fix(host-contracts): bump ACL reinitializer version

[zmalatrax]

Following #1904 the ACL.sol host-contract was modified but the upgrade version was not, when it must have.

Fix this issue flagged by jat, bumping reinitializer version.

Someone modified ACL.sol contract in this huge commit yesterday https://github.com/zama-ai/fhevm/commit/803f1048727eabf6d8b3df618203e3c7dda77890#diff-342c378b72fda8ec0e0e240388d[…]0e2753ebae955933659cf704af896818 removing those 3 lines of code (and a lot of comments):
if (expirationDate < block.timestamp + 1 hours) {
revert ExpirationDateBeforeOneHour();
}
But doing so without bumping the reinitializer version (and the MINOR) is a big issue, because future upgrade would revert. This is problematic. I don't know who did this modification so I am posting here and in other channel (commit was authored by 4 different ppl). Please let me know if you want a quick review next time on host contracts.
NOTE: ExpirationDateBeforeOneHour custom error should also be removed...

Summary of what is missing:
1/ bump REINITIALIZER_VERSIONto 4. (the critical part).
2/ bump MINOR_VERSION to 3.
3/ remove ExpirationDateBeforeOneHour custom error.
4/ update CI to catch similar issues in the future.

After further discussion, we chose to refactor the removal of the ExpirationDateBeforeOneHour to a weaker check, that enforces expirationDate > block.timestamp in delegateForUserDecryption:

if (expirationDate <= block.timestamp) {
  revert ExpirationDateInThePast();
}

Added back the two tests testing the revert on ExpirationDateInThePast

[mergify]

🧪 CI Insights

Here's what we observed from your CI run for a0b1ed7.

🟢 All jobs passed!

But CI Insights is watching 👀

[mergify]

🧪 CI Insights

Here's what we observed from your CI run for 09dcd3f.

❌ Job Failures

Pipeline	Job	Health on main	Retries	🔍 CI Insights	📄 Logs
common-pull-request	common-pull-request/lint (bpr)		0	View	View

[jatZama]

Excellent, thanks.

[zmalatrax]

@mergify queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-03-13 12:06 UTC · Rule: main
• ✅ Checks passed · on draft merge queue: embarking main (fd3ef74) and [#2086 + #2107] together #2110
• ✅ Merged — 2026-03-13 14:34 UTC · at a0b1ed7aabda8886f90ce6269574fb208964a6af

This pull request spent 2 hours 28 minutes 12 seconds in the queue, including 1 hour 54 minutes 44 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • feat(coprocessor): add cargo-llvm-cov code coverage to Rust CI workflows #2086
  • fix(host-contracts): bump ACL reinitializer version #2107
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • feat(coprocessor): add cargo-llvm-cov code coverage to Rust CI workflows #2086
  • fix(host-contracts): bump ACL reinitializer version #2107
• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • feat(coprocessor): add cargo-llvm-cov code coverage to Rust CI workflows #2086
  • fix(host-contracts): bump ACL reinitializer version #2107
• branch-protection-review-decision = APPROVED [🛡 GitHub branch protection]
  • feat(coprocessor): add cargo-llvm-cov code coverage to Rust CI workflows #2086
  • fix(host-contracts): bump ACL reinitializer version #2107
• check-success = run-e2e-tests / fhevm-e2e-test
• any of [🛡 GitHub branch protection]:
  • check-success = common-pull-request/lint (bpr)
  • check-neutral = common-pull-request/lint (bpr)
  • check-skipped = common-pull-request/lint (bpr)
• any of [🛡 GitHub branch protection]:
  • check-skipped = coprocessor-cargo-listener-tests/cargo-tests (bpr)
  • check-neutral = coprocessor-cargo-listener-tests/cargo-tests (bpr)
  • check-success = coprocessor-cargo-listener-tests/cargo-tests (bpr)
• any of [🛡 GitHub branch protection]:
  • check-success = coprocessor-cargo-test/cargo-tests (bpr)
  • check-neutral = coprocessor-cargo-test/cargo-tests (bpr)
  • check-skipped = coprocessor-cargo-test/cargo-tests (bpr)
• any of [🛡 GitHub branch protection]:
  • check-success = coprocessor-dependency-analysis/dependencies-check (bpr)
  • check-neutral = coprocessor-dependency-analysis/dependencies-check (bpr)
  • check-skipped = coprocessor-dependency-analysis/dependencies-check (bpr)
• any of [🛡 GitHub branch protection]:
  • check-skipped = gateway-contracts-deployment-tests/sc-deploy (bpr)
  • check-neutral = gateway-contracts-deployment-tests/sc-deploy (bpr)
  • check-success = gateway-contracts-deployment-tests/sc-deploy (bpr)
• any of [🛡 GitHub branch protection]:
  • check-skipped = kms-connector-tests/test-connector (bpr)
  • check-neutral = kms-connector-tests/test-connector (bpr)
  • check-success = kms-connector-tests/test-connector (bpr)