From 67f7f65637f31183c52336143b64218e964c739d Mon Sep 17 00:00:00 2001
From: CodingBabe-1 <Richardolajide1981@gmail.com>
Date: Tue, 29 Sep 2026 23:07:58 +0000
Subject: [PATCH 1/6] fix(server,frontend): repair CI breakage left by recent
 merges

main currently fails `tsc --noEmit` and 5 of 25 server suites, so any PR
against it is red regardless of its own changes. Repairs:

- services/stellar.ts declared getServerKeypair twice (TS2393), and the
  eager module-load key validation from #313 preempted the structured
  startup check from #383, making route tests unusable with a dummy key.
  Keep a single lazily-resolved, cached accessor; index.ts/validateEnv
  still owns boot-time validation, and startup now warns (non-fatally).
- token-revocation lookups added by authenticate() were not accounted for
  in the profile/trades route test mocks, shifting queued results (401s).
- createRatingSchema rejected an explicit `comment: null` that the route
  persists as null either way; accept nullish.
- virtualAccount.test.ts did not compile and raced fake timers against
  microtasks in two tests.
- three wallet modal tests queried ambiguous accessible names; the
  withdraw submit button now exposes a single accessible name while
  submitting.

No production behaviour changes beyond the schema/service repairs above.
---
 frontend/app/wallet/WithdrawModal.tsx       |  4 +
 frontend/app/wallet/depositCopy.test.tsx    | 18 ++--
 frontend/app/wallet/withdraw.test.tsx       |  4 +-
 server/src/routes/profile.test.ts           |  7 ++
 server/src/routes/trades.test.ts            |  5 +-
 server/src/schemas/ratings.schemas.ts       |  5 +-
 server/src/services/stellar-keypair.test.ts | 37 +++++---
 server/src/services/stellar.ts              | 99 ++++++++-------------
 server/src/services/virtualAccount.test.ts  | 15 +++-
 9 files changed, 106 insertions(+), 88 deletions(-)

diff --git a/frontend/app/wallet/WithdrawModal.tsx b/frontend/app/wallet/WithdrawModal.tsx
index 82d84dd..a1f6c50 100644
--- a/frontend/app/wallet/WithdrawModal.tsx
+++ b/frontend/app/wallet/WithdrawModal.tsx
@@ -494,6 +494,10 @@ export default function WithdrawModal({
           {/* Submit button */}
           <button
             type="submit"
+            // Explicit label while submitting: the spinner SVG carries
+            // aria-label="processing", and without this the button's accessible
+            // name would be read twice ("processing processing").
+            aria-label={isSubmitting ? t("processing") : undefined}
             disabled={
               isSubmitting ||
               !accountConfirmed ||
diff --git a/frontend/app/wallet/depositCopy.test.tsx b/frontend/app/wallet/depositCopy.test.tsx
index 6fea59c..fd15a6d 100644
--- a/frontend/app/wallet/depositCopy.test.tsx
+++ b/frontend/app/wallet/depositCopy.test.tsx
@@ -49,15 +49,21 @@ describe("CopyAccountNumberButton", () => {
   });
 
   it("confirms the copy for two seconds, then reverts", async () => {
+    // Fake timers must be installed *before* the click: the reset timeout is
+    // scheduled when the copy resolves, and a timeout created under real timers
+    // cannot be advanced by the fake clock afterwards.
+    jest.useFakeTimers();
+
     render(<CopyAccountNumberButton accountNumber={ACCOUNT_NUMBER} />);
     expect(copyButton()).toHaveTextContent("Copy");
 
-    fireEvent.click(copyButton());
-    await screen.findByText("Copied!");
-
-    // Switch to fake timers only once the async copy has settled, so the
-    // promise above is not waiting on a clock that no longer advances.
-    jest.useFakeTimers();
+    await act(async () => {
+      fireEvent.click(copyButton());
+      // Flush the mocked clipboard promise so the reset timer is scheduled.
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    expect(copyButton()).toHaveTextContent("Copied!");
 
     act(() => {
       jest.advanceTimersByTime(COPIED_FEEDBACK_MS - 1);
diff --git a/frontend/app/wallet/withdraw.test.tsx b/frontend/app/wallet/withdraw.test.tsx
index 1e20728..9e91e97 100644
--- a/frontend/app/wallet/withdraw.test.tsx
+++ b/frontend/app/wallet/withdraw.test.tsx
@@ -44,7 +44,9 @@ describe("WithdrawModal Available Balance and Max button", () => {
 
     fireEvent.click(maxButton);
 
-    const amountInput = screen.getByLabelText(/amount/i) as HTMLInputElement;
+    // Exact match: /amount/i would also match the "Max amount" button's
+    // aria-label, making the query ambiguous.
+    const amountInput = screen.getByLabelText("amount") as HTMLInputElement;
     expect(amountInput.value).toBe("10,000");
   });
 });
diff --git a/server/src/routes/profile.test.ts b/server/src/routes/profile.test.ts
index dcf8049..30bc038 100644
--- a/server/src/routes/profile.test.ts
+++ b/server/src/routes/profile.test.ts
@@ -41,6 +41,9 @@ describe("GET /api/v1/profile", () => {
   });
 
   it("returns 200 with profile data and non-empty referralCode", async () => {
+    // 0th query: authenticate's token-revocation check (token_version lookup).
+    mockQuery.mockResolvedValueOnce({ rows: [{ token_version: 1 }] });
+
     // 1st query: users
     mockQuery.mockResolvedValueOnce({
       rows: [
@@ -74,6 +77,10 @@ describe("GET /api/v1/profile", () => {
   });
 
   it("returns 404 when user is not found in database", async () => {
+    // 0th query: authenticate's token-revocation check (token_version lookup).
+    mockQuery.mockResolvedValueOnce({ rows: [{ token_version: 1 }] });
+
+    // 1st query: users (not found)
     mockQuery.mockResolvedValueOnce({ rows: [] });
 
     const res = await request(app)
diff --git a/server/src/routes/trades.test.ts b/server/src/routes/trades.test.ts
index ae890f9..ab11c98 100644
--- a/server/src/routes/trades.test.ts
+++ b/server/src/routes/trades.test.ts
@@ -97,13 +97,16 @@ describe("POST /api/v1/trades/:id/rate — issue #362: ratings survive account a
 
   // -------------------------------------------------------------------------
   // Helper: wire up mockQuery for a successful rating flow
-  // The mock receives calls in this order from the route handler:
+  // The mock receives calls in this order:
+  //   0. SELECT token_version FROM users ...      → authenticate() revocation check
   //   1. SELECT trade_offers WHERE id = $1       → completed trade row
   //   2. SELECT phone FROM users WHERE id = $1   → seller's phone / anon hash
   //   3. INSERT INTO ratings ...                 → new rating row
   // -------------------------------------------------------------------------
   function wireSuccessfulRating(sellerPhone: string) {
     mockQuery
+      // call 0 — authenticate() token-revocation check
+      .mockResolvedValueOnce({ rows: [{ token_version: 1 }] })
       // call 1 — load the trade
       .mockResolvedValueOnce({
         rows: [
diff --git a/server/src/schemas/ratings.schemas.ts b/server/src/schemas/ratings.schemas.ts
index 38c6ef1..7546391 100644
--- a/server/src/schemas/ratings.schemas.ts
+++ b/server/src/schemas/ratings.schemas.ts
@@ -2,7 +2,10 @@ import { z } from "zod";
 
 export const createRatingSchema = z.object({
   stars: z.number().int().min(1).max(5),
-  comment: z.string().max(300).optional(),
+  // `nullish` (not just optional): clients commonly serialise "no comment" as
+  // an explicit null in JSON, and the route persists `comment ?? null` either
+  // way, so an explicit null must not be rejected as a validation error.
+  comment: z.string().max(300).nullish(),
 });
 
 export type CreateRatingInput = z.infer<typeof createRatingSchema>;
diff --git a/server/src/services/stellar-keypair.test.ts b/server/src/services/stellar-keypair.test.ts
index d7f12ca..42fdea4 100644
--- a/server/src/services/stellar-keypair.test.ts
+++ b/server/src/services/stellar-keypair.test.ts
@@ -1,9 +1,14 @@
 /**
  * stellar-keypair.test.ts
  *
- * Fail-fast coverage for issue #313: the server signing key is validated
- * once at module load, so a missing/invalid STELLAR_SERVER_SECRET refuses
- * to boot instead of failing queued release jobs at runtime.
+ * Fail-fast coverage for issue #313: the server signing key is parsed and
+ * validated exactly once, so a missing/invalid STELLAR_SERVER_SECRET throws
+ * a clear error instead of failing queued release jobs at runtime.
+ *
+ * The key is resolved lazily (on first use) rather than as a module-load side
+ * effect: boot-time validation is owned by index.ts / config/validateEnv.ts
+ * (issue #383), and importing this module must not crash route tests that run
+ * without a real signing key configured.
  */
 
 describe('server keypair module load (#313)', () => {
@@ -34,20 +39,26 @@ describe('server keypair module load (#313)', () => {
     expect(mod.getServerKeypair().publicKey()).toBe(VALID_THROWAY_PUBLIC);
   });
 
-  it('refuses to load when the secret is missing', () => {
+  it('refuses to resolve the keypair when the secret is missing', () => {
     delete process.env[ENV_KEY];
-    expect(() => {
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      require('./stellar');
-    }).toThrow('STELLAR_SERVER_SECRET environment variable is not set');
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const mod = require('./stellar') as {
+      getServerKeypair: () => unknown;
+    };
+    expect(() => mod.getServerKeypair()).toThrow(
+      'STELLAR_SERVER_SECRET environment variable is not set'
+    );
   });
 
-  it('refuses to load when the secret is invalid', () => {
+  it('refuses to resolve the keypair when the secret is invalid', () => {
     process.env[ENV_KEY] =
       'SBXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';
-    expect(() => {
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      require('./stellar');
-    }).toThrow('STELLAR_SERVER_SECRET is invalid');
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const mod = require('./stellar') as {
+      getServerKeypair: () => unknown;
+    };
+    expect(() => mod.getServerKeypair()).toThrow(
+      'STELLAR_SERVER_SECRET is invalid'
+    );
   });
 });
diff --git a/server/src/services/stellar.ts b/server/src/services/stellar.ts
index fee3ba3..3fe9ab1 100644
--- a/server/src/services/stellar.ts
+++ b/server/src/services/stellar.ts
@@ -69,9 +69,16 @@ const sorobanServer = new SorobanRpc.Server(SOROBAN_RPC_URL, {
 });
 
 // ---------------------------------------------------------------------------
-// Server signing key (issue #313) — validated once at module load so a
-// missing/invalid secret fails server startup instead of failing queued
-// release jobs at runtime. Never exported; use getServerKeypair().
+// Server signing key (issue #313) — parsed and validated exactly once, on
+// first use, so a missing/invalid STELLAR_SERVER_SECRET surfaces as a clear
+// error instead of failing queued release jobs at runtime mid-flight.
+//
+// Deliberately *not* validated as a module-load side effect: boot-time
+// validation is owned by index.ts / config/validateEnv.ts (issue #383), which
+// reports every missing variable in one place and exits non-zero. Keeping this
+// module side-effect free also lets route tests import the app without a real
+// signing key configured. A non-fatal warning is still logged at startup (see
+// below) so a misconfigured deployment is visible in the boot logs.
 // ---------------------------------------------------------------------------
 
 function loadServerKeypair(): Keypair {
@@ -85,20 +92,41 @@ function loadServerKeypair(): Keypair {
     return Keypair.fromSecret(secret);
   } catch {
     throw new Error(
-      "STELLAR_SERVER_SECRET is invalid (not a decodable Stellar secret seed). Refusing to start."
+      "STELLAR_SERVER_SECRET is invalid (not a decodable Stellar secret seed)."
     );
   }
 }
 
