[achiever2110]

This PR resolves the following assigned issues:

• closes Add multi-oracle quorum resolution with median aggregation and per-feed fallback #28

Multi-oracle quorum resolution: a market can commit to a set of Reflector-style feeds and settle on their median, with per-feed rejection instead of all-or-nothing.

Architecture

commitment (ResolutionSpec::PriceQuorum(QuorumPriceConfig) hashed into resolution_hash)
-> registration validation (register_quorum_spec -> reveal: assert_unconfigured, validate_rule, assert_matches_commitment, store_rule — the pipeline is unchanged, the new variant just flows through it)
-> per-feed try_ classification (Ok(normalized) | Unavailable | Stale | Invalid | Failed)
-> normalisation to max(threshold_decimals, max feed decimals) (capped at 18, checked_mul/checked_div only)
-> median by insertion sort (odd: middle; even: floored average of the two middle values)
-> spread guard (max - min) * 10_000 / median > max_deviation_bps -> FeedsDisagree (deliberately stricter than distance-from-median: one outlier among quorate feeds is a disagreement the median would hide)
-> events: one FeedRejected per non-Ok feed, then QuorumResolution, then the existing PriceResolution/PriceResolutionV2 pair via settle_price.

accepted.len() < min_responses returns QuorumNotReached without writing anything — retryability is the point; liveness-to-void stays out of scope (issue #31). Nothing per-feed is persisted; the whole resolution computes in one transaction. register_spec_v2 needs no change: the ResolutionSpecV2.rule envelope picks the new variant up automatically.

Validation at reveal time: 1 <= min_responses <= feeds.len() <= MAX_FEEDS; strict majority min_responses * 2 > feeds.len() (two disjoint subsets can never both meet quorum with conflicting answers on a retry); duplicate (reflector, asset) pairs rejected; threshold >= 0; max_staleness > 0; max_deviation_bps <= 10_000 (the issue's bound, kept); every decimals <= 18; and the threshold must normalise to the target scale without overflow.

Deviations from the issue text (all verified against develop@5ede00a first)

1. The isolation premise is already done. The issue says resolve_price uses a non-try_ call so a panicking feed aborts the transaction. At tip, read_feed (contracts/resolver/src/lib.rs:2124) already uses ReflectorPriceClient::try_price and maps every failure to PriceUnavailable; validate_price already returns StalePrice; outcome_for already applies the committed comparison. This PR does not reimplement that discipline — it reuses it per feed: the freshness predicate is factored verbatim into staleness_ok (called via validate_price and directly by classify_feed), and the comparison into outcome_at (called via outcome_for). The only new distinction is reporting: quorum separates a trap (Failed) from a missing record (Unavailable) so FeedRejected reasons are honest. Ok(Err(ConversionError)) classifies as Failed, never a panic.
2. There is no decimals() on the feed interface. ReflectorPrice (resolver lib.rs:625) exposes exactly price(env, asset, timestamp) -> Option<PriceData>; PriceData is { price, timestamp }. The issue's c.try_decimals() does not exist, and adding a decimals method to the trait would make every real Reflector deployment fail the call. Precision is instead declared by the creator inside the commitment: FeedRef { reflector, asset, decimals }, validated <= MAX_DECIMALS (18) and covered by the spec hash. A feed reporting an absurd scale is Invalid, never an overflow.
3. Blast radius, and where it turned out smaller than expected. The change spans oracledesk-types (appends), resolver (main work), and scripts/spec-hash (new price-quorum subcommand). The issue/guides expect new match arms in contracts/treasury/src/lib.rs:2931 and contracts/router/src/lib.rs:333 — but both matches already end in wildcard arms (_ => false at treasury:2939, _ => return Err(Error::UnsupportedRule) at router:343), so the new variant compiles unchanged there and is correctly rejected by both agent flows (quorum markets reveal through the resolver directly). No treasury/router edits are made; this also keeps the merge surface smaller.

Unrelated pre-existing tip breakage (NOT touched, NOT fixed)

At develop@5ede00a the resolver references three free functions that are defined nowhere in the crate: core_call (first use :929), registry_call (:2415), to_core_outcome (:1521). The resolver therefore does not compile on any toolchain at tip, independent of this PR. I did not repair it (out of scope per the sweep rules); resolve_quorum calls core_call with the same convention the existing 21 call sites use. Additionally cargo +stable check cannot even reach the resolver here: it dies earlier on 21 pre-existing oracledesk-types attribute-macro errors (banked evidence .bank/l145-gate-probe-stable.txt).

