feat(market): complete MM2 activation, safeguards, and validation

[lunctoken]

Summary

This draft completes and validates the MM2 no-mint implementation against the approved proposal.

Key changes:

• initialize the accumulator and first activation safely during the v15 upgrade;
• generalize Market assets through one deterministic registry instead of duplicating USTC-specific logic;
• implement weighted TWAP bootstrapping and deviation checks for every price input;
• halt swaps after sustained Oracle quorum loss while preserving independent governance state;
• implement adaptive epoch liquidity with the proposal's 7% factor and a separate 10% hard daily cap;
• support governance closure and reopening through the historical spread parameter;
• repair the four-validator E2E harness and add bidirectional LUNC/USTC, unequal-power quorum, and governance-threshold coverage;
• fix default application export when an unregistered module appears in execution orders.

Validation

• go test -count=1 ./... passes on the latest feat/mm-implementation base.
• A four-validator Docker scenario reached consensus, completed Oracle rounds, built the TWAP window, and executed LUNC to USTC and USTC to LUNC swaps.
• A second four-validator scenario used 40% / 30% / 20% / 10% bonded power: exactly 50% remained active, sustained sub-quorum operation with only the 40% validator voting halted swaps with committed Market code 10, and restored quorum re-enabled swaps after TWAP reconstruction.
• A third scenario used the same bonded powers for expedited governance: 60% did not pass the 0.667 threshold and caused no parameter mutation; a fresh regular 40%/60% vote rejected the converted proposal; separate 70%/30% expedited votes closed Market at a 100% spread and reopened it at 0.35%. The closed swap committed with Market code 4 and left trader and Market balances unchanged.
• E2E-004 performed a process-level handoff from the official pre-v15/v14_2 binary at 9a5ee563 to the current MM2 binary on the same disk state. The legacy binary stopped at upgrade height 30; the new binary replayed the block, routed real taxes, activated only after the deferred epoch and Oracle recovery, and committed bidirectional swaps at heights 335 and 336.
• Default terrad export succeeds without an explicit module list and exports all 23 registered modules, including Market.
• The detailed findings, corrections, evidence, and remaining work are documented in docs/MM2_TEST_REPORT.md.

Remaining validation before community testnet

• Force Oracle quorum loss and recovery on the multi-validator network.
• Exercise governance closure and reopening on the multi-validator network.
• Replay the v15 migration from a representative v14_2 disk state with a real old/new binary handoff, taxation, deferred activation, and swaps.
• Observe adaptive liquidity across several live epochs.

Housekeeping

• Proposal: MM2 no-mint specification
• Added regression, integration, invariant, fuzz, and E2E tests.
• Update generated API documentation if maintainers require it.
• Add a changelog entry after review.

This remains a draft pending maintainer review and long-running network validation. A sanitized historical-mainnet rehearsal remains recommended before any mainnet proposal.

[lunctoken]

@StrathCole, could you please review this draft implementation together with StrathCole/oracle-go#1?

Before completing the remaining multi-validator E2E campaign, I would especially appreciate your confirmation of these design choices:

• Oracle meta-denom UST means USD per USTC; the bank denom remains uusd.
• The adaptive-liquidity factor follows the proposal value of 7%, while 10% is enforced separately as the hard daily swap cap.
• The existing MinStabilitySpread parameter is reused as the governance brake for closing and reopening Market.

The full validation evidence and the distinction between corrections and improvements are documented in docs/MM2_TEST_REPORT.md. Both PRs remain drafts pending review and the outstanding network-level tests.

[StrathCole]

@StrathCole, could you please review this draft implementation together with StrathCole/oracle-go#1?

Before completing the remaining multi-validator E2E campaign, I would especially appreciate your confirmation of these design choices:

* Oracle meta-denom `UST` means USD per USTC; the bank denom remains `uusd`.

* The adaptive-liquidity factor follows the proposal value of 7%, while 10% is enforced separately as the hard daily swap cap.

* The existing `MinStabilitySpread` parameter is reused as the governance brake for closing and reopening Market.

The full validation evidence and the distinction between corrections and improvements are documented in docs/MM2_TEST_REPORT.md. Both PRs remain drafts pending review and the outstanding network-level tests.

The mm2 implementation was designed as least-intrusive possible so a return to old mechanics would be very easy.
I didn't have time yet to look at yours closely but it seems very intrusive at some points and adding some more complexity and maybe computational overhead (new additional VP calculation).
It's quite a big PR so I cannot say when I can look in detail.