coins: mint the block-winning share onto the sharechain (dash/btc/bch/dgb)

Fixes #887.

mining_submit classifies a solve tighten-first: block target, then share
target. On dash, btc, bch and dgb the block arm dispatched the won block and
RETURNED, so the share arm -- the only place the sharechain mint /
create-share seam is invoked -- was never reached. Because
block_target <= share_target, a solve that clears the block target clears the
share target by definition: it is the highest-work share the node will ever
produce, and it was discarded on every block won. That costs (a) our own PPLNS
weight in the very window the block pays out from and (b) peers' view of our
best work. LTC is already correct -- core/web_server.cpp:7464 runs the
create-share hook before and independently of the block check.

Not block loss: the block submits correctly on all four coins. This is
share-weight loss.

Each coin's mint invocation is lifted VERBATIM out of the share arm into a
local helper and invoked from BOTH arms.

ORDERING. LTC mints first; here the helper runs on the won-block arm strictly
AFTER the block has been dispatched (on dash, also after the payee-guard
verdict and the recent-blocks record). The reward invariant is "never refuse a
block the daemon would ACCEPT", so nothing may be inserted ahead of the
submit: the mint walks the tracker, takes locks, can decline, and can throw.
Running it downstream reaches the same end state as LTC with none of that
exposure. The helper also catches exceptions locally on every coin (dgb's
ShareAccept previously had none), so a mint fault can never cost the block or
turn a won block into a stratum reject.

dash: the mint runs even after a payee-guard reject. The guard is a COIN-side
verdict about a stale masternode payee; the sharechain has its own acceptance
rule (the mint's X11-identity + pow<=own-committed-target gates) and the share
arm has never consulted the guard. The existing reject branch already states
the share still counts for the miner. Withholding would be a second,
self-inflicted loss on top of the forfeited block.

dgb: PRE-WIRING ONLY. Per #884 main_dgb.cpp never calls set_mint_share_fn, so
dgb cannot mint any local share today -- not this one, and not an ordinary
ShareAccept either. The won-block arm now REACHES the seam so dgb inherits the
fix the moment #884 binds it. The dgb KAT is named and commented accordingly
and asserts only seam reachability.

NO CONSENSUS CHANGE. Share construction, target derivation and serialisation
live entirely inside the untouched mint / create_local_share seams. This
changes only WHETHER the seam is invoked, never what it builds.

Tests folded into EXISTING allowlisted targets (never a new add_executable,
which would silently report "Not Run"). Each coin pins: the block still
dispatches; the share seam is reached; the seam observes the block as ALREADY
dispatched (ordering witness); and a throwing seam costs neither the block nor
the accepted reply.

Author: frstrtr

src/impl/bch/stratum/work_source.cpp

@@ -690,6 +690,52 @@ nlohmann::json BCHWorkSource::mining_submit(
 
     auto pow_hex_short = pow_hash.GetHex().substr(0, 16);
 
