From 6b34e7d40bdfecf069fdff9fb224219a8a8cb6b6 Mon Sep 17 00:00:00 2001
From: Abdullahi-Code9 <abdullerheepserdique@gmail.com>
Date: Sat, 25 Jul 2026 23:31:12 +0100
Subject: [PATCH] style: format code with Prettier

---
 .github/workflows/frontend.yml                |  33 +-
 .github/workflows/rust.yml                    |  29 +-
 AGENTS.md                                     |  12 +-
 CONTRIBUTING.md                               |  21 +-
 Issues.md                                     |   2 +-
 README.md                                     |  18 +-
 SECURITY.md                                   |   7 +
 TODO.md                                       |   2 +-
 UIDesign.md                                   |   2 +-
 code.md                                       |  94 ++--
 .../bench/bench_batch_charge_10_users.1.json  |   2 +-
 .../test_snapshots/bench/bench_charge.1.json  |   2 +-
 .../bench_charge_vs_subscribe_ratio.1.json    |   2 +-
 .../bench/bench_pay_per_use.1.json            |   2 +-
 .../bench/bench_subscribe.1.json              |   2 +-
 ...ccept_admin_without_proposal_panics.1.json |   2 +-
 ...t_active_count_decrements_on_cancel.1.json |   2 +-
 ...oes_not_double_count_on_resubscribe.1.json |   2 +-
 ...ctive_count_increments_on_subscribe.1.json |   2 +-
 .../test_active_count_multiple_users.1.json   |   2 +-
 ...criptions_freezes_multiple_accounts.1.json |   2 +-
 ...mes_paused_subscription_past_expiry.1.json |   2 +-
 ...st_batch_charge_charged_and_skipped.1.json |   2 +-
 .../test/test_batch_charge_empty.1.json       |   2 +-
 ...t_batch_charge_grace_period_elapsed.1.json |   2 +-
 .../test/test_batch_charge_inactive.1.json    |   2 +-
 .../test_batch_charge_no_subscription.1.json  |   2 +-
 .../test/test_batch_charge_ordering.1.json    |   2 +-
 ...ch_charge_over_default_limit_panics.1.json |   2 +-
 .../test/test_batch_charge_paused.1.json      |   2 +-
 .../test/test_batch_charge_stress.1.json      |   2 +-
 .../test/test_batch_charge_with_fee.1.json    |   2 +-
 ...bscriptions_exceeds_max_size_panics.1.json |   2 +-
 ...lid_missing_and_pre_paused_accounts.1.json |   2 +-
 ...ch_pause_subscriptions_mixed_inputs.1.json |   2 +-
 ...ause_subscriptions_non_admin_panics.1.json |   2 +-
 ...ects_more_than_twenty_five_accounts.1.json |   2 +-
 ...e_subscriptions_requires_admin_auth.1.json |   7 +-
 .../test_snapshots/test/test_cancel.1.json    |   2 +-
 ...d_at_interval_end_transfers_nothing.1.json |   2 +-
 ..._prorated_transfers_expected_amount.1.json |   2 +-
 ...arge_succeeds_after_merchant_frozen.1.json |   2 +-
 .../test/test_charge_too_early.1.json         |   2 +-
 .../test_charge_updates_last_charged.1.json   |   2 +-
 ...ith_zero_fee_bps_skips_fee_transfer.1.json |   2 +-
 ...charge_within_grace_window_succeeds.1.json |   2 +-
 ...rged_event_includes_ledger_sequence.1.json |   2 +-
 ...clear_charge_history_admin_succeeds.1.json |   2 +-
 ...ear_charge_history_non_admin_panics.1.json |   2 +-
 ...ge_history_nonexistent_key_no_panic.1.json |   2 +-
 ...chant_revenue_history_drops_history.1.json |   2 +-
 ...merchant_revenue_history_idempotent.1.json |   2 +-
 ...nt_revenue_history_non_admin_panics.1.json |   2 +-
 .../test_clear_metadata_removes_label.1.json  |   2 +-
 .../test_contract_pause_events_emitted.1.json |   2 +-
 ...st_custom_sac_token_end_to_end_flow.1.json |   2 +-
 ...aily_limit_accumulates_across_calls.1.json |   2 +-
 ...ily_limit_allows_spend_within_limit.1.json |   2 +-
 ...y_limit_blocks_cumulative_overspend.1.json |   2 +-
 .../test_daily_limit_blocks_overspend.1.json  |   2 +-
 ...test_daily_limit_day_start_boundary.1.json |   2 +-
 ...t_daily_limit_removed_event_emitted.1.json |   2 +-
 .../test_daily_limit_set_event_emitted.1.json |   2 +-
 ...limit_visibility_and_spend_tracking.1.json |   2 +-
 .../test/test_double_initialize.1.json        |   2 +-
 .../test_freeze_merchant_idempotent.1.json    |   2 +-
 ...e_merchant_independent_of_whitelist.1.json |   2 +-
 ...st_freeze_merchant_non_admin_panics.1.json |   2 +-
 ...charge_history_empty_for_no_history.1.json |   2 +-
 ...rge_history_page_limit_capped_at_12.1.json |   2 +-
 ...e_history_page_offset_beyond_length.1.json |   2 +-
 ...et_charge_history_page_offset_limit.1.json |   2 +-
 ...rge_history_three_charges_ascending.1.json |   2 +-
 .../test/test_get_daily_limit.1.json          |   2 +-
 ...et_fee_returns_current_fee_settings.1.json |   2 +-
 .../test_get_grace_period_after_set.1.json    |   2 +-
 .../test_get_grace_period_default_zero.1.json |   2 +-
 ...test_get_metadata_none_when_not_set.1.json |   2 +-
 .../test/test_get_min_interval_default.1.json |   2 +-
 ..._get_protocol_stats_after_subscribe.1.json |   2 +-
 ..._get_protocol_stats_contract_paused.1.json |   2 +-
 .../test_get_protocol_stats_initial.1.json    |   2 +-
 .../test_get_protocol_stats_with_fee.1.json   |   2 +-
 ...est_get_subscriber_at_returns_first.1.json |   2 +-
 ...ubscription_label_none_when_not_set.1.json |   2 +-
 ...ubscription_label_returns_set_value.1.json |   2 +-
 .../test_get_subscription_nonexistent.1.json  |   2 +-
 ...get_token_returns_initialized_token.1.json |   2 +-
 ...n_returns_none_when_not_initialized.1.json |   6 +-
 ...est_get_trial_end_with_trial_period.1.json |   2 +-
 ..._get_trial_end_without_trial_period.1.json |   2 +-
 .../test_global_volume_exceeds_limit.1.json   |   2 +-
 .../test_global_volume_window_reset.1.json    |   2 +-
 .../test_global_volume_within_limit.1.json    |   2 +-
 .../test_grace_period_ttl_extension.1.json    |   2 +-
 ...lth_check_active_subscription_count.1.json |   2 +-
 ...t_health_check_initialized_unpaused.1.json |   2 +-
 .../test/test_health_check_paused.1.json      |   2 +-
 .../test_health_check_pre_initialize.1.json   |   6 +-
 .../test_initialize_backward_compat.1.json    |   2 +-
 .../test_initialize_sets_instance_ttl.1.json  |   2 +-
 ...test_initialize_without_valid_token.1.json |   2 +-
 .../test/test_interval_minimum_valid.1.json   |   2 +-
 .../test/test_interval_too_short.1.json       |   2 +-
 ...e_due_false_for_paused_subscription.1.json |   2 +-
 ...harge_due_false_for_unknown_address.1.json |   2 +-
 ..._charge_due_false_past_grace_window.1.json |   2 +-
 ...arge_due_transitions_after_interval.1.json |   2 +-
 ...t_is_merchant_frozen_reflects_state.1.json |   2 +-
 ...d_returns_false_for_non_whitelisted.1.json |   2 +-
 .../test_merchant_revenue_from_charge.1.json  |   2 +-
 ...ub_count_double_cancel_no_underflow.1.json |   2 +-
 ...ount_resubscribe_different_merchant.1.json |   2 +-
 ...hant_sub_count_two_users_cancel_one.1.json |   2 +-
 ...pleted_event_with_version_and_count.1.json |   2 +-
 .../test/test_migrate_is_idempotent.1.json    |   2 +-
 .../test/test_migrate_non_admin_panics.1.json |   2 +-
 .../test_migrate_sets_schema_version.1.json   |   2 +-
 .../test/test_migrate_v1_to_v2.1.json         |   2 +-
 ...lti_token_independent_subscriptions.1.json |   2 +-
 .../test/test_multiple_users.1.json           |   2 +-
 ...st_next_charge_at_none_after_cancel.1.json |   2 +-
 ...rge_at_none_for_paused_subscription.1.json |   2 +-
 ..._charge_at_none_for_unknown_address.1.json |   2 +-
 ...charge_at_returns_correct_timestamp.1.json |   2 +-
 .../test/test_no_referral_returns_none.1.json |   2 +-
 ...dmin_add_and_remove_merchant_panics.1.json |   2 +-
 ...t_non_admin_set_grace_period_panics.1.json |   2 +-
 ...non_admin_set_max_batch_size_panics.1.json |   2 +-
 ...d_admin_loses_access_after_transfer.1.json |   2 +-
 ...use_on_inactive_subscription_panics.1.json |   2 +-
 .../test_pause_sets_indefinite_expiry.1.json  |   2 +-
 .../test/test_pause_sets_paused_true.1.json   |   2 +-
 ...til_auto_resume_clears_pause_expiry.1.json |   2 +-
 ..._pause_until_auto_resumes_on_charge.1.json |   2 +-
 ...t_pause_until_past_timestamp_panics.1.json |   2 +-
 .../test/test_pay_per_use.1.json              |   2 +-
 ...rotocol_fee_and_records_net_revenue.1.json |   2 +-
 ...er_use_does_not_update_last_charged.1.json |   2 +-
 .../test/test_pay_per_use_exceeds_cap.1.json  |   2 +-
 .../test/test_pay_per_use_inactive.1.json     |   2 +-
 .../test/test_pay_per_use_nonexistent.1.json  |   2 +-
 ...r_use_on_paused_subscription_panics.1.json |   2 +-
 ..._use_succeeds_after_merchant_frozen.1.json |   2 +-
 ...o_applies_protocol_fee_to_recipient.1.json |   2 +-
 ...daily_limit_shared_with_pay_per_use.1.json |   2 +-
 ...s_merchant_behaves_like_pay_per_use.1.json |   2 +-
 ...o_rejects_non_whitelisted_recipient.1.json |   2 +-
 ...transfers_to_recipient_not_merchant.1.json |   2 +-
 ..._zero_fee_bps_transfers_full_amount.1.json |   2 +-
 .../test/test_pay_per_use_zero_amount.1.json  |   2 +-
 .../test_referral_cleared_on_cancel.1.json    |   2 +-
 ...ral_clears_on_resubscribe_with_none.1.json |   2 +-
 .../test_referral_stored_on_subscribe.1.json  |   2 +-
 ...est_referral_updates_on_resubscribe.1.json |   2 +-
 ...it_allows_pay_per_use_after_removal.1.json |   2 +-
 .../test/test_resubscribe.1.json              |   2 +-
 ...ibe_active_does_not_duplicate_index.1.json |   2 +-
 ...t_resubscribe_zero_allowance_panics.1.json |   2 +-
 .../test_resume_clears_pause_expiry.1.json    |   2 +-
 ...resume_unpauses_and_charge_succeeds.1.json |   2 +-
 ...referral_rejected_via_try_subscribe.1.json |   2 +-
 .../test/test_set_and_get_metadata.1.json     |   2 +-
 .../test/test_set_fee_emits_event.1.json      |   2 +-
 .../test_set_fee_invalid_bps_panics.1.json    |   2 +-
 .../test_set_grace_period_emits_event.1.json  |   2 +-
 ..._batch_size_rejects_value_above_200.1.json |   2 +-
 ...et_metadata_label_at_limit_succeeds.1.json |   2 +-
 ...etadata_label_exceeding_limit_fails.1.json |   2 +-
 ...test_set_metadata_wrong_user_panics.1.json |   2 +-
 ...t_set_min_interval_non_admin_panics.1.json |   2 +-
 .../test_set_min_interval_zero_panics.1.json  |   2 +-
 ..._subscription_amount_admin_succeeds.1.json |   2 +-
 ...ption_amount_no_subscription_panics.1.json |   2 +-
 ...ubscription_amount_non_admin_panics.1.json |   2 +-
 ...ubscription_interval_admin_succeeds.1.json |   2 +-
 ...ion_interval_no_subscription_panics.1.json |   2 +-
 ...scription_interval_non_admin_panics.1.json |   2 +-
 ...t_subscription_interval_zero_panics.1.json |   2 +-
 ...t_enabled_false_allows_any_merchant.1.json |   2 +-
 ...ter_set_min_interval_lower_succeeds.1.json |   2 +-
 ...t_subscribe_amount_above_cap_panics.1.json |   2 +-
 ...st_subscribe_amount_at_cap_succeeds.1.json |   2 +-
 .../test/test_subscribe_and_charge.1.json     |   2 +-
 ..._subscribe_exact_allowance_succeeds.1.json |   2 +-
 ...test_subscribe_extends_instance_ttl.1.json |   2 +-
 ...subscribe_interval_minimum_succeeds.1.json |   2 +-
 ...rval_too_short_panics_default_floor.1.json |   2 +-
 ..._subscribe_interval_under_60_panics.1.json |   2 +-
 ...test_subscribe_non_contract_address.1.json |   2 +-
 ...ibe_non_whitelisted_merchant_panics.1.json |   2 +-
 ...e_overwrites_cancelled_subscription.1.json |   2 +-
 ...subscribe_to_frozen_merchant_panics.1.json |   2 +-
 ...be_valid_sac_token_address_succeeds.1.json |   2 +-
 ...cribe_whitelisted_merchant_succeeds.1.json |   2 +-
 ...scribe_with_metadata_label_too_long.1.json |   2 +-
 ...ta_no_subscription_on_label_failure.1.json |   2 +-
 ...est_subscribe_with_metadata_success.1.json |   2 +-
 ...ro_allowance_does_not_write_storage.1.json |   2 +-
 ...est_subscribe_zero_allowance_panics.1.json |   2 +-
 ...subscriber_index_three_unique_users.1.json |   2 +-
 ..._subscriber_page_limit_capped_at_50.1.json |   2 +-
 ...e_offset_beyond_count_returns_empty.1.json |   2 +-
 ...scription_struct_fields_match_input.1.json |   2 +-
 .../test/test_transfer_admin.1.json           |   2 +-
 .../test_transfer_admin_event_emitted.1.json  |   2 +-
 .../test_transfer_admin_requires_auth.1.json  |   2 +-
 ...test_transfer_subscription_succeeds.1.json |   2 +-
 ..._subscription_to_active_user_panics.1.json |   2 +-
 .../test/test_ttl_extension.1.json            |   2 +-
 ..._unfreeze_merchant_non_admin_panics.1.json |   2 +-
 ...nfreeze_merchant_non_frozen_is_noop.1.json |   2 +-
 .../test/test_upgrade_event_emitted.1.json    |   6 +-
 .../test/test_upgrade_event_emitted.2.json    |   2 +-
 .../test/test_user_can_switch_token.1.json    |   2 +-
 ...batch_add_duplicates_does_not_panic.1.json |   2 +-
 ...t_batch_add_exceeds_max_size_panics.1.json |   2 +-
 ...hitelist_batch_add_non_admin_panics.1.json |   2 +-
 ...whitelist_batch_add_three_merchants.1.json |   2 +-
 ...atch_remove_non_whitelisted_is_noop.1.json |   2 +-
 ...hitelist_batch_remove_two_merchants.1.json |   2 +-
 ..._withdraw_merchant_revenue_succeeds.1.json |   2 +-
 ...erchant_revenue_zero_balance_panics.1.json |   2 +-
 .../test/test_zero_amount.1.json              |   2 +-
 .../test/test_zero_interval.1.json            |   2 +-
 docs/ARCHITECTURE.md                          | 144 +++---
 docs/COMPLIANCE.md                            | 126 +++---
 docs/CONTRIBUTING-CONTRACT.md                 |  31 +-
 docs/CONTRIBUTING-FRONTEND.md                 |  27 +-
 docs/DAILY-LIMITS.md                          |  90 ++--
 docs/DEPLOYMENT.md                            |  45 +-
 docs/ERROR-CODES.md                           | 380 ++++++++--------
 docs/EVENT-DRIVEN-GUIDE.md                    | 103 ++---
 docs/FRONTEND-COMPONENTS.md                   | 357 +++++++--------
 docs/FRONTEND.md                              |  14 +-
 docs/GLOSSARY.md                              |  37 +-
 docs/INTEGRATION-GUIDE.md                     | 116 +++--
 docs/KEEPER.md                                |  66 +--
 docs/MAINNET-DEPLOYMENT.md                    |  68 +--
 docs/MERCHANT-INTEGRATION.md                  | 126 +++---
 docs/MULTI-TOKEN.md                           |  49 ++-
 docs/ONBOARDING.md                            |  17 +-
 docs/REFERRAL.md                              |   7 +
 docs/REFERRALS.md                             | 141 +++---
 docs/SECURITY.md                              |  76 ++--
 docs/STRUCTURE.md                             |  74 ++--
 docs/SUBSCRIBER-LIFECYCLE.md                  |  34 +-
 docs/TESTING.md                               |  22 +-
 docs/architecture/storage_and_ttl.md          | 102 ++---
 docs/architecture/two-step-auth.md            |  26 +-
 docs/development/performance-benchmarking.md  |  33 +-
 docs/development/testing_runbook.md           |  70 +--
 docs/integrations/frontend_integration.md     |  28 +-
 docs/operations/keeper_runbook.md             |  81 ++--
 docs/security/audit-preparation.md            |  88 ++--
 docs/security/threat_matrix.md                |  19 +-
 docs/spec/lifecycle_spec.md                   |  90 +++-
 scripts/replay-dlq.ts                         | 414 ++++++++++++++++++
 258 files changed, 2202 insertions(+), 1566 deletions(-)
 create mode 100644 scripts/replay-dlq.ts

diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index 5a70b84b..8465f63f 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -2,9 +2,9 @@ name: Frontend
 
 on:
   push:
-    branches: [ "master" ]
+    branches: ["master"]
   pull_request:
-    branches: [ "master" ]
+    branches: ["master"]
 
 defaults:
   run:
@@ -12,21 +12,20 @@ defaults:
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
-      with:
-        node-version: 20
-        cache: npm
-        cache-dependency-path: frontend/package-lock.json
-    - name: Install dependencies
-      run: npm ci
-    - name: Lint
-      run: npm run lint
-    - name: Format check
-      run: npx prettier --check .
-    - name: Build
-      run: npm run build
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Install dependencies
+        run: npm ci
+      - name: Lint
+        run: npm run lint
+      - name: Format check
+        run: npx prettier --check .
+      - name: Build
+        run: npm run build
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index d7e17ded..61fbe643 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -2,9 +2,9 @@ name: Backend (Rust)
 
 on:
   push:
-    branches: [ "master" ]
+    branches: ["master"]
   pull_request:
-    branches: [ "master" ]
+    branches: ["master"]
 
 env:
   CARGO_TERM_COLOR: always
@@ -15,19 +15,18 @@ defaults:
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
-    - name: Install Rust target
-      run: rustup target add wasm32-unknown-unknown
-    - name: Clippy
-      run: cargo clippy -- -D warnings
-      working-directory: contract
-    - name: Build
-      run: cargo build --verbose
-      working-directory: contract
-    - name: Run tests
-      run: cargo test --verbose
-      working-directory: contract
+      - uses: actions/checkout@v4
+      - name: Install Rust target
+        run: rustup target add wasm32-unknown-unknown
+      - name: Clippy
+        run: cargo clippy -- -D warnings
+        working-directory: contract
+      - name: Build
+        run: cargo build --verbose
+        working-directory: contract
+      - name: Run tests
+        run: cargo test --verbose
+        working-directory: contract
diff --git a/AGENTS.md b/AGENTS.md
index eff86401..16c7f3f1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -5,7 +5,7 @@ PayFlow (also referred to as FlowPay) is a decentralized subscription and recurr
 ## Project Overview
 
 - **Core Technology:** Stellar Soroban (Rust), React + TypeScript (Frontend)
-- **Architecture:** 
+- **Architecture:**
   - **Smart Contract (`/contract`):** Handles subscription logic, charging, cancellations, and pay-per-use microtransactions.
   - **Frontend (`/frontend`):** A React-based dashboard for users to manage subscriptions and for merchants to view revenue/subscribers.
   - **Documentation (`/docs`):** Comprehensive guides on API, architecture, deployment, and testing.
@@ -13,6 +13,7 @@ PayFlow (also referred to as FlowPay) is a decentralized subscription and recurr
 ## Key Components & Technologies
 
 ### Smart Contract (Rust/Soroban)
+
 - **Primary Contract:** `FlowPay` in `contract/src/lib.rs`.
 - **Key Functions:**
   - `initialize(token)`: Sets the primary SAC token (e.g., XLM).
@@ -24,6 +25,7 @@ PayFlow (also referred to as FlowPay) is a decentralized subscription and recurr
 - **Features:** Grace periods, merchant whitelisting, protocol fees, referral tracking, and subscription metadata.
 
