test(cketh): build the live balance-scan harness on the shared fixtures (#11124)

## Summary

The live-anvil balance-scan harness had grown into a second test
fixture: it created and funded canisters, sequenced their installs, and
registered ckERC20 tokens on its own, in parallel with the fixtures
every other cketh integration test already uses. This PR removes that
duplication — the harness now builds on the shared fixtures and keeps
only what is genuinely specific to it: the local Ethereum node it owns,
and the balance-scan assertions.

Collapsing the two fixtures meant removing the knobs the duplicate had
accumulated:

- **Whether PocketIC runs live is decided once, after construction, not
by the chain under test.** Every fixture — mocked or live — builds on an
ordinary, non-live PocketIC instance, where setup calls tick
deterministically; only `LiveBalanceScanSetup::new_live` switches the
instance to auto-progress, and only once its whole fixture — including
the ledger-suite orchestrator and the tokens it registers — is already
built. Building against a live (wall-clock-paced) instance from the
start made every setup call race a round deadline it didn't control,
which reproducibly failed under CPU contention.
- **The harness owns the local Ethereum node** rather than borrowing a
URL to it, so the type proves a node is really running behind that URL.
- **Callers can no longer supply a pre-built environment.** The chain
under test already determines the canisters' init args, and every caller
was passing exactly what would have been built anyway — the parameter
only offered a way to get it wrong.
- **Canisters are created and installed in the same order for every
chain under test**, as on master; only their init args differ. The
harness' dedicated controller and its skipped ledger install turned out
not to be load-bearing: the anonymous principal already controls
everything PocketIC creates by default, and the skipped install was down
to a Bazel data dependency that simply wasn't declared.
- **Token registration goes through a real ledger-suite orchestrator**
instead of the harness impersonating one with placeholder ledgers —
which is what testing the deposit flow will need next.
- **The set of tokens the balance scan credits with anvil bytecode is
now exactly the set the orchestrator registered**, not a separately
hardcoded list — `Holding` and the harness' token-facing methods take
the orchestrator's own token type directly, so the two can no longer
silently drift apart.

Behaviour of the mocked fixtures is otherwise unchanged: same canister
creation order, same derived minter address, and the same cold-start
property the deposit-flow tests depend on. One thing did change for
every fixture, mocked included: canisters are now funded with `u64::MAX`
cycles rather than `u128::MAX` — the amount that reproducibly crashes
the live harness' replica on its first HTTPS outcall — deliberately
funding every fixture the same way rather than carrying two cycle
amounts. No cketh test asserts on cycle balances, so this is not
expected to be observable.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: gregorydemay

rs/ethereum/cketh/minter/BUILD.bazel

@@ -301,6 +301,10 @@ rust_test(
         "tests/deposit_from_cex_demo/MockUSDT.sol",
         # End-to-end balance scan on a live PocketIC + local anvil node.
         ":cketh_minter_debug.wasm.gz",
+        "//rs/ethereum/ledger-suite-orchestrator:ledger_suite_orchestrator_canister.wasm.gz",
+        "//rs/ledger_suite/icrc1/archive:archive_canister_u256.wasm.gz",
+        "//rs/ledger_suite/icrc1/index-ng:index_ng_canister_u256.wasm.gz",
+        "//rs/ledger_suite/icrc1/ledger:ledger_canister_u256.wasm.gz",
         "//rs/pocket_ic_server:pocket-ic-server",
         "@evm_rpc.wasm.gz//file",
     ],
@@ -311,6 +315,10 @@ rust_test(
         "CARGO_MANIFEST_DIR": "rs/ethereum/cketh/minter",
         "CKETH_MINTER_WASM_PATH": "$(rootpath :cketh_minter_debug.wasm.gz)",
         "EVM_RPC_CANISTER_WASM_PATH": "$(rootpath @evm_rpc.wasm.gz//file)",
+        "INDEX_CANISTER_WASM_PATH": "$(rootpath //rs/ledger_suite/icrc1/index-ng:index_ng_canister_u256.wasm.gz)",
+        "LEDGER_ARCHIVE_NODE_CANISTER_WASM_PATH": "$(rootpath //rs/ledger_suite/icrc1/archive:archive_canister_u256.wasm.gz)",
+        "LEDGER_CANISTER_WASM_PATH": "$(rootpath //rs/ledger_suite/icrc1/ledger:ledger_canister_u256.wasm.gz)",
+        "LEDGER_SUITE_ORCHESTRATOR_WASM_PATH": "$(rootpath //rs/ethereum/ledger-suite-orchestrator:ledger_suite_orchestrator_canister.wasm.gz)",
         "POCKET_IC_BIN": "$(rootpath //rs/pocket_ic_server:pocket-ic-server)",
     },
     deps = [

rs/ethereum/cketh/minter/tests/ckerc20.rs

@@ -150,10 +150,7 @@ mod deposit_erc20 {
     use ic_cketh_minter::endpoints::{DepositErc20Error, DepositStatus};
     use ic_cketh_minter::state::automatic_deposits::DEPOSIT_ADDRESS_SCAN_WINDOW;
     use ic_cketh_test_utils::ckerc20::CkErc20Setup;
-    use ic_cketh_test_utils::{
-        DEFAULT_USER_SUBACCOUNT, format_ethereum_address_to_eip_55, new_pocket_ic,
-    };
-    use std::sync::Arc;
+    use ic_cketh_test_utils::{DEFAULT_USER_SUBACCOUNT, format_ethereum_address_to_eip_55};
 