-const serverKeypair = loadServerKeypair();
+let cachedServerKeypair: Keypair | null = null;
 
 /**
- * Internal accessor for the pre-validated server signing keypair.
- * The instance is intentionally not exported — call sites use this getter
- * so the secret-derived object never leaks into logs or responses.
+ * Internal accessor for the server signing keypair.
+ *
+ * The key is parsed and validated once and then cached; call sites use this
+ * getter so the secret-derived object never leaks into logs or responses.
  */
 export function getServerKeypair(): Keypair {
-  return serverKeypair;
+  if (!cachedServerKeypair) {
+    cachedServerKeypair = loadServerKeypair();
+  }
+  return cachedServerKeypair;
+}
+
+// Resolve (and validate) the server key as soon as this module loads so a
+// misconfigured deployment is visible in the startup logs immediately. This
+// only warns (never throws/exits) — index.ts's own REQUIRED_ENV_VARS check is
+// what actually fails startup for a missing STELLAR_SERVER_SECRET; this
+// mirrors the same non-fatal pattern used in config/contracts.ts for missing
+// contract IDs. Skipped under jest so test suites can import freely.
+const isTestEnv =
+  process.env["NODE_ENV"] === "test" || process.env["JEST_WORKER_ID"] !== undefined;
+
+if (!isTestEnv) {
+  try {
+    getServerKeypair();
+  } catch (err) {
+    console.warn(`[stellar] ${(err as Error).message}`);
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -230,59 +258,6 @@ export async function getWalletBalance(publicKey: string): Promise<string> {
   }
 }
 
-// ---------------------------------------------------------------------------
-// Server signing key — resolved and validated once, not on every call
-// ---------------------------------------------------------------------------
-//
-// `releasePayment` and `resolveDispute` both sign with the platform's admin
-// key. Previously each call re-read STELLAR_SERVER_SECRET from process.env
-// and re-validated it was present via `Keypair.fromSecret`, so a missing or
-// malformed key would only surface the first time a trade actually needed
-// releasing/resolving — in production, under live traffic — rather than at
-// startup. `getServerKeypair()` resolves and parses the key exactly once and
-// caches the result; every subsequent call reuses the cached Keypair instead
-// of touching the environment again.
-let cachedServerKeypair: Keypair | null = null;
-
-function getServerKeypair(): Keypair {
-  if (cachedServerKeypair) {
-    return cachedServerKeypair;
-  }
-
-  const serverSecret = process.env["STELLAR_SERVER_SECRET"];
-  if (!serverSecret) {
-    throw new Error("STELLAR_SERVER_SECRET environment variable is not set");
-  }
-
-  try {
-    cachedServerKeypair = Keypair.fromSecret(serverSecret);
-  } catch (err) {
-    throw new Error(
-      `STELLAR_SERVER_SECRET is not a valid Stellar secret key: ${(err as Error).message}`
-    );
-  }
-
-  return cachedServerKeypair;
-}
-
-const isTestEnv =
-  process.env["NODE_ENV"] === "test" || process.env["JEST_WORKER_ID"] !== undefined;
-
-// Resolve (and validate) the server key as soon as this module loads, rather
-// than waiting for the first releasePayment/resolveDispute call, so a
-// misconfigured deployment is visible in startup logs immediately. This only
-// warns (never throws/exits) — server/src/index.ts's own REQUIRED_ENV_VARS
-// check is what actually fails startup for a missing STELLAR_SERVER_SECRET;
-// this mirrors the same non-fatal pattern used in config/contracts.ts for
-// missing contract IDs.
-if (!isTestEnv) {
-  try {
-    getServerKeypair();
-  } catch (err) {
-    console.warn(`[stellar] ${(err as Error).message}`);
-  }
-}
-
 // ---------------------------------------------------------------------------
 /**
  * Calls the smart contract's `create_listing` function.
diff --git a/server/src/services/virtualAccount.test.ts b/server/src/services/virtualAccount.test.ts
index a66fd4c..9c3e7b6 100644
--- a/server/src/services/virtualAccount.test.ts
+++ b/server/src/services/virtualAccount.test.ts
@@ -89,7 +89,9 @@ describe("virtualAccount Paystack timeout", () => {
     installHangingFetch();
 
     const promise = createDedicatedVirtualAccount("user-1", "cus_123");
-    const assertion = promise.catch((err: unknown) => err as PaystackTimeoutError);
+    // `.catch()` unions the reject handler's return type with the fulfilled
+    // type, so annotate the resulting promise to keep the error typed.
+    const assertion = promise.catch((err: unknown) => err) as Promise<PaystackTimeoutError>;
 
     jest.advanceTimersByTime(PAYSTACK_TIMEOUT_MS);
 
@@ -110,7 +112,10 @@ describe("virtualAccount Paystack timeout", () => {
     const promise = ensurePaystackCustomer("user-1", "Ada Lovelace");
     const assertion = expect(promise).rejects.toBeInstanceOf(PaystackTimeoutError);
 
-    jest.advanceTimersByTime(PAYSTACK_TIMEOUT_MS);
+    // Async advance: the mocked DB lookups have to settle (and the hanging
+    // fetch's abort timer be installed) before the clock moves, otherwise the
+    // timeout fires before the request is ever in flight.
+    await jest.advanceTimersByTimeAsync(PAYSTACK_TIMEOUT_MS);
 
     await assertion;
   });
@@ -120,7 +125,7 @@ describe("virtualAccount Paystack timeout", () => {
     installHangingFetch();
 
     const promise = createDedicatedVirtualAccount("user-1", "cus_123");
-    const assertion = promise.catch((err: unknown) => err as PaystackTimeoutError);
+    const assertion = promise.catch((err: unknown) => err) as Promise<PaystackTimeoutError>;
 
     jest.advanceTimersByTime(1000);
 
@@ -138,7 +143,9 @@ describe("virtualAccount Paystack timeout", () => {
     const promise = createDedicatedVirtualAccount("user-1", "cus_123");
     const assertion = promise.catch((err: unknown) => err);
 
-    jest.advanceTimersByTime(PAYSTACK_TIMEOUT_MS);
+    // Async advance so the already-rejected fetch is processed first; a
+    // synchronous advance would let the timeout fire and mask the real error.
+    await jest.advanceTimersByTimeAsync(PAYSTACK_TIMEOUT_MS);
 
     await expect(assertion).resolves.toBe(networkErr);
   });

From 53f24d0d3cb66eea695de934de2e024649125cff Mon Sep 17 00:00:00 2001
From: CodingBabe-1 <Richardolajide1981@gmail.com>
Date: Wed, 30 Sep 2026 02:54:53 +0000
Subject: [PATCH 2/6] chore(ci): refresh pnpm-lock.yaml specifiers for the
 frontend workspace

Both Frontend CI and Server CI start with `pnpm install --frozen-lockfile`,
which now fails with ERR_PNPM_OUTDATED_LOCKFILE because frontend/package.json
added @axe-core/playwright and @storybook/addon-a11y while the lockfile still
listed the removed storybook entry. Every workflow aborted at the install step
before reaching lint, type-check or tests, so no PR could be verified.

Regenerated with the repo's pinned pnpm 10.28.0; the diff is limited to the
three frontend dev-dependency specifiers and their transitive entries.
---
 pnpm-lock.yaml | 48 +++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 45 insertions(+), 3 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a101005..169d264 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -67,9 +67,15 @@ importers:
         specifier: 18.3.1
         version: 18.3.1(react@18.3.1)
     devDependencies:
+      '@axe-core/playwright':
+        specifier: ^4.10.2
+        version: 4.13.0(playwright-core@1.62.1)
       '@playwright/test':
         specifier: ^1.62.1
         version: 1.62.1
+      '@storybook/addon-a11y':
+        specifier: ^8.2.9
+        version: 8.6.18(storybook@8.6.18)
       '@storybook/addon-essentials':
         specifier: ^8.2.9
         version: 8.6.14(@types/react@18.3.3)(storybook@8.6.18)
@@ -133,9 +139,6 @@ importers:
       postcss:
         specifier: 8.4.39
         version: 8.4.39
-      storybook:
-        specifier: ^8.2.9
-        version: 8.6.18
       tailwindcss:
         specifier: 3.4.4
         version: 3.4.4(ts-node@10.9.2(@swc/core@1.16.1)(@types/node@20.14.9)(typescript@5.5.3))
@@ -293,6 +296,11 @@ packages:
     peerDependencies:
       zod: ^3.20.2
 
+  '@axe-core/playwright@4.13.0':
+    resolution: {integrity: sha512-6YLx+kxXu5GJceG4ozFg+33a2EMTdjYwWGloJ3sb9Kta5pp+ZNS53uxGVog5JetIY8s++P5UrtX+cri+u0VAVg==}
+    peerDependencies:
+      playwright-core: '>= 1.0.0'
+
   '@babel/code-frame@7.29.7':
     resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
     engines: {node: '>=6.9.0'}
@@ -2351,6 +2359,11 @@ packages:
   '@stellar/stellar-sdk@12.3.0':
     resolution: {integrity: sha512-F2DYFop/M5ffXF0lvV5Ezjk+VWNKg0QDX8gNhwehVU3y5LYA3WAY6VcCarMGPaG9Wdgoeh1IXXzOautpqpsltw==}
 
+  '@storybook/addon-a11y@8.6.18':
+    resolution: {integrity: sha512-LFvudttdIfDTNWprA8/N1vbiWbJRrNscyt2OP9Qwi85E1d3LKLy+e8AWiqY08gpy2OUYujK7AjxfpKtNeddrxw==}
+    peerDependencies:
+      storybook: ^8.6.18
+
   '@storybook/addon-actions@8.6.14':
     resolution: {integrity: sha512-mDQxylxGGCQSK7tJPkD144J8jWh9IU9ziJMHfB84PKpI/V5ZgqMDnpr2bssTrUaGDqU5e1/z8KcRF+Melhs9pQ==}
     peerDependencies:
@@ -2381,6 +2394,11 @@ packages:
     peerDependencies:
       storybook: ^8.6.14
 
+  '@storybook/addon-highlight@8.6.18':
+    resolution: {integrity: sha512-wTFJ1DPM0C8gK6nGTJxH75byayQj7BPAz02fME4AOmT6clrBpVl1zSTFTkXaSr+k4xOfeMR/xNUfVskaXz6T9w==}
+    peerDependencies:
+      storybook: ^8.6.18
+
   '@storybook/addon-interactions@8.6.14':
     resolution: {integrity: sha512-8VmElhm2XOjh22l/dO4UmXxNOolGhNiSpBcls2pqWSraVh4a670EyYBZsHpkXqfNHo2YgKyZN3C91+9zfH79qQ==}
     peerDependencies:
@@ -3310,6 +3328,10 @@ packages:
     resolution: {integrity: sha512-LEUDjgmdJoA3LqklSTwKYqkjcZ4HKc4ddIYGSAiSkr46NTjzg2L9RNB+lekO9P7Dlpa87+hBtzc2Fzn/+GUWMQ==}
     engines: {node: '>=4'}
 
+  axe-core@4.13.0:
+    resolution: {integrity: sha512-UzGt8zg7Ny8djbYMhxl2zuEevVa7r2gJjYY5Lwr1xM7+XU2nd6CkIWFTVcCIbAP63vSz71NaVyyuSk9lHKcy0A==}
+    engines: {node: '>=4'}
+
   axe-core@4.9.1:
     resolution: {integrity: sha512-QbUdXJVTpvUTHU7871ppZkdOLBeGUKBQWHkHrvN2V9IQWGMt61zf3B45BtzjxEJzYuj0JBjBZP/hmYS/R9pmAw==}
     engines: {node: '>=4'}
@@ -7859,6 +7881,11 @@ snapshots:
       openapi3-ts: 4.6.1
       zod: 3.23.8
 
