[hpmaxi]

Summary

Closes #423

Four small consistency fixes in the vault and oracle, found in review: one guard read an oracle view directly instead of through its trapping-safe form, one entrypoint was missing a setup guard every sibling entrypoint already has, and two doc comments described behavior the code no longer matches.

Changes

• guards::feed_valid now calls try_state() and treats a trap or an Err the same as any other invalid state, refusing with FeedNotValid. A swapped-in oracle that traps on state() no longer aborts request_deposit with a host error. feed_valid has one caller (request, in deposit.rs); epoch.rs and health.rs already used the try_ form.
• wind_down::propose now calls the same setup guard every other setup-gated entrypoint uses, refusing a wind-down proposal while setup is open with SetupOpen. Updated the entrypoint's # Errors doc, the propose_wind_down row in docs/AUTHORIZATION_MATRIX.md, and the setup-gating lines in docs/kit-spec.md and the design doc.
• Rewrote the doc comment above OracleState in contracts/nav-oracle/src/state.rs: the guardian or the admin pauses the NAV, only the admin lifts it, and on Stale/Paused the vault refuses a new deposit request and prices no epoch, while a redemption request, a cancellation and a claim already owed stay open.
• Added one line to docs/kit-spec.md stating that the share token's burn is manager-only, with the vault as the sole manager, and that the token has no burn_from.

Test plan

Automated tests

1. cargo test --locked (full workspace) — all green; async-vault 528 passed (two new tests), nav-oracle 111, share-token 114, compliance 42, identity-verifier 7, unchanged elsewhere.
2. cargo clippy --workspace --all-targets --locked -- -D warnings — clean.
3. cargo fmt --all -- --check — clean.
4. npm run format:check — clean.
5. Wasm upgrade tests per docs/TESTING.md (--features upgrade_wasm, with_wasm) — 4 passed in async-vault, 2 passed in nav-oracle.
6. TDD proof for the feed fix: test::oracle_swap::a_feed_that_traps_on_its_state_refuses_a_deposit_request failed with the feed's own host error before the fix, and passes with FeedNotValid after it.
7. TDD proof for the wind-down fix: test::wind_down::a_wind_down_cannot_be_proposed_while_setup_is_open failed (the call succeeded) before the fix, and passes with SetupOpen after it.

Manual verification

None needed for the doc-only items.

Breaking changes

None. SetupOpen and FeedNotValid are both existing errors; no entrypoint's error set or signature changed, so no bindings or harness updates were needed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Nov 2, 2026 4:12pm UTC