dgb(#82): recompute won-block header merkle_root over the actual tx vector

The tx-bearing reconstruct path (reconstruct_won_block_from_template)
sources its body from the captured GBT template, but assemble_won_block
derived the header merkle_root by walking the share merkle_link
(check_merkle_link). That link only spans the txs it was built over, so a
coinbase-only link with a funded tx in the body emitted a header root for
the coinbase-only set -> daemon rejects bad-txnmrklroot (the #82 funded
multi-tx soak FAIL on both arms).

Recompute the root over [gentx_hash] ++ each other-tx txid via a canonical
BuildMerkleRoot (build_block_merkle_root), set before serialize so the
nonce-grind seam grinds the final header. Coinbase-only is unchanged
(root == gentx_hash). +1 regression KAT; corrected Test 4 which had
enshrined the buggy coinbase-only root with 2 other_txs. 8/8 green.

Author: frstrtr

src/impl/dgb/coin/block_assembly.hpp

@@ -45,6 +45,7 @@
 #include "block.hpp"
 #include "../share_check.hpp"   // dgb::check_merkle_link (SSOT merkle-branch walk)
 #include "../share_types.hpp"   // dgb::MerkleLink
+#include "mempool.hpp"          // dgb::coin::compute_txid (block-body txid SSOT)
 
 namespace dgb
 {
@@ -72,6 +73,28 @@ reconstruct_block_header(const SmallBlockHeaderType& small_header,
     return header;
 }
 
+// Build the canonical Bitcoin block merkle root over an ordered txid list
+// ([gentx_hash] ++ other-tx txids): duplicate-the-last on an odd count, then
+// sha256d each adjacent pair up to the single root.  This is the BLOCK-BODY
+// SSOT for the header merkle_root -- it MUST be recomputed over the txs the
+// block actually carries, NOT walked up the share's merkle_link, or a
+// tx-bearing reconstruct emits a header root for the coinbase-only set and the
+// daemon rejects the block with bad-txnmrklroot (#82 funded-soak regression).
+inline uint256 build_block_merkle_root(std::vector<uint256> txids)
+{
+    if (txids.empty()) return uint256();
+    while (txids.size() > 1) {
+        if (txids.size() % 2 == 1)
+            txids.push_back(txids.back());
+        std::vector<uint256> next;
+        next.reserve(txids.size() / 2);
+        for (size_t i = 0; i + 1 < txids.size(); i += 2)
+            next.push_back(Hash(txids[i], txids[i + 1]));
+        txids = std::move(next);
+    }
+    return txids[0];
+}
+
 // Assemble the full serialized parent block for a won share.
 //   small_header  : share.m_min_header (version|prev|time|bits|nonce)
 //   gentx         : the reconstructed coinbase transaction (block tx 0)
@@ -105,6 +128,26 @@ assemble_won_block(const SmallBlockHeaderType& small_header,
     for (const auto& tx : other_txs)
         block.m_txs.push_back(tx);
 
+    // Recompute the header merkle_root over the ACTUAL block tx vector
+    // ([gentx_hash] ++ each other-tx txid), overriding the merkle_link walk
+    // reconstruct_block_header did.  The share's merkle_link only spans the txs
+    // it was built over; when the reconstruct sources its body from the captured
+    // GBT template (reconstruct_won_block_from_template) that link can reflect a
+    // different (coinbase-only) set, so trusting it emits a header root that
+    // disagrees with the body -> daemon bad-txnmrklroot.  Deriving the root from
+    // the body keeps header and body consistent by construction (coinbase-only:
+    // build_block_merkle_root([gentx_hash]) == gentx_hash, identical to the
+    // empty-branch walk -- no regression).  Set BEFORE serialize so the
+    // nonce-grind seam (regrind_block.hpp) grinds the final, correct header.
+    {
+        std::vector<uint256> txids;
+        txids.reserve(block.m_txs.size());
+        txids.push_back(gentx_hash);
+        for (const auto& tx : other_txs)
+            txids.push_back(compute_txid(tx));
+        block.m_merkle_root = build_block_merkle_root(std::move(txids));
+    }
+
     PackStream packed = pack<BlockType>(block);
     auto sp = packed.get_span();
     std::vector<unsigned char> bytes(

src/impl/dgb/test/block_assembly_test.cpp

@@ -180,7 +180,16 @@ TEST(DgbBlockAssembly, AssembleRoundTripsCoinbaseFirst)
     EXPECT_EQ(blk.m_timestamp, sh.m_timestamp);
     EXPECT_EQ(blk.m_bits, sh.m_bits);
     EXPECT_EQ(blk.m_nonce, sh.m_nonce);
-    EXPECT_EQ(blk.m_merkle_root, gtx_hash);
+    // header merkle_root is recomputed over the ACTUAL block tx vector
+    // ([gentx_hash] ++ other-tx txids), NOT the (empty here) share merkle_link:
+    // with two other_txs it must differ from the coinbase-only root and equal
+    // build_block_merkle_root over the real leaves (#82 bad-txnmrklroot fix).
+    {
+        std::vector<uint256> leaves = { gtx_hash,
+            dgb::coin::compute_txid(other[0]), dgb::coin::compute_txid(other[1]) };
+        EXPECT_EQ(blk.m_merkle_root, dgb::coin::build_block_merkle_root(leaves));
+        EXPECT_NE(blk.m_merkle_root, gtx_hash);
+    }
 
     // txs = [gentx] ++ other_txs : coinbase at index 0, total = 1 + 2.
     ASSERT_EQ(blk.m_txs.size(), 3u);
@@ -295,4 +304,32 @@ TEST(DgbBlockAssembly, LegacyGentxEmitsLegacyBlock)
     EXPECT_EQ(hex, hex2);
 }
 
+// --- Test 8: tx-bearing block header root == body root, != coinbase-only ------
+// Regression lock for the #82 funded multi-tx gate: a reconstructed block that
+// carries 1+ non-coinbase txs MUST publish a header merkle_root computed over
+// [gentx]++other_txs, so a peer/daemon validating the body accepts it.  The
+// pre-fix path walked the share merkle_link (empty == coinbase-only => gentx_hash)
+// and the daemon rejected bad-txnmrklroot.
+TEST(DgbBlockAssembly, TxBearingRootMatchesBodyNotMerkleLink)
+{
+    auto sh = make_small_header();
+    auto gentx = make_gentx();
+    auto gtx_hash = fixed_gentx_hash();
+    ::dgb::MerkleLink link;            // empty link == the coinbase-only branch
+    std::vector<MutableTransaction> other = { make_tx(42) };
+
+    auto [bytes, hex] = assemble_won_block(sh, gentx, gtx_hash, link, other);
+    PackStream ps(bytes);
+    BlockType blk;
+    ps >> blk;
+
+    ASSERT_EQ(blk.m_txs.size(), 2u);
+    const uint256 body_root = dgb::coin::build_block_merkle_root(
+        { gtx_hash, dgb::coin::compute_txid(other[0]) });
+    EXPECT_EQ(blk.m_merkle_root, body_root);
+    // the empty merkle_link would have yielded gentx_hash -- prove we did NOT.
+    EXPECT_NE(blk.m_merkle_root, gtx_hash);
+    EXPECT_NE(body_root, gtx_hash);
+}
+
 } // namespace