fix(pool): clear pool_nonces on validator update to prevent nonce drift

[kariy]

The pool's TxValidator maintains an in-memory pool_nonces map that tracks the expected next nonce for each account as transactions are validated. This allows sequential transactions from the same sender to be validated without waiting for earlier ones to be committed on-chain. However, when update() is called after a block is mined — replacing the underlying state and block environment — pool_nonces was never cleared. This meant stale nonce values accumulated across block boundaries and could drift arbitrarily far ahead of the actual committed state nonce.

The drift happens naturally under normal operation. Each validated transaction increments pool_nonces[sender] by one. If, say, 978 transactions from the same account are validated between blocks, pool_nonces advances by 978. When the next block is produced and update() is called with the new post-block state, the committed state nonce reflects only the transactions that were actually executed in that block. But pool_nonces still holds the speculative value from validation. Over many blocks this gap compounds, especially under sustained load from a single account.

The consequence is that a new transaction whose nonce matches the drifted pool_nonces value passes the validator's nonce check (tx_nonce == current_nonce) and falls through to the blockifier for validation. The pool validator runs blockifier with strict_nonce_check = false (allowing account_nonce <= tx_nonce), so blockifier also accepts it since the real state nonce is lower than the transaction nonce. The transaction enters the pool as valid. When the block producer later picks it up and feeds it to the executor — which uses strict nonce checking (account_nonce == tx_nonce) — the executor rejects it with the error observed in production: Invalid transaction nonce of contract at address 0x4250...bccf. Account nonce: 0x27ed; got: 0x2bbf.

The fix is a single line: clear pool_nonces in update() after replacing the state. This forces the validator to re-derive nonces from the authoritative committed state for the next validation cycle, while pool_nonces is naturally rebuilt as new transactions arrive within the current block interval.

This PR also adds an early rejection for tx_nonce < current_nonce in the validator to fail fast before reaching blockifier, and includes two tests: one that verifies pool_nonces is properly cleared after update(), and an end-to-end test that exercises the full pool-to-executor pipeline reproducing the exact production error format.

🤖 Generated with Claude Code