blvm_consensus/

mining.rs

//! Mining and block creation functions from Orange Paper Section 10.1

#[cfg(test)]
use crate::economic::get_block_subsidy;
use crate::economic::get_block_subsidy_for_network;
use crate::error::Result;
use crate::pow::{check_proof_of_work, next_required_bits};
use crate::transaction::check_transaction;
use crate::types::*;
#[cfg(feature = "spec-lock")]
use blvm_spec_lock::spec_locked;

#[cfg(test)]
use crate::transaction::is_coinbase;

/// Compact bits for a block template.
///
/// `prev_headers` is oldest-to-newest and ends at `prev_header`'s height.
/// Height 0 uses the network proof-of-work limit.
fn template_bits(
    network: Network,
    height: Natural,
    block_timestamp: u64,
    parent: &BlockHeader,
    prev_headers: &[BlockHeader],
) -> Result<Natural> {
    if height == 0 {
        return Ok(match network {
            Network::Regtest => 0x207fffff,
            Network::Signet => 0x1e0377ae,
            Network::Mainnet | Network::Testnet | Network::Testnet4 => {
                crate::constants::MAX_TARGET as u64
            }
        });
    }
    let parent_height = height - 1;
    let window_end = parent_height;
    let window_start = if prev_headers.is_empty() {
        window_end
    } else {
        window_end.saturating_sub(prev_headers.len() as u64 - 1)
    };
    next_required_bits(network, height, block_timestamp, &|h| {
        if h == parent_height {
            return Some((parent.bits, parent.timestamp));
        }
        if prev_headers.is_empty() || h < window_start || h > window_end {
            return None;
        }
        prev_headers
            .get((h - window_start) as usize)
            .map(|hdr| (hdr.bits, hdr.timestamp))
    })?
    .ok_or_else(|| {
        crate::error::ConsensusError::InvalidProofOfWork(
            "genesis template has no parent bits".into(),
        )
    })
}

/// Minimum header version `check_bip90` accepts at `height`.
///
/// Height 1 on mainnet is still version 1. After BIP65 the minimum is 4.
pub fn template_block_version(network: Network, height: Natural) -> i64 {
    use crate::activation::{ForkActivationTable, IsForkActive};
    let table = ForkActivationTable::from_network(network);
    if table.is_fork_active(ForkId::Bip65, height) {
        4
    } else if table.is_fork_active(ForkId::Bip66, height) {
        3
    } else if table.is_fork_active(ForkId::Bip34, height) {
        2
    } else {
        1
    }
}

/// CreateNewBlock: 𝒰𝒮 × 𝒯𝒳* → ℬ
///
/// For UTXO set us and mempool transactions txs:
/// 1. Create coinbase transaction with appropriate subsidy
/// 2. Select transactions from mempool based on fee rate
/// 3. Calculate merkle root
/// 4. Create block header with appropriate difficulty
/// 5. Return new block
pub fn create_new_block(
    utxo_set: &UtxoSet,
    mempool_txs: &[Transaction],
    height: Natural,
    prev_header: &BlockHeader,
    prev_headers: &[BlockHeader],
    coinbase_script: &ByteString,
    coinbase_address: &ByteString,
) -> Result<Block> {
    // For backward compatibility, derive block_time from system clock here.
    let block_time = get_current_timestamp();
    create_new_block_with_time(
        utxo_set,
        mempool_txs,
        height,
        prev_header,
        prev_headers,
        coinbase_script,
        coinbase_address,
        block_time,
        Network::Mainnet,
        None,
    )
}

/// CreateNewBlock variant that accepts an explicit block_time.
///
/// This allows callers (e.g., node layer) to provide a median time-past or
/// adjusted network time instead of relying on `SystemTime::now()` inside
/// consensus code.
#[allow(clippy::too_many_arguments)]
pub fn create_new_block_with_time(
    utxo_set: &UtxoSet,
    mempool_txs: &[Transaction],
    height: Natural,
    prev_header: &BlockHeader,
    prev_headers: &[BlockHeader],
    coinbase_script: &ByteString,
    coinbase_address: &ByteString,
    block_time: u64,
    network: Network,
    mempool_witnesses: Option<&[Option<Vec<crate::segwit::Witness>>]>,
) -> Result<Block> {
    use crate::bip113::get_median_time_past;
    use crate::mempool::{Mempool, MempoolResult, accept_to_memory_pool};

    let median_time_past = get_median_time_past(prev_headers);
    let block_time = block_time.max(median_time_past.saturating_add(1));

    // 1. Create coinbase transaction
    let coinbase_tx = create_coinbase_transaction(
        height,
        get_block_subsidy_for_network(height, network),
        coinbase_script,
        coinbase_address,
    )?;

    // Header (80 bytes plus a 3-byte transaction count) and the coinbase are in the
    // block before any mempool transaction. The witness commitment is appended later.
    const WITNESS_COMMITMENT_RESERVE: u64 = 4_000;
    let header_weight = 83u64.saturating_mul(4);
    let coinbase_weight =
        crate::segwit::transaction_weight_from_stacks(&coinbase_tx, None).unwrap_or(0);
    let mut running_weight = header_weight
        .saturating_add(coinbase_weight)
        .saturating_add(WITNESS_COMMITMENT_RESERVE);
    // Block sigop cost counts witness programs. P2SH is 0x01. Witness is 0x800.
    const BLOCK_SIGOP_FLAGS: u32 = 0x01 | 0x800;
    let mut running_sigops = crate::sigop::get_transaction_sigop_cost_with_witness_slices(
        &coinbase_tx,
        utxo_set,
        None,
        BLOCK_SIGOP_FLAGS,
    )
    .unwrap_or(0);
    let max_weight = crate::constants::MAX_BLOCK_WEIGHT as u64;
    let max_sigops = crate::constants::MAX_BLOCK_SIGOPS_COST;

    // 2. Select transactions from mempool with proper validation.
    // Outputs of a selected transaction are spendable by a later one in this template.
    // A child that sorts ahead of its parent is tried again after that parent is selected.
    let mut selected_txs = Vec::new();
    let mut temp_mempool = Mempool::new();
    let mut available = utxo_set.clone();
    let mut waiting: Vec<usize> = (0..mempool_txs.len()).collect();

    while !waiting.is_empty() {
        let mut still_waiting = Vec::new();
        let selected_before = selected_txs.len();
        for idx in waiting {
            let tx = &mempool_txs[idx];
            if check_transaction(tx)? != ValidationResult::Valid {
                continue;
            }

            let time_context = Some(TimeContext {
                network_time: block_time,
                median_time_past,
            });
            let tx_witnesses = mempool_witnesses
                .and_then(|all| all.get(idx))
                .and_then(|w| w.as_deref());
            match accept_to_memory_pool(
                tx,
                tx_witnesses,
                &available,
                &temp_mempool,
                height,
                time_context,
                network,
                None,
            )? {
                MempoolResult::Accepted => {
                    let tx_weight =
                        match crate::segwit::transaction_weight_from_stacks(tx, tx_witnesses) {
                            Ok(weight) => weight,
                            Err(_) => continue,
                        };
                    let tx_sigops =
                        match crate::sigop::get_transaction_sigop_cost_with_witness_slices(
                            tx,
                            &available,
                            tx_witnesses,
                            BLOCK_SIGOP_FLAGS,
                        ) {
                            Ok(cost) => cost,
                            Err(_) => continue,
                        };
                    if running_weight.saturating_add(tx_weight) > max_weight
                        || running_sigops.saturating_add(tx_sigops) > max_sigops
                    {
                        continue;
                    }
                    running_weight = running_weight.saturating_add(tx_weight);
                    running_sigops = running_sigops.saturating_add(tx_sigops);
                    temp_mempool.insert_transaction_with_witness(tx, tx_witnesses);
                    let txid = crate::block::calculate_tx_id(tx);
                    for (index, output) in tx.outputs.iter().enumerate() {
                        available.insert(
                            OutPoint {
                                hash: txid,
                                index: index as u32,
                            },
                            std::sync::Arc::new(UTXO {
                                value: output.value,
                                script_pubkey: output.script_pubkey.clone().into(),
                                height,
                                is_coinbase: false,
                            }),
                        );
                    }
                    selected_txs.push(tx.clone());
                }
                MempoolResult::Rejected(_reason) => {
                    // The parent may appear later in this fee order.
                    #[cfg(test)]
                    eprintln!("Transaction rejected: {_reason}");
                    still_waiting.push(idx);
                }
            }
        }
        if selected_txs.len() == selected_before {
            break;
        }
        waiting = still_waiting;
    }

    // 3. Build transaction list (coinbase first)
    let mut transactions = vec![coinbase_tx];
    transactions.extend(selected_txs);

    // 4. Calculate merkle root
    let merkle_root = calculate_merkle_root(&transactions)?;

    // 5. Required compact bits for this height. Off a period boundary this is the
    // parent's bits (or the minimum-difficulty exception). The retarget formula
    // runs only when this height starts a new difficulty period.
    let next_work = template_bits(network, height, block_time, prev_header, prev_headers)?;

    // 6. Create block header
    let header = BlockHeader {
        version: template_block_version(network, height),
        prev_block_hash: calculate_block_hash(prev_header),
        merkle_root,
        timestamp: block_time,
        bits: next_work,
        nonce: 0, // Will be set during mining
    };

    Ok(Block {
        header,
        transactions: transactions.into_boxed_slice(),
    })
}

/// MineBlock: ℬ × ℕ → ℬ × {success, failure}
///
/// Attempt to mine a block by finding a valid nonce:
/// 1. Try different nonce values
/// 2. Check if resulting hash meets difficulty target
/// 3. Return mined block or failure
#[track_caller] // Better error messages showing caller location
pub fn mine_block(mut block: Block, max_attempts: Natural) -> Result<(Block, MiningResult)> {
    for nonce in 0..max_attempts {
        block.header.nonce = nonce;

        if check_proof_of_work(&block.header).unwrap_or(false) {
            return Ok((block, MiningResult::Success));
        }
    }