+  '@axe-core/playwright@4.13.0(playwright-core@1.62.1)':
+    dependencies:
+      axe-core: 4.13.0
+      playwright-core: 1.62.1
+
   '@babel/code-frame@7.29.7':
     dependencies:
       '@babel/helper-validator-identifier': 7.29.7
@@ -10363,6 +10390,14 @@ snapshots:
       - debug
       - supports-color
 
+  '@storybook/addon-a11y@8.6.18(storybook@8.6.18)':
+    dependencies:
+      '@storybook/addon-highlight': 8.6.18(storybook@8.6.18)
+      '@storybook/global': 5.0.0
+      '@storybook/test': 8.6.18(storybook@8.6.18)
+      axe-core: 4.9.1
+      storybook: 8.6.18
+
   '@storybook/addon-actions@8.6.14(storybook@8.6.18)':
     dependencies:
       '@storybook/global': 5.0.0
@@ -10420,6 +10455,11 @@ snapshots:
       '@storybook/global': 5.0.0
       storybook: 8.6.18
 
+  '@storybook/addon-highlight@8.6.18(storybook@8.6.18)':
+    dependencies:
+      '@storybook/global': 5.0.0
+      storybook: 8.6.18
+
   '@storybook/addon-interactions@8.6.14(storybook@8.6.18)':
     dependencies:
       '@storybook/global': 5.0.0
@@ -11556,6 +11596,8 @@ snapshots:
 
   axe-core@3.5.6: {}
 
+  axe-core@4.13.0: {}
+
   axe-core@4.9.1: {}
 
   axios@1.19.0:

From b6351c89974454866d722bddc39f0ed5f775b654 Mon Sep 17 00:00:00 2001
From: CodingBabe-1 <Richardolajide1981@gmail.com>
Date: Wed, 30 Sep 2026 03:06:41 +0000
Subject: [PATCH 3/6] ci(server): drop the Vitest-only --run flag from the
 Server CI test step

`pnpm test -- --run --json --outputFile=test-results.json` expands to
`jest --runInBand --forceExit --run ...`, and Jest 29 rejects `--run` with
"Unrecognized CLI Parameter" before executing any suite. No test-results.json
was produced, so the JUnit conversion step failed with ENOENT and the job went
red without ever running the tests it exists to run.

Verified locally with the CI environment (NODE_ENV=test, .env.test): 27 suites
/ 198 tests execute and test-results.xml is written.
---
 .github/workflows/server-ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/server-ci.yml b/.github/workflows/server-ci.yml
index 5ee7027..88c9ec2 100644
--- a/.github/workflows/server-ci.yml
+++ b/.github/workflows/server-ci.yml
@@ -64,7 +64,10 @@ jobs:
           NODE_ENV: test
           DOTENV_CONFIG_PATH: .env.test
           NODE_OPTIONS: --require=dotenv/config
-        run: pnpm test -- --run --json --outputFile=test-results.json
+        # `--run` is a Vitest flag; Jest 29 aborts with "Unrecognized option
+        # \"run\"" before running a single suite, so no test-results.json was
+        # written and the JUnit conversion below failed on the missing file.
+        run: pnpm test -- --json --outputFile=test-results.json
 
       - name: Convert Jest results to JUnit XML
         if: always()

From cd05e7f797860b49796a88ac8a4859e24ce0240c Mon Sep 17 00:00:00 2001
From: CodingBabe-1 <Richardolajide1981@gmail.com>
Date: Wed, 30 Sep 2026 04:01:14 +0000
Subject: [PATCH 4/6] fix(contracts): repair the contract build, tests and
 formatting for soroban-sdk

`main` cannot build its own contracts: escrow references three undefined event
helpers (`topic_token`, `topic_allowed`, `topic_removed`) and a
`DataKey::LastPauseAt` variant that does not exist, and `pause()` reads a `now`
scoped to the branch above it. Both test suites were written for an older
soroban-sdk (`try_*` used to return the contract error in the inner `Err`,
`StellarAssetClient` exposed `balance`, `mock_invoke` existed, and `vec!` had
to be imported), so neither crate's tests compiled either.

Makes the workspace build and its tests run again:
- escrow lib: define the missing topics, use the existing `DataKey::PausedAt`
  as the pause timestamp/cooldown source, hoist `now` out of the branch.
- both test modules: migrate to the soroban-sdk 22 `try_*` shape
  (`Err(Ok(ContractError::..))`), read balances through `token::Client`, use
  `env.set_auths(&[])`/`MockAuthInvoke` instead of `mock_invoke`,
  `env.register(..)` instead of the deprecated `register_contract`, import
  `vec!`, and derive `PartialEq` for `TradeOffer`/`Listing` so the error
  assertions type-check.
- regroup the integer literals clippy rejects, and fix the
  `test_err_fill_already_processed` setup so the double release it asserts is
  reachable (a fully released single-fill trade is Completed, so the old setup
  could only return WrongStatus).
- apply `cargo fmt --all` so the `Check formatting` gate passes.

Verified with the host target (the crate's `.cargo/config.toml` targets wasm):
fmt --check, clippy -D warnings, the wasm release build and 67 tests all pass.
---
 contracts/escrow/src/lib.rs      | 296 +++++++++++++++++--------------
 contracts/marketplace/src/lib.rs | 181 +++++++++++--------
 2 files changed, 262 insertions(+), 215 deletions(-)

diff --git a/contracts/escrow/src/lib.rs b/contracts/escrow/src/lib.rs
index 4751ca9..e433c14 100644
--- a/contracts/escrow/src/lib.rs
+++ b/contracts/escrow/src/lib.rs
@@ -4,8 +4,8 @@
 extern crate alloc;
 
 use soroban_sdk::{
-    contract, contractimpl, contracttype, contracterror, symbol_short,
-    token, Address, Env, Symbol, Vec,
+    contract, contracterror, contractimpl, contracttype, symbol_short, token, Address, Env, Symbol,
+    Vec,
 };
 
 // ---------------------------------------------------------------------------
@@ -42,16 +42,16 @@ pub enum TradeStatus {
 }
 
 #[contracttype]
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, PartialEq)]
 pub struct TradeOffer {
     pub id: u64,
     pub seller: Address,
-    pub token: Address,       // USDC or NGNC contract address
-    pub total_amount: i128,   // total token amount in stroops
-    pub filled_amount: i128,  // filled token amount in stroops
-    pub asset_type: Symbol,   // e.g. symbol_short!("AIRTIME")
+    pub token: Address,      // USDC or NGNC contract address
+    pub total_amount: i128,  // total token amount in stroops
+    pub filled_amount: i128, // filled token amount in stroops
+    pub asset_type: Symbol,  // e.g. symbol_short!("AIRTIME")
     pub status: TradeStatus,
-    pub expires_at: u64,      // Unix timestamp (ledger time)
+    pub expires_at: u64, // Unix timestamp (ledger time)
 }
 
 #[contracttype]
@@ -76,20 +76,20 @@ pub struct SubEscrow {
 #[contracterror]
 #[derive(Clone, Debug, PartialEq)]
 pub enum ContractError {
-    AlreadyInitialized   = 1,
-    Unauthorized         = 2,
-    TradeNotFound        = 3,
-    WrongStatus          = 4,
-    TradeExpired         = 5,
-    InsufficientFunds    = 6,
-    InvalidExpiry        = 7,
-    AlreadyDisputed      = 8,
-    ContractPaused       = 9,
-    TimelockNotExpired   = 10,
-    UnsupportedToken     = 11,
-    InvalidAmount        = 12,
+    AlreadyInitialized = 1,
+    Unauthorized = 2,
+    TradeNotFound = 3,
+    WrongStatus = 4,
+    TradeExpired = 5,
+    InsufficientFunds = 6,
+    InvalidExpiry = 7,
+    AlreadyDisputed = 8,
+    ContractPaused = 9,
+    TimelockNotExpired = 10,
+    UnsupportedToken = 11,
+    InvalidAmount = 12,
     FillAlreadyProcessed = 13,
-    NotAParty            = 14,
+    NotAParty = 14,
     PauseCooldownNotExpired = 15,
 }
 
@@ -101,14 +101,39 @@ pub enum ContractError {
 // characters (e.g. "completed" and "cancelled" are exactly 9 chars, at the limit).
 // Any topic strings approaching or exceeding 9 characters must use `Symbol::new(env, "...")`
 // to avoid compile-time macro panics.
-fn topic_created()   -> Symbol { symbol_short!("created")   } // 7 chars
-fn topic_locked()    -> Symbol { symbol_short!("locked")    } // 6 chars
-fn topic_completed() -> Symbol { symbol_short!("completed") } // 9 chars (max limit for symbol_short!)
-fn topic_cancelled() -> Symbol { symbol_short!("cancelled") } // 9 chars (max limit for symbol_short!)
-fn topic_disputed()  -> Symbol { symbol_short!("disputed")  } // 8 chars
-fn topic_contract()  -> Symbol { symbol_short!("contract")  } // 8 chars
-fn topic_paused()    -> Symbol { symbol_short!("paused")    } // 6 chars
-fn topic_unpaused()  -> Symbol { symbol_short!("unpaused")  } // 8 chars
+fn topic_created() -> Symbol {
+    symbol_short!("created")
+} // 7 chars
+fn topic_locked() -> Symbol {
+    symbol_short!("locked")
+} // 6 chars
+fn topic_completed() -> Symbol {
+    symbol_short!("completed")
+} // 9 chars (max limit for symbol_short!)
+fn topic_cancelled() -> Symbol {
+    symbol_short!("cancelled")
+} // 9 chars (max limit for symbol_short!)
+fn topic_disputed() -> Symbol {
+    symbol_short!("disputed")
+} // 8 chars
+fn topic_contract() -> Symbol {
+    symbol_short!("contract")
+} // 8 chars
+fn topic_paused() -> Symbol {
+    symbol_short!("paused")
+} // 6 chars
+fn topic_unpaused() -> Symbol {
+    symbol_short!("unpaused")
+} // 8 chars
+fn topic_token() -> Symbol {
+    symbol_short!("token")
+} // 5 chars
+fn topic_allowed() -> Symbol {
+    symbol_short!("allowed")
+} // 7 chars
+fn topic_removed() -> Symbol {
+    symbol_short!("removed")
+} // 7 chars
 
 // ---------------------------------------------------------------------------
 // Internal helpers
@@ -160,7 +185,9 @@ impl EscrowContract {
         env.storage().instance().set(&DataKey::Admin, &admin);
         env.storage().instance().set(&DataKey::TradeCounter, &0u64);
         env.storage().instance().set(&DataKey::Paused, &false);
-        env.storage().instance().set(&DataKey::LastPauseAt, &0u64);
+        // `PausedAt` doubles as "the moment we entered the paused state": 0
+        // means the contract has never been paused, so no cooldown applies.
+        env.storage().instance().set(&DataKey::PausedAt, &0u64);
         for token in allowed_tokens.iter() {
             env.storage()
                 .instance()
@@ -187,16 +214,15 @@ impl EscrowContract {
             .get(&DataKey::Paused)
             .unwrap_or(false);
 
+        let now = env.ledger().timestamp();
+
         if !is_already_paused {
-            let now = env.ledger().timestamp();
             env.storage().instance().set(&DataKey::PausedAt, &now);
         }
 
         env.storage().instance().set(&DataKey::Paused, &true);
-        env.storage().instance().set(&DataKey::LastPauseAt, &now);
 
