feat(minter): snapshot the watchlist before every upgrade

[gregorydemay]

The watchlist of the automatic deposit flow of #272 lives on the heap and registrations are not recorded as events, so a new pre_upgrade hook records a snapshot of it on every upgrade, empty included, and replay restores the latest one. Covered by unit tests and a PocketIC test of a registration surviving an upgrade.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Snapshot events currently prevent binary rollback and can make event-query pages exceed response limits.

2 open findings

• New event variant makes upgrades unrevertible due to decoder panic · New
• Event-count pagination can exceed reply limits and trap replay · New

What changed in this PR

Persists the automatic-deposit watchlist across canister upgrades through event-log snapshots.

Changes:

• Adds watchlist snapshot serialization and replay.
• Records snapshots during pre_upgrade.
• Adds unit, Candid, and PocketIC coverage.

File	Description
minter/​src/​test_fixtures/​mod.rs	Generates snapshot events for property tests.
minter/​src/​state/​watchlist/​tests.rs	Tests snapshot reconstruction.
minter/​src/​state/​watchlist/​mod.rs	Implements snapshot and restoration.
minter/​src/​state/​tests.rs	Tests snapshot replay ordering.
minter/​src/​state/​mod.rs	Restores snapshots into state.
minter/​src/​state/​event/​candid/​mod.rs	Converts snapshot Candid types.
minter/​src/​state/​event.rs	Defines the persisted snapshot event.
minter/​src/​state/​audit.rs	Applies snapshot events during replay.
minter/​src/​main.rs	Registers the pre_upgrade hook.
minter/​src/​lifecycle/​tests.rs	Tests snapshot recording.
minter/​src/​lifecycle.rs	Records snapshots before upgrades.
minter/​cksol_minter.did	Exposes snapshot debug-event types.
libs/​types-internal/​src/​event.rs	Adds public event representations.
integration_tests/​tests/​tests.rs	Tests restoration across an upgrade.
integration_tests/​src/​fixtures.rs	Adds watchlist test constants.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The first production rollout loses registrations because the outgoing WASM cannot execute the newly added pre-upgrade hook.

3 open findings

• First rollout drops existing registrations without a migration snapshot · New
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Human confirmation is needed for the initial rollout, because the previously installed Wasm cannot execute this newly added hook.

3 open findings

• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

Snapshot recording, serialization, replay, and upgrade behavior are consistently implemented and tested.

3 open findings

• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The initial rollout loses existing registrations, and recorded snapshot events prevent rollback to the preceding Wasm.

3 open findings

• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The mandatory new event makes rollback to any binary lacking tag 15 impossible without a documented recovery strategy.

3 open findings

• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

No blocking issues were identified in snapshot persistence, replay, interface changes, or the added test coverage.

3 open findings

• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The first rollout needs human validation because an installed version without this hook cannot snapshot any existing heap registrations.

3 open findings

• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Event-page response sizes remain unbounded, and registration preservation during the first rollout is unverified.

4 open findings

• get_events pages can exceed the IC 2 MiB response limit · New
• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The first rollout needs human validation because preservation of existing registrations depends on the previously installed version’s pre-upgrade behavior.

4 open findings

• get_events pages can exceed the IC 2 MiB response limit
• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Human validation is needed to establish replay instruction-budget headroom as populated snapshots accumulate across upgrades.

4 open findings

• get_events pages can exceed the IC 2 MiB response limit
• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Accumulated snapshot replay costs need validation before approving this mainnet persistence change.

4 open findings

• get_events pages can exceed the IC 2 MiB response limit
• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

No blocking defects were identified, but mainnet persistence changes warrant human upgrade validation.

4 open findings

• get_events pages can exceed the IC 2 MiB response limit
• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Initial rollout needs human validation because an outgoing version without this hook cannot snapshot existing heap-only registrations.

4 open findings

• get_events pages can exceed the IC 2 MiB response limit
• First rollout drops existing registrations without a migration snapshot
• Event-count pagination can exceed reply limits and trap replay
• New event variant makes upgrades unrevertible due to decoder panic

🧠 Review effort: Balanced