[j0sh]

Depends on #41. Merge after that PR.

Known payers use immutable cached collateral at the shared observation. A bounded hash-linked history proof keeps unchanged payers warm across canonical polling gaps; incomplete history resets entries for pinned rereads. Funding, withdrawal, reserve, round and Controller target changes invalidate the affected entries, including upgrades with unchanged public proxy addresses.

Cold reads share work by payer/recipient and have a global four-key limit with no distinct-key queue. Cancellation, eviction, failures and shutdown preserve those bounds. A durable settlement watermark is recorded with liability release and checked inside admission, preventing pre-settlement collateral from being paired with released liability.

Retains recipient-specific reserve/withdrawal semantics, replay guards, durable acknowledgement and redemption protections. Shared implementation and tests retain source attribution.

Validation: affected and full repository race suites, vet, canonicality/financial/recovery regressions and diff checks passed on the final reviewed series.

Closes #33.

[Copilot]

🔵 Needs a closer look

Missing definitions, dependencies, and test fixtures prevent compilation, while the watcher remains disconnected from the payment path and has unresolved critical cache-correctness issues.

17 open issues

• Undefined test fixtures prevent compilation
• Store removed-round refresh results back in the cache
• Isolate removed-round reread failures per cache entry
• Guard missing cache entries before emitting metrics
• Invalidate collateral and claims before removed-log recovery
• Keep unknown claim totals uncached until a full lookup
• Send event notifications after releasing the cache lock
• Process block and round events in canonical order
• Invalidate cached state when event delivery fails
• Return and store copies of claimed reserve values
• Include claimant in cache keys and recipient-specific updates
• Reconcile cold reads with canonical event updates
• Return deep copies to protect cached sender info
• Missing watcher interfaces and support prevent compilation
• Bound cache growth with capacity and idle eviction
• Cold reads lack deduplication, limits, and cancellation
• Cache is not connected to the payment observation path

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Two critical issues can admit unfunded tickets: reverted receipts release liability without advancing the collateral watermark, and later round initialization fails to invalidate cached collateral.

19 open issues

• Invalidate cached collateral when the initialized round changes · New
• Reverted liability releases must advance the collateral watermark · New
• Undefined test fixtures prevent compilation
• Store removed-round refresh results back in the cache
• Isolate removed-round reread failures per cache entry
• Guard missing cache entries before emitting metrics
• Invalidate collateral and claims before removed-log recovery
• Keep unknown claim totals uncached until a full lookup
• Send event notifications after releasing the cache lock
• Process block and round events in canonical order
• Invalidate cached state when event delivery fails
• Return and store copies of claimed reserve values
• Include claimant in cache keys and recipient-specific updates
• Reconcile cold reads with canonical event updates
• Return deep copies to protect cached sender info
• Missing watcher interfaces and support prevent compilation
• Bound cache growth with capacity and idle eviction
• Cold reads lack deduplication, limits, and cancellation
• Cache is not connected to the payment observation path

_{Review effort: Balanced}