 ### Frontend (React/TypeScript)
+
 - **Framework:** Vite + React + TypeScript.
 - **Blockchain Interaction:** `frontend/src/stellar.ts` uses `@stellar/stellar-sdk` and Soroban RPC.
 - **Wallet Support:** Freighter Wallet via `useWallet` hook.
@@ -32,21 +34,25 @@ PayFlow (also referred to as FlowPay) is a decentralized subscription and recurr
 ## Building and Running
 
 ### Prerequisites
+
 - Rust 1.70+ with `wasm32-unknown-unknown` target.
 - Soroban CLI.
 - Node.js 18+.
 
 ### Root Commands (using `package.json` scripts)
+
 - **Typecheck Frontend:** `npm run typecheck`
 - **Build Frontend:** `npm run build:frontend`
 - **Test Contract:** `npm run backend:test`
 - **Check Contract:** `npm run backend:typecheck`
 
 ### Contract (`/contract`)
+
 - **Build:** `cargo build --release --target wasm32-unknown-unknown`
 - **Test:** `cargo test`
 
 ### Frontend (`/frontend`)
+
 - **Install Dependencies:** `npm install`
 - **Development Server:** `npm run dev`
 - **Build:** `npm run build`
@@ -56,18 +62,22 @@ PayFlow (also referred to as FlowPay) is a decentralized subscription and recurr
 ## Development Conventions
 
 ### Coding Style
+
 - **Contract:** Idiomatic Rust using `soroban-sdk`. Strict use of `no_std`.
 - **Frontend:** Functional React components with TypeScript. Prefer Vanilla CSS for styling (as seen in `index.css`).
 
 ### Testing Practices
+
 - **Contract:** Comprehensive unit tests in `contract/src/test.rs`. Use `soroban-sdk`'s `testutils`.
 - **Frontend:** Vitest for unit and component testing. Smoke tests for main application entry points.
 
 ### Contribution Guidelines
+
 - Refer to `CONTRIBUTING.md` for detailed instructions.
 - Husky is used for pre-commit/pre-push hooks (linting and type-checking).
 
 ## Important Files
+
 - `contract/src/lib.rs`: Entry point for smart contract logic.
 - `frontend/src/stellar.ts`: Central hub for all Soroban/Stellar interactions.
 - `docs/API.md`: Detailed contract function documentation.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a33d58ba..0ad21baf 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -43,15 +43,15 @@ Be respectful. We welcome contributors of all experience levels. Harassment, gat
 
 These are well-scoped tasks that don't require deep knowledge of the whole codebase:
 
-| Task | Area | Difficulty |
-| --- | --- | --- |
-| Add USDC / custom SAC token support | Contract | Medium |
-| Build a Node.js keeper service that calls `charge()` on a schedule | Backend | Medium |
-| Add subscription pause/resume functions | Contract | Medium |
-| Improve frontend error messages with human-readable contract panics | Frontend | Easy |
-| Add `test_pay_per_use` unit test | Contract | Easy |
-| Add `test_double_initialize` unit test | Contract | Easy |
-| Display transaction history using contract events | Frontend | Hard |
+| Task                                                                | Area     | Difficulty |
+| ------------------------------------------------------------------- | -------- | ---------- |
+| Add USDC / custom SAC token support                                 | Contract | Medium     |
+| Build a Node.js keeper service that calls `charge()` on a schedule  | Backend  | Medium     |
+| Add subscription pause/resume functions                             | Contract | Medium     |
+| Improve frontend error messages with human-readable contract panics | Frontend | Easy       |
+| Add `test_pay_per_use` unit test                                    | Contract | Easy       |
+| Add `test_double_initialize` unit test                              | Contract | Easy       |
+| Display transaction history using contract events                   | Frontend | Hard       |
 
 ---
 
@@ -99,6 +99,7 @@ npm run dev
 5. Push your branch and open a Pull Request against `main`
 
 Branch naming conventions:
+
 - `feat/` — new feature
 - `fix/` — bug fix
 - `docs/` — documentation only
@@ -131,7 +132,6 @@ See the full guide: [`docs/CONTRIBUTING-FRONTEND.md`](docs/CONTRIBUTING-FRONTEND
 - Run `npm run format` to auto-format all source files with Prettier
 - Run `npm run build` to confirm there are no TypeScript errors before submitting
 
-
 ---
 
 ## Commit Style
@@ -180,6 +180,7 @@ npm run generate:types
 ```
 
 This invokes `scripts/generate-types.sh`, which requires either:
+
 - `CONTRACT_ID` env var pointing to a deployed contract, or
 - A compiled WASM artifact at `contract/target/wasm32-unknown-unknown/release/payflow.wasm`
 
diff --git a/Issues.md b/Issues.md
index c82a8288..9a2caaf3 100644
--- a/Issues.md
+++ b/Issues.md
@@ -68,4 +68,4 @@ Acceptance criteria
 
 Countdown appears on the subscription card
 Overdue state is visually distinct
-PR includes screenshot
\ No newline at end of file
+PR includes screenshot
diff --git a/README.md b/README.md
index fe786e95..233b304a 100644
--- a/README.md
+++ b/README.md
@@ -53,15 +53,16 @@ pub fn get_daily_limit(env: Env, user: Address) -> Option<i128> {
 get_daily_limit(env: Env, user: Address) -> Option<i128>
 ```
 
-| Parameter | Type | Description |
-|-----------|------|-------------|
-| `user` | `Address` | The subscriber address to query |
+| Parameter | Type      | Description                     |
+| --------- | --------- | ------------------------------- |
+| `user`    | `Address` | The subscriber address to query |
 
 **Returns:** `Some(limit)` in stroops if a limit is set, `None` otherwise.  
 **Auth:** None required.  
 **Storage:** Reads `DataKey::DailyLimit(user)` from temporary storage.
 
 **CLI example:**
+
 ```bash
 soroban contract invoke \
   --id <CONTRACT_ID> \
@@ -139,6 +140,7 @@ cargo test daily_limit
 ```
 
