@easy1staking/cip113-sdk-ts 0.3.1 → 0.5.0

package/dist/substandards/freeze-and-seize/index.js

@@ -5,9 +5,11 @@
  *
  * Capabilities: register, mint, burn, transfer, freeze, unfreeze, seize.
  */
+import { CIP171_METADATA_LABEL, buildCip171Metadatum } from "../../core/cip171.js";
 import { Address as EvoAddress, Assets, Data, Transaction, TransactionHash as EvoTransactionHash, TransactionInput as EvoTransactionInput, } from "@evolution-sdk/evolution";
 import { sortTxInputs, findRefInputIndex, findRegistryNode, findCoveringNode, utxoToTxInput, } from "../../core/registry.js";
-import { buildEvoScript, scriptAddress, rewardAddress, baseAddress, stakingCredentialHash, paymentCredentialHash, stringToHex, MAX_NEXT, voidData, registryNodeDatum, blacklistNodeDatum, issuanceRedeemerFirstMint, issuanceRedeemerRefInput, registryInsertRedeemer, transferActRedeemer, thirdPartyActRedeemer, blacklistInitRedeemer, blacklistAddRedeemer, blacklistRemoveRedeemer, extractConstrBytesField, extractCredentialField, getInlineDatum, utxoUnitQty, utxoLovelace, utxoTxHash, utxoOutputIndex, outputAssets, mintAssetsFromMap, Credential, KeyHash, InlineDatum, labeledAssetName, buildCIP68FTDatum, } from "../../core/evo-utils.js";
+import { buildEvoScript, scriptAddress, rewardAddress, baseAddress, stakingCredentialHash, paymentCredentialHash, stringToHex, MAX_NEXT, voidData, registryNodeDatum, decodeRegistryNode, blacklistNodeDatum, mintingProofOutputIndex, mintingProofRefInput, registryInsertRedeemer, blacklistInitRedeemer, blacklistAddRedeemer, blacklistRemoveRedeemer, extractConstrBytesField, getInlineDatum, utxoUnitQty, utxoLovelace, utxoTxHash, utxoOutputIndex, outputAssets, mintAssetsFromMap, REGISTRY_NODE_MIN_ADA, Credential, KeyHash, InlineDatum, labeledAssetName, buildCIP68FTDatum, } from "../../core/evo-utils.js";
+import { baseSpendRedeemer, transferRedeemer, thirdPartyRedeemer, withdrawalIndexOf, } from "../../core/ledger-order.js";
 import { createFESScripts } from "./scripts.js";
 // ---------------------------------------------------------------------------
 // Helpers
@@ -16,6 +18,20 @@ import { createFESScripts } from "./scripts.js";
  * Build the transaction and extract unsigned CBOR + txHash.
  * Works with both ReadOnlyClient (TransactionResultBase) and SigningClient (SignBuilder).
  */
+/**
+ * The evaluator this plugin builds with, set by `init()`.
+ *
+ * Module-scoped rather than threaded through nine call sites. Without it every
+ * script failure in this substandard surfaces as Kupmios's bare
+ * "evaluateTx failed", naming neither the failing validator nor the reason —
+ * which is the difference between a diagnosis and a guess, and it cost a cycle
+ * here exactly as it did in `dummy` before the same fix.
+ *
+ * ⚠ Shared across instances of this plugin in one process. Acceptable because
+ * it only affects DIAGNOSTICS, never the transaction built; if that ever stops
+ * being true, thread it through instead.
+ */
+let sharedEvaluator;
 async function buildAndSerialize(
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 builder, changeAddress, availableUtxos, passAdditionalUtxos = false) {
@@ -23,6 +39,9 @@ builder, changeAddress, availableUtxos, passAdditionalUtxos = false) {
     const buildOpts = {
         changeAddress: EvoAddress.fromBech32(changeAddress),
     };
+    if (sharedEvaluator) {
+        buildOpts.evaluator = sharedEvaluator;
+    }
     if (availableUtxos) {
         buildOpts.availableUtxos = availableUtxos;
     }
@@ -42,6 +61,57 @@ builder, changeAddress, availableUtxos, passAdditionalUtxos = false) {
     }
     return { cbor, txHash, chainAvailable, _signBuilder: result };
 }
+/**
+ * Wallet UTxOs that are SAFE TO SPEND.
+ *
+ * A deployment's reference scripts live in outputs somewhere on chain, and if
+ * that somewhere is the operator's own wallet — which is exactly what the
+ * devnet harness does — then `getUtxos(wallet)` hands them back alongside
+ * ordinary funds. Spending one DESTROYS protocol infrastructure: the
+ * `script_ref` is not carried into the change output, so the reference input
+ * every later operation depends on simply ceases to exist.