-        env.events()
-            .publish((topic_contract(), topic_paused()), ());
+        env.events().publish((topic_contract(), topic_paused()), ());
         Ok(())
     }
 
@@ -210,7 +236,7 @@ impl EscrowContract {
         let last_pause_at: u64 = env
             .storage()
             .instance()
-            .get(&DataKey::LastPauseAt)
+            .get(&DataKey::PausedAt)
             .unwrap_or(0);
 
         if last_pause_at > 0 && now < last_pause_at.saturating_add(PAUSE_COOLDOWN_SECONDS) {
@@ -276,9 +302,7 @@ impl EscrowContract {
             expires_at,
         };
 
-        env.storage()
-            .persistent()
-            .set(&DataKey::Trade(id), &trade);
+        env.storage().persistent().set(&DataKey::Trade(id), &trade);
         env.storage()
             .persistent()
             .extend_ttl(&DataKey::Trade(id), 17_280, 17_280 * 30);
@@ -413,8 +437,7 @@ impl EscrowContract {
             .persistent()
             .set(&DataKey::SubEscrow(trade_id, fill_id), &sub_escrow);
 
-        env.events()
-            .publish((topic_locked(),), (trade_id, buyer));
+        env.events().publish((topic_locked(),), (trade_id, buyer));
         Ok(())
     }
 
@@ -427,11 +450,7 @@ impl EscrowContract {
     /// The admin address (set at `initialize`) must authorise this call via
     /// `require_auth()`. In production the admin is the platform server signing
     /// key that verifies off-chain delivery before releasing escrow.
-    pub fn release_payment(
-        env: Env,
-        trade_id: u64,
-        fill_id: u64,
-    ) -> Result<(), ContractError> {
+    pub fn release_payment(env: Env, trade_id: u64, fill_id: u64) -> Result<(), ContractError> {
         require_not_paused(&env)?;
 
         let admin = get_admin(&env)?;
@@ -606,10 +625,7 @@ impl EscrowContract {
 
     /// Removes an unfilled listing after its expiry so its persistent storage
     /// can be reclaimed. Anyone may trigger this cleanup.
-    pub fn close_expired_listing(
-        env: Env,
-        trade_id: u64,
-    ) -> Result<(), ContractError> {
+    pub fn close_expired_listing(env: Env, trade_id: u64) -> Result<(), ContractError> {
         let mut trade: TradeOffer = env
             .storage()
             .persistent()
@@ -628,11 +644,8 @@ impl EscrowContract {
         env.storage()
             .persistent()
             .set(&DataKey::Trade(trade_id), &trade);
-        env.storage()
-            .persistent()
-            .remove(&DataKey::Trade(trade_id));
-        env.events()
-            .publish((topic_cancelled(),), (trade_id,));
+        env.storage().persistent().remove(&DataKey::Trade(trade_id));
+        env.events().publish((topic_cancelled(),), (trade_id,));
         Ok(())
     }
 
@@ -640,11 +653,7 @@ impl EscrowContract {
     // flag_dispute
     // -----------------------------------------------------------------------
 
-    pub fn flag_dispute(
-        env: Env,
-        caller: Address,
-        trade_id: u64,
-    ) -> Result<(), ContractError> {
+    pub fn flag_dispute(env: Env, caller: Address, trade_id: u64) -> Result<(), ContractError> {
         require_not_paused(&env)?;
         caller.require_auth();
 
@@ -813,9 +822,9 @@ impl EscrowContract {
 mod test {
     use super::*;
     use soroban_sdk::{
-        testutils::{Address as _, Ledger},
+        testutils::{Address as _, Ledger, MockAuth, MockAuthInvoke},
         token::{Client as TokenClient, StellarAssetClient},
-        Address, Env,
+        vec, Address, Env, IntoVal,
     };
 
     fn setup() -> (
@@ -829,7 +838,7 @@ mod test {
         let env = Env::default();
         env.mock_all_auths();
 
-        let contract_id = env.register_contract(None, EscrowContract);
+        let contract_id = env.register(EscrowContract, ());
         let client = EscrowContractClient::new(&env, &contract_id);
 
         let admin = Address::generate(&env);
@@ -841,7 +850,7 @@ mod test {
         let token_address = token_id.address();
         let sac = StellarAssetClient::new(&env, &token_address);
 
-        sac.mint(&buyer, &10_000_0000000i128);
+        sac.mint(&buyer, &100_000_000_000i128);
 
         let allowed_tokens = vec![&env, token_address.clone()];
         client.initialize(&admin, &allowed_tokens);
@@ -878,22 +887,11 @@ mod test {
         let (env, client, _admin, seller, _buyer, token) = setup();
         env.ledger().with_mut(|l| l.timestamp = 1_000_000);
 
-        let impersonator = Address::generate(&env);
         let expires_at = 1_000_000u64 + 86_400;
 
-        env.mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &impersonator,
-            invoke: &client.mock_invoke(
-                &client.create_listing,
-                (
-                    &seller,
-                    &token,
-                    &500_0000000i128,
-                    &symbol_short!("AIRTIME"),
-                    &expires_at,
-                ),
-            ),
-        }]);
+        // `set_auths(&[])` turns off the auth mocking `setup()` enabled, so the
+        // seller's `require_auth()` runs for real and has to fail.
+        env.set_auths(&[]);
 
         client.create_listing(
             &seller,
@@ -911,18 +909,23 @@ mod test {
 
         let expires_at = 1_000_000u64 + 86_400;
 
-        env.mock_auths(&[soroban_sdk::testutils::MockAuth {
+        // Only the seller's signature is mocked, so the listing can only be
+        // created if that auth satisfies `seller.require_auth()`.
+        env.mock_auths(&[MockAuth {
             address: &seller,
-            invoke: &client.mock_invoke(
-                &client.create_listing,
-                (
+            invoke: &MockAuthInvoke {
+                contract: &client.address,
+                fn_name: "create_listing",
+                args: (
                     &seller,
                     &token,
                     &500_0000000i128,
                     &symbol_short!("AIRTIME"),
                     &expires_at,
-                ),
-            ),
+                )
+                    .into_val(&env),
+                sub_invokes: &[],
+            },
         }]);
 
         let trade_id = client.create_listing(
@@ -973,15 +976,8 @@ mod test {
             &(1_000_000 + 86_400),
         );
 
-        let impersonator = Address::generate(&env);
-
-        env.mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &impersonator,
-            invoke: &client.mock_invoke(
-                &client.deposit_to_escrow,
-                (&buyer, &trade_id, &500_0000000i128),
-            ),
-        }]);
+        // No auth is provided, so the buyer's `require_auth()` cannot pass.
+        env.set_auths(&[]);
 
         client.deposit_to_escrow(&buyer, &trade_id, &500_0000000i128);
     }
@@ -999,12 +995,21 @@ mod test {
             &(1_000_000 + 86_400),
         );
 
-        env.mock_auths(&[soroban_sdk::testutils::MockAuth {
+        // Only the buyer's signature is mocked, so the deposit can only land if
+        // that auth covers both the root call and the token transfer it nests.
+        env.mock_auths(&[MockAuth {
             address: &buyer,
-            invoke: &client.mock_invoke(
-                &client.deposit_to_escrow,
-                (&buyer, &trade_id, &500_0000000i128),
-            ),
+            invoke: &MockAuthInvoke {
+                contract: &client.address,
+                fn_name: "deposit_to_escrow",
+                args: (&buyer, &trade_id, &500_0000000i128).into_val(&env),
+                sub_invokes: &[MockAuthInvoke {
+                    contract: &token,
+                    fn_name: "transfer",
+                    args: (&buyer, &client.address, &500_0000000i128).into_val(&env),
+                    sub_invokes: &[],
+                }],
+            },
         }]);
 
         client.deposit_to_escrow(&buyer, &trade_id, &500_0000000i128);
@@ -1105,7 +1110,7 @@ mod test {
         assert_eq!(trade.filled_amount, 0);
 
         let token_client = TokenClient::new(&env, &token);
-        assert_eq!(token_client.balance(&buyer), 10_000_0000000i128);
+        assert_eq!(token_client.balance(&buyer), 100_000_000_000i128);
     }
 
     #[test]
@@ -1129,7 +1134,7 @@ mod test {
         assert_eq!(trade.filled_amount, 0);
 
         let token_client = TokenClient::new(&env, &token);
-        assert_eq!(token_client.balance(&buyer), 10_000_0000000i128);
+        assert_eq!(token_client.balance(&buyer), 100_000_000_000i128);
     }
 
     #[test]
@@ -1148,7 +1153,10 @@ mod test {
         env.ledger().with_mut(|l| l.timestamp = 1_000_000 + 86_400);
         client.close_expired_listing(&trade_id);
 
-        assert_eq!(client.try_get_trade(&trade_id), Ok(Err(ContractError::TradeNotFound)));
+        assert_eq!(
+            client.try_get_trade(&trade_id),
+            Err(Ok(ContractError::TradeNotFound))
+        );
     }
 
     #[test]
@@ -1166,7 +1174,7 @@ mod test {
 
         let result = client.try_close_expired_listing(&trade_id);
 
-        assert_eq!(result, Ok(Err(ContractError::TradeExpired)));
+        assert_eq!(result, Err(Ok(ContractError::TradeExpired)));
         assert_eq!(client.get_trade(&trade_id).status, TradeStatus::Open);
     }
 
@@ -1187,7 +1195,7 @@ mod test {
 
         let result = client.try_close_expired_listing(&trade_id);
 
-        assert_eq!(result, Ok(Err(ContractError::WrongStatus)));
+        assert_eq!(result, Err(Ok(ContractError::WrongStatus)));
         assert_eq!(client.get_trade(&trade_id).status, TradeStatus::Locked);
     }
 
@@ -1201,14 +1209,14 @@ mod test {
         // setup() already called initialize; call it again
         let allowed = vec![&env, token.clone()];
         let result = client.try_initialize(&admin, &allowed);
-        assert_eq!(result, Ok(Err(ContractError::AlreadyInitialized)));
+        assert_eq!(result, Err(Ok(ContractError::AlreadyInitialized)));
     }
 
     #[test]
     fn test_err_trade_not_found() {
         let (_env, client, _admin, _seller, _buyer, _token) = setup();
         let result = client.try_get_trade(&999u64);
-        assert_eq!(result, Ok(Err(ContractError::TradeNotFound)));
+        assert_eq!(result, Err(Ok(ContractError::TradeNotFound)));
     }
 
     #[test]
@@ -1224,7 +1232,7 @@ mod test {
             &symbol_short!("AIRTIME"),
             &(1_000_000 + 86_400),
         );
-        assert_eq!(result, Ok(Err(ContractError::UnsupportedToken)));
+        assert_eq!(result, Err(Ok(ContractError::UnsupportedToken)));
     }
 
     #[test]
@@ -1238,7 +1246,7 @@ mod test {
             &symbol_short!("AIRTIME"),
             &(1_000_000 + 86_400),
         );
-        assert_eq!(result, Ok(Err(ContractError::InvalidAmount)));
+        assert_eq!(result, Err(Ok(ContractError::InvalidAmount)));
     }
 
     #[test]
@@ -1253,7 +1261,7 @@ mod test {
             &symbol_short!("AIRTIME"),
             &999_999u64,
         );
-        assert_eq!(result, Ok(Err(ContractError::InvalidExpiry)));
+        assert_eq!(result, Err(Ok(ContractError::InvalidExpiry)));
     }
 
