@easy1staking/cip113-sdk-ts 0.7.0 → 0.9.0

package/dist/substandards/dummy/index.js

@@ -7,17 +7,63 @@
  *
  * No compliance features, no blacklist.
  * Uses Evolution SDK directly — no adapter abstraction.
+ *
+ * ⛔ alpha.4 SPLIT ISSUANCE (#129), AND IT CHANGED WHAT `register` AND `mint`
+ * MUST CARRY. `issuance_mint` is frozen — its applied hash IS the policy id —
+ * so its redeemer is now `IssuanceRedeemer { params_idx }` and nothing else.
+ * Everything replaceable moved behind `issuance_logic_cred` in the
+ * protocol-params datum, which means EVERY mint and EVERY burn now carries a
+ * SECOND protocol withdrawal: `issuance_logic`'s withdraw-0, whose redeemer is
+ * the per-policy `MintingRegistryProof` map.
+ *
+ * ⚠ Omitting that withdrawal is SILENT. `issuance_mint` calls `covered_by`,
+ * which scans `tx.redeemers` for a `Withdraw(issuance_logic_cred)` purpose;
+ * with the withdrawal absent there is no such redeemer, the scan returns False,
+ * and the mint fails naming neither a withdrawal, nor a policy, nor an index.
+ * That is why `register` and `mint` route every index through `issuancePlan`
+ * and cross-check `plan.withdrawals.length` against their own `withdraw()`
+ * call count: a comment cannot prove a call site exists, a count can.
+ *
+ * `transfer` and `thirdPartyTransfer` neither mint nor burn, so neither needs
+ * `issuance_logic` and both still use `plbWithdrawalPlan`.
  */
 import { CIP171_METADATA_LABEL, buildCip171Metadatum } from "../../core/cip171.js";
-import { Address as EvoAddress, Assets as EvoAssets, Bytes, Data, Transaction, } from "@evolution-sdk/evolution";
+import { Address as EvoAddress, Assets as EvoAssets, Bytes, Data, Transaction, TransactionHash as EvoTransactionHash, TransactionInput as EvoTransactionInput, } from "@evolution-sdk/evolution";
 import { getValidatorCode } from "../../standard/blueprint.js";
 import { findRegistryNode, findCoveringNode, utxoToTxInput, } from "../../core/registry.js";
-import { baseSpendRedeemer, transferRedeemer, thirdPartyRedeemer, referenceInputIndexOf, withdrawalIndexOf, compareTxInputs, } from "../../core/ledger-order.js";
-import { buildEvoScript, computeScriptHash, scriptAddress, baseAddress, stakingCredentialHash, stringToHex, voidData, registryNodeDatum, decodeRegistryNode, registryInsertRedeemer, mintingProofOutputIndex, mintingProofRefInput, mintAssetsFromMap, REGISTRY_NODE_MIN_ADA, getInlineDatum, utxoUnitQty, outputAssets, Credential, KeyHash, InlineDatum, } from "../../core/evo-utils.js";
+import { baseSpendRedeemer, transferRedeemer, thirdPartyRedeemer, referenceInputIndexOf, plbWithdrawalPlan, issuancePlan, programmableLogicGlobalRedeemer, compareTxInputs, } from "../../core/ledger-order.js";
+import { buildEvoScript, computeScriptHash, scriptAddress, baseAddress, stakingCredentialHash, stringToHex, voidData, registryNodeDatum, decodeRegistryNode, registryInsertRedeemer, mintAssetsFromMap, REGISTRY_NODE_MIN_ADA, getInlineDatum, assertProtocolParamsIssuanceLogic, utxoUnitQty, outputAssets, minUtxoAtLeast, Credential, KeyHash, InlineDatum, } from "../../core/evo-utils.js";
 const DUMMY_VALIDATORS = {
     ISSUE: "transfer.issue.withdraw",
     TRANSFER: "transfer.transfer.withdraw",
 };
+/**
+ * The flat amount this plugin used to hardcode, kept as a FLOOR rather than an
+ * answer — see `minUtxoAtLeast`. All five token outputs share one shape (a
+ * programmable-logic-base address, one token, a `voidData()` datum), so the
+ * DATUM is fixed and they look like a constant is safe. It is not: min-UTxO
+ * scales with SERIALISED OUTPUT SIZE, and two of the three things that scale it
+ * come from the caller — the ASSET NAME (raw hex at every boundary here, 32
+ * bytes when CIP-67-labelled) and the QUANTITY (a CBOR integer that widens with
+ * magnitude).
