Cardano Updates

Deps for the builder/submit path:
- apollo/v2 via the renamed Blink fork (github.com/blinklabs-io/apollo/v2,
  portable pseudo-version; no replace directive)
- dingo v0.52.1 (utxorpc submit), gouroboros v0.182.0
- ch-go held at v0.61.5 (clickhouse-go v2.30.0 compat)

Signed-off-by: Chris Gianelloni <[email protected]>

Signed-off-by: cryptodj413 <[email protected]>

This tackles a weird corner case in a test run, checkout the commit before this
one and run `ChainDB q-s-m.sequential` with `--quickcheck-replay="(SMGen
15718721082101496336 1793087168948606521,99)"` to observe it.

In short, in the tests we don't copy blocks when we snapshot (which we do on
production, see TODO(geo2a) in ChainDB.StateMachine). Normally we would be
guarded by the fact that the snapshot would have a higher slot than the
immutable db tip but when the tip is exactly at an EBB this is not the case and
we reach the exception case.

With this fix, we instead discard the snapshot in this extremely rare situation.

  The init tx pre-funds the head output with enough ADA to cover the
  largest possible ClosedDatum (all parties having contested). The
  previous calculation used N-1 contesters, but the datum can grow
  to N entries when every party contests. For a single-party head,
  N-1=0 so the pre-funded amount was computed with an empty contesters
  list, leaving 103,440 lovelace short; the wallet's ensureMinUTxO
  then topped up the contest output, which the strict
  mustPreserveHeadValue (H4) check on-chain correctly rejected.

Signed-off-by: Sasha Bogicevic <[email protected]>

  The geq → == change in mustPreserveHeadValue prevents stuck-head griefing
  but requires the head output ADA to never need a wallet bump at Close or
  Contest time. Since ClosedDatum with N-1 contesters is larger than
  OpenDatum, compute minUTxO(ClosedDatum_{N-1}, V_tokens) at initTx and
  set that as the head output ADA. This ADA is returned to participants at
  fanout and remains stable through Increments (headAdaOverhead = headADA -
  utxoADA stays constant as both sides grow by deposit_ADA).

  Move InitTx out of prepareTxToPost (STM) into postTx (IO) so getPParams
  — a new TinyWallet field — can be called to fetch live protocol params
  for the min-UTxO calculation.

Signed-off-by: Sasha Bogicevic <[email protected]>

  mustPreserveHeadValue used geq (≥) rather than == for the Close and
  Contest transitions. This allowed a malicious contester to add extra ADA
  to the head output — a griefing attack where the added value would cause
  the fanout's strict == conservation check to fail, permanently locking
  the head.

  The geq was a defensive measure for datum-growth min-UTxO scenarios, but
  neither closeTx nor contestTx ever changes the head value (both call
  modifyTxOutDatum only), and using geq to "top up" would break the fanout
  anyway. The correct invariant is ==, which matches the spec.

  Add ContestIncreaseHeadValue mutation test to document the property.

Signed-off-by: Sasha Bogicevic <[email protected]>

  When snapshotVersion < version (an IncrementTx confirmed on L1 after the
  last snapshot), computeFullFanoutUTxO includes utxoToCommit in the full
  fanout set. After a PartialFanoutTx distributes all other outputs, a
  FinalPartialFanoutTx must distribute the pending deposit UTxO alone.

  Adds genClosedStateWithPendingCommit to the testlib and a property test
  that verifies finalPartialFanout succeeds in this scenario — guarding
  against the StaleChainState failure observed in practice when the
  in-memory deposit UTxO accumulator element diverges from the on-chain
  commitment.

Signed-off-by: Sasha Bogicevic <[email protected]>

Signed-off-by: Sasha Bogicevic <[email protected]>

Signed-off-by: Sasha Bogicevic <[email protected]>

  genStOpen inflates the head UTxO by u0Value but leaves headAdaOverhead
  in the open datum unchanged. genCloseTx now adjusts the head UTxO value
  to headAdaOverhead + confirmedUTxOValue + decommitValue before building
  the close tx, so closeTx computes the correct headAdaOverhead' for the
  closed datum (fixes H65).

  forAllClose was discarding the adjusted UTxO returned by genCloseTx and
  recomputing it from the original inflated OpenState, causing the
  evaluator to see a different input value than what the tx was built
  against (fixes H4/HeadValueIsNotPreserved).