 Expected output:
+
 ```
 test test::test_daily_limit_allows_spend_within_limit ... ok
 test test::test_daily_limit_accumulates_across_calls ... ok
@@ -202,11 +204,11 @@ Stellar's Soroban platform uses state archiving — persistent storage entries h
 
 ## Prerequisites
 
-| Tool | Version | Install |
-|------|---------|---------|
-| Rust | 1.70+ | `curl https://sh.rustup.rs -sSf \| sh` |
-| wasm32 target | — | `rustup target add wasm32-unknown-unknown` |
-| Soroban CLI | 21.x | `cargo install --locked soroban-cli` |
+| Tool          | Version | Install                                    |
+| ------------- | ------- | ------------------------------------------ |
+| Rust          | 1.70+   | `curl https://sh.rustup.rs -sSf \| sh`     |
+| wasm32 target | —       | `rustup target add wasm32-unknown-unknown` |
+| Soroban CLI   | 21.x    | `cargo install --locked soroban-cli`       |
 
 ---
 
diff --git a/SECURITY.md b/SECURITY.md
index 830a5df0..ff141c54 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -5,23 +5,28 @@
 If you discover a security vulnerability in PayFlow, please report it responsibly:
 
 ### Preferred Method
+
 Use **GitHub Security Advisories** to report vulnerabilities privately:
+
 1. Go to the "Security" tab in this repository
 2. Click "Report a vulnerability"
 3. Fill out the advisory form
 
 ### Alternative Method
+
 Email: **security@payflow.dev**
 
 Subject: `[PayFlow Security] Brief description`
 
 ### What to Include
+
 - Description of the vulnerability
 - Steps to reproduce
 - Potential impact assessment
 - Suggested mitigations (if any)
 
 ### Response Timeline
+
 - **Acknowledgment:** Within 48 hours
 - **Fix timeline:** Within 14 days for critical issues (depending on complexity)
 - **Credit:** We will credit researchers in release notes unless you prefer anonymity
@@ -37,6 +42,7 @@ For the full threat model, auth matrix, and storage notes, see [docs/SECURITY.md
 ## Scope
 
 In scope for vulnerability reports:
+
 - Smart contract logic vulnerabilities
 - Authorization bypass issues
 - Fund loss or theft scenarios
@@ -44,6 +50,7 @@ In scope for vulnerability reports:
 - Integer overflow/underflow issues
 
 Out of scope:
+
 - Issues in third-party dependencies (report to upstream)
 - Social engineering attacks
 - Physical security issues
diff --git a/TODO.md b/TODO.md
index bb3ddd60..af5f3833 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,6 +1,7 @@
 # TODO (PayFlow)
 
 ## Frontend DX: Hook JSDoc coverage
+
 - [ ] Scan all files in `frontend/src/hooks/` and verify which exported hooks are missing/partial JSDoc.
 - [ ] Add/upgrade `/** ... */` JSDoc blocks for every hook to include:
   - purpose
@@ -9,4 +10,3 @@
   - side effects
   - `@example` usage
 - [ ] Run TypeScript compile/typecheck for `frontend` to ensure no errors.
-
diff --git a/UIDesign.md b/UIDesign.md
index 95203571..ed114b9a 100644
--- a/UIDesign.md
+++ b/UIDesign.md
@@ -1 +1 @@
-https://www.figma.com/design/bhHlIX6xxmzhwcGga6ocmR/SiLioLabs-PayFlow?node-id=0-1&t=AcUOdKr2iI2eOxgC-1
\ No newline at end of file
+https://www.figma.com/design/bhHlIX6xxmzhwcGga6ocmR/SiLioLabs-PayFlow?node-id=0-1&t=AcUOdKr2iI2eOxgC-1
diff --git a/code.md b/code.md
index a06aed51..272b0b7b 100644
--- a/code.md
+++ b/code.md
@@ -1,81 +1,94 @@
-You are a senior Rust developer contributing to an open-source project built on the Stellar ecosystem. 
-
+You are a senior Rust developer contributing to an open-source project built on the Stellar ecosystem.
 
 1. Analyze Assigned Issues
-Carefully read the below assigned issues.
-Help solve each issues and map them to relevant parts of the codebase.
+   Carefully read the below assigned issues.
+   Help solve each issues and map them to relevant parts of the codebase.
+
+ISSUE #481 [CONTRACT-25] Add Event Index Metadata to All Published Events
 
-ISSUE #481 [CONTRACT-25] Add Event Index Metadata to All Published Events 
 ### Background
+
 All events in `events.rs` are published with a two-element topic tuple `(Symbol, Address)` or `(Symbol,)`. Soroban events are indexed by topic on the RPC layer, but the current events carry no sequence or correlation metadata. When `batch_charge` processes 50 users and emits 50 charged events in one transaction, there is no way for an event consumer to reconstruct the original batch ordering or correlate a charge event back to a specific `batch_charge` invocation. Keeper bots and analytics pipelines that process events asynchronously must rely on ledger sequence numbers alone, which breaks when multiple `batch_charge` calls land in the same ledger.
 
 ### Task
+
 Add a `ledger_sequence: u32` field to `ChargeEventData` (already a `#[contracttype]` struct). Populate it with `env.ledger().sequence()` in `publish_charged`. Add a consistent `sequence: u32` field to new event data structs for `publish_subscribed`, `publish_cancelled`, and `publish_pay_per_use` — wrap each in a new `#[contracttype]` struct (`SubscribedEventData`, `CancelledEventData`, `PayPerUseEventData`) rather than using bare tuples. This makes all major events strongly typed and carries ledger context.
 
 ### Key Files
-* `contract/src/events.rs` — define `SubscribedEventData`, `CancelledEventData`, `PayPerUseEventData` structs; add `ledger_sequence: u32` to all; update all `publish_*` functions to use these structs
-* `contract/src/lib.rs` — no changes needed if event functions are called correctly
-* `contract/src/test.rs` — update any tests that assert on raw event tuples to match new struct shapes; add a test reading back charged event data and asserting `ledger_sequence` equals `env.ledger().sequence()`
+
+- `contract/src/events.rs` — define `SubscribedEventData`, `CancelledEventData`, `PayPerUseEventData` structs; add `ledger_sequence: u32` to all; update all `publish_*` functions to use these structs
+- `contract/src/lib.rs` — no changes needed if event functions are called correctly
+- `contract/src/test.rs` — update any tests that assert on raw event tuples to match new struct shapes; add a test reading back charged event data and asserting `ledger_sequence` equals `env.ledger().sequence()`
 
 ### Edge Cases
-* `ChargeEventData` already exists as a struct — add `ledger_sequence` as a new field; existing snapshot tests will need regeneration
-* Snapshot files in `contract/test_snapshots/` will change — delete and regenerate with `cargo test` (this is expected and must be noted in the PR)
-* Do not add `ledger_sequence` to admin-only events (`publish_upgraded`, `publish_admin_transferred`) — those have different consumers
+
+- `ChargeEventData` already exists as a struct — add `ledger_sequence` as a new field; existing snapshot tests will need regeneration
+- Snapshot files in `contract/test_snapshots/` will change — delete and regenerate with `cargo test` (this is expected and must be noted in the PR)
+- Do not add `ledger_sequence` to admin-only events (`publish_upgraded`, `publish_admin_transferred`) — those have different consumers
 
 ### Acceptance Criteria
+
 - [ ] `ChargeEventData`, `SubscribedEventData`, `CancelledEventData`, `PayPerUseEventData` all carry `ledger_sequence: u32`
 - [ ] All four `publish_*` functions populate `ledger_sequence` from `env.ledger().sequence()`
 - [ ] Test: assert charged event's `ledger_sequence` field equals the ledger sequence at charge time
 - [ ] All snapshot files regenerated and committed
 - [ ] `cargo test` passes with no regressions
 
-
-ISSUE #468  ## [CONTRACT-12] Implement validate_token_is_contract Using WASM-Safe XDR Inspection 
-
+ISSUE #468 ## [CONTRACT-12] Implement validate_token_is_contract Using WASM-Safe XDR Inspection
 
 ### Background
+
 `subscribe` in `lib.rs` contains an inline token validation using `token.clone().to_xdr(&env).get(7) == Some(0)` to detect non-contract addresses. This is an undocumented, fragile heuristic based on XDR byte layout — it has no test coverage explaining the magic byte index, it will silently break if Soroban's XDR serialization changes, and it lives inline in `subscribe` rather than in `validation.rs`. The existing `ContractError::InvalidTokenAddress` error is correct but the detection logic is brittle. The proper check is to attempt a `token::Client::new(env, &token).decimals()` call and catch the resulting host trap — or validate that the Address resolves to a contract via the `env.deployer()` API.
 
 ### Task
+
 Move token validation into a `validate_token_address(env: &Env, token: &Address)` function in `validation.rs`. Replace the XDR byte hack with a call to `token::Client::new(env, token).decimals()` wrapped in a `try_` call (using soroban-sdk's `try_` invocation pattern for cross-contract calls). If the call returns an error, panic with `ContractError::InvalidTokenAddress`. Remove the inline XDR check from `subscribe` and replace it with `validation::validate_token_address`. Add the token module import to `validation.rs`.
 
 ### Key Files
-* `contract/src/validation.rs` — add `validate_token_address(env, token)`
-* `contract/src/lib.rs` — replace inline XDR check in `subscribe` with the new helper
-* `contract/src/test.rs` — the existing `test_subscribe_non_contract_address` test must continue to pass; add a test for a valid contract token address succeeding
+
+- `contract/src/validation.rs` — add `validate_token_address(env, token)`
+- `contract/src/lib.rs` — replace inline XDR check in `subscribe` with the new helper
+- `contract/src/test.rs` — the existing `test_subscribe_non_contract_address` test must continue to pass; add a test for a valid contract token address succeeding
 
 ### Edge Cases
-* In the test environment, soroban-sdk testutils register mock contracts — ensure the mock token used in `setup()` passes the new validation without changes to test infrastructure
-* If `token::Client::try_decimals()` is not available in the current SDK version, use an alternative introspection method and document it clearly in a code comment
-* The validation must occur after amount and interval checks to preserve existing error ordering in `subscribe`
+
+- In the test environment, soroban-sdk testutils register mock contracts — ensure the mock token used in `setup()` passes the new validation without changes to test infrastructure
+- If `token::Client::try_decimals()` is not available in the current SDK version, use an alternative introspection method and document it clearly in a code comment
+- The validation must occur after amount and interval checks to preserve existing error ordering in `subscribe`
 
 ### Acceptance Criteria
+
 - [ ] `validate_token_address(env, token)` exists in `validation.rs` with a doc comment explaining the approach
 - [ ] `subscribe` no longer contains any XDR byte-index magic; calls `validate_token_address` instead
 - [ ] `test_subscribe_non_contract_address` passes without modification to test setup
 - [ ] New test: subscribing with a valid SAC token address succeeds
 - [ ] `cargo test` passes with no regression
 
-ISSUE #472  ## [CONTRACT-16] Implement Configurable MAX_BATCH_SIZE Guard in batch_charge 
+ISSUE #472 ## [CONTRACT-16] Implement Configurable MAX_BATCH_SIZE Guard in batch_charge
 
 ### Background
+
 `batch_charge` in `batch.rs` accepts an unbounded `Vec<Address>` — a caller can pass thousands of addresses in a single transaction. Soroban enforces a per-transaction instruction budget, but the contract itself provides no explicit guard. A malicious or misconfigured keeper could submit a batch large enough to exhaust the instruction budget mid-execution, producing a partial batch result where some users are charged and others are not, with no way for the caller to distinguish charged-and-failed from not-yet-attempted. More critically, without a size cap the function's gas cost is unbounded and cannot be reliably estimated for keeper automation.
 
 ### Task
+
 Add a `MAX_BATCH_SIZE: u32 = 50` constant in `batch.rs`. At the start of `batch_charge`, check if `users.len() > MAX_BATCH_SIZE` and panic with a new `ContractError::BatchTooLarge = 20`. Add `get_max_batch_size(env: Env) -> u32` as a public read-only function returning the constant. Expose an admin-configurable override via `DataKey::MaxBatchSize` instance storage — `set_max_batch_size(env, size)` (admin-only, max value 200) so the limit can be adjusted as Soroban's instruction budget evolves. If `DataKey::MaxBatchSize` is unset, fall back to the hardcoded `MAX_BATCH_SIZE` constant.
 
 ### Key Files
-* `contract/src/batch.rs` — add `MAX_BATCH_SIZE` constant; add size guard using storage-or-default limit
-* `contract/src/errors.rs` — add `BatchTooLarge = 20`
-* `contract/src/lib.rs` — add `DataKey::MaxBatchSize`; add `get_max_batch_size` and `set_max_batch_size` public functions; `set_max_batch_size` requires admin auth
-* `contract/src/test.rs` — test: batch of 51 addresses panics with `BatchTooLarge`; test: `set_max_batch_size(10)` then batch of 11 panics; test: non-admin `set_max_batch_size` panics
+
+- `contract/src/batch.rs` — add `MAX_BATCH_SIZE` constant; add size guard using storage-or-default limit
+- `contract/src/errors.rs` — add `BatchTooLarge = 20`
+- `contract/src/lib.rs` — add `DataKey::MaxBatchSize`; add `get_max_batch_size` and `set_max_batch_size` public functions; `set_max_batch_size` requires admin auth
+- `contract/src/test.rs` — test: batch of 51 addresses panics with `BatchTooLarge`; test: `set_max_batch_size(10)` then batch of 11 panics; test: non-admin `set_max_batch_size` panics
 
 ### Edge Cases
-* `set_max_batch_size` must reject values > 200 with `ContractError::InvalidFeeBps` — or add a new `ContractError::InvalidBatchSize = 21` for clarity
-* An empty batch (`users.len() == 0`) must return an empty `Vec` without panicking
-* The existing `test_batch_charge_stress` test uses a large batch — update it to use a size $\le$ `MAX_BATCH_SIZE` or call `set_max_batch_size` first
+
+- `set_max_batch_size` must reject values > 200 with `ContractError::InvalidFeeBps` — or add a new `ContractError::InvalidBatchSize = 21` for clarity
+- An empty batch (`users.len() == 0`) must return an empty `Vec` without panicking
+- The existing `test_batch_charge_stress` test uses a large batch — update it to use a size $\le$ `MAX_BATCH_SIZE` or call `set_max_batch_size` first
 
 ### Acceptance Criteria
+
 - [ ] `ContractError::BatchTooLarge = 20` in `errors.rs`
 - [ ] `batch_charge` with `users.len() > max` panics with `BatchTooLarge`
 - [ ] `set_max_batch_size` requires admin auth and rejects values > 200
@@ -83,29 +96,34 @@ Add a `MAX_BATCH_SIZE: u32 = 50` constant in `batch.rs`. At the start of `batch_
 - [ ] Test: batch of 51 with default limit panics; batch of 50 succeeds
 - [ ] `cargo test` passes, `test_batch_charge_stress` updated accordingly
 
-ISSUE #474 ## [CONTRACT-18] Implement cancel_and_refund_prorated for Partial-Period Refunds 
+ISSUE #474 ## [CONTRACT-18] Implement cancel_and_refund_prorated for Partial-Period Refunds
 
-* **Points:** 200
-* **Labels:** contract, subscriptions, token, ux
+- **Points:** 200
+- **Labels:** contract, subscriptions, token, ux
 
 ### Background
+
 `cancel` in `lib.rs` immediately deactivates the subscription without any refund mechanism. Users who cancel mid-period have paid for a full billing interval but cannot recoup the unused portion. While full refund logic is complex and out of scope, a prorated refund — where the contract transfers back $\text{amount} \times (\text{remaining\_seconds} / \text{interval})$ to the user — is both mathematically tractable and a significant UX differentiator. The contract already holds no funds directly (charges use `transfer_from` on the user's allowance), so a refund is a merchant-to-user transfer, requiring the merchant's authorization.
 
 ### Task
+
 Add `cancel_and_refund_prorated(env: Env, user: Address, merchant: Address)` requiring both `user.require_auth()` and `merchant.require_auth()`. Compute $\text{elapsed} = \text{now} - \text{last\_charged}$, $\text{remaining} = \text{interval} - \text{elapsed}$ (clamped to 0 if $\text{elapsed} \ge \text{interval}$), $\text{refund} = \text{amount} \times \text{remaining} / \text{interval}$. If $\text{refund} > 0$, transfer refund from merchant to user using `token::Client::new(&env, &sub.token).transfer(&merchant, &user, &refund)`. Then cancel the subscription (set `active: false`, decrement counts). Emit a `subscription_cancelled_with_refund` event including the refund amount.
 
 ### Key Files
-* `contract/src/lib.rs` — add `cancel_and_refund_prorated`; factor `cancel` bookkeeping into `cancel_inner(env, user)` to avoid duplication
-* `contract/src/events.rs` — add `publish_cancelled_with_refund(env, user, refund_amount)`
-* `contract/src/test.rs` — test: cancel 25% into a 100-second interval on a 1,000,000 stroop subscription yields a 750,000 refund; test: cancel at or after interval end yields 0 refund and no transfer; test: missing subscription panics
+
+- `contract/src/lib.rs` — add `cancel_and_refund_prorated`; factor `cancel` bookkeeping into `cancel_inner(env, user)` to avoid duplication
+- `contract/src/events.rs` — add `publish_cancelled_with_refund(env, user, refund_amount)`
+- `contract/src/test.rs` — test: cancel 25% into a 100-second interval on a 1,000,000 stroop subscription yields a 750,000 refund; test: cancel at or after interval end yields 0 refund and no transfer; test: missing subscription panics
 
 ### Edge Cases
-* Both user and merchant must auth — a user cannot force a refund without merchant consent
-* If $\text{elapsed} \ge \text{interval}$, $\text{remaining} = 0$ and $\text{refund} = 0$ — skip the transfer entirely
-* Integer division truncation is acceptable (document in code comments); do not use floating point
-* The function must still cancel the subscription even when `refund == 0`
+
+- Both user and merchant must auth — a user cannot force a refund without merchant consent
+- If $\text{elapsed} \ge \text{interval}$, $\text{remaining} = 0$ and $\text{refund} = 0$ — skip the transfer entirely
+- Integer division truncation is acceptable (document in code comments); do not use floating point
+- The function must still cancel the subscription even when `refund == 0`
 
 ### Acceptance Criteria
+
 - [ ] Both `user.require_auth()` and `merchant.require_auth()` are called
 - [ ] Prorated refund formula: $\text{refund} = \text{amount} \times \max(0, \text{interval} - \text{elapsed}) / \text{interval}$
 - [ ] Token transfer only occurs when $\text{refund} > 0$
diff --git a/contract/test_snapshots/bench/bench_batch_charge_10_users.1.json b/contract/test_snapshots/bench/bench_batch_charge_10_users.1.json
index 02ad1db8..777d2cf3 100644
--- a/contract/test_snapshots/bench/bench_batch_charge_10_users.1.json
+++ b/contract/test_snapshots/bench/bench_batch_charge_10_users.1.json
@@ -1080,4 +1080,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/bench/bench_charge.1.json b/contract/test_snapshots/bench/bench_charge.1.json
index 23f74480..f2b961dc 100644
--- a/contract/test_snapshots/bench/bench_charge.1.json
+++ b/contract/test_snapshots/bench/bench_charge.1.json
@@ -1080,4 +1080,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/bench/bench_charge_vs_subscribe_ratio.1.json b/contract/test_snapshots/bench/bench_charge_vs_subscribe_ratio.1.json
index 824994d3..8279cc45 100644
--- a/contract/test_snapshots/bench/bench_charge_vs_subscribe_ratio.1.json
+++ b/contract/test_snapshots/bench/bench_charge_vs_subscribe_ratio.1.json
@@ -1080,4 +1080,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/bench/bench_pay_per_use.1.json b/contract/test_snapshots/bench/bench_pay_per_use.1.json
index 02ad1db8..777d2cf3 100644
--- a/contract/test_snapshots/bench/bench_pay_per_use.1.json
+++ b/contract/test_snapshots/bench/bench_pay_per_use.1.json
@@ -1080,4 +1080,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/bench/bench_subscribe.1.json b/contract/test_snapshots/bench/bench_subscribe.1.json
index 23f74480..f2b961dc 100644
--- a/contract/test_snapshots/bench/bench_subscribe.1.json
+++ b/contract/test_snapshots/bench/bench_subscribe.1.json
@@ -1080,4 +1080,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_accept_admin_without_proposal_panics.1.json b/contract/test_snapshots/test/test_accept_admin_without_proposal_panics.1.json
index 2c365676..cf93af38 100644
--- a/contract/test_snapshots/test/test_accept_admin_without_proposal_panics.1.json
+++ b/contract/test_snapshots/test/test_accept_admin_without_proposal_panics.1.json
@@ -1013,4 +1013,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_active_count_decrements_on_cancel.1.json b/contract/test_snapshots/test/test_active_count_decrements_on_cancel.1.json
index 5a835644..5d6b3a41 100644
--- a/contract/test_snapshots/test/test_active_count_decrements_on_cancel.1.json
+++ b/contract/test_snapshots/test/test_active_count_decrements_on_cancel.1.json
@@ -1807,4 +1807,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_active_count_does_not_double_count_on_resubscribe.1.json b/contract/test_snapshots/test/test_active_count_does_not_double_count_on_resubscribe.1.json
index 9495a0f0..d162e383 100644
--- a/contract/test_snapshots/test/test_active_count_does_not_double_count_on_resubscribe.1.json
+++ b/contract/test_snapshots/test/test_active_count_does_not_double_count_on_resubscribe.1.json
@@ -2198,4 +2198,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_active_count_increments_on_subscribe.1.json b/contract/test_snapshots/test/test_active_count_increments_on_subscribe.1.json
index 3d428992..476b044b 100644
--- a/contract/test_snapshots/test/test_active_count_increments_on_subscribe.1.json
+++ b/contract/test_snapshots/test/test_active_count_increments_on_subscribe.1.json
@@ -1676,4 +1676,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_active_count_multiple_users.1.json b/contract/test_snapshots/test/test_active_count_multiple_users.1.json
index f88b4d61..b3fa0531 100644
--- a/contract/test_snapshots/test/test_active_count_multiple_users.1.json
+++ b/contract/test_snapshots/test/test_active_count_multiple_users.1.json
@@ -2764,4 +2764,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_admin_batch_pause_subscriptions_freezes_multiple_accounts.1.json b/contract/test_snapshots/test/test_admin_batch_pause_subscriptions_freezes_multiple_accounts.1.json
index 3db2b0c7..72f31dc8 100644
--- a/contract/test_snapshots/test/test_admin_batch_pause_subscriptions_freezes_multiple_accounts.1.json
+++ b/contract/test_snapshots/test/test_admin_batch_pause_subscriptions_freezes_multiple_accounts.1.json
@@ -2969,4 +2969,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_auto_resumes_paused_subscription_past_expiry.1.json b/contract/test_snapshots/test/test_batch_charge_auto_resumes_paused_subscription_past_expiry.1.json
index 74e9ad58..69c14ec7 100644
--- a/contract/test_snapshots/test/test_batch_charge_auto_resumes_paused_subscription_past_expiry.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_auto_resumes_paused_subscription_past_expiry.1.json
@@ -1892,4 +1892,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_charged_and_skipped.1.json b/contract/test_snapshots/test/test_batch_charge_charged_and_skipped.1.json
index 48a7b2e5..b81c22e9 100644
--- a/contract/test_snapshots/test/test_batch_charge_charged_and_skipped.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_charged_and_skipped.1.json
@@ -3397,4 +3397,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_empty.1.json b/contract/test_snapshots/test/test_batch_charge_empty.1.json
index cf7f4630..a8ce4934 100644
--- a/contract/test_snapshots/test/test_batch_charge_empty.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_empty.1.json
@@ -933,4 +933,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_grace_period_elapsed.1.json b/contract/test_snapshots/test/test_batch_charge_grace_period_elapsed.1.json
index 2d196443..ffc384c2 100644
--- a/contract/test_snapshots/test/test_batch_charge_grace_period_elapsed.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_grace_period_elapsed.1.json
