feat(midnight-liquidation): union the market whitelist across sources

[haydenshively]

Why

Prod and staging pointed at different Midnight markets APIs — prod at the in-code default api.morpho.org, staging overriding to api.morpho.dev (which carries extra whitelisted shorter-maturity markets for testing). Staging is supposed to reveal problems that will exist in prod, and an external dependency differing between the two undercuts that.

Measuring the actual difference first narrowed the problem considerably:

	api.morpho.org (prod)	api.morpho.dev (staging)
/v0/midnight/markets?listed=true	6 markets	19 — the same 6 plus 13 test markets maturing daily
/markets/midnight/liquidation-candidates	45 rows, 26 markets	byte-for-byte identical

So the candidates endpoint is chain-wide, not environment-scoped (staging's override of it is a no-op), and the whitelist was the only real difference — additive, on the same chain, with the same cbBTC collateral and USDC loan token in both sets. The gap that actually mattered was that nothing ever exercised api.morpho.org before prod did: a breaking change to the host prod depends on would sail past staging.

What

MARKETS_API_URL now accepts a comma-separated list of endpoints, and the whitelist is the union across them, with the max-age staleness rule applied per source.

• src/discovery/markets.ts — createUnionListedMarketFilter composes per-source filters. current() freezes the fresh-source set for one discovery pass, so a pass is judged against one staleness reading.
• src/config.ts — new urlListEnv (order-preserving, de-duplicated on the parsed URL, fail-loud on any malformed entry or an all-separators value); MarketsConfig.apiUrl → apiUrls.
• src/index.ts — builds one filter per URL and reports the all-expired case per tick.

Intended deployment: staging gets the superset, prod stays prod-only

The property that matters is superset, not equality: staging must exercise everything prod touches. Staging reads both endpoints (so it finally exercises api.morpho.org, and its whitelist is a strict superset of prod's); prod keeps the single-endpoint default and does not widen. That fixes the stated problem at zero prod blast radius, and keeps the prod key from spending real gas on markets that exist only for testing.

The default stays the single public endpoint, so this branch is inert for prod — no prod env change is needed at all.

1. Merge → deploy-staging ships this code to staging-bot.
2. Set staging MARKETS_API_URL to https://api.morpho.org/v0/midnight/markets,https://api.morpho.dev/v0/midnight/markets, and delete staging's now-redundant LIQUIDATION_CANDIDATES_API_URL (a no-op override — the payloads are identical). Confirm markets.whitelist { markets: 19, sources: 2, fresh: 2 }.
3. Prod: nothing to do.

⚠️ Set a list value only after the supporting image is live, and clear it back to a single URL before rolling back past this release — older images validate the var as one URL and loadConfig would crash-loop the service. Documented in the README env table.

Safety semantics

Per-source staleness is what makes reading two endpoints safe in both directions: a source that goes down or goes stale drops out of the union (markets.source_expired) rather than either emptying the whitelist and halting all liquidations, or letting a stale set keep a since-delisted market in scope. refresh fans out concurrently and never throws — a per-source failure keeps that source's last-known-good and still lands its healthy peers. The union throws at construction if no source is configured, because an empty union lists nothing while logging nothing.

Log events: markets.whitelist (deduplicated combined size — per-source counts overlap and can be neither summed nor maxed into it), markets.listed / markets.refresh_failed / markets.source_expired (all carrying a host/path source label), markets.listed_empty (a source went from some markets to none — authoritative, but a healthy peer would otherwise mask it), markets.whitelist_expired (per tick, all sources stale → fail-closed), markets.refresh_error (at error: the non-throwing contract broke).

Review

Reviewed by reviewer, protocol-engineer, and product-manager. The scoping decision above came out of that review — the original plan had prod read both endpoints. Fixed in 13f31f0: the per-tick expiry signal that a long MARKETS_REFRESH_MS could outrun, the silent empty-filters case, the unreported empty-response transition, the startup tryCatch that had been dropped, per-pass staleness consistency, the union-size event, and source labels/dedup that collided on same-host endpoints.

Known and deliberately not in scope — pre-existing issues this PR no longer amplifies, now that prod stays narrow:

• The uncounted continue for unplannable positions (runner/tick.ts:140) — prod's silently-dropped set stays at its current size rather than growing. Still worth its own fix.
• Post-maturity mode is always chosen for a matured-and-unhealthy position, forfeiting most of the LIF incentive during the ramp (sizing/plan.ts:125). Only staging will see daily maturities.

Verification

• typecheck 0 errors; bun lint 0 warnings; bun format applied; knip clean.
• bun test: 1600 pass / 9 fail — the same 9 failures as the stashed baseline (fork + e2e tests requiring RPC_URL_8453 / FORK_URL), so zero regressions. 14 new tests.
• Vacuity checks: dropped the isFresh guard from the union and confirmed both per-source-expiry tests fail; separately replaced the deduplicated union size with a sum and removed the empty-source guard, and confirmed both of those tests fail. Reverted after each.

🤖 Generated with Claude Code