keeper: sweep-driven reconcile for stranded submit reservations - #586
Merged
Conversation
This was referenced Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds sweep-driven reconcile for stranded submit reservations to the keeper: a new
reconcileentry point walksJournal::pending, resolves eachRESERVED-but-not-COMMITTEDmarker against the venue idempotency-key contract, and commits or releases based on the answer. Exposes aReconcileReportandDEFAULT_RECONCILE_BUDGET, and re-exportspending()as an operator enumerate surface for poisoned or quarantined modules.Why
A reserve marker left by an accepted-but-commit-faulted submit is indistinguishable, without asking the venue, from one left by a crash or deadline-cancel mid-submit. Skipping it silently drops an order with no venue backstop; blindly resubmitting risks a duplicate. Neither is safe without a venue round-trip, so resolution belongs in the sweep, keyed on the reservation, not in a post-submit release call that no crash, trap, or OutOfFuel path ever reaches.
Testing
cargo fmt --all -- --check; cargo clippy --workspace --all-targets --all-features --locked -D warnings; cargo build --release --target wasm32-wasip2 --locked for all 16 guest modules plus a separate cow-venue adapter build (17 wasm artifacts, matching the expected count); cargo nextest run --workspace --all-features --no-fail-fast --locked; cargo test --doc --workspace --all-features --locked; RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --locked; scripts/check-venue-agnostic.sh; scripts/check-cow-orderbook-only.sh. All green, no stale-symbol matches.
AI Assistance
Implemented with Claude Code.
Closes #573