feat(vault): hold a frozen holder's exits

[hpmaxi]

Summary

Closes #171

The vault ignored freezes: a frozen holder could still exit, claim shares and collect a wind-down slice. Freezing now holds everything not yet out, recorded and protected, until an unfreeze; a frozen holder is held, not converted. A legal-order transfer moves only wallet shares; releasing value the vault holds under an order is a follow-up issue.

Changes

• Frozen (6071) on request and claim of exits, cancel of deposits, and wind-down claims
• Partial freeze: a redemption request and a wind-down surrender use free shares only
• Held cash stays in committed; a held wind-down slice stays in wind_down_owed
• lock_policy's table grows to cover every exit; no entrypoint checks the token's freeze itself
• COMPLIANCE_MATRIX, AUTHORIZATION_MATRIX, the design doc and kit-spec: the frozen-investor guarantee language matches the held behaviour

Deviations

• Kept COMPLIANCE_MATRIX §2 as one five-column table (Allowlisted / De-listed / Frozen / Mechanics) instead of the plan's separate two-column Frozen table, updating the Frozen cells and mechanics text in place so the de-listed columns and the transfer row stay intact.
• Fixed one stale COMPLIANCE_MATRIX §3.1 sentence the plan didn't call out ("the cash transfer never queries ... ShareToken::is_frozen"), since claim_redeem now does.
• Breaking changes below list what this PR actually reverses; claim_deposit's refusal of a frozen mint already shipped in an earlier PR, so it is not relisted here.

Acceptance criteria

• Each of the eight entrypoints (the vault's seven exits plus the share token's own transfer) refuses a frozen holder and moves nothing
• A partial freeze limits exits to the free balance
• Unfreezing releases every held claim

Test plan

Automated tests

1. CARGO_TARGET_DIR=<repo>/target SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2=1 nix develop -c cargo test --locked -p async-vault — 327 tests pass, including the rewritten and new freeze and partial-freeze tests in lock_policy, compliance and wind_down.
2. CARGO_TARGET_DIR=<repo>/target SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2=1 nix develop -c cargo test --locked — full workspace, all crates pass.

Manual verification

None. Checked scripts/harness/ for a frozen-holder call to a vault entrypoint: the only freeze scenario there unfreezes before calling the vault, and no entrypoint, event or error signature changed, so the harness needs no update and was not run against a local network.

Breaking changes

Four exits that previously went through for a frozen holder now refuse with Frozen: starting a redemption, claiming a priced one, cancelling a deposit, and a wind-down claim. A partial freeze no longer releases on the redeem escrow; it caps the request to the free balance instead. (claim_deposit's refusal while frozen already shipped in an earlier PR.)

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Oct 17, 2026 8:47am UTC