Honour the FX degraded path at the consumer, and bound provider calls (#206)

[Soumen1080]

User description

close #206
The S4 seam already exists and is well built: multi-source provider chain, two-tier cache with distinct crypto/fiat freshness policies, promise-coalescing stampede protection, per-provider circuit breakers, a route that returns HTTP 200 with unavailable: true rather than an error status, and tests for each.

Two things defeated it.

1. The consumer ignored the degraded contract useExpenseForm - the one place that actually creates an expense - did:

   if (!res.ok) throw ... // dead: the route always returns 200
   exchangeRate = data.rate; // null when unavailable
   finalXlmAmount = finalXlmAmount * parseFloat(exchangeRate);

   So a provider outage did not block expense creation; it produced NaN and persisted totalAmount: "NaN", with every share NaN too. A silently corrupt record is worse than a blocked submit, and it defeated the invariant the whole seam exists to serve. It also read data.timestamp, which the route never returns (it returns fetchedAt), so provenance was always undefined, and it never checked stale - the "worst failure mode" the issue names.

   lib/fx/quote.ts is now the shared client-side consumer: returns null for every "cannot price this" condition (transport failure, unavailable, absent / non-numeric / non-positive rate) instead of throwing or producing NaN. On null the form keeps everything the user typed, sets rateUnavailable, and tells them to enter XLM directly. A stale quote is used - a slightly old rate beats no expense - but announced with its age.

   It lives in lib/fx/ rather than the hook because it is pure async logic with no React in it, and any future caller must degrade identically.

2. No call was ever bounded Nothing in the chain had a timeout. A provider that accepts the connection and then never answers hung the whole chain forever and never tripped its breaker, since the breaker only counts outcomes it is told about - so the next request hung too. "Bypassed without repeatedly paying its timeout" was true for errors and false for hangs, which is the more common outage.

   CircuitBreaker.call now races the provider against callTimeoutMs (3 s default) and counts a timeout as a failure, so three hangs open the circuit and it then costs nothing. The timer is always cleared.

Tests cover the regression directly (unavailable/malformed/non-positive rate never yields NaN), provenance, stale labelling, and hang -> breaker-open.

Note: jest was not run - this checkout has no installed node_modules. The pure logic (describeAge, the rate guard) was extracted and executed under node; that caught a real bug, describeAge(30s) reporting "1 minute" because Math.round overstated freshness. Now floored in all three branches.

@

---

CodeAnt-AI Description

Prevent corrupted expenses when exchange rates are unavailable

What Changed

• Expense creation no longer saves NaN amounts when an exchange-rate request fails, returns an unusable rate, or reports the rate as unavailable
• When pricing is unavailable, the form stays filled in and clearly asks the user to switch to XLM
• Stale cached rates can still be used, with a message showing how old the rate is
• Provider requests now stop after a fixed time; repeatedly hanging providers are skipped after the circuit opens
• Added coverage for unavailable, malformed, stale, unreachable, and hanging-rate scenarios

Impact

✅ No corrupted NaN expenses
✅ Preserved form data during FX outages
✅ Fewer delays from hanging rate providers

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	854b99e	Aug 31, 2026 · 12:06	12:09

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stellar-star	Building	Preview	Aug 31, 2026 12:06pm

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

Suggestion: Timeout only stops awaiting fn(); the provider promise continues running, retaining network resources after the breaker has already moved to fallback providers. [resource leak]

Assessment: 🟠 Major · 🔁 Occurrence: Sometimes

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** lib/fx/circuitBreaker.ts
**Line:** 92:97
**Comment:**
	*Resource Leak: Timeout only stops awaiting `fn()`; the provider promise continues running, retaining network resources after the breaker has already moved to fallback providers.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