[behrang]

Follow-up to #499, which covered Hipo's staking messages. This adds the loan and round-lifecycle ops, the later request_loan layouts, and the unstake-all chain. It is additive: nothing released in #499 changes.

Ops added

• Round lifecycle: participate_in_election, vset_changed and finish_participation (ext_in, which is how they are sent), decide_loan_requests, process_loan_requests, recover_stakes, proxy_new_stake, proxy_recover_stake, request_rejected, take_profit, take_borrower_fee. A round-end trace is mostly made of these, and today it reads as unnamed op codes.
• Unstake-all chain: send_unstake_all, proxy_unstake_all, unstake_all.
• withdraw_surplus: one op and layout in the wallet, parent, treasury and librarian.

request_loan layouts

Following the bidask_swap_fallback / _v2 precedent, the released name keeps its body and later layouts are versioned:

name	after min_payment	in force
hipo_finance_request_loan	borrower_reward_share:uint8	until 2026-09-05
hipo_finance_request_loan_v2	borrower_reward_share:uint16	2026-09-05 to 2026-09-21
hipo_finance_request_loan_v3	nothing	2026-09-21 to 2026-09-26
hipo_finance_request_loan_v4	max_stake:(VarUInteger 16)	since 2026-09-26

Each layout consumes the body exactly only for its own era, so multipleMsgsDecoder picks the right one. Before this, every request since 2026-09-05 decoded the share as its high byte (1799 read as 7) or fell back to raw hex.

Left out on purpose

top_up, withdraw_jettons and the quote ops: most mainnet messages with their op codes belong to other protocols (97 of 105 top_up, all 154 withdraw_jettons), so declaring them would mislabel that traffic.

Tests

abi/hipo_finance_test.go decodes a real mainnet message for every op (except send_unstake_all, never sent, so built), and asserts the decode read the whole body. That check is what catches a wrong field width, which otherwise decodes to a plausible number. Layouts were checked against the FunC sources.

go-generate and abi pass. The unit-tests failures are outside abi: TestConvertBlockchainConfig fails the same way on master (run 34974885155), TestGeneratedMethod3 fails on master locally too, and TestParseAddress is liteserver flakiness.

[behrang]

On the red unit-tests: none of it is this PR, and I did not want to leave you to work that out.

• TestConvertBlockchainConfig (3 subtests) already fails on master — run 34974885155 on d12106f9, which is the commit this branch is based on.
• TestParseAddress and TestGeneratedMethod3 are public-liteserver flakiness: they fail locally on an unmodified checkout too, and a different one of the two failed on the base tree in the same run.

go-generate passes, which is the check that matters for a schema change, and go test ./abi/... is green including the twelve new cases.

Happy to split the borrower_reward_share width fix into its own commit or PR if you would rather review it separately from the new declarations.

[behrang]

Pushed 08a854e: Hipo's treasury upgraded on mainnet on 2026-09-21 at 14:19:35 UTC, and borrower_reward_share left request_loan. The treasury now sets one share for every loan in a round and refuses a request that names its own, so the body is 16 bits shorter from the next round onward. Without this commit those requests decode as raw hex.

The unversioned name keeps meaning the layout in force, which is what it meant when the 8-bit era became _v1, so the era that named a 16-bit share is now _v2. Nothing else about the decoding changes: the three are told apart by which reading consumes the body exactly, and multipleMsgsDecoder already prefers a complete read over a partial one.

One thing to know about the test: the body for the new layout is built by the package from the real 16-bit message above it, rather than taken from a block. The upgrade landed after the last request of the open round, so no message in this shape exists on chain yet — the first will be in the next round. I'll swap in a real one once it does; flag it if you would rather the commit wait for that.

No rush on review, but the PR has been open since the 18th, so a ping in case it slipped off the list. The unit-tests failure is still the pre-existing one described above, untouched by any of this.