+ *
+ * MEASURED against preview's live `coinsPerUtxoByte` of 4310 (2026-09-07):
+ *
+ *   live "DUM"+suffix (6B), qty 1000     1,202,490   OK, 97,510 headroom
+ *   live name (6B), qty 2^63-1           1,228,350   OK, 71,650 headroom
+ *   CIP-67 labelled 12B, qty 1000        1,215,420   OK, 84,580 headroom
+ *   max CIP-67 name (32B), qty 1000      1,318,860   SHORT by 18,860
+ *   max name (32B), qty 2^63-1           1,344,720   SHORT by 44,720
+ *
+ * ⚠ IDENTICAL figures to `freeze-and-seize`, and that is the point: same output
+ * shape means this was ONE defect appearing in two places, not two defects. It
+ * was found in FES first and only then looked for here — the second sighting is
+ * what made it a pattern rather than a one-off.
+ *
+ * The floor keeps the change MONOTONE: ordinary names emit exactly what they
+ * always did, and only the cases that were genuinely short move.
+ */
+const TOKEN_OUTPUT_FLOOR = 1300000n;
 export function dummySubstandard(config) {
     let ctx;
     let issueScript;
@@ -87,14 +133,16 @@ export function dummySubstandard(config) {
      */
     async function findParamsUtxo() {
         const unit = ctx.deployment.protocolParams.policyId + stringToHex("ProtocolParams");
-        const addr = EvoAddress.fromBech32(scriptAddress(networkId, ctx.deployment.coordination.scriptHash));
+        const addr = EvoAddress.fromBech32(scriptAddress(networkId, ctx.deployment.protocolParams.policyId));
         const utxos = await ctx.client.getUtxosWithUnit(addr, unit);
         if (utxos.length === 0) {
             throw new Error(`Protocol params UTxO not found (unit ${unit}) at the coordination address. ` +
                 `The params NFT is one-shot: zero results means it is locked elsewhere, not that ` +
                 `the protocol is un-deployed.`);
         }
-        return utxos[0];
+        const utxo = utxos[0];
+        assertProtocolParamsIssuanceLogic(utxo, ctx.deployment.issuanceLogic.scriptHash);
+        return utxo;
     }
     /**
      * The IssuanceCborHex UTxO.
@@ -115,6 +163,29 @@ export function dummySubstandard(config) {
         }
         return utxos[0];
     }
+    /**
+     * The `issuance_logic` reference-script UTxO.
+     *
+     * ⛔ Its withdraw-0 rides on EVERY mint and burn, which makes this the single
+     * most load-bearing reference-script output in the deployment. If an earlier
+     * transaction spent it, the deployment is broken and the script must be
+     * re-published; attaching the body here would hide that infrastructure loss.
+     */
+    async function findIssuanceLogicRefUtxo() {
+        const { txHash, outputIndex } = ctx.deployment.issuanceLogicRefInput;
+        const utxos = await ctx.client.getUtxosByOutRef([
+            new EvoTransactionInput.TransactionInput({
+                transactionId: EvoTransactionHash.fromHex(txHash),
+                index: BigInt(outputIndex),
+            }),
+        ]);
+        if (utxos.length === 0) {
+            throw new Error(`issuance_logic reference script not found on-chain at ${txHash}#${outputIndex}. ` +
+                `Deployment reference scripts are load-bearing: if an earlier transaction SPENT this ` +
+                `output, the deployment is broken and must be re-published.`);
+        }
+        return utxos[0];
+    }
     /** Build the transaction and shape it into an UnsignedTx. */
     async function finish(tx, changeAddress, extra = {}) {
         // ⛔ NEVER LET COIN SELECTION REACH A REFERENCE-SCRIPT UTxO.
@@ -170,22 +241,33 @@ export function dummySubstandard(config) {
          * node (the one whose key < ours and whose next > ours), spending it to
          * repoint its `next` at us, and minting a new node NFT for our own entry.
          *
-         * Mint and registration are one transaction because `issuance_mint`'s
-         * MintingRegistryProof can name the registry node as an OUTPUT of this very
-         * transaction (ctor 1, OutputIndex) rather than as a reference input — so
-         * the token can be minted before its node exists anywhere else.
+         * Mint and registration are one transaction because the registry proof can
+         * name the new node as an OUTPUT of this very transaction (OutputIndex), so
+         * the token can be minted before its node exists anywhere else. In alpha.4
+         * that proof rides inside `issuance_logic`'s withdraw-0 map, keyed by policy
+         * id; `issuance_mint`'s own redeemer is only `IssuanceRedeemer { params_idx }`.
+         * Register IS a first mint, so it needs that withdrawal, the params reference
+         * input and its map entry exactly as `mint` does.
          */
         async register(params) {
             const { feePayerAddress, assetName, quantity } = params;
             const recipient = params.recipientAddress ?? feePayerAddress;
             const client = ctx.client;
+            // min-UTxO is sized from live protocol parameters, not guessed — the asset
+            // name and the quantity are both caller-supplied and both widen the output.
