@totalreclaw/totalreclaw 3.3.12-rc.9 → 3.3.12

package/dist/subgraph-store.js

@@ -2,12 +2,13 @@
  * Subgraph store path — writes facts on-chain via ERC-4337 UserOps.
  *
  * Used when the managed service is active (TOTALRECLAW_SELF_HOSTED is not
- * "true"). Replaces the HTTP POST to /v1/store with an on-chain transaction
+ * "true"). Replaces the HTTP request to /v1/store with an on-chain transaction
  * flow.
  *
- * Uses @totalreclaw/core WASM for calldata encoding, UserOp hashing, and
- * ECDSA signing. Raw fetch() for all JSON-RPC calls to the relay bundler
- * and chain RPCs. No viem, no permissionless.
+ * Uses @totalreclaw/core WASM for calldata encoding and UserOp hashing;
+ * `signUserOp` (ECDSA) lives in `vault-crypto.ts`. All JSON-RPC calls to
+ * the relay bundler and chain RPCs go through `relay.ts` (the plugin's
+ * single network site). No viem, no permissionless.
  */
 // Lazy-load WASM via createRequire — the shipped bundle is ESM-only and
 // the bare `require` global is undefined there (issue #124). Same pattern
@@ -20,51 +21,10 @@ function getWasm() {
         _wasm = requireWasm('@totalreclaw/core');
     return _wasm;
 }
-import { CONFIG } from './config.js';
+import { CONFIG, getDataEdgeAddressOverride } from './config.js';
 import { buildRelayHeaders } from './relay-headers.js';
-// ---------------------------------------------------------------------------
-// Pimlico 429 retry helper
-// ---------------------------------------------------------------------------
-/**
- * Wrap a fetch-based JSON-RPC call with exponential backoff for HTTP 429
- * (rate limit) responses from Pimlico. Max 5 retries with 5s base delay,
- * doubling each attempt, capped at 60s, plus random jitter (0-1000ms).
- * Total retry window: ~135s (5+10+20+40+60 plus jitter).
- * All other HTTP errors throw immediately.
- */
-async function rpcWithRetry(url, headers, method, params) {
-    const maxRetries = 5;
-    const baseDelay = 5000; // 5 seconds
-    const maxDelay = 60_000; // 60 seconds cap
-    const body = JSON.stringify({ jsonrpc: '2.0', id: 1, method, params });
-    for (let attempt = 1; attempt <= maxRetries + 1; attempt++) {
-        const resp = await fetch(url, { method: 'POST', headers, body });
-        if (resp.ok) {
-            const json = await resp.json();
-            if (json.error) {
-                // Check if the RPC-level error message indicates a rate limit
-                if (attempt <= maxRetries && /429|rate limit/i.test(json.error.message)) {
-                    const delay = Math.min(Math.pow(2, attempt - 1) * baseDelay, maxDelay) + Math.floor(Math.random() * 1000);
-                    console.error(`Pimlico rate limited, retrying in ${delay}ms (attempt ${attempt}/${maxRetries})...`);
-                    await new Promise(r => setTimeout(r, delay));
-                    continue;
-                }
-                throw new Error(`RPC ${method}: ${json.error.message}`);
-            }
-            return json.result;
-        }
-        // HTTP-level 429 — retry with backoff
-        if (resp.status === 429 && attempt <= maxRetries) {
-            const delay = Math.min(Math.pow(2, attempt - 1) * baseDelay, maxDelay) + Math.floor(Math.random() * 1000);
-            console.error(`Pimlico rate limited, retrying in ${delay}ms (attempt ${attempt}/${maxRetries})...`);
-            await new Promise(r => setTimeout(r, delay));
-            continue;
-        }
-        throw new Error(`Relay returned HTTP ${resp.status} for ${method}`);
-    }
-    // Should not be reached, but satisfies TypeScript
-    throw new Error(`RPC ${method}: max retries exceeded`);
-}
+import { rpcRequest, rpcWithRetry } from './relay.js';
+import { signUserOp } from './vault-crypto.js';
 /** Legacy protobuf wrapper schema version (v0/v1-binary inner blob). */
 export const PROTOBUF_VERSION_LEGACY = 3;
 /** Memory Taxonomy v1 protobuf wrapper schema version. */
@@ -116,9 +76,12 @@ function getDefaultRpcUrl(chainId) {
         case 100:
             return 'https://rpc.gnosischain.com';
         case 84532:
+            // Retained for the legacy Base Sepolia chain id, but after ops-1 nothing
+            // should resolve here — the relay's authoritative chain_id is 100 (#402).
             return 'https://sepolia.base.org';
         default:
-            return 'https://sepolia.base.org';
+            // Unknown chain id → Gnosis mainnet (after ops-1 default), NOT Base Sepolia.