     #[test]
@@ -1275,7 +1283,7 @@ mod test {
         let sac = StellarAssetClient::new(&env, &token);
         sac.mint(&buyer2, &500_0000000i128);
         let result = client.try_deposit_to_escrow(&buyer2, &trade_id, &100_0000000i128);
-        assert_eq!(result, Ok(Err(ContractError::WrongStatus)));
+        assert_eq!(result, Err(Ok(ContractError::WrongStatus)));
     }
 
     #[test]
@@ -1294,7 +1302,7 @@ mod test {
         env.ledger().with_mut(|l| l.timestamp = 1_000_000 + 86_401);
 
         let result = client.try_deposit_to_escrow(&buyer, &trade_id, &500_0000000i128);
-        assert_eq!(result, Ok(Err(ContractError::TradeExpired)));
+        assert_eq!(result, Err(Ok(ContractError::TradeExpired)));
     }
 
     #[test]
@@ -1311,7 +1319,7 @@ mod test {
         );
 
         let result = client.try_deposit_to_escrow(&buyer, &trade_id, &600_0000000i128);
-        assert_eq!(result, Ok(Err(ContractError::InsufficientFunds)));
+        assert_eq!(result, Err(Ok(ContractError::InsufficientFunds)));
     }
 
     #[test]
@@ -1328,7 +1336,7 @@ mod test {
         );
         // No deposit — trade is still Open
         let result = client.try_release_payment(&trade_id, &1);
-        assert_eq!(result, Ok(Err(ContractError::WrongStatus)));
+        assert_eq!(result, Err(Ok(ContractError::WrongStatus)));
     }
 
     #[test]
@@ -1343,12 +1351,15 @@ mod test {
             &symbol_short!("DATA"),
             &(1_000_000 + 86_400),
         );
-        client.deposit_to_escrow(&buyer, &trade_id, &500_0000000i128);
+        // A *partial* fill keeps the trade out of its terminal state once the
+        // fill settles, which is what makes a second release reach the
+        // already-processed guard instead of the terminal-state check.
+        client.deposit_to_escrow(&buyer, &trade_id, &200_0000000i128);
         // Release fill #1 once
         client.release_payment(&trade_id, &1);
         // Release same fill again — should fail
         let result = client.try_release_payment(&trade_id, &1);
-        assert_eq!(result, Ok(Err(ContractError::FillAlreadyProcessed)));
+        assert_eq!(result, Err(Ok(ContractError::FillAlreadyProcessed)));
     }
 
     #[test]
@@ -1366,7 +1377,7 @@ mod test {
         client.deposit_to_escrow(&buyer, &trade_id, &500_0000000i128);
         // Buyer tries to cancel before expiry
         let result = client.try_cancel_and_refund(&buyer, &trade_id);
-        assert_eq!(result, Ok(Err(ContractError::TimelockNotExpired)));
+        assert_eq!(result, Err(Ok(ContractError::TimelockNotExpired)));
     }
 
     #[test]
@@ -1384,7 +1395,7 @@ mod test {
         client.deposit_to_escrow(&buyer, &trade_id, &500_0000000i128);
         // Seller is not a buyer and not admin — should get Unauthorized
         let result = client.try_cancel_and_refund(&seller, &trade_id);
-        assert_eq!(result, Ok(Err(ContractError::Unauthorized)));
+        assert_eq!(result, Err(Ok(ContractError::Unauthorized)));
     }
 
     #[test]
@@ -1404,7 +1415,7 @@ mod test {
         client.flag_dispute(&seller, &trade_id);
         // Second flag on already-Disputed trade
         let result = client.try_flag_dispute(&buyer, &trade_id);
-        assert_eq!(result, Ok(Err(ContractError::AlreadyDisputed)));
+        assert_eq!(result, Err(Ok(ContractError::AlreadyDisputed)));
     }
 
     #[test]
@@ -1423,7 +1434,7 @@ mod test {
 
         let stranger = Address::generate(&env);
         let result = client.try_flag_dispute(&stranger, &trade_id);
-        assert_eq!(result, Ok(Err(ContractError::NotAParty)));
+        assert_eq!(result, Err(Ok(ContractError::NotAParty)));
     }
 
     #[test]
@@ -1440,7 +1451,7 @@ mod test {
             &symbol_short!("AIRTIME"),
             &(1_000_000 + 86_400),
         );
-        assert_eq!(result, Ok(Err(ContractError::ContractPaused)));
+        assert_eq!(result, Err(Ok(ContractError::ContractPaused)));
     }
 
     #[test]
@@ -1451,7 +1462,7 @@ mod test {
         client.pause();
 
         let result = client.try_unpause();
-        assert_eq!(result, Ok(Err(ContractError::PauseCooldownNotExpired)));
+        assert_eq!(result, Err(Ok(ContractError::PauseCooldownNotExpired)));
     }
 
     #[test]
@@ -1470,11 +1481,11 @@ mod test {
     fn test_err_unauthorized_get_admin_uninitialised() {
         let env = Env::default();
         env.mock_all_auths();
-        let contract_id = env.register_contract(None, EscrowContract);
+        let contract_id = env.register(EscrowContract, ());
         let client = EscrowContractClient::new(&env, &contract_id);
         // Contract not initialised — get_admin should return Unauthorized
         let result = client.try_get_admin();
-        assert_eq!(result, Ok(Err(ContractError::Unauthorized)));
+        assert_eq!(result, Err(Ok(ContractError::Unauthorized)));
     }
 
     #[test]
@@ -1535,8 +1546,8 @@ mod fuzz {
     use super::*;
     use soroban_sdk::{
         testutils::{Address as _, Ledger},
-        token::StellarAssetClient,
-        Address, Env,
+        token::{Client as TokenClient, StellarAssetClient},
+        vec, Address, Env,
     };
 
     /// Minimal deterministic PRNG (xorshift64).
@@ -1565,11 +1576,17 @@ mod fuzz {
         }
     }
 
-    fn setup() -> (Env, EscrowContractClient<'static>, Address, Address, Address) {
+    fn setup() -> (
+        Env,
+        EscrowContractClient<'static>,
+        Address,
+        Address,
+        Address,
+    ) {
         let env = Env::default();
         env.mock_all_auths();
 
-        let contract_id = env.register_contract(None, EscrowContract);
+        let contract_id = env.register(EscrowContract, ());
         let client = EscrowContractClient::new(&env, &contract_id);
 
         let admin = Address::generate(&env);
@@ -1600,7 +1617,7 @@ mod fuzz {
             env.ledger().with_mut(|l| l.timestamp = 1_000_000);
 
             // Random total amount: 1 stroop up to ~10,000 XLM in stroops.
-            let total_amount = rng.range_i128(1, 100_000_0000000i128);
+            let total_amount = rng.range_i128(1, 1_000_000_000_000i128);
 
             let trade_id = client.create_listing(
                 &seller,
@@ -1644,11 +1661,11 @@ mod fuzz {
             // error rather than panicking or wrapping.
             let remaining = total_amount - running_filled;
             if remaining < total_amount {
-                let overfill = remaining + rng.range_i128(1, 1_000_000_0000000i128);
+                let overfill = remaining + rng.range_i128(1, 10_000_000_000_000i128);
                 let buyer = Address::generate(&env);
                 sac.mint(&buyer, &overfill);
                 let result = client.try_deposit_to_escrow(&buyer, &trade_id, &overfill);
-                assert_eq!(result, Ok(Err(ContractError::InsufficientFunds)));
+                assert_eq!(result, Err(Ok(ContractError::InsufficientFunds)));
             }
 
             let final_trade = client.get_trade(&trade_id);
@@ -1670,7 +1687,7 @@ mod fuzz {
             let (env, client, admin, seller, token) = setup();
             env.ledger().with_mut(|l| l.timestamp = 1_000_000);
 
-            let total_amount = rng.range_i128(3, 90_000_0000000i128);
+            let total_amount = rng.range_i128(3, 900_000_000_000i128);
             let trade_id = client.create_listing(
                 &seller,
                 &token,
@@ -1713,19 +1730,24 @@ mod fuzz {
 
         let sac = StellarAssetClient::new(&env, &token);
         let contract_addr = client.address.clone();
-        sac.mint(&contract_addr, &1_000_0000000i128);
+        sac.mint(&contract_addr, &10_000_000_000i128);
 
         client.pause();
 
         // Advance ledger time past 72 hours
-        env.ledger().with_mut(|l| l.timestamp = 1_000_000 + EMERGENCY_TIMELOCK_SECS + 1);
+        env.ledger()
+            .with_mut(|l| l.timestamp = 1_000_000 + EMERGENCY_TIMELOCK_SECS + 1);
 
         let recipient = Address::generate(&env);
-        let initial_balance = sac.balance(&recipient);
+        let token_client = TokenClient::new(&env, &token);
+        let initial_balance = token_client.balance(&recipient);
 
         client.emergency_withdraw(&token, &recipient, &500_0000000i128);
 
-        assert_eq!(sac.balance(&recipient), initial_balance + 500_0000000i128);
+        assert_eq!(
+            token_client.balance(&recipient),
+            initial_balance + 500_0000000i128
+        );
     }
 
     #[test]
@@ -1734,7 +1756,7 @@ mod fuzz {
         env.ledger().with_mut(|l| l.timestamp = 1_000_000);
 
         let sac = StellarAssetClient::new(&env, &token);
-        sac.mint(&client.address, &1_000_0000000i128);
+        sac.mint(&client.address, &10_000_000_000i128);
 
         client.pause();
 
@@ -1743,7 +1765,7 @@ mod fuzz {
 
         let recipient = Address::generate(&env);
         let result = client.try_emergency_withdraw(&token, &recipient, &500_0000000i128);
-        assert_eq!(result, Ok(Err(ContractError::TimelockNotExpired)));
+        assert_eq!(result, Err(Ok(ContractError::TimelockNotExpired)));
     }
 
     #[test]
@@ -1752,10 +1774,10 @@ mod fuzz {
         env.ledger().with_mut(|l| l.timestamp = 1_000_000);
 
         let sac = StellarAssetClient::new(&env, &token);
-        sac.mint(&client.address, &1_000_0000000i128);
+        sac.mint(&client.address, &10_000_000_000i128);
 
         let recipient = Address::generate(&env);
         let result = client.try_emergency_withdraw(&token, &recipient, &500_0000000i128);
-        assert_eq!(result, Ok(Err(ContractError::WrongStatus)));
+        assert_eq!(result, Err(Ok(ContractError::WrongStatus)));
     }
 }
diff --git a/contracts/marketplace/src/lib.rs b/contracts/marketplace/src/lib.rs
index 044adbc..6b086b3 100644
--- a/contracts/marketplace/src/lib.rs
+++ b/contracts/marketplace/src/lib.rs
@@ -2,8 +2,7 @@
 #![allow(clippy::too_many_arguments)]
 
 use soroban_sdk::{
-    contract, contractimpl, contracttype, contracterror, symbol_short,
-    token, Address, Env, Symbol,
+    contract, contracterror, contractimpl, contracttype, symbol_short, token, Address, Env, Symbol,
 };
 
 // ---------------------------------------------------------------------------
@@ -48,18 +47,18 @@ pub enum AssetCategory {
 }
 