    Ok((block, MiningResult::Failure))
}

/// BlockTemplate: Interface for mining software
///
/// Provides a template for mining software to work with:
/// 1. Block header with current difficulty
/// 2. Coinbase transaction template
/// 3. Selected transactions
/// 4. Mining parameters
#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
pub struct BlockTemplate {
    pub header: BlockHeader,
    pub coinbase_tx: Transaction,
    pub transactions: Vec<Transaction>,
    pub target: crate::pow::U256,
    pub height: Natural,
    pub timestamp: Natural,
}

/// Create a block template for mining
pub fn create_block_template(
    utxo_set: &UtxoSet,
    mempool_txs: &[Transaction],
    height: Natural,
    prev_header: &BlockHeader,
    prev_headers: &[BlockHeader],
    coinbase_script: &ByteString,
    coinbase_address: &ByteString,
    network: Network,
    mempool_witnesses: Option<&[Option<Vec<crate::segwit::Witness>>]>,
) -> Result<BlockTemplate> {
    let block_time = get_current_timestamp();
    let block = create_new_block_with_time(
        utxo_set,
        mempool_txs,
        height,
        prev_header,
        prev_headers,
        coinbase_script,
        coinbase_address,
        block_time,
        network,
        mempool_witnesses,
    )?;

    let target = crate::pow::expand_target(block.header.bits)?;

    let header = block.header.clone();

    // Use proven bounds for coinbase access (block has been validated)
    #[cfg(feature = "production")]
    let coinbase_tx = {
        use crate::optimizations::_optimized_access::get_proven_by_;
        get_proven_by_(&block.transactions, 0)
            .ok_or_else(|| {
                crate::error::ConsensusError::BlockValidation("Block has no transactions".into())
            })?
            .clone()
    };

    #[cfg(not(feature = "production"))]
    let coinbase_tx = block.transactions[0].clone();

    Ok(BlockTemplate {
        header: block.header.clone(),
        coinbase_tx,
        transactions: block.transactions[1..].to_vec(),
        target,
        height,
        timestamp: header.timestamp,
    })
}

// ============================================================================
// HELPER FUNCTIONS
// ============================================================================

/// Result of mining attempt
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum MiningResult {
    Success,
    Failure,
}

/// Create coinbase transaction
/// Orange Paper 12.2: Coinbase transaction structure.
/// BIP54: When BIP54 is active, coinbase must have nLockTime = height - 1 and nSequence != 0xffff_ffff.
/// This implementation sets those so that blocks are valid under BIP54 when activated.
fn create_coinbase_transaction(
    height: Natural,
    subsidy: Integer,
    script: &ByteString,
    address: &ByteString,
) -> Result<Transaction> {
    create_coinbase_with_outputs(height, script, &[(subsidy, address.clone())])
}

/// Multi-output coinbase. Callers set values (subsidy + fees). Empty list is an error.
/// Witness commitment is appended by `create_block_template_with_outputs` / Stratum.
pub fn create_coinbase_with_outputs(
    height: Natural,
    script: &ByteString,
    outputs: &[(Integer, ByteString)],
) -> Result<Transaction> {
    if outputs.is_empty() {
        return Err(crate::error::ConsensusError::InvalidProofOfWork(
            "coinbase requires at least one output".into(),
        ));
    }
    let lock_time = height.saturating_sub(1);
    let coinbase_input = TransactionInput {
        prevout: OutPoint {
            hash: [0u8; 32],
            index: 0xffffffff,
        },
        script_sig: script.clone(),
        sequence: 0xfffffffe, // BIP54: not 0xffffffff so coinbase is unique
    };
    let outs: Vec<TransactionOutput> = outputs
        .iter()
        .map(|(value, script_pubkey)| TransactionOutput {
            value: *value,
            script_pubkey: script_pubkey.clone(),
        })
        .collect();

    Ok(Transaction {
        version: 1,
        inputs: crate::tx_inputs![coinbase_input],
        outputs: outs.into(),
        lock_time,
    })
}

/// Same as `create_block_template`, then replace the coinbase and merkle root.
#[allow(clippy::too_many_arguments)]
pub fn create_block_template_with_outputs(
    utxo_set: &UtxoSet,
    mempool_txs: &[Transaction],
    height: Natural,
    prev_header: &BlockHeader,
    prev_headers: &[BlockHeader],
    coinbase_script: &ByteString,
    coinbase_outputs: &[(Integer, ByteString)],
    network: Network,
    mempool_witnesses: Option<&[Option<Vec<crate::segwit::Witness>>]>,
) -> Result<BlockTemplate> {
    let address = coinbase_outputs
        .first()
        .map(|(_, s)| s.clone())
        .unwrap_or_default();
    let mut tmpl = create_block_template(
        utxo_set,
        mempool_txs,
        height,
        prev_header,
        prev_headers,
        coinbase_script,
        &address,
        network,
        mempool_witnesses,
    )?;
    let subsidy = get_block_subsidy_for_network(height, network);
    let fees = sum_selected_fees(utxo_set, &tmpl.transactions);
    let fitted = fit_payouts_to_reward(coinbase_outputs, subsidy, fees)?;
    tmpl.coinbase_tx = create_coinbase_with_outputs(height, coinbase_script, &fitted)?;
    let mut txs = Vec::with_capacity(1 + tmpl.transactions.len());
    txs.push(tmpl.coinbase_tx.clone());
    txs.extend(tmpl.transactions.iter().cloned());
    let nested = nested_witnesses_for_selected(&txs, mempool_txs, mempool_witnesses)?;
    append_witness_commitment_from_nested(&mut tmpl.coinbase_tx, &mut txs, Some(&nested))?;
    tmpl.header.merkle_root = calculate_merkle_root(&txs)?;
    Ok(tmpl)
}

/// Resolve named txids from a mempool list, in declaration order.
/// Unknown or duplicate txids are errors. An empty list is allowed (coinbase-only).
pub fn resolve_declared_txs(
    mempool_txs: &[Transaction],
    txids: &[Hash],
) -> Result<Vec<Transaction>> {
    use crate::block::calculate_tx_id;
    use std::collections::{HashMap, HashSet};

    let mut by_id: HashMap<Hash, &Transaction> = HashMap::new();
    for tx in mempool_txs {
        by_id.entry(calculate_tx_id(tx)).or_insert(tx);
    }
    let mut seen = HashSet::new();
    let mut out = Vec::with_capacity(txids.len());
    for id in txids {
        if !seen.insert(*id) {
            return Err(crate::error::ConsensusError::BlockValidation(
                format!("duplicate declared txid {}", hex::encode(id)).into(),
            ));
        }
        let tx = by_id.get(id).ok_or_else(|| {
            crate::error::ConsensusError::BlockValidation(
                format!("unknown declared txid {}", hex::encode(id)).into(),
            )
        })?;
        out.push((*tx).clone());
    }
    Ok(out)
}

fn declared_tx_spends_witness_utxo(tx: &Transaction, utxo_set: &UtxoSet) -> bool {
    tx.inputs.iter().any(|input| {
        utxo_set.get(&input.prevout).is_some_and(|utxo| {
            crate::witness::is_standard_witness_program(utxo.script_pubkey.as_ref())
        })
    })
}

/// Align mempool witness slots to the declared subset by txid.
/// A witness spend without stored stacks is an error (no empty-stack BIP141).
fn align_declared_witnesses(
    declared: &[Transaction],
    mempool_txs: &[Transaction],
    mempool_witnesses: Option<&[Option<Vec<crate::segwit::Witness>>]>,
    utxo_set: &UtxoSet,
) -> Result<Vec<Option<Vec<crate::segwit::Witness>>>> {
    use crate::block::calculate_tx_id;
    use std::collections::HashMap;

    let mut by_txid = HashMap::new();
    if let Some(wits) = mempool_witnesses {
        for (tx, w) in mempool_txs.iter().zip(wits.iter()) {
            by_txid.insert(calculate_tx_id(tx), w.clone());
        }
    }
    let mut out = Vec::with_capacity(declared.len());
    for tx in declared {
        let id = calculate_tx_id(tx);
        let slot = by_txid.get(&id).cloned().flatten();
        if let Some(ref stacks) = slot {
            if stacks.len() != tx.inputs.len() {
                return Err(crate::error::ConsensusError::BlockValidation(
                    format!(
                        "witness count {} != input count {} for declared tx {}",
                        stacks.len(),
                        tx.inputs.len(),
                        hex::encode(id)
                    )
                    .into(),
                ));
            }
        } else if declared_tx_spends_witness_utxo(tx, utxo_set) {
            return Err(crate::error::ConsensusError::BlockValidation(
                format!(
                    "missing mempool witnesses for declared witness spend {}",
                    hex::encode(id)
                )
                .into(),
            ));
        }
        // A legacy spend has no witness. Store empty stacks so the commitment
        // lookup finds this txid. A None slot stays an error for a witness spend.
        let slot = slot.or_else(|| Some(vec![Vec::new(); tx.inputs.len()]));
        out.push(slot);
    }
    Ok(out)
}

/// Stage 3b slice 1: miner-declared mempool subset.
/// Resolves `declared_txids`, builds the Stage 3a template, and errors if the
/// selected non-coinbase txids are not exactly that list (no silent skip).
/// Empty `declared_txids` is coinbase-only. Spec-locked builders are unchanged.
/// Overweight uses Bitcoin `MAX_BLOCK_WEIGHT` (not a pool-invented cap).
#[allow(clippy::too_many_arguments)]
pub fn create_block_template_declared(
    utxo_set: &UtxoSet,
    mempool_txs: &[Transaction],
    declared_txids: &[Hash],
    height: Natural,
    prev_header: &BlockHeader,
    prev_headers: &[BlockHeader],
    coinbase_script: &ByteString,
    coinbase_outputs: &[(Integer, ByteString)],
    network: Network,
    mempool_witnesses: Option<&[Option<Vec<crate::segwit::Witness>>]>,
) -> Result<BlockTemplate> {
    use crate::block::calculate_tx_id;

    let declared = resolve_declared_txs(mempool_txs, declared_txids)?;
    let aligned = align_declared_witnesses(&declared, mempool_txs, mempool_witnesses, utxo_set)?;
    let tmpl = create_block_template_with_outputs(
        utxo_set,
        &declared,
        height,
        prev_header,
        prev_headers,
        coinbase_script,
        coinbase_outputs,
        network,
        Some(aligned.as_slice()),
    )?;
    let selected: Vec<Hash> = tmpl.transactions.iter().map(calculate_tx_id).collect();
    if selected.as_slice() != declared_txids {
        return Err(crate::error::ConsensusError::BlockValidation(
            "declared transaction was not selected (rejected or skipped)".into(),
        ));
    }
    check_template_weight(&tmpl, crate::constants::MAX_BLOCK_WEIGHT as u64)?;
    Ok(tmpl)
}