+            return 'https://rpc.gnosischain.com';
     }
 }
 // ---------------------------------------------------------------------------
@@ -132,7 +95,9 @@ function getDefaultRpcUrl(chainId) {
  */
 export async function deriveSmartAccountAddress(mnemonic, chainId) {
     const eoa = getWasm().deriveEoa(mnemonic);
-    const resolvedChainId = chainId ?? 84532;
+    // Default to Gnosis mainnet (100) after ops-1 — the SA address is CREATE2 and
+    // byte-equal across chains, but the RPC we query must be the live one (#402).
+    const resolvedChainId = chainId ?? 100;
     // SimpleAccountFactory.getAddress(address owner, uint256 salt) — view function
     // Selector: 0x8cb84e18 = keccak256("getAddress(address,uint256)")[0:4]
     const factoryAddress = getWasm().getSimpleAccountFactory();
@@ -141,17 +106,12 @@ export async function deriveSmartAccountAddress(mnemonic, chainId) {
     const selector = '8cb84e18';
     const calldata = `0x${selector}${ownerPadded}${saltPadded}`;
     const rpcUrl = CONFIG.rpcUrl || getDefaultRpcUrl(resolvedChainId);
-    const response = await fetch(rpcUrl, {
-        method: 'POST',
+    const json = await rpcRequest({
+        url: rpcUrl,
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'eth_call',
-            params: [{ to: factoryAddress, data: calldata }, 'latest'],
-        }),
+        method: 'eth_call',
+        params: [{ to: factoryAddress, data: calldata }, 'latest'],
     });
-    const json = await response.json();
     if (json.error) {
         throw new Error(`Failed to resolve Smart Account address: ${json.error.message}`);
     }
@@ -162,16 +122,61 @@ export async function deriveSmartAccountAddress(mnemonic, chainId) {
     return `0x${json.result.slice(-40)}`.toLowerCase();
 }
 // ---------------------------------------------------------------------------
-// Smart Account deployment check (with session cache)
+// Smart Account deployment check
 // ---------------------------------------------------------------------------
+//
+// NOTE on the removed session cache (2026-06-28, AA10 fix):
+//
+// A module-level `Set<string>` of "already deployed" accounts used to skip
+// the `eth_getCode` RPC after the first successful submission. That cache
+// was the single largest source of AA10 "sender already constructed"
+// failures in production:
+//
+//   - A process restart emptied the cache → the next submission relied on
+//     ONE `eth_getCode` read that could return stale `0x` from a lagging
+//     RPC node (the deploy tx was mined but the node hadn't caught up) →
+//     initCode was re-added → the EntryPoint rejected with AA10.
+//   - A receipt poll that timed out (success undetected within the 120s
+//     window) left the cache unpopulated → the next submission hit the
+//     same stale-`eth_getCode` path → AA10.
+//   - The AA25 retry path (`deployedAccounts.delete(...)`) existed ONLY to
+//     paper over the cache; with no cache there is nothing to invalidate.
+//
+// Fix: `getInitCode` calls `eth_getCode` on EVERY invocation. The
+// per-sender submission mutex (`withSenderLock`) already serializes
+// submissions per account, so the extra RPC cannot introduce a nonce
+// race. The cost is one extra RPC read per submission — negligible
+// against a relay round-trip — and the behavior is correct by
+// construction: the plugin asserts on-chain state at submit time rather
+// than trusting an in-memory guess that can be invalidated by anything
+// the plugin doesn't observe (relayer retries, parallel clients, node
+// reorgs, process restarts).
 /**
- * Session-level cache for account deployment status.
- * Once an account is deployed (first successful UserOp), we skip the
- * eth_getCode check and omit factory/factoryData for all subsequent calls.
- * This prevents AA10 "duplicate deployment" errors when multiple facts
- * are stored in rapid succession for a first-time user.
+ * Test-only RPC probe counter. Incremented each time `getInitCode` issues
+ * an `eth_getCode` read. The lifecycle test uses this to assert the cache
+ * is truly gone (every call hits the wire). Not part of the public API.
  */
-const deployedAccounts = new Set();
+let _ethGetCodeProbeCount = 0;
+/** Test-only seam: drive the private `getInitCode` logic. */
+export async function __getInitCodeForTests(sender, eoaAddress, rpcUrl) {
+    return getInitCode(sender, eoaAddress, rpcUrl);
+}
+/** Test-only seam: read the RPC probe counter. */
+export function __getRpcProbeCountForTests() {
+    return _ethGetCodeProbeCount;
+}
+/** Test-only seam: reset the RPC probe counter. */
+export function __resetRpcProbeCountForTests() {
+    _ethGetCodeProbeCount = 0;
+}
+/**
+ * Test-only seam: previously reset the deployment cache. The cache was
+ * removed in the AA10 fix; this function is retained as a no-op so the
+ * lifecycle test (and any future test that imports it) doesn't break.