 #[contracttype]
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, PartialEq)]
 pub struct Listing {
     pub id: u64,
     pub seller: Address,
-    pub token: Address,        // payment token (e.g. USDC / NGNC)
-    pub price: i128,           // price in base token units
+    pub token: Address, // payment token (e.g. USDC / NGNC)
+    pub price: i128,    // price in base token units
     pub asset_category: AssetCategory,
-    pub asset_type: Symbol,    // e.g. symbol_short!("MTN")
-    pub quantity: i128,        // units of airtime/data being sold
+    pub asset_type: Symbol, // e.g. symbol_short!("MTN")
+    pub quantity: i128,     // units of airtime/data being sold
     pub status: ListingStatus,
-    pub created_at: u64,       // ledger timestamp
-    pub expires_at: u64,       // listing expiry
+    pub created_at: u64, // ledger timestamp
+    pub expires_at: u64, // listing expiry
     /// Set by deposit_to_escrow once a buyer locks funds. Used by
     /// resolve_dispute to confirm a recipient is actually a party to the
     /// trade before funds are moved to them.
@@ -86,20 +85,20 @@ pub struct Reputation {
 #[contracterror]
 #[derive(Clone, Debug, PartialEq)]
 pub enum ContractError {
-    AlreadyInitialized   = 1,
-    Unauthorized         = 2,
-    TradeNotFound        = 3,
-    WrongStatus          = 4,
-    TradeExpired         = 5,
-    InsufficientFunds    = 6,
-    InvalidExpiry        = 7,
-    AlreadyDisputed      = 8,
-    ContractPaused       = 9,
-    TimelockNotExpired   = 10,
-    UnsupportedToken     = 11,
-    InvalidAmount        = 12,
+    AlreadyInitialized = 1,
+    Unauthorized = 2,
+    TradeNotFound = 3,
+    WrongStatus = 4,
+    TradeExpired = 5,
+    InsufficientFunds = 6,
+    InvalidExpiry = 7,
+    AlreadyDisputed = 8,
+    ContractPaused = 9,
+    TimelockNotExpired = 10,
+    UnsupportedToken = 11,
+    InvalidAmount = 12,
     FillAlreadyProcessed = 13,
-    NotAParty            = 14,
+    NotAParty = 14,
 }
 
 // ---------------------------------------------------------------------------
@@ -110,13 +109,27 @@ pub enum ContractError {
 // characters (e.g. "cancelled" is exactly 9 chars, at the limit).
 // Any topic strings approaching or exceeding 9 characters must use `Symbol::new(env, "...")`
 // to avoid compile-time macro panics.
-fn topic_listed()    -> Symbol { symbol_short!("listed")    } // 6 chars
-fn topic_sold()      -> Symbol { symbol_short!("sold")      } // 4 chars
-fn topic_cancelled() -> Symbol { symbol_short!("cancelled") } // 9 chars (max limit for symbol_short!)
-fn topic_contract()  -> Symbol { symbol_short!("contract")  } // 8 chars
-fn topic_paused()    -> Symbol { symbol_short!("paused")    } // 6 chars
-fn topic_unpaused()  -> Symbol { symbol_short!("unpaused")  } // 8 chars
-fn topic_updated()   -> Symbol { symbol_short!("updated")   } // 7 chars
+fn topic_listed() -> Symbol {
+    symbol_short!("listed")
+} // 6 chars
+fn topic_sold() -> Symbol {
+    symbol_short!("sold")
+} // 4 chars
+fn topic_cancelled() -> Symbol {
+    symbol_short!("cancelled")
+} // 9 chars (max limit for symbol_short!)
+fn topic_contract() -> Symbol {
+    symbol_short!("contract")
+} // 8 chars
+fn topic_paused() -> Symbol {
+    symbol_short!("paused")
+} // 6 chars
+fn topic_unpaused() -> Symbol {
+    symbol_short!("unpaused")
+} // 8 chars
+fn topic_updated() -> Symbol {
+    symbol_short!("updated")
+} // 7 chars
 
 // ---------------------------------------------------------------------------
 // Internal helpers
@@ -162,9 +175,11 @@ fn update_reputation(env: &Env, seller: &Address, volume: i128, disputed: bool)
     env.storage()
         .persistent()
         .set(&DataKey::Reputation(seller.clone()), &rep);
-    env.storage()
-        .persistent()
-        .extend_ttl(&DataKey::Reputation(seller.clone()), 17_280, 17_280 * 365);
+    env.storage().persistent().extend_ttl(
+        &DataKey::Reputation(seller.clone()),
+        17_280,
+        17_280 * 365,
+    );
 }
 
 // ---------------------------------------------------------------------------
@@ -188,7 +203,9 @@ impl MarketplaceContract {
         }
         admin.require_auth();
         env.storage().instance().set(&DataKey::Admin, &admin);
-        env.storage().instance().set(&DataKey::ListingCounter, &0u64);
+        env.storage()
+            .instance()
+            .set(&DataKey::ListingCounter, &0u64);
         env.storage().instance().set(&DataKey::Paused, &false);
         env.storage().instance().extend_ttl(17_280, 17_280 * 30);
         Ok(())
@@ -217,8 +234,7 @@ impl MarketplaceContract {
 
         env.storage().instance().set(&DataKey::Paused, &true);
 
-        env.events()
-            .publish((topic_contract(), topic_paused()), ());
+        env.events().publish((topic_contract(), topic_paused()), ());
         Ok(())
     }
 
@@ -428,11 +444,7 @@ impl MarketplaceContract {
         }
 
         let token_client = token::Client::new(&env, &listing.token);
-        token_client.transfer(
-            &env.current_contract_address(),
-            &buyer,
-            &listing.price,
-        );
+        token_client.transfer(&env.current_contract_address(), &buyer, &listing.price);
 
         listing.status = ListingStatus::Cancelled;
 
@@ -486,11 +498,7 @@ impl MarketplaceContract {
         }
 
         let token_client = token::Client::new(&env, &listing.token);
-        token_client.transfer(
-            &env.current_contract_address(),
-            &recipient,
-            &listing.price,
-        );
+        token_client.transfer(&env.current_contract_address(), &recipient, &listing.price);
 
         listing.status = ListingStatus::Cancelled;
 
@@ -554,8 +562,10 @@ impl MarketplaceContract {
             .persistent()
             .set(&DataKey::Listing(listing_id), &listing);
 
-        env.events()
-            .publish((topic_updated(),), (listing_id, seller, new_price, new_expires_at));
+        env.events().publish(
+            (topic_updated(),),
+            (listing_id, seller, new_price, new_expires_at),
+        );
 
         Ok(())
     }
@@ -700,7 +710,7 @@ mod test {
         let env = Env::default();
         env.mock_all_auths();
 
-        let contract_id = env.register_contract(None, MarketplaceContract);
+        let contract_id = env.register(MarketplaceContract, ());
         let client = MarketplaceContractClient::new(&env, &contract_id);
 
         let admin = Address::generate(&env);
@@ -713,7 +723,7 @@ mod test {
         let sac = StellarAssetClient::new(&env, &token_address);
 
         // Mint tokens to buyer
-        sac.mint(&buyer, &10_000_0000000i128);
+        sac.mint(&buyer, &100_000_000_000i128);
 
         client.initialize(&admin);
 
@@ -825,7 +835,7 @@ mod test {
             &1000i128,
             &(1_000_000 + 86_400),
         );
-        assert_eq!(result, Ok(Err(ContractError::ContractPaused)));
+        assert_eq!(result, Err(Ok(ContractError::ContractPaused)));
     }
 
     #[test]
@@ -846,7 +856,7 @@ mod test {
         client.pause();
 
         let result = client.try_deposit_to_escrow(&buyer, &listing_id);
-        assert_eq!(result, Ok(Err(ContractError::ContractPaused)));
+        assert_eq!(result, Err(Ok(ContractError::ContractPaused)));
     }
 
     #[test]
@@ -868,7 +878,7 @@ mod test {
         client.pause();
 
         let result = client.try_release_payment(&listing_id);
-        assert_eq!(result, Ok(Err(ContractError::ContractPaused)));
+        assert_eq!(result, Err(Ok(ContractError::ContractPaused)));
     }
 
     #[test]
@@ -890,7 +900,7 @@ mod test {
         client.pause();
 
         let result = client.try_cancel_and_refund(&buyer, &listing_id);
-        assert_eq!(result, Ok(Err(ContractError::ContractPaused)));
+        assert_eq!(result, Err(Ok(ContractError::ContractPaused)));
     }
 
     #[test]
@@ -912,7 +922,7 @@ mod test {
         client.pause();
 
         let result = client.try_resolve_dispute(&listing_id, &buyer);
-        assert_eq!(result, Ok(Err(ContractError::ContractPaused)));
+        assert_eq!(result, Err(Ok(ContractError::ContractPaused)));
     }
 
     #[test]
@@ -986,25 +996,25 @@ mod test {
         let (_env, client, admin, _seller, _buyer, _token) = setup();
         // setup() already initialised — call again
         let result = client.try_initialize(&admin);
-        assert_eq!(result, Ok(Err(ContractError::AlreadyInitialized)));
+        assert_eq!(result, Err(Ok(ContractError::AlreadyInitialized)));
     }
 
     #[test]
     fn test_err_unauthorized_uninitialised_pause() {
         let env = Env::default();
         env.mock_all_auths();
-        let contract_id = env.register_contract(None, MarketplaceContract);
+        let contract_id = env.register(MarketplaceContract, ());
         let client = MarketplaceContractClient::new(&env, &contract_id);
         // Contract not initialised — pause should fail with Unauthorized
         let result = client.try_pause();
-        assert_eq!(result, Ok(Err(ContractError::Unauthorized)));
+        assert_eq!(result, Err(Ok(ContractError::Unauthorized)));
     }
 
     #[test]
     fn test_err_trade_not_found() {
         let (_env, client, _admin, _seller, _buyer, _token) = setup();
         let result = client.try_get_listing(&999u64);
-        assert_eq!(result, Ok(Err(ContractError::TradeNotFound)));
+        assert_eq!(result, Err(Ok(ContractError::TradeNotFound)));
     }
 
     #[test]
@@ -1020,7 +1030,7 @@ mod test {
             &1000i128,
             &(1_000_000 + 86_400),
         );
-        assert_eq!(result, Ok(Err(ContractError::InvalidAmount)));
+        assert_eq!(result, Err(Ok(ContractError::InvalidAmount)));
     }
 
     #[test]
@@ -1036,7 +1046,7 @@ mod test {
             &0i128,
             &(1_000_000 + 86_400),
         );
-        assert_eq!(result, Ok(Err(ContractError::InvalidAmount)));
+        assert_eq!(result, Err(Ok(ContractError::InvalidAmount)));
     }
 
     #[test]
@@ -1052,7 +1062,7 @@ mod test {
             &500i128,
             &999_999u64,
         );
-        assert_eq!(result, Ok(Err(ContractError::InvalidExpiry)));
+        assert_eq!(result, Err(Ok(ContractError::InvalidExpiry)));
     }
 
     #[test]
@@ -1075,7 +1085,7 @@ mod test {
         let sac = StellarAssetClient::new(&env, &token);
         sac.mint(&buyer2, &500_0000000i128);
         let result = client.try_deposit_to_escrow(&buyer2, &listing_id);
-        assert_eq!(result, Ok(Err(ContractError::WrongStatus)));
+        assert_eq!(result, Err(Ok(ContractError::WrongStatus)));
     }
 
     #[test]
@@ -1096,7 +1106,7 @@ mod test {
         env.ledger().with_mut(|l| l.timestamp = 1_000_000 + 86_401);
 
         let result = client.try_deposit_to_escrow(&buyer, &listing_id);
-        assert_eq!(result, Ok(Err(ContractError::TradeExpired)));
+        assert_eq!(result, Err(Ok(ContractError::TradeExpired)));
     }
 
     #[test]
@@ -1114,7 +1124,7 @@ mod test {
             &(1_000_000 + 86_400),
         );
         let result = client.try_deposit_to_escrow(&seller, &listing_id);
-        assert_eq!(result, Ok(Err(ContractError::Unauthorized)));
+        assert_eq!(result, Err(Ok(ContractError::Unauthorized)));
     }
 
