feat(snapshot): supply/value conservation invariants on import (#125 follow-up)

[chiliec]

Follow-up to #125. Adds the deferred export-side completeness detector for snapshot import, and fixes a stale field that blocked the consensus-sim harness build.

Why

The #125 incident class is export-side incompleteness: a serving node serializes state with an account missing, the download matches its checksum, count-reconciliation passes (the recorded counts derive from the same short arrays), import succeeds, and the node wedges the moment a canonical block references the absent account (out_of_range "viz-social-bot"). Neither the checksum nor the count check can see this. A value invariant can: a missing balance/stake holder drops the summed total below the independently-tracked dgp supply.

What

plugins/snapshot/plugin.cpp — two post-import checks in load_snapshot():

• SHARES: dgp.total_vesting_shares == Σ account.vesting_shares. Delegation objects only redistribute already-counted vests → excluded.
• TOKEN: dgp.current_supply == Σ all liquid/locked TOKEN pools (account balance + reserved, escrow balance + pending_fee, invite balance, validator pending reward, vesting/reward/committee funds).

Both are strict equalities that raise the existing retryable FC_ASSERT on mismatch (→ retry another trusted peer), consistent with the other completeness checks. Per-component subtotals are logged unconditionally so any future mismatch is attributable to a specific pool.

tests/consensus_sim/harness/simulated_node.cpp: read signed_block::validator instead of the stale ->witness (Steem-ism). The harness had never compiled against current VIZ headers; this unblocks the suite so the is_wedged test from #125 can run.

Verification

Built on a real Linux/Boost env (Docker, Dockerfile-production). Ran the new vizd against six real mainnet snapshots (blocks 81334800–81620400): both invariants reconcile delta=0 to the satoshi at every height, including the height-varying validator pending-reward term. The wedge_predicate unit test (from #125) also builds and passes 8/8 with the harness fix.

Note: with the harness building, the full consensus suite surfaces pre-existing ASan/UBSan findings in the chain/serialization layer (unrelated to this PR; CI does not build BUILD_CONSENSUS_TESTS). Tracked separately.

[On1x]

Approve. This lands the export-side value invariant deferred from #125 (review finding #4) — the real detector for the incident class.

Verified the accounting is complete, not just delta=0 on the six tested heights:

• TOKEN pools — checked every asset(TOKEN_SYMBOL) field in the codebase. The sum covers all real pools: account.balance + reserved_balance, escrow.token_balance + pending_fee, invite.balance, validator.pending_stakeholder_reward, and the three dgp funds. The fields left out are correctly left out:
  • account.current_bid — the bid TOKEN is held in reserved_balance (database.cpp:4704-4705 reserved_balance -= current_bid; balance += current_bid); summing it would double-count.
  • committee_request.remain_payout_amount — the TOKEN stays in committee_fund until paid; payout decrements both together (database.cpp:3245/3250). It's a claim schedule, not a holding.
  • account_offer_price / last_bid / subaccount_offer_price — price/record fields, no TOKEN held.
  • paid_subscription.amount — a price (share_type), paid by direct transfer each period (database.cpp:3080), no escrow pool.
• SHARES — Σ account.vesting_shares == dgp.total_vesting_shares is correct: delegation doesn't mint vests, it only moves voting power (delegated_/received_vesting_shares are separate fields; vesting_shares is the account's own minted stake), so the delegation objects must be excluded to avoid double-counting. The satoshi-exact match on real mainnet snapshots (which have active delegations) confirms this.
• Harness fix — signed_block::validator (not the Steem-ism ->witness) is correct for current VIZ headers; unblocks the is_wedged test from #125.

Both are strict, retryable FC_ASSERTs on the snapshot-import path only (not block processing), with per-component subtotal logging for attribution — good.

Forward-looking note (non-blocking): these sums are now a maintenance coupling — any future hardfork that introduces a new TOKEN/VESTS pool must be added here or valid snapshots will start failing the strict equality. Worth a comment near the pool list pointing back to the supply-accounting sites, and ideally folding the eventual database::validate_invariants() definition into the same source of truth.