Cardano Updates

  The accumulator-based headIsFinalizedWith used txInfoOutputs directly,
  which includes the wallet's change output appended by coverFee. Since
  that output is not in the accumulator, the KZG membership proof failed
  for every real on-chain fanout.

  Restore numberOfFanoutOutputs :: Integer to the Fanout redeemer (as in
  the original hash-based validator) so the validator slices txInfoOutputs
  to only the distributed UTxOs before running the pairing check and value
  conservation. Also update the FanOut.hs head output to carry the UTxO
  value so mustConserveValue passes, and add a unit test that appends a
  trailing wallet change output and asserts the transaction still
  evaluates — this would have caught the regression at the contract test
  level rather than requiring a devnet E2E run.

Signed-off-by: Sasha Bogicevic <[email protected]>

  The new accumulator-based headIsFinalizedWith validator checks that the
  head input value covers all distributed outputs. The test head output was
  missing UTxO.totalValue, causing H4 (HeadValueIsNotPreserved) failures.

Signed-off-by: Sasha Bogicevic <[email protected]>

Signed-off-by: Sasha Bogicevic <[email protected]>

Signed-off-by: Sasha Bogicevic <[email protected]>

  Remove utxoHash/alphaUTxOHash/omegaUTxOHash from ClosedDatum, all
  Close/Contest redeemers, and the snapshot signing tuple. The BLS
  accumulator already commits to the full UTxO set (utxo ∪ alpha ∪
  omega), making the three separate SHA256 hashes redundant.

  Full fanout now verifies outputs via a KZG membership proof (same as
  partial fanout) rather than hash comparison. The Fanout redeemer gains
  proof and crsRef fields; the three output-count fields are dropped.

  Snapshot signing shrinks from a 7-tuple to a 4-tuple
  (headId, version, snapshotNumber, accumulatorHash).

Signed-off-by: Sasha Bogicevic <[email protected]>

Also reduce a diff in the test code

Signed-off-by: Sasha Bogicevic <[email protected]>

Signed-off-by: Sasha Bogicevic <[email protected]>

  fanoutChunkSize and fanoutOutputThreshold are now defined once in
  Test.Hydra.Tx.Fixture and imported wherever needed, removing the
  per-file duplicates.

  prepareTxToPost gains explicit FanoutTx/FinalPartialFanoutTx branches
  (error) so GHC's exhaustiveness checker catches any future unhandled
  constructor, instead of silently falling through a wildcard.

  The two deadline-slot conversions in mkChain.postTx now throw
  FailedToConstructFanoutTx (a PostTxError Tx) instead of userError,
  so the exception is caught by Node.hs's PostTxError handler rather
  than propagating uncaught and crashing the node.

  Replace the hardcoded numToDistribute = totalUTxO - 1 in the partial
  fanout benchmarks with a binary search that finds the largest chunk
  actually fitting within both the tx size and execution budget, mirroring
  findFittingFanoutTx in the real node. The Remaining column in the output
  table now carries meaningful information instead of always showing 1.

  Also add ContestationDeadlineOutsideTimeHorizon to the PostTxError
  oneOf in api.yaml, which was defined in Chain.hs but missing from the
  schema, causing ServerOutputSpec to fail.

Signed-off-by: Sasha Bogicevic <[email protected]>

  computeFinalPartialFanOutCost was capped at 7 (fanoutChunkSize), hiding
  the real tx-size limit for the terminal fanout step. Now it sweeps a wide
  range and searches for the actual maximum, using a single preceding output
  as minimal setup to reach FanoutProgress.

  computePartialFanOutMixedCost also dropped its fanoutChunkSize cap and
  now distributes all-but-one outputs, consistent with the nominal benchmark.
  The stale description mentioning fanoutChunkSize is corrected accordingly.

Signed-off-by: Sasha Bogicevic <[email protected]>

  HeadLogic no longer uses fanoutChunkSize or fanoutOutputThreshold to decide
  which tx type to emit. For a fresh fanout it always emits FanoutTx; for an
  in-progress fanout it always emits FinalPartialFanoutTx. Handlers now owns the
  sizing decision: it tries the preferred tx first, then falls back to
  PartialFanoutTx with a decreasing chunk size (starting at N-1) until one fits
  within the execution budget, using a single shared findFittingFanoutTx helper.

