feat: replay every canonical V3 pool event from the subscription (0.3.0-alpha.9)

[KaiCode2]

Two changes that only make sense together: canonical logs now arrive over the WebSocket instead of a per-block fetch, and every canonical Uniswap V3 pool event now replays into exact state instead of purging the pool.

Requires evm-fork-cache 0.4.0-alpha.5.

Canonical logs from the subscription

The driver discarded every log the WebSocket delivered and re-fetched the same set over hash-pinned eth_getLogs, once per canonical block. The documented rationale conflated ordering — solvable locally, since logs carry block hash, number, transaction index and log index — with completeness, which genuinely was not, because a punctured subscription looked identical to a whole one.

A block seals from the subscription only on a proof that its log set is closed, and only two things count:

1. a log delivered on the log subscription for a strictly later block; or
2. the block's logsBloom excluding every registered interest — a bloom admits false positives and never false negatives, so exclusion positively proves there is no matching log to wait for.

Anything unproven reconciles exactly as before. CanonicalLogSource::Reconcile restores the old behaviour outright.

A header for a later block is deliberately not a proof: newHeads and logs are independent subscriptions. Nor is a timer. The straggler window is retained but now bounds how long the driver waits for a proof rather than authorising it to publish whatever has arrived.

Exact canonical V3 event replay

Mint, Burn, Collect, Flash, SetFeeProtocol, CollectProtocol and IncreaseObservationCardinalityNext previously returned a whole-storage purge, which zeroed slot0 and left the pool reverting LOK on every quote until a full rebuild completed. They now replay exactly: both boundary ticks through Tick.update/Tick.clear, the bitmap words they flip, the oracle entry an in-range change writes, and active liquidity.

A boundary tick's Tick.Info words are read only when its bitmap bit is set — a clear bit proves the struct is zero, so a mint opening a brand-new position needs no tick read at all, which matters because cold start warms bitmap words but not empty ticks. Where the parent holds a word anyway the inference is cross-checked both ways and a disagreement fails closed.

A boundary tick outside the warmed radius is unknown rather than contradicted, and costs a five-slot targeted resync instead of the pool. Initialize remains a fail-closed purge: a pool being initialised wants a cold start.

Verification against mainnet

The just-in-time liquidity block 25,673,790 on Ethereum BIFI/WETH (Swap, Mint, Swap, Burn, Collect, Swap) replays all six logs exactly, compared per transaction against the node's own debug_traceTransaction prestateTracer(diffMode=true) diff — no repair, no purge, no provider read. Both quote directions then match the deployed QuoterV2 on amountOut and sqrtPriceX96After across seven initialized-tick crossings.

Two 70-minute three-chain dry-runs against the published alphas:

	published	this branch
eth_getLogs	4,525	692
total JSON-RPC	7,893	4,544
quote-canary rejections	1	2

Breaking

• AmmSubscriberDriverConfig gains canonical_log_source.
• AmmSubscriberDriverStats is new.
• Requires evm-fork-cache 0.4.0-alpha.5, whose checkpoint-format bumps mean existing checkpoints are rejected and must be rebuilt.

Release ordering — please read before merging

Cargo.lock still names evm-fork-cache 0.4.0-alpha.4 while the manifest pins =0.4.0-alpha.5. A tracked lockfile cannot record a checksum for an unpublished version, and the alternative was committing an unpublishable path entry. RELEASING.md documents the sequence: publish fork-cache alpha.5, run cargo update -p evm-fork-cache, then publish this crate. CI --locked will not resolve until that step.

Verification

fmt, clippy -D warnings, tests green across the feature matrix and all seven isolated per-adapter configs, on nightly, stable, and MSRV 1.90.0.