+ *
+ * MEASURED, not theorised: `seize` consumed the deployment's `third_party`
+ * reference-script UTxO this way, which is why it appeared to work at all —
+ * a spent input's reference script counts as supplied (CIP-33) — and why the
+ * next run failed with 3011.
+ */
+function spendableWalletUtxos(walletUtxos, deployment) {
+    const reserved = new Set([
+        deployment.programmableBaseRefInput,
+        deployment.transferRefInput,
+        deployment.thirdPartyRefInput,
+        deployment.unfrackingRefInput,
+    ]
+        .filter(Boolean)
+        .map((r) => `${r.txHash}#${r.outputIndex}`));
+    return walletUtxos.filter((u) => {
+        // ⛔ ANY UTxO CARRYING A REFERENCE SCRIPT IS OFF LIMITS, not merely the four
+        // this deployment names.
+        //
+        // MEASURED, THE EXPENSIVE WAY: the named-four filter was not enough. A
+        // long-lived wallet accumulates reference scripts from EVERY deployment it
+        // has ever made, and coin selection is free to spend any of them. On
+        // preview it consumed two of the LIVE deployment's own four during a
+        // failed retry — the deployment two VERIFIED CIP-171 records describe —
+        // because those four were reached through a path that did not consult this
+        // filter at all.
+        //
+        // Spending one destroys protocol infrastructure silently: the script_ref is
+        // not carried into the change output, nothing errors, and the damage
+        // surfaces only when a later operation needs the script. On mainnet this is
+        // spending live reference scripts that running contracts depend on, and it
+        // would look like a successful transaction.
+        //
+        // The safe rule needs no knowledge of WHOSE deployment a script belongs to:
+        // if a wallet UTxO carries a reference script, it is infrastructure, not
+        // funds.
+        if (u.scriptRef)
+            return false;
+        const i = utxoToTxInput(u);
+        return !reserved.has(`${i.txHash}#${i.outputIndex}`);
+    });
+}
 function selectUtxosForAmount(utxos, unit, requiredAmount) {
     const selected = [];
     let total = 0n;
@@ -62,7 +132,9 @@ function selectUtxosForAmount(utxos, unit, requiredAmount) {
 /** Find protocol params UTxO by searching for the protocol params NFT */
 async function findProtocolParamsUtxo(client, networkId, deployment) {
     const ppUnit = deployment.protocolParams.policyId + stringToHex("ProtocolParams");
-    const addr = EvoAddress.fromBech32(scriptAddress(networkId, deployment.protocolParams.alwaysFailScriptHash));
+    const addr = EvoAddress.fromBech32(
+    // 0.5.x: params NFT lives at coordination_spend, not always_fail.
+    scriptAddress(networkId, deployment.coordination.scriptHash));
     const utxos = await client.getUtxosWithUnit(addr, ppUnit);
     if (utxos.length > 0)
         return utxos[0];
@@ -114,7 +186,27 @@ export function freezeAndSeizeSubstandard(config) {
         version: "0.1.0",
         blueprint: config.blueprint,
         init(context) {
+            // ---------------------------------------------------------------------
+            // MIGRATION STATE (W-E). Read this before assuming an operation works.
+            // ---------------------------------------------------------------------
+            //
+            // The blanket refusal that D-14 installed is GONE: `register`, `mint`,
+            // `transfer`, `initCompliance`, `freeze` and `unfreeze` are migrated to
+            // CIP-113 0.5.0-alpha.2 and this plugin initialises.
+            //
+            // `seize` and `burn` are migrated too (W-E S-5): both take the
+            // THIRD-PARTY route, which #110 moved off the deleted `ThirdPartyAct` and
+            // onto the standalone `third_party` validator's withdraw-0 with a
+            // ThirdPartyRedeemer, plus BaseSpendRedeemer(SpendViaThirdParty) on every
+            // programmable input.
+            //
+            // ⚠ The seize/burn paths still need re-validating against upstream #79
+            // (UTxO contamination), #80 (issuance delegation scope) and #115 (datum
+            // hashes and reference scripts banned on programmable outputs). Those are
+            // SEMANTIC changes with no signature to catch them, so a green devnet run
+            // is necessary and not sufficient.
             ctx = context;
+            sharedEvaluator = ctx.evaluator;
             networkId = ctx.client.chain.id;
             const { adminPkh, assetName, blacklistNodePolicyId, blacklistInitTxInput } = config.deployment;
             const fes = createFESScripts(config.blueprint);
@@ -140,7 +232,12 @@ export function freezeAndSeizeSubstandard(config) {
             const { feePayerAddress, assetName, quantity, recipientAddress } = params;
             const recipient = recipientAddress || feePayerAddress;
             const chainedUtxos = (params.chainedUtxos ?? []);
-            const assetNameHex = stringToHex(assetName);
+            // Already hex: `assetName` is raw asset-name HEX at every API boundary in
+            // this SDK. This previously ran stringToHex over it, double-encoding any
+            // caller who followed the convention — and silently producing a DIFFERENT
+            // token, under a policy derived from a different issuer_admin, so nothing
+            // failed; the tokens simply were not where anyone looked for them.
