node-2.0.0-rc.2

Midnight Node 2.0.0-rc.2

Cumulative note. Unlike a normal release candidate note (delta-only), this one is the superset of the entire 2.0.0 line so far — 2.0.0-alpha.1 + 2.0.0-rc.1 + 2.0.0-rc.2 — framed as the full change set from the last final release, node-1.0.0, to node-2.0.0-rc.2. Per-pre-release deltas remain available in their own release notes (alpha.1, rc.1).

Metadata

• Type of release: major (release-candidate pre-release)
• Date: 2026-06-17
• Ships in bundle: TBD — rc pre-release (not bundled)
• Git tag: node-2.0.0-rc.2
• Environment: Supported environments: local env, Devnet, Stagenet. For the full compatibility matrix, see the release notes overview.
• Upgrade scope: binary only — no on-chain runtime upgrade occurs; the node binary carries its bundled runtime and is not compatible with existing networks, so chains start fresh
• Reset required: Yes — fresh chain required; no in-place upgrade from any prior node version is supported in this line
• Governance action required: No (deployed as a fresh chain); enabling the Cardano→Midnight bridge later requires a governance action — it ships inert
• Sister-line note: The 1.0.x maintenance line (e.g. node-1.0.1-rc.1) continues in parallel for networks staying on ledger 8. The 2.0.0 line is a fresh-chain development line and is not an upgrade target for 1.0.x chains yet.

High-level summary

Cumulative state of the Midnight Node 2.0.0 line through rc.2. The 2.0.0 line moves the ledger to version 9 (9.1.0.0-rc.2 at this rc), lands the (still-inert) Cardano→Midnight bridge pallet plus toolkit commands, removes unused partner-chains pallets, bumps the Rust toolchain to 1.95, and carries a large batch of Least Authority audit-hardening fixes across node and toolkit. On top of the alpha it adds a dual v1/v2 ZK proving pipeline, on-chain contract IR (ContractOperation V4), substantial sync-performance work, guaranteed-segment-only ledger-9 validation, multi-destination toolkit transfers, fixed genesis pool generation, and a fixed bridge claim path. rc.2 then adds cNIGHT contract-identifier root extrinsics for upgradeability testing, benchmarks/weights for the bridge pallets, a recreated devnet genesis, and a new stagenet network.

This is a binary-only release: the node binary carries its own bundled runtime, so no on-chain runtime upgrade happens. It is not compatible with existing networks — there is no migration from ledger 8 and no in-place upgrade from any prior node version: 2.0.0 chains must start fresh. (For reference, the bundled runtime reports spec_version 002_000_000 and transaction_version 4, vs 1_000_000 / 3 in node 1.0.0.)

Audience

These release notes are intended for:

• Operators evaluating or running the 2.0.0 line — a fresh-chain start is mandatory; no rolling upgrade is supported yet.
• Developers who build and sign extrinsics — transaction_version is 4; extrinsics signed against the 1.0.0 runtime (tx version 3) no longer decode.
• Toolkit users who generate transactions, manage wallets, or rehearse the Cardano→Midnight bridge flow.
• Integrators decoding runtime metadata or ledger state — metadata was regenerated for ledger 9.1 (new parameters; on-chain ContractOperation V4).
• Administrators maintaining genesis state and chain-specs — devnet was recreated and a new stagenet network was added.

Dependencies

• Ledger: 9.1.0.0-rc.2 (midnight-ledger-v9 1.0.0). No v8 → v9 migration path; incompatible with ledger-8 chain state.
• CompactC: the toolkit defaults to 0.31.0.
• transaction_version 4: signed extrinsics built against the 1.0.0 runtime (tx version 3) will not decode.
• Runtime metadata: regenerated for ledger 9.1 (new max_contract_metadata_size parameter; on-chain ContractOperation format changed; new cNIGHT contract-identifier root extrinsics). Re-pull metadata before pointing tooling at a 2.0.0-rc.2 chain.