/// Weight of coinbase + selected txs (empty stacks if none stored).
/// Uses Bitcoin `MAX_BLOCK_WEIGHT` (4_000_000). Not an invented pool cap.
pub fn check_template_weight(tmpl: &BlockTemplate, max_weight: u64) -> Result<()> {
    let mut txs = Vec::with_capacity(1 + tmpl.transactions.len());
    txs.push(tmpl.coinbase_tx.clone());
    txs.extend(tmpl.transactions.iter().cloned());
    let block = Block {
        header: tmpl.header.clone(),
        transactions: txs.clone().into_boxed_slice(),
    };
    let nested: Vec<Vec<crate::segwit::Witness>> = txs
        .iter()
        .map(|tx| vec![Vec::new(); tx.inputs.len()])
        .collect();
    let weight = crate::segwit::calculate_block_weight_from_nested(&block, &nested)?;
    if weight > max_weight {
        return Err(crate::error::ConsensusError::BlockValidation(
            format!("declared template weight {weight} exceeds max {max_weight}").into(),
        ));
    }
    Ok(())
}

/// Coinbase empty stacks, then mempool witnesses aligned to selected txs by txid.
fn nested_witnesses_for_selected(
    txs: &[Transaction],
    mempool_txs: &[Transaction],
    mempool_witnesses: Option<&[Option<Vec<crate::segwit::Witness>>]>,
) -> Result<Vec<Vec<crate::segwit::Witness>>> {
    use crate::block::calculate_tx_id;
    use std::collections::HashMap;

    let mut by_txid = HashMap::new();
    if let Some(wits) = mempool_witnesses {
        for (tx, w) in mempool_txs.iter().zip(wits.iter()) {
            if let Some(stacks) = w {
                by_txid.insert(calculate_tx_id(tx), stacks.clone());
            }
        }
    }
    let mut nested = Vec::with_capacity(txs.len());
    for (i, tx) in txs.iter().enumerate() {
        if i == 0 || mempool_witnesses.is_none() {
            nested.push(vec![Vec::new(); tx.inputs.len()]);
            continue;
        }
        let stacks = by_txid.get(&calculate_tx_id(tx)).cloned().ok_or_else(|| {
            crate::error::ConsensusError::BlockValidation(
                "missing witness for selected transaction".into(),
            )
        })?;
        nested.push(stacks);
    }
    Ok(nested)
}

/// Fees of selected (non-coinbase) txs.
/// An input missing from the chain set is priced from an earlier selected transaction.
/// Any other missing input contributes nothing.
pub fn sum_selected_fees(utxo_set: &UtxoSet, txs: &[Transaction]) -> Integer {
    use crate::block::calculate_tx_id;

    let mut created: std::collections::HashMap<Hash, usize> = std::collections::HashMap::new();
    let mut total = 0i64;
    for (i, tx) in txs.iter().enumerate() {
        if !crate::transaction::is_coinbase(tx) {
            total = total.saturating_add(selected_tx_fee(tx, utxo_set, txs, &created));
        }
        created.insert(calculate_tx_id(tx), i);
    }
    total
}

fn selected_tx_fee(
    tx: &Transaction,
    utxo_set: &UtxoSet,
    txs: &[Transaction],
    created: &std::collections::HashMap<Hash, usize>,
) -> Integer {
    let mut total_input = 0i64;
    for input in &tx.inputs {
        let value = if let Some(utxo) = utxo_set.get(&input.prevout) {
            utxo.value
        } else if let Some(&parent_i) = created.get(&input.prevout.hash) {
            let Some(output) = txs[parent_i].outputs.get(input.prevout.index as usize) else {
                return 0;
            };
            output.value
        } else {
            return 0;
        };
        total_input = match total_input.checked_add(value) {
            Some(sum) => sum,
            None => return 0,
        };
    }
    let total_output = tx
        .outputs
        .iter()
        .try_fold(0i64, |acc, output| acc.checked_add(output.value))
        .unwrap_or(0);
    total_input.saturating_sub(total_output).max(0)
}

/// If payouts exceed subsidy+fees, error. Shortfall is added to the first output.
pub fn fit_payouts_to_reward(
    payouts: &[(Integer, ByteString)],
    subsidy: Integer,
    fees: Integer,
) -> Result<Vec<(Integer, ByteString)>> {
    if payouts.is_empty() {
        return Err(crate::error::ConsensusError::InvalidProofOfWork(
            "coinbase requires at least one output".into(),
        ));
    }
    let max = subsidy.saturating_add(fees);
    let sum: Integer = payouts
        .iter()
        .map(|(v, _)| *v)
        .fold(0, |a, b| a.saturating_add(b));
    if sum > max {
        return Err(crate::error::ConsensusError::EconomicValidation(
            format!("payouts {sum} exceed subsidy+fees {max}").into(),
        ));
    }
    let mut out = payouts.to_vec();
    if sum < max {
        out[0].0 = out[0].0.saturating_add(max - sum);
    }
    Ok(out)
}

/// BIP141: coinbase wtxid is 0, so appending the OP_RETURN does not change the witness root.
/// Empty stacks when `nested` is `None` (legacy). Prefer
/// [`append_witness_commitment_from_nested`] when mempool witnesses are known.
pub fn append_witness_commitment(
    coinbase: &mut Transaction,
    txs: &mut [Transaction],
) -> Result<()> {
    append_witness_commitment_from_nested(coinbase, txs, None)
}

/// Same as [`append_witness_commitment`], using per-tx per-input stacks.
/// `nested[i]` is the witness for `txs[i]`. Coinbase wtxid stays 0.
pub fn append_witness_commitment_from_nested(
    coinbase: &mut Transaction,
    txs: &mut [Transaction],
    nested: Option<&[Vec<crate::segwit::Witness>]>,
) -> Result<()> {
    if txs.is_empty() {
        return Ok(());
    }
    let owned: Vec<Vec<crate::segwit::Witness>>;
    let nested = if let Some(n) = nested {
        if n.len() < txs.len() {
            return Err(crate::error::ConsensusError::BlockValidation(
                "missing witness for selected transaction".into(),
            ));
        }
        n
    } else {
        owned = txs
            .iter()
            .map(|tx| vec![Vec::new(); tx.inputs.len()])
            .collect();
        &owned
    };
    let header = BlockHeader {
        version: 1,
        prev_block_hash: [0u8; 32],
        merkle_root: [0u8; 32],
        timestamp: 0,
        bits: 0,
        nonce: 0,
    };
    let block = Block {
        header,
        transactions: txs.to_vec().into_boxed_slice(),
    };
    let root = crate::segwit::compute_witness_merkle_root_from_nested(&block, nested, None)?;
    let script = crate::segwit::witness_commitment_script(&root, &[0u8; 32]);
    let mut outs = coinbase.outputs.to_vec();
    outs.push(TransactionOutput {
        value: 0,
        script_pubkey: script,
    });
    coinbase.outputs = outs.into();
    txs[0] = coinbase.clone();
    Ok(())
}

/// Calculate merkle root using proper Bitcoin Merkle tree construction
#[track_caller] // Better error messages showing caller location
#[cfg_attr(feature = "production", inline(always))]
#[cfg_attr(not(feature = "production"), inline)]
#[cfg_attr(feature = "spec-lock", spec_locked("8.4.1", "ComputeMerkleRoot"))]
pub fn calculate_merkle_root(transactions: &[Transaction]) -> Result<Hash> {
    if transactions.is_empty() {
        return Err(crate::error::ConsensusError::InvalidProofOfWork(
            "Cannot calculate merkle root for empty transaction list".into(),
        ));
    }

    // Calculate transaction hashes with batch optimization (if available)
    // Uses SIMD vectorization + proven bounds for optimal performance
    // Use cache-aligned structures throughout merkle tree building
    #[cfg(feature = "production")]
    let mut hashes: Vec<crate::optimizations::CacheAlignedHash> = {
        use crate::optimizations::simd_vectorization;

        // Serialize all transactions in parallel (if rayon available)
        // Then batch hash all serialized forms using double SHA256
        // Pre-allocate serialization buffers
        let serialized_txs: Vec<Vec<u8>> = {
            #[cfg(feature = "rayon")]
            {
                use rayon::prelude::*;
                transactions
                    .par_iter()
                    .map(serialize_tx_for_hash) // Uses prealloc_tx_buffer internally
                    .collect()
            }
            #[cfg(not(feature = "rayon"))]
            {
                transactions
                    .iter()
                    .map(serialize_tx_for_hash) // Uses prealloc_tx_buffer internally
                    .collect()
            }
        };

        // Batch hash all serialized transactions using double SHA256
        // Keep cache-aligned structures for better cache locality
        let tx_data_refs: Vec<&[u8]> = serialized_txs.iter().map(|v| v.as_slice()).collect();
        simd_vectorization::batch_double_sha256_aligned(&tx_data_refs)
    };

    #[cfg(not(feature = "production"))]
    let mut hashes: Vec<Hash> = {
        // Sequential fallback for non-production builds
        let mut hashes = Vec::with_capacity(transactions.len());
        for tx in transactions {
            hashes.push(calculate_tx_hash(tx));
        }
        hashes
    };

    // Build Merkle tree bottom-up
    // Pre-allocate next level and combined buffers
    // Optimization: Process multiple tree levels in parallel where safe
    // Use cache-aligned structures in production mode for better cache locality
    #[cfg(feature = "production")]
    {
        use crate::optimizations::CacheAlignedHash;

        let mut mutated = false;

        while hashes.len() > 1 {
            // CVE-2012-2459: Detect mutations (duplicate hashes at same level)
            let mut level_mutated = false;
            let mut pos = 0;
            while pos + 1 < hashes.len() {
                if hashes[pos].as_bytes() == hashes[pos + 1].as_bytes() {
                    level_mutated = true;
                }
                pos += 2;
            }
            if level_mutated {
                mutated = true;
            }