+ */
+export function __resetDeployedAccountsForTests() {
+    /* no-op: session cache removed; getInitCode always re-checks eth_getCode */
+}
 // ---------------------------------------------------------------------------
 // Per-account submission mutex — 3.3.1-rc.3 AA25 serialization
 // ---------------------------------------------------------------------------
@@ -233,30 +238,72 @@ async function withSenderLock(sender, fn) {
 export function __resetSenderLocksForTests() {
     _senderSubmissionLocks.clear();
 }
+// ---------------------------------------------------------------------------
+// Test-only WASM mock seams (AA10 submit-path retry test)
+// ---------------------------------------------------------------------------
+/**
+ * Test-only seam: inject a mock WASM module.
+ *
+ * The AA10 submit-path retry test needs to drive the real submitFactBatchOnChain
+ * while controlling WASM behavior (deriveEoa, encodeBatchCall, hashUserOp,
+ * signUserOp, getEntryPointAddress). This seam swaps the module-level _wasm
+ * reference so the test can provide stubs.
+ *
+ * MUST be followed by __clearWasmForTests() in teardown.
+ */
+export function __setWasmForTests(mock) {
+    _wasm = mock;
+}
+/**
+ * Test-only seam: restore the real WASM module.
+ *
+ * Clears a test-injected mock WASM and resets the module to null so the next
+ * getWasm() call reloads the real @totalreclaw/core.
+ */
+export function __clearWasmForTests() {
+    _wasm = null;
+}
 /**
  * Check if a Smart Account is deployed and return factory/factoryData if not.
  *
- * For ERC-4337 v0.7, undeployed accounts need `factory` and `factoryData`
- * in the UserOp so the EntryPoint can deploy them during the first transaction.
+ * For ERC-4337 v0.7, undeployed (counterfactual) accounts need `factory`
+ * and `factoryData` in the UserOp so the EntryPoint deploys the SA + runs
+ * signature validation in one transaction.
+ *
+ * Re-checks `eth_getCode` on EVERY call — no session cache. The previous
+ * in-memory cache was the source of AA10 "sender already constructed"
+ * errors: it could be stale (process restart, missed receipt, lagging RPC
+ * node) and re-add initCode to a UserOp whose sender was already
+ * constructed. Each submission now pays one extra RPC read to assert the
+ * on-chain deployment state at submit time, which is the only source of
+ * truth the EntryPoint will enforce. See the note above on the removed
+ * cache for the full failure taxonomy.
  */
 async function getInitCode(sender, eoaAddress, rpcUrl) {
-    // Session cache: if we already deployed this account, skip the RPC check
-    if (deployedAccounts.has(sender.toLowerCase())) {
-        return { factory: null, factoryData: null };
-    }
-    // Check if the Smart Account contract is deployed
-    const codeResp = await fetch(rpcUrl, {
-        method: 'POST',
+    // Check if the Smart Account contract is deployed. Always re-read — never
+    // cache. The per-sender submission mutex serializes calls for the same
+    // account, so this cannot race a nonce fetch.
+    _ethGetCodeProbeCount++;
+    const codeJson = await rpcRequest({
+        url: rpcUrl,
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            jsonrpc: '2.0', id: 1, method: 'eth_getCode',
-            params: [sender, 'latest'],
-        }),
+        method: 'eth_getCode',
+        params: [sender, 'latest'],
     });
-    const codeJson = await codeResp.json();
-    const isDeployed = codeJson.result && codeJson.result !== '0x' && codeJson.result !== '0x0';
+    // A JSON-RPC error envelope (e.g. a rate-limited public RPC) or a
+    // non-string result is NOT evidence the account is undeployed. Treat it as
+    // a hard failure and throw — otherwise we would attach initCode to a
+    // possibly-deployed sender, guaranteeing AA10 "sender already constructed"
+    // at the paymaster. The thrown error propagates to the submit retry-loop
+    // catch; it does not match the AA25/AA10 regex, so it fails fast with an
+    // accurate message rather than poisoning a UserOp. Only a literal '0x' /
+    // '0x0' result means "not deployed" (#402).
+    const codeResult = codeJson.result;
+    if (codeJson.error || typeof codeResult !== 'string') {
+        throw new Error('eth_getCode failed: ' + (codeJson.error?.message || 'no result'));
+    }
+    const isDeployed = codeResult !== '0x' && codeResult !== '0x0';
     if (isDeployed) {
-        deployedAccounts.add(sender.toLowerCase());
         return { factory: null, factoryData: null };
     }
     // Account not deployed — build factory + factoryData for first-time deployment.
@@ -270,7 +317,7 @@ async function getInitCode(sender, eoaAddress, rpcUrl) {
     return { factory, factoryData };
 }
 // ---------------------------------------------------------------------------
-// On-chain submission (ERC-4337 UserOps via raw fetch)
+// On-chain submission (ERC-4337 UserOps via relay.ts network site)
 // ---------------------------------------------------------------------------
 /**
  * Submit a fact on-chain via ERC-4337 UserOp through the relay server.
@@ -281,7 +328,7 @@ async function getInitCode(sender, eoaAddress, rpcUrl) {
  * 3. UserOp hashing (ERC-4337 v0.7)
  * 4. ECDSA signing (EIP-191 prefixed)
  *
- * All JSON-RPC calls go through raw fetch() to the relay bundler endpoint.