     #[test]
@@ -1133,7 +1143,7 @@ mod test {
         );
         // No deposit — still Active
         let result = client.try_release_payment(&listing_id);
-        assert_eq!(result, Ok(Err(ContractError::WrongStatus)));
+        assert_eq!(result, Err(Ok(ContractError::WrongStatus)));
     }
 
     #[test]
@@ -1152,7 +1162,7 @@ mod test {
         );
         // Listing is Active, not Sold
         let result = client.try_cancel_and_refund(&buyer, &listing_id);
-        assert_eq!(result, Ok(Err(ContractError::WrongStatus)));
+        assert_eq!(result, Err(Ok(ContractError::WrongStatus)));
     }
 
     #[test]
@@ -1234,8 +1244,13 @@ mod test {
             &(1_000_000 + 86_400),
         );
 
-        let result = client.try_update_listing(&buyer, &listing_id, &600_0000000i128, &(1_000_000 + 100_000));
-        assert_eq!(result, Ok(Err(ContractError::Unauthorized)));
+        let result = client.try_update_listing(
+            &buyer,
+            &listing_id,
+            &600_0000000i128,
+            &(1_000_000 + 100_000),
+        );
+        assert_eq!(result, Err(Ok(ContractError::Unauthorized)));
     }
 
     #[test]
@@ -1256,8 +1271,13 @@ mod test {
         // Buyer deposits, making listing Sold
         client.deposit_to_escrow(&buyer, &listing_id);
 
-        let result = client.try_update_listing(&seller, &listing_id, &600_0000000i128, &(1_000_000 + 100_000));
-        assert_eq!(result, Ok(Err(ContractError::WrongStatus)));
+        let result = client.try_update_listing(
+            &seller,
+            &listing_id,
+            &600_0000000i128,
+            &(1_000_000 + 100_000),
+        );
+        assert_eq!(result, Err(Ok(ContractError::WrongStatus)));
     }
 
     // -----------------------------------------------------------------------
@@ -1271,20 +1291,25 @@ mod test {
 
         let sac = StellarAssetClient::new(&env, &token);
         let contract_addr = client.address.clone();
-        sac.mint(&contract_addr, &1_000_0000000i128);
+        sac.mint(&contract_addr, &10_000_000_000i128);
 
         // Must be paused
         client.pause();
 
         // Advance ledger time past 72 hours
-        env.ledger().with_mut(|l| l.timestamp = 1_000_000 + EMERGENCY_TIMELOCK_SECS + 1);
+        env.ledger()
+            .with_mut(|l| l.timestamp = 1_000_000 + EMERGENCY_TIMELOCK_SECS + 1);
 
         let recipient = buyer.clone();
-        let initial_balance = sac.balance(&recipient);
+        let token_client = TokenClient::new(&env, &token);
+        let initial_balance = token_client.balance(&recipient);
 
         client.emergency_withdraw(&token, &recipient, &500_0000000i128);
 
-        assert_eq!(sac.balance(&recipient), initial_balance + 500_0000000i128);
+        assert_eq!(
+            token_client.balance(&recipient),
+            initial_balance + 500_0000000i128
+        );
     }
 
     #[test]
@@ -1293,7 +1318,7 @@ mod test {
         env.ledger().with_mut(|l| l.timestamp = 1_000_000);
 
         let sac = StellarAssetClient::new(&env, &token);
-        sac.mint(&client.address, &1_000_0000000i128);
+        sac.mint(&client.address, &10_000_000_000i128);
 
         client.pause();
 
@@ -1301,7 +1326,7 @@ mod test {
         env.ledger().with_mut(|l| l.timestamp = 1_000_000 + 3600);
 
         let result = client.try_emergency_withdraw(&token, &buyer, &500_0000000i128);
-        assert_eq!(result, Ok(Err(ContractError::TimelockNotExpired)));
+        assert_eq!(result, Err(Ok(ContractError::TimelockNotExpired)));
     }
 
     #[test]
@@ -1310,10 +1335,10 @@ mod test {
         env.ledger().with_mut(|l| l.timestamp = 1_000_000);
 
         let sac = StellarAssetClient::new(&env, &token);
-        sac.mint(&client.address, &1_000_0000000i128);
+        sac.mint(&client.address, &10_000_000_000i128);
 
         // Not paused
         let result = client.try_emergency_withdraw(&token, &buyer, &500_0000000i128);
-        assert_eq!(result, Ok(Err(ContractError::WrongStatus)));
+        assert_eq!(result, Err(Ok(ContractError::WrongStatus)));
     }
 }

From 1547c2f5607c8ac67e78967b66b400e6e9b6e5db Mon Sep 17 00:00:00 2001
From: CodingBabe-1 <Richardolajide1981@gmail.com>
Date: Wed, 30 Sep 2026 04:05:33 +0000
Subject: [PATCH 5/6] fix(escrow): enforce one active sub-escrow per buyer per
 trade (#294)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`deposit_to_escrow` only validated the *remaining capacity* of a listing, so a
single buyer could call it repeatedly with amounts that each fit that capacity
— the trade's `Status`/single-`fill_id` checks never rejected them — letting one
buyer hold several concurrent sub-escrows on the same trade and monopolise a
public listing.

Adds `ContractError::DuplicateFill = 16` and a `require_no_active_fill` guard
called by `deposit_to_escrow` before any tokens move: a caller that already
holds a sub-escrow on this trade which is neither released nor refunded is
rejected, so a refused duplicate is a no-op on capacity and balances. The rule
is per (trade, buyer) and per *active* fill, so a settled fill (delivered or
refunded) leaves the buyer free to buy into a partially filled listing again.

Tests: duplicate rejection with no money moved, multi-buyer partial fills up to
Locked/Completed, and refill allowed after the previous fill is released.

Also documents code 16 (and the previously undocumented 15) in
`contracts/ERROR_CODES.md` — whose table had drifted from the enum entirely —
and mirrors both in the server's typed error registry.
---
 contracts/ERROR_CODES.md              |  34 +++--
 contracts/escrow/src/lib.rs           | 171 ++++++++++++++++++++++++++
 server/src/services/contractErrors.ts |  23 ++++
 3 files changed, 218 insertions(+), 10 deletions(-)

diff --git a/contracts/ERROR_CODES.md b/contracts/ERROR_CODES.md
index 5fe7c7b..0f299c9 100644
--- a/contracts/ERROR_CODES.md
+++ b/contracts/ERROR_CODES.md
@@ -2,20 +2,34 @@
 
 This document lists all error codes thrown by the AirFlex Escrow and Marketplace Soroban contracts.
 
+Discriminants are the values of the `ContractError` enum in
+`contracts/escrow/src/lib.rs` and `contracts/marketplace/src/lib.rs`. Codes `1`–`14`
+are shared by both contracts; escrow appends `15`–`16`. The server-side mirror in
+`server/src/services/contractErrors.ts` maps every code back to a typed error.
+
+**Never renumber an existing variant** — new variants are always appended with the
+next integer, because deployed callers decode by discriminant.
+
 ## Error Codes Reference
 
 | Error Code | Error Name | Description | Contract |
 |---|---|---|---|
-| `1` / `101` | `Unauthorized` | Caller is not authorized to perform this operation (e.g. missing signature or wrong role). | Escrow & Marketplace |
-| `2` / `102` | `AlreadyInitialized` | The contract has already been initialized with an admin and parameters. | Escrow & Marketplace |
-| `3` / `103` | `ContractPaused` | Operations are currently paused by the administrator emergency pause. | Escrow & Marketplace |
-| `4` / `104` | `InvalidStatus` | The requested state transition is invalid for the current `TradeStatus` or `ListingStatus`. | Escrow & Marketplace |
-| `5` / `105` | `TradeNotFound` / `ListingNotFound` | The specified trade ID or listing ID does not exist in persistent storage. | Escrow & Marketplace |
-| `6` / `106` | `TokenNotAllowed` | The requested token address is not in the contract's allowed tokens whitelist. | Escrow |
-| `7` / `107` | `InsufficientAmount` / `InvalidAmount` | The specified amount is zero, negative, or exceeds available fill balance. | Escrow & Marketplace |
-| `8` / `108` | `ExpiryNotReached` | Attempted to trigger auto-cancellation or refund before the expiry timestamp. | Escrow & Marketplace |
-| `9` / `109` | `AlreadyExpired` | Attempted to deposit or accept a listing after its expiry timestamp. | Escrow & Marketplace |
-| `10` / `110` | `DisputeAlreadyFlagged` | A dispute has already been raised for this trade/listing. | Escrow & Marketplace |
+| `1` | `AlreadyInitialized` | `initialize` was called on a contract that already has an admin. | Escrow & Marketplace |
+| `2` | `Unauthorized` | The caller is not permitted to perform this action (missing signature, seller acting as buyer, admin acting as buyer, or a caller who is not a party to the trade). | Escrow & Marketplace |
+| `3` | `TradeNotFound` | No trade/listing with the given ID exists in storage. | Escrow & Marketplace |
+| `4` | `WrongStatus` | The action is invalid for the trade's current status. | Escrow & Marketplace |
+| `5` | `TradeExpired` | The trade has passed its expiry timestamp (also returned when a listing has *not* yet expired). | Escrow & Marketplace |
+| `6` | `InsufficientFunds` | The requested amount exceeds the trade's remaining capacity or the contract's balance. | Escrow & Marketplace |
+| `7` | `InvalidExpiry` | The supplied expiry is not in the future. | Escrow & Marketplace |
+| `8` | `AlreadyDisputed` | A dispute is already open on this trade. | Escrow & Marketplace |
+| `9` | `ContractPaused` | The contract is paused by the admin circuit breaker. | Escrow & Marketplace |
+| `10` | `TimelockNotExpired` | A timelocked action was attempted too early (buyer refund before expiry, or the 72-hour emergency-withdrawal timelock). | Escrow & Marketplace |
+| `11` | `UnsupportedToken` | The token is not on the contract's allow-list. | Escrow & Marketplace |
+| `12` | `InvalidAmount` | The amount is zero, negative, or not a whole number of stroops. | Escrow & Marketplace |
+| `13` | `FillAlreadyProcessed` | The sub-escrow fill has already been released or refunded. | Escrow & Marketplace |
+| `14` | `NotAParty` | The caller is neither the seller nor a buyer of the trade. | Escrow & Marketplace |
+| `15` | `PauseCooldownNotExpired` | `unpause` was called before the 5-minute pause cooldown elapsed. | Escrow |
+| `16` | `DuplicateFill` | The buyer already holds an active (unreleased, unrefunded) sub-escrow on this trade — one active fill per buyer per trade (issue #294). | Escrow |
 
 ## Handling Errors
 
diff --git a/contracts/escrow/src/lib.rs b/contracts/escrow/src/lib.rs
index e433c14..1ff403e 100644
--- a/contracts/escrow/src/lib.rs
+++ b/contracts/escrow/src/lib.rs
@@ -91,6 +91,7 @@ pub enum ContractError {
     FillAlreadyProcessed = 13,
     NotAParty = 14,
     PauseCooldownNotExpired = 15,
+    DuplicateFill = 16,
 }
 
 // ---------------------------------------------------------------------------
@@ -160,6 +161,39 @@ fn get_admin(env: &Env) -> Result<Address, ContractError> {
 
 const PAUSE_COOLDOWN_SECONDS: u64 = 300;
 