     /// Number of `AutomaticDepositReceived` events currently in the minter's audit log.
     fn count_automatic_deposits_received(ckerc20: &CkErc20Setup) -> usize {
@@ -172,7 +169,7 @@ mod deposit_erc20 {
 
     #[test]
     fn should_trap_when_ckerc20_feature_not_active() {
-        let ckerc20 = CkErc20Setup::new_without_ckerc20_active(Arc::new(new_pocket_ic()));
+        let ckerc20 = CkErc20Setup::new_without_ckerc20_active();
         let caller = ckerc20.caller();
         ckerc20
             .call_minter_deposit_erc20(
@@ -577,21 +574,20 @@ mod withdraw_erc20 {
         CKETH_TRANSFER_FEE, DEFAULT_BLOCK_HASH, DEFAULT_BLOCK_NUMBER,
         DEFAULT_CKERC20_WITHDRAWAL_TRANSACTION, DEFAULT_CKERC20_WITHDRAWAL_TRANSACTION_FEE,
         DEFAULT_CKERC20_WITHDRAWAL_TRANSACTION_HASH, DEFAULT_PRINCIPAL_ID, EXPECTED_BALANCE,
-        JsonRpcProvider, new_pocket_ic,
+        JsonRpcProvider,
     };
     use ic_ledger_suite_orchestrator_test_utils::CKERC20_TRANSFER_FEE;
     use icrc_ledger_types::icrc3::transactions::Burn;
     use num_bigint::BigUint;
     use num_traits::ToPrimitive;
     use serde_bytes::ByteBuf;
     use std::convert::identity;
-    use std::sync::Arc;
 
     const NOT_SUPPORTED_CKERC20_LEDGER_ID: Principal = Principal::management_canister();
 
     #[test]
     fn should_trap_when_ckerc20_feature_not_active() {
-        CkErc20Setup::new_without_ckerc20_active(Arc::new(new_pocket_ic()))
+        CkErc20Setup::new_without_ckerc20_active()
             .call_minter_withdraw_erc20(
                 Principal::anonymous(),
                 0_u8,

rs/ethereum/cketh/minter/tests/deposit_from_cex.rs

@@ -29,7 +29,7 @@ use ic_cketh_minter::deposit_address::DepositAddress;
 use ic_cketh_minter::endpoints::DepositStatus;
 use ic_cketh_minter::numeric::Erc20Value;
 use ic_cketh_test_utils::anvil::{Anvil, DEV_ACCOUNT, address_from_hex, deploy_mock_erc20};
-use ic_cketh_test_utils::live_scan::{CkErc20LiveScanSetup, Holding, SupportedToken};
+use ic_cketh_test_utils::live_scan::{Holding, LiveBalanceScanSetup};
 use ic_ethereum_types::Address;
 use std::time::Duration;
 
@@ -197,26 +197,18 @@ fn should_flag_only_deposits_at_or_above_the_per_token_minimum() {
     const USDC_ABOVE_MINIMUM: u128 = 15_000_000;
     const USDT_BELOW_MINIMUM: u128 = 1_000_000;
 
-    let setup = CkErc20LiveScanSetup::new_live();
+    let setup = LiveBalanceScanSetup::new_live();
+    // `supported_erc20_tokens()` registers ckUSDC then ckUSDT, in that order.
+    let [usdc, usdt] = setup.supported_erc20_tokens() else {
+        panic!("expected exactly 2 supported tokens")
+    };
     let deposits = [
-        (
-            setup.depositor(1),
-            SupportedToken::CkUsdt,
-            USDT_ABOVE_MINIMUM,
-        ),
-        (
-            setup.depositor(2),
-            SupportedToken::CkUsdc,
-            USDC_ABOVE_MINIMUM,
-        ),
-        (
-            setup.depositor(3),
-            SupportedToken::CkUsdt,
-            USDT_BELOW_MINIMUM,
-        ),
+        (setup.depositor(1), usdt, USDT_ABOVE_MINIMUM),
+        (setup.depositor(2), usdc, USDC_ABOVE_MINIMUM),
+        (setup.depositor(3), usdt, USDT_BELOW_MINIMUM),
     ];
 