+ * All JSON-RPC calls go through `relay.ts` to the relay bundler endpoint.
  */
 export async function submitFactOnChain(protobufPayload, config) {
     if (!config.relayUrl) {
@@ -309,18 +356,25 @@ async function submitFactOnChainLocked(protobufPayload, config, eoa, sender) {
     const headers = buildRelayHeaders(overrides);
     // Helper for JSON-RPC calls to relay bundler (with 429 retry)
     async function rpc(method, params) {
-        return rpcWithRetry(bundlerUrl, headers, method, params);
+        return rpcWithRetry({ url: bundlerUrl, headers, method, params });
     }
     const entryPoint = config.entryPointAddress || getWasm().getEntryPointAddress();
-    // 2. Encode calldata (SimpleAccount.execute → DataEdge fallback)
-    const calldataBytes = getWasm().encodeSingleCall(protobufPayload);
+    // 2. Encode calldata (SimpleAccount.execute → DataEdge).
+    // Target the resolved DataEdge address (env → relay billing → WASM default,
+    // per getSubgraphConfig / #462) so writes land on the SAME contract the
+    // relay reads from. The legacy `encodeSingleCall` bakes the PROD DataEdge,
+    // which stranded staging writes on prod (#460). Guard: an empty address
+    // (config built without getSubgraphConfig) falls back to the legacy encoder
+    // — behavior-identical to before, and avoids `encodeSingleCallTo` throwing
+    // on a bad address.
+    const calldataBytes = config.dataEdgeAddress
+        ? getWasm().encodeSingleCallTo(protobufPayload, config.dataEdgeAddress)
+        : getWasm().encodeSingleCall(protobufPayload);
     const callData = `0x${Buffer.from(calldataBytes).toString('hex')}`;
     // 3. Get gas prices from Pimlico
     const gasPrices = await rpc('pimlico_getUserOperationGasPrice', []);
     const fast = gasPrices.fast;
     const rpcUrl = config.rpcUrl || CONFIG.rpcUrl || getDefaultRpcUrl(config.chainId);
-    // 4. Check if Smart Account is deployed (needed for factory/factoryData)
-    const { factory, factoryData } = await getInitCode(sender, eoa.address, rpcUrl);
     // 5. Get nonce from EntryPoint via bundler RPC.
     //    Routing through the bundler lets Pimlico account for pending mempool
     //    UserOps, preventing AA25 nonce conflicts on rapid submissions.
@@ -330,85 +384,51 @@ async function submitFactOnChainLocked(protobufPayload, config, eoa, sender) {
     const senderPadded = sender.slice(2).toLowerCase().padStart(64, '0');
     const keyPadded = '0'.repeat(64);
     const nonceCalldata = `0x35567e1a${senderPadded}${keyPadded}`;
-    let nonce;
-    try {
-        const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-        nonce = nonceResult || '0x0';
-    }
-    catch {
-        // Fallback to public RPC if bundler doesn't support eth_call
-        const nonceResp = await fetch(rpcUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                jsonrpc: '2.0', id: 1, method: 'eth_call',
+    // Helper to fetch nonce (with bundler fallback)
+    async function fetchNonce() {
+        try {
+            const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
+            return nonceResult || '0x0';
+        }
+        catch {
+            // Fallback to public RPC if bundler doesn't support eth_call
+            const nonceJson = await rpcRequest({
+                url: rpcUrl,
+                headers: { 'Content-Type': 'application/json' },
+                method: 'eth_call',
                 params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-            }),
-        });
-        const nonceJson = await nonceResp.json();
-        nonce = nonceJson.result || '0x0';
-    }
-    // 6. Build unsigned UserOp (v0.7 fields, camelCase for Rust JSON serde)
-    const unsignedOp = {
-        sender,
-        nonce,
-        callData,
-        callGasLimit: '0x0',
-        verificationGasLimit: '0x0',
-        preVerificationGas: '0x0',
-        maxFeePerGas: fast.maxFeePerGas,
-        maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
-        signature: DUMMY_SIGNATURE,
-    };
-    if (factory) {
-        unsignedOp.factory = factory;
-        unsignedOp.factoryData = factoryData;
+            });
+            return nonceJson.result || '0x0';
+        }
     }
-    // 7. Get paymaster sponsorship (fills gas limits + paymaster fields)
-    const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
-    Object.assign(unsignedOp, sponsorResult);
-    // 8. Hash and sign the UserOp via WASM
-    const opJson = JSON.stringify(unsignedOp);
-    const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
-    const sigHex = getWasm().signUserOp(hashHex, eoa.private_key);
-    unsignedOp.signature = `0x${sigHex}`;
-    // 9. Submit the signed UserOp (with AA25 nonce conflict retry)
+    // Track force-deployed senders for AA10 retry (local to this submission attempt)
+    const forceDeployed = new Set();
+    // Single retry loop: getInitCode → build UserOp → sponsor → sign → send
+    // On AA10 "sender already constructed", mark sender as force-deployed and retry.