+            const assetNameHex = assetName;
             const hasCIP68 = !!params.cip68Metadata;
             const client = ctx.client;
             // When CIP-68 is enabled, prefix asset names with CIP-67 labels
@@ -162,26 +259,41 @@ export function freezeAndSeizeSubstandard(config) {
             const protocolParamsUtxo = await findProtocolParamsUtxo(client, networkId, ctx.deployment);
             const issuanceCborHexUtxo = await findIssuanceCborHexUtxo(client, networkId, ctx.deployment);
             // 3. Build datums
-            const coveringTransferCred = extractCredentialField(coveringDatum, 2) ?? { type: "key", hash: "" };
-            const coveringThirdPartyCred = extractCredentialField(coveringDatum, 3) ?? { type: "key", hash: "" };
+            // UNREACHABLE — this plugin refuses at init (T-D09). Retained, and made to
+            // typecheck against the 7-field layout, so the freeze-and-seize epic gets a
+            // readable diff instead of a rewrite from memory.
+            //
+            // The index-based reads that used to be here (2/3/4) were silently wrong
+            // under the 7-field layout. Replaced with decodeRegistryNode, which is
+            // positional-safe and fails loudly on a short record.
+            if (!coveringDatum) {
+                throw new Error("register: the covering registry node has no inline datum. The directory " +
+                    "cannot be traversed without it — a node with no datum is malformed, not empty.");
+            }
+            const covering = decodeRegistryNode(coveringDatum);
             const updatedCoveringDatum = registryNodeDatum({
+                ...covering,
                 key: coveringKey,
                 next: scripts.tokenPolicyId,
-                transferLogicScript: coveringTransferCred,
-                thirdPartyTransferLogicScript: coveringThirdPartyCred,
-                globalStateCs: extractConstrBytesField(coveringDatum, 4) ?? "",
             });
             const newRegistryNodeDatum = registryNodeDatum({
                 key: scripts.tokenPolicyId,
                 next: coveringNext,
+                mintingLogicScript: { type: "script", hash: scripts.issuerAdmin.hash },
                 transferLogicScript: { type: "script", hash: scripts.transfer.hash },
                 thirdPartyTransferLogicScript: { type: "script", hash: scripts.issuerAdmin.hash },
+                // ⚠ UNASSIGNED, NOT DECIDED. Upstream added an unfracking delegate per
+                // registry node; freeze-and-seize has no unfracking concept and the
+                // choice belongs to its own epic. Pointing it at issuerAdmin keeps the
+                // shape valid; it is NOT a design decision and is never emitted, because
+                // init() throws before any of this runs.
+                unfrackingLogicScript: { type: "script", hash: scripts.issuerAdmin.hash },
                 globalStateCs: "",
             });
             // 4. Build redeemers — registry output index shifts when CIP-68 adds an extra output
             const registryOutputIndex = hasCIP68 ? 3 : 2;
-            const issuanceRedeemer = issuanceRedeemerFirstMint(scripts.issuerAdmin.hash, registryOutputIndex);
-            const registryMintRedeemer = registryInsertRedeemer(scripts.issuanceMint.hash, scripts.issuerAdmin.hash);
+            const issuanceRedeemer = mintingProofOutputIndex(registryOutputIndex);
+            const registryMintRedeemer = registryInsertRedeemer(scripts.issuanceMint.hash, { type: "script", hash: scripts.issuerAdmin.hash });
             const tokenDatum = voidData();
             // 5. Determine if chaining from initCompliance
             const useChaining = chainedUtxos.length > 0;
@@ -200,6 +312,14 @@ export function freezeAndSeizeSubstandard(config) {
             const coveringNftUnit = findCoveringNodeNftUnit(coveringNodeUtxo, registryMintPolicyId);
             // 8. Build transaction
             let tx = client.newTx();
+            // CIP-171 provenance, carried by the transaction that parameterises the
+            // scripts it describes. Optional: absent, this behaves exactly as before.
+            if (params.cip171Record) {
+                tx = tx.attachMetadata({
+                    label: CIP171_METADATA_LABEL,
+                    metadata: buildCip171Metadatum(params.cip171Record),
+                });
+            }
             tx = tx.collectFrom({ inputs: [coveringNodeUtxo], redeemer: voidData() });
             tx = tx.withdraw({
                 stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(scripts.issuerAdmin.hash, "hex"))),
@@ -233,10 +353,19 @@ export function freezeAndSeizeSubstandard(config) {
                 assets: outputAssets(utxoLovelace(coveringNodeUtxo), coveringNodeTokenMap),
                 datum: new InlineDatum.InlineDatum({ data: updatedCoveringDatum }),
             });
-            // New registry node (output 2 or 3)
+            // New registry node (output 2 or 3).
