Merge main into ledger-v9: #69 external faucet and canonical token registry

[acedward]

Merge commit bringing `main` @ `e3b9388` (PR #69 — remove the local faucet contract, use the canonical external token registry) into `ledger-v9` @ `560a77b` (PR #70, the same change ported to v9), so the ledger-v9 line misses no feature that `main` has.

• Merge commit only (no rebase, no cherry-pick); the reapply commit `544670d` remains an ancestor; `origin/main` is an ancestor.
• Conflict resolutions follow the rule "prefer the v9 port; take main only where v9 lacks it" — the per-file list and the gate results (frozen install, lockfile pins, typecheck, compact-runtime invariant, CI unit set, pgtypes) are being recorded and will be posted here as a comment before merge.
• Organizer record: Offer Files project 00038.

Draft PR #65 (the ledger-v9 line) is unaffected; this merges into its branch.

[acedward]

Gate results for this merge (mirrored from the PR #65 comment):

main (#69) merged into ledger-v9

origin/main @ e3b9388d11dfe1a6c5554a4c8699250fe595e4ce (PR #69, Remove local faucet contract and use canonical external tokens) is now an ancestor of ledger-v9. This PR stays OPEN / DRAFT; nothing here was merged or retargeted.

Merge commit	2e0ba008ed245b9bb100e7753184e6fa8d722e06 — parents 560a77b79b0a718d00ac27d556a759e2763f0483 (ledger-v9, PR #70) + e3b9388d11dfe1a6c5554a4c8699250fe595e4ce (main, PR #69)
origin/ledger-v9 now	5d794f9a27f6d65529bf176650405f740531d430 — the PR #71 merge that carried 2e0ba00 onto the branch. Same tree
Method	merge commit only — no rebase, no cherry-pick, no reimplementation
git merge-base --is-ancestor 544670d HEAD	YES — the reapply commit is still an ancestor
git merge-base --is-ancestor origin/main HEAD	YES
git rev-list --left-right --count origin/main...HEAD	0 14 — behind 0, ahead 14
Merged tree	32076111f34238c19e3d0c43205c210cb19908c0

What came in from main

The four commits ledger-v9 was behind: e3b9388 (merge #69), 5e8d410 Remove local faucet contract and require prefunded inventory, f074494 Seed published Preprod test tokens, e439258 Externalize faucet and import canonical token registry.

In content: nothing. PR #70 is PR #69 already ported to the v9 line, and it turned out to be a complete port — the resolved tree is byte-identical to ledger-v9 @ 560a77b. This merge carries history, not content: it makes main an ancestor so the branch is no longer behind.

That is measured, not assumed:

• File coverage — git diff --name-status a608fa6 e3b9388 (Remove local faucet contract and use canonical external tokens #69) = 171 files, git diff --name-status 80bace3 560a77b (Remove local faucet contract on ledger-v9 #70) = 181 files, and comm of the two lists shows no file Remove local faucet contract and use canonical external tokens #69 touched that Remove local faucet contract on ledger-v9 #70 did not. The 10 extra are v9-only files (LEDGER-V9-MIGRATION.md, infra/compact-toolchain.Dockerfile, mint-recipient{,.test}.ts, PRODUCTION-READINESS.md, seed-market.ts, scripts/check-compact-{artifacts,runtime}.ts, check-compact-runtime.test.ts, start.external.ts).
• Line coverage — every line Remove local faucet contract and use canonical external tokens #69 adds (--unified=0, bun.lock excluded) searched verbatim in the merged tree: 4,464 added lines, 4,461 present, 3 absent, and those 3 are the two deliberate v9 differences: ["solver-provision"|"relay", "proof-server", "service_healthy"] (v9 uses service_started, because ⚠ BREAKING: move ledger-v9 to Compact 0.34 and typed mint recipients #67 disabled that healthcheck) and "@effectstream/wallets": "0.103.1" (v9 pins 0.200.2).

Conflicts — 11 files, all content conflicts, no delete/modify

Both sides deleted packages/contracts-midnight/** and git resolved those deletions silently. Rule applied: #70 IS #69 ported, so prefer the v9 side; take main's only where main has something v9 lacks — which, per the measurement above, was nowhere.

File	Resolution	Why
README.md	v9	v9's hunk is a superset — keeps the branch-pairing note (v-next↔ledger-v9, midnight-1↔main) and "Midnight 2.x / ledger-v9 only"; main's side of the hunk was empty. The canonical-token-registry paragraph both ports added is common text and survives
bun.lock (11 hunks)	v9	every hunk is a v9-vs-v8 pin block or a main-only transitive dedup entry for the v8 tree (onchain-runtime-v3, midnight-js-*@4.1.1, platform-js@2.2.4, wallet-sdk-address-format@3.1.0, bin-version/execa/*)
deploy/scripts/lib/check-compose-topology.ts	v9	proof-server edges stay service_started; main's service_healthy would fail against v9's own compose.yml. diff ours theirs shows those 3 lines are the only difference
deploy/scripts/lib/poster-config.test.ts	v9	both ports rewrote it (base 522 → v9 198 / main 168 lines) and v9 is a strict superset: it keeps "a malformed number or boolean is a startup error, never a silent default" and "network endpoints follow MIDNIGHT_NETWORK_ID, and explicit values win", which the main port deleted
docs/package.json	v9 pins	midnight-js-network-id 5.0.0-beta.6, @effectstream/wallets 0.200.2, mip-zswap-offer 0.4.0-v9.0
packages/database/migrations/000-init.sql	v9	the conflict is a single comment word (ledger-v9 vs ledger-v8); the seed rows are byte-identical on both sides
packages/midnight-infra/package.json	v9 pins	@effectstream/npm-midnight-* 0.200.2
packages/node/package.json	v9 pins	ledger-v9 1.0.0-rc.3 / onchain-runtime-v4 / midnight-js 5.0.0-beta.6. One non-pin difference checked: main lists @effectstream/event-client@0.103.1, v9 does not — git log -S shows the v9 line dropped that direct dependency in 544670d, long before either port; #69 never touched it and nothing imports it
packages/solver-core/package.json	v9 pins	+ mip-zswap-offer 0.4.0-v9.0
packages/tests/package.json	v9 pins	+ wallet-sdk-hd 3.1.0-beta.1, wallet-sdk-unshielded-wallet 4.0.0-beta.2
packages/tests/stm/unshielded-only.test.ts	v9	@midnightntwrk/… scope; v9 also carries signDataAsync and the waitForWalletSettlement error-170 guard that main's signData version lacks

