feat(eip7928): move BAL tracking to Journal; eliminate phantom entries

[Gabriel-Trintinalia]

Summary

• Moves EIP-7928 Block Access List tracking from WitnessDatabase (DB layer) into JournalInner (always-on, no @hasDecl guards)
• Eliminates phantom BAL entries: gas pre-checks are now performed before any DB load at CALL, EXTCODECOPY, SELFDESTRUCT, and CREATE opcodes — if a worst-case gas check fails, no account is loaded and no phantom entry is created
• Removes bal_untracked, untrackAddress, and forceTrackAddress — no longer needed since phantoms are prevented at the opcode level
• WitnessDatabase becomes a pure 4-method DB backend (basic, codeByHash, storage, blockHash)

Depends on

#20

Test plan

• zig build test passes
• Blockchain test runner passes against Amsterdam fixtures

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches core execution paths (journal commit/discard and opcode gas charging) and changes EIP-7928 access tracking semantics; regressions could affect gas/OOG behavior or BAL validation across transactions.

Overview
Moves EIP-7928 Block Access List (BAL) tracking into JournalInner, adding persistent pre-block account/storage snapshots plus per-tx staging, cross-tx committed_changed slot tracking, and a takeAccessLog() API to drain the block log.

Updates journal lifecycle to flush/clear BAL state on commitTx()/discardTx() and records pre-block account/slot values on first loadAccount*/sload access, removing DB-layer/frame-based tracking hooks.

Eliminates phantom BAL entries by restructuring opcode gas checks to occur before any account/code DB load (notably CALL, CREATE, EXTCODECOPY, SELFDESTRUCT) and simplifying warm/cold handling to rely on warm_addresses across tx boundaries.

^{Reviewed by Cursor Bugbot for commit a3f8e92. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

SELFDESTRUCT worst-case pre-check causes false OOG pre-Amsterdam

High Severity

The max_dyn_gas unconditionally adds 25000 for Tangerine through pre-Amsterdam, but the actual dyn_gas only includes 25000 when selfdestruct_charges_new_account is true (target doesn't exist, and for Spurious Dragon+ self has value). A SELFDESTRUCT to a warm existing account on Berlin with fewer than 25000 gas remaining will falsely OOG when the actual dynamic cost is 0. The pre-check condition needs to be gated on amsterdam rather than tangerine, since phantom BAL entries are only relevant for Amsterdam.

 

^{Reviewed by Cursor Bugbot for commit 72ed824. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{Reviewed by Cursor Bugbot for commit a3f8e92. Configure here.}

[cursor]

finalize() omits clearing new BAL tracking maps

Medium Severity

finalize() is documented to "clear the journal by resetting it to initial state," but it doesn't clear or deinit any of the five new BAL-related maps (bal_pre_accounts, bal_pre_storage, bal_pending_accounts, bal_pending_storage, bal_committed_changed). If finalize() is called without a prior takeAccessLog(), these maps retain stale data from previous transactions. Inner maps within bal_pre_storage, bal_pending_storage, and bal_committed_changed also leak since their heap allocations are never freed.

 

^{Reviewed by Cursor Bugbot for commit a3f8e92. Configure here.}