            // Duplicate last hash if odd number of hashes (Bitcoin's special rule)
            if hashes.len() & 1 != 0 {
                let last = hashes[hashes.len() - 1].clone();
                hashes.push(last);
            }

            // Stack-allocated 64-byte buffer, double SHA256 at each level
            let next_level: Vec<CacheAlignedHash> = hashes
                .chunks(2)
                .map(|chunk| {
                    let mut combined = [0u8; 64];
                    combined[..32].copy_from_slice(chunk[0].as_bytes());
                    combined[32..].copy_from_slice(if chunk.len() == 2 {
                        chunk[1].as_bytes()
                    } else {
                        chunk[0].as_bytes()
                    });
                    CacheAlignedHash::new(double_sha256_hash(&combined))
                })
                .collect();

            hashes = next_level;
        }

        if mutated {
            return Err(crate::error::ConsensusError::InvalidProofOfWork(
                "Merkle root mutation detected (CVE-2012-2459)".into(),
            ));
        }

        Ok(*hashes[0].as_bytes())
    }

    #[cfg(not(feature = "production"))]
    {
        let (root, mutated) = merkle_tree_from_hashes(&mut hashes)?;
        if mutated {
            return Err(crate::error::ConsensusError::InvalidProofOfWork(
                "Merkle root mutation detected (CVE-2012-2459)".into(),
            ));
        }
        Ok(root)
    }
}

/// Build merkle tree from pre-computed leaf hashes.
///
/// Also usable directly when tx_ids are already computed, avoiding
/// redundant serialization and hashing.
/// Implements ComputeMerkleRoot (Orange Paper 8.4.1).
///
/// Returns `Err` if `tx_ids` is empty **or** if a CVE-2012-2459 mutation is detected
/// (duplicate adjacent hashes at any merkle level). Use [`compute_merkle_root_and_mutated`]
/// when you need the root regardless of mutation (Orange Paper §8.4.1 merkle root).
#[cfg_attr(feature = "spec-lock", spec_locked("8.4.1", "ComputeMerkleRoot"))]
pub fn calculate_merkle_root_from_tx_ids(tx_ids: &[Hash]) -> Result<Hash> {
    let (root, mutated) = compute_merkle_root_and_mutated(tx_ids)?;
    if mutated {
        return Err(crate::error::ConsensusError::InvalidProofOfWork(
            "Merkle root mutation detected (CVE-2012-2459)".into(),
        ));
    }
    Ok(root)
}

/// Compute merkle root **and** CVE-2012-2459 mutation flag without aborting on mutation.
/// Computes merkle root from leaves with optional mutation detection — always returns a root.
/// Callers decide policy: `CheckBlock` rejects mutated blocks; `ConnectBlock` may skip
/// the check for already-accepted blocks.
#[cfg_attr(feature = "spec-lock", spec_locked("8.4.1", "ComputeMerkleRoot"))]
pub fn compute_merkle_root_and_mutated(tx_ids: &[Hash]) -> Result<(Hash, bool)> {
    if tx_ids.is_empty() {
        return Err(crate::error::ConsensusError::InvalidProofOfWork(
            "Cannot calculate merkle root for empty transaction list".into(),
        ));
    }
    let mut hashes = tx_ids.to_vec();
    merkle_tree_from_hashes(&mut hashes)
}

/// Merkle tree building logic. Uses double SHA256 at each level (Bitcoin standard).
/// Stack-allocates the 64-byte pair buffer to avoid heap allocation per node.
/// Orange Paper 8.4.1: ComputeMerkleRoot pair-and-hash construction.
/// Returns `(root, mutated)` — caller decides policy on mutation.
#[cfg_attr(feature = "spec-lock", spec_locked("8.4.1", "ComputeMerkleRoot"))]
fn merkle_tree_from_hashes(hashes: &mut Vec<Hash>) -> Result<(Hash, bool)> {
    let mut mutated = false;

    while hashes.len() > 1 {
        // CVE-2012-2459: Detect mutations (duplicate hashes at same level)
        for pos in (0..hashes.len().saturating_sub(1)).step_by(2) {
            if hashes[pos] == hashes[pos + 1] {
                mutated = true;
            }
        }

        // Duplicate last hash if odd number of hashes (Bitcoin's special rule)
        if hashes.len() & 1 != 0 {
            hashes.push(hashes[hashes.len() - 1]);
        }

        let mut next_level = Vec::with_capacity(hashes.len() / 2);

        // Stack-allocated 64-byte buffer for combining hash pairs
        for chunk in hashes.chunks(2) {
            let mut combined = [0u8; 64];
            combined[..32].copy_from_slice(&chunk[0]);
            combined[32..].copy_from_slice(if chunk.len() == 2 {
                &chunk[1]
            } else {
                &chunk[0]
            });
            next_level.push(double_sha256_hash(&combined));
        }

        *hashes = next_level;
    }

    Ok((hashes[0], mutated))
}

/// Serialize transaction for hashing (used for batch hashing optimization)
///
/// This is the same serialization as calculate_tx_hash but returns the serialized bytes
/// instead of hashing them, allowing batch hashing to be applied.
fn serialize_tx_for_hash(tx: &Transaction) -> Vec<u8> {
    // Pre-allocate buffer using proven maximum size
    #[cfg(feature = "production")]
    let mut data = {
        use crate::optimizations::prealloc_tx_buffer;
        prealloc_tx_buffer()
    };

    #[cfg(not(feature = "production"))]
    let mut data = Vec::new();

    // Version (4 bytes, little-endian)
    data.extend_from_slice(&(tx.version as u32).to_le_bytes());

    // Input count (varint)
    data.extend_from_slice(&encode_varint(tx.inputs.len() as u64));

    // Inputs
    for input in &tx.inputs {
        // Previous output hash (32 bytes)
        data.extend_from_slice(&input.prevout.hash);
        // Previous output index (4 bytes, little-endian)
        data.extend_from_slice(&input.prevout.index.to_le_bytes());
        // Script length (varint)
        data.extend_from_slice(&encode_varint(input.script_sig.len() as u64));
        // Script
        data.extend_from_slice(&input.script_sig);
        // Sequence (4 bytes, little-endian)
        data.extend_from_slice(&(input.sequence as u32).to_le_bytes());
    }

    // Output count (varint)
    data.extend_from_slice(&encode_varint(tx.outputs.len() as u64));

    // Outputs
    for output in &tx.outputs {
        // Value (8 bytes, little-endian)
        data.extend_from_slice(&(output.value as u64).to_le_bytes());
        // Script length (varint)
        data.extend_from_slice(&encode_varint(output.script_pubkey.len() as u64));
        // Script
        data.extend_from_slice(&output.script_pubkey);
    }

    // Lock time (4 bytes, little-endian)
    data.extend_from_slice(&(tx.lock_time as u32).to_le_bytes());

    data
}

/// Calculate transaction hash using proper Bitcoin serialization
///
/// This function computes the double SHA256 hash of the serialized transaction.
/// For batch operations, use serialize_tx_for_hash + batch_double_sha256 instead.
#[allow(dead_code)] // Used in tests
fn calculate_tx_hash(tx: &Transaction) -> Hash {
    let data = serialize_tx_for_hash(tx);
    // Double SHA256 (Bitcoin standard)
    let hash1 = sha256_hash(&data);
    sha256_hash(&hash1)
}

/// Encode a number as a Bitcoin varint
fn encode_varint(value: u64) -> Vec<u8> {
    if value < 0xfd {
        vec![value as u8]
    } else if value <= 0xffff {
        let mut result = vec![0xfd];
        result.extend_from_slice(&(value as u16).to_le_bytes());
        result
    } else if value <= 0xffffffff {
        let mut result = vec![0xfe];
        result.extend_from_slice(&(value as u32).to_le_bytes());
        result
    } else {
        let mut result = vec![0xff];
        result.extend_from_slice(&value.to_le_bytes());
        result
    }
}

/// Orange Paper 7.2: Block hash = SHA256d(serialize(header)) — same as blockstore / PoW.
fn calculate_block_hash(header: &BlockHeader) -> Hash {
    let wire = crate::serialization::block::serialize_block_header(header);
    double_sha256_hash(&wire)
}

/// Simple SHA256 hash function
///
/// Performance optimization: Uses OptimizedSha256 (SHA-NI or AVX2) instead of sha2 crate
/// for faster hashing in Merkle tree construction.
#[inline(always)]
fn sha256_hash(data: &[u8]) -> Hash {
    use crate::crypto::OptimizedSha256;
    OptimizedSha256::new().hash(data)
}

/// Double SHA256 hash (Bitcoin standard for merkle tree nodes and txids)
#[inline(always)]
fn double_sha256_hash(data: &[u8]) -> Hash {
    use crate::crypto::OptimizedSha256;
    OptimizedSha256::new().hash256(data)
}

/// Wall-clock Unix timestamp for block template creation.
fn get_current_timestamp() -> Natural {
    std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .unwrap_or(std::time::Duration::ZERO)
        .as_secs()
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::opcodes::*;

    #[test]
    fn test_create_new_block() {
        let mut utxo_set = UtxoSet::default();
        // Add UTXO for the transaction input
        let outpoint = OutPoint {
            hash: [1; 32],
            index: 0,
        };
        let utxo = UTXO {
            value: 10000,
            // Empty script_pubkey - script_sig (OP_1) will push 1, final stack [1] passes
            script_pubkey: vec![].into(),
            height: 0,
            is_coinbase: false,
        };
        utxo_set.insert(outpoint, std::sync::Arc::new(utxo));

        let mempool_txs = vec![create_valid_transaction()];
        let height = 100;
        let prev_header = create_valid_block_header();
        // Create headers with different timestamps to ensure valid difficulty adjustment
        let mut prev_header2 = prev_header.clone();
        prev_header2.timestamp = prev_header.timestamp + 600; // 10 minutes later
        let prev_headers = vec![prev_header.clone(), prev_header2];
        let coinbase_script = vec![OP_1];
        let coinbase_address = vec![OP_1];

