Merge pull request #1363 from graphprotocol/deployment/mainnet/2026-0…

…9-18/security-fixes

chore(deployment): record SubgraphService and L2GNS mainnet upgrade

upgrade: security-fixes

network: arbitrum-one (42161)
deployed-by: packages/deployment --tags SubgraphService,deploy + L2GNS,deploy; upgrade executed via Council Safe

contracts (horizon):
  - L2GNS (implementation: 0xa3946606960eee45c9b855de8d3cd30b9c875c34)

contracts (subgraph-service):
  - SubgraphService (implementation: 0x09a72545d2040dc6ac3686631daff113e492f8ea)

upgrade: gip-0088

network: arbitrum-sepolia (421614)
deployed-by: packages/deployment --tags GIP-0088:{upgrade,issuance-connect,issuance-allocate} + execute-governance

contracts (horizon):
  - HorizonStaking (implementation: 0xf53b3910ecaeed1aac4bb5ba9840d25e36e52b7c)
  - PaymentsEscrow (implementation: 0x827cfa1ecb452931aaa50dc66beb4d763649f206)
  - RecurringCollector (implementation: 0xa1af9300209cc60de6ce39752d57f04ab7e29432)

contracts (issuance):
  - DefaultAllocation (implementation: 0x77a6e5f2f13218b33a97aec56d591db18d60ffb1)
  - DirectAllocation_Implementation (address: 0x77a6e5f2f13218b33a97aec56d591db18d60ffb1)
  - IssuanceAllocator (implementation: 0x54c6639e45f9eb5ab55a370d4071e77e5f1b9ff6)
  - ReclaimedRewards (implementation: 0x77a6e5f2f13218b33a97aec56d591db18d60ffb1)
  - RecurringAgreementManager (implementation: 0xcb197bae4e6d54536a1041fb4b9df9c5962cb70e)

contracts (subgraph-service):
  - SubgraphService (implementation: 0x0ee47634c94e6606f67301b3a868319073cb0fc2)

Retrospective mainnet deploy tag (Arbitrum One, chain 42161)

Network: arbitrumOne
Deploy: Issuance Rewards Eligibility Oracle (on-chain 2026-03-16, block 442383753)
Contract (new on 42161):
  issuance: RewardsEligibilityOracleA  impl 0x7381f99a610f6c438206811183e2d3969ae7eb01
            proxy 0x8ec2767a9d9ba02b4e09e8ff4fac2e14a340f304 (transparent)
            NetworkOperator 0xae656A0aa51cd465B7506F98F2e8FBb82aa79894

Anchor rationale: this commit's RewardsEligibilityOracle.sol (369-line enumerable
version, solc 0.8.34 / optimizer runs 100 / viaIR) compiles to deployedBytecode hash
0x8ff7d1a6e22cf7f074c4688d9c84394ee151531de3f219ceabf66f0386201412 — byte-identical
(metadata stripped) to the on-chain implementation. Verified by recompilation.

Note: this REO was deployed as part of the GIP-0088 campaign (same bytecode also on
testnet, recorded at deploy/testnet/2026-04-10/gip-0088). The earlier address-book
commit d348b77 (2026-03-24) only recorded the addresses on top of the then-current
296-line REO source, which does NOT reproduce the deployed bytecode; this tag anchors
on 7d7927a where the actually-deployed source merged to main.