@subsquid/ponder 0.16.7-sqd.1

@subsquid/ponder@0.16.7-sqd.1

ponder@0.16.7 + the SQD Portal backfill layer, drop-in (bin stays ponder). This is the
first cut on ponder@0.16.7 and the newest ponder version in the fork, so it installs by
default. It carries the same Portal layer as 0.16.6-sqd.2 — the full invariant-first
re-architecture and correctness wave — grafted onto ponder@0.16.7.

Install: npm i @subsquid/ponder, or pin exact: npm i @subsquid/ponder@0.16.7-sqd.1.

Highlights

• Silent-gap / phantom-coverage elimination. The known paths that could mark a block range
  "synced" without actually delivering its data now fail loud (or retry) instead of recording
  phantom coverage. This covers the
  unbounded-source backfill floor (a source with no fromBlock starts at genesis, not at the
  min of the defined floors — INV-16), head-truncated frontier chunks (extended before being
  served, never served stale — INV-13), a bounded backfill whose toBlock runs past the
  finalized head (head-clamped, not phantom-covered — INV-9/INV-13), and the mid-range
  /finalized-stream 204: a load-balanced replica serving only part of a requested range and
  204-ing the tail is now a transient incomplete-range that retries on a fresher replica or
  fails loud, never recorded as clean completion (issue #47).
• Bounded time-to-first-durable-commit. The finalized-range fetch starts from a small warmup
  span and grows geometrically, and on a restart resumes from the persisted watermark, so a dense
  or wide-range source lands its first durable commit promptly instead of blocking on a full-range
  scan — regardless of range size; discovery follows the same geometric slow-start on the
  watermark-following path (#50).
• Stream-realtime correctness + reorg handling. The unfinalized window is kept
  strictly-increasing and parent-hash-linked; an unknown-parent gap is fatal (never a silent
  fork switch), finality is verified by hash at the exact probe height, and a 1-block tip
  orphan heals via the Portal's HTTP 409 fork-negotiation protocol instead of fataling
  (issue #33). Same-block factory-child log redelivery is reconciled without dropping or
  duplicating blocks (INV-10).
• Factory / account-source coverage. Discovered factory children are persisted to the sync
  store in the same transaction that marks the interval synced — including on the RPC
  finality-delegation path — so a restart never silently drops a factory's events
  (INV-15), with write-side idempotence so a re-flush never durably duplicates rows (INV-17).
  Every transaction matched by a tx filter gets a receipt inserted (account sources).
• Invariant-first architecture. portal/ is a pure functional core behind an imperative
  shell; 18 named invariants (INV-1…INV-18, portal/INVARIANTS.md) are asserted at runtime and
  proven by property-based + regression tests. A violation is a loud InvariantViolation, not
  silent corruption.

Portal layer

• Backfill / transform (portal.ts, portal-transform.ts, portal-client.ts,
  portal-chunks.ts, portal-discovery.ts, portal-filters.ts, portal-assemble.ts): the
  chunked finalized-range fetch, discovery-before-data ordering (INV-3), interval-exact
  assembly (INV-2), full-tree trace ranking (INV-5), request merging (INV-11), AIMD concurrency
  control + bounded buffered rows (INV-7/INV-8), and byte-identical RPC-shape transforms
  (INV-6).
• Realtime wiring (portal-realtime.ts, portal-realtime-wire.ts): finalized-stream resume
  with parentBlockHash, 409 fork negotiation, reorg reconciliation, and the
  historical→realtime cutover guard (portal-cutover-guard.ts) that skips the refetch for
  end-capped chains (INV-18).
• Wiring patch: portal/wiring/0.16.7.patch. The runtime/historical.ts cutover hunks are
  byte-identical to the 0.16.6 patch; the patch applies cleanly (zero rejects) because the
  grafted seam — HistoricalSync.syncBlockRangeData / syncBlockData, interval-scoped — is
  identical in shape from 0.15.17 through 0.16.7. 0.16.6 → 0.16.7 is a single upstream
  DB-layer change (live-query notification batching, ponder-sh/ponder#2314) that touches none
  of the graft surfaces.

Fixes

The Portal-layer correctness fixes since the first fork cuts, grouped by theme:

• Silent-gap / phantom-coverage: genesis backfill floor for unbounded sources (#8, #10),
  head-truncated frontier extension (#5), zero-line-200 gap (#66), bounded-backfill head clamp
  and stream-mode delegation fatals (#44), and the mid-range 204 transient-incomplete-range
  close (#47).
• Stream-realtime + reorg: same-block child logs, finality anchor, reorg prune, head pin,
  parent txs (#26); parentBlockHash on /stream resume + 1-block-orphan 409 healing (#33);
  stream-mode finality floor at persisted finality (restart regression); omnichain
  foreign-checkpoint timestamp mapping (#57); and the bounded historical→realtime cutover skip
  (INV-18).
• Factory / account-source coverage: persist discovered factory children (#2), flush on the
  RPC-delegation path + survive core's transaction retry (INV-15), write-side idempotence
  (#53), the factory-range gate pin (#21), and a receipt for every tx-filter-matched
  transaction (#24); the extend-path needed-field fatal scoped to a genuine per-filter need — no
  false-fatal on client-unmatched traces (#20) or a shared filter's receipt requirement (#94).
• Liveness / bounded warmup: bounded time-to-first-durable-commit — the finalized-range
  fetch (and the watermark-following discovery scan) start from a small warmup span and grow
  geometrically, resume-seeded from the persisted watermark on restart (#50).
• HTTP-client hardening: retry truncated response bodies + loud dataset-start skips (#25),
  fail loud when a provider omits accessList on typed transactions (#27), and zero-backoff /
  timeout hardening (#9 follow-ups, #16).
• Invariant-first re-architecture: functional core + imperative shell (#6), with the
  head-clamp / discovery-floor / trace-receipt correctness wave (#15) folded in.

Compatibility

• Built + tested against ponder@0.16.7. The full Portal property/regression suite is green:
  302/302 across ponder@0.15.17, ponder@0.16.6, and ponder@0.16.7
  (scripts/sync-upstream.sh <ver> --test).
• The dense-source / factory-child discovery paths are additionally re-accepted under a Poisson
  kill/resume chaos campaign: the store stays
  logically byte-identical to a clean baseline across 33 verified resumes with zero invariant
  violations (VALIDATION.md §4.4).
• Seam verified against: 0.16.7, 0.16.6, 0.15.17 (compat.tested). The seam is stable
  and identical in shape across 0.15.17 – 0.16.7.