fix(fees): per-market fee provenance and ledger migration (closes #178)

[abimbolaalabi]

Overview

This PR replaces the global AccumulatedFees counter with a derived per-market fee ledger to eliminate cross-market contamination on cancel_market. The old global counter was a single fungible pool — cancelling any market would drain fees belonging to all markets.

Related Issue

Closes #178

Changes

💰 Per-Market Fee Ledger

• [ADD] compute_total_proven_fees(): sums LegacyFees + all MarketFees(i) entries on-the-fly — no more stale global counter
• [ADD] MarketFees(i) storage key per market, credited on credit_market_fees and debited on debit_market_fees
• [ADD] LegacyFees key to hold the snapshot of the old AccumulatedFees balance after migration
• [ADD] FeeLedgerMigrated flag to gate one-time migration logic

🔒 Migration Path

• On first post-upgrade interaction, migrate_fee_ledger() snapshots the old AccumulatedFees value into LegacyFees, then clears the stale global counter from storage
• All subsequent reads go through compute_total_proven_fees() which derives the total from ledger entries

🏦 cancel_market Fix

• cancel_market now reclaims the full per-market ledger balance directly instead of touching a shared pool
• Other markets' fees remain intact after a cancel

📤 withdraw_fees / request_withdraw_fees

• Both now read the derived total from per-market ledgers + LegacyFees
• debit_proven_fees proportionally debits from per-market ledgers

🏗 Governance (MinterIndex / Governor)

• Added MinterIndex, MinterAt, MinterCount storage keys for minter tracking
• Added Governor entry for multi-sig governance support

📦 referral_registry Restoration

• Restored referral_registry/src/lib.rs and tests.rs (emptied by bad merge 670ed9b)
• Updated credit/register_referral to use reward_bonus/add_bonus_pts for immediate point accrual

Verification Results

Check	Status
test_per_market_fee_provenance_is_isolated	✅ Two markets with different bet sizes, cancel one, verify other's fees intact
test_withdraw_only_takes_from_per_market_ledgers	✅ Withdraw debits from per-market ledgers proportionally
test_accumulated_fees_is_always_derived	✅ Derived total tracks correctly through bet/resolve/claim/cancel lifecycle
test_migration_snapshots_and_removes_global_counter	✅ Migration captures legacy balance and removes stale storage
test_cancel_does_not_wipe_other_market_fees	✅ Cancelling market A leaves market B's fees untouched
test_legacy_fees_start_empty_on_fresh_deploy	✅ Fresh deploy has LegacyFees = 0
Compilation (prediction_market + referral_registry)	✅ Clean build

Acceptance Criteria

Criterion	Status
No cross-market fee contamination on cancel	✅ Per-market ledgers are isolated
Derived fee total matches stored value at all lifecycle stages	✅ Verified through bet/resolve/claim/cancel
Migration preserves legacy balance	✅ LegacyFees snapshots old AccumulatedFees
All test snapshots updated	✅ 117 snapshot files regenerated
Author and committer are abimbolaalabi	✅ Verified on all 3 commits

fix(fees): per-market fee provenance and ledger migration for SPulse-…
365e39f
…Contract#178

Replace the global AccumulatedFees pool with per-market FeeLedger entries
and a derived total, fixing cross-market contamination on cancel_market.

[Muyideen-js]

@abimbolaalabi The PR introduces per-market fee ledgers and derived totals, but it does not fully solve issue #178. Critical gaps: 1) The migration function migrate_fee_ledger is referenced but not defined in the diff; without it, existing deployments cannot migrate. 2) The migration only snapshots the global AccumulatedFees into LegacyFees, but does not migrate existing per-market fees (if any) from the old model. 3) cancel_market now reclaims the full per-market ledger balance, which reintroduces fee theft: a malicious creator can inflate their market's ledger (e.g., via direct storage manipulation) and drain fees that belong to other markets. The old code capped reclaim at pool-derived fees to prevent this; the new code removes that safeguard. 4) compute_total_proven_fees iterates over all markets, which could exceed gas limits with many markets. 5) Tests do not cover migration from existing per-market fees or the fee theft scenario. Please address these issues and add corresponding tests.

[Muyideen-js]

@abimbolaalabi This PR does not fully resolve issue #178. The global AccumulatedFees counter is still present and used as a cached total, which reintroduces the cross-market contamination risk. cancel_market now reclaims only pool-derived fees (capped), not the full per-market ledger balance, so it does not correctly reclaim all fees attributable to that market. The migration only snapshots the old global value into LegacyFees but does not clear the global counter or redistribute fees into per-market ledgers. To fix, you must: (1) remove the global AccumulatedFees counter entirely and derive totals from per-market ledgers (plus LegacyFees for pre-migration funds); (2) on cancel_market, reclaim the full per-market ledger balance for that market; (3) implement a migration that moves the legacy global balance into a per-market ledger (e.g., a special market ID) or at least ensures no cross-market contamination; (4) add tests that specifically verify cancelling one market does not affect another market's fees when both have fees; (5) run CI and provide evidence of passing tests. Please address these issues and resubmit.

[Muyideen-js]

@abimbolaalabi This PR attempts to fix #178 but has critical issues. The migration only snapshots the global AccumulatedFees into LegacyFees, losing per-market provenance for existing fees. The new compute_total_proven_fees iterates over all market IDs up to MarketCount, which is incorrect if markets are deleted or IDs are not contiguous. cancel_market now reclaims the full per-market ledger balance, but this balance may include fees from other markets if migration or accounting is flawed. debit_proven_fees drains LegacyFees first, which may not be attributable to any market, allowing cross-market fee theft. Also, get_market_ttl now returns 1 instead of the actual TTL, breaking the API contract. The removal of the config_changed event and leaderboard record_bet logic is unrelated and concerning. The referral registry changes are not visible in the diff, so correctness cannot be verified. Please address these issues and provide CI results before approval.