@@ -1899,4 +1899,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_inactive.1.json b/contract/test_snapshots/test/test_batch_charge_inactive.1.json
index 3819d095..d52f9d80 100644
--- a/contract/test_snapshots/test/test_batch_charge_inactive.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_inactive.1.json
@@ -1773,4 +1773,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_no_subscription.1.json b/contract/test_snapshots/test/test_batch_charge_no_subscription.1.json
index a143c9a2..4e19eb80 100644
--- a/contract/test_snapshots/test/test_batch_charge_no_subscription.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_no_subscription.1.json
@@ -945,4 +945,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_ordering.1.json b/contract/test_snapshots/test/test_batch_charge_ordering.1.json
index edfbc45e..9641a75c 100644
--- a/contract/test_snapshots/test/test_batch_charge_ordering.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_ordering.1.json
@@ -4350,4 +4350,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_over_default_limit_panics.1.json b/contract/test_snapshots/test/test_batch_charge_over_default_limit_panics.1.json
index ace39ae0..2f7a7363 100644
--- a/contract/test_snapshots/test/test_batch_charge_over_default_limit_panics.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_over_default_limit_panics.1.json
@@ -1339,4 +1339,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_paused.1.json b/contract/test_snapshots/test/test_batch_charge_paused.1.json
index 7e874845..01e51c38 100644
--- a/contract/test_snapshots/test/test_batch_charge_paused.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_paused.1.json
@@ -1807,4 +1807,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_stress.1.json b/contract/test_snapshots/test/test_batch_charge_stress.1.json
index 4fcc679d..664e047f 100644
--- a/contract/test_snapshots/test/test_batch_charge_stress.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_stress.1.json
@@ -61362,4 +61362,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_charge_with_fee.1.json b/contract/test_snapshots/test/test_batch_charge_with_fee.1.json
index f8955ed6..7900cb92 100644
--- a/contract/test_snapshots/test/test_batch_charge_with_fee.1.json
+++ b/contract/test_snapshots/test/test_batch_charge_with_fee.1.json
@@ -4368,4 +4368,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_pause_subscriptions_exceeds_max_size_panics.1.json b/contract/test_snapshots/test/test_batch_pause_subscriptions_exceeds_max_size_panics.1.json
index 09f98215..e72faf35 100644
--- a/contract/test_snapshots/test/test_batch_pause_subscriptions_exceeds_max_size_panics.1.json
+++ b/contract/test_snapshots/test/test_batch_pause_subscriptions_exceeds_max_size_panics.1.json
@@ -1227,4 +1227,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_pause_subscriptions_handles_valid_missing_and_pre_paused_accounts.1.json b/contract/test_snapshots/test/test_batch_pause_subscriptions_handles_valid_missing_and_pre_paused_accounts.1.json
index 45bfbf94..b1a24316 100644
--- a/contract/test_snapshots/test/test_batch_pause_subscriptions_handles_valid_missing_and_pre_paused_accounts.1.json
+++ b/contract/test_snapshots/test/test_batch_pause_subscriptions_handles_valid_missing_and_pre_paused_accounts.1.json
@@ -3167,4 +3167,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_pause_subscriptions_mixed_inputs.1.json b/contract/test_snapshots/test/test_batch_pause_subscriptions_mixed_inputs.1.json
index fb41b4a8..fe0ee429 100644
--- a/contract/test_snapshots/test/test_batch_pause_subscriptions_mixed_inputs.1.json
+++ b/contract/test_snapshots/test/test_batch_pause_subscriptions_mixed_inputs.1.json
@@ -5927,4 +5927,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_pause_subscriptions_non_admin_panics.1.json b/contract/test_snapshots/test/test_batch_pause_subscriptions_non_admin_panics.1.json
index e105825e..293e701d 100644
--- a/contract/test_snapshots/test/test_batch_pause_subscriptions_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_batch_pause_subscriptions_non_admin_panics.1.json
@@ -1774,4 +1774,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_pause_subscriptions_rejects_more_than_twenty_five_accounts.1.json b/contract/test_snapshots/test/test_batch_pause_subscriptions_rejects_more_than_twenty_five_accounts.1.json
index 667ea1c3..b8adb0ef 100644
--- a/contract/test_snapshots/test/test_batch_pause_subscriptions_rejects_more_than_twenty_five_accounts.1.json
+++ b/contract/test_snapshots/test/test_batch_pause_subscriptions_rejects_more_than_twenty_five_accounts.1.json
@@ -1227,4 +1227,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_batch_pause_subscriptions_requires_admin_auth.1.json b/contract/test_snapshots/test/test_batch_pause_subscriptions_requires_admin_auth.1.json
index 2098fc25..66a741e2 100644
--- a/contract/test_snapshots/test/test_batch_pause_subscriptions_requires_admin_auth.1.json
+++ b/contract/test_snapshots/test/test_batch_pause_subscriptions_requires_admin_auth.1.json
@@ -3,10 +3,7 @@
     "address": 3,
     "nonce": 0
   },
-  "auth": [
-    [],
-    []
-  ],
+  "auth": [[], []],
   "ledger": {
     "protocol_version": 21,
     "sequence_number": 0,
@@ -267,4 +264,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_cancel.1.json b/contract/test_snapshots/test/test_cancel.1.json
index 80cb736a..b147c8de 100644
--- a/contract/test_snapshots/test/test_cancel.1.json
+++ b/contract/test_snapshots/test/test_cancel.1.json
@@ -1843,4 +1843,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_cancel_and_refund_prorated_at_interval_end_transfers_nothing.1.json b/contract/test_snapshots/test/test_cancel_and_refund_prorated_at_interval_end_transfers_nothing.1.json
index a376dc18..342c09ed 100644
--- a/contract/test_snapshots/test/test_cancel_and_refund_prorated_at_interval_end_transfers_nothing.1.json
+++ b/contract/test_snapshots/test/test_cancel_and_refund_prorated_at_interval_end_transfers_nothing.1.json
@@ -2349,4 +2349,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_cancel_and_refund_prorated_transfers_expected_amount.1.json b/contract/test_snapshots/test/test_cancel_and_refund_prorated_transfers_expected_amount.1.json
index ab2712c4..2a429641 100644
--- a/contract/test_snapshots/test/test_cancel_and_refund_prorated_transfers_expected_amount.1.json
+++ b/contract/test_snapshots/test/test_cancel_and_refund_prorated_transfers_expected_amount.1.json
@@ -2465,4 +2465,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_charge_succeeds_after_merchant_frozen.1.json b/contract/test_snapshots/test/test_charge_succeeds_after_merchant_frozen.1.json
index 29155eda..c4452b12 100644
--- a/contract/test_snapshots/test/test_charge_succeeds_after_merchant_frozen.1.json
+++ b/contract/test_snapshots/test/test_charge_succeeds_after_merchant_frozen.1.json
@@ -2527,4 +2527,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_charge_too_early.1.json b/contract/test_snapshots/test/test_charge_too_early.1.json
index 5d6cd18d..8faec054 100644
--- a/contract/test_snapshots/test/test_charge_too_early.1.json
+++ b/contract/test_snapshots/test/test_charge_too_early.1.json
@@ -1753,4 +1753,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_charge_updates_last_charged.1.json b/contract/test_snapshots/test/test_charge_updates_last_charged.1.json
index 4a943e64..c32a59fc 100644
--- a/contract/test_snapshots/test/test_charge_updates_last_charged.1.json
+++ b/contract/test_snapshots/test/test_charge_updates_last_charged.1.json
@@ -2293,4 +2293,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_charge_with_zero_fee_bps_skips_fee_transfer.1.json b/contract/test_snapshots/test/test_charge_with_zero_fee_bps_skips_fee_transfer.1.json
index 0a416cfa..f9b5e26e 100644
--- a/contract/test_snapshots/test/test_charge_with_zero_fee_bps_skips_fee_transfer.1.json
+++ b/contract/test_snapshots/test/test_charge_with_zero_fee_bps_skips_fee_transfer.1.json
@@ -2666,4 +2666,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_charge_within_grace_window_succeeds.1.json b/contract/test_snapshots/test/test_charge_within_grace_window_succeeds.1.json
index c5a889c0..5bd7309e 100644
--- a/contract/test_snapshots/test/test_charge_within_grace_window_succeeds.1.json
+++ b/contract/test_snapshots/test/test_charge_within_grace_window_succeeds.1.json
@@ -2550,4 +2550,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_charged_event_includes_ledger_sequence.1.json b/contract/test_snapshots/test/test_charged_event_includes_ledger_sequence.1.json
index a869e495..f970ea94 100644
--- a/contract/test_snapshots/test/test_charged_event_includes_ledger_sequence.1.json
+++ b/contract/test_snapshots/test/test_charged_event_includes_ledger_sequence.1.json
@@ -2161,4 +2161,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_clear_charge_history_admin_succeeds.1.json b/contract/test_snapshots/test/test_clear_charge_history_admin_succeeds.1.json
index d7f59c25..97d1eaed 100644
--- a/contract/test_snapshots/test/test_clear_charge_history_admin_succeeds.1.json
+++ b/contract/test_snapshots/test/test_clear_charge_history_admin_succeeds.1.json
@@ -2328,4 +2328,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_clear_charge_history_non_admin_panics.1.json b/contract/test_snapshots/test/test_clear_charge_history_non_admin_panics.1.json
index 052fc2f7..d6cb26d1 100644
--- a/contract/test_snapshots/test/test_clear_charge_history_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_clear_charge_history_non_admin_panics.1.json
@@ -1069,4 +1069,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_clear_charge_history_nonexistent_key_no_panic.1.json b/contract/test_snapshots/test/test_clear_charge_history_nonexistent_key_no_panic.1.json
index 78f1b3f9..1e40206d 100644
--- a/contract/test_snapshots/test/test_clear_charge_history_nonexistent_key_no_panic.1.json
+++ b/contract/test_snapshots/test/test_clear_charge_history_nonexistent_key_no_panic.1.json
@@ -995,4 +995,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_clear_merchant_revenue_history_drops_history.1.json b/contract/test_snapshots/test/test_clear_merchant_revenue_history_drops_history.1.json
index 64fa4442..7bf37357 100644
--- a/contract/test_snapshots/test/test_clear_merchant_revenue_history_drops_history.1.json
+++ b/contract/test_snapshots/test/test_clear_merchant_revenue_history_drops_history.1.json
@@ -2515,4 +2515,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_clear_merchant_revenue_history_idempotent.1.json b/contract/test_snapshots/test/test_clear_merchant_revenue_history_idempotent.1.json
index c8829072..f4153543 100644
--- a/contract/test_snapshots/test/test_clear_merchant_revenue_history_idempotent.1.json
+++ b/contract/test_snapshots/test/test_clear_merchant_revenue_history_idempotent.1.json
@@ -1238,4 +1238,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_clear_merchant_revenue_history_non_admin_panics.1.json b/contract/test_snapshots/test/test_clear_merchant_revenue_history_non_admin_panics.1.json
index 8c39a3a1..63293d9a 100644
--- a/contract/test_snapshots/test/test_clear_merchant_revenue_history_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_clear_merchant_revenue_history_non_admin_panics.1.json
@@ -1026,4 +1026,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_clear_metadata_removes_label.1.json b/contract/test_snapshots/test/test_clear_metadata_removes_label.1.json
index a9c4418a..c04b0f3c 100644
--- a/contract/test_snapshots/test/test_clear_metadata_removes_label.1.json
+++ b/contract/test_snapshots/test/test_clear_metadata_removes_label.1.json
@@ -1886,4 +1886,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_contract_pause_events_emitted.1.json b/contract/test_snapshots/test/test_contract_pause_events_emitted.1.json
index 78a8955e..b6fe27e2 100644
--- a/contract/test_snapshots/test/test_contract_pause_events_emitted.1.json
+++ b/contract/test_snapshots/test/test_contract_pause_events_emitted.1.json
@@ -1226,4 +1226,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_custom_sac_token_end_to_end_flow.1.json b/contract/test_snapshots/test/test_custom_sac_token_end_to_end_flow.1.json
index fde3ed9d..6cd982fc 100644
--- a/contract/test_snapshots/test/test_custom_sac_token_end_to_end_flow.1.json
+++ b/contract/test_snapshots/test/test_custom_sac_token_end_to_end_flow.1.json
@@ -4027,4 +4027,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_daily_limit_accumulates_across_calls.1.json b/contract/test_snapshots/test/test_daily_limit_accumulates_across_calls.1.json
index a48e5297..7f6fdd57 100644
--- a/contract/test_snapshots/test/test_daily_limit_accumulates_across_calls.1.json
+++ b/contract/test_snapshots/test/test_daily_limit_accumulates_across_calls.1.json
@@ -2719,4 +2719,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_daily_limit_allows_spend_within_limit.1.json b/contract/test_snapshots/test/test_daily_limit_allows_spend_within_limit.1.json
index 2ef0d75a..5398dd59 100644
--- a/contract/test_snapshots/test/test_daily_limit_allows_spend_within_limit.1.json
+++ b/contract/test_snapshots/test/test_daily_limit_allows_spend_within_limit.1.json
@@ -2452,4 +2452,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_daily_limit_blocks_cumulative_overspend.1.json b/contract/test_snapshots/test/test_daily_limit_blocks_cumulative_overspend.1.json
index 6e482daf..b307a674 100644
--- a/contract/test_snapshots/test/test_daily_limit_blocks_cumulative_overspend.1.json
+++ b/contract/test_snapshots/test/test_daily_limit_blocks_cumulative_overspend.1.json
@@ -2641,4 +2641,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_daily_limit_blocks_overspend.1.json b/contract/test_snapshots/test/test_daily_limit_blocks_overspend.1.json
index da212004..d7db0446 100644
--- a/contract/test_snapshots/test/test_daily_limit_blocks_overspend.1.json
+++ b/contract/test_snapshots/test/test_daily_limit_blocks_overspend.1.json
@@ -1958,4 +1958,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_daily_limit_day_start_boundary.1.json b/contract/test_snapshots/test/test_daily_limit_day_start_boundary.1.json
index fadac38c..ae314e7e 100644
--- a/contract/test_snapshots/test/test_daily_limit_day_start_boundary.1.json
+++ b/contract/test_snapshots/test/test_daily_limit_day_start_boundary.1.json
@@ -3390,4 +3390,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_daily_limit_removed_event_emitted.1.json b/contract/test_snapshots/test/test_daily_limit_removed_event_emitted.1.json
index 2a0bc6a3..f588881b 100644
--- a/contract/test_snapshots/test/test_daily_limit_removed_event_emitted.1.json
+++ b/contract/test_snapshots/test/test_daily_limit_removed_event_emitted.1.json
@@ -1192,4 +1192,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_daily_limit_set_event_emitted.1.json b/contract/test_snapshots/test/test_daily_limit_set_event_emitted.1.json
index 818f95fe..797860d5 100644
--- a/contract/test_snapshots/test/test_daily_limit_set_event_emitted.1.json
+++ b/contract/test_snapshots/test/test_daily_limit_set_event_emitted.1.json
@@ -1072,4 +1072,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_daily_limit_visibility_and_spend_tracking.1.json b/contract/test_snapshots/test/test_daily_limit_visibility_and_spend_tracking.1.json
index eaa03aab..e0340ee6 100644
--- a/contract/test_snapshots/test/test_daily_limit_visibility_and_spend_tracking.1.json
+++ b/contract/test_snapshots/test/test_daily_limit_visibility_and_spend_tracking.1.json
@@ -2712,4 +2712,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_double_initialize.1.json b/contract/test_snapshots/test/test_double_initialize.1.json
index 45625c06..75b17496 100644
--- a/contract/test_snapshots/test/test_double_initialize.1.json
+++ b/contract/test_snapshots/test/test_double_initialize.1.json
@@ -1199,4 +1199,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_freeze_merchant_idempotent.1.json b/contract/test_snapshots/test/test_freeze_merchant_idempotent.1.json
index 758fc102..481cee60 100644
--- a/contract/test_snapshots/test/test_freeze_merchant_idempotent.1.json
+++ b/contract/test_snapshots/test/test_freeze_merchant_idempotent.1.json
@@ -1372,4 +1372,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_freeze_merchant_independent_of_whitelist.1.json b/contract/test_snapshots/test/test_freeze_merchant_independent_of_whitelist.1.json
index e3d6df7a..fde87a96 100644
--- a/contract/test_snapshots/test/test_freeze_merchant_independent_of_whitelist.1.json
+++ b/contract/test_snapshots/test/test_freeze_merchant_independent_of_whitelist.1.json
@@ -1346,4 +1346,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_freeze_merchant_non_admin_panics.1.json b/contract/test_snapshots/test/test_freeze_merchant_non_admin_panics.1.json
index b0226087..eced3c48 100644
--- a/contract/test_snapshots/test/test_freeze_merchant_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_freeze_merchant_non_admin_panics.1.json
@@ -1033,4 +1033,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_charge_history_empty_for_no_history.1.json b/contract/test_snapshots/test/test_get_charge_history_empty_for_no_history.1.json
index 139febf6..9aae1485 100644
--- a/contract/test_snapshots/test/test_get_charge_history_empty_for_no_history.1.json
+++ b/contract/test_snapshots/test/test_get_charge_history_empty_for_no_history.1.json
@@ -933,4 +933,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_charge_history_page_limit_capped_at_12.1.json b/contract/test_snapshots/test/test_get_charge_history_page_limit_capped_at_12.1.json
index b55cb300..ba44a151 100644
--- a/contract/test_snapshots/test/test_get_charge_history_page_limit_capped_at_12.1.json
+++ b/contract/test_snapshots/test/test_get_charge_history_page_limit_capped_at_12.1.json
@@ -6025,4 +6025,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_charge_history_page_offset_beyond_length.1.json b/contract/test_snapshots/test/test_get_charge_history_page_offset_beyond_length.1.json
index edaed75a..a35c3e71 100644
--- a/contract/test_snapshots/test/test_get_charge_history_page_offset_beyond_length.1.json
+++ b/contract/test_snapshots/test/test_get_charge_history_page_offset_beyond_length.1.json
@@ -2224,4 +2224,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_charge_history_page_offset_limit.1.json b/contract/test_snapshots/test/test_get_charge_history_page_offset_limit.1.json
index e47c97f0..6fa4d7f2 100644
--- a/contract/test_snapshots/test/test_get_charge_history_page_offset_limit.1.json
+++ b/contract/test_snapshots/test/test_get_charge_history_page_offset_limit.1.json
@@ -2811,4 +2811,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_charge_history_three_charges_ascending.1.json b/contract/test_snapshots/test/test_get_charge_history_three_charges_ascending.1.json
index 36cf2c03..d162948b 100644
--- a/contract/test_snapshots/test/test_get_charge_history_three_charges_ascending.1.json
+++ b/contract/test_snapshots/test/test_get_charge_history_three_charges_ascending.1.json
@@ -2801,4 +2801,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_daily_limit.1.json b/contract/test_snapshots/test/test_get_daily_limit.1.json
index 3385fc85..ca4a82dc 100644
--- a/contract/test_snapshots/test/test_get_daily_limit.1.json
+++ b/contract/test_snapshots/test/test_get_daily_limit.1.json
@@ -1173,4 +1173,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_fee_returns_current_fee_settings.1.json b/contract/test_snapshots/test/test_get_fee_returns_current_fee_settings.1.json
index a0759bce..05668cdf 100644
--- a/contract/test_snapshots/test/test_get_fee_returns_current_fee_settings.1.json
+++ b/contract/test_snapshots/test/test_get_fee_returns_current_fee_settings.1.json
@@ -1231,4 +1231,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_grace_period_after_set.1.json b/contract/test_snapshots/test/test_get_grace_period_after_set.1.json
index 4858175d..cde0eb8a 100644
--- a/contract/test_snapshots/test/test_get_grace_period_after_set.1.json
+++ b/contract/test_snapshots/test/test_get_grace_period_after_set.1.json
@@ -1188,4 +1188,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_grace_period_default_zero.1.json b/contract/test_snapshots/test/test_get_grace_period_default_zero.1.json
index a5607a39..e513e0bc 100644
--- a/contract/test_snapshots/test/test_get_grace_period_default_zero.1.json
+++ b/contract/test_snapshots/test/test_get_grace_period_default_zero.1.json
@@ -931,4 +931,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_metadata_none_when_not_set.1.json b/contract/test_snapshots/test/test_get_metadata_none_when_not_set.1.json
index ccde10e9..7a22c6c9 100644
--- a/contract/test_snapshots/test/test_get_metadata_none_when_not_set.1.json
+++ b/contract/test_snapshots/test/test_get_metadata_none_when_not_set.1.json
@@ -931,4 +931,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_min_interval_default.1.json b/contract/test_snapshots/test/test_get_min_interval_default.1.json
index 0dd8f258..5c87d6fa 100644
--- a/contract/test_snapshots/test/test_get_min_interval_default.1.json
+++ b/contract/test_snapshots/test/test_get_min_interval_default.1.json
@@ -931,4 +931,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_protocol_stats_after_subscribe.1.json b/contract/test_snapshots/test/test_get_protocol_stats_after_subscribe.1.json
index c8ed2180..f84c65c9 100644
--- a/contract/test_snapshots/test/test_get_protocol_stats_after_subscribe.1.json
+++ b/contract/test_snapshots/test/test_get_protocol_stats_after_subscribe.1.json
@@ -1683,4 +1683,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_protocol_stats_contract_paused.1.json b/contract/test_snapshots/test/test_get_protocol_stats_contract_paused.1.json
index 1de020ac..bbde61e7 100644
--- a/contract/test_snapshots/test/test_get_protocol_stats_contract_paused.1.json
+++ b/contract/test_snapshots/test/test_get_protocol_stats_contract_paused.1.json
@@ -1336,4 +1336,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_protocol_stats_initial.1.json b/contract/test_snapshots/test/test_get_protocol_stats_initial.1.json
index c916043e..ea01cd42 100644
--- a/contract/test_snapshots/test/test_get_protocol_stats_initial.1.json
+++ b/contract/test_snapshots/test/test_get_protocol_stats_initial.1.json
@@ -986,4 +986,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_protocol_stats_with_fee.1.json b/contract/test_snapshots/test/test_get_protocol_stats_with_fee.1.json
index d52ff02c..78cc6dea 100644
--- a/contract/test_snapshots/test/test_get_protocol_stats_with_fee.1.json
+++ b/contract/test_snapshots/test/test_get_protocol_stats_with_fee.1.json
@@ -1281,4 +1281,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_subscriber_at_returns_first.1.json b/contract/test_snapshots/test/test_get_subscriber_at_returns_first.1.json
index 63dc6596..17ea38bf 100644
--- a/contract/test_snapshots/test/test_get_subscriber_at_returns_first.1.json
+++ b/contract/test_snapshots/test/test_get_subscriber_at_returns_first.1.json
@@ -1678,4 +1678,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_subscription_label_none_when_not_set.1.json b/contract/test_snapshots/test/test_get_subscription_label_none_when_not_set.1.json
index ec64cbb2..07304774 100644
--- a/contract/test_snapshots/test/test_get_subscription_label_none_when_not_set.1.json
+++ b/contract/test_snapshots/test/test_get_subscription_label_none_when_not_set.1.json
@@ -931,4 +931,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_subscription_label_returns_set_value.1.json b/contract/test_snapshots/test/test_get_subscription_label_returns_set_value.1.json
index 828db7d1..0efb5a42 100644
--- a/contract/test_snapshots/test/test_get_subscription_label_returns_set_value.1.json
+++ b/contract/test_snapshots/test/test_get_subscription_label_returns_set_value.1.json
@@ -1784,4 +1784,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_subscription_nonexistent.1.json b/contract/test_snapshots/test/test_get_subscription_nonexistent.1.json
index b865b48b..8c467aeb 100644
--- a/contract/test_snapshots/test/test_get_subscription_nonexistent.1.json
+++ b/contract/test_snapshots/test/test_get_subscription_nonexistent.1.json
@@ -931,4 +931,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_token_returns_initialized_token.1.json b/contract/test_snapshots/test/test_get_token_returns_initialized_token.1.json