        // get_next_work_required can fail in some cases (e.g., invalid target expansion)
        // Handle errors gracefully like test_create_block_template_comprehensive does
        let block_time = 1_700_000_000u64;
        let result = create_new_block_with_time(
            &utxo_set,
            &mempool_txs,
            height,
            &prev_header,
            &prev_headers,
            &coinbase_script,
            &coinbase_address,
            block_time,
            Network::Mainnet,
            None,
        );

        if let Ok(block) = result {
            assert_eq!(block.transactions.len(), 2); // coinbase + 1 mempool tx
            assert!(is_coinbase(&block.transactions[0]));
            assert_eq!(block.header.version, 1);
            assert_eq!(block.header.timestamp, block_time);
        } else {
            // Accept that it might fail due to target expansion or other validation issues
            // This can happen when get_next_work_required returns an error
            assert!(result.is_err());
        }
    }

    #[test]
    fn test_mine_block_success() {
        let block = create_test_block();
        let result = mine_block(block, 1000);

        // Should succeed now that we fixed the target expansion
        assert!(result.is_ok());
        let (mined_block, mining_result) = result.unwrap();
        assert!(matches!(
            mining_result,
            MiningResult::Success | MiningResult::Failure
        ));
        assert_eq!(mined_block.header.version, 1);
    }

    #[test]
    fn test_create_block_template() {
        let utxo_set = UtxoSet::default();
        let mempool_txs = vec![create_valid_transaction()];
        let height = 100;
        let prev_header = create_valid_block_header();
        let prev_headers = vec![prev_header.clone()];
        let coinbase_script = vec![OP_1];
        let coinbase_address = vec![OP_1];

        // Height 100 is not a retarget boundary, so the template copies the parent bits.
        let template = create_block_template(
            &utxo_set,
            &mempool_txs,
            height,
            &prev_header,
            &prev_headers,
            &coinbase_script,
            &coinbase_address,
            Network::Mainnet,
            None,
        )
        .expect("off-boundary template");
        assert_eq!(template.header.bits, prev_header.bits);
        assert_eq!(template.height, height);
    }

    #[test]
    fn test_coinbase_transaction() {
        let height = 100;
        let subsidy = get_block_subsidy(height);
        let script = vec![OP_1];
        let address = vec![OP_1];

        let coinbase_tx = create_coinbase_transaction(height, subsidy, &script, &address).unwrap();

        assert!(is_coinbase(&coinbase_tx));
        assert_eq!(coinbase_tx.outputs[0].value, subsidy);
        assert_eq!(coinbase_tx.inputs[0].prevout.hash, [0u8; 32]);
        assert_eq!(coinbase_tx.inputs[0].prevout.index, 0xffffffff);
    }

    #[test]
    fn test_merkle_root_calculation() {
        let txs = vec![create_valid_transaction(), create_valid_transaction()];

        let merkle_root = calculate_merkle_root(&txs).unwrap();
        assert_ne!(merkle_root, [0u8; 32]);
    }

    #[test]
    fn test_merkle_root_empty() {
        let txs = vec![];
        let result = calculate_merkle_root(&txs);
        assert!(result.is_err());
    }

    // ============================================================================
    // COMPREHENSIVE MINING TESTS
    // ============================================================================

    #[test]
    fn test_create_block_template_comprehensive() {
        let mut utxo_set = UtxoSet::default();
        // Add UTXO for the transaction input
        let outpoint = OutPoint {
            hash: [1; 32],
            index: 0,
        };
        let utxo = UTXO {
            value: 10000,
            // Empty script_pubkey - script_sig (OP_1) will push 1, final stack [1] passes
            script_pubkey: vec![].into(),
            height: 0,
            is_coinbase: false,
        };
        utxo_set.insert(outpoint, std::sync::Arc::new(utxo));

        let mempool_txs = vec![create_valid_transaction()];
        let height = 100;
        let prev_header = create_valid_block_header();
        // Create headers with different timestamps to ensure valid difficulty adjustment
        let mut prev_header2 = prev_header.clone();
        prev_header2.timestamp = prev_header.timestamp + 600; // 10 minutes later
        let prev_headers = vec![prev_header.clone(), prev_header2];
        let coinbase_script = vec![OP_1];
        let coinbase_address = vec![OP_2];

        let result = create_block_template(
            &utxo_set,
            &mempool_txs,
            height,
            &prev_header,
            &prev_headers,
            &coinbase_script,
            &coinbase_address,
            Network::Mainnet,
            None,
        );

        // If get_next_work_required returns a target that's too large, this will fail
        // That's ok for testing the error path
        if let Ok(template) = result {
            assert_eq!(template.height, height);
            assert!(!template.target.is_zero());
            assert!(is_coinbase(&template.coinbase_tx));
            assert_eq!(template.transactions.len(), 1);
        } else {
            // Accept that it might fail due to target expansion or other validation issues
            assert!(result.is_err());
        }
    }

    #[test]
    fn test_mine_block_attempts() {
        let block = create_test_block();
        let (mined_block, result) = mine_block(block, 1000).unwrap();

        // Result depends on whether we found a valid nonce
        assert!(matches!(
            result,
            MiningResult::Success | MiningResult::Failure
        ));
        assert_eq!(mined_block.header.version, 1);
    }

    #[test]
    fn test_mine_block_failure() {
        let block = create_test_block();
        let (mined_block, result) = mine_block(block, 0).unwrap();

        // With 0 attempts, should always fail
        assert_eq!(result, MiningResult::Failure);
        assert_eq!(mined_block.header.nonce, 0);
    }

    #[test]
    fn test_create_coinbase_transaction() {
        let height = 100;
        let subsidy = 5000000000;
        let script = vec![0x51, 0x52];
        let address = vec![0x53, 0x54];

        let coinbase_tx = create_coinbase_transaction(height, subsidy, &script, &address).unwrap();

        assert!(is_coinbase(&coinbase_tx));
        assert_eq!(coinbase_tx.outputs.len(), 1);
        assert_eq!(coinbase_tx.outputs[0].value, subsidy);
        assert_eq!(coinbase_tx.outputs[0].script_pubkey, address);
        assert_eq!(coinbase_tx.inputs[0].script_sig, script);
        assert_eq!(coinbase_tx.inputs[0].prevout.hash, [0u8; 32]);
        assert_eq!(coinbase_tx.inputs[0].prevout.index, 0xffffffff);
    }

    #[test]
    fn test_create_coinbase_with_outputs_preserves_order() {
        let script = vec![OP_1];
        let a = vec![OP_1];
        let b = vec![OP_2];
        let tx = create_coinbase_with_outputs(100, &script, &[(10, a.clone()), (20, b.clone())])
            .unwrap();
        assert!(is_coinbase(&tx));
        assert_eq!(tx.outputs.len(), 2);
        assert_eq!(tx.outputs[0].value, 10);
        assert_eq!(tx.outputs[0].script_pubkey, a);
        assert_eq!(tx.outputs[1].value, 20);
        assert_eq!(tx.outputs[1].script_pubkey, b);
    }

    #[test]
    fn test_create_coinbase_with_outputs_empty_is_error() {
        let script = vec![OP_1];
        assert!(create_coinbase_with_outputs(1, &script, &[]).is_err());
    }

    #[test]
    fn fit_payouts_tops_up_first_with_fees() {
        let a = vec![OP_1];
        let b = vec![OP_2];
        let fitted = fit_payouts_to_reward(&[(10, a.clone()), (20, b.clone())], 100, 5).unwrap();
        assert_eq!(fitted[0].0, 85);
        assert_eq!(fitted[1].0, 20);
        assert!(fit_payouts_to_reward(&[(90, a)], 50, 0).is_err());
    }

    #[test]
    fn witness_commitment_script_roundtrips_extract() {
        let root = [7u8; 32];
        let nonce = [0u8; 32];
        let script = crate::segwit::witness_commitment_script(&root, &nonce);
        let got = crate::segwit::extract_witness_commitment(&script);
        assert!(got.is_some());
        assert_eq!(script[0], 0x6a);
        assert_eq!(script[1], 0x24);
        assert_eq!(&script[2..6], &[0xaa, 0x21, 0xa9, 0xed]);
    }

    #[test]
    fn append_witness_commitment_adds_zero_value_op_return() {
        let script = vec![OP_1];
        let mut cb = create_coinbase_with_outputs(1, &script, &[(50, vec![OP_1])]).unwrap();
        let mut txs = vec![cb.clone()];
        append_witness_commitment(&mut cb, &mut txs).unwrap();
        assert_eq!(cb.outputs.len(), 2);
        assert_eq!(cb.outputs[1].value, 0);
        assert_eq!(cb.outputs[1].script_pubkey[0], 0x6a);
        assert!(crate::economic::check_coinbase_subsidy(&cb, 50, 0));
    }

    #[test]
    fn append_from_nested_differs_from_empty_stacks() {
        let script = vec![OP_1];
        let cb = create_coinbase_with_outputs(1, &script, &[(50, vec![OP_1])]).unwrap();
        let spend = Transaction {
            version: 2,
            inputs: crate::tx_inputs![TransactionInput {
                prevout: OutPoint {
                    hash: [0x11u8; 32],
                    index: 0,
                },
                script_sig: vec![],
                sequence: 0xfffffffe,
            }],
            outputs: crate::tx_outputs![TransactionOutput {
                value: 90_000,
                script_pubkey: vec![OP_1],
            }],
            lock_time: 0,
        };
        let mut empty_cb = cb.clone();
        let mut empty_txs = vec![cb.clone(), spend.clone()];
        append_witness_commitment(&mut empty_cb, &mut empty_txs).unwrap();

        let nested = vec![vec![Vec::new()], vec![vec![vec![OP_1]]]];
        let mut real_cb = cb.clone();
        let mut real_txs = vec![cb, spend];
        append_witness_commitment_from_nested(&mut real_cb, &mut real_txs, Some(&nested)).unwrap();

        assert_ne!(
            empty_cb.outputs.last().unwrap().script_pubkey,
            real_cb.outputs.last().unwrap().script_pubkey,
            "mempool witness must change the commitment"
        );
        let header = BlockHeader {
            version: 1,
            prev_block_hash: [0u8; 32],
            merkle_root: [0u8; 32],
            timestamp: 0,
            bits: 0,
            nonce: 0,
        };
        let block = Block {
            header,
            transactions: real_txs.clone().into_boxed_slice(),
        };
        let root =
            crate::segwit::compute_witness_merkle_root_from_nested(&block, &nested, None).unwrap();
        let expect = crate::segwit::witness_commitment_script(&root, &[0u8; 32]);
        assert_eq!(real_cb.outputs.last().unwrap().script_pubkey, expect);
    }