-    let holdings: Vec<Holding> = deposits
+    let holdings: Vec<Holding<'_>> = deposits
         .iter()
         .map(|&(depositor, token, amount)| Holding {
             deposit: setup.register_deposit_address(depositor, DEPOSIT_SUBACCOUNT, token),
@@ -228,21 +220,21 @@ fn should_flag_only_deposits_at_or_above_the_per_token_minimum() {
 
     let deadline = Duration::from_secs(180);
     assert_matches!(
-        setup.await_scan(setup.depositor(1), DEPOSIT_SUBACCOUNT, SupportedToken::CkUsdt, deadline).status,
+        setup.await_scan(setup.depositor(1), DEPOSIT_SUBACCOUNT, usdt, deadline).status,
         DepositStatus::AwaitingSweep(detected)
-            if detected.erc20_contract_address == SupportedToken::CkUsdt.contract().to_string()
+            if detected.erc20_contract_address == usdt.contract.address
                 && detected.scanned_balance == USDT_ABOVE_MINIMUM
                 && detected.detected_at_block > 0_u8
     );
     assert_matches!(
-        setup.await_scan(setup.depositor(2), DEPOSIT_SUBACCOUNT, SupportedToken::CkUsdc, deadline).status,
+        setup.await_scan(setup.depositor(2), DEPOSIT_SUBACCOUNT, usdc, deadline).status,
         DepositStatus::AwaitingSweep(detected)
-            if detected.erc20_contract_address == SupportedToken::CkUsdc.contract().to_string()
+            if detected.erc20_contract_address == usdc.contract.address
                 && detected.scanned_balance == USDC_ABOVE_MINIMUM
                 && detected.detected_at_block > 0_u8
     );
     assert_matches!(
-        setup.await_scan(setup.depositor(3), DEPOSIT_SUBACCOUNT, SupportedToken::CkUsdt, deadline).status,
+        setup.await_scan(setup.depositor(3), DEPOSIT_SUBACCOUNT, usdt, deadline).status,
         DepositStatus::Scanning { scan_count, last_scanned_block, .. }
             if scan_count >= 1 && last_scanned_block.is_some()
     );

rs/ethereum/cketh/test_utils/src/ckerc20.rs

@@ -13,7 +13,7 @@ use crate::{
     DEPOSIT_WITH_SUBACCOUNT_HELPER_CONTRACT_ADDRESS, ERC20_HELPER_CONTRACT_ADDRESS,
     ETH_HELPER_CONTRACT_ADDRESS, LAST_SCRAPED_BLOCK_NUMBER_AT_INSTALL, LedgerBalance, MAX_TICKS,
     RECEIVED_ERC20_EVENT_TOPIC, RECEIVED_ETH_OR_ERC20_WITH_SUBACCOUNT_EVENT_TOPIC, assert_reply,
-    format_ethereum_address_to_eip_55, new_pocket_ic,
+    format_ethereum_address_to_eip_55,
 };
 use assert_matches::assert_matches;
 use candid::{Decode, Encode, Nat, Principal};
@@ -62,7 +62,7 @@ pub struct CkErc20Setup {
 
 impl Default for CkErc20Setup {
     fn default() -> Self {
-        Self::new(Arc::new(new_pocket_ic()))
+        Self::new()
     }
 }
 
@@ -73,8 +73,14 @@ impl AsRef<CkEthSetup> for CkErc20Setup {
 }
 
 impl CkErc20Setup {
-    pub fn new(env: Arc<PocketIc>) -> Self {
-        let mut ckerc20 = Self::new_without_ckerc20_active(env);
+    pub fn new() -> Self {
+        Self::with_cketh(CkEthSetup::default())
+    }
+
+    /// Activates the ckERC20 feature on an existing ckETH fixture: the balance-scan harness in
+    /// [`crate::live_scan`] supplies one backed by a live anvil node rather than the mocked default.
+    pub(crate) fn with_cketh(cketh: CkEthSetup) -> Self {
+        let mut ckerc20 = Self::without_ckerc20_active(cketh);
         ckerc20.cketh = ckerc20
             .cketh
             .upgrade_minter_to_add_orchestrator_id(
@@ -84,8 +90,14 @@ impl CkErc20Setup {
         ckerc20
     }
 
-    pub fn new_without_ckerc20_active(env: Arc<PocketIc>) -> Self {
-        let cketh = CkEthSetup::new(env.clone());
+    pub fn new_without_ckerc20_active() -> Self {
+        Self::without_ckerc20_active(CkEthSetup::default())
+    }
+
+    /// The ckETH fixture builds the PocketIC instance; the orchestrator is then created on that
+    /// same instance so both share one replica.
+    fn without_ckerc20_active(cketh: CkEthSetup) -> Self {
+        let env = cketh.env.clone();
         let orchestrator = LedgerSuiteOrchestrator::new(
             env.clone(),
             LedgerSuiteOrchestratorInitArg {