fix(vault): return escrow as manager after a check

[hpmaxi]

Summary

aha H: our reply says "a share-token pause no longer blocks cancelling an unpriced redemption, since the pause stops trading between holders and not the vault's own escrow." Until now it did. The vault returned escrowed shares through the token's checked transfer, so the pause blocked every return, and compliance delisting the vault's own address blocked them too. The vault now checks the holder itself and returns the shares as the token's manager. The code now matches the decided rule in the strata-learning lock model (RedemptionEscrow.tla, ReturnShares): the holder's standing decides, not the vault's own allowlist place or the token pause. In a wind-down, a cancel still surrenders the escrow into the holder's slice.

Changes

• cancel_redeem and a claim that pays nothing check the receiver in the vault (its standing, then the compliance rules' can_transfer) and return the shares with forced_transfer
• New HolderNotEligible (6073) when the vault refuses a return: a delisted holder's zero-asset claim, or a move the compliance rules refuse
• Neither the vault's own allowlist place nor the share-token pause stops a return; a partial freeze stays on the returned shares
• COMPLIANCE_MATRIX, kit-spec (Invariants 5 to 7, the health table, the runbook), AUTHORIZATION_MATRIX, TESTING and the design doc's token-pause text and trust boundaries updated

Deviations

• Delisted and frozen cancels keep NotAllowlisted (6068) and Frozen (6071): the lock policy refuses them first. The plan's tests now expect those codes; compliance.rs is unchanged.
• deliver asks lock_policy::standing instead of a new eligibility::can_receive.
• In a wind-down a zero-asset claim burns its escrow, so 6073 never arises there.
• Two extra tests: rules refusing a return, a zero-asset claim under a token pause. settlement.rs expects 6073 instead of 304.
• The trust-boundary row fits the table's columns and cites no tests (share_controls.rs does not exist).
• Also fixed text this made false: kit-spec vault_unfrozen, the runbook, Invariant 7, a fixture comment and a deploy comment.

Acceptance criteria

• Delisting the vault no longer stops returns
• A delisted or frozen holder is still refused; a token pause no longer stops a return
• The wind-down surrender still applies: no shares come back in a wind-down

Test plan

Automated tests

1. CARGO_TARGET_DIR=<repo>/target SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2=1 nix develop -c cargo test --locked -p async-vault share_returns: 8 tests pass. Before the change five failed: 304 from the delisted vault, 1000 from the token pause (on a cancel and on a zero-asset claim), and 305 or 304 where 6073 is expected.
2. The workspace: async-vault 379, compliance 29, nav-oracle 80, share-token 64, timelock 19, identity-verifier 6 and storage 6 pass. After building the Wasm, --features upgrade_wasm with_wasm passes 5 + 2.
3. On a fresh local network, npm run deploy -w scripts/harness, then test:happy-path (24/24), test:guards (48/48) and test:wind-down (6/6) pass. The guards' cancel after a NAV pause runs the new return path on the Wasm build.

Manual verification

On the same network, after a fresh deploy, a throwaway script (not committed) checked both cases on the Wasm build. With the share token paused, cancel_redeem returned the 10 escrowed shares and a transfer between holders was refused with EnforcedPause. With the vault's address delisted, health().allowlisted read false and cancel_redeem returned the shares.

Breaking changes

• A delisted holder's zero-asset claim_redeem fails with HolderNotEligible (6073) instead of the token's 304. The console maps 304 for that claim (claimRedeemContractErrorReason in TransactionModal.tsx) and shows its generic refusal until it maps 6073.
• A return the compliance rules refuse fails with 6073 instead of the token's TransferNotCompliant (305).
• cancel_redeem and a zero-asset claim now succeed during a share-token pause, and while the vault's own address is delisted, instead of failing with EnforcedPause (1000) or 304. The console's share-token pause copy still says the pause stops "returns of escrowed shares" (pages/emergency.ts, TransactionModal.tsx).
• The vault's spec gains error 6073, so its client must be regenerated.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Oct 17, 2026 9:15pm UTC