index 442cc4cd..39e9b717 100644
--- a/contract/test_snapshots/test/test_get_token_returns_initialized_token.1.json
+++ b/contract/test_snapshots/test/test_get_token_returns_initialized_token.1.json
@@ -1064,4 +1064,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_token_returns_none_when_not_initialized.1.json b/contract/test_snapshots/test/test_get_token_returns_none_when_not_initialized.1.json
index 53ad479f..3baab2b6 100644
--- a/contract/test_snapshots/test/test_get_token_returns_none_when_not_initialized.1.json
+++ b/contract/test_snapshots/test/test_get_token_returns_none_when_not_initialized.1.json
@@ -3,9 +3,7 @@
     "address": 1,
     "nonce": 0
   },
-  "auth": [
-    []
-  ],
+  "auth": [[]],
   "ledger": {
     "protocol_version": 21,
     "sequence_number": 0,
@@ -118,4 +116,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_trial_end_with_trial_period.1.json b/contract/test_snapshots/test/test_get_trial_end_with_trial_period.1.json
index 4d3d6766..4e108d54 100644
--- a/contract/test_snapshots/test/test_get_trial_end_with_trial_period.1.json
+++ b/contract/test_snapshots/test/test_get_trial_end_with_trial_period.1.json
@@ -1634,4 +1634,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_get_trial_end_without_trial_period.1.json b/contract/test_snapshots/test/test_get_trial_end_without_trial_period.1.json
index 9ba9a442..fbf44800 100644
--- a/contract/test_snapshots/test/test_get_trial_end_without_trial_period.1.json
+++ b/contract/test_snapshots/test/test_get_trial_end_without_trial_period.1.json
@@ -1628,4 +1628,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_global_volume_exceeds_limit.1.json b/contract/test_snapshots/test/test_global_volume_exceeds_limit.1.json
index a0296223..75a4501f 100644
--- a/contract/test_snapshots/test/test_global_volume_exceeds_limit.1.json
+++ b/contract/test_snapshots/test/test_global_volume_exceeds_limit.1.json
@@ -3871,4 +3871,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_global_volume_window_reset.1.json b/contract/test_snapshots/test/test_global_volume_window_reset.1.json
index 66d01f64..033b318c 100644
--- a/contract/test_snapshots/test/test_global_volume_window_reset.1.json
+++ b/contract/test_snapshots/test/test_global_volume_window_reset.1.json
@@ -3939,4 +3939,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_global_volume_within_limit.1.json b/contract/test_snapshots/test/test_global_volume_within_limit.1.json
index 08d69bc8..663b13d6 100644
--- a/contract/test_snapshots/test/test_global_volume_within_limit.1.json
+++ b/contract/test_snapshots/test/test_global_volume_within_limit.1.json
@@ -2161,4 +2161,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_grace_period_ttl_extension.1.json b/contract/test_snapshots/test/test_grace_period_ttl_extension.1.json
index 40e6a94a..639663ab 100644
--- a/contract/test_snapshots/test/test_grace_period_ttl_extension.1.json
+++ b/contract/test_snapshots/test/test_grace_period_ttl_extension.1.json
@@ -1188,4 +1188,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_health_check_active_subscription_count.1.json b/contract/test_snapshots/test/test_health_check_active_subscription_count.1.json
index 3e3550c1..6169c8f4 100644
--- a/contract/test_snapshots/test/test_health_check_active_subscription_count.1.json
+++ b/contract/test_snapshots/test/test_health_check_active_subscription_count.1.json
@@ -1710,4 +1710,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_health_check_initialized_unpaused.1.json b/contract/test_snapshots/test/test_health_check_initialized_unpaused.1.json
index 62a47370..d1c8440d 100644
--- a/contract/test_snapshots/test/test_health_check_initialized_unpaused.1.json
+++ b/contract/test_snapshots/test/test_health_check_initialized_unpaused.1.json
@@ -1146,4 +1146,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_health_check_paused.1.json b/contract/test_snapshots/test/test_health_check_paused.1.json
index bb0cb5dc..5e311a06 100644
--- a/contract/test_snapshots/test/test_health_check_paused.1.json
+++ b/contract/test_snapshots/test/test_health_check_paused.1.json
@@ -1269,4 +1269,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_health_check_pre_initialize.1.json b/contract/test_snapshots/test/test_health_check_pre_initialize.1.json
index 83205d0d..c74eee31 100644
--- a/contract/test_snapshots/test/test_health_check_pre_initialize.1.json
+++ b/contract/test_snapshots/test/test_health_check_pre_initialize.1.json
@@ -3,9 +3,7 @@
     "address": 1,
     "nonce": 0
   },
-  "auth": [
-    []
-  ],
+  "auth": [[]],
   "ledger": {
     "protocol_version": 21,
     "sequence_number": 0,
@@ -202,4 +200,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_initialize_backward_compat.1.json b/contract/test_snapshots/test/test_initialize_backward_compat.1.json
index e0971ed5..bf514906 100644
--- a/contract/test_snapshots/test/test_initialize_backward_compat.1.json
+++ b/contract/test_snapshots/test/test_initialize_backward_compat.1.json
@@ -2642,4 +2642,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_initialize_sets_instance_ttl.1.json b/contract/test_snapshots/test/test_initialize_sets_instance_ttl.1.json
index c53e28f3..25a0bbf3 100644
--- a/contract/test_snapshots/test/test_initialize_sets_instance_ttl.1.json
+++ b/contract/test_snapshots/test/test_initialize_sets_instance_ttl.1.json
@@ -519,4 +519,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_initialize_without_valid_token.1.json b/contract/test_snapshots/test/test_initialize_without_valid_token.1.json
index 576b1edb..ab9d2ee2 100644
--- a/contract/test_snapshots/test/test_initialize_without_valid_token.1.json
+++ b/contract/test_snapshots/test/test_initialize_without_valid_token.1.json
@@ -206,4 +206,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_interval_minimum_valid.1.json b/contract/test_snapshots/test/test_interval_minimum_valid.1.json
index fbd60a24..216a633a 100644
--- a/contract/test_snapshots/test/test_interval_minimum_valid.1.json
+++ b/contract/test_snapshots/test/test_interval_minimum_valid.1.json
@@ -1993,4 +1993,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_interval_too_short.1.json b/contract/test_snapshots/test/test_interval_too_short.1.json
index ca20ba8e..a0791866 100644
--- a/contract/test_snapshots/test/test_interval_too_short.1.json
+++ b/contract/test_snapshots/test/test_interval_too_short.1.json
@@ -1094,4 +1094,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_is_charge_due_false_for_paused_subscription.1.json b/contract/test_snapshots/test/test_is_charge_due_false_for_paused_subscription.1.json
index 77b1dac5..df985e83 100644
--- a/contract/test_snapshots/test/test_is_charge_due_false_for_paused_subscription.1.json
+++ b/contract/test_snapshots/test/test_is_charge_due_false_for_paused_subscription.1.json
@@ -1795,4 +1795,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_is_charge_due_false_for_unknown_address.1.json b/contract/test_snapshots/test/test_is_charge_due_false_for_unknown_address.1.json
index 96a883b2..1bbe6e8d 100644
--- a/contract/test_snapshots/test/test_is_charge_due_false_for_unknown_address.1.json
+++ b/contract/test_snapshots/test/test_is_charge_due_false_for_unknown_address.1.json
@@ -933,4 +933,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_is_charge_due_false_past_grace_window.1.json b/contract/test_snapshots/test/test_is_charge_due_false_past_grace_window.1.json
index cefe113d..5d0bcfb5 100644
--- a/contract/test_snapshots/test/test_is_charge_due_false_past_grace_window.1.json
+++ b/contract/test_snapshots/test/test_is_charge_due_false_past_grace_window.1.json
@@ -1887,4 +1887,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_is_charge_due_transitions_after_interval.1.json b/contract/test_snapshots/test/test_is_charge_due_transitions_after_interval.1.json
index d1836363..dc1398db 100644
--- a/contract/test_snapshots/test/test_is_charge_due_transitions_after_interval.1.json
+++ b/contract/test_snapshots/test/test_is_charge_due_transitions_after_interval.1.json
@@ -1680,4 +1680,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_is_merchant_frozen_reflects_state.1.json b/contract/test_snapshots/test/test_is_merchant_frozen_reflects_state.1.json
index 2c6f49c0..e094424b 100644
--- a/contract/test_snapshots/test/test_is_merchant_frozen_reflects_state.1.json
+++ b/contract/test_snapshots/test/test_is_merchant_frozen_reflects_state.1.json
@@ -1421,4 +1421,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_is_merchant_whitelisted_returns_false_for_non_whitelisted.1.json b/contract/test_snapshots/test/test_is_merchant_whitelisted_returns_false_for_non_whitelisted.1.json
index f20e0a41..50c126f4 100644
--- a/contract/test_snapshots/test/test_is_merchant_whitelisted_returns_false_for_non_whitelisted.1.json
+++ b/contract/test_snapshots/test/test_is_merchant_whitelisted_returns_false_for_non_whitelisted.1.json
@@ -1045,4 +1045,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_merchant_revenue_from_charge.1.json b/contract/test_snapshots/test/test_merchant_revenue_from_charge.1.json
index 165cdfd2..3065c42c 100644
--- a/contract/test_snapshots/test/test_merchant_revenue_from_charge.1.json
+++ b/contract/test_snapshots/test/test_merchant_revenue_from_charge.1.json
@@ -2267,4 +2267,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_merchant_sub_count_double_cancel_no_underflow.1.json b/contract/test_snapshots/test/test_merchant_sub_count_double_cancel_no_underflow.1.json
index beebdf1b..412134b5 100644
--- a/contract/test_snapshots/test/test_merchant_sub_count_double_cancel_no_underflow.1.json
+++ b/contract/test_snapshots/test/test_merchant_sub_count_double_cancel_no_underflow.1.json
@@ -1992,4 +1992,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_merchant_sub_count_resubscribe_different_merchant.1.json b/contract/test_snapshots/test/test_merchant_sub_count_resubscribe_different_merchant.1.json
index 8910bf67..572f68fe 100644
--- a/contract/test_snapshots/test/test_merchant_sub_count_resubscribe_different_merchant.1.json
+++ b/contract/test_snapshots/test/test_merchant_sub_count_resubscribe_different_merchant.1.json
@@ -2170,4 +2170,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_merchant_sub_count_two_users_cancel_one.1.json b/contract/test_snapshots/test/test_merchant_sub_count_two_users_cancel_one.1.json
index c56cefe6..7cc5f959 100644
--- a/contract/test_snapshots/test/test_merchant_sub_count_two_users_cancel_one.1.json
+++ b/contract/test_snapshots/test/test_merchant_sub_count_two_users_cancel_one.1.json
@@ -2818,4 +2818,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_migrate_emits_completed_event_with_version_and_count.1.json b/contract/test_snapshots/test/test_migrate_emits_completed_event_with_version_and_count.1.json
index dbcc5d67..8dd43662 100644
--- a/contract/test_snapshots/test/test_migrate_emits_completed_event_with_version_and_count.1.json
+++ b/contract/test_snapshots/test/test_migrate_emits_completed_event_with_version_and_count.1.json
@@ -1740,4 +1740,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_migrate_is_idempotent.1.json b/contract/test_snapshots/test/test_migrate_is_idempotent.1.json
index 766f38ba..2baf0893 100644
--- a/contract/test_snapshots/test/test_migrate_is_idempotent.1.json
+++ b/contract/test_snapshots/test/test_migrate_is_idempotent.1.json
@@ -1181,4 +1181,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_migrate_non_admin_panics.1.json b/contract/test_snapshots/test/test_migrate_non_admin_panics.1.json
index f0ce8584..7770f1d6 100644
--- a/contract/test_snapshots/test/test_migrate_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_migrate_non_admin_panics.1.json
@@ -1077,4 +1077,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_migrate_sets_schema_version.1.json b/contract/test_snapshots/test/test_migrate_sets_schema_version.1.json
index 14d9458b..a8b99efe 100644
--- a/contract/test_snapshots/test/test_migrate_sets_schema_version.1.json
+++ b/contract/test_snapshots/test/test_migrate_sets_schema_version.1.json
@@ -1130,4 +1130,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_migrate_v1_to_v2.1.json b/contract/test_snapshots/test/test_migrate_v1_to_v2.1.json
index 882498f8..6088a23c 100644
--- a/contract/test_snapshots/test/test_migrate_v1_to_v2.1.json
+++ b/contract/test_snapshots/test/test_migrate_v1_to_v2.1.json
@@ -1302,4 +1302,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_multi_token_independent_subscriptions.1.json b/contract/test_snapshots/test/test_multi_token_independent_subscriptions.1.json
index 60841ed9..3706afde 100644
--- a/contract/test_snapshots/test/test_multi_token_independent_subscriptions.1.json
+++ b/contract/test_snapshots/test/test_multi_token_independent_subscriptions.1.json
@@ -4046,4 +4046,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_multiple_users.1.json b/contract/test_snapshots/test/test_multiple_users.1.json
index c20eeb77..96b4897a 100644
--- a/contract/test_snapshots/test/test_multiple_users.1.json
+++ b/contract/test_snapshots/test/test_multiple_users.1.json
@@ -3253,4 +3253,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_next_charge_at_none_after_cancel.1.json b/contract/test_snapshots/test/test_next_charge_at_none_after_cancel.1.json
index 1f533f75..27f3cb00 100644
--- a/contract/test_snapshots/test/test_next_charge_at_none_after_cancel.1.json
+++ b/contract/test_snapshots/test/test_next_charge_at_none_after_cancel.1.json
@@ -1759,4 +1759,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_next_charge_at_none_for_paused_subscription.1.json b/contract/test_snapshots/test/test_next_charge_at_none_for_paused_subscription.1.json
index 9d5a1d90..79d3f9dc 100644
--- a/contract/test_snapshots/test/test_next_charge_at_none_for_paused_subscription.1.json
+++ b/contract/test_snapshots/test/test_next_charge_at_none_for_paused_subscription.1.json
@@ -1793,4 +1793,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_next_charge_at_none_for_unknown_address.1.json b/contract/test_snapshots/test/test_next_charge_at_none_for_unknown_address.1.json
index d9015323..ac904012 100644
--- a/contract/test_snapshots/test/test_next_charge_at_none_for_unknown_address.1.json
+++ b/contract/test_snapshots/test/test_next_charge_at_none_for_unknown_address.1.json
@@ -931,4 +931,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_next_charge_at_returns_correct_timestamp.1.json b/contract/test_snapshots/test/test_next_charge_at_returns_correct_timestamp.1.json
index 81139463..26f8c85e 100644
--- a/contract/test_snapshots/test/test_next_charge_at_returns_correct_timestamp.1.json
+++ b/contract/test_snapshots/test/test_next_charge_at_returns_correct_timestamp.1.json
@@ -1762,4 +1762,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_no_referral_returns_none.1.json b/contract/test_snapshots/test/test_no_referral_returns_none.1.json
index 2a4b0068..8aff9efd 100644
--- a/contract/test_snapshots/test/test_no_referral_returns_none.1.json
+++ b/contract/test_snapshots/test/test_no_referral_returns_none.1.json
@@ -1628,4 +1628,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_non_admin_add_and_remove_merchant_panics.1.json b/contract/test_snapshots/test/test_non_admin_add_and_remove_merchant_panics.1.json
index 6bb41960..e14bf70a 100644
--- a/contract/test_snapshots/test/test_non_admin_add_and_remove_merchant_panics.1.json
+++ b/contract/test_snapshots/test/test_non_admin_add_and_remove_merchant_panics.1.json
@@ -1069,4 +1069,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_non_admin_set_grace_period_panics.1.json b/contract/test_snapshots/test/test_non_admin_set_grace_period_panics.1.json
index 6ef46910..6734e5d3 100644
--- a/contract/test_snapshots/test/test_non_admin_set_grace_period_panics.1.json
+++ b/contract/test_snapshots/test/test_non_admin_set_grace_period_panics.1.json
@@ -1069,4 +1069,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_non_admin_set_max_batch_size_panics.1.json b/contract/test_snapshots/test/test_non_admin_set_max_batch_size_panics.1.json
index 8428b861..9b43cc2e 100644
--- a/contract/test_snapshots/test/test_non_admin_set_max_batch_size_panics.1.json
+++ b/contract/test_snapshots/test/test_non_admin_set_max_batch_size_panics.1.json
@@ -1026,4 +1026,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_old_admin_loses_access_after_transfer.1.json b/contract/test_snapshots/test/test_old_admin_loses_access_after_transfer.1.json
index 70410d5c..921dfc29 100644
--- a/contract/test_snapshots/test/test_old_admin_loses_access_after_transfer.1.json
+++ b/contract/test_snapshots/test/test_old_admin_loses_access_after_transfer.1.json
@@ -1116,4 +1116,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pause_on_inactive_subscription_panics.1.json b/contract/test_snapshots/test/test_pause_on_inactive_subscription_panics.1.json
index 095a9010..d47334c0 100644
--- a/contract/test_snapshots/test/test_pause_on_inactive_subscription_panics.1.json
+++ b/contract/test_snapshots/test/test_pause_on_inactive_subscription_panics.1.json
@@ -1884,4 +1884,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pause_sets_indefinite_expiry.1.json b/contract/test_snapshots/test/test_pause_sets_indefinite_expiry.1.json
index 502895c4..0a3f0209 100644
--- a/contract/test_snapshots/test/test_pause_sets_indefinite_expiry.1.json
+++ b/contract/test_snapshots/test/test_pause_sets_indefinite_expiry.1.json
@@ -1407,4 +1407,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pause_sets_paused_true.1.json b/contract/test_snapshots/test/test_pause_sets_paused_true.1.json
index efa3d4a4..788130e1 100644
--- a/contract/test_snapshots/test/test_pause_sets_paused_true.1.json
+++ b/contract/test_snapshots/test/test_pause_sets_paused_true.1.json
@@ -1877,4 +1877,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pause_until_auto_resume_clears_pause_expiry.1.json b/contract/test_snapshots/test/test_pause_until_auto_resume_clears_pause_expiry.1.json
index e6fd9fdd..1be9b48e 100644
--- a/contract/test_snapshots/test/test_pause_until_auto_resume_clears_pause_expiry.1.json
+++ b/contract/test_snapshots/test/test_pause_until_auto_resume_clears_pause_expiry.1.json
@@ -1797,4 +1797,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pause_until_auto_resumes_on_charge.1.json b/contract/test_snapshots/test/test_pause_until_auto_resumes_on_charge.1.json
index d35b8f0d..e5e3b558 100644
--- a/contract/test_snapshots/test/test_pause_until_auto_resumes_on_charge.1.json
+++ b/contract/test_snapshots/test/test_pause_until_auto_resumes_on_charge.1.json
@@ -2059,4 +2059,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pause_until_past_timestamp_panics.1.json b/contract/test_snapshots/test/test_pause_until_past_timestamp_panics.1.json
index 7e7d4fcd..cd91545a 100644
--- a/contract/test_snapshots/test/test_pause_until_past_timestamp_panics.1.json
+++ b/contract/test_snapshots/test/test_pause_until_past_timestamp_panics.1.json
@@ -1424,4 +1424,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use.1.json b/contract/test_snapshots/test/test_pay_per_use.1.json
index 2708b675..d32a1eb9 100644
--- a/contract/test_snapshots/test/test_pay_per_use.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use.1.json
@@ -2369,4 +2369,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_applies_protocol_fee_and_records_net_revenue.1.json b/contract/test_snapshots/test/test_pay_per_use_applies_protocol_fee_and_records_net_revenue.1.json
index 4e7b6299..79a31f5e 100644
--- a/contract/test_snapshots/test/test_pay_per_use_applies_protocol_fee_and_records_net_revenue.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_applies_protocol_fee_and_records_net_revenue.1.json
@@ -3004,4 +3004,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_does_not_update_last_charged.1.json b/contract/test_snapshots/test/test_pay_per_use_does_not_update_last_charged.1.json
index 88673a1b..dad11243 100644
--- a/contract/test_snapshots/test/test_pay_per_use_does_not_update_last_charged.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_does_not_update_last_charged.1.json
@@ -2527,4 +2527,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_exceeds_cap.1.json b/contract/test_snapshots/test/test_pay_per_use_exceeds_cap.1.json
index 3d197ae1..c68d15ae 100644
--- a/contract/test_snapshots/test/test_pay_per_use_exceeds_cap.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_exceeds_cap.1.json
@@ -1769,4 +1769,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_inactive.1.json b/contract/test_snapshots/test/test_pay_per_use_inactive.1.json
index 04a22fe2..75b4a830 100644
--- a/contract/test_snapshots/test/test_pay_per_use_inactive.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_inactive.1.json
@@ -1900,4 +1900,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_nonexistent.1.json b/contract/test_snapshots/test/test_pay_per_use_nonexistent.1.json
index f93a9a5f..7e18cd27 100644
--- a/contract/test_snapshots/test/test_pay_per_use_nonexistent.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_nonexistent.1.json
@@ -1072,4 +1072,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_on_paused_subscription_panics.1.json b/contract/test_snapshots/test/test_pay_per_use_on_paused_subscription_panics.1.json
index 2bd1dc53..2b03af5c 100644
--- a/contract/test_snapshots/test/test_pay_per_use_on_paused_subscription_panics.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_on_paused_subscription_panics.1.json
@@ -1934,4 +1934,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_succeeds_after_merchant_frozen.1.json b/contract/test_snapshots/test/test_pay_per_use_succeeds_after_merchant_frozen.1.json
index 4d7930d8..a83f83bf 100644
--- a/contract/test_snapshots/test/test_pay_per_use_succeeds_after_merchant_frozen.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_succeeds_after_merchant_frozen.1.json
@@ -2500,4 +2500,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_to_applies_protocol_fee_to_recipient.1.json b/contract/test_snapshots/test/test_pay_per_use_to_applies_protocol_fee_to_recipient.1.json
index 85263a00..f8ac9a14 100644
--- a/contract/test_snapshots/test/test_pay_per_use_to_applies_protocol_fee_to_recipient.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_to_applies_protocol_fee_to_recipient.1.json
@@ -3010,4 +3010,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_to_daily_limit_shared_with_pay_per_use.1.json b/contract/test_snapshots/test/test_pay_per_use_to_daily_limit_shared_with_pay_per_use.1.json
index 4a806abe..cbb078ba 100644
--- a/contract/test_snapshots/test/test_pay_per_use_to_daily_limit_shared_with_pay_per_use.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_to_daily_limit_shared_with_pay_per_use.1.json
@@ -2647,4 +2647,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_to_recipient_equals_merchant_behaves_like_pay_per_use.1.json b/contract/test_snapshots/test/test_pay_per_use_to_recipient_equals_merchant_behaves_like_pay_per_use.1.json
index 69d8fa85..562703e7 100644
--- a/contract/test_snapshots/test/test_pay_per_use_to_recipient_equals_merchant_behaves_like_pay_per_use.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_to_recipient_equals_merchant_behaves_like_pay_per_use.1.json
@@ -2428,4 +2428,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_to_rejects_non_whitelisted_recipient.1.json b/contract/test_snapshots/test/test_pay_per_use_to_rejects_non_whitelisted_recipient.1.json
index b4621693..30a3666a 100644
--- a/contract/test_snapshots/test/test_pay_per_use_to_rejects_non_whitelisted_recipient.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_to_rejects_non_whitelisted_recipient.1.json
@@ -2136,4 +2136,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_to_transfers_to_recipient_not_merchant.1.json b/contract/test_snapshots/test/test_pay_per_use_to_transfers_to_recipient_not_merchant.1.json
index cfa037a6..b8a019fb 100644
--- a/contract/test_snapshots/test/test_pay_per_use_to_transfers_to_recipient_not_merchant.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_to_transfers_to_recipient_not_merchant.1.json
