Fix main: repair the damage from a batch of unverified merges

.gitignore

@@ -8,6 +8,7 @@
 /wayfare
 /wayfared
 /ladder
+/hop-analysis
 
 # Test and coverage artifacts
 *.out

asset/known_test.go

@@ -164,10 +164,18 @@ func TestRegistryCompleteness(t *testing.T) {
 	}
 }
 
+// TestValidateEntryRequiresVerificationDate pins the field that makes a
+// registry entry auditable.
+//
+// An entry without a verification date records that somebody believed the
+// issuer, not that anybody checked it. Issuers rotate accounts, so an
+// undated claim cannot be re-verified or expired — which is why this is a
+// required field rather than a nice-to-have.
 func TestValidateEntryRequiresVerificationDate(t *testing.T) {
 	e := Entry{
 		Code:       "TEST",
 		Issuer:     "GBTEST",
+		Peg:        "TST",
 		Status:     "live",
 		SourceURL:  "https://example.com/.well-known/stellar.toml",
 		HomeDomain: "example.com",

cmd/hop-analysis/main.go

@@ -63,10 +63,15 @@ type SizeBreakdown struct {
 // CorridorReport is the per-corridor rollup: hop-composition counts across
 // every size, and one SizeBreakdown per size for reproducibility.
 type CorridorReport struct {
-	Snapshot         string          `json:"snapshot"`
-	SendCode         string          `json:"send"`
-	ReceiveCode      string          `json:"receive"`
-	SizesMeasured    int             `json:"sizes_measured"`
+	Snapshot      string `json:"snapshot"`
+	SendCode      string `json:"send"`
+	ReceiveCode   string `json:"receive"`
+	SizesMeasured int    `json:"sizes_measured"`
+	// SizesParsed counts probes whose response could be read at all. It is
+	// distinct from SizesWithAnyPath: a parsed response with no paths is the
+	// NO-MARKET finding, while a response that would not parse taught us
+	// nothing about the corridor.
+	SizesParsed      int             `json:"sizes_parsed"`
 	SizesWithAnyPath int             `json:"sizes_with_any_path"`
 	SizesBestUsesXLM int             `json:"sizes_best_uses_xlm"`
 	SizesWithNonXLM  int             `json:"sizes_with_non_xlm_alt"`
@@ -138,6 +143,24 @@ func Analyse(snapshotsDir string) (*Report, error) {
 			fmt.Fprintf(os.Stderr, "skip %s: %v\n", e.Name(), err)
 			continue
 		}
+
+		// A snapshot from which no probe parsed is not a corridor
+		// measurement. testdata carries deliberately malformed fixtures —
+		// declared as such in their manifest notes — so the route layer can
+		// be tested against payloads that must be rejected. Reporting one as
+		// a corridor would publish hop analysis derived entirely from
+		// responses designed to be invalid, and it declares the same corridor
+		// as a real snapshot, so it would appear as a second contradictory
+		// entry for it.
+		//
+		// This is the Failed-versus-NO-MARKET distinction again: nothing was
+		// learned here, which is different from learning there is no path.
+		if cr.SizesParsed == 0 {
+			fmt.Fprintf(os.Stderr,
+				"skip %s: not one probe parsed; nothing was learned about this corridor\n",
+				e.Name())
+			continue
+		}
 		out.Corridors = append(out.Corridors, cr)
 	}
 	return out, nil
@@ -172,6 +195,7 @@ func analyseSnapshot(m *snapshot.Manifest) (CorridorReport, error) {
 		SizesMeasured: len(sizes),
 	}
 
+	var parsed int
 	for _, size := range sizes {
 		paths, err := c.StrictSendPaths(ctx, send, size, recv)
 		if err != nil {
@@ -182,6 +206,11 @@ func analyseSnapshot(m *snapshot.Manifest) (CorridorReport, error) {
 			continue
 		}
 
+		// The response parsed. Whether it contained a path is a separate
+		// question: zero paths is a finding about the corridor (NO-MARKET),
+		// while a response that would not parse taught us nothing at all.
+		parsed++
+
 		sb := SizeBreakdown{SendAmount: size.String(), NumPaths: len(paths)}
 		if len(paths) > 0 {
 			cr.SizesWithAnyPath++
@@ -216,10 +245,12 @@ func analyseSnapshot(m *snapshot.Manifest) (CorridorReport, error) {
 				Mul(decimal.NewFromInt(100))
 			sb.XLMAdvantagePc = adv.StringFixed(2)
 		}
+		cr.SizesParsed = parsed
 		cr.Sizes = append(cr.Sizes, sb)
 	}
 
 	cr.SummaryLine = summariseCorridor(cr)
+	cr.SizesParsed = parsed
 	return cr, nil
 }
 

