What

Reconstructor slice 4/7. Ports the FRAMING half of p2pool data.py Share.as_block into btc::coin::assemble_won_block (src/impl/btc/coin/block_assembly.hpp):

• reconstruct_block_header — the share stores only a SmallBlockHeader (no merkle_root); recompute the header root as btc::check_merkle_link(gentx_hash, merkle_link), exactly as verification did at check() time.
• assemble_won_block — frame [gentx] ++ other_txs (coinbase at index 0, template order) and emit {bytes, hex} through the live BlockType TX_WITH_WITNESS conditional codec — the identical NodeRPC::submit_block wire path (rpc.cpp: pack<BlockType>(block) -> submitblock).

Reuse-only: check_merkle_link, compute_merkle_root, and the BlockType serializer are all pre-existing sealed SSOTs. No new builders, no new merkle path.

The no-re-inject rationale (please do not "fix" this back to the DGB shape)

BTC commits the BIP141 witness root inside the coinbase at gentx-BUILD time (share_check.hpp:2166 / :2296, generate_share_transaction), so slices 1-3 hand this framer an already witness-committed gentx. This framer therefore does NOT re-inject a witness commitment.

Re-injecting a DGB-style add_witness_commitment here would mutate the coinbase, change its txid, invalidate the share-committed header merkle_root, and open a second merkle path — which the sealed BTC merkle family (#570 / #574 / #579) forbids. The DGB lane adds its commitment downstream only because it does not commit at gentx-time; BTC does, so the correct BTC action is to reuse the committed gentx verbatim.

The segwit-vs-legacy merkle-link selection (segwit_data.txid_merkle_link vs merkle_link, share_check.hpp:674-692) stays in the caller (the reconstruct closure, slice 5): this framer takes an already-resolved MerkleLink, exactly like the landed DGB slice — sealed link math reused, no new path introduced here.

Fail-closed body/header self-check (compute_merkle_root)

Because BTC hands us the full template tx set, assemble_won_block verifies the assembled body against the share-committed header before emitting bytes: body_merkle_root folds [gentx_hash] ++ other-tx non-witness txids through the sealed btc::coin::compute_merkle_root and the function throws on a mismatch rather than broadcast a bad-txnmrklroot block — consistent with the slice arc's "never emit a malformed block" posture (cf. gentx_unpack.hpp).

Interaction with slice-3 template_capture.hpp (flagging for ratification): on a capture MISS slice 3 replays an empty transactions[]. If the won share mined a coinbase-only template (empty link), body_root == header_root and the coinbase-only block broadcasts, carrying the full subsidy exactly as template_capture documents. If the share instead committed to fee txs (non-empty link), a coinbase-only body is a bad-txnmrklroot block the daemon would reject anyway; the guard fails closed so the closure does announce+audit instead of broadcasting a doomed block. Nothing broadcastable is lost — the guard only tightens the non-empty-link miss case, which was never valid.

Test

btc_share_test 82/82 green (10 new BtcBlockAssembly KATs). Branches are self-derived from the SSOT other_tx_txid, so the body/header guard is exercised on genuinely consistent inputs; the throw path is tested explicitly (MismatchedBodyThrows).

• Cut off origin/master (not stacked on btc(#744): unpack_gentx_coinbase -- gentx bytes -> MutableTransaction codec #822/btc(#744): gentx_coinbase SSOT assembler -- reconstructor slice 2/7 #835/btc: reconstructor slice 3/7 — template_capture FIFO GBT-tx store (btc::coin::TemplateCapture) #837).
• btc-tree-only diff: block_assembly.hpp, block_assembly_test.cpp, test/CMakeLists.txt (registers the test in the existing allowlisted btc_share_test target).

Signed commit 3ca1ca9a5. I do not self-merge.