Recognize the pre-release Vault build that holds token #45744

src/identity/registry/vault.ts

@@ -16,7 +16,7 @@ export type { AssertVaultBytecodeClient, VaultCheckPacing } from './vault/byteco
 export {
   CURRENT_VAULT_BUILD,
   FIRST_COMMITTED_VAULT_BUILD,
-  PRE_RELEASE_VAULT_BUILD_HASH,
+  PRE_RELEASE_VAULT_BUILD,
   knownVaultBuilds,
   vaultBuildForCode,
   vaultBuildForHash,

src/identity/registry/vault/builds.ts

@@ -27,23 +27,25 @@ export const FIRST_COMMITTED_VAULT_BUILD: VaultBuild = {
   hasHeldAgent: true,
 }
 
-// A build deployed before the source was committed (1,955 bytes). It behaves like the
-// current build except that it has no heldAgent() view. Its full runtime hash starts
-// 0xf8f23197; it is filled in from a live read of a deployed Vault running it
-// (`ethagent custody --json` prints `build.observedHash`).
-export const PRE_RELEASE_VAULT_BUILD_HASH: Hex | undefined = undefined
+// A build deployed before the source was committed (1,955 bytes), read from Vault
+// 0x6bdC52c8e262c6D139e618260400614c2Bfe51d7 on Base, which holds token #45744. Its
+// executable code was reproduced from a reconstructed source with solc 0.8.24 (only
+// the metadata hash differs). The owner, operator, and refusal rules match the
+// current build, with three differences:
+// - no heldAgent() view;
+// - no registry or token binding: it accepts any ERC-721 (AlreadyDeposited per
+//   token, no UnexpectedToken);
+// - no operator epoch: approvals survive a withdraw and apply to whoever deposits
+//   the same token next.
+export const PRE_RELEASE_VAULT_BUILD: VaultBuild = {
+  id: 'pre-release',
+  label: 'pre-release build, no heldAgent()',
+  runtimeHash: '0xf8f2319752c7b0a6382ef0d233426d0bd605641e65300a4e1b2ece5479a64c13',
+  hasHeldAgent: false,
+}
 
 export function knownVaultBuilds(): VaultBuild[] {
-  const builds: VaultBuild[] = [CURRENT_VAULT_BUILD, FIRST_COMMITTED_VAULT_BUILD]
-  if (PRE_RELEASE_VAULT_BUILD_HASH) {
-    builds.push({
-      id: 'pre-release',
-      label: 'pre-release build, no heldAgent()',
-      runtimeHash: PRE_RELEASE_VAULT_BUILD_HASH,
-      hasHeldAgent: false,
-    })
-  }
-  return builds
+  return [CURRENT_VAULT_BUILD, FIRST_COMMITTED_VAULT_BUILD, PRE_RELEASE_VAULT_BUILD]
 }
 
 export function vaultBuildForHash(hash: Hex, builds: readonly VaultBuild[] = knownVaultBuilds()): VaultBuild | undefined {

test/identity/registry/vault.test.ts

@@ -466,10 +466,13 @@ test('assertVaultBytecode accepts any known build for an existing Vault but only
   )
 })
 
-test('the builds table knows the current and first committed builds by runtime hash', () => {
+test('the builds table knows the current, first committed, and pre-release builds by runtime hash', () => {
   assert.equal(vaultBuildForCode(VAULT_RUNTIME_BYTECODE)?.id, 'current')
   assert.equal(vaultBuildForHash(FIRST_COMMITTED_VAULT_BUILD.runtimeHash)?.id, 'first-committed')
   assert.equal(FIRST_COMMITTED_VAULT_BUILD.runtimeHash, '0xfea7e898c15b1e72a5a54ec35bdad917dfed8ea3d4bfe078fafa3cf00784cde4')
+  const preRelease = vaultBuildForHash('0xF8F2319752C7B0A6382EF0D233426D0BD605641E65300A4E1B2ECE5479A64C13')
+  assert.equal(preRelease?.id, 'pre-release')
+  assert.equal(preRelease?.hasHeldAgent, false)
   assert.equal(vaultBuildForHash(('0x' + '11'.repeat(32)) as Hex), undefined)
 })