+            const coinsPerUtxoByte = (await client.getProtocolParameters()).coinsPerUtxoByte;
             // The token policy IS issuance_mint parameterised by our minting logic.
             const issuanceMint = ctx.standardScripts.buildIssuanceMint(issueScript.hash);
             const tokenPolicyId = issuanceMint.hash;
             const unit = tokenPolicyId + assetName;
-            const registryMintPolicyId = ctx.standardScripts.registryMint.hash;
-            const registrySpendAddr = scriptAddress(networkId, ctx.standardScripts.registrySpend.hash);
-            const registryUtxos = await client.getUtxos(EvoAddress.fromBech32(registrySpendAddr));
+            const registryPolicyId = ctx.standardScripts.registry.hash;
+            // ⚑ ONE HASH, TWO ROLES. registry_mint and registry_spend merged (#117), so
+            // the node NFT policy id and the node address's payment credential are the
+            // same value — the minting policy naming itself. The old names
+            // (registrySpendAddr / registryMintPolicyId) asserted a distinction that no
+            // longer exists and would tell a reader to look for two hashes.
+            const registryAddr = scriptAddress(networkId, ctx.standardScripts.registry.hash);
+            const registryUtxos = await client.getUtxos(EvoAddress.fromBech32(registryAddr));
             const covering = findCoveringNode(registryUtxos, tokenPolicyId);
             if (!covering) {
                 throw new Error(`No covering registry node found for policy ${tokenPolicyId}. The registry origin ` +
@@ -220,14 +302,34 @@ export function dummySubstandard(config) {
                 globalStateCs: "",
             });
             const updatedCoveringDatum = registryNodeDatum({ ...coveringNode, next: tokenPolicyId });
-            const registryNftUnit = registryMintPolicyId + tokenPolicyId;
-            const coveringNftUnit = registryMintPolicyId + coveringNode.key;
-            // Output order is the contract: the MintingRegistryProof below names our
-            // registry node by OUTPUT INDEX, so moving these outputs silently changes
-            // which output the validator inspects.
-            const OUT_TOKEN = 0;
-            const OUT_NEW_NODE = 1;
-            const OUT_COVERING = 2;
+            const registryNftUnit = registryPolicyId + tokenPolicyId;
+            const coveringNftUnit = registryPolicyId + coveringNode.key;
+            const paramsUtxo = await findParamsUtxo();
+            const issuanceCborUtxo = await findIssuanceCborUtxo();
+            const issuanceLogicRefUtxo = await findIssuanceLogicRefUtxo();
+            // ⛔ ONE ARRAY, TWO USES, DECLARED ONCE. `params_idx` and every other
+            // reference-input index the plan computes are positions in THIS set, and
+            // `readFrom` below is what actually puts that set in the transaction. Two
+            // separately-built lists are two chances to disagree, and a disagreement
+            // here is a valid integer pointing at the wrong UTxO.
+            const refUtxos = [paramsUtxo, issuanceCborUtxo, issuanceLogicRefUtxo];
+            // Output order is the contract: `issuance_logic`'s map names our registry
+            // node by OUTPUT INDEX, so moving these outputs silently changes which
+            // output the validator inspects. Balancing change is appended after the
+            // explicit outputs — established by the literals this replaces having
+            // validated on chain, not by reasoning about Evolution.
+            const outputTags = ["user-token", "new-node", "covering-node"];
+            // ⛔ EVERY INDEX IN THIS TRANSACTION, COMPUTED IN ONE PLACE OVER THE
+            // COMPLETE SETS. No `plgHash`: register spends the covering registry node
+            // and wallet funds, never a `programmable_logic_base` input.
+            const plan = issuancePlan({
+                issuanceLogicHash: ctx.deployment.issuanceLogic.scriptHash,
+                otherWithdrawals: [{ hash: issueScript.hash, isScript: true }],
+                referenceInputs: refUtxos.map(utxoToTxInput),
+                paramsRefInput: utxoToTxInput(paramsUtxo),
+                outputs: outputTags,
+                issued: [{ policyId: tokenPolicyId, proof: { kind: "output", tag: "new-node" } }],
+            });
             let tx = client.newTx();
             // CIP-171 provenance, carried by the transaction that parameterises the
             // scripts it describes. Optional: absent, this behaves exactly as before.
@@ -238,24 +340,43 @@ export function dummySubstandard(config) {
                 });
             }
             tx = tx.collectFrom({ inputs: [covering], redeemer: voidData() });
-            // The minting-logic withdraw-0: dummy's `issue` validator, redeemer 100.
-            tx = tx.withdraw({
-                stakeCredential: Credential.makeScriptHash(hexToBytes(issueScript.hash)),
-                amount: 0n,
-                redeemer: Data.int(100n),
-            });
+            // The minting-logic and protocol issuance-logic withdrawals. The latter's
+            // script witness comes from `issuanceLogicRefUtxo` in `readFrom` below.
