feat(intent_settlement): batch fill/cancel, paginated list_solvers, Solana e2e (+ compile-baseline fix)

[ushpraise]

Closes #201
Closes #199
Closes #198

Why this PR is larger than three features

intent_settlement did not compile on main (cargo build → 50 errors), so none of #198/#199/#201 could be built, tested, or land green on their own. Restoring a compiling, green baseline is the substance of the open issues #202 (undefined constants), #203 (Error enum), #204 (DataKey enum), so this PR closes those too. Commit 1 is the baseline restoration; commit 2 is the three features + docs.

Commit 1 — restore a compiling, green baseline (#202, #203, #204)

Area	Problem on main	Fix
Constants (#202)	~12 names used but never declared (MAX_BATCH_SIZE, SLASH_COOLDOWN, CANCEL_COOLDOWN, DEFAULT_*, MAX_PROTOCOL_FEE_BPS, MIN_FILL_WINDOW_SECS, MIN_INTENT_EXPIRY_SECS, MIN_BOND_FLOOR, MAX_EXTENSION_DURATION)	Declared with rationale comments (table below)
Error enum (#203)	discriminant 22 used ×3, 23 used ×2 (won't compile); 6 variants referenced but missing	Renumbered sequentially to 36; added AmountTooLarge, InvalidConfig, TimelockNotElapsed, NoPendingAdminTransfer, NoPendingDstTokenChange, CancelCooldownNotExpired, BatchTooLarge, ExtensionAlreadyGranted; replaced the Error::ZeroAmount "reuse nearest" placeholders
DataKey enum (#204)	9 variants referenced but missing	Added Config, PendingAdmin, PendingDstTokenAdd, PendingDstTokenRemove, AllowedDstTokenList, MinBondMultiplier, UserIntents, CancelCooldown, ExtensionGranted
validate_src_token	called String::get, which soroban_sdk::String does not have	Reads bytes via copy_into_slice into a fixed buffer; accepted formats unchanged (EVM 0x+40hex; Solana base58 32–44)
compute_reputation_score	pub contract fn taking &SolverRecord → error: unsupported type	pub(crate) (not an entrypoint)
fill_intent	dst transfer + fee transfer written three times each (a real fund-loss bug)	One CEI-ordered pass: state committed, then one user transfer + one fee transfer
get_pending_admin	PendingAdmin had no reader	Added the view
test.rs / proptest_bond.rs	merge damage: unclosed fns, empty fn bodies, a duplicate test name, a stale duplicate import, a SolverRecord literal missing a field; several pre-#127 tests used "0xabc" placeholder src_tokens; get_stats() destructured as a 2-tuple	Repaired; proptest advances past SLASH_COOLDOWN between accept+slash steps

Chosen constant values (please sanity-check per #202)

Constant	Value	Rationale
DEFAULT_MIN_BOND / DEFAULT_FILL_WINDOW / DEFAULT_INTENT_EXPIRY / DEFAULT_PROTOCOL_FEE_BPS	= MIN_BOND / FILL_WINDOW / INTENT_EXPIRY / PROTOCOL_FEE_BPS (50 USDC / 300 s / 1800 s / 5 bps)	Aliased to the historical hard-coded constants so initialize() behaviour is byte-for-byte unchanged
MAX_PROTOCOL_FEE_BPS	1_000	10% ceiling — matches the value already documented in set_config's doc comment
MIN_FILL_WINDOW_SECS	60	matches set_config doc
MIN_INTENT_EXPIRY_SECS	300	matches set_config doc
MIN_BOND_FLOOR	10_000_000	1 USDC (7 decimals) absolute floor
SLASH_COOLDOWN	3_600 (1 h)	matches the existing slash_cooldown_expires_after_time_window test's pass_time(3600)
CANCEL_COOLDOWN	60	anti-spam gap between a user's cancels
MAX_BATCH_SIZE	20	covers realistic solver batching, well inside per-tx limits
MAX_EXTENSION_DURATION	300	same magnitude as FILL_WINDOW

There are upstream branches (fix/error-discriminant-collision, fix/restore-dst-token-not-allowed-variant) touching the same enums — happy to rebase onto whichever lands first.

