fix: correct what the group a review found

[hpmaxi]

Summary

The final review of the Group A stack found no critical issue. This PR fixes what it asked for: the token's and oracle's admin tests that could not fail, the vault's upgrade check, the wind-down coverage loop, and docs that said something false.

Changes

• 1, 2: the token's and oracle's admin tests bind the vault first and sign only as a stranger, so each fails without its admin check
• 3: the vault's upgrade test checks that the host found no upgrade function
• 4: the wind-down loop expects every view to answer and every write to get its wind-down answer
• 5: the paused-vault cancel_redeem line names the rules refusal and the wind-down surrender
• 6: the claim_deposit and cancel_redeem rows describe the conversion to an exit, the wind-down surrender and the manager return
• 7: the finish_setup and SetupIncomplete doc comments list every check
• 8: the setup-checks comment and the health table say health() leaves out the supply check, and why
• 9: the extend script's reach is stated exactly
• 10: a frozen holder's zero-share refund is named as the exception, with a pointer to §8.7
• 11: revoking the compliance key is instant only on the token; the verifier swap waits
• 12: two banned words rephrased
• 13: the deviation-cap comment and the DeviationExceeded doc name the real fields
• 14: the remainder bound counts redemption requests
• 15: accept_admin_transfer rows for the vault, token and oracle
• 16: free_reserve subtracts wind_down_owed, as the code does
• 17: AGENTS says when cancellation reopens
• 18: day constants in the vault tests use DAY_DURATION
• 19: Invariant 6 gives the frozen controller its own sentence
• 20: the zero-asset claim row says "outside a wind-down" and what a wind-down does
• 21: the vault_unfrozen row says it plainly
• 22: a delisted holder's share return checks standing before reading the compliance contract, saving a call
• Re-review: the finish_setup, health() and Health docs, the health table, the cancel_deposit row, the extend.ts comment and the new test helpers' comments say exactly what the code does

Deviations

• 4: five writes succeed in a wind-down (deposit cap, raising the delay or notice, the cancel_redeem surrender, pause), so the loop expects accepted for them. fund now runs as the holder: the outsider has no USDC trustline, so the asset refused it.
• 4: total_economic_supply, read in its own test, is checked too.
• 13: environments.toml now says its values match the harness's testnet oracle; the oracle tests cap a fall at 10%.
• 18: a second 29 * 24 * 60 * 60 in the wind-down tests is converted too.

Acceptance criteria

• Each admin test fails when the admin check it guards is removed, and passes with it
• The vault's upgrade test fails if the vault gains an upgrade entrypoint
• The wind-down loop fails when a view traps
• Every rewritten doc sentence is true of the code at head

Test plan

Automated tests

1. CARGO_TARGET_DIR=<repo>/target SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2=1 nix develop -c cargo test --locked: async-vault 379, compliance 29, nav-oracle 80, share-token 64, timelock 19, identity-verifier 6 and storage 6 pass. With the Wasm built, --features upgrade_wasm with_wasm passes 5 + 2.
2. Removing any one of the five admin checks (bind_vault, finish_setup, propose_change, cancel_change, apply_change) on the token or the oracle fails the matching assertion. Before this PR, both tests passed with all five removed.
3. Adding an immediate upgrade to the vault fails the_vault_exposes_no_immediate_upgrade; the old version passed.

Manual verification

On a fresh stellar/quickstart local network: npm run deploy -w scripts/harness, then test:happy-path (24/24), test:guards (48/48) and test:wind-down (6/6) pass. With the vault's wind_down_acc made to trap, the old wind-down test still passed 6/6, and the new one failed on wind_down_acc.

Breaking changes

None. The vault's and the oracle's specs change only in doc text; regenerated clients show it.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Oct 17, 2026 11:11pm UTC