Signed-off-by: Sasha Bogicevic <[email protected]>

  getAccumulatorHash (which runs a BLS12-381 multi-scalar multiplication)
  was called three times per snapshot: once in `sign`, once in
  `mkSeenSnapshot`, and once in `toJSON`. All three operate on the same
  HydraAccumulator value.

  Change HydraAccumulator from a newtype to a data type with a lazy
  _cachedHash field. The thunk is computed at most once per value via
  normal Haskell sharing — subsequent callers return the already-evaluated
  ByteString immediately.

Signed-off-by: Sasha Bogicevic <[email protected]>

  mustNotChangeVersion (H13) fires before mustBeValidSnapshot (H28) in checkClose
  because && evaluates left-to-right; setting closedVersion != openVersion always
  triggers H13 first.

Signed-off-by: Sasha Bogicevic <[email protected]>

  genStOpen inflates the head UTxO by u0Value but genCloseTx was not
  adjusting it before calling unsafeClose. With mustPreserveHeadValue
  now using strict equality (instead of geq), the head value must be
  exactly headAdaOverhead + confirmedUTxO + decommit at close time,
  or the Plutus script fires H65. Adjust the UTxO in genCloseTx the
  same way genClosedStateForFanout and genFanoutTx already do.

Signed-off-by: Sasha Bogicevic <[email protected]>

Signed-off-by: Sasha Bogicevic <[email protected]>

  The field was superseded by accumulatorHash (KZG-based) and was never
  read or validated by the on-chain head validator.

Signed-off-by: Sasha Bogicevic <[email protected]>

  Three coverage gaps in the contract test suite are filled:

  - CloseAny: new test module exercising the NoThing → CloseAny redeemer
    path, including the unique on-chain snapshotNumber > 0 check (21
    mutations; signature/number failures all map to FailedCloseAny because
    that path wraps both checks in a single traceIfFalse).

  - CloseInitial: expanded from 2 to 15 mutations, adding the three
    CloseInitial-specific checks (snapshotNumber == 0, version == 0,
    accumulatorCommitment == G1 generator → FailedCloseInitial) plus the
    ten shared close checks (parties, headId, contestation period, validity
    bounds, minting, contesters, value, required signer).

  - ContestInc: new test module contesting with a commit-type snapshot
    (utxoToCommit = Just depositedUTxO), exercising the ToCommit
    accumulator commitment path that ContestDec (decommit path) left
    uncovered.

Signed-off-by: Sasha Bogicevic <[email protected]>

    A malicious participant could set an arbitrary headAdaOverhead in the
    output ClosedDatum at close time. Since mustPreserveHeadAdaOverhead in
    checkContest locks this value permanently after Close, a wrong value
    makes fanout impossible and freezes all head funds.

    Fix: store headAdaOverhead in OpenDatum at init time (where it equals
    worstCaseMinLovelace, the pre-funded overhead with no L2 UTxOs) and
    verify it is unchanged in checkClose, checkIncrement, and checkDecrement.
    The invariant headAdaOverhead = headLovelace - utxoLovelace holds across
    the head lifetime because Increment and Decrement both change headLovelace
    and utxoLovelace by the same deposit/decommit amount.

    Also fix worstCaseClosedDatum used to compute the pre-funded ADA at
    initTx: variable-size integer fields (version, snapshotNumber,
    contestationDeadline, headAdaOverhead) previously used small constants
    (0 or 2 trillion) that produce 1-9 CBOR bytes less than the true
    maximum. Using maxBound @Word64 for all of them ensures the datum size
    estimate is a genuine upper bound, preventing potential ledger min-UTxO
    rejections on close for long-running or high-throughput heads.

Signed-off-by: Sasha Bogicevic <[email protected]>

  deposit.ak checks the head redeemer constructor index via raw CBOR
  arithmetic; if Increment ever shifts from index 0, deposits are
  permanently locked. The test catches that at build time.

Signed-off-by: Sasha Bogicevic <[email protected]>