Downstream impact (cascading effects): indexers, wallets, and SDKs that decode runtime metadata or ledger-8 state must be rebuilt against the 2.0.0-rc.2 metadata / ledger 9.1 before they can follow a 2.0.0 chain. The C2M bridge is inert, so no downstream bridge integration is active yet.

For all other interop questions, see the bundle dependency matrix.

Deployment information

• Upgrade scope: binary only — there is no on-chain runtime upgrade. The runtime is baked into the node binary and is incompatible with existing networks, so deployment is a fresh chain, not an in-place upgrade.
• Reset required: Yes — fresh chain. Ledger 9 has no state transition from ledger 8, and this line supports no in-place upgrade from any prior node version (including 2.0.0-alpha.1 / 2.0.0-rc.1). Genesis state and chain-specs were regenerated for ledger 9.1 (ledger-state tag v17); devnet genesis was recreated and stagenet added. Mixed pre-v9/post-v9 handling in block replay and toolkit caching remains deliberately relaxed and unsupported.
• Governance action required: No — deploys as a fresh chain, not an on-chain upgrade. Later RCs will require an on-chain runtime upgrade once ledger-8 → 9 state-migration work is complete, at which point existing chains roll forward instead of resetting. Separately, enabling the C2M bridge requires a governance action (setting the bridge MainChainScripts addresses + a data checkpoint); until then the bridge inherent-data provider reports Inert everywhere.
• Downtime / coordination: Not an in-place upgrade — existing chains cannot roll forward. New networks bootstrap from fresh genesis.

Artifacts

• Docker: midnightntwrk/midnight-node:2.0.0-rc.2
• Docker: midnightntwrk/midnight-node-toolkit:2.0.0-rc.2
• Git tree hash: fb07af1f46d233b643574259c4578e20dd848d85

docker pull midnightntwrk/midnight-node:2.0.0-rc.2
docker pull midnightntwrk/midnight-node-toolkit:2.0.0-rc.2

Note: like 2.0.0-rc.1 (and unlike 2.0.0-alpha.1), this rc does not publish a standalone runtime WASM release asset — only the node and toolkit binaries (linux-amd64 / linux-arm64 tarballs) and SHA256SUMS.

What changed

Cumulative new features, improvements, and fixes across the 2.0.0 line (1.0.0 → 2.0.0-rc.2):

• Ledger 9 — new ledger major; no migration from ledger 8, so 2.0.0 chains start fresh (#1604); bumped to 9.1.0.0-rc.2 with a dual v1/v2 ZK proving pipeline, on-chain contract IR and ContractOperation V4, ECDSA domain-separator change, and a new max_contract_metadata_size parameter (#1692).
• Cardano→Midnight bridge (inert) — new c2m-bridge pallet, genesis/runtime config, transfer classification, pre-approvals, subminimal-transfer holds, claim-path fix, benchmarks/weights, and a toolkit bridge-transfer command (#1386, #1333, #1513, #1477, #1393, #1608, #1697, #1635, #1340).
• cNIGHT contract-identifier root extrinsics — set Cardano contract identifiers on-chain to exercise contract upgradeability in fork/local-env testing (#1602).
• Sync performance — bulk-read cNIGHT observation cache (genesis→tip ~3 h 19 m) (#1436), epoch-nonce + federated-ops caches (#1551), cNIGHT UTXO overestimate 64× → 4× (#1367), Midnight parity-db fork (#1478), db-sync autovacuum tuning (#1434).
• Ledger-9 guaranteed-only validation — mempool and block-inclusion pre-checks dry-run only the guaranteed segment on ledger 9 (#1454).
• New networks / genesis — recreate devnet genesis + chain-spec (#1698); add stagenet (Cardano Preview, 7 permissioned validators) (#1707); prevent empty locked pool + --allow-empty-pools, testnet pools mirror mainnet (#1675).
• Removed unused partner-chains pallets and their CLI commands (#1562).
• SessionInfoApi runtime API exposing the substrate session index (#1534); storage_separation config option (#1278).
• Toolkit — multi-destination single-tx (#1560), --coin-selection, --input-utxo pinning, --print-system-tx-hex, batched cache warmup (#1457, #1404, #1473, #1603).
• Rust 1.95 toolchain (#1363); toolkit CompactC default 0.31.0 (#1555).
• Granular ledger error variants surfaced through pallet + RPC error reporting (#1449, #1475, #916, #1359).
• A batch of Least Authority audit-hardening fixes across node and toolkit.