+    // AA10 can occur at pm_sponsorUserOperation (initCode present on deployed sender)
+    // or eth_sendUserOperation (same root cause). This loop handles both.
     let userOpHash;
-    try {
-        userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
-    }
-    catch (err) {
-        const msg = err?.message || '';
-        if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
-            console.error('AA25/AA10 nonce conflict detected, rebuilding UserOp with fresh nonce...');
-            // Bust deployment cache so getInitCode re-checks on-chain
-            deployedAccounts.delete(sender.toLowerCase());
-            // Wait for previous UserOp to mine before retrying with fresh nonce.
-            // Public RPC won't reflect the new nonce until the tx is on-chain.
-            await new Promise(r => setTimeout(r, 15000));
-            // Re-fetch initCode and nonce
-            const { factory: retryFactory, factoryData: retryFactoryData } = await getInitCode(sender, eoa.address, rpcUrl);
-            let retryNonce;
-            try {
-                const retryNonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-                retryNonce = retryNonceResult || '0x0';
-            }
-            catch {
-                const retryNonceResp = await fetch(rpcUrl, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        jsonrpc: '2.0', id: 1, method: 'eth_call',
-                        params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-                    }),
-                });
-                const retryNonceJson = await retryNonceResp.json();
-                retryNonce = retryNonceJson.result || '0x0';
+    let lastErr;
+    let attempt = 0;
+    const maxAttempts = 2;
+    while (attempt < maxAttempts) {
+        attempt++;
+        try {
+            // 4. Check if Smart Account is deployed (needed for factory/factoryData)
+            // If force-deployed, skip eth_getCode and return null initCode.
+            let factory = null;
+            let factoryData = null;
+            if (!forceDeployed.has(sender.toLowerCase())) {
+                const initCode = await getInitCode(sender, eoa.address, rpcUrl);
+                factory = initCode.factory;
+                factoryData = initCode.factoryData;
             }
-            // Rebuild unsigned UserOp with fresh nonce and initCode
-            const retryOp = {
+            // Fetch fresh nonce for each attempt
+            const nonce = await fetchNonce();
+            // 6. Build unsigned UserOp (v0.7 fields, camelCase for Rust JSON serde)
+            const unsignedOp = {
                 sender,
-                nonce: retryNonce,
+                nonce,
                 callData,
                 callGasLimit: '0x0',
                 verificationGasLimit: '0x0',
@@ -417,23 +437,53 @@ async function submitFactOnChainLocked(protobufPayload, config, eoa, sender) {
                 maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
                 signature: DUMMY_SIGNATURE,
             };
-            if (retryFactory) {
-                retryOp.factory = retryFactory;
-                retryOp.factoryData = retryFactoryData;
+            if (factory) {
+                unsignedOp.factory = factory;
+                unsignedOp.factoryData = factoryData;
             }
-            // Re-sponsor and re-sign
-            const retrySponsor = await rpc('pm_sponsorUserOperation', [retryOp, entryPoint]);
-            Object.assign(retryOp, retrySponsor);
-            const retryOpJson = JSON.stringify(retryOp);
-            const retryHashHex = getWasm().hashUserOp(retryOpJson, entryPoint, BigInt(config.chainId));
-            const retrySigHex = getWasm().signUserOp(retryHashHex, eoa.private_key);
-            retryOp.signature = `0x${retrySigHex}`;
-            userOpHash = await rpc('eth_sendUserOperation', [retryOp, entryPoint]);
+            // 7. Get paymaster sponsorship (fills gas limits + paymaster fields)
+            // This is where AA10 "sender already constructed" can occur if initCode
+            // is present but the sender is already deployed.
+            const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
+            Object.assign(unsignedOp, sponsorResult);
+            // 8. Hash and sign the UserOp via WASM
+            const opJson = JSON.stringify(unsignedOp);
+            const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
+            const sigHex = signUserOp(hashHex, eoa.private_key);
+            unsignedOp.signature = `0x${sigHex}`;
+            // 9. Submit the signed UserOp
+            userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
+            // Success — break out of retry loop
+            break;
         }
-        else {
+        catch (err) {
+            const msg = err?.message || '';
+            // AA10 "sender already constructed" or AA25 invalid nonce → retry
+            if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
+                lastErr = err;
+                console.error(`AA25/AA10 detected (attempt ${attempt}/${maxAttempts}), retrying...`);
+                // On AA10, force-mark sender as deployed so next retry omits initCode
+                if (/AA10/i.test(msg)) {
+                    forceDeployed.add(sender.toLowerCase());
+                    console.error('AA10: force-marking sender as deployed, retrying without initCode');
+                }
+                // Wait for previous UserOp to mine before retrying with fresh nonce.
+                // Public RPC won't reflect the new nonce until the tx is on-chain.
