[droplister]

Cached block responses could hide a fork while Exchange advanced its checkpoint. This change makes Core reads fresh on retries and continuation pages, verifies each new header's actual parent, and restores mutable order, dispenser and pool rows from transactional before-images instead of reopening them by time.

The historical order audit also found an unhandled settlement event: Core emits ORDER_FILLED for completed BTC payments. Exchange now requests and applies it, preserves residual BTC quantities, and prunes stale deal listings even when a block contains only closures. ORDER_UPDATE replay uses the event's quantities and the lookup's divisibility metadata, so a newer current-state response cannot rewrite an earlier block's amounts. Missing metadata stops checkpoint advancement.

Order snapshot reconciliation now requires complete pagination, valid rows, explicit canonical closure statuses and an unchanged Bitcoin/ledger/messages anchor before any order write. A failed lookup no longer marks an order filled or zeroes its remaining amount. Snapshot batches are retryable; callers must still coordinate writers and establish a new verified undo baseline.

Read-only production audit at block 969885: 2,857 local open orders versus 2,864 canonical. Eleven creations from block 961106 are absent; four locally open orders are filled. The 2,853 shared orders match all 15 audited economic fields. Two stale BTC orders have dedicated ORDER_FILLED events at block 964435; the other two have filled ORDER_UPDATE events at block 963588. Current replay reproduces all three historical blocks correctly. The historical cause of the eleven omissions and other two stale rows is not established; these findings are not proof of reorg damage. All 64 shared orders with different Core heights/times were checked against their original OPEN_ORDER events and block headers; their stored inclusion heights and times are correct.

A separate, unexecuted cleanup proposal adds eleven orders, closes four, and corrects thirteen affected order-book summaries. Full current-open-set comparison, conflict refusal, restart/idempotence and scoped restoration were rehearsed locally. No production cleanup or deployment has been performed for Exchange.

Validation: 111 compiled API tests, local Worker D1 migration/trigger tests, three Vitest Worker tests, TypeScript and promise lint pass (existing lint warnings unchanged). Regressions use the canonical historical events and cover missing metadata, incomplete/repeated pagination, inconsistent statuses, malformed amounts, changed anchors and preservation of one-satoshi residual quantities.

Apply migration 0053 before deploying. Undo coverage starts at the deployment checkpoint and retains 24 blocks; older forks stop for a verified rebuild. The configured Core provider remains the protocol authority.