feat: MVP — contract on testnet, dashboard, and every open issue closed

[jayteemoney]

Takes StelFlow from a documentation repo to a working product, and closes every open issue.

Live on testnet: CBUWKI66…NRL7 · 75 contract tests · dashboard drives every entry point.

Closes #2, #3, #10, #11, #13, #33, #34, #38.

The contract

Every Phase 0 decision implemented, with docs/behaviour.md's scenarios turned into 75 passing tests. No upgrade function exists — not gated, absent. The pause reaches create_stream and nothing else, expires after 30 days, and can be renounced. cancel takes the recipient's signature alongside the sender's when cancelable = false.

accrual.rs is pure functions over a Stream and a timestamp, so the property tests hammer the maths directly. Milestone state, deadline and expiry policy collapse into one Resolution enum every call site folds over — a milestone cannot mean one thing to withdraw and another to cancel.

Two invariants are asserted separately, because they catch different things. Value conservation (deposit == withdrawn + refunded + remaining) is a closure check: it balances even if one stream were paid out of another's deposit. The contract's token balance is pooled, so per-stream solvency (payout <= total - withdrawn) is checked on its own. That second assertion is the reason a withdrawal pause isn't needed.

#38 — milestone deadlines, decided because #33 made it now-or-never

A non-upgradeable contract cannot retrofit a recovery path onto streams already created. Deferring the decision was deciding it, in the direction that can't be reversed.

The interesting finding: grants and vesting want on_expiry pointed in opposite directions. A grant should resolve to the recipient — the funder chose the committee, so the funder carries the risk of it failing. A performance-gated vest should resolve to the sender — a target that pays out because nobody looked is not a target. That is precisely why it is a term agreed at creation rather than a protocol default.

Bugs found by running it, not by reading it

1. The first deploy came up with pauser == null. Setup was a callable initialize, and on a contract that can never be upgraded, whoever calls it first holds the role permanently. Moved to __constructor, which runs inside the deploy transaction.
2. RPC getEvents returns an empty page plus a cursor when nothing matches in the span it scanned — not an error, and not the events further along the range. A single wide query reported "no activity" for a contract with plenty.
3. #[contractevent] emits snake_case topics. StreamCreated publishes as stream_created; matching on the Rust type name silently dropped every event.
4. The meter labelled a cancelled stream's remainder "Unstreamed" — that money went back to the sender.
5. pnpm bindings destroyed the workspace on every run, repointing the package at an unbuilt ./dist and pinning a second stellar-sdk. Two SDK copies mean two incompatible u64/i128 aliases, surfacing as "number is not assignable to bigint" somewhere unrelated.
6. initialize consumed stream id 0, so the first real stream was id 1.

#2 — the survey found the README was wrong

The README called Soroban's streaming projects "hackathon-scale". Both are actively developed, pushed within a week of the survey, with substantial contributor programmes. Corrected rather than quietly dropped.

What held up is narrower: none of the four surveyed implements approver-gated milestones — Sablier's "tranched" streams unlock on a clock, not a signature. LlamaPay is recorded as a genuinely different model rather than a weaker one.

Sablier V2 also shipped its core non-upgradeable with an admin that cannot touch user streams — near-identical to #33's conclusion, reached independently. That resolved a TODO(maintainer) with a citation instead of a recollection.

Docs

All markdown now lives in one folder, docs/, flattened. Two exceptions, both functional: README.md is the repo landing page, and .github/ templates are only read from .github/.

A truth pass corrected every page that still said "None of it is implemented", "nothing is built", "Phase 0 of 8", and the fee-on-transfer question that #32 settled.

The docs won a naming dispute with the code. They specify bump_stream throughout; I had implemented touch. The docs were written first and are the specification, so the code was what was wrong — renamed and redeployed.

Verification

Check	Result
Contract tests	75/75
cargo clippy (wasm lib + host tests)	clean
cargo fmt	clean
markdownlint	0 issues, 25 files
Links + anchors	0 broken, 26 files
Web typecheck / lint / build	clean
Docs site build + Mermaid	renders, verified in-browser
End-to-end on testnet	conserves value exactly

create → withdraw → approve → cancel
withdrawn 301,750,000 + refund 494,305,557 + remaining 203,944,443
  = 1,000,000,000 deposited

Not done, deliberately

#12 (Spanish README) is left open for a human. The issue says "Native or fluent speakers only. A machine translation of a technical doc reads as machine-translated and does more harm than no translation." I am machine translation. It does not block anything — README.es.md is a leaf nothing imports.

The indexer and the Trustless Work integration remain unbuilt and are marked as such wherever they appear.