Change	Upgrade Type	PR
Ledger 9 support	Runtime upgrade	#1604
Bump ledger to 9.1.0.0-rc.2 (dual v1/v2 ZK pipeline, ContractOperation V4, max_contract_metadata_size)	Runtime upgrade	#1692
Added c2m-bridge pallet	Runtime upgrade	#1386
C2M bridge: genesis / runtime configuration	Runtime upgrade	#1333
C2M bridge: Reserve Transfer classification	Runtime upgrade	#1513
C2M bridge: pre-approvals filter (→ treasury + UnapprovedTransfer)	Runtime upgrade	#1477
C2M bridge: hold + flush subminimal transfers	Runtime upgrade	#1393
C2M bridge: STAR denomination fix	Runtime upgrade	#1608
C2M bridge: fix claim path	Runtime upgrade	#1697
C2M bridge: benchmarks + weights (pallet_c2m_bridge, pallet_partner_chains_bridge)	Runtime upgrade	#1635
cNIGHT contract-identifier root extrinsics (upgradeability testing)	Runtime upgrade	#1602
Remove unused partner-chains pallets + commands	Runtime upgrade	#1562
SessionInfoApi runtime API	Runtime upgrade	#1534
cnight-observation: panic → typed error on inherent decode	Runtime upgrade	#1234
federated-authority: keep motion removal on failed dispatch	Runtime upgrade	#938
cNIGHT observation UTXO capacity −16× (API v2 gated)	Runtime upgrade	#1367
cNight observation: bounded storage (unbounded-alloc fix)	Runtime upgrade	#1423
Throttle AccountUsage storage-migration refactor	Runtime upgrade	#1526
Granular ledger error variants in pallet error reporting	Runtime upgrade	#1449
Session-change error log when D-parameter below permissioned count	Runtime upgrade	#1506
cnight-observation genesis panic diagnostics	Runtime upgrade	#1466
Prevent empty locked pool in genesis; --allow-empty-pools; testnet pools mirror mainnet	Runtime upgrade	#1675
Recreate devnet genesis state/block + chain-spec	Runtime upgrade	#1698
Update Rust toolchain to 1.95	Runtime upgrade (mixed)	#1363
Add stagenet network genesis + chain specs	Node upgrade	#1707
Bulk-read cNIGHT observation cache (genesis→tip sync ~3 h 19 m)	Node upgrade	#1436
Epoch-nonce + federated-ops caches (sync perf)	Node upgrade	#1551
Ledger-9 apply_guaranteed_only guaranteed-segment validation	Node upgrade	#1454
Bound GRANDPA + BEEFY finality subscription fan-out	Node upgrade	#1075
Enforce TLS cert + hostname validation for DB connections	Node upgrade	#1104
Verify removal of WalletSeed Default implementation	Node upgrade	#1109
Return ContractNotPresent for missing contracts	Node upgrade	#916
Surface ContractNotPresent through midnight_contractState RPC	Node upgrade	#1475
Return BeneficiaryNotFound in get_unclaimed_amount	Node upgrade	#1359
Per-session validator committee-membership log	Node upgrade	#1534
Reject block headers with duplicate mainchain-ref-hash digests	Node upgrade	#1617
Complete zeroization of secret buffers	Node upgrade	#1379
Default unsafe_allow_symlinks to false when missing	Node upgrade	#1600
parity-db: Midnight fork (lower flush threshold, ahash)	Node upgrade	#1478
