feat(app): consume structured pushflip:* events in EventFeed (Pre-Mainnet 5.0.9 PR 2)

[RamirezAlex]

Replaces the state-diff event feed with an authoritative stream reconstructed from the on-chain pushflip:<kind>:... log lines every state-changing instruction emits (Pre-Mainnet 5.0.9 PR 1, deployed 2026-04-15 at tx 3i6KEFmMysL...). Three problems the diff-based hook couldn't solve: the feed wasn't authoritative (a second device saw a different log), it died on refresh (held only in React state), and it couldn't answer "what happened before I opened this tab?". All three are fixed here.

Client parser (clients/js/):

• New src/events.ts — framework-agnostic parseEventLog() + parseTransactionEvents() + GameEvent / GameEventKind types. Handles both the raw "Program log: pushflip:..." form as it appears in meta.logMessages and logsNotifications.value.logs, and the already-stripped form. Returns null for non-pushflip lines, unknown kinds, malformed k=v pairs, runtime "Program success" lines, CPI interleaved chatter.
• New src/events.test.ts — golden fixtures pinned verbatim to the 16 format strings in program/src/instructions/. 46 new cases covering all kinds (with + without the "Program log: " prefix), id composition, and negatives (SPL token CPI interleaved, runtime lines, unknown kind, truncated, malformed segment, empty key, empty tail, batched-instruction future case, blockTime=null). Client test count 35 → 81.
• src/index.ts re-exports the new public surface.

App (app/src/):

• New lib/event-render.ts — renderEventMessage(GameEvent) maps each of the 16 kinds to feed text. Pubkey hex → base58 via Kit's getAddressDecoder (HexPubkey on-chain emits lowercase hex; regex is case-insensitive as defense against a future format drift). Stake / pot / amount fields route through parseU64 rather than raw BigInt() — Lesson #42 applies even to program-authored strings; keeps the rule "no raw BigInt() on external input" uniform across the workspace. Exports explorerTxUrl + EVENT_CATEGORY (8-bucket palette keyed off Record<GameEventKind, ...> so adding a new kind without a case here is a compile error).
• Rewritten hooks/use-game-events.ts — drops diffGameSessions. Opens logsNotifications({mentions: [gamePda]}) FIRST, then kicks off backfill via getSignaturesForAddress({limit: 50})
  • getTransaction in concurrent batches of 10 (Promise.allSettled so a flaky RPC / 429 / pruned tx doesn't drop the whole batch; rejections logged and skipped). Merges into an id-keyed Map, sorts by (slot DESC, logIndex DESC), slices to MAX_EVENTS=200. Toast only live events — backfill inserts silently so a page load doesn't spray 50 toasts. Exposes isBackfilling so EventFeed can show skeletons. Subscribe-first ordering is load-bearing: opening in reverse would leave a silent gap between getSignaturesForAddress returning and the WebSocket connecting, dropping any event that fired in that window.
• components/game/event-feed.tsx — Explorer "tx" link per row (target="_blank" + rel="noopener noreferrer"), 4 skeleton rows during backfill, 8-category color palette replacing the previous 6 (16 kinds → coarse buckets: admin / lifecycle / deck / join-leave / hit / stay / burn / bounty). blockTime-aware timestamp with slot-number fallback for the rare null blockTime case (old / pruned blocks).

Design decisions worth flagging:

• blockTime semantics are "best-effort Unix seconds" — chain truth for backfilled rows (via getTransaction), wall-clock- on-arrival for live rows (the logsNotifications payload does NOT include blockTime, and an extra getBlockTime(slot) per live event isn't worth the RPC round-trip for log display). Documented inline on the GameEvent interface.
• logIndex is the position in the FULL logMessages array, not the position among pushflip matches — so event ids stay stable if future program changes add or remove surrounding CPI calls around the emission site.
• Sort key is (slot DESC, logIndex DESC), NOT Date.now(). Client mount time has no relation to backfill event time; a wall-clock sort would scramble the feed every page load.
• Promise.allSettled over Promise.all in the backfill loop: one rejected getTransaction shouldn't drop the other 9 in the batch. Rejections are logged via logError and the batch continues.

Known limitations (acceptable for now):

• Pre-existing lint errors on main (constants.ts noBarrelFile, use-faucet.ts trailing-comma format, no-publickey-in-hook-deps .grit format) are NOT in scope for this diff — confirmed on HEAD before this branch was cut.
• logsNotifications({mentions: [pda]}) support varies across RPC providers. The public devnet endpoint supports it (per Kit's typings overloading the filter variant). If a private RPC rejects, fallback is 'all' + client-side filter — a 3-line change in drainSubscription if it ever bites.
• RPC backfill returns up to 50 signatures. Games with deep history will truncate; the typical game tree is <20 events so this is comfortable for now.

Verified:

• pnpm --filter @pushflip/client test → 81/81 passing (was 35)
• pnpm --filter @pushflip/app typecheck clean
• pnpm --filter @pushflip/app lint clean on the 3 changed + 3 new files introduced by this diff
• pnpm --filter @pushflip/app build clean (~430 ms, same bundle size as before)
• pnpm --filter @pushflip/scripts exec tsc --noEmit clean
• pnpm --filter @pushflip/faucet typecheck clean
• pnpm --filter @pushflip/dealer test → 11/11 passing
• cargo check --all-targets clean (same pre-existing warnings, nothing new)

docs/EXECUTION_PLAN.md update recording PR 2 completion will land in a follow-up docs(plan) commit per the usual session- closing pattern, once this has had a devnet bake.

[georgedonnelly]

Nicely done! Good catch on that gap. Love the tests, thank you sir!