dgb(#82): expose SSOT gentx bytes for won-block reconstruction

generate_share_transaction computes the coinbase via assemble_gentx_coinbase
(the SSOT proven by #172) but returned only the gentx_hash, discarding the
bytes. reconstruct_won_block needs the exact non-witness coinbase bytes -- it
is block tx[0] and its txid is the merkle leaf -- not just the hash.

Add an optional out_gentx (GentxCoinbase*) param, default nullptr: zero change
for the verification callers, surfaces {bytes,txid} for the reconstructor. KAT
proves the exposed bytes hash to the returned gentx_hash and deserialize into
the coinbase MutableTransaction that assemble_won_block frames, round-tripping
byte-identically (non-witness). Single-coin (src/impl/dgb/ only); reuses the
existing #172 dgb_gentx_share_path_test target (no new allowlist entry).

Author: frstrtr

src/impl/dgb/share_check.hpp

@@ -933,7 +933,7 @@ inline std::vector<unsigned char> get_share_script(const auto* obj)
 // Reference: frstrtr/p2pool-merged-v36  p2pool/data.py  generate_transaction()
 // ============================================================================
 template <typename ShareT, typename TrackerT>
-uint256 generate_share_transaction(const ShareT& share, TrackerT& tracker, const core::CoinParams& params, bool dump_diag = false, bool v36_active = false)
+uint256 generate_share_transaction(const ShareT& share, TrackerT& tracker, const core::CoinParams& params, bool dump_diag = false, bool v36_active = false, dgb::coin::GentxCoinbase* out_gentx = nullptr)
 {
     auto gst_t0 = std::chrono::steady_clock::now();
     constexpr int64_t ver = ShareT::version;
@@ -1310,6 +1310,11 @@ uint256 generate_share_transaction(const ShareT& share, TrackerT& tracker, const
         reinterpret_cast<const std::byte*>(_gc.bytes.data()), _gc.bytes.size()));
     auto txid = _gc.txid;
 
+    // Expose the SSOT gentx (non-witness bytes + txid) for the won-block
+    // reconstructor (#82): block tx[0] is this coinbase and gentx_hash is
+    // its merkle leaf. Default nullptr => zero change for verification callers.
+    if (out_gentx) *out_gentx = _gc;
+
     // V36 hash_link cross-check: compute prefix hash_link from our coinbase
     // and compare with the share's stored hash_link. If states differ,
     // the prefix (outputs/amounts) differs from what p2pool built.

src/impl/dgb/test/gentx_share_path_test.cpp

@@ -31,6 +31,7 @@
 #include <impl/dgb/share_check.hpp>
 #include <impl/dgb/params.hpp>
 #include <impl/dgb/coin/gentx_coinbase.hpp>
+#include <impl/dgb/coin/transaction.hpp>
 
 #include <core/pack.hpp>
 #include <core/hash.hpp>
@@ -261,4 +262,47 @@ TEST(DgbGentxSharePath, CoinbaseInputsAreLoadBearing)
     EXPECT_NE(h0, h2) << "coinbase script did not reach the gentx vin";
 }
 
+// --- Test 4: SSOT gentx bytes are exposed for won-block reconstruction (#82) ---
+// reconstruct_won_block needs the EXACT coinbase bytes whose txid is the merkle
+// leaf -- not just the hash. The out_gentx param surfaces them straight from the
+// SSOT assembler; they must (a) hash to the returned gentx_hash and (b)
+// deserialize into the coinbase MutableTransaction that assemble_won_block frames
+// as block tx[0], round-tripping byte-identically.
+TEST(DgbGentxSharePath, SsotGentxBytesExposedForReconstruct)
+{
+    auto params = dgb::make_coin_params(false);
+    dgb::ShareTracker tracker;
+    auto share = make_v36_share();
+
+    dgb::coin::GentxCoinbase gc;
+    uint256 gentx_hash = dgb::generate_share_transaction(
+        share, tracker, params, /*dump_diag=*/false, /*v36_active=*/true, &gc);
+
+    ASSERT_FALSE(gc.bytes.empty()) << "out_gentx not populated";
+    EXPECT_EQ(gc.txid, gentx_hash)
+        << "exposed gentx bytes do not match the returned gentx_hash";
+    auto sp = std::span<const unsigned char>(gc.bytes.data(), gc.bytes.size());
+    EXPECT_EQ(Hash(sp), gentx_hash)
+        << "double-SHA(exposed bytes) != gentx_hash (merkle leaf would mismatch)";
+
+    // Deserialize into the coinbase tx that assemble_won_block consumes.
+    dgb::coin::MutableTransaction gentx;
+    {
+        PackStream ps(gc.bytes);
+        dgb::coin::UnserializeTransaction(gentx, ps, dgb::coin::TX_NO_WITNESS);
+    }
+    // Coinbase shape: single input spending the null outpoint at 0xffffffff.
+    ASSERT_EQ(gentx.vin.size(), 1u);
+    EXPECT_TRUE(gentx.vin[0].prevout.hash.IsNull());
+    EXPECT_EQ(gentx.vin[0].prevout.index, 0xffffffffu);
+
+    // Re-serialize non-witness => byte-identical to the SSOT bytes, so the
+    // reconstructed block tx[0] is faithful and the daemon-side block hashes.
+    auto repacked = pack(dgb::coin::TX_NO_WITNESS(gentx));
+    std::vector<unsigned char> rebytes(
+        reinterpret_cast<const unsigned char*>(repacked.data()),
+        reinterpret_cast<const unsigned char*>(repacked.data()) + repacked.size());
+    EXPECT_EQ(rebytes, gc.bytes) << "coinbase tx does not round-trip the SSOT bytes";
+}
+
 } // namespace