PM: reconcile & re-arm snapshot TOKEN supply invariant (follow-up to #126 on pm branch)

[On1x]

Context

PR #126 added satoshi-exact supply/value conservation invariants to snapshot import on master (SHARES: Σ account.vesting_shares == dgp.total_vesting_shares; TOKEN: Σ pools == dgp.current_supply). Merging master into the pm (Prediction Markets) branch brings these checks in — but PM introduces new TOKEN pools (bets, LP, lazy-pool, commit escrow, dispute fees, oracle insurance, leverage), so the base TOKEN sum no longer equals current_supply on a PM snapshot.

To avoid bricking PM snapshot import, the TOKEN check on the pm branch is currently LOG-ONLY (plugins/snapshot/plugin.cpp, TODO(pm)): it sums a best-effort PM pool set and logs the delta per-component, but does not fail import. The SHARES check and the #125 count/referential/singleton checks remain fatal (PM holds no VESTS).

Task

Reconcile the PM TOKEN accounting to delta == 0 satoshi-exact on real PM snapshots, then re-arm the TOKEN check as a fatal FC_ASSERT (as on master).

Candidate non-overlapping PM TOKEN holdings (best-effort, from static read of pm_evaluator.cpp)

• Σ pm_bet.amount — market/outcome bets_sum and CPMM reserve_a/reserve_b are aggregates of these → excluded.
• Σ pm_liquidity.amount WHERE provider != "" — empty-provider LP is the lazy pool, already in allocated_balance → excluded.
• pm_lazy_pool.free_balance + allocated_balance — pm_lazy_deposit.principal is a per-depositor claim on this → excluded.
• Σ pm_commit.escrow_amount
• Σ pm_dispute.dispute_fee
• Σ pm_market.forfeit_pool
• Σ pm_oracle.insurance
• Σ (pm_leverage_position.collateral + loan) — loan is debited from free_balance at open → held in the position, not the pool; leverage_fund_used is a marker → excluded.

Open questions to resolve (the UNVERIFIED status filters in code)

1. Bet held-states: which pm_bet.status values still hold TOKEN (currently summing 0/5/6 = active/queued/revealed-pending)? Are resolved (3) / cancelled (1) / refunded (2) bets deleted or retained with a stale amount?
2. Commit escrow vs forfeit_pool: on forfeit (status 2), escrow moves to market.forfeit_pool. Confirm escrow_amount is zeroed then (else double-count with forfeit_pool). On reveal (status 1), is escrow returned or converted into a pm_bet (already summed)?
3. Dispute fee: returned/slashed on close — confirm only status 0 holds it.
4. Leverage: confirm free_balance is debited by loan at open (so loan isn't double-counted), and which status values still hold collateral + loan.
5. forfeit_pool: confirm it is zeroed post-settlement (so summing all markets is safe).

Acceptance criteria

• pm_token accounting reconciles delta == 0 on ≥6 real PM snapshots covering all lifecycle states (active markets, open commits, disputes, active leverage, post-settlement).
• Status filters verified against pm_evaluator.cpp money-flow (no double-count, no missed holding).
• TOKEN check re-armed as fatal FC_ASSERT (remove the LOG-ONLY path), matching master.
• Ideally folded into a single database::validate_invariants() source of truth once defined.

Follow-up to #125 / #126.

[On1x]

Validation run #1 — testnet snapshot, block 81627002 (delta == 0 ✅)

Imported via --replay-from-snapshot --snapshot-auto-latest on a vizd:pm build of the merged branch (snapshot-block-81627000.vizjson). Snapshot carried live PM state: 55944 markets, 121101 outcomes, 1669 bets, 57507 liquidity, 1 lazy pool, 4 lazy deposits, 1560 lazy allocations, 4 leverage positions, 2 oracles.

Both invariants reconciled to delta = 0:

SHARES: Sum(account.vesting_shares)=55199069177189, dgp.total_vesting_shares=55199069177189, delta=0
TOKEN:  current_supply=108992654223 vs summed=108992654223 (base=101745033531 + pm=7247620692), delta=0
  Base: acc_balance=20188446082 acc_reserved=0 escrow_balance=7000000000 escrow_fee=0
        invite_balance=8992691 validator_pending=38556 vesting_fund=55199717442
        reward_fund=152478642 committee_fund=19195360118
  PM:   bets=9894274 user_lp=6882800000 lazy=289875819 commit=0 dispute=0 forfeit=0
        insurance=65000000 leverage=50599

Validated by this run (the tricky double-count exclusions all hold)

• user_lp sums only provider != "" LPs; the empty-provider lazy LP is captured via allocated_balance → no double-count (57507 LP objects, still delta 0).
• lazy = free_balance + allocated_balance; pm_lazy_deposit.principal excluded → no double-count (4 deposits).
• leverage = collateral + loan, with loan debited from free_balance at open → no double-count (4 positions).
• bets status filter {0,5,6} correctly excludes settled/refunded stakes — 1669 bets of mixed lifecycle still reconcile to 0.
• insurance (2 oracles) reconciles.

NOT yet exercised (all zero in this snapshot)

• pm_commit = 0 → escrow_amount filter (status==0) and the commit → forfeit_pool interaction unverified.
• pm_dispute = 0 → dispute_fee filter unverified.
• forfeit_pool = 0 → unverified.
• leverage only in active status (0) → non-active filters (liquidated/resolved/closed) unverified.

Before re-arming as a fatal FC_ASSERT

Need one more validation run on a snapshot that carries open commits, an open/forfeited commit path, an open dispute, a non-zero forfeit_pool, and leverage in non-active states, and confirm delta == 0 there too. Then flip the LOG-ONLY path back to ++invariant_failures.