+                await new Promise(r => setTimeout(r, 15000));
+                // Continue to next iteration of retry loop
+                continue;
+            }
+            // Not a retryable error — re-throw
             throw err;
         }
     }
+    // Retry budget exhausted with no successful submission — throw the last
+    // retryable error instead of falling through to a receipt poll against an
+    // undefined userOpHash (which used to burn 120s and surface a misleading
+    // 'submission failed (tx=…)'). See #402.
+    if (userOpHash == null) {
+        throw lastErr ?? new Error('eth_sendUserOperation returned no result');
+    }
     // 10. Wait for receipt (poll up to 120s)
     let receipt = null;
     for (let i = 0; i < 60; i++) {
@@ -446,10 +496,10 @@ async function submitFactOnChainLocked(protobufPayload, config, eoa, sender) {
         catch { /* not mined yet */ }
     }
     const success = receipt?.success ?? false;
-    // Mark account as deployed after first successful submission
-    if (success) {
-        deployedAccounts.add(sender.toLowerCase());
-    }
+    // No session-deployment cache to update — getInitCode always re-checks
+    // eth_getCode on the next submission, so a successful receipt needs no
+    // bookkeeping here. (Previous cache removed in the AA10 fix — see note
+    // at the top of this section.)
     return {
         txHash: receipt?.receipt?.transactionHash || '',
         userOpHash,
@@ -497,119 +547,72 @@ async function submitFactBatchOnChainLocked(protobufPayloads, config, eoa, sende
     const headers = buildRelayHeaders(overrides);
     // Helper for JSON-RPC calls to relay bundler (with 429 retry)
     async function rpc(method, params) {
-        return rpcWithRetry(bundlerUrl, headers, method, params);
+        return rpcWithRetry({ url: bundlerUrl, headers, method, params });
     }
     const entryPoint = config.entryPointAddress || getWasm().getEntryPointAddress();
-    // Encode batch calldata (SimpleAccount.executeBatch)
-    // encodeBatchCall expects a JSON array of hex-encoded payload strings
+    // Encode batch calldata (SimpleAccount.executeBatch).
+    // encodeBatchCall{,To} expect a JSON array of hex-encoded payload strings.
+    // Target the resolved DataEdge address (env → relay billing → WASM default,
+    // per getSubgraphConfig / #462) so writes land on the SAME contract the
+    // relay reads from — the legacy `encodeBatchCall` bakes the PROD DataEdge and
+    // stranded staging writes on prod (#460). Guard: empty address → legacy
+    // encoder (behavior-identical; avoids `encodeBatchCallTo` throwing).
     const payloadsHex = protobufPayloads.map(p => p.toString('hex'));
-    const calldataBytes = getWasm().encodeBatchCall(JSON.stringify(payloadsHex));
+    const payloadsJson = JSON.stringify(payloadsHex);
+    const calldataBytes = config.dataEdgeAddress
+        ? getWasm().encodeBatchCallTo(payloadsJson, config.dataEdgeAddress)
+        : getWasm().encodeBatchCall(payloadsJson);
     const callData = `0x${Buffer.from(calldataBytes).toString('hex')}`;
     // Get gas prices
     const gasPrices = await rpc('pimlico_getUserOperationGasPrice', []);
     const fast = gasPrices.fast;
     const rpcUrl = config.rpcUrl || CONFIG.rpcUrl || getDefaultRpcUrl(config.chainId);
-    // Check if Smart Account is deployed (needed for factory/factoryData)
-    const { factory, factoryData } = await getInitCode(sender, eoa.address, rpcUrl);
     // Get nonce via bundler (accounts for pending mempool UserOps) with public RPC fallback
     const senderPadded = sender.slice(2).toLowerCase().padStart(64, '0');
     const keyPadded = '0'.repeat(64);
     const nonceCalldata = `0x35567e1a${senderPadded}${keyPadded}`;
-    let nonce;
-    try {
-        const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-        nonce = nonceResult || '0x0';
-    }
-    catch {
-        const nonceResp = await fetch(rpcUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                jsonrpc: '2.0', id: 1, method: 'eth_call',
-                params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-            }),
-        });
-        const nonceJson = await nonceResp.json();
-        nonce = nonceJson.result || '0x0';
-    }
-    // Build unsigned UserOp
-    const unsignedOp = {
-        sender,
-        nonce,
-        callData,
-        callGasLimit: '0x0',
-        verificationGasLimit: '0x0',
-        preVerificationGas: '0x0',
-        maxFeePerGas: fast.maxFeePerGas,
-        maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
-        signature: DUMMY_SIGNATURE,
-    };
-    if (factory) {
-        unsignedOp.factory = factory;
-        unsignedOp.factoryData = factoryData;
-    }
-    // Gas estimation for batch operations — get accurate gas limits from Pimlico
-    // before paymaster sponsorship (can't bump after sponsorship as it invalidates
-    // the paymaster's signature, causing AA34).