Silence cNIGHT observation noise logs	Node upgrade	#1324
Run hardware benchmarks on node startup	Node upgrade	#1394
Midnight-specific reference hardware profile	Node upgrade	#1511
Log sanitized db-sync startup probe results	Node upgrade	#1411
Tune autovacuum on db-sync hot tables	Node upgrade	#1434
Eliminate deadlock in LedgerContext::with_wallets_from_seeds	Node upgrade	#1471
New storage_separation config option	Node upgrade	#1278
Toolkit single-tx multiple-destination support	Toolkit	#1560
Toolkit bridge-transfer command	Toolkit	#1340
Toolkit contract-address --untagged cleanup	Toolkit	#1486
Enforce derivation-path role validation in wallet constructors	Toolkit	#1076
Improve wallet seed / keypair / address code quality	Toolkit	#1217
--coin-selection flag on coin-selecting commands	Toolkit	#1457
Batched dust_balance::execute_many for cache warmup	Toolkit	#1603
--input-utxo pinning for generate-txs single-tx	Toolkit	#1404
--print-system-tx-hex for update-ledger-parameters	Toolkit	#1473
Harden coin-selection arithmetic with checked operations	Toolkit	#1293
Enforce EOF on untagged CLI parser path (ADR-0022)	Toolkit	#1437
Abstract transaction builders over a BuilderContext trait	Toolkit	#1605
Fix dust-balance snapshot tagged at block_height = 0 under dust_warp	Toolkit	#1574
Lock redb fetch cache against concurrent toolkit processes	Toolkit	#1493
Terminal-status sender error handling	Toolkit	#1323
Dispatch toolkit-js variants by compactc version	Toolkit	#1555
Fix stack overflow in trusted_deserialize_tagged	Toolkit	#1576
Update default CompactC version to 0.31.0	Toolkit	#1555
Restore cNIGHT observation e2e coverage against Cardano Preview	Infrastructure	#1578, #1613
Initial CI for fork testing	Infrastructure	#1353
fork-network workflow: node-upgrade option	Infrastructure	#1469
local-files secrets mode for mock authorities	Infrastructure	#1287
Remove Kubernetes + AWS coupling from local-environment	Infrastructure	#1470
local-env: patch cnight mapping_validator_address from compiled contracts	Infrastructure	#1653
e2e tests for C2M bridge	Infrastructure	#1654
C2M-bridge subminimal-transfer edge-case tests	Infrastructure	#1677
Nightly cNIGHT e2e job runs in a container	Infrastructure	#1658
compactc: arbitrary compact dependency via submodule in CI	Infrastructure	#1662
qanet e2e reads contracts from reserve-contracts submodule	Infrastructure	#1666
Remove local-env + e2e-tests in partner-chains	Infrastructure	#1351
e2e regression coverage for genesis_extrinsics parsing	Infrastructure	#1516
Per-test tracing logger for the e2e suite	Infrastructure	#1564
Local fork-testing for the 1.0.0 release train	Infrastructure	#1522
Read e2e contract values from runtime-values	Infrastructure	#1348
Split e2e suite into per-topic module files	Infrastructure	#1565
Remove unused/outdated ddosnet network	Infrastructure	#1343

