refactor(script): merge the per-chain token-copy scripts into one

.github/workflows/manual-broadcast.yaml

@@ -7,10 +7,22 @@ on:
         required: true
         type: choice
         options:
-          # Append-only registry: add new entries at the bottom; never reorder
-          # or delete. Re-dispatching a historical (executed) script must
-          # remain possible — a signer/auditor may want to re-run its
-          # pre-flight against on-chain reality to confirm what landed.
+          # Append-only registry: add new entries at the bottom; never reorder.
+          # Re-dispatching a historical (executed) script must remain possible
+          # — a signer/auditor may want to re-run its pre-flight against
+          # on-chain reality to confirm what landed.
+          #
+          # An entry may be DELETED only when a named successor listed here
+          # covers its pre-flight at least as strongly, and the deleted
+          # script's broadcast run id has been carried into the pin its run
+          # produced. `20260722-deploy-missing-tokens-ethereum` and
+          # `-hyperevm` were removed under that rule: dispatching
+          # `20260807-deploy-missing-tokens` at the same `network` re-runs the
+          # same gates and answers `NoMissingTokens` when everything landed,
+          # checked against Base's CURRENT token set rather than the config
+          # table the deleted scripts joined against. Their run ids are pinned
+          # in `LibTokenInvariants.productionTokensEthereum()` and
+          # `productionTokensHyperEvm()`.
           #
           # Each entry is the date-prefixed filename (without `.s.sol`) of a
           # broadcast script under `script/`. Convention:
@@ -20,8 +32,7 @@ on:
           # registry of *which* scripts exist, not *whether* they've run.
           - 20260619-deploy-v4-authoriser-clone
           - 20260706-deploy-tokens-ethereum
-          - 20260722-deploy-missing-tokens-ethereum
-          - 20260722-deploy-missing-tokens-hyperevm
+          - 20260807-deploy-missing-tokens
       network:
         description: 'Network to broadcast against (default: base)'
         required: true

CHANGELOG.md

@@ -70,6 +70,49 @@
     `forge test -vvv`) and should be regenerated in CI, where the fork-test RPC
     secrets are available.
 
+### Deploy scripts
+
+- **The per-chain "deploy missing tokens" scripts are merged into one.**
+  `20260722-deploy-missing-tokens-ethereum` and `-hyperevm` were byte-identical
+  apart from the chain each hardcoded; both are replaced by
+  `20260807-deploy-missing-tokens`, which resolves the target chain's token
+  table, authoriser and Safe from `block.chainid`. Adding a target chain is now
+  a table plus an authoriser pin rather than a new copy of the script.
+- **"Missing" is now defined against Base, not against the canonical config.** A
+  token is missing when its `underlying` appears in `productionTokensBase()` and
+  not in the target chain's table, matched by key rather than by index. Base is
+  the source of truth for what the token set is — a ticker is deployed there
+  first, pinned, then copied outward — so the target chain's table simply lags
+  Base until the script runs. Matching by key is what lets the two tables carry
+  different lengths in that window; the previous index-join required every table
+  to be the same length at all times. Cross-chain parity is red between the Base
+  pin and the copy, which is accurate: the chains genuinely differ until the
+  copy lands.
+- Dispatching the script against Base, or any chain without a token table,
+  reverts `UnsupportedTargetChain` rather than resolving to an empty table and
+  reading as "copy everything".
+- **The canonical config table is allowed to run ahead of Base.** A row is
+  authored when a ticker is chosen and Base is pinned when it is deployed, so
+  the config table leads in that window; only the rows Base carries are read,
+  so the excess is inert. The genuine error is a config table SHORTER than
+  Base — a deployed Base row with no name/symbol to deploy under — which
+  reverts `TokenTableTooShort(configsLength, baseLength)`. Row-for-row key
+  drift between the two tables still reverts `TokenTableMisaligned`.
+- **Three checks the gap-fill scripts had dropped are back, matching
+  `20260706-deploy-tokens-ethereum`.** Each deployed vault is now read back
+  before the loop moves on — `AuthoriserNotWired` if it is not routed to the
+  chain's authoriser, `OwnershipHandoffFailed` if ownership did not land on the
+  Safe — so a silent miss cannot finish the broadcast leaving a production vault
+  inoperable or owned by the CI deploy key. A deploy call that emitted no
+  `Deployment` event reverts `DeploymentEventMissing(underlying)` rather than
+  carrying a zero address into the receipt readback.
+- The two per-chain scripts' broadcast run ids are pinned into the token tables
+  their runs produced, so deleting the scripts does not delete the record of
+  what deployed each chain's set. `manual-broadcast.yaml`'s append-only rule now
+  states the exception the deletion was made under: an entry may be dropped only
+  when a named successor listed there covers its pre-flight at least as
+  strongly, and the run id has been carried into the pin.
+
 ### New contracts
 
 - **ST0xOrchestrator**: Singleton mint/burn proxy for the whole ST0x