    #[test]
    fn missing_witness_does_not_commit_empty_stacks() {
        let script = vec![OP_1];
        let mut cb = create_coinbase_with_outputs(1, &script, &[(50, vec![OP_1])]).unwrap();
        let spend = Transaction {
            version: 2,
            inputs: crate::tx_inputs![TransactionInput {
                prevout: OutPoint {
                    hash: [0x11u8; 32],
                    index: 0,
                },
                script_sig: vec![],
                sequence: 0xfffffffe,
            }],
            outputs: crate::tx_outputs![TransactionOutput {
                value: 90_000,
                script_pubkey: vec![OP_1],
            }],
            lock_time: 0,
        };
        let mut txs = vec![cb.clone(), spend.clone()];
        let short = vec![vec![Vec::new()]];
        assert!(append_witness_commitment_from_nested(&mut cb, &mut txs, Some(&short)).is_err());
        assert_eq!(cb.outputs.len(), 1);

        let txs = vec![cb, spend.clone()];
        assert!(nested_witnesses_for_selected(&txs, &[spend], Some(&[None])).is_err());
    }

    #[test]
    fn test_calculate_tx_hash() {
        let tx = create_valid_transaction();
        let hash = calculate_tx_hash(&tx);

        // Should be a 32-byte hash
        assert_eq!(hash.len(), 32);

        // Same transaction should produce same hash
        let hash2 = calculate_tx_hash(&tx);
        assert_eq!(hash, hash2);
    }

    #[test]
    fn test_calculate_tx_hash_different_txs() {
        let tx1 = create_valid_transaction();
        let mut tx2 = tx1.clone();
        tx2.version = 2; // Different version

        let hash1 = calculate_tx_hash(&tx1);
        let hash2 = calculate_tx_hash(&tx2);

        // Different transactions should produce different hashes
        assert_ne!(hash1, hash2);
    }

    #[test]
    fn test_encode_varint_small() {
        let encoded = encode_varint(0x42);
        assert_eq!(encoded, vec![0x42]);
    }

    #[test]
    fn test_encode_varint_medium() {
        let encoded = encode_varint(0x1234);
        assert_eq!(encoded.len(), 3);
        assert_eq!(encoded[0], 0xfd);
    }

    #[test]
    fn test_encode_varint_large() {
        let encoded = encode_varint(0x12345678);
        assert_eq!(encoded.len(), 5);
        assert_eq!(encoded[0], 0xfe);
    }

    #[test]
    fn test_encode_varint_huge() {
        let encoded = encode_varint(0x123456789abcdef0);
        assert_eq!(encoded.len(), 9);
        assert_eq!(encoded[0], 0xff);
    }

    #[test]
    fn test_calculate_block_hash() {
        let header = create_valid_block_header();
        let hash = calculate_block_hash(&header);

        // Should be a 32-byte hash
        assert_eq!(hash.len(), 32);

        // Same header should produce same hash
        let hash2 = calculate_block_hash(&header);
        assert_eq!(hash, hash2);
    }

    #[test]
    fn test_calculate_block_hash_different_headers() {
        let header1 = create_valid_block_header();
        let mut header2 = header1.clone();
        header2.version = 2; // Different version

        let hash1 = calculate_block_hash(&header1);
        let hash2 = calculate_block_hash(&header2);

        // Different headers should produce different hashes
        assert_ne!(hash1, hash2);
    }

    #[test]
    fn test_sha256_hash() {
        let data = b"hello world";
        let hash = sha256_hash(data);

        // Should be a 32-byte hash
        assert_eq!(hash.len(), 32);

        // Same data should produce same hash
        let hash2 = sha256_hash(data);
        assert_eq!(hash, hash2);
    }

    #[test]
    fn test_sha256_hash_different_data() {
        let data1 = b"hello";
        let data2 = b"world";

        let hash1 = sha256_hash(data1);
        let hash2 = sha256_hash(data2);

        // Different data should produce different hashes
        assert_ne!(hash1, hash2);
    }

    #[test]
    fn test_pow_expand_target_regtest_minimum_difficulty() {
        let target = crate::pow::expand_target(0x207fffff).expect("regtest nBits");
        assert!(!target.is_zero());
        assert_eq!(target.gbt_target_hex().len(), 64);
    }

    #[test]
    fn test_create_block_template_regtest_nbits() {
        let utxo_set = UtxoSet::default();
        let prev_header = BlockHeader {
            version: 4,
            prev_block_hash: [0u8; 32],
            merkle_root: [0u8; 32],
            timestamp: 1_600_000_000,
            bits: 0x207fffff,
            nonce: 0,
        };
        let prev_headers = vec![prev_header.clone(), prev_header.clone()];

        let template = create_block_template(
            &utxo_set,
            &[],
            1,
            &prev_header,
            &prev_headers,
            &vec![],
            &vec![0x51],
            Network::Regtest,
            None,
        )
        .expect("create_block_template must not fail on regtest nBits");

        assert_eq!(template.header.bits, 0x207fffff);
        let expanded = crate::pow::expand_target(0x207fffff).unwrap();
        assert_eq!(template.target, expanded);
        assert_ne!(template.target, crate::pow::U256::one());
    }

    #[test]
    fn test_get_current_timestamp() {
        let timestamp = get_current_timestamp();
        // Must be a plausible post-genesis wall-clock value, not a hardcoded constant.
        assert!(timestamp > 1_231_006_505);
        assert!(timestamp < 4_000_000_000);
    }

    #[test]
    fn test_merkle_root_single_transaction() {
        let txs = vec![create_valid_transaction()];
        let merkle_root = calculate_merkle_root(&txs).unwrap();

        // Should be a 32-byte hash
        assert_eq!(merkle_root.len(), 32);
        assert_ne!(merkle_root, [0u8; 32]);
    }

    #[test]
    fn test_merkle_root_three_transactions() {
        let txs = vec![
            create_valid_transaction(),
            create_valid_transaction(),
            create_valid_transaction(),
        ];
        let merkle_root = calculate_merkle_root(&txs).unwrap();

        // Should be a 32-byte hash
        assert_eq!(merkle_root.len(), 32);
        assert_ne!(merkle_root, [0u8; 32]);
    }

    #[test]
    fn test_merkle_root_five_transactions() {
        let txs = vec![
            create_valid_transaction(),
            create_valid_transaction(),
            create_valid_transaction(),
            create_valid_transaction(),
            create_valid_transaction(),
        ];
        let merkle_root = calculate_merkle_root(&txs).unwrap();

        // Should be a 32-byte hash
        assert_eq!(merkle_root.len(), 32);
        assert_ne!(merkle_root, [0u8; 32]);
    }

    #[test]
    fn test_block_template_fields() {
        let mut utxo_set = UtxoSet::default();
        // Add UTXO for the transaction input
        let outpoint = OutPoint {
            hash: [1; 32],
            index: 0,
        };
        let utxo = UTXO {
            value: 10000,
            // Empty script_pubkey - script_sig (OP_1) will push 1, final stack [1] passes
            script_pubkey: vec![].into(),
            height: 0,
            is_coinbase: false,
        };
        utxo_set.insert(outpoint, std::sync::Arc::new(utxo));

        let mempool_txs = vec![create_valid_transaction()];
        let height = 100;
        let prev_header = create_valid_block_header();
        let prev_headers = vec![prev_header.clone(), prev_header.clone()];
        let coinbase_script = vec![OP_1];
        let coinbase_address = vec![OP_2];

        let result = create_block_template(
            &utxo_set,
            &mempool_txs,
            height,
            &prev_header,
            &prev_headers,
            &coinbase_script,
            &coinbase_address,
            Network::Mainnet,
            None,
        );

        // If get_next_work_required returns a target that's too large, this will fail
        // That's ok for testing the error path
        if let Ok(template) = result {
            // Test all fields
            assert_eq!(template.height, height);
            assert!(!template.target.is_zero());
            assert!(template.timestamp > 0);
            assert!(is_coinbase(&template.coinbase_tx));
            assert_eq!(template.transactions.len(), 1);
            assert_eq!(template.header.version, 1);
        } else {
            // Accept that it might fail due to target expansion
            assert!(result.is_err());
        }
    }

    // Helper functions for tests
    #[test]
    fn a_child_of_a_selected_parent_is_in_the_template() {
        use crate::block::calculate_tx_id;

        let funding = OutPoint {
            hash: [4; 32],
            index: 0,
        };
        let mut utxo_set = UtxoSet::default();
        utxo_set.insert(
            funding,
            std::sync::Arc::new(UTXO {
                value: 50_000,
                script_pubkey: vec![].into(),
                height: 0,
                is_coinbase: false,
            }),
        );
        let parent = Transaction {
            version: 1,
            inputs: vec![TransactionInput {
                prevout: funding,
                script_sig: vec![OP_1],
                sequence: 0xffffffff,
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 40_000,
                script_pubkey: vec![],
            }]
            .into(),
            lock_time: 0,
        };
        let child = Transaction {
            version: 1,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: calculate_tx_id(&parent),
                    index: 0,
                },
                script_sig: vec![OP_1],
                sequence: 0xffffffff,
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 25_000,
                script_pubkey: vec![],
            }]
            .into(),
            lock_time: 0,
        };
        let height = 100;
        let prev_header = create_valid_block_header();
        let mut prev_header2 = prev_header.clone();
        prev_header2.timestamp = prev_header.timestamp + 600;
        let tmpl = create_block_template_with_outputs(
            &utxo_set,
            &[parent, child.clone()],
            height,
            &prev_header,
            &[prev_header.clone(), prev_header2],
            &vec![OP_1],
            &[(0, vec![OP_1])],
            Network::Regtest,
            None,
        )
        .unwrap();
        assert!(
            tmpl.transactions
                .iter()
                .any(|tx| calculate_tx_id(tx) == calculate_tx_id(&child)),
            "child must be selected with its parent"
        );
        let subsidy = get_block_subsidy_for_network(height, Network::Regtest);
        assert_eq!(tmpl.coinbase_tx.outputs[0].value, subsidy + 25_000);
    }

    fn create_valid_transaction() -> Transaction {
        // Use thread-local counter to avoid non-determinism across tests
        use std::cell::Cell;
        thread_local! {
            static COUNTER: Cell<u64> = const { Cell::new(0) };
        }
        let counter = COUNTER.with(|c| {
            let val = c.get();
            c.set(val + 1);
            val
        });