+    // -- Sharechain write (#887) --
+    // Dispatch to create_share_fn_ (v36 share add). SHARED by both accept
+    // classes: block_target <= share_target, so a solve that meets the block
+    // target meets the share target too -- it is the highest-work share this
+    // node will ever produce, and the sharechain and the coin blockchain are
+    // independent systems. Before #887 the won-block arm returned without ever
+    // reaching this seam, forfeiting our own PPLNS weight in the very window
+    // the block pays out from and denying peers our best work. LTC has always
+    // written on both classes (web_server.cpp).
+    //
+    // ORDERING -- reward invariant: on the won-block arm this runs AFTER the
+    // block has already been dispatched, never before. create_share_fn_ takes
+    // the exclusive tracker lock, can decline, and can throw; the block submit
+    // must never sit behind any of that.
+    //
+    // CONSENSUS: unchanged. Share construction, target derivation and
+    // serialisation live entirely inside the (untouched) create_local_share
+    // seam -- this changes only WHETHER it is invoked, not what it builds.
+    auto write_solved_share = [&](bool won_block) {
+        const char* tag = won_block ? "[BCH-STRATUM-BLOCK-SHARE]"
+                                    : "[BCH-STRATUM-SHARE]";
+        CreateShareFn create_fn;
+        { std::lock_guard<std::mutex> lk(callback_mutex_); create_fn = create_share_fn_; }
+
+        uint256 share_hash;
+        if (create_fn) {
+            auto payout_script = core::address_to_script(username);
+            try { share_hash = create_fn(coinbase, header, *job, payout_script); }
+            catch (const std::exception& e) {
+                LOG_WARNING << tag << " create_share_fn threw: " << e.what()
+                            << " -- share not added";
+            }
+        }
+
+        if (!share_hash.IsNull())
+            LOG_INFO << tag << " ACCEPTED + ADDED user=" << username
+                     << " share_hash=" << share_hash.GetHex().substr(0, 16)
+                     << " pow_hash=" << pow_hex_short << " job=" << job_id;
+        else if (create_fn)
+            LOG_INFO << tag << " accepted (deferred) user=" << username
+                     << " pow_hash=" << pow_hex_short << " job=" << job_id;
+        else
+            LOG_INFO << tag << " accepted (no-tracker) user=" << username
+                     << " pow_hash=" << pow_hex_short << " job=" << job_id;
+    };
+
     // -- Classify --
     if (!(pow_hash > block_target)) {
         // BLOCK FOUND.
@@ -731,6 +777,11 @@ nlohmann::json BCHWorkSource::mining_submit(
                       << height << " not broadcast -- lost subsidy!";
         }
 
+        // #887: the won block is a SHARE too. The dispatch above has already
+        // happened, so nothing here can delay, gate or endanger the block
+        // submit -- the sharechain write is strictly downstream of it.
+        write_solved_share(/*won_block=*/true);
+
         {
             std::lock_guard<std::mutex> lk(workers_mutex_);
             for (auto& [sid, w] : workers_) { (void)sid; if (w.username == username) { w.accepted++; break; } }
@@ -740,29 +791,7 @@ nlohmann::json BCHWorkSource::mining_submit(
 
     if (!(pow_hash > share_target)) {
         // Share meets sharechain target -> create_share_fn_ (v36 share add).
-        CreateShareFn create_fn;
-        { std::lock_guard<std::mutex> lk(callback_mutex_); create_fn = create_share_fn_; }
-
-        uint256 share_hash;
-        if (create_fn) {
-            auto payout_script = core::address_to_script(username);
-            try { share_hash = create_fn(coinbase, header, *job, payout_script); }
-            catch (const std::exception& e) {
-                LOG_WARNING << "[BCH-STRATUM-SHARE] create_share_fn threw: " << e.what()
-                            << " -- share not added";
-            }
-        }
-
-        if (!share_hash.IsNull())
-            LOG_INFO << "[BCH-STRATUM-SHARE] ACCEPTED + ADDED user=" << username
-                     << " share_hash=" << share_hash.GetHex().substr(0, 16)
-                     << " pow_hash=" << pow_hex_short << " job=" << job_id;
-        else if (create_fn)
-            LOG_INFO << "[BCH-STRATUM-SHARE] accepted (deferred) user=" << username
-                     << " pow_hash=" << pow_hex_short << " job=" << job_id;
-        else
-            LOG_INFO << "[BCH-STRATUM-SHARE] accepted (no-tracker) user=" << username
-                     << " pow_hash=" << pow_hex_short << " job=" << job_id;
+        write_solved_share(/*won_block=*/false);
 
         {
             std::lock_guard<std::mutex> lk(workers_mutex_);

