Merge pull request #571 from frstrtr/dash/version-gate-accept-seam

dash: wire version-transition gate into a src/ accept seam (chain_admit.hpp)

Author: frstrtr

src/impl/dash/chain_admit.hpp

@@ -0,0 +1,68 @@
+#pragma once
+
+// Dash chain-relative share admission seam.
+//
+// THE PROBLEM THIS CLOSES: dash::verify_version_transition (share_check.hpp) is
+// the mint<->accept version-coupling gate, fully KAT-proven in isolation — but
+// before this header it had ZERO src/ consumers (the only callers lived in
+// test/test_dash_conformance.cpp). btc/dgb carry this coupling LIVE: dgb's
+// src/impl/dgb/node.cpp runs share_init_verify() in a parallel phase and then
+// applies the chain-relative gates serially as each share is admitted to the
+// tracker. Dash had no accept orchestrator at all, so the gate was dead in
+// prod. This header is the FIRST src/ consumer: the single, named seam the S8
+// dash node run-loop / launcher --run share-receive path calls per incoming
+// share. The behavioural thresholds (60% weighted successor / 95% weighted v36
+// obsolescence) are pinned by the version_negotiation isolation KATs and the
+// DashConformanceVersionWiring wired-path KATs; this seam locks the WIRING
+// boundary the node accept path consumes, not the thresholds.
+//
+// Oracle: ref/p2pool-dash/p2pool/data.py — Share.__init__() (step 1, structural
+// + PoW) followed by tracker admission running Share.check() (step 2, the
+// chain-relative version guard). Mirrors the cross-coin standard so the v37
+// unification is a clean migration, not a per-coin v36 dialect.
+
+#include "share.hpp"
+#include "share_check.hpp"   // share_init_verify (step 1) + verify_version_transition (step 2)
+
+#include <core/coin_params.hpp>
+#include <core/uint256.hpp>
+
+namespace dash
+{
+
+// admit_chain_relative — STEP 2 ONLY: the chain-relative version-transition
+// gate, decoupled from the CPU-bound structural verify. This is the seam the
+// node accept path runs AFTER share_init_verify has been computed (typically in
+// a parallel scrypt/X11 phase off the io_context — the dgb node.cpp pattern),
+// so the chain admission never re-runs PoW. Throws std::invalid_argument on a
+// disallowed version switch; returns normally when the share is admissible.
+//
+// Extension point: additional chain-relative admission gates (timestamp
+// monotonicity, abswork progression, far_share_hash anchoring) compose HERE as
+// they are conformance-proven, keeping the node accept path a single call.
+template <typename ChainT>
+inline void admit_chain_relative(const DashShare& share, ChainT& chain,
+                                 uint64_t chain_length)
+{
+    verify_version_transition(share, chain, chain_length);
+}
+
+// admit_share — the canonical per-incoming-share admission a Dash node runs in
+// its accept path, composing BOTH steps in oracle order:
+//   step 1  share_init_verify(...)        structural + X11 PoW, coin-param-relative
+//   step 2  admit_chain_relative(...)      version mint<->accept coupling, chain-relative
+// Returns the verified share hash (the value share_init_verify computes); throws
+// std::invalid_argument on any rejected share. Use this single-call form on the
+// serial accept path; use share_init_verify + admit_chain_relative separately
+// when the structural verify is hoisted into a parallel phase.
+template <typename ChainT>
+inline uint256 admit_share(const DashShare& share, ChainT& chain,
+                           const core::CoinParams& params, uint64_t chain_length,
+                           bool check_pow = true)
+{
+    uint256 hash = share_init_verify(share, params, check_pow);
+    admit_chain_relative(share, chain, chain_length);
+    return hash;
+}
+
+} // namespace dash

test/test_dash_conformance.cpp

@@ -29,6 +29,7 @@
 
 #include <impl/dash/coinbase_builder.hpp>   // dash::coinbase::merkle_branches_raw, HexStr
 #include <impl/dash/share_check.hpp>        // dash::check_merkle_link
+#include <impl/dash/chain_admit.hpp>        // dash::admit_chain_relative (accept-path seam)
 #include <impl/dash/share_types.hpp>        // dash::MerkleLink
 #include <impl/dash/pplns.hpp>           // dash::pplns::compute_payouts, dash::ShareChain, DashShare
 #include <impl/dash/version_negotiation.hpp> // dash::version_negotiation::get_desired_version_counts/weights
@@ -1132,6 +1133,70 @@ TEST(DashConformanceVersionWiring, InitPhaseComposedAndRejectsBeforeGate) {
     }
 }
 
+// ── Accept-path SEAM: dash::admit_chain_relative (chain_admit.hpp) ───────────
+// The DashConformanceVersionWiring group above proves the gate primitive
+// (verify_version_transition). These prove the FIRST src/ CONSUMER seam routes
+// through to that gate: dash::admit_chain_relative — the single call the S8 node
+// run-loop / launcher --run share-receive path makes after share_init_verify.
+// Before chain_admit.hpp the gate had ZERO src/ consumers (test-only). These
+// lock the consumer boundary; the 60%/95% floors stay pinned by the KATs above.
+TEST(DashChainAdmitSeam, AdmitsSameVersionThroughSeam) {
+    SyntheticChain sc;
+    const uint160 A = miner_h160(0x16);
+    uint256 tip = build_uniform(sc, 22, 36, BITS_DIFF1, A);
+    add_versioned(sc, 0x90, tip, 36, BITS_DIFF1, A);
+    EXPECT_NO_THROW(dash::admit_chain_relative(*sc.pool.back(), sc.chain, CL));
+}
+
+// Seam rejects a stale pre-v36 share once the lookbehind is >=95% weighted v36
+// (routes to the obsolescence arm of the gate).
+TEST(DashChainAdmitSeam, RejectsStalePreV36ThroughSeam) {
+    SyntheticChain sc;
+    const uint160 A = miner_h160(0x17);
+    uint256 tip = build_uniform(sc, 22, 36, BITS_DIFF1, A);
+    add_versioned(sc, 0x91, tip, 16, BITS_DIFF1, A);  // stale v16 on v36 tip
+    try {
+        dash::admit_chain_relative(*sc.pool.back(), sc.chain, CL);
+        FAIL() << "expected seam to reject stale pre-v36 share";
+    } catch (const std::invalid_argument& e) {
+        EXPECT_NE(std::string(e.what()).find("too old"), std::string::npos);
+    }
+}
+
+// Seam rejects an upgrade boundary lacking CHAIN_LENGTH history (routes to the
+// successor-guard arm; no-history short-circuit throws "enough history").
+TEST(DashChainAdmitSeam, RejectsUpgradeWithoutHistoryThroughSeam) {
+    SyntheticChain sc;
+    const uint160 A = miner_h160(0x18);
+    uint256 tip = build_uniform(sc, 5, 16, BITS_DIFF1, A);  // < CL ancestors
+    add_versioned(sc, 0x92, tip, 36, BITS_DIFF1, A);        // v16 -> v36 upgrade
+    try {
+        dash::admit_chain_relative(*sc.pool.back(), sc.chain, CL);
+        FAIL() << "expected seam to reject upgrade without enough history";
+    } catch (const std::invalid_argument& e) {
+        EXPECT_NE(std::string(e.what()).find("enough history"), std::string::npos);
+    }
+}
+
+// Seam admits an upgrade boundary whose tail window already carries the
+// successor version (>=60% successor votes) — the gate's admit path.
+TEST(DashChainAdmitSeam, AdmitsSuccessorMajorityThroughSeam) {
+    SyntheticChain sc;
+    const uint160 A = miner_h160(0x19);
+    uint256 tip = build_uniform(sc, 22, 36, BITS_DIFF1, A);          // tail = v36
+    uint256 prev = add_versioned(sc, 0x93, tip, 16, BITS_DIFF1, A);  // lone v16 prev
+    add_versioned(sc, 0x94, prev, 36, BITS_DIFF1, A);                // v16 -> v36 upgrade
+    EXPECT_NO_THROW(dash::admit_chain_relative(*sc.pool.back(), sc.chain, CL));
+}
+
+// Genesis / no-parent share is admitted unconditionally through the seam.
+TEST(DashChainAdmitSeam, AdmitsGenesisThroughSeam) {
+    SyntheticChain sc;
+    const uint160 A = miner_h160(0x1a);
+    add_versioned(sc, 0x95, uint256(), 36, BITS_DIFF1, A);  // null prev_hash
+    EXPECT_NO_THROW(dash::admit_chain_relative(*sc.pool.back(), sc.chain, CL));
+}
+
 // ── DIP4 special-tx coinbase payload (CCbTx) wire-encoding conformance ──────
 // DASH coinbase transactions carry a DIP-0004 "special transaction" extra
 // payload: the CCbTx. Its merkleRootMNList / merkleRootQuorums fields are what