New features

Ledger 9 (9.1.0.0-rc.2)

Description: Moves the node, runtime, and toolkit onto ledger version 9, ending at 9.1.0.0-rc.2 (midnight-ledger-v9 crate 1.0.0) at this rc. There is no state transition from ledger 8 — an existing ledger-8 chain cannot be hard-forked or migrated, so 2.0.0 chains must start fresh; mixed pre-v9/post-v9 handling in block replay and toolkit caching is deliberately relaxed and unsupported. Why ledger 9, not 8.1: 8.1 was a minor (storage stability + wallet WASM bindings); ledger 9 supplies the primitives 2.0.0 is built around — the UnlockToTreasury system transaction (locked pool → treasury), ECDSA signatures for the Cardano bridge, and an explicit governed fee price floor — plus split-phase execution and panic/cost-heuristic hardening. The 9.1.0.0-rc.2 bump then adds a dual v1/v2 ZK proving pipeline (zk-stdlib v2 / circuits v7): zkir 2.2.0 holds v1 or v2 prover keys behind VersionedInnerPK and defaults to v1; the ledger gains ProofVersioned::V3 for zk-stdlib-v2 proofs, and proof_verify dispatches v1/v2 by proof version while zswap verification stays on v1 for backwards compatibility. On-chain, ContractOperation gains a v3 verifier-key field (ContractOperationVersion::V4) and an ir field (contract IR on chain), with per-entry-point metadata checks capped by the new max_contract_metadata_size runtime parameter. coin-structure 3.0.0 updates the ECDSA domain separator. Node-side, ledger 9 no longer shares one crypto stack with ledgers 7/8 — L9 uses 3.x coin-structure/transient-crypto aliases and zkir 2.2.0, while L7/L8 stay on the 2.x stack. Runtime metadata and undeployed genesis/test fixtures were regenerated (ledger-state tag v17). Runtime upgrade.

PR: #1604 (ledger 9), #1692 (9.1.0.0-rc.2)

Reference: ledger 9.1.0.0-rc.2 changelog · what the Ledger 9 upgrade unlocks

Cardano→Midnight bridge (inert)

Description: Introduces the c2m-bridge pallet, a stateful TransferHandler built on the partner-chains bridge pallet that holds the Midnight-specific bridge logic: it classifies Cardano transfers by distinguishing Reserve Validator and ICS Validator inputs (closing a metadata-spoofing attack on the M.R pool), redirects unapproved user transfers to the treasury while emitting UnapprovedTransfer, accumulates subminimal transfers and flushes them as one once a configured threshold is met, and treats amounts as STAR end-to-end (no NIGHT denomination conversion). The claim path was fixed (#1697) and the bridge pallets gained benchmarks + weights (#1635). Governance dispatchables set_subminimal_transfers_config and add_approved_mc_tx_hashes configure it. A toolkit bridge-transfer command submits the corresponding Cardano transaction. The bridge ships inert — its inherent-data provider reports Inert in every environment, and a governance action (setting MainChainScripts addresses + a data checkpoint) is required to enable it. Full surface (pallet extrinsics/events/storage, bridge-transfer flags, SessionInfoApi) is documented in the engineering notes. Runtime upgrade (+ Toolkit).

PR: #1386, #1333, #1513, #1477, #1393, #1608, #1697, #1635, #1340

cNIGHT contract-identifier root extrinsics

Description: Adds root extrinsics to set the Cardano cNIGHT contract identifiers on-chain, closing a gap in contract-upgradeability testing. The intended flow forks a network into local-env, swaps the contract UTXO to keep the same address while pointing at the contract's staging track, and lets the node observe the logic-round increment and adjust logic for the new version. Runtime upgrade.

PR: #1602

SessionInfoApi runtime API

Description: A new midnight-primitives-session-info::SessionInfoApi runtime API exposes current_session_index() -> u32, backed by pallet_partner_chains_session::Pallet::current_index(). Node-side code can now read the substrate session index through a typed runtime API instead of reaching into pallet storage directly. Requires a metadata rebuild. Runtime upgrade.

PR: #1534

Toolkit transaction-generation controls

Description: Adds operator-facing controls to the transaction generator: generate-txs single-tx now accepts multiple --destination-address entries, each with its own shielded/unshielded amount and token type, so one transaction can pay several recipients across both token types (#1560); --coin-selection <largest-first|smallest-first> orders coin/UTXO selection (largest-first default minimises inputs; smallest-first consolidates dust); --input-utxo <intent_hash>#<n> pins exact UTXOs as inputs, bypassing greedy selection; --print-system-tx-hex builds and prints the update-ledger-parameters system-transaction payload without submitting (no council/TC keys needed); and dust_balance::execute_many warms the wallet cache for many seeds in a single shared block replay. Toolkit.