+            const withdrawalSpecs = [
+                { hash: issueScript.hash, redeemer: Data.int(100n) },
+                {
+                    hash: ctx.deployment.issuanceLogic.scriptHash,
+                    redeemer: plan.issuanceLogicRedeemer,
+                },
+            ];
+            if (withdrawalSpecs.length !== plan.withdrawals.length) {
+                throw new Error(`register: issuance plan declares ${plan.withdrawals.length} withdrawals but ` +
+                    `${withdrawalSpecs.length} are emitted`);
+            }
+            for (const withdrawal of withdrawalSpecs) {
+                tx = tx.withdraw({
+                    stakeCredential: Credential.makeScriptHash(hexToBytes(withdrawal.hash)),
+                    amount: 0n,
+                    redeemer: withdrawal.redeemer,
+                });
+            }
             tx = tx.mintAssets({
                 assets: mintAssetsFromMap(new Map([[unit, quantity]])),
-                redeemer: mintingProofOutputIndex(OUT_NEW_NODE),
+                redeemer: plan.issuanceRedeemer,
             });
             tx = tx.mintAssets({
                 assets: mintAssetsFromMap(new Map([[registryNftUnit, 1n]])),
                 redeemer: registryInsertRedeemer(tokenPolicyId, { type: "script", hash: issueScript.hash }),
             });
+            // outputTags[0] — "user-token": the minted supply at the recipient's PLB.
             tx = tx.payToAddress({
                 address: EvoAddress.fromBech32(recipientPlbAddr),
-                assets: outputAssets(1300000n, new Map([[unit, quantity]])),
-                datum: new InlineDatum.InlineDatum({ data: voidData() }),
+                assets: outputAssets(minUtxoAtLeast(TOKEN_OUTPUT_FLOOR, {
+                    address: recipientPlbAddr,
+                    assets: outputAssets(0n, new Map([[unit, quantity]])),
+                    datum: voidData(),
+                    coinsPerUtxoByte,
+                }), new Map([[unit, quantity]])), datum: new InlineDatum.InlineDatum({ data: voidData() }),
             });
             // ⚠ min-UTxO, not a round number pulled from the old code.
             //
@@ -267,24 +388,62 @@ export function dummySubstandard(config) {
             // Deliberately generous rather than exact: min-UTxO scales with
             // serialised size and with a protocol parameter that can rise.
             const REGISTRY_NODE_ADA = REGISTRY_NODE_MIN_ADA;
+            // outputTags[1] — "new-node": our registry node, named by the proof.
             tx = tx.payToAddress({
-                address: EvoAddress.fromBech32(registrySpendAddr),
+                address: EvoAddress.fromBech32(registryAddr),
                 assets: outputAssets(REGISTRY_NODE_ADA, new Map([[registryNftUnit, 1n]])),
                 datum: new InlineDatum.InlineDatum({ data: newNodeDatum }),
             });
+            // outputTags[2] — "covering-node": the predecessor with its new link.
             tx = tx.payToAddress({
-                address: EvoAddress.fromBech32(registrySpendAddr),
+                address: EvoAddress.fromBech32(registryAddr),
                 assets: outputAssets(REGISTRY_NODE_ADA, new Map([[coveringNftUnit, 1n]])),
                 datum: new InlineDatum.InlineDatum({ data: updatedCoveringDatum }),
             });
-            const paramsUtxo = await findParamsUtxo();
-            const issuanceCborUtxo = await findIssuanceCborUtxo();
-            tx = tx.readFrom({ referenceInputs: [paramsUtxo, issuanceCborUtxo] });
+            // ⛔ THE PROTOCOL-PARAMS REFERENCE INPUT STAYS — and as of S-11 that is a
+            // MEASURED decision, not a cautious one.
+            //
+            // alpha.3's registry no longer reads it (#117). `issuance_mint` does, to
+            // pull the LIVE delegate credentials from its datum, and that locate is
+            // DELIBERATELY NON-FAILING: absent params UTxO means "no delegation",
+            // falling back to local `no_escape` custody. So removing it raises no
+            // error — it silently selects a different custody path.
+            //
+            // MEASURED ON DEVNET (S-11): removing it from BOTH substandards' register
+            // paths, the full lifecycle still passes — dummy 2/2, FES 3/3. The two
+            // custody branches do converge here, as the reasoning predicted.
+            //
+            // ⇒ AND IT STAYS ANYWAY, for a reason the measurement itself supplies:
+            // the tests pass EITHER WAY. That is precisely what makes dropping it
+            // unsafe to keep. Nothing in this suite would notice if `issuance_mint`'s
+            // delegation semantics changed and the absent input started to matter —
+            // the guard against that is the input being there, not a test. The saving
+            // is one reference input on a once-per-token transaction; the exposure is
+            // a silent custody change nobody would see.
+            // alpha.4 makes it mandatory rather than an optional custody hint because
+            // `with_protocol_params_fields` opens with `list.expect_at`.