src/impl/bch/test/CMakeLists.txt

@@ -212,13 +212,22 @@ if(BUILD_TESTING)
     # Needs coin/transaction.cpp for the MutableTransaction ctors, same as
     # block_connector_test; link set and header-only-over-coin/*.hpp posture are
     # otherwise identical, so per-coin isolation stays clean.
+    #
+    # #887 fold-in: the same file now also drives BCHWorkSource::mining_submit
+    # to pin that a WON BLOCK is written to the sharechain as well (block
+    # dispatch first, share write strictly after). That needs bch_stratum
+    # (work_source.cpp) and its bch_coin dependency. FOLDED into this EXISTING
+    # allowlisted target rather than a new add_executable -- a new one would
+    # silently report "Not Run" (see merged PR #868). Still bch-only, so the
+    # per-coin isolation invariant holds.
     add_executable(bch_g2_block_assembly_roundtrip_test
         g2_block_assembly_roundtrip_test.cpp
         ${CMAKE_SOURCE_DIR}/src/impl/bch/coin/transaction.cpp)
     target_include_directories(bch_g2_block_assembly_roundtrip_test PRIVATE ${CMAKE_SOURCE_DIR}/src)
     target_link_libraries(bch_g2_block_assembly_roundtrip_test PRIVATE
         core pool sharechain
         c2pool_payout c2pool_merged_mining c2pool_hashrate c2pool_storage c2pool_difficulty
+        bch_stratum bch_coin
         btclibs)
     add_test(NAME bch_g2_block_assembly_roundtrip_test COMMAND bch_g2_block_assembly_roundtrip_test)
 endif()

src/impl/bch/test/g2_block_assembly_roundtrip_test.cpp

@@ -49,13 +49,20 @@
 #include <string>
 #include <vector>
 
+#include <memory>
+#include <stdexcept>
+
 #include "../coin/block.hpp"
 #include "../coin/block_assembly.hpp"
+#include "../coin/header_chain.hpp"
 #include "../coin/mempool.hpp"
 #include "../coin/merkle.hpp"
 #include "../coin/reconstruct_won_block.hpp"
 #include "../coin/transaction.hpp"
 #include "../stratum/coinbase_slot_guard.hpp"
+#include "../stratum/work_source.hpp"
+
+#include <core/stratum_types.hpp>
 
 namespace {
 
@@ -349,6 +356,138 @@ void test_truncation_and_trailing_bytes()
     CHECK(std::string(hv.reason).find("no transactions") != std::string::npos);
 }
 