+            //
+            // 3 ADA, not 2: the RegistryNode datum is SEVEN fields in 0.5.x and
+            // min-UTxO scales with serialised output size. MEASURED at 2,038,630 for
+            // a node of this shape — the inherited 2,000,000 was sized for the
+            // five-field datum, and the ledger reports the shortfall as
+            // "insufficient Ada" with a number, never as "your datum grew".
+            // (The covering-node output above needs no change: it carries the
+            // covering UTxO's OWN lovelace forward, so it inherits whatever the
+            // bootstrap funded the origin with.)
             tx = tx.payToAddress({
                 address: EvoAddress.fromBech32(registrySpendAddr),
-                assets: outputAssets(2000000n, new Map([[registryNftUnit, 1n]])),
+                assets: outputAssets(REGISTRY_NODE_MIN_ADA, new Map([[registryNftUnit, 1n]])),
                 datum: new InlineDatum.InlineDatum({ data: newRegistryNodeDatum }),
             });
             // Reference inputs
@@ -287,7 +416,7 @@ export function freezeAndSeizeSubstandard(config) {
             const sortedRefInputs = sortTxInputs([regRef]);
             const registryRefIdx = findRefInputIndex(sortedRefInputs, regRef);
             // 3. Build redeemers
-            const issuanceRedeemer = issuanceRedeemerRefInput(scripts.issuerAdmin.hash, registryRefIdx);
+            const issuanceRedeemer = mintingProofRefInput(registryRefIdx);
             const tokenDatum = voidData();
             // 4. Build PLB address
             const plbHash = ctx.standardScripts.programmableLogicBase.hash;
@@ -297,7 +426,8 @@ export function freezeAndSeizeSubstandard(config) {
             // 6. Build transaction
             const tokenAssets = mintAssetsFromMap(new Map([[unit, quantity]]));
             let tx = client.newTx();
-            tx = tx.collectFrom({ inputs: walletUtxos.slice(0, 2) });
+            const spendableUtxos = spendableWalletUtxos(walletUtxos, ctx.deployment);
+            tx = tx.collectFrom({ inputs: spendableUtxos.slice(0, 2) });
             tx = tx.withdraw({
                 stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(scripts.issuerAdmin.hash, "hex"))),
                 amount: 0n,
@@ -313,7 +443,7 @@ export function freezeAndSeizeSubstandard(config) {
             tx = tx.attachScript({ script: buildEvoScript(scripts.issuerAdmin.compiledCode) });
             tx = tx.attachScript({ script: buildEvoScript(scripts.issuanceMint.compiledCode) });
             tx = tx.addSigner({ keyHash: KeyHash.fromHex(config.deployment.adminPkh) });
-            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, walletUtxos);
+            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, spendableUtxos);
             return { cbor, txHash, tokenPolicyId, _signBuilder };
         },
         // ====================================================================
@@ -349,8 +479,33 @@ export function freezeAndSeizeSubstandard(config) {
             const sortedRefInputs = sortTxInputs(allRefInputRefs);
             const registryIdx = findRefInputIndex(sortedRefInputs, utxoToTxInput(registryUtxo));
             // 4. Build redeemers
-            const issuanceRedeemer = issuanceRedeemerRefInput(scripts.issuerAdmin.hash, registryIdx);
-            const plgRedeemer = thirdPartyActRedeemer(registryIdx, 0);
+            const issuanceRedeemer = mintingProofRefInput(registryIdx);
+            const paramsIdx = findRefInputIndex(sortedRefInputs, utxoToTxInput(protocolParamsUtxo));
+            // 0.5.x third-party route. `ThirdPartyAct` was DELETED by #110: the
+            // administrative path is now the standalone `third_party` validator, and
+            // programmable_logic_base dispatches to it via SpendViaThirdParty — so
+            // this transaction never loads the `transfer` reference script at all.
+            //
+            // The withdrawal set is BOTH scripts: the framework delegate, and the
+            // issuer authority the registry node names in
+            // `third_party_transfer_logic_script`. `third_party` requires the latter
+            // by name — it is the only thing standing between a holder's tokens and
+            // anyone who wants them, and for FES it is a real issuer-admin check
+            // rather than dummy's unconditional one.
+            const thirdPartyKey = {
+                hash: ctx.standardScripts.thirdParty.hash,
+                isScript: true,
+            };
+            const issuerAuthorityKey = { hash: scripts.issuerAdmin.hash, isScript: true };
+            const thirdPartyWdrlIdx = withdrawalIndexOf([thirdPartyKey, issuerAuthorityKey], thirdPartyKey);
+            // outputs_start_idx = 0: `third_party` PAIRS each programmable input with
+            // the NEXT output (same address, datum and reference script, lovelace
+            // ratcheting up) and reads the seized amount as the DELTA. Destination
+            // outputs must therefore sit AMONG THE LEADING ones it skips.