+            tx = tx.readFrom({ referenceInputs: refUtxos });
             tx = tx.attachScript({ script: buildEvoScript(issuanceMint.compiledCode) });
-            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.registryMint.compiledCode) });
-            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.registrySpend.compiledCode) });
+            // ⚑ ONE attach, not two. registry_mint and registry_spend merged into a
+            // single validator (#117): this transaction both MINTS a node NFT and
+            // SPENDS the covering node, which in alpha.2 needed two scripts. It is
+            // now one script serving both purposes — attaching it twice would put a
+            // duplicate witness in the transaction.
+            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.registry.compiledCode) });
             tx = tx.attachScript({ script: buildEvoScript(issueScript.compiledCode) });
-            return finish(tx, feePayerAddress, { tokenPolicyId, unit, outputIndices: { OUT_TOKEN, OUT_NEW_NODE, OUT_COVERING } });
+            // Register's withdrawal set is asserted on the decoded transaction at
+            // test/devnet/dummy-lifecycle.test.ts:142-155. It stays there as readable
+            // documentation of the invariant rather than as a guard, because the live
+            // evaluator is upstream of it.
+            return finish(tx, feePayerAddress, {
+                tokenPolicyId,
+                unit,
+                outputIndices: {
+                    OUT_TOKEN: plan.outputIndexOf("user-token"),
+                    OUT_NEW_NODE: plan.outputIndexOf("new-node"),
+                    OUT_COVERING: plan.outputIndexOf("covering-node"),
+                },
+            });
         },
         /**
          * Mint more of an already-registered dummy token.
@@ -297,40 +456,77 @@ export function dummySubstandard(config) {
             const { feePayerAddress, tokenPolicyId, assetName, quantity } = params;
             const recipient = params.recipientAddress ?? feePayerAddress;
             const client = ctx.client;
+            // min-UTxO is sized from live protocol parameters, not guessed — the asset
+            // name and the quantity are both caller-supplied and both widen the output.
+            const coinsPerUtxoByte = (await client.getProtocolParameters()).coinsPerUtxoByte;
             const unit = tokenPolicyId + assetName;
             const issuanceMint = ctx.standardScripts.buildIssuanceMint(issueScript.hash);
             if (issuanceMint.hash !== tokenPolicyId) {
                 throw new Error(`Policy ${tokenPolicyId} is not a dummy token: issuance_mint parameterised by ` +
                     `dummy's issue logic hashes to ${issuanceMint.hash}.`);
             }
-            const registrySpendAddr = scriptAddress(networkId, ctx.standardScripts.registrySpend.hash);
-            const registryUtxos = await client.getUtxos(EvoAddress.fromBech32(registrySpendAddr));
+            const registryAddr = scriptAddress(networkId, ctx.standardScripts.registry.hash);
+            const registryUtxos = await client.getUtxos(EvoAddress.fromBech32(registryAddr));
             const node = findRegistryNode(registryUtxos, tokenPolicyId);
             if (!node)
                 throw new Error(`Registry node not found for policy ${tokenPolicyId}`);
             const paramsUtxo = await findParamsUtxo();
-            const refs = [paramsUtxo, node];
-            const nodeIdx = referenceInputIndexOf(refs.map(utxoToTxInput), utxoToTxInput(node));
+            const issuanceLogicRefUtxo = await findIssuanceLogicRefUtxo();
+            // ⛔ ONE ARRAY, TWO USES, DECLARED ONCE. The plan computes `params_idx`
+            // and the registry-node proof over this set; `readFrom` supplies this same
+            // set. A second list could disagree while remaining perfectly well typed.
