embedded_getwork/seam_workview/block_broadcast/coin_node_seam were
authored alongside the #156 body but never added to CMake or build.yml,
so they built locally yet never ran in CI (authored-but-unrun =
false-green). Add bch_embedded_getwork_test, bch_embedded_seam_workview_test,
bch_embedded_block_broadcast_test, bch_coin_node_seam_test to the bch
test CMakeLists and to BOTH the Linux Release and ASan/UBSan target
allowlists in build.yml, mirroring the #137 NOT_BUILT lesson (test in
CMake must also be in build.yml). Single-coin src/impl/bch-isolated;
no impl_bch coin lib; zero p2pool-merged-v36 surface.

Add tools/ci/check_test_target_allowlist.py + a standalone, build-free CI job
that fails closed when a per-coin test executable declared in
src/impl/<coin>/test/CMakeLists.txt is absent from the build.yml --target
allowlist. Such a target is never compiled, so CTest reports it NOT_BUILT and
silently passes -- the DGB #137 / test_dgb_subsidy class that red'd master.

Generic across all coin lanes (bch/btc/dgb/ltc/nmc); expands foreach(t IN LISTS
VAR) + add_executable(prefix_${t}) generators. Escape hatch for intentionally
unbuilt targets: # ci-allowlist-exempt: <target> -- <reason>. Currently audits
48 targets across 5 lanes, all present (zero drift).

…gime-independent)

Pin-independent, VM-independent scaffolding for the G3 block-production
gate. Drives the won-block path FOUND -> ASSEMBLED -> ACCEPTED across the
three share-version regimes (v35 / HYBRID activation-boundary / v36) and
asserts the dual-path broadcaster reaches the network in every regime
under both a healthy P2P sink and an RPC-only fallback.

Locks the load-bearing invariant regime _|_ reaches_network: core::
version_gate governs the SHARE encoding / consensus revision only and
must never gate whether a found block reaches the chain. Uses the real
version_gate SSOT and the real broadcast_block_with_fallback seam; the
terminal ACCEPTED-by-bitcoind leg is modelled by sink fakes and swaps to
the live regtest path when VM130 auth lands. Standalone g++ harness in
the block_broadcast_test.cpp style -- off the CI allowlist (no #137
NOT_BUILT) until the G2/G3 VM lane is authorized. 18/18 local PASS.

P1 PB for embedded merge-mined Namecoin. Adds the one NMC tx-class with no
BTC/DOGE analog: the name operations (name_new / name_firstupdate /
name_update). c2pool is a merge-miner, not a name registry, so name txs are
RELAYED into the block template WITHOUT name-db consensus validation
(SPV-trust in the configured namecoind backend; namecoind owns name-db
consensus).

- coin/mempool.hpp: classify_name_op() (version-marker + leading name opcode,
  with a false-positive guard against bare OP_1..OP_3 segwit/multisig outputs
  in plain Bitcoin-version txs); MempoolEntry carries NameOp + TxSource
  provenance (daemon-trusted vs peer-relay, the SPV-trust boundary);
  name_op_count() / trusted_name_op_count() queries. Name-tx fees flow through
  the existing get_sorted_txs_with_fees -> coinbasevalue path unchanged (name
  ops are NOT special-cased in payout; Bitcoin subsidy schedule).
- test/nmc_mempool_name_test.cpp: 9 KATs (classify incl. false-positive guard,
  admission + provenance tagging, fee reaching template coinbasevalue).
- Registered in test/CMakeLists.txt + build.yml allowlist (both lines) to
  avoid a #137 NOT_BUILT sentinel.

Per-coin isolation: src/impl/nmc/ only; btc tree consumed read-only. The three
§4 PF caveats (bind trust to daemon source; v36 short-circuit; aux-slot
distinctness) are folded into the PF KAT slice, not gated on PB.

PE item 3, dispatcher leg. Adds nmc::coin::broadcast_won_aux_block -- the
NMC dual-path won-block dispatcher mirroring dgb::coin::broadcast_won_block:
embedded P2P relay PRIMARY + external namecoind submitauxblock RPC FALLBACK
(fired ALWAYS per the broadcaster-gate dual-path rule), each leg guarded,
landed_first records the race, NEITHER sink => ERROR scream, never
silent-drops a won block. Both legs are std::function sinks so the contract
is build-verifiable now; the run-loop binds the live .140 testnet namecoind
submitauxblock client in the follow-up slice (item 4 soak gated on it).

5 contract KATs (no-sink no-op / p2p-only / rpc-only / dual-path
always-fires-fallback / fallback-no-ack-does-not-mask-p2p). Registered in
test/CMakeLists.txt AND both build.yml --target allowlist lines (no #137
NOT_BUILT sentinel). Header-only, fenced src/impl/nmc/, consumes core/* only;
no consensus-value change, no p2pool-merged-v36 surface touched.

Co-authored-by: frstrtr <frstrtr@users.noreply.github.com>

Net-new vs the helper-level nmc_block_broadcast_test (which only checks
sink PRESENCE): reconstruct the NMC run-loop binding exactly as
c2pool_refactored.cpp does -- set_block_relay -> merged_broadcasters
[chain_id] -> submit_block_raw (PRIMARY P2P) and set_fallback_backend ->
AuxChainRPC::submit_aux_block (FALLBACK submitauxblock) -- and lock
DELIVERY through BOTH legs with fake sinks.

host_dual_path_delivered() asserts both networks were ACTUALLY reached,
so a refactor that drops set_block_relay, drops set_fallback_backend, or
mis-keys merged_broadcasters by chain_id turns the lock RED. The mis-key
case is the insidious one: p2p_sent stays true (sink present) yet the
peer broadcaster is never invoked -- a delivery-level invariant the
presence-only helper KAT cannot catch.