+            // See docs/api-reference.md — getting this backwards fails with an EMPTY
+            // TRACE LIST, because it is a structural expect and not a traced check.
+            const plgRedeemer = thirdPartyRedeemer(paramsIdx, registryIdx, 0);
+            const plbSpendRedeemer = baseSpendRedeemer("THIRD_PARTY", paramsIdx, thirdPartyWdrlIdx);
             const tokenDatum = voidData();
             // 5. Compute remaining assets (remove burned token's policy)
             const remainingTokens = new Map();
@@ -370,31 +525,37 @@ export function freezeAndSeizeSubstandard(config) {
             const walletUtxos = await client.getUtxos(EvoAddress.fromBech32(feePayerAddress));
             // 8. Build transaction
             let tx = client.newTx();
-            tx = tx.collectFrom({ inputs: walletUtxos.slice(0, 2) });
-            tx = tx.collectFrom({ inputs: [utxoToBurn], redeemer: voidData() });
+            const spendableUtxos = spendableWalletUtxos(walletUtxos, ctx.deployment);
+            tx = tx.collectFrom({ inputs: spendableUtxos.slice(0, 2) });
+            tx = tx.collectFrom({ inputs: [utxoToBurn], redeemer: plbSpendRedeemer });
             tx = tx.withdraw({
                 stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(scripts.issuerAdmin.hash, "hex"))),
                 amount: 0n,
                 redeemer: voidData(),
             });
             tx = tx.withdraw({
-                stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(ctx.standardScripts.programmableLogicGlobal.hash, "hex"))),
+                stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(ctx.standardScripts.thirdParty.hash, "hex"))),
                 amount: 0n,
                 redeemer: plgRedeemer,
             });
             tx = tx.payToAddress({
                 address: utxoToBurn.address,
                 assets: outputAssets(utxoLovelace(utxoToBurn), remainingTokens.size > 0 ? remainingTokens : undefined),
-                datum: new InlineDatum.InlineDatum({ data: tokenDatum }),
+                // The PAIRED continuation: `third_party` requires it to preserve the
+                // input's ADDRESS, DATUM and REFERENCE SCRIPT exactly. Carry the input's
+                // own datum rather than a fresh void one — they happen to be equal today
+                // because every programmable output here is void-datumed, and that is a
+                // coincidence rather than a guarantee.
+                datum: new InlineDatum.InlineDatum({ data: getInlineDatum(utxoToBurn) ?? tokenDatum }),
             });
             tx = tx.mintAssets({ assets: burnAssets, redeemer: issuanceRedeemer });
             tx = tx.readFrom({ referenceInputs: [protocolParamsUtxo, registryUtxo] });
             tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.programmableLogicBase.compiledCode) });
-            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.programmableLogicGlobal.compiledCode) });
+            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.thirdParty.compiledCode) });
             tx = tx.attachScript({ script: buildEvoScript(scripts.issuerAdmin.compiledCode) });
             tx = tx.attachScript({ script: buildEvoScript(scripts.issuanceMint.compiledCode) });
             tx = tx.addSigner({ keyHash: KeyHash.fromHex(config.deployment.adminPkh) });
-            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, walletUtxos);
+            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, spendableUtxos);
             return { cbor, txHash, _signBuilder };
         },
         // ====================================================================
@@ -451,18 +612,56 @@ export function freezeAndSeizeSubstandard(config) {
             const sortedRefInputs = sortTxInputs(allRefInputRefs);
             const proofIndices = selected.map(() => findRefInputIndex(sortedRefInputs, utxoToTxInput(proofUtxos[0])));
             const registryIdx = findRefInputIndex(sortedRefInputs, utxoToTxInput(registryUtxo));
+            const paramsIdx = findRefInputIndex(sortedRefInputs, utxoToTxInput(protocolParamsUtxo));
             // 8. Get sender's wallet UTxOs
             const senderWalletUtxos = await client.getUtxos(EvoAddress.fromBech32(senderAddress));
-            // 9. Build redeemers
+            // 9. Build redeemers — 0.5.x shapes.
+            //
+            // The withdrawal set must be COMPLETE and in LEDGER order: script
+            // credentials before key credentials, bytewise within each. This
+            // transaction carries two, both scripts — the framework's `transfer`
+            // delegate and this substandard's own transfer logic.
