Test: pause mid-auction

The question: what happens to escrow if the token’s issuer pauses the mint in the middle of an auction?

On mainnet only Backed Finance can pause an xStock, so this can only be tested on a mint you control (Why devnet).

What was done

A small book was placed and crossed. Then the fixture mint was paused through its pausableConfig authority after the cross, before settlement.

The test was run twice: first on the original program (Phase 1, AAPLx fixture), then again on the upgraded program (Phase 2, IBMx fixture) after the settlement-path lock was added.

What happened

Settlement failed, cleanly. settle_batch was rejected by Token-2022 with error 0x43, “Transferring, minting, and burning is paused on this mint”. The transaction aborted atomically. The auction stayed Cleared with 0 of 2 orders settled. Every balance and both vaults were unchanged. No partial transfer, no half-settled order.
The failed attempt did not lock the path. On the upgraded program, the settle path stayed none. The failed transaction rolled back its own path write, so a failed settlement does not commit the auction to ordinary settlement.
Dollars were refunded while still paused. cancel_and_refund on the buy order returned the buyer’s full test-dollar escrow. The test dollar is a different mint and was never paused.
Ordinary settlement was then refused. After refunds had begun, a settle_batch attempt was rejected with SettlementPathLocked (6019). That is the guard working: the auction was now committed to the refund path.
Shares were refunded after the pause lifted. Once the mint was resumed, cancel_and_refund on the sell order returned the escrowed shares.
Final state: the auction Settled, 2 of 2, on the refund path. Both vaults at exactly zero. Both wallets back to their exact pre-auction balances (Phase 1 run).

A repeat cancel_and_refund on an already-refunded order was also checked. It is a no-op, so there is no double refund.

Re-run after the refund-path fix (24 Sept)

On 24 September cancel_and_refund was restricted to a paused ticker mint, or a refund path already chosen (Honest limitations). The pause case was run again on the fixed program, on the dormant CRCLx fixture:

settlement failed while paused;
a stranger refunded the buyer while paused;
the seller was refunded after the mint resumed, allowed because the refund path had already been chosen;
every balance ended where it started, and both vaults ended at zero.

Signatures are in Transaction index.

What it shows, and what it doesn’t

Shows: the program fails safely under a pause. Nothing is half-settled, dollar refunds work during the pause, and every balance is recoverable the moment it lifts.

Doesn’t: get shares out during a pause. A paused mint blocks refunds of that token as well as settlement. cancel_and_refund is an escape hatch from a failed clearing, not from a pause. While the issuer holds the pause authority, which it does on every xStock, escrowed shares are unreachable until it unpauses. That is inherent to Token-2022’s pausable extension.

Signatures

Upgraded program (Phase 2, IBMx fixture). Auction cleared at 205.00 × 4.

Step	Result
`settle_batch` while paused	rejected: `0x43`, nothing landed
`cancel_and_refund` [1] while paused	`4DNRgi4M…ZBBPGxbZ`
`settle_batch` after refunds began	rejected: `SettlementPathLocked` (6019)
`cancel_and_refund` [0] after resume	`2r9ANErS…NpP1eNB7`

Original program (Phase 1, AAPLx fixture). Auction 243zHq9yVZWornL3GLCUV9xNDrsjC2w1nDCpfRpsEt5R: sell 4 @ 200, buy 4 @ 210, cleared at 205.00 × 4.

Step	Result
`initialize_auction`	`5zSWWcEC…HqCYeJh3`
`place_order` #0 (sell 4 @ 200)	`4SCjHheg…cfKjA567`
`place_order` #1 (buy 4 @ 210)	`27e2ZnfC…KpnUin4J`
`compute_clearing`	`P9Jf2Sc9…s98EBtvY`
pause mint	`4FHHJEmu…9gYZYotC`
`settle_batch` while paused	rejected: `0x43`, nothing landed
`cancel_and_refund` [1] (paused, dollar side)	`5SEFyptp…vy7DjrCT`
resume mint	`DQ37fmkW…xcc7WjTw`
`cancel_and_refund` [0] (after resume)	`54YkbSwC…fHrSdhoi`

Sources: docs/phase1.md Step 3 (pause test), docs/phase2.md (pause and multiplier traps, re-run on the upgraded program), README.md.