+            const refUtxos = [paramsUtxo, node, issuanceLogicRefUtxo];
+            const plan = issuancePlan({
+                issuanceLogicHash: ctx.deployment.issuanceLogic.scriptHash,
+                otherWithdrawals: [{ hash: issueScript.hash, isScript: true }],
+                referenceInputs: refUtxos.map(utxoToTxInput),
+                paramsRefInput: utxoToTxInput(paramsUtxo),
+                issued: [
+                    {
+                        policyId: tokenPolicyId,
+                        proof: { kind: "reference-input", input: utxoToTxInput(node) },
+                    },
+                ],
+            });
             const plbHash = ctx.standardScripts.programmableLogicBase.hash;
             const recipientPlbAddr = baseAddress(networkId, plbHash, recipient);
             let tx = client.newTx();
-            tx = tx.withdraw({
-                stakeCredential: Credential.makeScriptHash(hexToBytes(issueScript.hash)),
-                amount: 0n,
-                redeemer: Data.int(100n),
-            });
+            const withdrawalSpecs = [
+                { hash: issueScript.hash, redeemer: Data.int(100n) },
+                {
+                    hash: ctx.deployment.issuanceLogic.scriptHash,
+                    redeemer: plan.issuanceLogicRedeemer,
+                },
+            ];
+            if (withdrawalSpecs.length !== plan.withdrawals.length) {
+                throw new Error(`mint: issuance plan declares ${plan.withdrawals.length} withdrawals but ` +
+                    `${withdrawalSpecs.length} are emitted`);
+            }
+            for (const withdrawal of withdrawalSpecs) {
+                tx = tx.withdraw({
+                    stakeCredential: Credential.makeScriptHash(hexToBytes(withdrawal.hash)),
+                    amount: 0n,
+                    redeemer: withdrawal.redeemer,
+                });
+            }
             tx = tx.mintAssets({
                 assets: mintAssetsFromMap(new Map([[unit, quantity]])),
-                redeemer: mintingProofRefInput(nodeIdx),
+                redeemer: plan.issuanceRedeemer,
             });
             tx = tx.payToAddress({
                 address: EvoAddress.fromBech32(recipientPlbAddr),
-                assets: outputAssets(1300000n, new Map([[unit, quantity]])),
-                datum: new InlineDatum.InlineDatum({ data: voidData() }),
+                assets: outputAssets(minUtxoAtLeast(TOKEN_OUTPUT_FLOOR, {
+                    address: recipientPlbAddr,
+                    assets: outputAssets(0n, new Map([[unit, quantity]])),
+                    datum: voidData(),
+                    coinsPerUtxoByte,
+                }), new Map([[unit, quantity]])), datum: new InlineDatum.InlineDatum({ data: voidData() }),
             });
-            tx = tx.readFrom({ referenceInputs: refs });
+            tx = tx.readFrom({ referenceInputs: refUtxos });
             tx = tx.attachScript({ script: buildEvoScript(issuanceMint.compiledCode) });
             tx = tx.attachScript({ script: buildEvoScript(issueScript.compiledCode) });
+            // The executable count check above prevents the plan and emitted
+            // transaction silently diverging before evaluation.
             return finish(tx, feePayerAddress, { tokenPolicyId, unit });
         },
         async burn(_params) {
@@ -364,6 +560,9 @@ export function dummySubstandard(config) {
             const { holderAddress, recipientAddress, tokenPolicyId, assetName, quantity, feePayerAddress } = params;
             const unit = tokenPolicyId + assetName;
             const client = ctx.client;
+            // min-UTxO is sized from live protocol parameters, not guessed — the asset
+            // name and the quantity are both caller-supplied and both widen the output.
+            const coinsPerUtxoByte = (await client.getProtocolParameters()).coinsPerUtxoByte;
             const plbHash = ctx.standardScripts.programmableLogicBase.hash;
             const holderPlbAddr = baseAddress(networkId, plbHash, holderAddress);
             const recipientPlbAddr = baseAddress(networkId, plbHash, recipientAddress);
@@ -374,8 +573,8 @@ export function dummySubstandard(config) {
             }
             const { selected, totalTokenAmount } = selectUtxosForAmount(tokenUtxos, unit, quantity);
             const returningAmount = totalTokenAmount - quantity;
-            const registrySpendAddr = scriptAddress(networkId, ctx.standardScripts.registrySpend.hash);
-            const registryUtxos = await client.getUtxos(EvoAddress.fromBech32(registrySpendAddr));
+            const registryAddr = scriptAddress(networkId, ctx.standardScripts.registry.hash);
+            const registryUtxos = await client.getUtxos(EvoAddress.fromBech32(registryAddr));
             const registryUtxo = findRegistryNode(registryUtxos, tokenPolicyId);
             if (!registryUtxo)
                 throw new Error(`Registry node not found for policy ${tokenPolicyId}`);
@@ -392,8 +591,12 @@ export function dummySubstandard(config) {
                 isScript: true,
             };
             const issuerAuthorityKey = { hash: transferScript.hash, isScript: true };
-            const allWithdrawals = [thirdPartyKey, issuerAuthorityKey];
-            const thirdPartyWdrlIdx = withdrawalIndexOf(allWithdrawals, thirdPartyKey);
+            // alpha.3: the DISPATCHER withdraws too, and PLB's wdrl_idx points at IT.
+            const plan = plbWithdrawalPlan({
+                plgHash: ctx.standardScripts.programmableLogicGlobal.hash,
+                others: [thirdPartyKey, issuerAuthorityKey],
+            });
+            const allWithdrawals = plan.all;
             // ---- Output layout is the contract, and it is NOT the transfer layout --
             //
             // `third_party` PAIRS each programmable input with an output, in ledger
@@ -413,14 +616,20 @@ export function dummySubstandard(config) {
             // Getting this backwards — destination last, continuations first — encodes
             // and submits happily and fails at evaluation with an empty trace list.
             const OUTPUTS_START_IDX = 1;
-            const spendRdmr = baseSpendRedeemer("THIRD_PARTY", paramsIdx, thirdPartyWdrlIdx);
+            // wdrl_idx targets the dispatcher; the ACT moves to the dispatcher's own
+            // redeemer. In alpha.2 both lived on this one redeemer.