-    if (protobufPayloads.length > 1) {
+    // Helper to fetch nonce (with bundler fallback)
+    async function fetchNonce() {
         try {
-            const gasEstimate = await rpc('eth_estimateUserOperationGas', [unsignedOp, entryPoint]);
-            if (gasEstimate.callGasLimit)
-                unsignedOp.callGasLimit = gasEstimate.callGasLimit;
-            if (gasEstimate.verificationGasLimit)
-                unsignedOp.verificationGasLimit = gasEstimate.verificationGasLimit;
-            if (gasEstimate.preVerificationGas)
-                unsignedOp.preVerificationGas = gasEstimate.preVerificationGas;
+            const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
+            return nonceResult || '0x0';
         }
         catch {
-            // If estimation fails, let the paymaster handle it (default behavior)
+            const nonceJson = await rpcRequest({
+                url: rpcUrl,
+                headers: { 'Content-Type': 'application/json' },
+                method: 'eth_call',
+                params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
+            });
+            return nonceJson.result || '0x0';
         }
     }
-    // Paymaster sponsorship (uses gas limits from estimation above for batches)
-    const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
-    Object.assign(unsignedOp, sponsorResult);
-    // Hash and sign via WASM
-    const opJson = JSON.stringify(unsignedOp);
-    const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
-    const sigHex = getWasm().signUserOp(hashHex, eoa.private_key);
-    unsignedOp.signature = `0x${sigHex}`;
-    // Submit (with AA25 nonce conflict retry)
+    // Track force-deployed senders for AA10 retry (local to this submission attempt)
+    const forceDeployed = new Set();
+    // Single retry loop: getInitCode → build UserOp → estimate → sponsor → sign → send
+    // On AA10 "sender already constructed", mark sender as force-deployed and retry.
     let userOpHash;
-    try {
-        userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
-    }
-    catch (err) {
-        const msg = err?.message || '';
-        if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
-            console.error('AA25/AA10 nonce conflict detected (batch), rebuilding UserOp with fresh nonce...');
-            // Bust deployment cache so getInitCode re-checks on-chain
-            deployedAccounts.delete(sender.toLowerCase());
-            // Wait for previous UserOp to mine before retrying with fresh nonce.
-            // Public RPC won't reflect the new nonce until the tx is on-chain.
-            await new Promise(r => setTimeout(r, 15000));
-            // Re-fetch initCode and nonce
-            const { factory: retryFactory, factoryData: retryFactoryData } = await getInitCode(sender, eoa.address, rpcUrl);
-            let retryNonce;
-            try {
-                const retryNonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-                retryNonce = retryNonceResult || '0x0';
-            }
-            catch {
-                const retryNonceResp = await fetch(rpcUrl, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        jsonrpc: '2.0', id: 1, method: 'eth_call',
-                        params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-                    }),
-                });
-                const retryNonceJson = await retryNonceResp.json();
-                retryNonce = retryNonceJson.result || '0x0';
+    let lastErr;
+    let attempt = 0;
+    const maxAttempts = 2;
+    while (attempt < maxAttempts) {
+        attempt++;
+        try {
+            // Check if Smart Account is deployed (needed for factory/factoryData)
+            // If force-deployed, skip eth_getCode and return null initCode.
+            let factory = null;
+            let factoryData = null;
+            if (!forceDeployed.has(sender.toLowerCase())) {
+                const initCode = await getInitCode(sender, eoa.address, rpcUrl);
+                factory = initCode.factory;
+                factoryData = initCode.factoryData;
             }
-            // Rebuild unsigned UserOp with fresh nonce and initCode
-            const retryOp = {
+            // Fetch fresh nonce for each attempt
+            const nonce = await fetchNonce();
+            // Build unsigned UserOp
+            const unsignedOp = {
                 sender,
-                nonce: retryNonce,
+                nonce,
                 callData,
                 callGasLimit: '0x0',
                 verificationGasLimit: '0x0',
@@ -618,23 +621,70 @@ async function submitFactBatchOnChainLocked(protobufPayloads, config, eoa, sende
                 maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
                 signature: DUMMY_SIGNATURE,
             };
-            if (retryFactory) {
-                retryOp.factory = retryFactory;
-                retryOp.factoryData = retryFactoryData;
+            if (factory) {
+                unsignedOp.factory = factory;
+                unsignedOp.factoryData = factoryData;
+            }
+            // Gas estimation for batch operations — get accurate gas limits from Pimlico
+            // before paymaster sponsorship (can't bump after sponsorship as it invalidates
+            // the paymaster's signature, causing AA34).
