[droplister]

A cached rolling probe could miss a fork after advancing to a newer block, and an interrupted index pass could leave derived data ahead of its checkpoint. Reads now use fresh URLs, verification revisits the retained checkpoint after downtime, and durable recovery markers keep incomplete rollback/replay work pending. Missing proof or no common ancestor pauses indexing.

Bitcoin block hashes supplement ledger/messages hashes. Complete, tip-fenced order snapshots remove absent rows and restore canonical fields, including non-expiring orders. Core's order block_index can reflect a later status update, so it is not treated as independent proof of Bitcoin inclusion. Recovery also rewinds partial trade writes, invalidates book digests, and rechecks refunded launches while preserving announcement and payment history.

The historical audit also found same-block candle opens/closes reversed because raw venue feeds arrive newest-first. Candles now use the merged trades' transaction/event indexes. Regressions reproduce HONDACIVIC block 965496, multi-event transactions, mixed venues and unchanged re-reads.

Validation: full npm run check passed: 1,445 Vitest tests, 17 render-read tests, web/API types and lint, numeric discipline and translations. The read-only production audit found complete launch/mint/order/trade/burn identity sets and matching economic quantities. All 233 reward entitlements and 76 confirmed payment transactions matched. It identified 258 historical candle open/close corrections; none were applied. Legacy missing ordering metadata and mutable order-height differences are documented separately in docs/reorg-recovery.md.

Apply migration 0041 before deployment. Retained checkpoint history is 144 blocks; deeper or unverifiable forks stop for recovery. Reads can observe partial index progress during a pass. The configured Core node remains the protocol authority. Historical cleanup requires a separate reviewed, guarded repair after the preventive fix is deployed.