+            const spendRdmr = baseSpendRedeemer(paramsIdx, plan.plgIdx);
             let tx = client.newTx();
             tx = tx.collectFrom({ inputs: selected, redeemer: spendRdmr });
             // Destination first.
             tx = tx.payToAddress({
                 address: EvoAddress.fromBech32(recipientPlbAddr),
-                assets: outputAssets(1300000n, new Map([[unit, quantity]])),
-                datum: new InlineDatum.InlineDatum({ data: voidData() }),
+                assets: outputAssets(minUtxoAtLeast(TOKEN_OUTPUT_FLOOR, {
+                    address: recipientPlbAddr,
+                    assets: outputAssets(0n, new Map([[unit, quantity]])),
+                    datum: voidData(),
+                    coinsPerUtxoByte,
+                }), new Map([[unit, quantity]])), datum: new InlineDatum.InlineDatum({ data: voidData() }),
             });
             // Then one continuation per input, in LEDGER ORDER — the validator walks
             // inputs and outputs in lockstep, and the ledger sorts inputs by
@@ -448,10 +657,18 @@ export function dummySubstandard(config) {
             if (stillToSeize > 0n) {
                 throw new Error(`Selected UTxOs hold ${quantity - stillToSeize} of ${quantity} ${unit} — selection is short`);
             }
+            // The dispatcher's own withdraw-0 — new in alpha.3, and required on every
+            // programmable transaction. Its redeemer carries the act that used to be
+            // BaseSpendRedeemer's constructor.
+            tx = tx.withdraw({
+                stakeCredential: Credential.makeScriptHash(hexToBytes(ctx.standardScripts.programmableLogicGlobal.hash)),
+                amount: 0n,
+                redeemer: programmableLogicGlobalRedeemer("THIRD_PARTY"),
+            });
             tx = tx.withdraw({
                 stakeCredential: Credential.makeScriptHash(hexToBytes(ctx.standardScripts.thirdParty.hash)),
                 amount: 0n,
-                redeemer: thirdPartyRedeemer(paramsIdx, registryIdx, OUTPUTS_START_IDX),
+                redeemer: thirdPartyRedeemer(registryIdx, OUTPUTS_START_IDX),
             });
             tx = tx.withdraw({
                 stakeCredential: Credential.makeScriptHash(hexToBytes(transferScript.hash)),
@@ -460,6 +677,12 @@ export function dummySubstandard(config) {
             });
             tx = tx.readFrom({ referenceInputs: refUtxos });
             tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.thirdParty.compiledCode) });
+            // ⛔ THE DISPATCHER'S OWN SCRIPT WITNESS. A withdraw-0 needs the script in
+            // full, not just a redeemer — alpha.3 added the dispatcher's withdrawal to
+            // every programmable transaction, and S-6 wired the withdrawal and the
+            // redeemer but not this. The ledger says "An associated script witness is
+            // missing" on purpose=withdraw, which names the shape but not the script.
+            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.programmableLogicGlobal.compiledCode) });
             tx = tx.attachScript({ script: buildEvoScript(transferScript.compiledCode) });
             tx = tx.attachScript({
                 script: buildEvoScript(ctx.standardScripts.programmableLogicBase.compiledCode),
@@ -472,6 +695,9 @@ export function dummySubstandard(config) {
             const { senderAddress, recipientAddress, tokenPolicyId, assetName, quantity } = params;
             const unit = tokenPolicyId + assetName;
             const client = ctx.client;
+            // min-UTxO is sized from live protocol parameters, not guessed — the asset
+            // name and the quantity are both caller-supplied and both widen the output.
+            const coinsPerUtxoByte = (await client.getProtocolParameters()).coinsPerUtxoByte;
             const plbHash = ctx.standardScripts.programmableLogicBase.hash;
             // 1. Build PLB addresses
             const senderPlbAddr = baseAddress(networkId, plbHash, senderAddress);
@@ -486,8 +712,8 @@ export function dummySubstandard(config) {
             const { selected, totalTokenAmount } = selectUtxosForAmount(tokenUtxos, unit, quantity);
             const returningAmount = totalTokenAmount - quantity;
             // 4. Find registry node reference input
-            const registrySpendAddr = scriptAddress(networkId, ctx.standardScripts.registrySpend.hash);
-            const registryUtxos = await client.getUtxos(EvoAddress.fromBech32(registrySpendAddr));
+            const registryAddr = scriptAddress(networkId, ctx.standardScripts.registry.hash);
+            const registryUtxos = await client.getUtxos(EvoAddress.fromBech32(registryAddr));
             const registryUtxo = findRegistryNode(registryUtxos, tokenPolicyId);
             if (!registryUtxo) {
                 throw new Error(`Registry node not found for policy ${tokenPolicyId}`);
@@ -510,18 +736,21 @@ export function dummySubstandard(config) {
                 hash: ctx.standardScripts.transfer.hash,
                 isScript: true,
             };
-            const allWithdrawals = [
-                { hash: transferScript.hash, isScript: true },
-                coreTransferKey,
-            ];
-            const transferWdrlIdx = withdrawalIndexOf(allWithdrawals, coreTransferKey);
-            const coreTransferRedeemer = transferRedeemer(paramsIdx, [
+            // alpha.3: the DISPATCHER withdraws too, and PLB's wdrl_idx points at IT.
