fix: read at the head by default, add a global --finalized, add send --all

[n13]

Found live, minutes after mainnet enacted spec 153. Sending 1.99 QTC from an account holding exactly 2 QTC was refused:

Insufficient balance for send. Have: 2 QTC, Need: 2.000167025 QTC
(estimated fee: 0.010167025 QTC)

The transfer was affordable. Only the quote was stale.

Cause

partial_fee_estimate calls TransactionPaymentApi_query_info at latest_finalized_block_ref (subxt tx_client.rs:583). QPoW finality trails the head, so the quote came from the runtime the upgrade had just replaced — and 153 cut FEE_SCALE tenfold. Measured on mainnet at the time:

best: 97174   finalized: 97073   lag: 101 blocks
runtime @ head:      spec 153   ← fees 10x cheaper
runtime @ finalized: spec 152   ← what the estimate used

Real fee ~0.001 QTC; quoted 0.0102.

1. Estimate at the block everything else reads

QuantusClient::partial_fee runs the same runtime API at get_latest_block(). Replaces both partial_fee_estimate call sites (send.rs, cold_signing.rs).

2. One switch for finality

An audit of every finalized reference found those two sites were the only wrong ones — everything else is a deliberate --finalized-tx opt-in, or already fixed by #152 (collect-rewards proofs) and #154 (client metadata). So rather than add a parallel mechanism, this unifies what exists.

ExecutionMode::finalized already decided how long to wait for a transaction. It now also decides which block reads are taken at. Reads happen in ~80 places with no reason to carry an ExecutionMode, so main publishes the flag once via ExecutionMode::install, and get_latest_block consults it — one switch governs waits and reads, the way wait_for_transaction already governs waiting.

--finalized-tx becomes --finalized (kept as a clap alias) since it no longer governs only transactions. system --runtime reads the runtime version and header at one selected block, so the flag moves both.

Some reads deliberately don't follow the installed switch:

• The signing nonce is always read at the head. A nonce from the finalized block makes the extrinsic outdated whenever the account has anything unfinalized.
• Wormhole proof tips follow the ExecutionMode the flow is handed, via QuantusClient::head_or_finalized. The proof block must match the wait, and library callers reaching handle_wormhole_command never install the switch.
• The SDK helpers at_best_block and at_finalized_block fetch the block they name.

Default is the head. --finalized opts back in for callers who want finality's guarantees and will wait ~20 minutes for them.

3. send --all

Sweeping by subtracting an estimate cannot be made reliable — too low strands dust, too high is refused, which is exactly what happened above. --all submits Balances::transfer_all and lets the chain deduct the exact fee. --keep-alive chooses between reaping the account and leaving the existential deposit.

quantus send --from m1 --to <dest> --all

--amount and --all are mutually exclusive, enforced by clap.

The verbose fee line reads MiningRewards::FeesCollected from the included transaction. A balance delta can't separate the fee from what --all moved, and TransactionFeePaid omits the refund a reaped account forfeits: on a dev chain it reported 0.008028025 for a sweep that cost 0.008203025. send needs the inclusion block for this, so manual-nonce submission gains submit_transaction_with_nonce_and_inclusion_block; submit_transaction_with_nonce still returns the hash.

Verification

• 369 tests pass (5 new): the finality switch flips reads, wormhole tips follow the supplied mode rather than the installed switch, the SDK block helpers fetch the block they name, --all builds Balances::transfer_all, and a fixed amount still builds transfer_allow_death
• SKIP_CIRCUIT_BUILD=1 cargo clippy --all-targets --locked -- -D warnings clean
• cargo +nightly fmt --all -- --check clean
• Exercised against live mainnet on 153
• Testnet: --finalized system --runtime reports the finalized block, ~100 behind the head
• Local dev chain: the fee line matches the sender's balance change to the planck for a fixed amount, a manual nonce with a tip, --all --keep-alive and a reaping --all. --finalized send from an account with an unfinalized transaction now signs with the head nonce and is included; it was rejected as outdated before

Follow-up, not in this PR

On a dev node the pool never reports InFinalizedBlock for a watched transaction: a --finalized wait ends in Dropped("Finality timeout") after 480 s even though its block is finalized, so the command reports failure for a finalized transfer. Predates this PR — --finalized-tx shared the wait.

COMPATIBLE_RUNTIMES still tops out at 149, so every mainnet command prints specVersion=153 … newer than this CLI's tested list. Cosmetic — transaction_version never moved off 6 — but all three chains are on 153 now and it should be bumped.

[n13]

Reviewer model: GPT-6 Sol

Verdict (advisory): Request changes

1. [P1] Keep proof reads aligned with the requested finality for library callers. src/cli/wormhole.rs:1213-1216 now selects its proof block through get_latest_block(), whose global flag is installed only by the binary in src/main.rs:92-98. The public handle_wormhole_command(..., ExecutionMode { finalized: true, ... }) and execute_command paths do not install that flag. A library caller therefore waits for finalized transactions while building wormhole proofs from the unfinalized head; the prior code used the supplied mode to select the finalized block. Make the block selection honor the supplied mode outside main as well, and cover that public call path in a test.

2. [P2] Make system --runtime honor the new global --finalized read setting. The flag promises finalized reads, but src/cli/system.rs:184-220 still gets runtime versions with no block hash and calls chain_getHeader and state_getRuntimeVersion with empty parameters. quantus --finalized system --runtime consequently reports the best block's height and runtime, including during the post-upgrade gap that motivates this PR. Resolve one selected block hash and use it for those runtime and header queries.

3. [P3] Preserve fee reporting for send --all. src/cli/send.rs:697-704 passes the entire starting balance as the transfer amount, so the fee calculation at src/cli/send.rs:744-747 always saturates to zero for a sweep and the verbose fee line disappears even though a fee was paid. Derive the transferred amount or fee from the included transaction before reporting it.

Validation: cargo +nightly fmt --all -- --check and git diff --check passed. The three new focused tests passed. With SKIP_CIRCUIT_BUILD=1, 364 library tests passed when the generated verifier artifact test was excluded; without that exclusion, that test failed because the skipped build did not create its required bins. The PR's full build/test and analysis CI jobs passed at head e87b9d7.

[n13]

Reviewer model: GPT-6 Sol

Verdict (advisory): Request changes

1. [P2] Keep the published finalized-block SDK helper. src/lib.rs:62-66 removes the at_finalized_block re-export and src/cli/wormhole.rs deletes the public function. It was explicitly exported for SDK use at the base commit, so existing quantus_cli::at_finalized_block(...) callers will stop compiling, although this PR does not change the crate's 2.3.0 version. Restore the helper and re-export it; it can use head_or_finalized(true) internally. Also keep the surviving at_best_block helper pinned to the head: its new get_latest_block() call at src/cli/wormhole.rs:1477 can return a finalized block after ExecutionMode::install(true).

2. [P2] Preserve the public manual-nonce submission result. src/cli/common.rs:709-716 changes submit_transaction_with_nonce from Result<H256> to Result<(H256, Option<H256>)>. Existing library callers expecting a transaction hash will fail to compile. Keep the old signature as a wrapper and add an inclusion-block variant for send, as this PR already does for automatic-nonce submission.

The previous wormhole tip, system --runtime, and send fee-reporting findings are addressed at head e4f6a2b. Validation: cargo +nightly fmt --all -- --check, git diff --check, and cargo metadata --no-deps --locked passed. Local focused test compilation was stopped because this detached worktree has a cold target directory; the current-head Ubuntu/macOS build-and-test, Clippy, format, and security CI checks passed.