,
idle_poll_interval: Duration,
+ /// Write-before-broadcast hook (review R1a): the poster raises the
+ /// persisted wallet-nonce watermark through this before every send.
+ watermark_sink: crate::l1::watermark::StorageWatermarkSink,
}
impl {
pub fn new(db_path: impl Into , config: BatchSubmitterConfig) -> Self {
+ let db_path = db_path.into();
Self {
- db_path: db_path.into(),
+ watermark_sink: crate::l1::watermark::StorageWatermarkSink::new(db_path.clone()),
+ db_path,
poster,
idle_poll_interval: config.idle_poll_interval(),
}
@@ -137,6 +142,12 @@ impl {
loop {
let outcome = match self.tick_once().await {
Ok(o) => o,
+ // A wrong-chain RPC is terminal — never retry-loop signing onto
+ // it. Lift it out of the transient `Poster` bucket below.
+ Err(e @ BatchSubmitterError::Poster(BatchPosterError::ChainIdMismatch { .. })) => {
+ error!(error = %e, "RPC serves the wrong chain — refusing to submit");
+ return Err(e);
+ }
Err(BatchSubmitterError::Poster(source)) => {
error!(error = %source, "L1 provider error — will retry");
TickOutcome::Transient
@@ -180,7 +191,10 @@ impl {
}
let submitted_count = pending.len();
let payloads: Vec {
}
}
-/// Advance `expected` by greedily consuming any matching observed nonce.
-///
-/// `observed_nonces` is the stream of **batch nonces** (from the SSZ payload)
-/// decoded from `InputAdded` events sent by our batch-submitter EOA, in L1
-/// event order. Because L1 mines txs from a single EOA in strict wallet-nonce
-/// order, this stream is naturally gap-less at the wallet-nonce level:
-/// tx[k]'s event cannot appear on-chain without tx[k-1]'s event, and the
-/// observed batch nonce sequence therefore mirrors our submission order.
-///
-/// Batch nonces themselves (unlike wallet nonces) CAN repeat across recovery
-/// generations — e.g., after a cascade, a fresh batch reuses its invalidated
-/// predecessor's nonce. That's why we still match on equality rather than
-/// trusting a sort: in a post-recovery window, the same batch nonce can be
-/// observed twice (once from the invalidated generation, once from the new
-/// one), and we only want to advance once.
-///
-/// Under the wallet-nonce ordering above, once the next `expected` doesn't
-/// appear in the stream the frontier naturally stops advancing — the gap
-/// means the scheduler hasn't seen that nonce on-chain yet (or observed it at
-/// a different wallet nonce from an earlier generation).
-fn advance_expected_batch_nonce(
- mut expected: u64,
- observed_nonces: impl IntoIterator