[mono-move] Add the MonoMove Aptos transaction executor - #20181

New crate `mono-move/aptos-transaction-executor`: the AptosVM transaction
layer on the MonoMove VM. Executes one user transaction -- versioned prologue
-> entry function -> versioned epilogue -- single-threaded, returning an
unmaterialized `TxnOutcome`.

Design decisions:

- One session, one checkpoint. No respawned sessions or per-stage change
  sets; a failed payload rolls the heap and read-write set back to the
  post-prologue checkpoint, so prologue effects such as nonce insertion
  survive. Prologue and epilogue run unmetered via a scoped meter swap.
- Deferred materialization. The executor hands back raw VM effects;
  rendering them into a `TransactionOutput` is a separate, fallible step.
  Nothing on the execution path calls into `materialize/`, so a block
  coordinator that reads effects directly can skip it entirely.
- Past the prologue, the transaction always commits and pays. Neither a
  payload VM error nor a misbehaving epilogue discards: the payload's
  effects are dropped, the epilogue reruns against the state the prologue
  left, and only a failing rerun discards -- mirroring
  `failed_transaction_cleanup`.
- Typed outcomes. `DiscardReason`/`ExecutionStatus` make illegal states
  unrepresentable, and aborts carry their own `AbortLocation` so the
  executor records where an abort came from instead of the status mapper
  asserting it afterwards.
- The executor owns no data access. It borrows `ModuleProvider` for code and
  the runtime's `ResourceProvider` for reads; only materialization needs the
  extra resource-group trait. The `StateView`-backed implementations live in
  the sibling `mono-move-aptos-state-view-providers` crate, and Block-STM
  will supply the production ones behind the same traits.

Materialization failures are gathered rather than raised where hit -- the
read-write set has no defined iteration order, so `MaterializationError`
sorts its reasons on construction and reports all of them.

Scope: entry functions only; resource groups work end to end. Gas is
incomplete (uncalibrated units, no IO or storage fees). Scripts, multisig,
publishing, keyless/AA, orderless and argument validation are inline TODOs.
The attacker-reachable gaps -- entry visibility, argument admissibility,
`check_gas` -- are labelled `TODO(security, ..)` and listed in AGENTS.md as
gates that must land before a real coordinator drives this executor; today
the only caller is the e2e harness.

Runtime and core gain what the executor needs: `new_idle()`, `prepare_call`,
`unmetered()`, public `WriteClass`/`serialize_value`, and struct-tag
interning.

Tested by differential e2e against the legacy VM on `FakeExecutor` genesis
-- statuses, write sets and events, masking only the gas-fee slots: p2p
transfer, insufficient balance, fee payer drained (the epilogue retry),
nonexistent entry function, and two dependent transfers applied
sequentially.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The runtime now carries the aborting module on `RuntimeStatus::Aborted`, so
the executor can report where an abort happened instead of reconstructing it
downstream. `location` flows through the whole failure taxonomy --
`CallStatus::Abort` into the prologue, payload and epilogue abort variants,
and out through `ExecutionStatus::Abort`.

Payload aborts no longer report `AbortLocation::Script`. The epilogue's
hardcoded `0x1::transaction_validation` is gone too: the abort supplies its
own location, so the executor constructs none at all.

`prologue_failure_to_status` now guards the validation table on that
location. Previously any prologue abort was matched against it regardless of
which module raised it; an abort from elsewhere is reported as unexpected,
which is also what the legacy VM falls back to. Its `transaction_limits` and
multisig branches are deliberately not ported -- multisig payloads are
rejected before execution and the prologue is always called with no
transaction-limits request, so porting them would duplicate a dozen
constants for unreachable code. Left as a TODO(completeness).

The insufficient-balance differential test was passing only because it
skipped the location; it compares it now, so the payload abort is verified
against the legacy VM's module rather than assumed. Comparing `AbortInfo`
still needs the executor to resolve it from module metadata.

`runtime_error_to_status` still cannot produce `ExecutionFailure`: unlike an
abort, `RuntimeError` carries neither location, function nor code offset, so
that TODO now says it waits on the runtime.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The consensus-visibility warning on `SessionId` moves from the module doc to
the enum itself, where someone adding a variant will see it, and says what
the rule actually requires: a new session kind is a new variant.

`TransactionPayload::script_hash` matches exhaustively instead of falling
through on `_`, so a new executable kind has to be considered here.

The state-view provider's caches use `FxHashMap`; the keys are interned
pointers and state keys with a precomputed hash, so the default SipHash buys
nothing. Its arena doc no longer names `ExternalHeap` -- what matters is that
reads hand out pointers into it.

`AGENTS.md` drops the scope preamble and the interface walkthrough, and the
design-decision prose becomes directions an agent can follow: assume the
latest feature set, do not port legacy paths, do not treat a gas mismatch as
a regression.

The idle interpreter registers gain a TODO for the dangling `func` pointer,
which leans on `is_idle` rather than the `NonNull` invariant. The fix is to
lift long-lived transaction state out so an invocation runs against
`&mut Context` and no idle state exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`ResourceReadWriteSet::writes` became public, exposing an iteration order
that callers must not depend on -- a fact stated only in a doc comment.
`writes_unordered` puts it at every call site instead.

