[Labi-Joy]

Closes #774
Closes #775
Closes #776
Closes #777

What changed

Four Wave 10 fixes bundled per the maintainer's recent multi-issue pattern. Two land as behavior changes with tests (#774, #775), two land as documentation + the baseline build fixes needed to reach them (#776, #777).

#775 — OracleVerifier readings must advance strictly forward in time

submit_data / batch_submit_data / submit_data_batch previously accepted readings whose timestamp was <= a prior reading from the same oracle for the same (data_type, key). A replayed or out-of-order submission from a flaky feed could overwrite a fresher reading already folded into the aggregate. Added StorageKey::LastReadingTimestamp(data_type, key, oracle), a new Error::StaleReadingTimestamp (code 37), and two helpers (require_strictly_newer_reading / record_reading_timestamp) that gate the submission before store_plain_reading and advance the high-water mark only after acceptance. Guard scoped per (data_type, key, oracle), same guard in both batch entry points.

#774 — RiskPool guardian removal routes through the remaining guardians

set_guardians was admin-only and let a single admin key wipe the guardian set in one call. The function now rejects any update that drops a current guardian (GuardianRemoveBlocked, code 49). Removal routes through a new propose/approve flow (propose_remove_guardian / approve_remove_guardian / cancel_pending_guardian_removal / get_pending_guardian_removal) that mirrors the existing propose_new_admin + approve_admin_change pattern. The guardian being removed cannot vote on their own exit. MIN_GUARDIANS = 2 enforced both at propose and at execution so the committee can't collapse to a single key. Threshold is capped at the new set size on removal so subsequent approvals stay reachable.

Only two new error codes were added — Soroban's #[contracterror] enum is spec-capped at 50 variants on this contract. NotGuardian and NoPendingUpgrade are reused for "address is not a guardian" and "no pending removal" to stay under the cap.

#776 — ClaimsProcessor claim-equality boundary

The AC calls out "accept claim = premium" / "handle boundary correctly". Walking the gates in process_claim, evaluate_and_settle, and the installment-schedule check: every claim-vs-coverage comparison already uses != or strict >, so claim.coverage_amount == policy.coverage_amount, paid_amount == claim.coverage_amount, and total_amount == claim.coverage_amount are permitted today. The defect reported is a documentation gap, not a logic one. Added an explicit doc block on process_claim describing the equality semantics so a future refactor to >=/<= is caught at review.

#777 — PolicyEngine upgrade preserves policy state

Soroban's env.deployer().update_current_contract_wasm swaps the code without touching storage; every entry in instance(), persistent(), and temporary() survives. The existing upgrade + run_migrations + migrate_v1_to_v2 scaffold already handles the schema-change case. Added a doc block on upgrade listing which StorageKeys are preserved, spelling out the order of operations (run migrations → stamp version → swap WASM), and documenting the operator upgrade procedure end-to-end.

Baseline build fixes (needed to reach #776 / #777 in test)

main fails to compile parashield-policy-engine and parashield-claims-processor as of 77c7c51. Fixed inline so this PR actually builds the touched crates:

policy-engine (3 errors):

• s.as_ref().as_bytes() on L471 needed a type annotation.
• Error::UnregisteredOracleDataType referenced at L495 but not declared.
• Error::InvalidInput referenced at L1095 but not declared.

claims-processor (6 errors):

• Error::EvidenceLimitExceeded referenced at L2092 but not declared.
• Error::InvalidEvidence referenced at L2097 and L2107 but not declared.
• StorageKey::ClaimEvidence(u128) referenced at L2110 and L2117 but not declared.
• Error::InvalidToken referenced at L2231 but not declared.

Added the missing enum variants with doc comments. No behavior changed in the library code paths that reference them — they were already written to panic through these names, there just weren't declarations for the names.

Verification

$ cargo build -p parashield-policy-engine -p parashield-claims-processor \
              -p parashield-risk-pool -p parashield-oracle-verifier
Finished `dev` profile [unoptimized + debuginfo] target(s)   # was failing on main

$ cargo test -p parashield-risk-pool --lib test_guardians
test result: ok. 8 passed; 0 failed

$ cargo test -p parashield-oracle-verifier --lib test_monotonic
test result: ok. 5 passed; 0 failed

$ cargo test -p parashield-oracle-verifier --lib
test result: FAILED. 123 passed; 10 failed  # same 10 pre-existing fails on main

Full oracle-verifier baseline on main is 118 / 10; after this PR 123 / 10 — the 10 failures are unchanged pre-existing baseline, the +5 new passing tests are the monotonic suite. No regressions.

Note on cargo tests for #776 and #777

I did not land cargo tests for #776 or #777 because the test harnesses on main are pre-existing broken against the current library code:

• claims-processor: 35 compile errors across test.rs / test_integration.rs / test_claim_uniqueness.rs / test_advanced.rs — buy_policy signature drift, missing expected_token field on CreateProductParams, missing get_pending_guardian_config client method, u64 vs i64 compares.
• policy-engine: 128 compile errors across test.rs / test_advanced.rs / test_product_names.rs — references to symbols that no longer exist.

Fixing those harnesses would be a sizable follow-up on top of this PR. Flagging explicitly so the maintainer can prioritize.

[drips-wave]

@Labi-Joy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits