btc/bch/dgb: route F3 send-path tx-completeness gate through the per-coin new_tx_hashes SSOT

The old flat m_new_transaction_hashes probe was FALSE for every share
variant (v17/v33 nest the refs in m_tx_info; v34+ carry none), so the F3
gate collected empty refs and treated every share as vacuously backable
-- it never withheld an incomplete share on any version. Route each
coin through its SSOT accessor from #913/#914 (btc/bch::new_tx_hashes,
dgb::append_share_tx_refs) so the gate sees the real refs.

Adds BtcBroadcastGate.RealShareTxInfoRefsWithheld driving a REAL v17/v33
share (not a top-level mock); mutation-verify confirms it goes red when
the probe is reverted to the dead flat form.

Author: frstrtr

src/impl/bch/node.cpp

@@ -746,9 +746,12 @@ std::vector<uint256> NodeImpl::send_shares(peer_ptr peer,
             shares, m_known_txs, [](ShareType& share) {
                 std::vector<uint256> hashes;
                 share.invoke([&](auto* obj) {
-                    if constexpr (requires { obj->m_new_transaction_hashes; })
-                        hashes.assign(obj->m_new_transaction_hashes.begin(),
-                                      obj->m_new_transaction_hashes.end());
+                    // #880: route through the bch::new_tx_hashes SSOT (#913)
+                    // instead of the dead flat probe -- v17/v33 nest the list in
+                    // m_tx_info, v34+ carry none. The old probe was FALSE for
+                    // every variant, so this F3 gate never withheld a share.
+                    if (const auto* new_txs = bch::new_tx_hashes(obj))
+                        hashes.assign(new_txs->begin(), new_txs->end());
                 });
                 return hashes;
             });

src/impl/btc/node.cpp

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 #include "node.hpp"
 #include "known_txs_retention.hpp"      // F3 retain_template_txs + select_backable_shares
+#include "share_tx_refs.hpp"          // btc::new_tx_hashes -- uniform gate probe (#880)
 #include "coin/template_other_txs.hpp"  // deserialize_template_other_txs (GBT data[] -> MutableTransaction)
 
 #include <core/common.hpp>
@@ -787,9 +788,13 @@ std::vector<uint256> NodeImpl::send_shares(peer_ptr peer, const std::vector<uint
             shares, m_known_txs, [](ShareType& share) {
                 std::vector<uint256> hashes;
                 share.invoke([&](auto* obj) {
-                    if constexpr (requires { obj->m_new_transaction_hashes; })
-                        hashes.assign(obj->m_new_transaction_hashes.begin(),
-                                      obj->m_new_transaction_hashes.end());
+                    // #880: route through the btc::new_tx_hashes SSOT instead
+                    // of the dead flat probe -- v17/v33 nest the list in
+                    // m_tx_info, v34+ carry none. The old probe was FALSE for
+                    // every variant, so this F3 gate saw empty refs -> every
+                    // share vacuously backable -> the gate no-op'd all versions.
+                    if (const auto* new_txs = btc::new_tx_hashes(obj))
+                        hashes.assign(new_txs->begin(), new_txs->end());
                 });
                 return hashes;
             });

src/impl/btc/share_tx_refs.hpp

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+//
+// Uniform access to a share's "new transaction hashes" list across the BTC
+// share variants.
+//
+// WHY THIS EXISTS. The BTC share variants do NOT all spell this list the same
+// way, and they do not all HAVE it:
+//
+//   btc::Share              (v17) -> obj->m_tx_info.m_new_transaction_hashes
+//   btc::NewShare           (v33) -> obj->m_tx_info.m_new_transaction_hashes
+//   btc::SegwitMiningShare  (v34) -> none (carries types::DataSegwitShare, no
+//   btc::PaddingBugfixShare (v35)    m_tx_info member -- share_check leaves the
+//   btc::MergedMiningShare  (v36)    tx list empty for version >= 34)
+//
+// node.cpp's send_shares() F3 broadcast gate (partition_backable) probed
+// `requires { obj->m_new_transaction_hashes; }` directly on the share object.
+// That expression is FALSE for every one of the five variants -- v17/v33 nest
+// the list inside m_tx_info, v34+ have no list -- so the gate collected an empty
+// ref list for every share, every share was vacuously backable, and the gate
+// no-op'd for ALL versions (#880): a v17/v33 share referencing a tx the peer
+// lacked was broadcast anyway, tripping the canonical "referenced unknown
+// transaction" disconnect. The per_share_refs relay block below the gate already
+// spells the nested list correctly (#871), which is why relay worked and only
+// the gate probe was dead.
+//
+// Probing through one accessor removes the class of bug: a new share variant
+// either exposes the list in one of the two known spellings and is handled, or
+// exposes none and is reported as "no list" (nothing to gate on) -- never
+// silently dead because of a member-name mismatch. Mirrors bch::new_tx_hashes
+// (src/impl/bch/share_tx_refs.hpp, #913) and ltc::new_tx_hashes
+// (src/impl/ltc/share_tx_refs.hpp, #873); BTC's variant topology is identical.
+
+#pragma once
+
+#include <vector>
+
+#include <core/uint256.hpp>
+
+namespace btc {
+
+// Pointer to the share's new-transaction-hash list, or nullptr when this share
+// variant carries none. A pointer (not a copy) so the broadcast hot path does no
+// per-share allocation. Lifetime is the share object's.
+template <typename ShareObj>
+inline auto new_tx_hashes(ShareObj* obj)
+{
+    if constexpr (requires { obj->m_tx_info.m_new_transaction_hashes; })
+        return &obj->m_tx_info.m_new_transaction_hashes;
+    else if constexpr (requires { obj->m_new_transaction_hashes; })
+        return &obj->m_new_transaction_hashes;
+    else
+        return static_cast<const std::vector<uint256>*>(nullptr);
+}
+
+// Compile-time pin of the fact above: true iff the share variant exposes the
+// list under the FLAT spelling that the old probe assumed. Held false by the KAT
+// for every BTC variant -- if this ever becomes true, the flat branch of
+// new_tx_hashes() is what handles it, not a silent skip.
+template <typename ShareObj>
+inline constexpr bool has_flat_new_tx_hashes =
+    requires(ShareObj* o) { o->m_new_transaction_hashes; };
+
+// True iff the share variant nests the list inside m_tx_info (v17 / v33).
+template <typename ShareObj>
+inline constexpr bool has_nested_new_tx_hashes =
+    requires(ShareObj* o) { o->m_tx_info.m_new_transaction_hashes; };
+
+} // namespace btc

src/impl/btc/test/broadcast_gate_test.cpp

@@ -33,10 +33,13 @@
 
 #include <map>
 #include <set>
+#include <utility>
 #include <vector>
 
 #include <core/uint256.hpp>
 #include <impl/btc/known_txs_retention.hpp>
+#include <impl/btc/share.hpp>          // real btc share variants + ShareType
+#include <impl/btc/share_tx_refs.hpp>  // btc::new_tx_hashes SSOT (#880)
 
 namespace {
 
@@ -206,3 +209,105 @@ TEST(BtcBroadcastMarking, WalkStrandedWhenMarkedBeforeSend)
         EXPECT_TRUE(walk(chain, marked).empty());   // now correctly de-duped
     }
 }
+
+
+// ---------------------------------------------------------------------------
+// #880 REGRESSION: the F3 gate above must be driven by the PRODUCTION probe,
+// not a hand-rolled stand-in. The FakeShare KATs exercise partition_backable's
+// MECHANICS with a top-level new_txs member and a bespoke refs_of -- exactly
+// the shape that let the real bug hide. In production send_shares probed
+// `requires { obj->m_new_transaction_hashes; }`, which is FALSE for every BTC
+// share variant (the list is nested in m_tx_info), so the gate collected empty
+// refs, every share was vacuously backable, and the gate silently no-op'd for
+// ALL versions -- a share referencing a tx the peer lacked was broadcast anyway
+// and tripped the canonical "referenced unknown transaction" disconnect.
+//
+// These KATs build REAL btc share types and drive them through the SAME
+// btc::new_tx_hashes SSOT that node.cpp's partition_backable refs_of now uses.
+// FAILS-BEFORE: revert btc::new_tx_hashes (or the gate) to the flat probe and
+// the v17/v33 expectations collapse -- the unbacked share is no longer withheld.
+// ---------------------------------------------------------------------------
+namespace {
+
+// The exact refs_of node.cpp installs on partition_backable: route the variant
+// through the btc::new_tx_hashes SSOT.
+std::vector<uint256> production_refs_of(btc::ShareType& share)
+{
+    std::vector<uint256> hashes;
+    share.invoke([&](auto* obj) {
+        if (const auto* new_txs = btc::new_tx_hashes(obj))
+            hashes.assign(new_txs->begin(), new_txs->end());
+    });
+    return hashes;
+}
+
+} // namespace
+
+// Accessor SSOT: a REAL v17 share nests its new-tx hashes in m_tx_info; the
+// production probe must surface them (the dead flat probe returned nullptr).
+TEST(BtcBroadcastGate, RealV17ShareRefsResolvedViaSsot)
+{
+    btc::Share s;
+    s.m_tx_info.m_new_transaction_hashes = {TA, TC};
+
+    const auto* refs = btc::new_tx_hashes(&s);
+    ASSERT_NE(refs, nullptr);
+    ASSERT_EQ(refs->size(), 2u);          // dead flat probe -> nullptr
+    EXPECT_EQ((*refs)[0], TA);
+    EXPECT_EQ((*refs)[1], TC);
+}
+
+// Accessor SSOT: v33 uses the same nested carrier.
+TEST(BtcBroadcastGate, RealV33ShareRefsResolvedViaSsot)
+{
+    btc::NewShare s;
+    s.m_tx_info.m_new_transaction_hashes = {TC};
+
+    const auto* refs = btc::new_tx_hashes(&s);
+    ASSERT_NE(refs, nullptr);
+    ASSERT_EQ(refs->size(), 1u);
+    EXPECT_EQ((*refs)[0], TC);
+}
+
+// Accessor SSOT: v34/v35/v36 carry no m_tx_info -> nullptr, compiled out.
+TEST(BtcBroadcastGate, SegwitAndMergedVariantsHaveNoRefs)
+{
+    btc::SegwitMiningShare v34;
+    btc::PaddingBugfixShare v35;
+    btc::MergedMiningShare v36;
+    EXPECT_EQ(btc::new_tx_hashes(&v34), nullptr);
+    EXPECT_EQ(btc::new_tx_hashes(&v35), nullptr);
+    EXPECT_EQ(btc::new_tx_hashes(&v36), nullptr);
+}
+
+// The gate end-to-end: REAL share variants + the production refs_of through
+// btc::partition_backable. A v17 share referencing a tx whose bytes we do NOT
+// hold must be withheld; the backable ones survive, in order. Pre-fix the dead
+// probe made every share vacuously backable -> skipped==0, nothing withheld.
+TEST(BtcBroadcastGate, RealShareTxInfoRefsWithheld)
+{
+    std::vector<btc::Share*> raws;   // own the heap shares for cleanup
+    auto v17 = [&](std::vector<uint256> refs) {
+        auto* raw = new btc::Share();
+        raw->m_tx_info.m_new_transaction_hashes = std::move(refs);
+        raws.push_back(raw);
+        btc::ShareType sv; sv = raw; return sv;
+    };
+
+    const std::set<uint256> held{TA, TB};   // TC bytes NOT held
+
+    std::vector<btc::ShareType> batch;
+    batch.push_back(v17({TA}));        // backable
+    batch.push_back(v17({TC}));        // references unheld TC -> withheld
+    batch.push_back(v17({TA, TB}));    // backable
+
+    const std::size_t skipped =
+        btc::partition_backable(batch, held, production_refs_of);
+
+    EXPECT_EQ(skipped, 1u);            // dead-probe regression -> 0
+    ASSERT_EQ(batch.size(), 2u);
+    EXPECT_EQ(production_refs_of(batch[0]).front(), TA);   // order preserved
+    EXPECT_EQ(production_refs_of(batch[1]).front(), TA);
+
+    for (auto* raw : raws) delete raw;
+}

src/impl/dgb/node.cpp

@@ -722,9 +722,11 @@ std::vector<uint256> NodeImpl::send_shares(peer_ptr peer,
             shares, m_known_txs, [](ShareType& share) {
                 std::vector<uint256> hashes;
                 share.invoke([&](auto* obj) {
-                    if constexpr (requires { obj->m_new_transaction_hashes; })
-                        hashes.assign(obj->m_new_transaction_hashes.begin(),
-                                      obj->m_new_transaction_hashes.end());
+                    // #880: route through the dgb::append_share_tx_refs SSOT
+                    // (#914) instead of the dead flat probe -- the refs live in
+                    // m_tx_info on v17/v33, absent v34+. The old probe was FALSE
+                    // for every version, so this F3 gate never withheld a share.
+                    dgb::append_share_tx_refs(obj, hashes);
                 });
                 return hashes;
             });