+            if (protobufPayloads.length > 1) {
+                try {
+                    const gasEstimate = await rpc('eth_estimateUserOperationGas', [unsignedOp, entryPoint]);
+                    if (gasEstimate.callGasLimit)
+                        unsignedOp.callGasLimit = gasEstimate.callGasLimit;
+                    if (gasEstimate.verificationGasLimit)
+                        unsignedOp.verificationGasLimit = gasEstimate.verificationGasLimit;
+                    if (gasEstimate.preVerificationGas)
+                        unsignedOp.preVerificationGas = gasEstimate.preVerificationGas;
+                }
+                catch {
+                    // If estimation fails, let the paymaster handle it (default behavior)
+                }
             }
-            // Re-sponsor and re-sign
-            const retrySponsor = await rpc('pm_sponsorUserOperation', [retryOp, entryPoint]);
-            Object.assign(retryOp, retrySponsor);
-            const retryOpJson = JSON.stringify(retryOp);
-            const retryHashHex = getWasm().hashUserOp(retryOpJson, entryPoint, BigInt(config.chainId));
-            const retrySigHex = getWasm().signUserOp(retryHashHex, eoa.private_key);
-            retryOp.signature = `0x${retrySigHex}`;
-            userOpHash = await rpc('eth_sendUserOperation', [retryOp, entryPoint]);
+            // Paymaster sponsorship (uses gas limits from estimation above for batches)
+            // This is where AA10 "sender already constructed" can occur if initCode
+            // is present but the sender is already deployed.
+            const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
+            Object.assign(unsignedOp, sponsorResult);
+            // Hash and sign via WASM
+            const opJson = JSON.stringify(unsignedOp);
+            const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
+            const sigHex = signUserOp(hashHex, eoa.private_key);
+            unsignedOp.signature = `0x${sigHex}`;
+            // Submit the signed UserOp
+            userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
+            // Success — break out of retry loop
+            break;
         }
-        else {
+        catch (err) {
+            const msg = err?.message || '';
+            // AA10 "sender already constructed" or AA25 invalid nonce → retry
+            if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
+                lastErr = err;
+                console.error(`AA25/AA10 detected (batch, attempt ${attempt}/${maxAttempts}), retrying...`);
+                // On AA10, force-mark sender as deployed so next retry omits initCode
+                if (/AA10/i.test(msg)) {
+                    forceDeployed.add(sender.toLowerCase());
+                    console.error('AA10: force-marking sender as deployed, retrying without initCode');
+                }
+                // Wait for previous UserOp to mine before retrying with fresh nonce.
+                // Public RPC won't reflect the new nonce until the tx is on-chain.
+                await new Promise(r => setTimeout(r, 15000));
+                // Continue to next iteration of retry loop
+                continue;
+            }
+            // Not a retryable error — re-throw
             throw err;
         }
     }
+    // Retry budget exhausted with no successful submission — throw the last
+    // retryable error instead of polling for a receipt against an undefined
+    // userOpHash (which used to burn 120s and surface a misleading
+    // 'submission failed (tx=…)'). See #402.
+    if (userOpHash == null) {
+        throw lastErr ?? new Error('eth_sendUserOperation returned no result');
+    }
     // Wait for receipt (poll up to 120s)
     let receipt = null;
     for (let i = 0; i < 60; i++) {
@@ -647,10 +697,10 @@ async function submitFactBatchOnChainLocked(protobufPayloads, config, eoa, sende
         catch { /* not mined yet */ }
     }
     const batchSuccess = receipt?.success ?? false;
-    // Mark account as deployed after first successful submission
-    if (batchSuccess) {
-        deployedAccounts.add(sender.toLowerCase());
-    }
+    // No session-deployment cache to update — getInitCode always re-checks
+    // eth_getCode on the next submission, so a successful receipt needs no
+    // bookkeeping here. (Previous cache removed in the AA10 fix — see note
+    // at the top of the Smart Account deployment-check section.)
     return {
         txHash: receipt?.receipt?.transactionHash || '',
         userOpHash,
@@ -679,7 +729,10 @@ export function isSubgraphMode() {
  *   - TOTALRECLAW_SELF_HOSTED -- set "true" to use self-hosted server (default: managed service)
  *
  * Chain ID is no longer configurable via env — it is auto-detected from the
- * relay billing response (free = Base Sepolia, Pro = Gnosis mainnet).
+ * relay billing response (post-ops-1 both tiers are on Gnosis mainnet, chain
+ * 100). The DataEdge contract address is likewise consumed from the relay's
+ * authoritative `data_edge_address` (env override still wins, WASM default is
+ * the final fallback — see the `dataEdgeAddress` resolution below, #460).
  */
 export function getSubgraphConfig() {
     return {
@@ -688,7 +741,12 @@ export function getSubgraphConfig() {
         mnemonic: CONFIG.recoveryPhrase,
         cachePath: CONFIG.cachePath,
         chainId: CONFIG.chainId,
-        dataEdgeAddress: CONFIG.dataEdgeAddress || getWasm().getDataEdgeAddress(),
+        // Resolution order (#460): explicit operator env override → relay billing
+        // `data_edge_address` (verbatim) → WASM-baked default. The relay routes
+        // each environment to its own DataEdge (staging is on-chain isolated), so
+        // consuming its value keeps writes + reads on the same contract; without
+        // the middle term staging writes mined on the prod default → empty recall.
+        dataEdgeAddress: CONFIG.dataEdgeAddress || getDataEdgeAddressOverride() || getWasm().getDataEdgeAddress(),
         entryPointAddress: CONFIG.entryPointAddress || getWasm().getEntryPointAddress(),
         rpcUrl: CONFIG.rpcUrl || undefined,
     };