Acceptance criteria mapping

• committed feed set with median aggregation, per-feed rejection, strict-majority quorum, retryable failures — implemented as above.
• DataKey::Quorum(u64) included in assert_unconfigured (a quorum market cannot be re-revealed into another mode).
• FeedRejected + QuorumResolution events in the house #[contractevent] style.
• spec-hash CLI: price-quorum subcommand with verify support; feed grammar <reflector>:<asset>:<decimals>,... (first/last-colon split so stellar:/other: asset prefixes survive).
• listed tests authored: median odd/even (floored), panicking feed ignored, stale/None ignored with exact event sequence, QuorumNotReached retryable + writes nothing, FeedsDisagree, mixed decimals, outlier-does-not-move-median (plus spread guard rejects it), duplicate-feed / non-majority / over-MAX_FEEDS / decimals>18 / deviation>10_000 registration rejections, snapshot+pre-close+double-reveal guards, and legacy_specs_hash_unchanged_by_price_quorum_append in the golden module.
• Refused: vendored wasm regeneration. This host cannot build the workspace (toolchain pin from Replace vendored market_core.wasm with a deterministic build and hash-pinned import #58 + the breakage above); touching *.wasm/*.wasm.sha256 without a reproducible build would be worse than not touching them. Zero wasm files are in this diff (verified with git diff --name-only | grep -c '\.wasm' = 0).
• Refused: make bindings. No node_modules, codegen needs built wasm. Note the two new events and the new ResolutionSpec variant do change the interface spec: bindings regeneration is a required follow-up commit for someone with a working toolchain, before release.

Verification actually performed (and its honest limit)

No test was run — none can run on this host; every test above is authored only. Do not read anything below as "tests pass".

• cargo +stable fmt -- --check per crate, baseline on the untouched tip vs after: resolver 12 findings -> 12 (same 12, shifted lines; the content multiset of the findings is byte-identical to baseline), oracledesk-types 0 -> 0, spec-hash 2 -> 2 (identical content), router/treasury untouched. This also proves rustfmt parses every changed file — i.e. the additions are syntactically valid Rust. It demonstrates nothing stronger; type errors would only surface on a machine that can compile.
• grep -oE '= [0-9]+' over the resolver Error enum: no duplicate discriminants after appending 44/45.
• grep -rn 'ResolutionSpec::' contracts/ scripts/: every consumer re-audited (see deviation 3).
• bash -n scripts/seed-market.sh: OK (file unchanged; the new subcommand is additive to its grammar).
• MAX_FEEDS = 5 is reasoned, not measured: one try_price sub-call + O(n) bookkeeping per feed, the issue's own budget note puts n=5 with n-1 trapping feeds well under the instruction limit, and 5 sits at the conservative end of the issue's 5-7 suggestion. Residual risk disclosed in code comments: Soroban sub-calls have no isolated budget, so a committed malicious feed can burn the transaction budget — at worst this forces a retry or a guardian void, never a wrong outcome.

Enum tails appended (XDR append-only)

• resolver DataKey: Quorum(u64) after Snapshot(u64)
• resolver Error: QuorumNotReached = 44, FeedsDisagree = 45 after PendingAdminExpired = 43
• oracledesk-types ResolutionSpec: PriceQuorum(QuorumPriceConfig) after Hybrid(HybridConfig)

Tail collisions expected with our sibling PRs #184, #171, #237, #239, #240 which also append to these enums (this branch deliberately does not rebase onto them — it stands alone against develop@5ede00a8). Whichever merges later must re-append at the then-current tail; the resolver golden tests + this PR's legacy_specs_hash_unchanged_by_price_quorum_append are the drift tripwire.

Changes

• oracledesk-stellar/contracts/oracledesk-types/src/lib.rs: FeedRef, QuorumPriceConfig, ResolutionSpec::PriceQuorum (append-only), test extended.
• oracledesk-stellar/contracts/resolver/src/lib.rs: re-exports; MAX_FEEDS/MAX_DECIMALS/MAX_DEVIATION_BPS; Error 44/45; DataKey::Quorum; FeedRejectionReason + FeedRejected/QuorumResolution events; FeedState; register_quorum_spec; resolve_price quorum dispatch; classify_feed/normalize_price/quorum_target_decimals/insert_sorted/median/assert_spread/quorum_config_is_valid/resolve_quorum; staleness_ok/outcome_at factored out of validate_price/outcome_for (behaviour-preserving); validate_rule/store_rule/assert_unconfigured/price_config arms; MockReflector::set_panic; 14 tests + 1 golden test.
• oracledesk-stellar/scripts/spec-hash/src/lib.rs: parse_asset/parse_direction extraction, parse_price_quorum, price-quorum in USAGE/parse_rule, 4 CLI tests.

Frozen shapes respected: no field/variant reordered or removed anywhere; all additions are at enum tails or new items.