  PartialFanoutTx is removed from PostChainTx — it is now an internal Handlers
  detail, never emitted by HeadLogic. fanoutChunkSize and fanoutOutputThreshold
  are removed from KZGTrustedSetup and all call sites.

Adds a remote-driven QA harness to validate hard-fork (Van Rossem)
readiness end-to-end against mainnet, modelled on cf-token-metadata-registry:

- docker-compose.yml + .env: Postgres + API (built from source), syncing
  mainnet from the first ADA Handle mint (slot 47931310) to tip. DNS-TTL
  relay-wedge mitigation applied via JAVA_TOOL_OPTIONS (the image entrypoint
  is a fixed `java -jar`, so JAVA_OPTS would be ignored).
- .claude/skills/cf-adahandle-resolver-mainnet-integration-test-full-sync:
  SSH-driven skill (preflight -> prepare -> compose up -> tunnels -> monitor
  sync to tip -> parse-error scan -> REST round-trip spot-checks). Pass =
  full sync through Conway with zero genuine block-parse errors + DB-vs-API
  consistency on sampled handles.
- .gitignore: track .claude/, ignore skill runtime config (config.env,
  tunnels.pid) and settings.local.json.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Resolves https://github.com/cardano-scaling/hydra/issues/2629

The root cause was in confirmedUTxO inside onOpenNetworkReqSn: it always
included `utxoToCommit` unconditionally. When a new `ReqSn` with no
deposit arrived after recovery, the recovered deposit was still part of
the base UTxO used to apply transactions, and with no `withoutUTxO` to
strip it back out, it baked into the new snapshot's utxo field.

<!-- Describe your change here -->

---

<!-- Consider each and tick it off one way or the other -->
* [ ] CHANGELOG updated or not needed
* [ ] Documentation updated or not needed
* [ ] Haddocks updated or not needed
* [ ] No new TODOs introduced or explained herafter

fix: instantiate provider lazily in resolveAdaHandle to prevent crashes in preprod environments

feat: persist hasCheckedSession in sessionStorage to avoid redundant session checks and modal displays

refactor: make NEXT_PUBLIC_BLOCKFROST_API_KEY_MAINNET optional for better environment handling

fix: ensure BlockfrostProvider is instantiated only with a valid API key

Both cardano-crypto and cardano-crypto-wallet bundle ed25519.c with the
same ED25519_FN macro prefix, producing duplicate exported symbols
(cardano_crypto_ed25519_publickey, etc.).  The GHC runtime linker aborts
on duplicate symbols, breaking TH evaluation via iserv (e.g. Windows
cross-builds) and GHCi on all platforms.

Rename the prefix in cardano-crypto-wallet from cardano_crypto_ to ccw_
so the two libraries no longer collide.  No Haskell FFI changes needed:
the FFI only imports wallet_encrypted_* and wallet_sodium_* symbols; the
ed25519 symbols are internal C-to-C calls.

Two fixes for source-repo / reinstallable-lib:ghc projects under v2,
surfaced by the ghc-lib-reinstallable-cabal test:

1. Build-time source-repository-package composition.  The cleanup
   commit dropped source-repo handling (cardano-node has none), which
   broke any project with source-repo deps — including lib:ghc via
   useLocalGhcLib.  Each source-repo package now emits its own
   `source-repository-package` block (wrapping its source in a minimal
   git repo) into its fragment, and the build-time composer collects
   them across the closure and omits those packages from
   `extra-packages:`.  The block references a derivation, so it's
   written with `writeText` (not `toFile`).

2. `allow-boot-library-installs: True` is now emitted unconditionally,
   combined with `allow-newer`/`allow-older` in the project skeleton
   (`solverRelaxations`).  It only *permits* reinstalling boot libs;
   cabal can act on it solely when a boot lib's source is in this
   slice's repo (one plan-nix reinstalled), so it's a no-op otherwise.
   This drops the `bootLibPkgNames` gating machinery and lets cabal
   pick the source-repo `ghc` for useLocalGhcLib slices.  Also added
   `allow-older: *:*` alongside `allow-newer: *:*` (harmless given the
   per-slice repo has one candidate version per package).

Verified: tests.ghc9141.native.tests.ghc-lib-reinstallable-cabal builds
(reinstalls lib:ghc end to end); Stream / happy / proto-lens-protobuf-types
unaffected.