feat(dvm): C6 call_sc + incoming-value forward (fixes #118)

[liqdmetal]

Summary

C6 from the improvement agenda — cross-contract calls: call_sc.
The single biggest DeFi gap in DERO's DVM is closed: a contract can now call another contract. No more monolithic dApps.

The primitive

LET ok = call_sc(TARGET_SCID, "Deposit", "value", ITOA(amount))
IF ok != 0 THEN GOTO fail

• call_sc(scid_hex String, entrypoint String, name1, val1, name2, val2, ...) -> Uint64
• Runs the target's entrypoint in a nested DVM invocation sharing the same tx: one gas budget, one commit point, deferred transfers intact
• Returns the callee's RETURN value (0 = success, nonzero = error/rollback)

Value-forward (folded in)

Reserved args value / assetvalue / asset move incoming funds into the callee for the nested run:

• call_sc(scid, "Deposit", "value", 100) — the callee sees DEROVALUE() == 100
• call_sc(scid, "Deposit", "assetvalue", N, "asset", asset_scid) — same for a named asset
• Insufficient incoming funds → code 2, all Assets restored (atomic)
• On success the forwarded amount is spent from the caller's leftover pot; identity (SCIDSELF / Chain_inputs.SCID / Store) is restored

Execution semantics

Concern	Design
Storage isolation	Each SC lives in its own per-SCID graviton tree; the nested call switches SCIDSELF + Chain_inputs.SCID to the target and resolves/executes against the target's own tree
Atomicity	Nested writes commit to the target's tree directly, safe under the snapshot — a failing top-level tx rolls back the whole chain. Nonzero RETURN rolls back the callee's writes; parent sees it
Reentrancy	Caller's writes are uncommitted until the whole chain succeeds; a reentrant back-call reads committed-only state. Cap of 8 fails cleanly
Auth	Signer propagated unchanged; callee must do its own auth via verify_sig (K0 Fix C) — never trusts "who called me"
Gas	call_sc base 10,000 + the callee's execution on the shared budget

Cross-call state rules (wargame, folded in)

TestWargameC6_* locks three rules for contract authors:

• R1 write isolation — a callee runs on its own tree; a callee STORE("count", x) never clobbers the caller's same-named key.
• R2 back-call sees committed-only — a reentrant call reads committed state, never the outer frame's in-flight writes (pinned: in-flight 999 never leaks; committed 111 is what's read).
• R3 scoped rollback — on nested failure only the failing call's writes are discarded.

Key finding: a nonzero callee RETURN is a failure, so data crosses calls via STORE, never via return value.

Deliberately NOT in v1

• No dynamic dispatch (call-by-SCID only — a registry/interface standard layers on top later)
• No caller-identity to the callee beyond the shared signer
• Funds cross in one direction per call (value-forward)

Tests (dvm/call_sc_test.go + dvm/wargame_c6_reentrancy_test.go)

Test	Verifies
TestC6_NestedSuccess	caller → counter's Inc(7) → count persisted = 7
TestC6_FailureRollback	failing callee's write (poison) discarded
TestC6_RecursionCap	self-call chain exceeds depth, fails cleanly
TestC6_ValueForward	value=100 forwarded → callee DEROVALUE() = 100; over-forward fails and rolls back
TestWargameC6_WriteIsolation	R1 — same key name, separate trees, no clobber
TestWargameC6_BackcallSeesCommittedOnly	R2 — back-call reads committed, not in-flight
TestWargameC6_RollbackScoped	R3 — rollback scoped to the failing call

Full dvm suite green; whole tree builds.

Why this matters

Router, escrow, and token can now be separate audited contracts calling each other instead of one giant contract where a bug in any piece compromises all of it. Standard interfaces become possible. This is the composability primitive that a settlement rail — atomic swaps, DEX, confidential AMM, perpDEX — is built on.

Relationship

• Implements research-docs/cross-contract-calls.md (issue Cross-contract calls (CALL_SC) — design proposal #87).
• Flat on community-dev — no intrinsic dependency. Composes with v9 intrinsics for callee auth.

---

Branch: feature/dvm-c6-callsc in the fork liqdmetal/derohe-improvements-by-liqdmetal. Carries the build fixes. Flat on community-dev.

[liqdmetal]

Folded local maturity: call_sc now forwards incoming DERO/asset via reserved args value/assetvalue/asset. Callee sees DEROVALUE()==forwarded amount; insufficient funds returns 2 and rolls back. TestC6_ValueForward. Branch is flat on community-dev (no intrinsic dep).