feat(vault): send a delisted claim to the queue

[hpmaxi]

Summary

aha A, the open part: a holder delisted after their deposit was priced. Our reply said her claim moves the priced shares into the exit queue, a wind-down credits them to her entitlement, and a frozen holder is held, not converted. This PR builds that: the vault mints the shares into its escrow and adds them to her redemption in the open epoch, paid in cash at that epoch's price like every other exit. In a wind-down they join her entitlement, and the supply snapshot counts them. This PR answers the rest of aha's comment A.

Changes

• claim_deposit by a caller off the allowlist converts the claim into a redemption in the open epoch (DepositConvertedToExit), or in an active wind-down credits the shares to her entitlement.
• In an active wind-down, every cancel_redeem burns the escrow into the entitlement (RedemptionSurrendered); no token pause or allowlist place can hold it.
• In an active wind-down, a redemption claim that pays nothing burns its escrow instead of returning shares.
• A frozen holder is held (Frozen, 6071) on claim_deposit and cancel_redeem, and refused on request_deposit.
• The lock policy decides these three exits from the holder's standing and the wind-down.

Deviations

• The exit uses the next epoch's price, not the deposit epoch's: that price would pay a holder whose KYC lapses after a fall at the others' expense.
• A frozen investor is refused at request_deposit and held at claim_deposit even while listed; before, both went through.
• A delisted holder's cancel_redeem outside a wind-down fails with NotAllowlisted, not the token's IdentityVerificationFailed.
• The conversion waits while the vault itself is delisted; documented, not built around.
• The dApp still blocks this claim (plan 04, a4 and d4); the CLI can call it. The other frozen holds follow in B1-2.

Acceptance criteria

• A delisted caller's claim_deposit mints the shares into the vault's escrow and queues them in the open epoch (DepositConvertedToExit)
• She is paid at that epoch's price, like every exit in it
• In a wind-down they are credited to her entitlement and counted in the snapshot
• In an active wind-down, cancelling any escrowed redemption burns it into the entitlement (RedemptionSurrendered)
• A frozen holder is held (Frozen, 6071), delisted or not
• In an active wind-down, a redemption claim that pays nothing returns no shares

Test plan

Automated tests

1. SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2=1 nix develop -c cargo test --locked -p async-vault: 307 passed, among them delisted, lock_policy (one test per cell of the lock table), compliance and wind_down.
2. The property test conversions_settle_the_epoch_in_any_order runs 16 random epochs.
3. Harness on a local stellar/quickstart network: guards 38/38 and happy path 24/24.

Manual verification

None.

Breaking changes

• claim_deposit returns 0 and publishes DepositConvertedToExit instead of failing for a delisted caller.
• In an active wind-down, cancel_redeem publishes RedemptionSurrendered and returns no shares; a zero-asset claim_redeem burns the shares and publishes RedeemClaimed with 0 assets.
• New error Frozen (6071). A delisted holder's cancel_redeem fails with 6068 instead of the token's 304.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Oct 17, 2026 7:26am UTC