+            const coreTransferKey = {
+                hash: ctx.standardScripts.transfer.hash,
+                isScript: true,
+            };
+            const fesLogicKey = { hash: scripts.transfer.hash, isScript: true };
+            const transferWdrlIdx = withdrawalIndexOf([coreTransferKey, fesLogicKey], coreTransferKey);
+            if (process.env.DUMP_TX_STRUCTURE) {
+                // Computed indices, printed beside the artefact's own order so the two
+                // can be COMPARED rather than reasoned about. A structural expect in
+                // programmable_logic_base fails with an empty trace list, so this is the
+                // only way to see which index is wrong.
+                // eslint-disable-next-line no-console
+                console.error("=== FES transfer COMPUTED ===\n" +
+                    `  refs (sorted): ${sortedRefInputs.map((r) => `${r.txHash.slice(0, 8)}#${r.outputIndex}`).join(" ")}\n` +
+                    `  paramsIdx=${paramsIdx} -> ${sortedRefInputs[paramsIdx]?.txHash?.slice(0, 8)}#${sortedRefInputs[paramsIdx]?.outputIndex}\n` +
+                    `  registryIdx=${registryIdx}\n` +
+                    `  coreTransfer=${ctx.standardScripts.transfer.hash}\n` +
+                    `  fesLogic    =${scripts.transfer.hash}\n` +
+                    `  transferWdrlIdx=${transferWdrlIdx}\n` +
+                    "=== END COMPUTED ===");
+            }
             const fesTransferRedeemer = Data.list(proofIndices.map((idx) => Data.constr(0n, [Data.int(BigInt(idx))])));
-            const plgRedeemer = transferActRedeemer([{ type: "exists", nodeIdx: registryIdx }]);
-            const spendRdmr = voidData();
+            // TransferRedeemer { params_idx, proofs } — params_idx was PREPENDED by
+            // #109; an old TransferAct encoder's bytes are not compatible.
+            const plgRedeemer = transferRedeemer(paramsIdx, [
+                { type: "exists", nodeIdx: registryIdx },
+            ]);
+            // programmable_logic_base no longer takes an untyped redeemer: it
+            // dispatches on the constructor and witnesses where its delegate's
+            // withdrawal sits.
+            const spendRdmr = baseSpendRedeemer("TRANSFER", paramsIdx, transferWdrlIdx);
             const tokenDatum = voidData();
             // 10. Build transaction
             let tx = client.newTx();
             tx = tx.collectFrom({ inputs: selected, redeemer: spendRdmr });
+            // The TRANSFER delegate — not third_party. programmable_logic_base
+            // resolves the withdrawal at `wdrl_idx` and requires it to equal the
+            // credential the params datum names for THIS dispatch arm, so withdrawing
+            // the wrong delegate fails the spend with an empty trace list.
             tx = tx.withdraw({
-                stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(ctx.standardScripts.programmableLogicGlobal.hash, "hex"))),
+                stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(ctx.standardScripts.transfer.hash, "hex"))),
                 amount: 0n,
                 redeemer: plgRedeemer,
             });
@@ -485,7 +684,7 @@ export function freezeAndSeizeSubstandard(config) {
             });
             tx = tx.readFrom({ referenceInputs: [...proofUtxos, protocolParamsUtxo, registryUtxo] });
             tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.programmableLogicBase.compiledCode) });
-            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.programmableLogicGlobal.compiledCode) });
+            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.transfer.compiledCode) });
             tx = tx.attachScript({ script: buildEvoScript(scripts.transfer.compiledCode) });
             tx = tx.addSigner({ keyHash: KeyHash.fromHex(senderStakingHash) });
             const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, senderAddress, senderWalletUtxos);
@@ -592,7 +791,8 @@ export function freezeAndSeizeSubstandard(config) {
             const nftAssets = mintAssetsFromMap(new Map([[nftUnit, 1n]]));
             const walletUtxos = await client.getUtxos(EvoAddress.fromBech32(feePayerAddress));
             let tx = client.newTx();
-            tx = tx.collectFrom({ inputs: walletUtxos.slice(0, 2) });
+            const spendableUtxos = spendableWalletUtxos(walletUtxos, ctx.deployment);
+            tx = tx.collectFrom({ inputs: spendableUtxos.slice(0, 2) });
             tx = tx.collectFrom({ inputs: [coveringNode], redeemer: voidData() });
             tx = tx.mintAssets({ assets: nftAssets, redeemer: blacklistAddRedeemer(targetStakingHash) });
             // Output 0: updated covering node
@@ -615,7 +815,7 @@ export function freezeAndSeizeSubstandard(config) {
             tx = tx.attachScript({ script: buildEvoScript(scripts.blacklistMint.compiledCode) });
             const managerPkh = paymentCredentialHash(feePayerAddress);
             tx = tx.addSigner({ keyHash: KeyHash.fromHex(managerPkh) });
-            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, walletUtxos);