+/// Rejects a deposit from a buyer who already holds an *active* sub-escrow on
+/// this trade (issue #294).
+///
+/// Without this check a single buyer could call `deposit_to_escrow` repeatedly
+/// with small amounts — each one individually within the remaining capacity —
+/// and take over a listing that is meant to be shared by many buyers.
+///
+/// The rule is per `(trade, buyer)` and counts only *active* fills: a fill that
+/// has already been released or refunded no longer holds a place, so a buyer
+/// whose delivery completed (or whose funds were returned) can still buy into
+/// a listing that is only partially filled.
+fn require_no_active_fill(env: &Env, trade_id: u64, buyer: &Address) -> Result<(), ContractError> {
+    let fill_count: u64 = env
+        .storage()
+        .instance()
+        .get(&DataKey::TradeFillCounter(trade_id))
+        .unwrap_or(0);
+
+    for i in 1..=fill_count {
+        if let Some(sub_escrow) = env
+            .storage()
+            .persistent()
+            .get::<_, SubEscrow>(&DataKey::SubEscrow(trade_id, i))
+        {
+            if sub_escrow.buyer == *buyer && !sub_escrow.released && !sub_escrow.refunded {
+                return Err(ContractError::DuplicateFill);
+            }
+        }
+    }
+
+    Ok(())
+}
+
 // ---------------------------------------------------------------------------
 // Contract
 // ---------------------------------------------------------------------------
@@ -356,6 +390,11 @@ impl EscrowContract {
     ///
     /// Transfers `fill_amount` tokens from `buyer` → contract.
     /// Sets trade status to `Locked` when fully filled, `PartiallyFilled` otherwise.
+    ///
+    /// At most one *active* sub-escrow per buyer per trade is allowed — a buyer
+    /// holding an unreleased/unrefunded fill on this trade is rejected with
+    /// `DuplicateFill` (issue #294), so no single buyer can fill a public
+    /// listing repeatedly and monopolise it.
     pub fn deposit_to_escrow(
         env: Env,
         buyer: Address,
@@ -402,6 +441,11 @@ impl EscrowContract {
             return Err(ContractError::InsufficientFunds);
         }
 
+        // One active sub-escrow per (trade, buyer) — issue #294. Checked before
+        // any funds move, so a rejected duplicate fill is a pure no-op on the
+        // trade's capacity and on the buyer's balance.
+        require_no_active_fill(&env, trade_id, &buyer)?;
+
         let token_client = token::Client::new(&env, &trade.token);
         token_client.transfer(&buyer, &env.current_contract_address(), &fill_amount);
 
@@ -1065,6 +1109,133 @@ mod test {
         assert_eq!(trade.filled_amount, 500_0000000i128);
     }
 
+    // -----------------------------------------------------------------------
+    // Issue #294 — one active sub-escrow per (trade, buyer)
+    // -----------------------------------------------------------------------
+
+    /// A buyer cannot stack a second active fill on the same listing: the
+    /// monopolising pattern from the issue (repeated deposits that each fit the
+    /// remaining capacity) is rejected with `DuplicateFill`.
+    #[test]
+    fn test_deposit_to_escrow_rejects_duplicate_fill_by_same_buyer() {
+        let (env, client, _admin, seller, buyer, token) = setup();
+        env.ledger().with_mut(|l| l.timestamp = 1_000_000);
+
+        let trade_id = client.create_listing(
+            &seller,
+            &token,
+            &500_0000000i128,
+            &symbol_short!("AIRTIME"),
+            &(1_000_000 + 86_400),
+        );
+
+        client.deposit_to_escrow(&buyer, &trade_id, &100_0000000i128);
+
+        // Second and third fills by the same buyer while the first is active.
+        let result = client.try_deposit_to_escrow(&buyer, &trade_id, &100_0000000i128);
+        assert_eq!(result, Err(Ok(ContractError::DuplicateFill)));
+
+        let result = client.try_deposit_to_escrow(&buyer, &trade_id, &400_0000000i128);
+        assert_eq!(result, Err(Ok(ContractError::DuplicateFill)));
+
+        // The rejected attempts moved no money and consumed no capacity, so the
+        // remainder of the listing stays available to other buyers.
+        let trade = client.get_trade(&trade_id);
+        assert_eq!(trade.status, TradeStatus::PartiallyFilled);
+        assert_eq!(trade.filled_amount, 100_0000000i128);
+
+        let token_client = TokenClient::new(&env, &token);
+        assert_eq!(
+            token_client.balance(&buyer),
+            100_000_000_000i128 - 100_0000000i128
+        );
+    }
+
+    /// The limit is per buyer, not per trade: several buyers can still split a
+    /// listing, and the trade only locks once the capacity is exhausted.
+    #[test]
+    fn test_deposit_to_escrow_multi_buyer_partial_fills() {
+        let (env, client, _admin, seller, buyer, token) = setup();
+        env.ledger().with_mut(|l| l.timestamp = 1_000_000);
+
+        let trade_id = client.create_listing(
+            &seller,
+            &token,
+            &500_0000000i128,
+            &symbol_short!("AIRTIME"),
+            &(1_000_000 + 86_400),
+        );
+
+        let sac = StellarAssetClient::new(&env, &token);
+        let buyer2 = Address::generate(&env);
+        let buyer3 = Address::generate(&env);
+        sac.mint(&buyer2, &200_0000000i128);
+        sac.mint(&buyer3, &200_0000000i128);
+
+        client.deposit_to_escrow(&buyer, &trade_id, &200_0000000i128);
+        client.deposit_to_escrow(&buyer2, &trade_id, &200_0000000i128);
+
+        let trade = client.get_trade(&trade_id);
+        assert_eq!(trade.status, TradeStatus::PartiallyFilled);
+        assert_eq!(trade.filled_amount, 400_0000000i128);
+
+        client.deposit_to_escrow(&buyer3, &trade_id, &100_0000000i128);
+
+        let trade = client.get_trade(&trade_id);
+        assert_eq!(trade.status, TradeStatus::Locked);
+        assert_eq!(trade.filled_amount, 500_0000000i128);
+
+        // Each buyer deposited exactly once, so all three fills are distinct
+        // and independently releasable.
+        client.release_payment(&trade_id, &1);
+        client.release_payment(&trade_id, &2);
+        client.release_payment(&trade_id, &3);
+
+        assert_eq!(client.get_trade(&trade_id).status, TradeStatus::Completed);
+        let token_client = TokenClient::new(&env, &token);
+        assert_eq!(token_client.balance(&seller), 500_0000000i128);
+    }
+
+    /// "Active" is the rule, not "has ever deposited": once a buyer's fill has
+    /// been settled they may buy into the same (still partially filled)
+    /// listing again, which opens a new sub-escrow with a new fill id.
+    #[test]
+    fn test_deposit_to_escrow_allows_refill_after_release() {
+        let (env, client, _admin, seller, buyer, token) = setup();
+        env.ledger().with_mut(|l| l.timestamp = 1_000_000);
+
+        let trade_id = client.create_listing(
+            &seller,
+            &token,
+            &500_0000000i128,
+            &symbol_short!("DATA"),
+            &(1_000_000 + 86_400),
+        );
+
+        client.deposit_to_escrow(&buyer, &trade_id, &200_0000000i128);
+        // Fill #1 is delivered and settled while the listing is still open.
+        client.release_payment(&trade_id, &1);
+
+        let trade = client.get_trade(&trade_id);
+        assert_eq!(trade.status, TradeStatus::PartiallyFilled);
+        assert_eq!(trade.filled_amount, 200_0000000i128);
+
+        // The buyer holds no active fill any more, so a second deposit is
+        // accepted rather than rejected as a duplicate.
+        client.deposit_to_escrow(&buyer, &trade_id, &300_0000000i128);
+
+        let trade = client.get_trade(&trade_id);
+        assert_eq!(trade.status, TradeStatus::Locked);
+        assert_eq!(trade.filled_amount, 500_0000000i128);
+
+        // The settled fill stays settled: only the new fill #2 is releasable.
+        let result = client.try_release_payment(&trade_id, &1);
+        assert_eq!(result, Err(Ok(ContractError::FillAlreadyProcessed)));
+
+        client.release_payment(&trade_id, &2);
+        assert_eq!(client.get_trade(&trade_id).status, TradeStatus::Completed);
+    }
+
     #[test]
     fn test_release_payment() {
         let (env, client, _admin, seller, buyer, token) = setup();
diff --git a/server/src/services/contractErrors.ts b/server/src/services/contractErrors.ts
index e1d11f5..f8f93d2 100644
--- a/server/src/services/contractErrors.ts
+++ b/server/src/services/contractErrors.ts
@@ -164,6 +164,27 @@ export class NotAPartyError extends ContractError {
   }
 }
 
+/** Code 15 — `unpause` was called before the pause cooldown elapsed (escrow). */
+export class PauseCooldownNotExpiredError extends ContractError {
+  constructor() {
+    super("The pause cooldown has not expired yet", 15);
+    this.name = "PauseCooldownNotExpiredError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+}
+
+/**
+ * Code 16 — The buyer already holds an active sub-escrow on this trade, so a
+ * second fill is refused (one active fill per buyer per trade, escrow only).
+ */
+export class DuplicateFillError extends ContractError {
+  constructor() {
+    super("This buyer already has an active fill on this trade", 16);
+    this.name = "DuplicateFillError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Registry
 // ---------------------------------------------------------------------------
@@ -184,6 +205,8 @@ const ERROR_REGISTRY = new Map<number, new () => ContractError>([
   [12, InvalidAmountError],
   [13, FillAlreadyProcessedError],
   [14, NotAPartyError],
+  [15, PauseCooldownNotExpiredError],
+  [16, DuplicateFillError],
 ]);
 
 // ---------------------------------------------------------------------------

From dc8e10c0d514a7060ea0ba71db987e2f49797942 Mon Sep 17 00:00:00 2001
From: CodingBabe-1 <Richardolajide1981@gmail.com>
Date: Wed, 30 Sep 2026 04:42:14 +0000
Subject: [PATCH 6/6] test(frontend): commit the EscrowTransactionLink snapshot
 so CI passes from a clean checkout

The suite asserts toMatchSnapshot() but the generated .snap file was never
tracked, so on a fresh checkout Jest has nothing to compare against. Locally
that silently rewrites the snapshot and passes; under CI=true Jest refuses to
write new snapshots and the suite fails. Track the generated snapshot.

Co-Authored-By: Codebuff <noreply@codebuff.com>
---
 .../EscrowTransactionLink.test.tsx.snap       | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 frontend/components/__snapshots__/EscrowTransactionLink.test.tsx.snap

diff --git a/frontend/components/__snapshots__/EscrowTransactionLink.test.tsx.snap b/frontend/components/__snapshots__/EscrowTransactionLink.test.tsx.snap
new file mode 100644
index 0000000..d26d968
--- /dev/null
+++ b/frontend/components/__snapshots__/EscrowTransactionLink.test.tsx.snap
@@ -0,0 +1,31 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`EscrowTransactionLink matches the snapshot for a sample hash 1`] = `
+<a
+  class="inline-flex items-center gap-1 text-violet-600 hover:text-violet-700 hover:underline dark:text-violet-400 dark:hover:text-violet-300 font-mono text-xs "
+  href="https://stellar.expert/explorer/testnet/tx/3389e9f0f1a54f7b1d5b2a0c9f8e7d6c5b4a39281706f5e4d3c2b1a09f8e7d6c"
+  rel="noopener noreferrer"
+  target="_blank"
+  title="View transaction on Stellar Expert"
+>
+  <span>
+    View escrow on Stellar Explorer
+  </span>
+  <svg
+    aria-hidden="true"
+    class="h-3.5 w-3.5 shrink-0 opacity-70 transition-opacity hover:opacity-100"
+    data-testid="external-link-icon"
+    fill="none"
+    role="img"
+    stroke="currentColor"
+    viewBox="0 0 24 24"
+  >
+    <path
+      d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"
+      stroke-linecap="round"
+      stroke-linejoin="round"
+      stroke-width="2"
+    />
+  </svg>
+</a>
+`;