Not `unsafe`, as suggested on review: that marks memory safety, and no
`unsafe` block becomes sound because the caller sorted. Overloading it for
a determinism contract would train readers to write SAFETY comments that
assert nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`VMRegisters::new`/`idle` took a raw `*mut u8` and claimed in a SAFETY
comment that it pointed into an allocation far larger than
`FRAME_METADATA_SIZE` -- something a bare pointer cannot carry. They take
`&MemoryRegion` now, so the one remaining unsafe block sits in
`root_frame_base`, where the length is checked rather than asserted in
prose.

Review suggested inlining the helpers instead; that would put the unsafe
block at all three call sites.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`PrologueFailure`, `PayloadFailure` and `EpilogueFailure` described the same
two outcomes -- a Move abort, or a VM error -- so they become one
`MoveExecutionFailure`. The prologue's variant only looked different because
`run_prologue` still stringified its `VMInternalError`; that is fixed too,
the same loss already corrected for the epilogue.

`ExecutionStatus` was a re-encoding of the same pair plus success, so it
becomes `Success` or a failure carrying the `ExecutionStage` it happened in.
That deletes the match in the driver that existed only to translate between
the two shapes, and `DiscardReason` folds its `Prologue`/`Epilogue` variants
into the same pair.

The stage is what removes `RecoveredEpilogueFailure`, which review found
hard to reason about: an epilogue failure had to be pre-wrapped in a
dedicated error type so the status mapper could recover, by downcast, the
fact that it came from the epilogue. Recording the stage says it directly.
The driver no longer decides which epilogue aborts are legitimate --
`executed_vm_status` does, alongside every other status decision -- and a
misbehaving epilogue still maps to `UNEXPECTED_ERROR_FROM_KNOWN_MOVE_FUNCTION`
as the legacy VM reports it.

The stage's epilogue cases are variants rather than a `&'static str`, since
the three runs differ in outcome: only the one after a successful payload
commits.

Doc fixes from the same review: a status other than success is not what
makes a transaction charge the fee (they all do), an abort is not
necessarily the epilogue's balance check, and the note claiming the fee
abort is the only legitimate epilogue failure is gone rather than left to
go stale.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Argument placement took whatever the signature named, so a payload could
pass a reference to a non-signer, an uninstantiated type parameter, or a
function value -- the last of which lets a transaction hand a callee
something like `minter: || Coin`. The legacy VM rejects all three outright
(`transaction_arg_validation`), and now so does this.

Signers must also lead the parameter list, matching the legacy check that
validates only the parameters after the leading signers: `(signer, u64,
signer)` was accepted here and is not valid.

This is a backstop at placement time, not the real validation: the
rejections surface as invariant violations rather than a signature error,
and which structs are constructible from a transaction argument is still
unchecked. Both are recorded where they happen.

The signer reference was assembled byte by byte, which is what raised the
question of endianness. `write_fat_ptr` in core already does this, so the
runtime gains `set_root_ref_arg` to reach it; the pointer is written
directly, so there is no byte order to get wrong. It is `unsafe`, unlike
`writes_unordered`: a dangling target here really is undefined behaviour.

`CallStatus` was a copy of `RuntimeStatus` down to the field names, and only
existed to be converted back.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The signer buffers were built twice with different shapes -- sender and fee
payer for validation, sender and secondaries for the payload -- and passed
around as bare slices. `TxnSigners` owns both constructors, so a fee payer
becoming optional or multisig bringing several senders changes one place
rather than every call site.

`call_system_function` and `call_validation_function` gain the `_unmetered`
suffix: that system code does not consume the transaction's gas budget was
stated only in a doc comment, and it is the one thing a reader must not
miss.

Serializing the validation arguments no longer panics. The parameter is any
`impl Serialize`, so the signature promises nothing about it, and the
function already returns a `VMInternalError`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The abort location the prologue table is guarded on was rebuilt, allocating
an `Identifier`, on every discarded transaction.

Nothing in the executor logs. The legacy VM logs at the point of status
conversion, which does not carry over: materialization is skippable, so a
coordinator reading effects directly would never reach it. The TODO sits
where failures are detected instead.

Also records what the differential test does not cover -- the sender's store
is masked, so a wrong debit there would pass -- and that the write-set
drain's collect-then-sort may want revisiting against fail-fast and write
limits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The metadata cache hands out an `Arc` purely to share a deserialized value;
nothing ever takes a `Weak` to it, so the weak count is dead weight.
`aptos-types` already depends on triomphe and uses it in
`block_executor::value`.

Only one of the 41 call sites names the `Arc` type -- the rest deref -- and
that one becomes `as_deref`, which is agnostic to which `Arc` this is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`group_members` hands out a shared handle only so callers can read it past
the provider's `RefCell` borrow; the weak count it carries is never used.
With the module metadata switched over too, `std::sync::Arc` is gone from
both crates.

Also records two deferred cleanups: the group-member map could be
`shared-dsa`'s `UnorderedSet` to make its unordered iteration explicit, and
`nominal_tag` should become a cached method on the context, which would let
the state-view providers stop open-coding the same conversion.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Group resolution built a StructTag on every resource read just to name the
defining module; the interned module id is enough. Resource reads also
recomputed pointer offsets to republish a descriptor lowering had already
published, so look that one up instead.