Two of these needed whole-file --ours rather than hunk-level resolution, because git's 3-way output straddled the change boundary: check-compose-topology.ts would have ended up with a duplicated const REMOVED_SERVICES (both sides added the identical line at different offsets), and poster-config.test.ts lost two assertion lines from the middle of a test main deleted around.

Post-merge tree assertions

• ls packages/contracts-midnight → absent.
• grep -rn "mint_shielded\|mint_unshielded\|contract-offer-files" → 10 hits, all in LEDGER-V9-MIGRATION.md, under the Historical migration record banner Remove local faucet contract on ledger-v9 #70 added. No live code, script, Dockerfile or workflow reference remains.
• One 000-init.sql seed set, v9's: 8 known_tokens rows (NIGHT, SNIGHT, TWBTC, TWETH, TWUSDC, TWUSDM, UTWUSDC, UTWBTC) and 6 canonical_token_registry_state rows at revision ebd5eab….
• .github/workflows/ci.yml = v9's, a strict superset of main's — git diff origin/main HEAD -- .github/workflows has no removal lines at all. Adds scripts/check-compact-runtime.test.ts to unit-tests and the kernel-image-amd64 job (which asserts test ! -e /app/packages/contracts-midnight inside the built image).
• compactc is no longer a build input. Remove local faucet contract on ledger-v9 #70 deleted the whole compactc install stage from deploy/images/kernel/Dockerfile; root package.json has no check:compact-artifacts, scripts/check-compact-artifacts.ts is gone, ci.yml has no compact-compile job and no start.*.ts probes the compiler. infra/compact-version.txt (0.34.0), infra/compact-checksums.sha256, infra/compact-toolchain.Dockerfile and infra/compact.sh remain in the tree but are orphaned; the merge did not resurrect the stage from main. What is still live is the runtime pin only.

Gates

Space-free git clone --local copy, auto-removed docker run --rm containers, Docker 29.7.2, host arm64. No Compose stack started and no kernel image built — another executor owns this host's Docker.

Gate	Image	Result
bun install --frozen-lockfile	oven/bun:1.3.3 (CI's pin)	2,182 packages, bun.lock unchanged. The 3 failures are OPTIONAL native postinstalls (msgpackr-extract, bufferutil, utf-8-validate) with no node-gyp toolchain in the arm64 Bun image — CI's x64 runner uses prebuilds
lockfile pins	—	ledger-v8 0; one @midnightntwrk/ledger-v9@1.0.0-rc.3 resolution; one @midnight-ntwrk/compact-runtime resolution, 0.19.0 (4 transitive 0.18.0-rc.1 requests all dedupe onto it; installed version 0.19.0, no nested copy)
bun run typecheck	oven/bun:1.3.3	exit 0 — backend 0, solver 0, price-feed 0 in-scope diagnostics
CI unit set (exact ci.yml list)	oven/bun:1.3.3	1,462 pass / 1 fail / 0 skip, 14,027 assertions, 112 files
bun run check:compact-runtime + its test	oven/bun:1.3.11	exit 0 — compact-runtime invariant OK: @midnight-ntwrk/compact-runtime@0.19.0; 4 pass / 0 fail
bun run check:pgtypes	node:24-bookworm-slim + git + bun 1.3.3	exit 0 — 11 query types regenerated, generated output is current and query names are unique
non-CI suites (price-feed, launcher-dependencies, start)	oven/bun:1.3.3	65 pass / 0 fail

The one failure, named: packages/tests/grand-e2e/lib/solver-offerfiles-real-image-secret-scan.test.ts — its beforeAll runs docker pull and the test container has no Docker CLI (Executable not found in $PATH: "docker", line 42), so the file aborts in its hook and Bun reports (fail) (unnamed). Reproduced in isolation. Untouched by this merge and by both parents; green on GitHub's runner. Environment-only. No other failure exists.

Two pre-existing observations, neither caused by this merge (its tree is identical to 560a77b): bun run check:compact-runtime needs Bun ≥ 1.3.11 (Bun.JSONC.parse, introduced by d8d4ec8 in #67) while CI pins unit-tests to 1.3.3 — CI is unaffected because it runs only the test file, which imports the pure helpers; and packages/price-feed, packages/tests/launcher-dependencies.test.ts and packages/tests/start.test.ts are still outside the unit-tests list.

Not run, deliberately: deploy/gates.sh, the kernel image build and any Compose bring-up — this merge moves no pin, Dockerfile stage or Compose content, and this PR's own CI runs kernel-image-amd64.