@@ -2587,4 +2587,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_with_zero_fee_bps_transfers_full_amount.1.json b/contract/test_snapshots/test/test_pay_per_use_with_zero_fee_bps_transfers_full_amount.1.json
index f220c9af..4bf7cafb 100644
--- a/contract/test_snapshots/test/test_pay_per_use_with_zero_fee_bps_transfers_full_amount.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_with_zero_fee_bps_transfers_full_amount.1.json
@@ -2768,4 +2768,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_pay_per_use_zero_amount.1.json b/contract/test_snapshots/test/test_pay_per_use_zero_amount.1.json
index 5e84938b..f8a7631b 100644
--- a/contract/test_snapshots/test/test_pay_per_use_zero_amount.1.json
+++ b/contract/test_snapshots/test/test_pay_per_use_zero_amount.1.json
@@ -1769,4 +1769,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_referral_cleared_on_cancel.1.json b/contract/test_snapshots/test/test_referral_cleared_on_cancel.1.json
index 68903f1a..2cb9bf23 100644
--- a/contract/test_snapshots/test/test_referral_cleared_on_cancel.1.json
+++ b/contract/test_snapshots/test/test_referral_cleared_on_cancel.1.json
@@ -1838,4 +1838,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_referral_clears_on_resubscribe_with_none.1.json b/contract/test_snapshots/test/test_referral_clears_on_resubscribe_with_none.1.json
index ee6404e6..3692476c 100644
--- a/contract/test_snapshots/test/test_referral_clears_on_resubscribe_with_none.1.json
+++ b/contract/test_snapshots/test/test_referral_clears_on_resubscribe_with_none.1.json
@@ -1960,4 +1960,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_referral_stored_on_subscribe.1.json b/contract/test_snapshots/test/test_referral_stored_on_subscribe.1.json
index 9be250b5..d437ad8d 100644
--- a/contract/test_snapshots/test/test_referral_stored_on_subscribe.1.json
+++ b/contract/test_snapshots/test/test_referral_stored_on_subscribe.1.json
@@ -1704,4 +1704,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_referral_updates_on_resubscribe.1.json b/contract/test_snapshots/test/test_referral_updates_on_resubscribe.1.json
index 7f2fe533..be7c8341 100644
--- a/contract/test_snapshots/test/test_referral_updates_on_resubscribe.1.json
+++ b/contract/test_snapshots/test/test_referral_updates_on_resubscribe.1.json
@@ -2036,4 +2036,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_remove_daily_limit_allows_pay_per_use_after_removal.1.json b/contract/test_snapshots/test/test_remove_daily_limit_allows_pay_per_use_after_removal.1.json
index f1bd91b0..62dff396 100644
--- a/contract/test_snapshots/test/test_remove_daily_limit_allows_pay_per_use_after_removal.1.json
+++ b/contract/test_snapshots/test/test_remove_daily_limit_allows_pay_per_use_after_removal.1.json
@@ -2812,4 +2812,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_resubscribe.1.json b/contract/test_snapshots/test/test_resubscribe.1.json
index d449a57f..ecab1adb 100644
--- a/contract/test_snapshots/test/test_resubscribe.1.json
+++ b/contract/test_snapshots/test/test_resubscribe.1.json
@@ -2234,4 +2234,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_resubscribe_active_does_not_duplicate_index.1.json b/contract/test_snapshots/test/test_resubscribe_active_does_not_duplicate_index.1.json
index 0cf8ef5f..739971c2 100644
--- a/contract/test_snapshots/test/test_resubscribe_active_does_not_duplicate_index.1.json
+++ b/contract/test_snapshots/test/test_resubscribe_active_does_not_duplicate_index.1.json
@@ -1992,4 +1992,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_resubscribe_zero_allowance_panics.1.json b/contract/test_snapshots/test/test_resubscribe_zero_allowance_panics.1.json
index e8ef8140..86f288d9 100644
--- a/contract/test_snapshots/test/test_resubscribe_zero_allowance_panics.1.json
+++ b/contract/test_snapshots/test/test_resubscribe_zero_allowance_panics.1.json
@@ -1080,4 +1080,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_resume_clears_pause_expiry.1.json b/contract/test_snapshots/test/test_resume_clears_pause_expiry.1.json
index 72fe9e8e..87c19620 100644
--- a/contract/test_snapshots/test/test_resume_clears_pause_expiry.1.json
+++ b/contract/test_snapshots/test/test_resume_clears_pause_expiry.1.json
@@ -1928,4 +1928,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_resume_unpauses_and_charge_succeeds.1.json b/contract/test_snapshots/test/test_resume_unpauses_and_charge_succeeds.1.json
index 8a275009..25167d85 100644
--- a/contract/test_snapshots/test/test_resume_unpauses_and_charge_succeeds.1.json
+++ b/contract/test_snapshots/test/test_resume_unpauses_and_charge_succeeds.1.json
@@ -2533,4 +2533,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_self_referral_rejected_via_try_subscribe.1.json b/contract/test_snapshots/test/test_self_referral_rejected_via_try_subscribe.1.json
index 31f26602..ea78f469 100644
--- a/contract/test_snapshots/test/test_self_referral_rejected_via_try_subscribe.1.json
+++ b/contract/test_snapshots/test/test_self_referral_rejected_via_try_subscribe.1.json
@@ -1132,4 +1132,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_and_get_metadata.1.json b/contract/test_snapshots/test/test_set_and_get_metadata.1.json
index 8e06e0e6..d1468663 100644
--- a/contract/test_snapshots/test/test_set_and_get_metadata.1.json
+++ b/contract/test_snapshots/test/test_set_and_get_metadata.1.json
@@ -1784,4 +1784,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_fee_emits_event.1.json b/contract/test_snapshots/test/test_set_fee_emits_event.1.json
index 2c594985..056180d3 100644
--- a/contract/test_snapshots/test/test_set_fee_emits_event.1.json
+++ b/contract/test_snapshots/test/test_set_fee_emits_event.1.json
@@ -1176,4 +1176,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_fee_invalid_bps_panics.1.json b/contract/test_snapshots/test/test_set_fee_invalid_bps_panics.1.json
index 12251d6e..0020cc3c 100644
--- a/contract/test_snapshots/test/test_set_fee_invalid_bps_panics.1.json
+++ b/contract/test_snapshots/test/test_set_fee_invalid_bps_panics.1.json
@@ -1079,4 +1079,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_grace_period_emits_event.1.json b/contract/test_snapshots/test/test_set_grace_period_emits_event.1.json
index 4a84dc4e..f8abf9c8 100644
--- a/contract/test_snapshots/test/test_set_grace_period_emits_event.1.json
+++ b/contract/test_snapshots/test/test_set_grace_period_emits_event.1.json
@@ -1140,4 +1140,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_max_batch_size_rejects_value_above_200.1.json b/contract/test_snapshots/test/test_set_max_batch_size_rejects_value_above_200.1.json
index 6292118f..09c6d15b 100644
--- a/contract/test_snapshots/test/test_set_max_batch_size_rejects_value_above_200.1.json
+++ b/contract/test_snapshots/test/test_set_max_batch_size_rejects_value_above_200.1.json
@@ -1069,4 +1069,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_metadata_label_at_limit_succeeds.1.json b/contract/test_snapshots/test/test_set_metadata_label_at_limit_succeeds.1.json
index 865ca45d..a04d0339 100644
--- a/contract/test_snapshots/test/test_set_metadata_label_at_limit_succeeds.1.json
+++ b/contract/test_snapshots/test/test_set_metadata_label_at_limit_succeeds.1.json
@@ -1087,4 +1087,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_metadata_label_exceeding_limit_fails.1.json b/contract/test_snapshots/test/test_set_metadata_label_exceeding_limit_fails.1.json
index 040257f1..7f8d81cd 100644
--- a/contract/test_snapshots/test/test_set_metadata_label_exceeding_limit_fails.1.json
+++ b/contract/test_snapshots/test/test_set_metadata_label_exceeding_limit_fails.1.json
@@ -1066,4 +1066,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_metadata_wrong_user_panics.1.json b/contract/test_snapshots/test/test_set_metadata_wrong_user_panics.1.json
index e47f5ad0..8e86dbc9 100644
--- a/contract/test_snapshots/test/test_set_metadata_wrong_user_panics.1.json
+++ b/contract/test_snapshots/test/test_set_metadata_wrong_user_panics.1.json
@@ -1734,4 +1734,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_min_interval_non_admin_panics.1.json b/contract/test_snapshots/test/test_set_min_interval_non_admin_panics.1.json
index 6b5054a7..3cad6ad9 100644
--- a/contract/test_snapshots/test/test_set_min_interval_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_set_min_interval_non_admin_panics.1.json
@@ -1026,4 +1026,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_min_interval_zero_panics.1.json b/contract/test_snapshots/test/test_set_min_interval_zero_panics.1.json
index 9bb5730b..971cbfd8 100644
--- a/contract/test_snapshots/test/test_set_min_interval_zero_panics.1.json
+++ b/contract/test_snapshots/test/test_set_min_interval_zero_panics.1.json
@@ -1086,4 +1086,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_subscription_amount_admin_succeeds.1.json b/contract/test_snapshots/test/test_set_subscription_amount_admin_succeeds.1.json
index f81abebd..bc13c32b 100644
--- a/contract/test_snapshots/test/test_set_subscription_amount_admin_succeeds.1.json
+++ b/contract/test_snapshots/test/test_set_subscription_amount_admin_succeeds.1.json
@@ -2008,4 +2008,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_subscription_amount_no_subscription_panics.1.json b/contract/test_snapshots/test/test_set_subscription_amount_no_subscription_panics.1.json
index e3d568c9..60d636ee 100644
--- a/contract/test_snapshots/test/test_set_subscription_amount_no_subscription_panics.1.json
+++ b/contract/test_snapshots/test/test_set_subscription_amount_no_subscription_panics.1.json
@@ -1085,4 +1085,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_subscription_amount_non_admin_panics.1.json b/contract/test_snapshots/test/test_set_subscription_amount_non_admin_panics.1.json
index 8b18f673..32f6f9f2 100644
--- a/contract/test_snapshots/test/test_set_subscription_amount_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_set_subscription_amount_non_admin_panics.1.json
@@ -1782,4 +1782,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_subscription_interval_admin_succeeds.1.json b/contract/test_snapshots/test/test_set_subscription_interval_admin_succeeds.1.json
index 57a23f7b..78c5bcf4 100644
--- a/contract/test_snapshots/test/test_set_subscription_interval_admin_succeeds.1.json
+++ b/contract/test_snapshots/test/test_set_subscription_interval_admin_succeeds.1.json
@@ -2046,4 +2046,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_subscription_interval_no_subscription_panics.1.json b/contract/test_snapshots/test/test_set_subscription_interval_no_subscription_panics.1.json
index bda32605..b5c3034e 100644
--- a/contract/test_snapshots/test/test_set_subscription_interval_no_subscription_panics.1.json
+++ b/contract/test_snapshots/test/test_set_subscription_interval_no_subscription_panics.1.json
@@ -1079,4 +1079,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_subscription_interval_non_admin_panics.1.json b/contract/test_snapshots/test/test_set_subscription_interval_non_admin_panics.1.json
index 79503b7f..4ea0ee66 100644
--- a/contract/test_snapshots/test/test_set_subscription_interval_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_set_subscription_interval_non_admin_panics.1.json
@@ -1776,4 +1776,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_subscription_interval_zero_panics.1.json b/contract/test_snapshots/test/test_set_subscription_interval_zero_panics.1.json
index 7fe20f66..e220636b 100644
--- a/contract/test_snapshots/test/test_set_subscription_interval_zero_panics.1.json
+++ b/contract/test_snapshots/test/test_set_subscription_interval_zero_panics.1.json
@@ -1776,4 +1776,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_set_whitelist_enabled_false_allows_any_merchant.1.json b/contract/test_snapshots/test/test_set_whitelist_enabled_false_allows_any_merchant.1.json
index 0c27781a..c221cfcf 100644
--- a/contract/test_snapshots/test/test_set_whitelist_enabled_false_allows_any_merchant.1.json
+++ b/contract/test_snapshots/test/test_set_whitelist_enabled_false_allows_any_merchant.1.json
@@ -1923,4 +1923,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_after_set_min_interval_lower_succeeds.1.json b/contract/test_snapshots/test/test_subscribe_after_set_min_interval_lower_succeeds.1.json
index 33c2da01..b3118c50 100644
--- a/contract/test_snapshots/test/test_subscribe_after_set_min_interval_lower_succeeds.1.json
+++ b/contract/test_snapshots/test/test_subscribe_after_set_min_interval_lower_succeeds.1.json
@@ -1968,4 +1968,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_amount_above_cap_panics.1.json b/contract/test_snapshots/test/test_subscribe_amount_above_cap_panics.1.json
index cff431d6..817aeadf 100644
--- a/contract/test_snapshots/test/test_subscribe_amount_above_cap_panics.1.json
+++ b/contract/test_snapshots/test/test_subscribe_amount_above_cap_panics.1.json
@@ -1407,4 +1407,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_amount_at_cap_succeeds.1.json b/contract/test_snapshots/test/test_subscribe_amount_at_cap_succeeds.1.json
index 0f645ceb..1e337b59 100644
--- a/contract/test_snapshots/test/test_subscribe_amount_at_cap_succeeds.1.json
+++ b/contract/test_snapshots/test/test_subscribe_amount_at_cap_succeeds.1.json
@@ -2280,4 +2280,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_and_charge.1.json b/contract/test_snapshots/test/test_subscribe_and_charge.1.json
index 789641a9..fe08c8ea 100644
--- a/contract/test_snapshots/test/test_subscribe_and_charge.1.json
+++ b/contract/test_snapshots/test/test_subscribe_and_charge.1.json
@@ -2425,4 +2425,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_exact_allowance_succeeds.1.json b/contract/test_snapshots/test/test_subscribe_exact_allowance_succeeds.1.json
index e3e63060..27b705af 100644
--- a/contract/test_snapshots/test/test_subscribe_exact_allowance_succeeds.1.json
+++ b/contract/test_snapshots/test/test_subscribe_exact_allowance_succeeds.1.json
@@ -1080,4 +1080,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_extends_instance_ttl.1.json b/contract/test_snapshots/test/test_subscribe_extends_instance_ttl.1.json
index 41efee9f..b471ebda 100644
--- a/contract/test_snapshots/test/test_subscribe_extends_instance_ttl.1.json
+++ b/contract/test_snapshots/test/test_subscribe_extends_instance_ttl.1.json
@@ -1581,4 +1581,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_interval_minimum_succeeds.1.json b/contract/test_snapshots/test/test_subscribe_interval_minimum_succeeds.1.json
index fbd60a24..216a633a 100644
--- a/contract/test_snapshots/test/test_subscribe_interval_minimum_succeeds.1.json
+++ b/contract/test_snapshots/test/test_subscribe_interval_minimum_succeeds.1.json
@@ -1993,4 +1993,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_interval_too_short_panics_default_floor.1.json b/contract/test_snapshots/test/test_subscribe_interval_too_short_panics_default_floor.1.json
index d5f31dca..a0e0f64c 100644
--- a/contract/test_snapshots/test/test_subscribe_interval_too_short_panics_default_floor.1.json
+++ b/contract/test_snapshots/test/test_subscribe_interval_too_short_panics_default_floor.1.json
@@ -1094,4 +1094,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_interval_under_60_panics.1.json b/contract/test_snapshots/test/test_subscribe_interval_under_60_panics.1.json
index e129ec78..14e54e45 100644
--- a/contract/test_snapshots/test/test_subscribe_interval_under_60_panics.1.json
+++ b/contract/test_snapshots/test/test_subscribe_interval_under_60_panics.1.json
@@ -1094,4 +1094,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_non_contract_address.1.json b/contract/test_snapshots/test/test_subscribe_non_contract_address.1.json
index 95afe620..9010db2b 100644
--- a/contract/test_snapshots/test/test_subscribe_non_contract_address.1.json
+++ b/contract/test_snapshots/test/test_subscribe_non_contract_address.1.json
@@ -1094,4 +1094,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_non_whitelisted_merchant_panics.1.json b/contract/test_snapshots/test/test_subscribe_non_whitelisted_merchant_panics.1.json
index 2e367781..70bf51b2 100644
--- a/contract/test_snapshots/test/test_subscribe_non_whitelisted_merchant_panics.1.json
+++ b/contract/test_snapshots/test/test_subscribe_non_whitelisted_merchant_panics.1.json
@@ -1206,4 +1206,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_overwrites_cancelled_subscription.1.json b/contract/test_snapshots/test/test_subscribe_overwrites_cancelled_subscription.1.json
index f836f59c..a732c584 100644
--- a/contract/test_snapshots/test/test_subscribe_overwrites_cancelled_subscription.1.json
+++ b/contract/test_snapshots/test/test_subscribe_overwrites_cancelled_subscription.1.json
@@ -2320,4 +2320,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_to_frozen_merchant_panics.1.json b/contract/test_snapshots/test/test_subscribe_to_frozen_merchant_panics.1.json
index cfd0ef13..bc8d1fc8 100644
--- a/contract/test_snapshots/test/test_subscribe_to_frozen_merchant_panics.1.json
+++ b/contract/test_snapshots/test/test_subscribe_to_frozen_merchant_panics.1.json
@@ -1407,4 +1407,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_valid_sac_token_address_succeeds.1.json b/contract/test_snapshots/test/test_subscribe_valid_sac_token_address_succeeds.1.json
index 35c4a00a..f8387ba1 100644
--- a/contract/test_snapshots/test/test_subscribe_valid_sac_token_address_succeeds.1.json
+++ b/contract/test_snapshots/test/test_subscribe_valid_sac_token_address_succeeds.1.json
@@ -1712,4 +1712,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_whitelisted_merchant_succeeds.1.json b/contract/test_snapshots/test/test_subscribe_whitelisted_merchant_succeeds.1.json
index 9af522d8..cb130613 100644
--- a/contract/test_snapshots/test/test_subscribe_whitelisted_merchant_succeeds.1.json
+++ b/contract/test_snapshots/test/test_subscribe_whitelisted_merchant_succeeds.1.json
@@ -2123,4 +2123,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_with_metadata_label_too_long.1.json b/contract/test_snapshots/test/test_subscribe_with_metadata_label_too_long.1.json
index 9d6b9015..8a812900 100644
--- a/contract/test_snapshots/test/test_subscribe_with_metadata_label_too_long.1.json
+++ b/contract/test_snapshots/test/test_subscribe_with_metadata_label_too_long.1.json
@@ -1100,4 +1100,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_with_metadata_no_subscription_on_label_failure.1.json b/contract/test_snapshots/test/test_subscribe_with_metadata_no_subscription_on_label_failure.1.json
index 9d6b9015..8a812900 100644
--- a/contract/test_snapshots/test/test_subscribe_with_metadata_no_subscription_on_label_failure.1.json
+++ b/contract/test_snapshots/test/test_subscribe_with_metadata_no_subscription_on_label_failure.1.json
@@ -1100,4 +1100,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_with_metadata_success.1.json b/contract/test_snapshots/test/test_subscribe_with_metadata_success.1.json
index b3c0c853..9ba3b9e6 100644
--- a/contract/test_snapshots/test/test_subscribe_with_metadata_success.1.json
+++ b/contract/test_snapshots/test/test_subscribe_with_metadata_success.1.json
@@ -1813,4 +1813,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_zero_allowance_does_not_write_storage.1.json b/contract/test_snapshots/test/test_subscribe_zero_allowance_does_not_write_storage.1.json
index 4f1539ac..4b33db8b 100644
--- a/contract/test_snapshots/test/test_subscribe_zero_allowance_does_not_write_storage.1.json
+++ b/contract/test_snapshots/test/test_subscribe_zero_allowance_does_not_write_storage.1.json
@@ -432,4 +432,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscribe_zero_allowance_panics.1.json b/contract/test_snapshots/test/test_subscribe_zero_allowance_panics.1.json
index 14a76aed..fde93186 100644
--- a/contract/test_snapshots/test/test_subscribe_zero_allowance_panics.1.json
+++ b/contract/test_snapshots/test/test_subscribe_zero_allowance_panics.1.json
@@ -815,4 +815,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscriber_index_three_unique_users.1.json b/contract/test_snapshots/test/test_subscriber_index_three_unique_users.1.json
index a939b90d..a3883dc6 100644
--- a/contract/test_snapshots/test/test_subscriber_index_three_unique_users.1.json
+++ b/contract/test_snapshots/test/test_subscriber_index_three_unique_users.1.json
@@ -3609,4 +3609,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscriber_page_limit_capped_at_50.1.json b/contract/test_snapshots/test/test_subscriber_page_limit_capped_at_50.1.json
index a9be5f8b..973ec015 100644
--- a/contract/test_snapshots/test/test_subscriber_page_limit_capped_at_50.1.json
+++ b/contract/test_snapshots/test/test_subscriber_page_limit_capped_at_50.1.json
@@ -49073,4 +49073,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscriber_page_offset_beyond_count_returns_empty.1.json b/contract/test_snapshots/test/test_subscriber_page_offset_beyond_count_returns_empty.1.json
index a9accdc0..21762f90 100644
--- a/contract/test_snapshots/test/test_subscriber_page_offset_beyond_count_returns_empty.1.json
+++ b/contract/test_snapshots/test/test_subscriber_page_offset_beyond_count_returns_empty.1.json
@@ -1742,4 +1742,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_subscription_struct_fields_match_input.1.json b/contract/test_snapshots/test/test_subscription_struct_fields_match_input.1.json
index 1fc4ca5b..cb97c032 100644
--- a/contract/test_snapshots/test/test_subscription_struct_fields_match_input.1.json
+++ b/contract/test_snapshots/test/test_subscription_struct_fields_match_input.1.json
@@ -1712,4 +1712,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_transfer_admin.1.json b/contract/test_snapshots/test/test_transfer_admin.1.json
index 70410d5c..921dfc29 100644
--- a/contract/test_snapshots/test/test_transfer_admin.1.json
+++ b/contract/test_snapshots/test/test_transfer_admin.1.json
@@ -1116,4 +1116,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_transfer_admin_event_emitted.1.json b/contract/test_snapshots/test/test_transfer_admin_event_emitted.1.json
index 1c896f13..94f7e6bc 100644
--- a/contract/test_snapshots/test/test_transfer_admin_event_emitted.1.json
+++ b/contract/test_snapshots/test/test_transfer_admin_event_emitted.1.json
@@ -1115,4 +1115,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_transfer_admin_requires_auth.1.json b/contract/test_snapshots/test/test_transfer_admin_requires_auth.1.json
index 70410d5c..921dfc29 100644
--- a/contract/test_snapshots/test/test_transfer_admin_requires_auth.1.json
+++ b/contract/test_snapshots/test/test_transfer_admin_requires_auth.1.json
@@ -1116,4 +1116,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_transfer_subscription_succeeds.1.json b/contract/test_snapshots/test/test_transfer_subscription_succeeds.1.json
index 25dde8a5..7b921c15 100644
--- a/contract/test_snapshots/test/test_transfer_subscription_succeeds.1.json
+++ b/contract/test_snapshots/test/test_transfer_subscription_succeeds.1.json
@@ -2472,4 +2472,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_transfer_subscription_to_active_user_panics.1.json b/contract/test_snapshots/test/test_transfer_subscription_to_active_user_panics.1.json
index 0e535dcd..565313c9 100644
--- a/contract/test_snapshots/test/test_transfer_subscription_to_active_user_panics.1.json
+++ b/contract/test_snapshots/test/test_transfer_subscription_to_active_user_panics.1.json
@@ -2720,4 +2720,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_ttl_extension.1.json b/contract/test_snapshots/test/test_ttl_extension.1.json
index 9184641e..373de0ab 100644
--- a/contract/test_snapshots/test/test_ttl_extension.1.json
+++ b/contract/test_snapshots/test/test_ttl_extension.1.json
@@ -1761,4 +1761,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_unfreeze_merchant_non_admin_panics.1.json b/contract/test_snapshots/test/test_unfreeze_merchant_non_admin_panics.1.json
index d0192576..694c18fd 100644
--- a/contract/test_snapshots/test/test_unfreeze_merchant_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_unfreeze_merchant_non_admin_panics.1.json
@@ -1026,4 +1026,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_unfreeze_merchant_non_frozen_is_noop.1.json b/contract/test_snapshots/test/test_unfreeze_merchant_non_frozen_is_noop.1.json
index e83fc2d8..be8554f8 100644
