Cardano Updates

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6.0.1...v7.0.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Importantly, but the lower bound on aeson >= 2.3.0.0 to avoid a DoS
vulnerability in earlier versions:

  https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html

Co-Authored-By: Hamish Mackenzie <[email protected]>

Importantly, but the lower bound on aeson >= 2.3.0.0 to avoid a DoS
vulnerability in earlier versions:

  https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html

matchShape's result type variable was generated from a value-namespace name
(makeRandomVariable), so implicit quantification in the signature did not bind
it and GHC reported 'not in scope'. Rebuild it as a type-variable-namespace
name. (Latent bug surfaced by the new Match activation test.)

Co-Authored-By: Claude Opus 4.8 <[email protected]>

The Match destructor no longer uses head/(tail^n) to index the constructor's
arguments; it binds them with an explicit list pattern

  \case args_ of { [a0, a1, ...] -> f_ (decode a0) (decode a1) ...; _ -> PlutusTx.Builtins.error () }

The wildcard branch is unreachable for well-formed Data and uses the on-chain
error builtin, matching the previous head/tail crash-on-malformed behaviour.

Adds Match/Spec.hs (deriving (AsData, Match) via Plinth) which exercises
matchShape's dispatch + field decoding at runtime, so the codegen is verified
end-to-end in CI like the AsData test.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Per review: the generated view function now binds the constructor's
arguments with an explicit list pattern

  \case args_ of { [a0, a1, ...] -> Just (decode a0, decode a1, ...); _ -> Nothing }

instead of indexing with head/(tail^n). The generated code is now total, so
the AsData activation test drops -Wno-x-partial entirely.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Per review: emit 'pattern Con :: t0 -> ... -> T a b' signatures alongside the
generated pattern synonyms, so user modules no longer need
-Wno-missing-pattern-synonym-signatures (dropped from the activation test).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

* Fuse unionWith and checkBinRel in V1.Data.Value

Drop the internal unionVal and checkPred helpers; inline the merge logic
into unionWith and checkBinRel respectively. The previous chain built a
Map CurrencySymbol (Map TokenName (These Integer Integer)) intermediate
via unionVal, then re-walked it to apply f -- three outer passes for a
single conceptual merge.

The fused unionWith now runs Map.union once and a single outer Map.map,
collapsing the These shape inline per currency-symbol entry. The
Map TokenName (These Integer Integer) stage is gone; the outer Map.map
runs once instead of twice. checkBinRel is refactored along the same
shape with Map.union + Map.all, which gives geq / leq / gt / lt
short-circuit termination on the first failing pair.

Adds Spec.Data.Value.test_unionWith: a QuickCheck property that compiles
unionWith via TH, evaluates on the CEK machine, and compares against the
host-Haskell unionWith for the same inputs. Differential test against
the Plinth compiler: any divergence is a compilation bug, not a
semantics bug.

The Spec.Data.Budget gt / geq budget goldens are regenerated: short-circuit
checkBinRel reduces gt4 / geq4 by ~46% (the worst-case adverse input);
other shapes drop 0.7-3% from removing one outer pass over the These
intermediate. The remaining diff is the cost-model anchor; that
component is unrelated to this change.

Budget evidence (union matrix vs builtin, unsafeDataAsValue baseline)
lives on the companion experimental branch
yura/issue-2243-fused-unionwith-evidence, stacked on the sibling
valueOf-evidence branch.

For IntersectMBO/plutus-private#2243.

* Refresh GHC 9.12 gt / geq budget goldens after checkBinRel rewrite

The previous commit (642442a85f) regenerated the GHC 9.6 column only.
plutus-ledger-api-plugin-test is also buildable on GHC 9.12 per the
ghc-version-support common stanza, and Hydra runs it there; the
checkBinRel rewrite changes the compiled UPLC enough to move the
budgets in both columns. Same regen, run in nix develop .#ghc912.

For IntersectMBO/plutus-private#2243.

* Make the unionWith property test differential against the builtin

Compare the typed unionWith (+) against the builtin unionValue path on
CEK rather than against host-Haskell unionWith: a shared-source oracle
cannot catch a bug that lands the same way on both sides. Inputs are
restricted to the well-formed domain unsafeDataAsValue accepts, and
results are compared up to key order and zero-sum entries. Bindings use
plinthc instead of the compile splice.

Also rephrase Note [Single-pass unionWith] and the checkBinRel docstring
to describe the present structure without contrasting against history.

For IntersectMBO/plutus-private#2243.

* Correct the unionWith fusion wording

The fusion is a constant-factor change, not the elimination of the These
intermediate it was described as. Map.union still produces a per-key These
and the inner These is still built transiently for shared keys; what the
fusion removes is one of the two outer Map.map passes over the post-union
map, plus the wrap-then-remap of single-side currencies. Adjust the
changelog and drop Note [Single-pass unionWith] accordingly; the merge
structure is plain from the code.

For IntersectMBO/plutus-private#2243.

* Clarify checkBinRel short-circuit wording in changelog

* Trim changelog to the exported unionWith change

Addresses two review comments:
- parseDerivingStrategy returned Maybe [String] but the options channel is
  always empty now, so it becomes isPlinthVia :: ... -> Bool, and the [String]
  options are removed from the Generator type and the handle* plumbing.
- The CLI/help/version handling pulled in the Paths_ module plus Config, Flag
  and Options modules for no real benefit. The pass always uses defaults now,
  so those three modules are deleted and the config threading removed; verbose
  dumping is driven solely by -ddump-deriv.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Per review (hsyl20): instead of shipping a standalone PlinthPlugin that users
must enable with a second -fplugin, wire the parsed-AST deriving pass into the
existing Plinth.Plugin as its parsedResultAction. Any module compiled with the
Plinth plugin now gets 'deriving via Plinth' automatically.

Also: move the modules from PlinthPlugin.* to PlutusTx.Plugin.Deriving.*, and
rename the deriving-via sentinel to a bare 'data Plinth' (PlutusTx.Plugin.Deriving.Via)
so it reads 'deriving AsData via Plinth' with no DataKinds. The standalone
'plugin' value and its CLI/help/version handling are dropped.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

The fusion is a constant-factor change, not the elimination of the These
intermediate it was described as. Map.union still produces a per-key These
and the inner These is still built transiently for shared keys; what the
fusion removes is one of the two outer Map.map passes over the post-union
map, plus the wrap-then-remap of single-side currencies. Adjust the
changelog and drop Note [Single-pass unionWith] accordingly; the merge
structure is plain from the code.

For IntersectMBO/plutus-private#2243.