[colll78]

Summary

Construct Dijkstra Receiving witnesses using Map Word32 (AnyScriptWitness era), keyed by each protected output's original body-local position.

outputs: ordinary[0], Plutus A[1], key[2], native[3], Plutus A[4]
Receiving redeemers: 1 → its own redeemer/budget, 4 → its own redeemer/budget

Same-hash and identical Plutus outputs retain separate contexts and budgets. Native scripts and authorization remain shared by hash, without Plutus redeemers. Protected key signatures remain deduplicated.

Balancing and offline fee estimation preserve authored output positions and append change. Balancing evaluates final outputs, including protected change, preserves each output's budget and isolates parent/child reports. Fees include recipient/native signatures and unsigned child witness sizes. Construction rejects protected collateral returns and changes that invalidate signed children. Protected addresses retain their identity through API, RPC and WASM conversions.

RPC preserves separate Receiving indices, payloads, budgets and traces. Its current wire enum lacks Guarding and Receiving constructors, so both use UNSPECIFIED; the API purposes remain typed.

Dependencies are the coordinated ledger #1, Plutus #1, consensus 5.x #3, addresses #2, keys #2 and config #2 proposals. The normal project pins the published ledger 4b06e253 and release consensus 8268ddc7. API 70415a82 is signed and published; current-head fork CI passes at metadata child e645b7a4, as recorded below. The public consensus successor changes only disk fixtures; API production inputs and its recorded normal-graph proof remain valid.

The ledger-state JSON adapter also follows the upstream six-field NewEpochState: its existing six outer keys remain unchanged, and stakeDistrib reads the current set-snapshot pool distribution. Nested ledger-state JSON/CBOR follows the upstream schema.

Evidence

GitHub Actions runs in this fork. Earlier upstream CI links are historical evidence.

Fork head e645b7a4 is a changelog-metadata-only child of implementation/dependency pin 70415a82: the existing Herald pr fields now identify this fork PR. The immutable parent dependency pins remain unchanged. All 13 applicable fork Actions workflows pass at e645b7a4, including native CI attempt 2, WASM CI and changelog validation.

All local compilation/runtime evidence below uses GHC 9.6.7 with the coordinated native integration graph (blockio +serialblockio, crypto -external-libsodium-vrf). Normal default-flag source resolution, Nix evaluation and remote CI are separate evidence.

The preceding per-output implementation passed all 293 API units, 125 goldens and 171 RPC tests, with genuine repeated-output validators, budgets, reference fees and signatures. Its remote platform/build/binding checks passed, including WASM browser/Node/Elm regressions and generic binding quickstarts. A single synthetic extraction scaling run measured 29.146/61.544/129.120 µs at 101/201/401 Plutus outputs; it supplies no paired-baseline, allocation or script-resolution claim. These results retain their pre-upstream-state-migration scope.

• The fresh merged-ledger API library compiles all 147 modules strictly. All 14 affected API regressions and all 125 goldens pass.
• A private check through public DebugLedgerState serialization passes against the fresh library: exactly six keys, epoch 7, an independently authored nonempty current SET pool/stake distribution, exclusion of a different MARK snapshot, and encode/toJSON equality. Actual library, harness and binary hashes were verified.
• The source list includes eras/shelley/test-suite, selecting the migrated local package instead of the stale published test library. Fresh strict API/CLI/node-testnet and release-consensus builds pass; the original source-selection failure is retained. The recorded twelve-target build also included a tracer-test script now deferred outside the final CIP candidate, so the entire build is not presented as an exact final-candidate proof.
• At the exact signed source, all three normal native dry-runs (default/all, tests-enabled/all, and test/all) pass with 679 components and all 13 owning components under default native flags. Six public dependency sources, 24 archives and 2,450 members were verified. Genuine isolated Linux GHC 9.12.4 API-library derivation evaluation passes with 682/13 components and the exact adapter source. This is resolution/evaluation evidence, not a completed default Nix build or runtime claim.
• Current-head fork Actions results are recorded above. Earlier package-only fixture provenance, formatting and source-distribution checks retain their recorded scope.

Merge Danger

Door: two-way

Blast Radius: consumers

Address and body-content constructors change; proposed development versions are cardano-api 11.9 and cardano-api-gen 10.3. Dependency acceptance and protocol activation remain separate decisions. Independent upstream CI failures and external approval gates are tracked separately from the required API implementation and compatibility changes.

The upstream ledger-state JSON/CBOR schema changes with this dependency update. Existing outer JSON keys remain stable. Old persisted NES/Mark states require replay; current-format restart does not establish old-format restoration.