refrate/cross_test.go

@@ -21,6 +21,16 @@ type fakeProvider struct {
 
 func (f *fakeProvider) Name() string { return f.name }
 
+// fakeProvider answers with a fixed rate or a fixed error.
+type fakeProvider struct {
+	name string
+	mid  string
+	asOf time.Time
+	err  error
+}
+
+func (f *fakeProvider) Name() string { return f.name }
+
 func (f *fakeProvider) Rate(_ context.Context, base, quote string) (Rate, error) {
 	if f.err != nil {
 		return Rate{}, f.err
@@ -360,6 +370,7 @@ func TestStaleSelectsFresherFeedRegardlessOfOrder(t *testing.T) {
 		{"fresh primary", fresh, stale},
 		{"fresh secondary", stale, fresh},
 	}
+
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			r := rateOf(t, &Cross{Primary: tc.primary, Secondary: tc.secondary})

route/cost_test.go

@@ -15,6 +15,59 @@ import (
 func testUSDC() asset.Asset { return asset.USDC() }
 func testNGNC() asset.Asset { return asset.NGNC() }
 
+// TestDecomposeExpectedFailureCostUndetermined pins the one cost component
+// that must never acquire a number.
+//
+// Expected failure cost is a layer 3 quantity: it needs observed failures to
+// estimate, and none have been collected. Reporting it as zero would state
+// that a corridor never fails, which is a much stronger claim than "we do not
+// know" and the opposite of what the data supports.
+//
+// So it stays undetermined, and it carries a reason saying why — an unexplained
+// blank invites a reader to assume the cost is negligible rather than unmeasured.
+func TestDecomposeExpectedFailureCostUndetermined(t *testing.T) {
+	q := Quote{
+		Kind:          KindDEX,
+		Description:   "USDC -> XLM -> NGNC",
+		Source:        "stellar-dex",
+		SendAsset:     testUSDC(),
+		SendAmount:    decimal.NewFromInt(100),
+		ReceiveAsset:  testNGNC(),
+		ReceiveAmount: decimal.RequireFromString("112800.51"),
+		EffectiveRate: decimal.RequireFromString("1128.0051"),
+		ReferenceMid:  decimal.RequireFromString("1500"),
+		LossPct:       decimal.RequireFromString("24.80"),
+		LossAmount:    decimal.RequireFromString("37199.49"),
+		Verdict:       VerdictUnusable,
+	}
+
+	d := Decompose(q, decimal.RequireFromString("1500"))
+
+	var found bool
+	for _, p := range d.Parts {
+		if p.Component != CostExpectedFailure {
+			continue
+		}
+		found = true
+
+		if p.Determined {
+			t.Error("expected failure cost reported as determined; it needs observed " +
+				"failures to estimate, and none have been collected")
+		}
+		if !p.Amount.IsZero() {
+			t.Errorf("undetermined expected failure cost carries amount %s; an "+
+				"undetermined component must hold no figure at all", p.Amount)
+		}
+		if strings.TrimSpace(p.Reason) == "" {
+			t.Error("undetermined expected failure cost carries no reason; an " +
+				"unexplained blank invites a reader to assume the cost is negligible")
+		}
+	}
+	if !found {
+		t.Fatal("decomposition omits the expected-failure component entirely")
+	}
+}
+
 func TestCostDecomposeSplitsCorrectly(t *testing.T) {
 	q := Quote{
 		Kind:          KindDEX,
@@ -97,6 +150,12 @@ func TestCostDecomposeSplitsCorrectly(t *testing.T) {
 	}
 }
 
+// TestCostDecomposeZeroLoss covers a route that achieves mid exactly.
+//
+// Zero loss is a real measurement, not a missing one: the route was priced and
+// found to cost nothing against the benchmark. It must therefore report a
+// determined zero rather than an undetermined component, which is the
+// distinction the rest of this file exists to protect.
 func TestCostDecomposeZeroLoss(t *testing.T) {
 	q := Quote{
 		Kind:          KindDEX,

sep38/sep38.go

@@ -38,6 +38,7 @@ package sep38
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"

server/api.go

@@ -412,6 +412,9 @@ const (
 	codeUpstreamTimeout     = "upstream_timeout"
 	codeInvalidQuery        = "invalid_query"
 	codeInternalError       = "internal_error"
+	codeInvalidLimit        = "invalid_limit"
+	codeStoreRead           = "store_read_error"
+	codeDivergenceHistory   = "divergence_history_error"
 )
 
 // checkParams rejects any query parameter outside the endpoint's allow-list.

server/api_test.go

@@ -237,6 +237,10 @@ func TestUnknownQueryParamsAreRejected(t *testing.T) {
 			path:    "/api/corridor?tp=NGNC",
 			wantMsg: `"tp"`,
 		},
+		// "pretty" is deliberately NOT listed here: it is a supported
+		// parameter with its own test (TestPrettyOptInIndents). An earlier
+		// merge left both a test asserting it returns 200 and this one
+		// asserting it returns 400, which cannot both hold.
 		"corridor extra param": {
 			// Deliberately not "pretty": that is a real, supported parameter
 			// (the opt-in for indented JSON). Strictness rejects a parameter