        Transaction {
            version: 1,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [1; 32], // Keep consistent hash for UTXO matching
                    index: 0,
                },
                // Use OP_1 in script_sig to push 1, script_pubkey will be OP_1 which also pushes 1
                // But wait, that gives [1, 1] which doesn't pass (needs exactly one value)
                // Try: OP_1 script_sig + empty script_pubkey, or empty script_sig + OP_1 script_pubkey
                // Actually, let's use OP_1 in script_sig and empty script_pubkey
                // Make script_sig unique by adding counter as extra data (OP_PUSHDATA + counter bytes)
                // This ensures transaction hash is unique without affecting script execution
                script_sig: {
                    let mut sig = vec![OP_1]; // OP_1 pushes 1
                    // Add counter as extra push data (will be on stack but script_pubkey is empty, so it doesn't matter)
                    if counter > 0 {
                        sig.push(PUSH_1_BYTE); // Push 1 byte
                        sig.push((counter & 0xff) as u8); // Push counter byte
                    }
                    sig
                },
                sequence: 0xffffffff,
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 1000 + counter as i64, // Make each transaction unique
                // Empty script_pubkey - script_sig already pushed 1, so final stack is [1].into()
                script_pubkey: vec![],
            }]
            .into(),
            lock_time: 0,
        }
    }

    fn create_valid_block_header() -> BlockHeader {
        BlockHeader {
            version: 1,
            prev_block_hash: [0; 32],
            merkle_root: [0; 32],
            timestamp: 1231006505,
            bits: 0x0600ffff, // Safe target - exponent 6
            nonce: 0,
        }
    }

    fn create_test_block() -> Block {
        Block {
            header: create_valid_block_header(),
            transactions: vec![create_valid_transaction()].into_boxed_slice(),
        }
    }

    #[test]
    fn test_create_coinbase_transaction_zero_subsidy() {
        let height = 100;
        let subsidy = 0; // Zero subsidy
        let script = vec![OP_1];
        let address = vec![OP_1];

        let coinbase_tx = create_coinbase_transaction(height, subsidy, &script, &address).unwrap();

        assert!(is_coinbase(&coinbase_tx));
        assert_eq!(coinbase_tx.outputs[0].value, 0);
    }

    #[test]
    fn test_create_coinbase_transaction_large_subsidy() {
        let height = 100;
        let subsidy = 2100000000000000; // Large subsidy
        let script = vec![OP_1];
        let address = vec![OP_1];

        let coinbase_tx = create_coinbase_transaction(height, subsidy, &script, &address).unwrap();

        assert!(is_coinbase(&coinbase_tx));
        assert_eq!(coinbase_tx.outputs[0].value, subsidy);
    }

    #[test]
    fn test_create_coinbase_transaction_empty_script() {
        let height = 100;
        let subsidy = 5000000000;
        let script = vec![]; // Empty script
        let address = vec![OP_1];

        let coinbase_tx = create_coinbase_transaction(height, subsidy, &script, &address).unwrap();

        assert!(is_coinbase(&coinbase_tx));
        assert_eq!(coinbase_tx.outputs[0].value, subsidy);
    }

    #[test]
    fn test_create_coinbase_transaction_empty_address() {
        let height = 100;
        let subsidy = 5000000000;
        let script = vec![OP_1];
        let address = vec![]; // Empty address

        let coinbase_tx = create_coinbase_transaction(height, subsidy, &script, &address).unwrap();

        assert!(is_coinbase(&coinbase_tx));
        assert_eq!(coinbase_tx.outputs[0].value, subsidy);
    }

    #[test]
    fn test_calculate_merkle_root_single_transaction() {
        let txs = vec![create_valid_transaction()];
        let merkle_root = calculate_merkle_root(&txs).unwrap();

        assert_eq!(merkle_root.len(), 32);
        assert_ne!(merkle_root, [0u8; 32]);
    }

    #[test]
    fn test_calculate_merkle_root_three_transactions() {
        let txs = vec![
            create_valid_transaction(),
            create_valid_transaction(),
            create_valid_transaction(),
        ];

        let merkle_root = calculate_merkle_root(&txs).unwrap();
        assert_eq!(merkle_root.len(), 32);
        assert_ne!(merkle_root, [0u8; 32]);
    }

    #[test]
    fn test_calculate_merkle_root_five_transactions() {
        let txs = vec![
            create_valid_transaction(),
            create_valid_transaction(),
            create_valid_transaction(),
            create_valid_transaction(),
            create_valid_transaction(),
        ];

        let merkle_root = calculate_merkle_root(&txs).unwrap();
        assert_eq!(merkle_root.len(), 32);
        assert_ne!(merkle_root, [0u8; 32]);
    }

    #[test]
    fn test_calculate_tx_hash_different_transactions() {
        let tx1 = create_valid_transaction();
        let mut tx2 = create_valid_transaction();
        tx2.version = 2; // Different version

        let hash1 = calculate_tx_hash(&tx1);
        let hash2 = calculate_tx_hash(&tx2);

        assert_ne!(hash1, hash2);
    }

    #[test]
    fn test_sha256_hash_empty_data() {
        let data = vec![];
        let hash = sha256_hash(&data);

        assert_eq!(hash.len(), 32);
    }

    // ==========================================================================
    // REGRESSION TESTS: Merkle tree must use double SHA256 (critical fix)
    // ==========================================================================
    // Bitcoin's Merkle tree uses double SHA256 (SHA256(SHA256(x))) at each level,
    // NOT single SHA256. Using single SHA256 produces wrong merkle roots that
    // cause all blocks to fail verification.

    #[test]
    fn test_merkle_tree_uses_double_sha256_not_single() {
        // Compute two known hashes
        let hash_a = [0x01u8; 32];
        let hash_b = [0x02u8; 32];

        // Manually compute expected double SHA256 of the concatenation
        let mut combined = [0u8; 64];
        combined[..32].copy_from_slice(&hash_a);
        combined[32..].copy_from_slice(&hash_b);

        let expected_double = double_sha256_hash(&combined);
        let wrong_single = sha256_hash(&combined);

        // They must be different (proving single vs double matters)
        assert_ne!(
            expected_double, wrong_single,
            "Double SHA256 and single SHA256 must produce different results"
        );

        // Now test via calculate_merkle_root_from_tx_ids
        let root = calculate_merkle_root_from_tx_ids(&[hash_a, hash_b]).unwrap();
        assert_eq!(
            root, expected_double,
            "Merkle root must use double SHA256, not single SHA256"
        );
        assert_ne!(
            root, wrong_single,
            "Merkle root must NOT match single SHA256 result"
        );
    }

    #[test]
    fn test_merkle_root_single_tx_equals_txid() {
        // For a single transaction, the merkle root IS the txid itself
        let tx = create_valid_transaction();
        let txid = calculate_tx_hash(&tx);

        let root_from_txs = calculate_merkle_root(&[tx]).unwrap();
        let root_from_ids = calculate_merkle_root_from_tx_ids(&[txid]).unwrap();

        assert_eq!(root_from_txs, txid, "Single tx merkle root must equal txid");
        assert_eq!(
            root_from_ids, txid,
            "Single txid merkle root must equal txid"
        );
    }

    #[test]
    fn test_calculate_merkle_root_from_tx_ids_matches_calculate_merkle_root() {
        // Both functions must produce identical results for the same transactions
        let tx1 = create_valid_transaction();
        let tx2 = create_valid_transaction();
        let tx3 = create_valid_transaction();

        let txid1 = calculate_tx_hash(&tx1);
        let txid2 = calculate_tx_hash(&tx2);
        let txid3 = calculate_tx_hash(&tx3);

        let root_from_txs = calculate_merkle_root(&[tx1, tx2, tx3]).unwrap();
        let root_from_ids = calculate_merkle_root_from_tx_ids(&[txid1, txid2, txid3]).unwrap();

        assert_eq!(
            root_from_txs, root_from_ids,
            "calculate_merkle_root and calculate_merkle_root_from_tx_ids must produce identical results"
        );
    }

    #[test]
    fn test_calculate_merkle_root_from_tx_ids_two_txs() {
        let tx1 = create_valid_transaction();
        let tx2 = create_valid_transaction();

        let txid1 = calculate_tx_hash(&tx1);
        let txid2 = calculate_tx_hash(&tx2);

        let root_from_txs = calculate_merkle_root(&[tx1, tx2]).unwrap();
        let root_from_ids = calculate_merkle_root_from_tx_ids(&[txid1, txid2]).unwrap();

        assert_eq!(root_from_txs, root_from_ids);
    }

    #[test]
    fn test_calculate_merkle_root_from_tx_ids_four_txs() {
        let tx1 = create_valid_transaction();
        let tx2 = create_valid_transaction();
        let tx3 = create_valid_transaction();
        let tx4 = create_valid_transaction();

        let txid1 = calculate_tx_hash(&tx1);
        let txid2 = calculate_tx_hash(&tx2);
        let txid3 = calculate_tx_hash(&tx3);
        let txid4 = calculate_tx_hash(&tx4);

        let root_from_txs = calculate_merkle_root(&[tx1, tx2, tx3, tx4]).unwrap();
        let root_from_ids =
            calculate_merkle_root_from_tx_ids(&[txid1, txid2, txid3, txid4]).unwrap();

        assert_eq!(root_from_txs, root_from_ids);
    }

    #[test]
    fn test_calculate_merkle_root_from_tx_ids_empty() {
        let result = calculate_merkle_root_from_tx_ids(&[]);
        assert!(result.is_err(), "Empty tx_ids list should fail");
    }

    #[test]
    fn test_merkle_root_deterministic() {
        // Same inputs must always produce the same output
        let tx1 = create_valid_transaction();
        let tx2 = create_valid_transaction();

        let txid1 = calculate_tx_hash(&tx1);
        let txid2 = calculate_tx_hash(&tx2);

        let root1 = calculate_merkle_root_from_tx_ids(&[txid1, txid2]).unwrap();
        let root2 = calculate_merkle_root_from_tx_ids(&[txid1, txid2]).unwrap();

        assert_eq!(root1, root2, "Merkle root must be deterministic");
    }

    #[test]
    fn test_merkle_root_order_matters() {
        // Swapping tx order must produce a different merkle root
        let txid1 = [0x01u8; 32];
        let txid2 = [0x02u8; 32];

        let root_ab = calculate_merkle_root_from_tx_ids(&[txid1, txid2]).unwrap();
        let root_ba = calculate_merkle_root_from_tx_ids(&[txid2, txid1]).unwrap();

        assert_ne!(root_ab, root_ba, "Tx order must affect merkle root");
    }

    #[test]
    fn test_double_sha256_hash_known_value() {
        // Verify double_sha256_hash produces correct result for empty input
        // SHA256("") = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
        // SHA256(SHA256("")) = 5df6e0e2761359d30a8275058e299fcc0381534545f55cf43e41983f5d4c9456
        let result = double_sha256_hash(&[]);
        // Just verify it's 32 bytes and deterministic
        assert_eq!(result.len(), 32);
        let result2 = double_sha256_hash(&[]);
        assert_eq!(result, result2);

        // Also verify it's different from single SHA256
        let single = sha256_hash(&[]);
        assert_ne!(
            result, single,
            "double SHA256 must differ from single SHA256"
        );
    }

    fn declared_spend(prev_hash: [u8; 32], extra: u8) -> Transaction {
        Transaction {
            version: 1,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: prev_hash,
                    index: 0,
                },
                script_sig: vec![OP_1, PUSH_1_BYTE, extra],
                sequence: 0xffffffff,
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 1000,
                script_pubkey: vec![],
            }]
            .into(),
            lock_time: 0,
        }
    }

    fn insert_legacy_utxo(utxo_set: &mut UtxoSet, hash: [u8; 32]) {
        utxo_set.insert(
            OutPoint { hash, index: 0 },
            std::sync::Arc::new(UTXO {
                value: 10_000,
                script_pubkey: vec![].into(),
                height: 0,
                is_coinbase: false,
            }),
        );
    }

    fn declared_template_header() -> (BlockHeader, Vec<BlockHeader>) {
        let prev = BlockHeader {
            version: 4,
            prev_block_hash: [0u8; 32],
            merkle_root: [0u8; 32],
            timestamp: 1_600_000_000,
            bits: 0x207fffff,
            nonce: 0,
        };
        let prev_headers = vec![prev.clone(), prev.clone()];
        (prev, prev_headers)
    }

    #[test]
    fn resolve_declared_txs_empty_ok() {
        let tx = declared_spend([1u8; 32], 1);
        assert!(resolve_declared_txs(&[tx], &[]).unwrap().is_empty());
    }

    #[test]
    fn resolve_declared_txs_unknown_is_error() {
        let tx = declared_spend([1u8; 32], 1);
        let err = resolve_declared_txs(&[tx], &[[9u8; 32]]).unwrap_err();
        assert!(err.to_string().contains("unknown declared txid"));
    }

    #[test]
    fn resolve_declared_txs_duplicate_is_error() {
        let tx = declared_spend([1u8; 32], 1);
        let id = crate::block::calculate_tx_id(&tx);
        let err = resolve_declared_txs(&[tx], &[id, id]).unwrap_err();
        assert!(err.to_string().contains("duplicate declared txid"));
    }

    #[test]
    fn declared_template_selects_named_subset_and_commons_bip141() {
        let mut utxo_set = UtxoSet::default();
        insert_legacy_utxo(&mut utxo_set, [1u8; 32]);
        insert_legacy_utxo(&mut utxo_set, [2u8; 32]);
        let a = declared_spend([1u8; 32], 1);
        let b = declared_spend([2u8; 32], 2);
        let id_b = crate::block::calculate_tx_id(&b);
        let (prev, prev_headers) = declared_template_header();
        let outputs = [(1, vec![OP_1]), (2, vec![OP_2])];
        let tmpl = create_block_template_declared(
            &utxo_set,
            &[a, b.clone()],
            &[id_b],
            1,
            &prev,
            &prev_headers,
            &vec![OP_1],
            &outputs,
            Network::Regtest,
            None,
        )
        .expect("declared subset");
        assert_eq!(tmpl.transactions.len(), 1);
        assert_eq!(crate::block::calculate_tx_id(&tmpl.transactions[0]), id_b);
        assert!(is_coinbase(&tmpl.coinbase_tx));
        assert!(tmpl.coinbase_tx.outputs.len() >= 3);
        let last = tmpl.coinbase_tx.outputs.last().unwrap();
        assert_eq!(last.value, 0);
        assert_eq!(
            &last.script_pubkey[0..6],
            &[0x6a, 0x24, 0xaa, 0x21, 0xa9, 0xed]
        );
        assert_eq!(tmpl.coinbase_tx.outputs[1].script_pubkey, vec![OP_2]);
    }

    #[test]
    fn declared_template_empty_is_coinbase_only() {
        let utxo_set = UtxoSet::default();
        let extra = declared_spend([1u8; 32], 1);
        let (prev, prev_headers) = declared_template_header();
        let tmpl = create_block_template_declared(
            &utxo_set,
            &[extra],
            &[],
            1,
            &prev,
            &prev_headers,
            &vec![OP_1],
            &[(1, vec![OP_1])],
            Network::Regtest,
            None,
        )
        .expect("empty declaration");
        assert!(tmpl.transactions.is_empty());
        assert!(is_coinbase(&tmpl.coinbase_tx));
        assert!(check_template_weight(&tmpl, crate::constants::MAX_BLOCK_WEIGHT as u64).is_ok());
        let err = check_template_weight(&tmpl, 1).unwrap_err();
        assert!(err.to_string().contains("exceeds max"));
    }

    #[test]
    fn declared_template_unknown_txid_errors() {
        let utxo_set = UtxoSet::default();
        let tx = declared_spend([1u8; 32], 1);
        let (prev, prev_headers) = declared_template_header();
        let err = create_block_template_declared(
            &utxo_set,
            &[tx],
            &[[9u8; 32]],
            1,
            &prev,
            &prev_headers,
            &vec![OP_1],
            &[(1, vec![OP_1])],
            Network::Regtest,
            None,
        )
        .unwrap_err();
        assert!(err.to_string().contains("unknown declared txid"));
    }

    #[test]
    fn declared_template_duplicate_txid_errors() {
        let mut utxo_set = UtxoSet::default();
        insert_legacy_utxo(&mut utxo_set, [1u8; 32]);
        let tx = declared_spend([1u8; 32], 1);
        let id = crate::block::calculate_tx_id(&tx);
        let (prev, prev_headers) = declared_template_header();
        let err = create_block_template_declared(
            &utxo_set,
            &[tx],
            &[id, id],
            1,
            &prev,
            &prev_headers,
            &vec![OP_1],
            &[(1, vec![OP_1])],
            Network::Regtest,
            None,
        )
        .unwrap_err();
        assert!(err.to_string().contains("duplicate declared txid"));
    }

    #[test]
    fn declared_template_rejected_tx_errors() {
        let utxo_set = UtxoSet::default();
        let rejected = declared_spend([9u8; 32], 9);
        let id = crate::block::calculate_tx_id(&rejected);
        let (prev, prev_headers) = declared_template_header();
        let err = create_block_template_declared(
            &utxo_set,
            &[rejected],
            &[id],
            1,
            &prev,
            &prev_headers,
            &vec![OP_1],
            &[(1, vec![OP_1])],
            Network::Regtest,
            None,
        )
        .unwrap_err();
        let msg = err.to_string();
        assert!(
            msg.contains("not selected") || msg.contains("rejected"),
            "expected rejected-declared error, got {msg}"
        );
    }

    #[test]
    fn declared_template_missing_witness_stack_errors() {
        let mut utxo_set = UtxoSet::default();
        let mut p2wpkh = vec![OP_0, PUSH_20_BYTES];
        p2wpkh.extend_from_slice(&[0u8; 20]);
        utxo_set.insert(
            OutPoint {
                hash: [0xAAu8; 32],
                index: 0,
            },
            std::sync::Arc::new(UTXO {
                value: 10_000,
                script_pubkey: p2wpkh.into(),
                height: 0,
                is_coinbase: false,
            }),
        );
        let spend = Transaction {
            version: 2,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [0xAAu8; 32],
                    index: 0,
                },
                script_sig: vec![],
                sequence: 0xffffffff,
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 1000,
                script_pubkey: vec![OP_1],
            }]
            .into(),
            lock_time: 0,
        };
        let id = crate::block::calculate_tx_id(&spend);
        let (prev, prev_headers) = declared_template_header();
        let err = create_block_template_declared(
            &utxo_set,
            &[spend],
            &[id],
            1,
            &prev,
            &prev_headers,
            &vec![OP_1],
            &[(1, vec![OP_1])],
            Network::Regtest,
            None,
        )
        .unwrap_err();
        assert!(
            err.to_string().contains("missing mempool witnesses"),
            "got {}",
            err
        );
    }

    #[test]
    fn template_version_follows_bip90() {
        assert_eq!(template_block_version(Network::Mainnet, 1), 1);
        assert!(template_block_version(Network::Mainnet, 388_381) >= 4);
    }

    #[test]
    fn template_time_is_at_least_the_median_plus_one() {
        let prev = BlockHeader {
            version: 1,
            prev_block_hash: [0; 32],
            merkle_root: [0; 32],
            timestamp: 999,
            bits: 0x1d00ffff,
            nonce: 0,
        };
        let prev_headers = vec![prev.clone(); 11];
        let utxo = UtxoSet::default();
        let script = vec![OP_1];
        let early = create_new_block_with_time(
            &utxo,
            &[],
            1,
            &prev,
            &prev_headers,
            &script,
            &script,
            900,
            Network::Mainnet,
            None,
        )
        .unwrap();
        assert_eq!(early.header.timestamp, 1_000);
        assert_eq!(early.header.version, 1);
        let late = create_new_block_with_time(
            &utxo,
            &[],
            1,
            &prev,
            &prev_headers,
            &script,
            &script,
            1_100,
            Network::Mainnet,
            None,
        )
        .unwrap();
        assert_eq!(late.header.timestamp, 1_100);
    }
}