+            const plan = plbWithdrawalPlan({
+                plgHash: ctx.standardScripts.programmableLogicGlobal.hash,
+                others: [{ hash: transferScript.hash, isScript: true }, coreTransferKey],
+            });
+            const allWithdrawals = plan.all;
+            // params_idx is gone from the delegate redeemer — delegates no longer
+            // read the params datum at all.
+            const coreTransferRedeemer = transferRedeemer([
                 { type: "exists", nodeIdx: registryIdx },
             ]);
             const dummyTransferRedeemer = Data.int(200n);
-            // programmable_logic_base no longer takes an untyped redeemer: it dispatches
-            // on the constructor, and witnesses WHERE its delegate's withdrawal sits.
-            const spendRdmr = baseSpendRedeemer("TRANSFER", paramsIdx, transferWdrlIdx);
+            // programmable_logic_base witnesses where the DISPATCHER's withdrawal
+            // sits; the dispatch choice itself is the dispatcher's own redeemer.
+            const spendRdmr = baseSpendRedeemer(paramsIdx, plan.plgIdx);
             const tokenDatum = voidData();
             // 8. Get sender's staking credential
             const senderStakingHash = stakingCredentialHash(senderAddress);
@@ -536,6 +765,12 @@ export function dummySubstandard(config) {
                 amount: 0n,
                 redeemer: dummyTransferRedeemer,
             });
+            // The dispatcher's own withdraw-0 — new in alpha.3.
+            tx = tx.withdraw({
+                stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(ctx.standardScripts.programmableLogicGlobal.hash, "hex"))),
+                amount: 0n,
+                redeemer: programmableLogicGlobalRedeemer("TRANSFER"),
+            });
             tx = tx.withdraw({
                 stakeCredential: Credential.makeScriptHash(new Uint8Array(Buffer.from(ctx.standardScripts.transfer.hash, "hex"))),
                 amount: 0n,
@@ -544,17 +779,31 @@ export function dummySubstandard(config) {
             if (returningAmount > 0n) {
                 tx = tx.payToAddress({
                     address: EvoAddress.fromBech32(senderPlbAddr),
-                    assets: outputAssets(1300000n, new Map([[unit, returningAmount]])),
-                    datum: new InlineDatum.InlineDatum({ data: tokenDatum }),
+                    assets: outputAssets(minUtxoAtLeast(TOKEN_OUTPUT_FLOOR, {
+                        address: senderPlbAddr,
+                        assets: outputAssets(0n, new Map([[unit, returningAmount]])),
+                        datum: voidData(),
+                        coinsPerUtxoByte,
+                    }), new Map([[unit, returningAmount]])), datum: new InlineDatum.InlineDatum({ data: tokenDatum }),
                 });
             }
             tx = tx.payToAddress({
                 address: EvoAddress.fromBech32(recipientPlbAddr),
-                assets: outputAssets(1300000n, new Map([[unit, quantity]])),
-                datum: new InlineDatum.InlineDatum({ data: tokenDatum }),
+                assets: outputAssets(minUtxoAtLeast(TOKEN_OUTPUT_FLOOR, {
+                    address: recipientPlbAddr,
+                    assets: outputAssets(0n, new Map([[unit, quantity]])),
+                    datum: voidData(),
+                    coinsPerUtxoByte,
+                }), new Map([[unit, quantity]])), datum: new InlineDatum.InlineDatum({ data: tokenDatum }),
             });
             tx = tx.readFrom({ referenceInputs: [protocolParamsUtxo, registryUtxo] });
             tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.transfer.compiledCode) });
+            // ⛔ THE DISPATCHER'S OWN SCRIPT WITNESS. A withdraw-0 needs the script in
+            // full, not just a redeemer — alpha.3 added the dispatcher's withdrawal to
+            // every programmable transaction, and S-6 wired the withdrawal and the
+            // redeemer but not this. The ledger says "An associated script witness is
+            // missing" on purpose=withdraw, which names the shape but not the script.
+            tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.programmableLogicGlobal.compiledCode) });
             tx = tx.attachScript({ script: buildEvoScript(transferScript.compiledCode) });
             tx = tx.attachScript({ script: buildEvoScript(ctx.standardScripts.programmableLogicBase.compiledCode) });
             tx = tx.addSigner({ keyHash: KeyHash.fromHex(senderStakingHash) });