--- a/contract/test_snapshots/test/test_unfreeze_merchant_non_frozen_is_noop.1.json
+++ b/contract/test_snapshots/test/test_unfreeze_merchant_non_frozen_is_noop.1.json
@@ -1066,4 +1066,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_upgrade_event_emitted.1.json b/contract/test_snapshots/test/test_upgrade_event_emitted.1.json
index 02f3d300..c0afb89c 100644
--- a/contract/test_snapshots/test/test_upgrade_event_emitted.1.json
+++ b/contract/test_snapshots/test/test_upgrade_event_emitted.1.json
@@ -3,9 +3,7 @@
     "address": 1,
     "nonce": 0
   },
-  "auth": [
-    []
-  ],
+  "auth": [[]],
   "ledger": {
     "protocol_version": 21,
     "sequence_number": 0,
@@ -91,4 +89,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_upgrade_event_emitted.2.json b/contract/test_snapshots/test/test_upgrade_event_emitted.2.json
index 2dfb72e6..b85787a0 100644
--- a/contract/test_snapshots/test/test_upgrade_event_emitted.2.json
+++ b/contract/test_snapshots/test/test_upgrade_event_emitted.2.json
@@ -1082,4 +1082,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_user_can_switch_token.1.json b/contract/test_snapshots/test/test_user_can_switch_token.1.json
index f5e34c9d..ce5e94a3 100644
--- a/contract/test_snapshots/test/test_user_can_switch_token.1.json
+++ b/contract/test_snapshots/test/test_user_can_switch_token.1.json
@@ -2764,4 +2764,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_whitelist_batch_add_duplicates_does_not_panic.1.json b/contract/test_snapshots/test/test_whitelist_batch_add_duplicates_does_not_panic.1.json
index 1ab68c98..b3790370 100644
--- a/contract/test_snapshots/test/test_whitelist_batch_add_duplicates_does_not_panic.1.json
+++ b/contract/test_snapshots/test/test_whitelist_batch_add_duplicates_does_not_panic.1.json
@@ -1340,4 +1340,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_whitelist_batch_add_exceeds_max_size_panics.1.json b/contract/test_snapshots/test/test_whitelist_batch_add_exceeds_max_size_panics.1.json
index 6028d162..def89e05 100644
--- a/contract/test_snapshots/test/test_whitelist_batch_add_exceeds_max_size_panics.1.json
+++ b/contract/test_snapshots/test/test_whitelist_batch_add_exceeds_max_size_panics.1.json
@@ -1377,4 +1377,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_whitelist_batch_add_non_admin_panics.1.json b/contract/test_snapshots/test/test_whitelist_batch_add_non_admin_panics.1.json
index a34772e4..47dedddc 100644
--- a/contract/test_snapshots/test/test_whitelist_batch_add_non_admin_panics.1.json
+++ b/contract/test_snapshots/test/test_whitelist_batch_add_non_admin_panics.1.json
@@ -1077,4 +1077,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_whitelist_batch_add_three_merchants.1.json b/contract/test_snapshots/test/test_whitelist_batch_add_three_merchants.1.json
index 1a6bcb9e..abc94b3a 100644
--- a/contract/test_snapshots/test/test_whitelist_batch_add_three_merchants.1.json
+++ b/contract/test_snapshots/test/test_whitelist_batch_add_three_merchants.1.json
@@ -1848,4 +1848,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_whitelist_batch_remove_non_whitelisted_is_noop.1.json b/contract/test_snapshots/test/test_whitelist_batch_remove_non_whitelisted_is_noop.1.json
index 636a590a..12b52bf3 100644
--- a/contract/test_snapshots/test/test_whitelist_batch_remove_non_whitelisted_is_noop.1.json
+++ b/contract/test_snapshots/test/test_whitelist_batch_remove_non_whitelisted_is_noop.1.json
@@ -1055,4 +1055,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_whitelist_batch_remove_two_merchants.1.json b/contract/test_snapshots/test/test_whitelist_batch_remove_two_merchants.1.json
index 82b7aaa6..f4f14e1e 100644
--- a/contract/test_snapshots/test/test_whitelist_batch_remove_two_merchants.1.json
+++ b/contract/test_snapshots/test/test_whitelist_batch_remove_two_merchants.1.json
@@ -1651,4 +1651,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_withdraw_merchant_revenue_succeeds.1.json b/contract/test_snapshots/test/test_withdraw_merchant_revenue_succeeds.1.json
index b9d7c260..24b23b06 100644
--- a/contract/test_snapshots/test/test_withdraw_merchant_revenue_succeeds.1.json
+++ b/contract/test_snapshots/test/test_withdraw_merchant_revenue_succeeds.1.json
@@ -2944,4 +2944,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_withdraw_merchant_revenue_zero_balance_panics.1.json b/contract/test_snapshots/test/test_withdraw_merchant_revenue_zero_balance_panics.1.json
index ecb5315c..401e8a29 100644
--- a/contract/test_snapshots/test/test_withdraw_merchant_revenue_zero_balance_panics.1.json
+++ b/contract/test_snapshots/test/test_withdraw_merchant_revenue_zero_balance_panics.1.json
@@ -1190,4 +1190,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_zero_amount.1.json b/contract/test_snapshots/test/test_zero_amount.1.json
index 565ac69f..254f9a10 100644
--- a/contract/test_snapshots/test/test_zero_amount.1.json
+++ b/contract/test_snapshots/test/test_zero_amount.1.json
@@ -1094,4 +1094,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/contract/test_snapshots/test/test_zero_interval.1.json b/contract/test_snapshots/test/test_zero_interval.1.json
index e129ec78..14e54e45 100644
--- a/contract/test_snapshots/test/test_zero_interval.1.json
+++ b/contract/test_snapshots/test/test_zero_interval.1.json
@@ -1094,4 +1094,4 @@
       "failed_call": false
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index ce538de1..859ff497 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -32,31 +32,31 @@ graph TD
 
 ## Contract Modules
 
-| Module | Responsibility |
-| --- | --- |
-| `lib.rs` | Public entry points, contract data types, storage keys, and cross-module orchestration. |
-| `admin.rs` | Admin initialization, auth checks, and two-step admin transfer. |
-| `batch.rs` | `batch_charge()` processing and per-user result reporting. |
-| `bench.rs` | Benchmark-only instruction counting for core flows. |
-| `charge_exec.rs` | Charge scheduling helpers and charge execution internals. |
-| `errors.rs` | Contract error codes. |
-| `events.rs` | All event emission helpers. |
-| `fee.rs` | Protocol fee proposal, commit, and fee calculation logic. |
-| `grace.rs` | Grace-period proposal, commit, and lookup helpers. |
-| `merchant_stats.rs` | Merchant revenue, subscriber counts, and daily revenue buckets. |
-| `migration.rs` | Schema version tracking and storage migration. |
-| `min_interval.rs` | Minimum billing interval floor. |
-| `referral.rs` | Referral storage and lookup. See [REFERRALS.md](./REFERRALS.md). |
-| `spending_limit.rs` | Temporary daily spending limits for `pay_per_use()`. |
-| `storage.rs` | Shared storage read/write helpers. |
-| `subscription_count.rs` | Active subscription count and append-only subscriber index. |
-| `subscription_history.rs` | Charge history recording and paging. |
-| `subscription_metadata.rs` | Short subscription labels. |
-| `test.rs` | Contract unit tests. |
-| `trial.rs` | Trial end computation and trial helpers. |
-| `upgrade.rs` | WASM upgrade wrapper and upgrade event emission. |
-| `validation.rs` | Shared validation helpers for amounts, intervals, and allowance checks. |
-| `whitelist.rs` | Merchant whitelist and freeze state helpers. |
+| Module                     | Responsibility                                                                          |
+| -------------------------- | --------------------------------------------------------------------------------------- |
+| `lib.rs`                   | Public entry points, contract data types, storage keys, and cross-module orchestration. |
+| `admin.rs`                 | Admin initialization, auth checks, and two-step admin transfer.                         |
+| `batch.rs`                 | `batch_charge()` processing and per-user result reporting.                              |
+| `bench.rs`                 | Benchmark-only instruction counting for core flows.                                     |
+| `charge_exec.rs`           | Charge scheduling helpers and charge execution internals.                               |
+| `errors.rs`                | Contract error codes.                                                                   |
+| `events.rs`                | All event emission helpers.                                                             |
+| `fee.rs`                   | Protocol fee proposal, commit, and fee calculation logic.                               |
+| `grace.rs`                 | Grace-period proposal, commit, and lookup helpers.                                      |
+| `merchant_stats.rs`        | Merchant revenue, subscriber counts, and daily revenue buckets.                         |
+| `migration.rs`             | Schema version tracking and storage migration.                                          |
+| `min_interval.rs`          | Minimum billing interval floor.                                                         |
+| `referral.rs`              | Referral storage and lookup. See [REFERRALS.md](./REFERRALS.md).                        |
+| `spending_limit.rs`        | Temporary daily spending limits for `pay_per_use()`.                                    |
+| `storage.rs`               | Shared storage read/write helpers.                                                      |
+| `subscription_count.rs`    | Active subscription count and append-only subscriber index.                             |
+| `subscription_history.rs`  | Charge history recording and paging.                                                    |
+| `subscription_metadata.rs` | Short subscription labels.                                                              |
+| `test.rs`                  | Contract unit tests.                                                                    |
+| `trial.rs`                 | Trial end computation and trial helpers.                                                |
+| `upgrade.rs`               | WASM upgrade wrapper and upgrade event emission.                                        |
+| `validation.rs`            | Shared validation helpers for amounts, intervals, and allowance checks.                 |
+| `whitelist.rs`             | Merchant whitelist and freeze state helpers.                                            |
 
 ---
 
@@ -104,35 +104,35 @@ graph TD
 
 FlowPay uses Soroban instance, persistent, and temporary storage deliberately.
 
-| DataKey | Purpose | Storage type |
-| --- | --- | --- |
-| `Token` | Default payment token | instance |
-| `Admin` | Current admin | instance |
-| `PendingAdmin` | Two-step admin transfer target | instance |
-| `ContractPaused` | Global pause flag | instance |
-| `GracePeriod` | Charge grace window | instance |
-| `WhitelistEnabled` | Merchant whitelist flag | instance |
-| `FeeCollector` / `FeeBps` | Protocol fee configuration | instance |
-| `PendingFee` | Pending fee proposal | temporary |
-| `PendingGracePeriod` | Pending grace-period proposal | temporary |
-| `MinInterval` | Minimum allowed subscription interval | instance |
-| `SchemaVersion` | Storage schema version | instance |
-| `ActiveCount` | Active subscription count | instance |
-| `SubscriberIndexSize` | Append-only subscriber count | instance |
-| `Subscription(user)` | Subscriber subscription record | persistent |
-| `MerchantWhitelist(merchant)` | Whitelisted merchant flag | persistent |
-| `MerchantFrozen(merchant)` | Frozen merchant flag | persistent |
-| `MerchantRevenue(merchant)` | Cumulative merchant revenue | persistent |
-| `MerchantRevenueDay(merchant, day)` | Daily revenue bucket | persistent |
-| `MerchantRevenueHistory(merchant)` | History vector for revenue reads | persistent |
-| `MerchantSubCount(merchant)` | Active subscriber count per merchant | persistent |
-| `DailyLimit(user)` | Temporary pay-per-use limit | temporary |
-| `DailySpent(user)` | Temporary pay-per-use spend counter | temporary |
-| `Referral(user)` | Referrer for a subscriber ([REFERRALS.md](./REFERRALS.md)) | persistent |
-| `SubscriptionMeta(user)` | Short subscription label | persistent |
-| `ChargeHistory(user)` | Charge timestamps | persistent |
-| `SubscriberIndex(i)` | Append-only subscriber list entry | persistent |
-| `GlobalVolumeWindow` | Rolling volume cap state | instance |
+| DataKey                             | Purpose                                                    | Storage type |
+| ----------------------------------- | ---------------------------------------------------------- | ------------ |
+| `Token`                             | Default payment token                                      | instance     |
+| `Admin`                             | Current admin                                              | instance     |
+| `PendingAdmin`                      | Two-step admin transfer target                             | instance     |
+| `ContractPaused`                    | Global pause flag                                          | instance     |
+| `GracePeriod`                       | Charge grace window                                        | instance     |
+| `WhitelistEnabled`                  | Merchant whitelist flag                                    | instance     |
+| `FeeCollector` / `FeeBps`           | Protocol fee configuration                                 | instance     |
+| `PendingFee`                        | Pending fee proposal                                       | temporary    |
+| `PendingGracePeriod`                | Pending grace-period proposal                              | temporary    |
+| `MinInterval`                       | Minimum allowed subscription interval                      | instance     |
+| `SchemaVersion`                     | Storage schema version                                     | instance     |
+| `ActiveCount`                       | Active subscription count                                  | instance     |
+| `SubscriberIndexSize`               | Append-only subscriber count                               | instance     |
+| `Subscription(user)`                | Subscriber subscription record                             | persistent   |
+| `MerchantWhitelist(merchant)`       | Whitelisted merchant flag                                  | persistent   |
+| `MerchantFrozen(merchant)`          | Frozen merchant flag                                       | persistent   |
+| `MerchantRevenue(merchant)`         | Cumulative merchant revenue                                | persistent   |
+| `MerchantRevenueDay(merchant, day)` | Daily revenue bucket                                       | persistent   |
+| `MerchantRevenueHistory(merchant)`  | History vector for revenue reads                           | persistent   |
+| `MerchantSubCount(merchant)`        | Active subscriber count per merchant                       | persistent   |
+| `DailyLimit(user)`                  | Temporary pay-per-use limit                                | temporary    |
+| `DailySpent(user)`                  | Temporary pay-per-use spend counter                        | temporary    |
+| `Referral(user)`                    | Referrer for a subscriber ([REFERRALS.md](./REFERRALS.md)) | persistent   |
+| `SubscriptionMeta(user)`            | Short subscription label                                   | persistent   |
+| `ChargeHistory(user)`               | Charge timestamps                                          | persistent   |
+| `SubscriberIndex(i)`                | Append-only subscriber list entry                          | persistent   |
+| `GlobalVolumeWindow`                | Rolling volume cap state                                   | instance     |
 
 Persistent entries that must remain available are refreshed with TTL extensions where needed, most importantly subscription records and selected merchant-revenue data. Temporary entries are used for short-lived proposals and daily spending caps.
 
@@ -145,24 +145,24 @@ Each `Subscription(user)` record carries its own `token` address rather than sha
 
 Events are emitted from `events.rs` and kept separate from storage mutation so the public contract methods remain small.
 
-| Event | Trigger |
-| --- | --- |
-| `subscribed` | New or replaced subscription created |
-| `referred` | Referrer stored on subscribe ([REFERRALS.md](./REFERRALS.md)) |
-| `charged` | Successful recurring charge |
-| `pay_per_use` | Successful one-time charge |
-| `cancelled` | Subscription cancelled |
-| `paused` / `resumed` | Subscription pause state changed |
-| `admin_transferred` | Two-step admin transfer completed |
-| `fee_proposed` / `fee_committed` | Fee configuration changed |
-| `merchant_added` / `merchant_removed` | Whitelist updated |
-| `merchant_frozen` / `merchant_unfrozen` | Merchant freeze state changed |
-| `grace_period_proposed` / `grace_period_committed` | Grace period updated |
-| `subscription_amount_updated` / `subscription_interval_updated` | Admin adjusted a subscription |
-| `merchant_withdrawal` | Merchant withdrew revenue |
-| `daily_limit_set` / `daily_limit_removed` | Daily limit updated |
-| `subscription_transferred` | Subscription ownership moved |
-| `upgraded` | Contract WASM upgraded |
+| Event                                                           | Trigger                                                       |
+| --------------------------------------------------------------- | ------------------------------------------------------------- |
+| `subscribed`                                                    | New or replaced subscription created                          |
+| `referred`                                                      | Referrer stored on subscribe ([REFERRALS.md](./REFERRALS.md)) |
+| `charged`                                                       | Successful recurring charge                                   |
+| `pay_per_use`                                                   | Successful one-time charge                                    |
+| `cancelled`                                                     | Subscription cancelled                                        |
+| `paused` / `resumed`                                            | Subscription pause state changed                              |
+| `admin_transferred`                                             | Two-step admin transfer completed                             |
+| `fee_proposed` / `fee_committed`                                | Fee configuration changed                                     |
+| `merchant_added` / `merchant_removed`                           | Whitelist updated                                             |
+| `merchant_frozen` / `merchant_unfrozen`                         | Merchant freeze state changed                                 |
+| `grace_period_proposed` / `grace_period_committed`              | Grace period updated                                          |
+| `subscription_amount_updated` / `subscription_interval_updated` | Admin adjusted a subscription                                 |
+| `merchant_withdrawal`                                           | Merchant withdrew revenue                                     |
+| `daily_limit_set` / `daily_limit_removed`                       | Daily limit updated                                           |
+| `subscription_transferred`                                      | Subscription ownership moved                                  |
+| `upgraded`                                                      | Contract WASM upgraded                                        |
 
 Events are the main off-chain integration surface for analytics, indexers, and the keeper workflow.
 
diff --git a/docs/COMPLIANCE.md b/docs/COMPLIANCE.md
index dc70e796..adf7a16c 100644
--- a/docs/COMPLIANCE.md
+++ b/docs/COMPLIANCE.md
@@ -22,22 +22,22 @@ That means:
 
 ## What’s on-chain vs ephemeral
 
-### Durable enough for audit *if you retain it*
+### Durable enough for audit _if you retain it_
 
-| Artifact | Where it lives | What finance can use it for |
-| --- | --- | --- |
-| Contract events (`charged`, `subscribed`, `cancelled`, …) | Stellar ledger history | Complete billing journal: who paid whom, when, gross/fee/net |
-| `Subscription` record | Persistent contract storage | Current terms: merchant, amount, interval, pause/active flags |
-| Merchant revenue counters / day buckets / history | Persistent storage | Cumulative and daily revenue snapshots |
-| Charge history timestamps | Persistent storage | Recent charge *times* only (see limits below) |
-| Whitelist / freeze / referral / metadata | Persistent storage | Merchant directory and labels — not full payment proof |
+| Artifact                                                  | Where it lives              | What finance can use it for                                   |
+| --------------------------------------------------------- | --------------------------- | ------------------------------------------------------------- |
+| Contract events (`charged`, `subscribed`, `cancelled`, …) | Stellar ledger history      | Complete billing journal: who paid whom, when, gross/fee/net  |
+| `Subscription` record                                     | Persistent contract storage | Current terms: merchant, amount, interval, pause/active flags |
+| Merchant revenue counters / day buckets / history         | Persistent storage          | Cumulative and daily revenue snapshots                        |
+| Charge history timestamps                                 | Persistent storage          | Recent charge _times_ only (see limits below)                 |
+| Whitelist / freeze / referral / metadata                  | Persistent storage          | Merchant directory and labels — not full payment proof        |
 
 ### Ephemeral — do **not** treat as long-term evidence
 
-| Artifact | Storage tier | Behavior |
-| --- | --- | --- |
-| Daily spend limit / daily spent / day-start markers | Temporary | Expire after ~24 hours (`17,280` ledgers). Permanently deleted; not restorable. |
-| Pending fee / grace / upgrade proposals | Temporary | Short-lived propose → commit state (~1 day TTL). |
+| Artifact                                            | Storage tier | Behavior                                                                        |
+| --------------------------------------------------- | ------------ | ------------------------------------------------------------------------------- |
+| Daily spend limit / daily spent / day-start markers | Temporary    | Expire after ~24 hours (`17,280` ledgers). Permanently deleted; not restorable. |
+| Pending fee / grace / upgrade proposals             | Temporary    | Short-lived propose → commit state (~1 day TTL).                                |
 
 See [architecture/storage_and_ttl.md](./architecture/storage_and_ttl.md) for storage tiers and TTL policy, and [ARCHITECTURE.md](./ARCHITECTURE.md#storage-strategy) for the high-level map.
 
@@ -54,11 +54,11 @@ See [architecture/storage_and_ttl.md](./architecture/storage_and_ttl.md) for sto
 1. Node.js 18+ and dependencies under `scripts/` (`cd scripts && npm install`).
 2. Environment (Testnet defaults shown):
 
-| Variable | Purpose |
-| --- | --- |
-| `VITE_CONTRACT_ID` or `CONTRACT_ID` | FlowPay contract ID |
-| `VITE_RPC_URL` / `RPC_URL` | Soroban RPC endpoint |
-| `VITE_NETWORK_PASSPHRASE` | Network passphrase (defaults to Testnet) |
+| Variable                            | Purpose                                  |
+| ----------------------------------- | ---------------------------------------- |
+| `VITE_CONTRACT_ID` or `CONTRACT_ID` | FlowPay contract ID                      |
+| `VITE_RPC_URL` / `RPC_URL`          | Soroban RPC endpoint                     |
+| `VITE_NETWORK_PASSPHRASE`           | Network passphrase (defaults to Testnet) |
 
 3. Your merchant Stellar address (`G…`).
 4. Optionally, an indexer database if you run continuous event ingestion (required for day-summary and churn scripts).
@@ -115,7 +115,7 @@ CONTRACT_ID=C... node --experimental-require-module scripts/subscription-snapsho
   --addresses GABC...,GXYZ... --out snapshot.json
 ```
 