+// ---------------------------------------------------------------------------
+// #887 -- the block-winning share must ALSO be written to the sharechain.
+//
+// BCHWorkSource::mining_submit classifies tighten-first: block target, then
+// share target. block_target <= share_target, so a solve that clears the block
+// target clears the share target BY DEFINITION -- it is the highest-work share
+// this node will ever produce. Before #887 the won-block arm dispatched the
+// block and RETURNED, so create_share_fn_ was never reached and that share was
+// discarded: our own PPLNS weight in the very window the block pays out from,
+// and the strongest share peers would ever have seen from us, forfeited on
+// every block won. LTC has always written on both classes (core/web_server.cpp).
+//
+// The sharechain and the coin blockchain are independent systems; the solve
+// belongs in both.
+//
+// Determinism: SHA256d of a fixed header is not steerable, so the outcome CLASS
+// is pinned by the TARGETS, not the hash (the dgb_work_source_test idiom).
+// block_nbits 0x2100ffff expands to 0xffff << 240 (~2^256): every practical
+// digest clears it -> WonBlock. 0x03000001 expands to 1: none clears it.
+// ---------------------------------------------------------------------------
+
+struct WorkSourceRig {
+    bch::coin::BCHChainParams params = bch::coin::BCHChainParams::mainnet();
+    bch::coin::HeaderChain    chain{params};
+    bch::coin::Mempool        mempool;
+    bool                      submit_called = false;
+
+    std::unique_ptr<bch::stratum::BCHWorkSource> make()
+    {
+        auto fn = [this](const std::vector<unsigned char>&, uint32_t) -> bool {
+            submit_called = true;
+            return true;
+        };
+        return std::make_unique<bch::stratum::BCHWorkSource>(
+            chain, mempool, /*is_testnet=*/false, fn);
+    }
+};
+
+core::stratum::JobSnapshot make_submit_job(uint32_t share_bits,
+                                           const std::string& block_nbits)
+{
+    core::stratum::JobSnapshot j;
+    j.coinb1       = "01000000";            // minimal well-formed coinbase head
+    j.coinb2       = "00000000";            // minimal coinbase tail
+    j.gbt_prevhash = std::string(64, '0');  // 32-byte prevhash, BE display hex
+    j.nbits        = "1e0fffff";            // header (share) bits
+    j.version      = 0x20000000u;
+    j.share_bits   = share_bits;
+    j.block_nbits  = block_nbits;
+    j.subsidy      = 312500000ULL;
+    return j;
+}
+
+void test_won_block_also_writes_share()
+{
+    WorkSourceRig rig;
+    auto ws = rig.make();
+
+    bool share_written = false;
+    bool saw_block_already_submitted = false;
+    std::size_t seen_header_size = 0;
+    ws->set_create_share_fn(
+        [&](const std::vector<unsigned char>&,
+            const std::vector<uint8_t>&       header_80b,
+            const core::stratum::JobSnapshot&,
+            const std::vector<unsigned char>&) -> uint256
+        {
+            share_written    = true;
+            seen_header_size = header_80b.size();
+            // Reward-invariant witness: the block MUST already be dispatched.
+            saw_block_already_submitted = rig.submit_called;
+            return uint256(uint64_t(0xb10c5));
+        });
+
+    auto job = make_submit_job(/*share_bits=*/0x2100ffffu, /*block_nbits=*/"2100ffff");
+    auto result = ws->mining_submit(
+        "bchtest.worker1", "job-won-share", "00000000", "00000000",
+        "60000000", "00000000", "rid", /*merged_addresses=*/{}, &job);
+
+    CHECK(result.is_boolean() && result.get<bool>());
+    CHECK(rig.submit_called);                 // block dispatched, unchanged
+    CHECK(share_written);                     // ...AND the share is written
+    CHECK(saw_block_already_submitted);       // block FIRST, always
+    CHECK(seen_header_size == 80u);
+}
+
+void test_won_block_survives_throwing_share_write()
+{
+    WorkSourceRig rig;
+    auto ws = rig.make();
+    ws->set_create_share_fn(
+        [](const std::vector<unsigned char>&,
+           const std::vector<uint8_t>&,
+           const core::stratum::JobSnapshot&,
+           const std::vector<unsigned char>&) -> uint256 {
+            throw std::runtime_error("share write blew up");
+        });
+
+    auto job = make_submit_job(/*share_bits=*/0x2100ffffu, /*block_nbits=*/"2100ffff");
+    auto result = ws->mining_submit(
+        "bchtest.worker1", "job-won-throw", "00000000", "00000000",
+        "60000000", "00000000", "rid", /*merged_addresses=*/{}, &job);
+
+    CHECK(rig.submit_called);                     // block reached the sink
+    CHECK(result.is_boolean() && result.get<bool>());  // throw did not escape
+}
+
+void test_plain_share_still_writes_and_does_not_broadcast()
+{
+    WorkSourceRig rig;
+    auto ws = rig.make();
+    bool share_written = false;
+    ws->set_create_share_fn(
+        [&](const std::vector<unsigned char>&,
+            const std::vector<uint8_t>&,
+            const core::stratum::JobSnapshot&,
+            const std::vector<unsigned char>&) -> uint256 {
+            share_written = true;
+            return uint256(uint64_t(0x5157));
+        });
+
+    // block target 1 -> no digest is a block; share target maximal -> accepted.
+    auto job = make_submit_job(/*share_bits=*/0x2100ffffu, /*block_nbits=*/"03000001");
+    auto result = ws->mining_submit(
+        "bchtest.worker1", "job-share", "00000000", "00000000",
+        "60000000", "00000000", "rid", /*merged_addresses=*/{}, &job);
+
+    CHECK(result.is_boolean() && result.get<bool>());
+    CHECK(share_written);
+    CHECK(!rig.submit_called);
+}
+
 } // namespace
 
 int main()
@@ -358,6 +497,9 @@ int main()
     test_degraded_reference_hash_absent();
     test_job_builder_commitment_slot_invariant();
     test_truncation_and_trailing_bytes();
+    test_won_block_also_writes_share();
+    test_won_block_survives_throwing_share_write();
+    test_plain_share_still_writes_and_does_not_broadcast();
 
     if (failures) {
         std::cerr << failures << " CHECK(s) failed\n";