+            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, spendableUtxos);
             return { cbor, txHash, _signBuilder };
         },
         // ====================================================================
@@ -648,7 +848,8 @@ export function freezeAndSeizeSubstandard(config) {
             const burnAssets = mintAssetsFromMap(new Map([[nftUnit, -1n]]));
             const walletUtxos = await client.getUtxos(EvoAddress.fromBech32(feePayerAddress));
             let tx = client.newTx();
-            tx = tx.collectFrom({ inputs: walletUtxos.slice(0, 2) });
+            const spendableUtxos = spendableWalletUtxos(walletUtxos, ctx.deployment);
+            tx = tx.collectFrom({ inputs: spendableUtxos.slice(0, 2) });
             tx = tx.collectFrom({ inputs: [nodeToRemove], redeemer: voidData() });
             tx = tx.collectFrom({ inputs: [precedingNode], redeemer: voidData() });
             tx = tx.mintAssets({ assets: burnAssets, redeemer: blacklistRemoveRedeemer(targetStakingHash) });
@@ -666,7 +867,7 @@ export function freezeAndSeizeSubstandard(config) {
             tx = tx.attachScript({ script: buildEvoScript(scripts.blacklistMint.compiledCode) });
             const managerPkh = paymentCredentialHash(feePayerAddress);
             tx = tx.addSigner({ keyHash: KeyHash.fromHex(managerPkh) });
-            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, walletUtxos);
+            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, spendableUtxos);
             return { cbor, txHash, _signBuilder };
         },
         // ====================================================================
@@ -709,11 +910,64 @@ export function freezeAndSeizeSubstandard(config) {
             if (!registryUtxo)
                 throw new Error(`Registry node not found for ${tokenPolicyId}`);
             // 3. Sort reference inputs
-            const allRefInputRefs = [utxoToTxInput(protocolParamsUtxo), utxoToTxInput(registryUtxo)];
+            // `third_party`'s script is supplied EXPLICITLY, as a reference input.
+            //
+            // ⚠ It used to arrive BY ACCIDENT: the bootstrap publishes reference
+            // scripts to the fee payer's own address, so `getUtxos(wallet)` returns
+            // them and `slice(0, 2)` sometimes SPENT one. A spent input's reference
+            // script counts as supplied (CIP-33), so the transaction validated —
+            // and CONSUMED the deployment's reference-script UTxO in the process.
+            // When the draw went the other way the script was absent entirely and
+            // the ledger rejected with 3011 (missing script witness). One root
+            // cause, two opposite symptoms; the earlier 3104 was its third face,
+            // an explicit attach duplicating what the spent input already supplied.
+            const thirdPartyRefUtxos = await client.getUtxosByOutRef([
+                new EvoTransactionInput.TransactionInput({
+                    transactionId: EvoTransactionHash.fromHex(ctx.deployment.thirdPartyRefInput.txHash),
+                    index: BigInt(ctx.deployment.thirdPartyRefInput.outputIndex),
+                }),
+            ]);
+            if (thirdPartyRefUtxos.length === 0) {
+                throw new Error(`third_party reference script not found on-chain at ` +
+                    `${ctx.deployment.thirdPartyRefInput.txHash}#${ctx.deployment.thirdPartyRefInput.outputIndex}. ` +
+                    `Deployment reference scripts are load-bearing: if an earlier transaction SPENT this ` +
+                    `output, the deployment is broken and must be re-published.`);
+            }
+            const thirdPartyRefUtxo = thirdPartyRefUtxos[0];
+            const allRefInputRefs = [
+                utxoToTxInput(protocolParamsUtxo),
+                utxoToTxInput(registryUtxo),
+                utxoToTxInput(thirdPartyRefUtxo),
+            ];
             const sortedRefInputs = sortTxInputs(allRefInputRefs);
             const registryIdx = findRefInputIndex(sortedRefInputs, utxoToTxInput(registryUtxo));
             // 4. Build redeemers
-            const plgRedeemer = thirdPartyActRedeemer(registryIdx, 1);
+            const paramsIdx = findRefInputIndex(sortedRefInputs, utxoToTxInput(protocolParamsUtxo));
+            // 0.5.x third-party route. `ThirdPartyAct` was DELETED by #110: the
+            // administrative path is now the standalone `third_party` validator, and
+            // programmable_logic_base dispatches to it via SpendViaThirdParty — so
+            // this transaction never loads the `transfer` reference script at all.
+            //
+            // The withdrawal set is BOTH scripts: the framework delegate, and the
+            // issuer authority the registry node names in
+            // `third_party_transfer_logic_script`. `third_party` requires the latter
+            // by name — it is the only thing standing between a holder's tokens and
+            // anyone who wants them, and for FES it is a real issuer-admin check
+            // rather than dummy's unconditional one.