---

Commit 2 — the three features

#199 — batch_fill_intent / batch_cancel_intent

• batch_fill_intent(solver, fills: Vec<(BytesN<32>, i128)>), batch_cancel_intent(user, intent_ids: Vec<BytesN<32>>); both capped at MAX_BATCH_SIZE, whole-batch revert on any failure.
• Auth bug also fixed for the existing batch_submit_intent / batch_accept_intent: require_auth() may only be called once per address per invocation, so calling the public single-item entrypoints in a loop failed with Auth, ExistingValue on item 2. All four batch fns now authorise the actor once and call un-gated *_inner bodies.
• batch_cancel_intent checks + stamps CANCEL_COOLDOWN once for the call, so a user clears all their open intents in one tx.
• Mixed full/partial fills in one batch keep OpenIntents / active_intents correct.

#198 — list_solvers(start, limit)

• New DataKey::SolverList (instance storage, Vec<Address>) kept in sync by register_solver / deregister_solver using the add_to_/remove_from_dst_token_list pattern (Add a view listing all currently allowed dst_tokens #117), including the "already present" guard — deregister + re-register never duplicates.
• limit clamped to MAX_BATCH_SIZE; empty page past the end.
• Storage-cost trade-off documented on DataKey::SolverList in the style of the OpenIntents comment.
• indexer/reference-indexer.js comment points at list_solvers as the alternative to full event replay.

#201 — Solana, end to end

• validate_src_token's Solana branch (base58 alphabet excluding 0 O I l, 32–44 chars, no 0x prefix) is verified against the Solana SDK (Pubkey = 32-byte ed25519 key, bs58 Bitcoin alphabet) and the published SPL mint list — noted in docs/132-supported-chains.md §3.2.
• Docs: 132-supported-chains.md §2 Solana → Supported; §3.2 rewritten (rules table, alphabet, decimals-vary warning, CLI example); new §4.8 SPL-mint table (USDC 6, USDT 6, wSOL 9, JitoSOL 9, BONK 5). solver-integration-guide.md gains a per-source-chain src_token/src_amount table incl. resolving a Solana mint and reading its non-uniform decimals. README: "planned" removed, Solana rows in the decimal table.
• Also documented that avalanche/bsc src_tokens are not yet format-checked on-chain (only the 5 EVM chains + Solana are).

---

Tests & CI

• 14 new tests: list_solvers register/deregister/dedupe/pagination boundaries; batch_fill mixed full+partial, atomic revert, size guard; batch_cancel one-cooldown, atomic revert, size guard; Solana end-to-end with the allowlist enabled, out-of-range length rejection, 0x-prefix rejection.
• wasm-size CI job: the contract is ~93 KB raw before any of this. [profile.release] now sets lto = true (→ 68 KB raw) and the job installs binaryen and measures the wasm-opt -Oz artifact — the size that actually deploys — against a 63 000-byte budget (under Soroban's 64 KB hard limit). It measures 61 456 bytes. A real size-reduction pass (dead-code audit / splitting rarely-used entrypoints) is still owed and noted in the workflow + CHANGELOG.

Local run (test output)

$ cargo fmt --all -- --check      # clean
$ cargo clippy --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s)   # 0 warnings
$ cargo test
test result: ok. 158 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 99.45s
$ PROPTEST_CASES=256 cargo test --features testutils -- bond_conservation
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 157 filtered out; finished in 81.96s
$ cargo build --target wasm32-unknown-unknown --release && wasm-opt -Oz ...
raw=68149  optimized=61456  budget=63000

[drips-wave]

@ushpraise Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits