fix: commit the deployed SNP receiver sources verbatim, closing D7

[mattglory]

Summary

Closes D7. CONTRACT_INVENTORY recorded that the source for the live snp-flashstack-receiver and -v3 was absent from the repo. It was on the maintainer's machine but gitignored as "stale experiment contracts", which is why the 2026-09-16 review found nothing. Maintainer's call to commit them; this adds no ongoing workload, since they are immutable deployed contracts and can never change.

Verified, not assumed

• Byte-identical to the deployed source (GET /v2/contracts/source/SP3TGRVG7DKGFVRTTVGGS60S59R916FWB4DAB9STZ/<name>):
  • snp-flashstack-receiver 3,270 bytes, sha256 0722955560dbd791d5c3a29c84e1787e4a250df88db5ece6d27be768a0b920ea
  • snp-flashstack-receiver-v3 5,396 bytes, sha256 2560814d0e0103d2e8fcb337fc560cdbc5c39215828b81606712ab82ffb3fdec
• The staged git blobs hash to the same values, and .gitattributes forces LF for *.clar, so the hash is stable across checkouts.
• Read both files in full first: no secrets or personal data.
• Not in mattglory/snp-mvp either (default branch checked), so this is the only public copy besides the chain.

What they are, recorded honestly

Legacy gen-1 SNP integration receivers with mock vault placeholders. In v3, remove-vault is a no-op stub (is-not-removed-vault always returns true). Immutable, not funds-bearing, not in the audit scope. Now stated in the inventory so an auditor doesn't have to discover it.

The pin: tests/deployed-source-pins.test.ts

A repo copy of an immutable contract can only be wrong by changing, which is exactly how F-7 happened, and the mock placeholders and the stub are tempting to "fix". The test pins both hashes offline. Mutation-checked: a one-character edit to either file fails it. The re-verify command is in the test header.

Changes

• .gitignore: drop the two snp lines only. bitflow-arb-compounder.clar stays ignored (different case).
• Not registered in Clarinet.toml; the comment claiming they're "not tracked in git at all" is corrected.
• CONTRACT_INVENTORY: D7 → FIXED with hashes; D5's "two .clar files that do not exist" clause corrected (D5 stays open, the plan is still a gen-1 publish); §3 row updated. TESTNET_STAGING §4 note updated.

Verification

clarinet check 211 contracts, 0 errors (unchanged). Suite 223/223 across 21 files (221 + 2). Suite counts drift as #66/#68 land; whichever merges last should update the README/ROADMAP/packet numbers.

contracts/ and Clarinet.toml are CODEOWNERS-protected (Hillary).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
web	Ready	Preview	Sep 21, 2026 12:49pm UTC

[unixwhisperer]

Approving. The load-bearing claim is independently verified, not taken on trust.

Re-fetched the chain myself

I refetched both sources live from GET /v2/contracts/source/SP3TGRVG.../<name> rather than reusing your numbers, and hashed the git blobs separately:

	on chain (fetched today)	git blob on 598f2b3
snp-flashstack-receiver	3270 B · 07229555…b920ea	3270 B · 07229555…b920ea
snp-flashstack-receiver-v3	5396 B · 25608141…b3fdec	5396 B · 25608141…b3fdec

Byte-identical. Both at publish_height 7576112. .gitattributes does force *.clar to LF, so the pin is stable across checkouts, and both files end in 0a — which is why the jq -j hash agrees rather than being off by a newline.

Pin mutation-checked independently: I changed one character in a comment in -v3 and deployed-source-pins.test.ts failed on the size assertion first, then passed again on revert. It does what it says.

Merged onto current main (b7ac850) in a clean worktree: no conflicts, 256/256 across 24 files, 0 failures.

Clarinet.toml is comment-only — I diffed it with comments stripped and the delta is empty, so clarinet check coverage is provably unchanged.

The three source-level claims in the inventory are accurate as written: the mock vault placeholders are there, and is-not-removed-vault does return true unconditionally, so remove-vault filters nothing while still returning (ok true). Good that it's stated plainly rather than softened. (v1 has no remove-vault at all, so "v3's" is the right scoping.)

One thing I'd like recorded — non-blocking

Committing these files removes an accidental safety property, and I'd rather it be written down than discovered later.

deployments/default.mainnet-plan.yaml is a network: mainnet contract-publish plan pointed at https://api.hiro.so, and lines 77 and 84 reference exactly these two paths. Until this PR, two of its 13 paths did not exist, so the plan could not get far — it would die on a missing file. After this PR every path resolves and it is a runnable mainnet publish plan.

It is still not dangerous on its own: it needs the deployer key, it republishes names that already exist at that address so the chain would reject them, and D5 already says the file describes none of the live system. But "it fails fast because a file is missing" was doing unearned safety work, and that work is now gone. That raises the priority of D5 / Flashstack-ajv.7.2 rather than lowering it.

Suggested: one clause on the D5 row noting the paths now resolve and that this makes disposition more urgent, not less. Your D5 update currently says "so the plan's paths resolve" as a neutral fact; I read it as the argument for acting on D5.

Two smaller notes — take or leave

1. Test count. The PR says 223/223 across 21 files. Against current main it's 256/256 across 24. README/ROADMAP/packet currently say 254, and #70 is now the last to land, so per your own note in this PR the reconcile falls to this one. Happy to push that as a follow-up if you'd rather not touch it here.

2. calculate-leverage-benefit is honest-looking but can't do what its shape implies — in both contracts. (- yield fees) is unsigned subtraction, so when fees exceed yield it aborts rather than returning profitable: false. That field is effectively unreachable in the false case. Also (- leverage u1) aborts on leverage u0. Both read-only and immutable, so nothing to fix — but since the point of this PR is recording these contracts honestly for an auditor, it's the same class of note as the mock placeholders and worth a clause next to them.

Nit, no action: v1 defines a user-stats map that is never written.

Verdict

Approved. contracts/ and Clarinet.toml are mine under CODEOWNERS and this clears that gate. The one substantive item above is a documentation change on D5, not a change to this diff — I don't want to hold a verified-verbatim commit behind it.

One flag before you merge: CI on this PR last ran 2026-09-21 against base 00cf0c4, 27 commits back. That green Dependency Audit predates #69 removing continue-on-error, so it's from the era when the step could not fail — it isn't evidence. My worktree run above is against b7ac850 and is the number I'd trust.