+            const thirdPartyKey = {
+                hash: ctx.standardScripts.thirdParty.hash,
+                isScript: true,
+            };
+            const issuerAuthorityKey = { hash: scripts.issuerAdmin.hash, isScript: true };
+            const thirdPartyWdrlIdx = withdrawalIndexOf([thirdPartyKey, issuerAuthorityKey], thirdPartyKey);
+            // outputs_start_idx = 1: `third_party` PAIRS each programmable input with
+            // the NEXT output (same address, datum and reference script, lovelace
+            // ratcheting up) and reads the seized amount as the DELTA. Destination
+            // outputs must therefore sit AMONG THE LEADING ones it skips.
+            // See docs/api-reference.md — getting this backwards fails with an EMPTY
+            // TRACE LIST, because it is a structural expect and not a traced check.
+            const plgRedeemer = thirdPartyRedeemer(paramsIdx, registryIdx, 1);
+            const plbSpendRedeemer = baseSpendRedeemer("THIRD_PARTY", paramsIdx, thirdPartyWdrlIdx);
             const tokenDatum = voidData();
             // 5. Build recipient PLB address
             const recipientPlbAddr = baseAddress(networkId, plbHash, destinationAddress);
@@ -729,17 +983,19 @@ export function freezeAndSeizeSubstandard(config) {
             }
             // 7. Get wallet UTxOs
             const walletUtxos = await client.getUtxos(EvoAddress.fromBech32(feePayerAddress));
+            // NEVER spend a deployment reference-script UTxO — see spendableWalletUtxos.
+            const spendableUtxos = spendableWalletUtxos(walletUtxos, ctx.deployment);
             // 8. Build transaction
             let tx = client.newTx();
-            tx = tx.collectFrom({ inputs: walletUtxos.slice(0, 2) });
-            tx = tx.collectFrom({ inputs: [utxoToSeize], redeemer: voidData() });
+            tx = tx.collectFrom({ inputs: spendableUtxos.slice(0, 2) });
+            tx = tx.collectFrom({ inputs: [utxoToSeize], redeemer: plbSpendRedeemer });
             tx = tx.withdraw({
                 stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(scripts.issuerAdmin.hash, "hex"))),
                 amount: 0n,
                 redeemer: voidData(),
             });
             tx = tx.withdraw({
-                stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(ctx.standardScripts.programmableLogicGlobal.hash, "hex"))),
+                stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(ctx.standardScripts.thirdParty.hash, "hex"))),
                 amount: 0n,
                 redeemer: plgRedeemer,
             });
@@ -753,14 +1009,31 @@ export function freezeAndSeizeSubstandard(config) {
             tx = tx.payToAddress({
                 address: utxoToSeize.address,
                 assets: outputAssets(utxoLovelace(utxoToSeize), remainingTokens.size > 0 ? remainingTokens : undefined),
-                datum: new InlineDatum.InlineDatum({ data: tokenDatum }),
+                // The PAIRED continuation: `third_party` requires it to preserve the
+                // input's ADDRESS, DATUM and REFERENCE SCRIPT exactly. Carry the input's
+                // own datum rather than a fresh void one — they happen to be equal today
+                // because every programmable output here is void-datumed, and that is a
+                // coincidence rather than a guarantee.
+                datum: new InlineDatum.InlineDatum({ data: getInlineDatum(utxoToSeize) ?? tokenDatum }),
             });
-            tx = tx.readFrom({ referenceInputs: [protocolParamsUtxo, registryUtxo] });
+            tx = tx.readFrom({ referenceInputs: [protocolParamsUtxo, registryUtxo, thirdPartyRefUtxo] });
+            if (process.env.DUMP_TX_STRUCTURE) {
+                // eslint-disable-next-line no-console
+                console.error("=== SEIZE attached scripts ===\n" +
+                    `  programmableLogicBase=${ctx.standardScripts.programmableLogicBase.hash}\n` +
+                    `  thirdParty           =${ctx.standardScripts.thirdParty.hash}\n` +
+                    `  issuerAdmin          =${scripts.issuerAdmin.hash}\n` +
+                    "=== END SEIZE SCRIPTS ===");
+            }
             tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.programmableLogicBase.compiledCode) });
-            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.programmableLogicGlobal.compiledCode) });
+            // ⚠ `third_party` is NOT attached here. Its withdrawal already carries the
+            // script witness, and attaching it again makes the duplicate extraneous —
+            // the ledger rejects the whole transaction with code 3104. MEASURED: the
+            // hash it names is third_party's, while the withdrawal for that same
+            // credential is present and correct.
             tx = tx.attachScript({ script: buildEvoScript(scripts.issuerAdmin.compiledCode) });
             tx = tx.addSigner({ keyHash: KeyHash.fromHex(config.deployment.adminPkh) });
-            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, walletUtxos);
+            const { cbor, txHash, _signBuilder } = await buildAndSerialize(tx, feePayerAddress, spendableUtxos);
             return { cbor, txHash, _signBuilder };
         },
     };