PR: #1560, #1457, #1404, #1473, #1603

New features requiring configuration updates

storage_separation config option

Required updates:

• Set storage_separation = "separate" (default) or "unified" in node config (TOML key, or the STORAGE_SEPARATION environment variable). There is no CLI flag.
• Choose the value at chain initialisation — it cannot be changed on an existing database.

Impact: unified stores Midnight ledger and Substrate items in a single ParityDb instance, reducing the chance of cross-instance data-integrity errors on unexpected process termination. Switching modes against a populated database fails at open with IncompatibleColumnConfig; the node prints a clear error and you must delete the chain-data directory and resync. See the storage_separation operator guide.

PR: #1278

Genesis pool configuration (--allow-empty-pools)

Required updates:

• Chain-spec / genesis generation now rejects an empty reserve, ICS, locked, or treasury pool unless you pass --allow-empty-pools. Previously, an absent reserve config silently assigned all remaining supply to the reserve pool, leaving the locked pool empty.
• All res/* environment configs now carry valid (non-zero) Reserve and ICS values and mirror mainnet pool amounts; regenerate any custom chain-specs from the updated configs.

Impact: New chain-specs will have a correctly funded locked pool. Durable-environment genesis states are unchanged except Preview, whose existing genesis/chain-spec is still wrong (config is now correct) and will likely need a reset. Runtime upgrade (genesis/chainspec) + Toolkit.

PR: #1675

New stagenet network

Required updates:

• A new stagenet preset (res/cfg/stagenet.toml) is available, running on Cardano Preview with 7 permissioned validators and governance split across a technical committee (validators 1-3) and council (validators 4-6).
• Genesis ledger state (res/genesis/genesis_{state,block}_stagenet.mn), chain-specs (res/stagenet/chain-spec{,-raw,-abridged}.json), and Earthfile targets generate-stagenet-genesis-seeds / rebuild-genesis-state-stagenet ship with it.

Impact: Operators can target stagenet directly. The cNIGHT observation state starts empty and is observed forward from genesis; reserve and ICS/treasury pools carry nominal genesis amounts (ledger 9 requires non-empty pools). Node upgrade (network config).

PR: #1707

Improvements

• Sync performance: bulk-read cNIGHT observation cache replaces per-query db-sync round-trips with an in-memory sliding-window cache, syncing mainnet genesis→tip in ~3 h 19 m (~572 k blocks) (#1436); epoch-nonce and federated-ops caches address residual slow-sync hot paths (#1551); the per-transaction UTXO overestimate drops from 64× to 4× (runtime-API-v2 gated so validators can't diverge mid-rollout) (#1367); the workspace parity-db switches to the Midnight fork with a lower background-flush threshold and ahash (#1478); autovacuum_analyze_scale_factor is tuned (0.1 → 0.01) on hot db-sync tables to avoid >400s worst-case query plans (#1434).
• Validation efficiency: on ledger 9, mempool validate_transaction and block-inclusion pre-checks dry-run only the guaranteed transaction segment via apply_guaranteed_only instead of a full apply() that also executed the fallible segment; ledger 7/8 keep the full-apply() path (#1454).
• Bridge weights: pallet_c2m_bridge and pallet_partner_chains_bridge gained generated benchmarks and weights (#1635).
• Observability: per-session log of whether the local AURA key is in the active committee (#1534); error log when the D-parameter is below the permissioned candidate count (#1506); sanitized db-sync startup probe timings (#1411); hardware benchmarks on startup against a Midnight reference profile, with --no-hardware-benchmarks to opt out (#1394, #1511); actionable cnight-observation genesis-failure diagnostics naming the offending chain-spec field (#1466).
• Log hygiene: demote per-UTXO cNIGHT "no registration" / "no create event" warnings to trace and drop no-signal address debug lines (#1324).
• Error reporting: granular inner-cause variants for InvalidError / MalformedError / SystemTransactionError (stable codes 212–250, metadata rebuild required) (#1449); ContractNotPresent distinguishable from empty state, end-to-end through the midnight_contractState RPC (#916, #1475); BeneficiaryNotFound vs zero unclaimed reward (#1359).
• Block validation: reject headers carrying more than one mcsh pre-runtime digest, mirroring sc-consensus-aura (#1617).
• Toolkit UX / robustness: contract-address --untagged hidden from --help with its deprecation warning routed through log::warn! and --tagged --untagged now a parse error (#1486); advisory lock on the redb fetch cache to stop concurrent-process corruption (#1493); stacker-based fix for stack overflow in trusted_deserialize_tagged on long chains (#1576); terminal-status sender error handling (#1323); BuilderContext trait so builders no longer require a full local chain replay (#1605); dispatch toolkit-js by compactc version rather than ledger version (#1555).