Test-only, fake sinks, zero consensus surface (no PoW/share/aux-commit/
template/PPLNS). nmc/ isolated; consumes coin/block_broadcast.hpp only.
Registered in test/CMakeLists.txt AND both build.yml --target allowlist
rows (Linux + ASan) -- no #137/#143 NOT_BUILT sentinel.

5/5 local PASS.

Net-new vs the helper-level nmc_block_broadcast_test (which only checks
sink PRESENCE): reconstruct the NMC run-loop binding exactly as
c2pool_refactored.cpp does -- set_block_relay -> merged_broadcasters
[chain_id] -> submit_block_raw (PRIMARY P2P) and set_fallback_backend ->
AuxChainRPC::submit_aux_block (FALLBACK submitauxblock) -- and lock
DELIVERY through BOTH legs with fake sinks.

host_dual_path_delivered() asserts both networks were ACTUALLY reached,
so a refactor that drops set_block_relay, drops set_fallback_backend, or
mis-keys merged_broadcasters by chain_id turns the lock RED. The mis-key
case is the insidious one: p2p_sent stays true (sink present) yet the
peer broadcaster is never invoked -- a delivery-level invariant the
presence-only helper KAT cannot catch.

Test-only, fake sinks, zero consensus surface (no PoW/share/aux-commit/
template/PPLNS). nmc/ isolated; consumes coin/block_broadcast.hpp only.
Registered in test/CMakeLists.txt AND both build.yml --target allowlist
rows (Linux + ASan) -- no #137/#143 NOT_BUILT sentinel.

5/5 local PASS.

Net-new vs the helper-level nmc_block_broadcast_test (which only checks
sink PRESENCE): reconstruct the NMC run-loop binding exactly as
c2pool_refactored.cpp does -- set_block_relay -> merged_broadcasters
[chain_id] -> submit_block_raw (PRIMARY P2P) and set_fallback_backend ->
AuxChainRPC::submit_aux_block (FALLBACK submitauxblock) -- and lock
DELIVERY through BOTH legs with fake sinks.

host_dual_path_delivered() asserts both networks were ACTUALLY reached,
so a refactor that drops set_block_relay, drops set_fallback_backend, or
mis-keys merged_broadcasters by chain_id turns the lock RED. The mis-key
case is the insidious one: p2p_sent stays true (sink present) yet the
peer broadcaster is never invoked -- a delivery-level invariant the
presence-only helper KAT cannot catch.

Test-only, fake sinks, zero consensus surface (no PoW/share/aux-commit/
template/PPLNS). nmc/ isolated; consumes coin/block_broadcast.hpp only.
Registered in test/CMakeLists.txt AND both build.yml --target allowlist
rows (Linux + ASan) -- no #137/#143 NOT_BUILT sentinel.

5/5 local PASS.

Phase PF fallback-path half. The V36 external_fallback invariant requires
the external-daemon (.140 namecoind submitauxblock) RPC fallback to PERSIST
as the retained path alongside the embedded P2P relay. Existing dispatcher
and host-wiring KATs bind the fallback leg to an always-ack fake, so neither
distinguishes WHICH backend serves it.

This adds nmc_fallback_path_conformance_test (3 KATs) locking the one fact PF
owns: the fallback MUST be the external namecoind RPC (a daemon that can ack),
NOT the embedded backend daemon-less submit_aux_block (structurally false,
aux_chain_embedded.hpp:153). Mis-wiring set_fallback_backend to the embedded
self-leg leaves the wiring looking present but turns the retained fallback into
a dead path -- a won aux block is silently lost when P2P is down. Test 2 makes
that regression RED; test 1 proves the external path carries when P2P is down;
test 3 locks that the external fallback always-fires alongside a working
embedded relay (not optimized away).

Test-only, NMC-fenced (src/impl/nmc/ only), zero consensus surface. Registered
in test/CMakeLists.txt + gtest_add_tests and the build.yml --target allowlist
(both legs) to avoid a #137-style NOT_BUILT sentinel.

Co-authored-by: frstrtr <frstrtr@users.noreply.github.com>

…erged-aux)

Standalone host-compilable harness proving FOUND->ASSEMBLED->ACCEPTED is
regime-independent (v35/HYBRID/v36) for BOTH the LTC parent block and the
DOGE aux block it carries. Asserts:
 - populated assembly: 6 diverse tx (coinbase/P2PKH/P2SH/segwit/MWEB/aux-cb),
   never coinbase-only, identical across regimes;
 - LTC dual sink (submit_block_p2p -> submitblock RPC fallback);
 - DOGE aux dual sink (embedded P2P relay -> submitauxblock->dogecoind);
 - merged-mining coupling: aux LOST when parent LOST, aux sinks notwithstanding;
 - load-bearing invariant regime _|_ reaches_network on BOTH chains.

Confined to src/impl/ltc/test; reads core::version_gate SSOT read-only, no
core/bitcoin_family drift. Off the CI allowlist (no #137 trap) until the G3
regtest VM lane is authorized; live leg swaps the sink lambdas for the real
submit paths.