Deprecations

None.

Breaking changes

⚠️ This is a major release: spec_version 1_000_000 → 002_000_000, transaction_version 3 → 4, and ledger 8 → 9 with no migration path. Existing chains cannot roll forward — start fresh. No in-place upgrade from any prior node version (including 2.0.0-alpha.1 / 2.0.0-rc.1) is supported.

transaction_version bumped 3 → 4

What changed: The runtime transaction version moved from 3 (node 1.0.0) to 4.

What breaks: Signed extrinsics constructed against the 1.0.0 runtime metadata will no longer decode/validate. Any tooling, SDK, or service that builds and signs extrinsics must refresh its metadata.

Required actions:

• Rebuild runtime metadata against 2.0.0-rc.2 and regenerate any codegen/types derived from it.
• Re-sign or re-construct pending extrinsics with the new metadata.
• Pin integrators to the 2.0.0-rc.2 metadata before pointing them at a 2.0.0 chain.

Ledger 9 — no migration from ledger 8

What changed: The ledger moves to version 9 (9.1.0.0-rc.2 at this rc); this line ships no v8 → v9 state transition or hard-fork.

What breaks: An existing ledger-8 chain cannot be upgraded in place. Block replay and toolkit caching across the v8/v9 boundary are unsupported.

Required actions:

• Start a fresh ledger-9 chain from genesis.
• Do not point ledger-8 state, snapshots, or caches at a 2.0.0 binary.

Partner-chains pallets removed

What changed: Partner-chains pallets not used by Midnight, and their related CLI commands, were removed (#1562).

What breaks: Any caller of those pallets' extrinsics or the removed CLI commands. Their storage no longer exists in the runtime.

Required actions:

• Drop usage of the removed extrinsics/commands. A fresh chain is required anyway, so no storage migration is involved.

Known issues

No state transition / upgrade path into 2.0.0

Description: The 2.0.0 line runs ledger 9 but ships no migration or hard-fork path from ledger 8, and no in-place upgrade from any prior node version (including 2.0.0-alpha.1 / 2.0.0-rc.1). Only a fresh ledger-9 chain can be started. Mixed pre-v9/post-v9 handling in block replay and toolkit caching is deliberately relaxed and unsupported; tests requiring intent[v7] or a v8 → v9 hard-fork are ignored.

Issue: #1579

Workaround (if any): Start a fresh chain. Migration / hard-fork support is planned for a later 2.0.0 pre-release.

Links and references

• PRs: full set on the GitHub release pages for alpha.1, rc.1, and rc.2; every change above links its PR inline.
• Engineering docs:
  • Ledger 9 and the Cardano→Midnight bridge
  • storage_separation operator guide
• Migration guides: not produced — a fresh chain is required; a partner-chains / transaction_version migration guide will accompany the pre-release that introduces an upgrade path.
• API documentation: new SessionInfoApi (current_session_index() -> u32); the midnight_contractState RPC now surfaces ContractNotPresent; ledger 9.1 regenerated runtime metadata (new max_contract_metadata_size parameter; on-chain ContractOperation V4; new cNIGHT contract-identifier root extrinsics). See the engineering notes.
• GitHub release: https://github.com/midnightntwrk/midnight-node/releases/tag/node-2.0.0-rc.2
• Known issues board: https://github.com/midnightntwrk/midnight-node/issues?q=is%3Aissue+is%3Aopen+label%3Abug

Fixed defect list

Defect number	Description
PM-19967	Unbounded GRANDPA/BEEFY finality subscription fan-out could exhaust node resources (#1075)
PM-20015	Wallet constructors accepted derivation paths with mismatched roles (#1076)
PM-22023	DB connections allowed insecure SSL modes / unverified TLS (#1104)
PM-22024	Residual all-zero WalletSeed Default needed removal verification (#1109)
PM-21799	Malformed cnight-observation inherent data could panic all validators and halt the chain (#1234)
PM-22085	Approved-but-failed federated-authority motions became permanently stuck (#938)
PM-21800	Deadlock in LedgerContext::with_wallets_from_seeds (reentrant mutex) (#1471)
PM-21801	get_unclaimed_amount returned Ok(0) for absent beneficiaries (#1359)
PM-19896	cnight-observation genesis panics gave no actionable diagnostics (#1466)
PM-22034	Incomplete zeroization of secret buffers after conversion (#1379)
PM-22018	Unchecked arithmetic in coin selection could overflow/panic (#1293)
PM-22028	Untagged CLI parser accepted trailing bytes (silent-fallback ambiguity) (#1437)
PM-22038	Secret material lacked Zeroize/redacted Debug; unneeded Copy/Clone (#1217)
#116	Unbounded allocation storing cNight mappings per user (#1423)
#1573	dust-balance snapshot saved at block_height = 0 under dust_warp, corrupting later replays (#1574)
#1401	Concurrent toolkit processes corrupted the shared redb fetch cache (#1493)
#1575	Stack overflow in trusted_deserialize_tagged on long-running chains (#1576)
#1607	C2M bridge applied an unnecessary NIGHT denomination to STAR amounts (#1608)
#1599	New binary failed to start against an older default.toml missing unsafe_allow_symlinks (#1600)
#1674	Genesis generation left the locked pool empty when reserve config was absent (assigned all remaining supply to the reserve pool) (#1675)
#1531	Slow node sync from missing epoch-nonce / federated-ops caching (#1551)
#1158	Slow genesis→tip sync from per-query db-sync round-trips for cNIGHT observation data (#1436)
#1609	qanet e2e tests panicked at startup when local-env docker artefacts were absent (#1666)
C2M bridge claim	Bridge claim path was broken on an earlier untested code path (#1697)

Other Changes

• cNIGHT observation e2e coverage restored against Cardano Preview, with a multi-hour await_cnight_observations watermark helper and a Postgres-backed shared fetch cache on qanet (#1578, #1613).
• fork-network workflow gained a node-upgrade option (#1469); initial CI for fork testing (#1353); local fork-testing for the 1.0.0 release train (#1522).
• compactc: arbitrary compact dependency now supported via submodule in CI, alongside the release-based flow (#1662).
• e2e tests added for the C2M bridge (#1654) and its subminimal-transfer edge cases (#1677); local-env patches the cNIGHT mapping_validator_address from freshly compiled contracts (#1653); the nightly cNIGHT e2e job runs inside a container (#1658); qanet e2e reads contracts from the reserve-contracts submodule (#1666).
• e2e suite housekeeping: regression coverage for genesis_extrinsics parsing (#1516), per-test tracing logger (#1564), per-topic module split (#1565), contract values read from runtime-values (#1348).
• Infra cleanup: local-files secrets mode for mock authorities (#1287); Kubernetes + AWS coupling removed from local-environment (#1470); local-env + e2e-tests removed from partner-chains (#1351); unused ddosnet network removed (#1343).