-Useful for proving *current* terms, not historical charges.
+Useful for proving _current_ terms, not historical charges.
 
 ### Step 4 — Cross-check recent charge timestamps on-chain
 
@@ -182,11 +182,11 @@ Full event schemas: [EVENTS.md](./EVENTS.md). Indexing patterns: [EVENT-DRIVEN-G
 
 If you already persist events to SQLite:
 
-| Script | Purpose |
-| --- | --- |
-| `scripts/daily-revenue-summary.ts` | UTC-day charge / fee / subscription totals |
-| `scripts/fee-revenue-report.ts` | Protocol fee totals from `charged.fee` |
-| `scripts/subscriber-churn-report.ts` | Cancellation / churn rates |
+| Script                               | Purpose                                    |
+| ------------------------------------ | ------------------------------------------ |
+| `scripts/daily-revenue-summary.ts`   | UTC-day charge / fee / subscription totals |
+| `scripts/fee-revenue-report.ts`      | Protocol fee totals from `charged.fee`     |
+| `scripts/subscriber-churn-report.ts` | Cancellation / churn rates                 |
 
 These do **not** replace a primary event archive; they summarize one.
 
@@ -196,20 +196,20 @@ These do **not** replace a primary event archive; they summarize one.
 
 ### Billing events in finance language
 
-| Event | Meaning for books |
-| --- | --- |
-| `subscribed` | Customer enrolled; recurring price (`amount`) and period (`interval` seconds) set |
-| `charged` | Recurring invoice collected: **gross** charged to customer, **fee** to protocol, **net** to merchant, at `charged_at` |
-| `pay_per_use` | One-off usage charge against an active subscription |
-| `cancelled` / `cancelled_with_refund` | Subscription ended; no further recurring charges (refund amount only on the refund variant) |
-| `paused` / `resumed` | Customer temporarily stopped / restarted billing |
-| `sub_amount_updated` / `sub_interval_updated` | Price or billing period changed |
-| `sub_transferred` | Subscription moved to another Stellar address |
-| `merchant_withdrawal` | Merchant withdrew accrued protocol-tracked revenue (payout) |
-| `daily_limit_set` / `daily_limit_removed` | Customer changed pay-per-use daily cap (control, not revenue) |
-| `fee_proposed` / `fee_committed` | Protocol fee schedule change (policy audit) |
-| `merchant_frozen` / `merchant_unfrozen` | Admin blocked / unblocked the merchant from new activity |
-| `contract_paused` / `contract_unpaused` | Protocol-wide halt / resume |
+| Event                                         | Meaning for books                                                                                                     |
+| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| `subscribed`                                  | Customer enrolled; recurring price (`amount`) and period (`interval` seconds) set                                     |
+| `charged`                                     | Recurring invoice collected: **gross** charged to customer, **fee** to protocol, **net** to merchant, at `charged_at` |
+| `pay_per_use`                                 | One-off usage charge against an active subscription                                                                   |
+| `cancelled` / `cancelled_with_refund`         | Subscription ended; no further recurring charges (refund amount only on the refund variant)                           |
+| `paused` / `resumed`                          | Customer temporarily stopped / restarted billing                                                                      |
+| `sub_amount_updated` / `sub_interval_updated` | Price or billing period changed                                                                                       |
+| `sub_transferred`                             | Subscription moved to another Stellar address                                                                         |
+| `merchant_withdrawal`                         | Merchant withdrew accrued protocol-tracked revenue (payout)                                                           |
+| `daily_limit_set` / `daily_limit_removed`     | Customer changed pay-per-use daily cap (control, not revenue)                                                         |
+| `fee_proposed` / `fee_committed`              | Protocol fee schedule change (policy audit)                                                                           |
+| `merchant_frozen` / `merchant_unfrozen`       | Admin blocked / unblocked the merchant from new activity                                                              |
+| `contract_paused` / `contract_unpaused`       | Protocol-wide halt / resume                                                                                           |
 
 Amounts on `charged` are the structured source for revenue recognition splits (gross vs fee vs net). Prefer event payloads over reconstructing from token transfers alone.
 
@@ -221,20 +221,20 @@ Amounts on `charged` are the structured source for revenue recognition splits (g
 4. Expect **gross − fee = net**. Protocol fees go to the configured fee collector, not the merchant — do not book fee as merchant revenue.
 5. Investigate gaps: missing events usually mean RPC retention lapsed without an indexer, or filters excluded the merchant.
 
-Token transfers prove value movement; contract events prove *why* (subscription charge vs pay-per-use vs withdrawal). Keep both in the audit package when possible.
+Token transfers prove value movement; contract events prove _why_ (subscription charge vs pay-per-use vs withdrawal). Keep both in the audit package when possible.
 
 ---
 
 ## Data retention
 
-| Concern | Fact | Recommendation |
-| --- | --- | --- |
-| RPC event history | Short retention (~week order) | Run `watch-events` / indexer continuously; archive to your own storage |
+| Concern                     | Fact                                                             | Recommendation                                                                      |
+| --------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| RPC event history           | Short retention (~week order)                                    | Run `watch-events` / indexer continuously; archive to your own storage              |
 | Subscription / metadata TTL | Persistent keys target ~1 year (`6,307,200` ledgers) when bumped | Idle subscriptions may archive; call `extend_subscription_ttl` or restore if needed |
-| Merchant revenue keys | Extended ~90 days on write in current code | Export reports regularly; do not rely on day buckets alone for multi-year books |
-| Charge history storage | Max **12** timestamps; clearable by user | Never use as sole multi-year evidence |
-| Temporary daily limits | Deleted after ~24h | Irrelevant for long-term audit |
-| Admin clears | Admin can clear merchant revenue history / reset revenue | Treat admin actions as privileged; log them off-chain |
+| Merchant revenue keys       | Extended ~90 days on write in current code                       | Export reports regularly; do not rely on day buckets alone for multi-year books     |
+| Charge history storage      | Max **12** timestamps; clearable by user                         | Never use as sole multi-year evidence                                               |
+| Temporary daily limits      | Deleted after ~24h                                               | Irrelevant for long-term audit                                                      |
+| Admin clears                | Admin can clear merchant revenue history / reset revenue         | Treat admin actions as privileged; log them off-chain                               |
 
 **Retention recommendation:** Keep an off-chain append-only event store (and periodic merchant report exports) for as long as your accounting and tax rules require. The chain is the source of truth, but RPC nodes and temporary storage will not keep a multi-year merchant archive for you.
 
@@ -244,15 +244,15 @@ Token transfers prove value movement; contract events prove *why* (subscription
 
 PayFlow / FlowPay does **not** provide:
 
-| Expectation | Reality |
-| --- | --- |
-| KYC / identity verification | Addresses only — no identity documents or sanctions screening |
-| Tax calculation or filing | No tax engine, jurisdiction rules, or Form exports |
-| Legal dispute resolution | No on-chain arbitration for failed or disputed charges |
-| Guaranteed charge timing | Recurring charges depend on an external [keeper](./GLOSSARY.md#keeper) calling `charge` / `batch_charge` |
-| Complete on-chain invoice archive | Storage keeps only recent timestamps; full history requires indexed events |
-| Production Mainnet assurance | Testnet deployment; no formal security audit yet ([SECURITY.md](./SECURITY.md)) |
-| Custody or bank statements | Non-custodial protocol — bank-style statements are your responsibility off-chain |
+| Expectation                       | Reality                                                                                                  |
+| --------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| KYC / identity verification       | Addresses only — no identity documents or sanctions screening                                            |
+| Tax calculation or filing         | No tax engine, jurisdiction rules, or Form exports                                                       |
+| Legal dispute resolution          | No on-chain arbitration for failed or disputed charges                                                   |
+| Guaranteed charge timing          | Recurring charges depend on an external [keeper](./GLOSSARY.md#keeper) calling `charge` / `batch_charge` |
+| Complete on-chain invoice archive | Storage keeps only recent timestamps; full history requires indexed events                               |
+| Production Mainnet assurance      | Testnet deployment; no formal security audit yet ([SECURITY.md](./SECURITY.md))                          |
+| Custody or bank statements        | Non-custodial protocol — bank-style statements are your responsibility off-chain                         |
 
 Broad admin powers (pause, freeze merchants, clear history, upgrade) exist. Treat admin key holders as highly trusted for any compliance narrative.
 
@@ -260,12 +260,12 @@ Broad admin powers (pause, freeze merchants, clear history, upgrade) exist. Trea
 
 ## Related documentation
 
-| Document | Topic |
-| --- | --- |
-| [SECURITY.md](./SECURITY.md) | Security model, auth table, known limitations, disclosure |
-| [ARCHITECTURE.md](./ARCHITECTURE.md) | Modules, storage strategy, event architecture |
-| [EVENTS.md](./EVENTS.md) | Full event payload reference |
-| [EVENT-DRIVEN-GUIDE.md](./EVENT-DRIVEN-GUIDE.md) | Indexing, replay, RPC retention |
-| [architecture/storage_and_ttl.md](./architecture/storage_and_ttl.md) | Storage tiers and TTL |
-| [API.md](./API.md) | Charge and charge-history APIs |
-| [GLOSSARY.md](./GLOSSARY.md) | Protocol terminology |
+| Document                                                             | Topic                                                     |
+| -------------------------------------------------------------------- | --------------------------------------------------------- |
+| [SECURITY.md](./SECURITY.md)                                         | Security model, auth table, known limitations, disclosure |
+| [ARCHITECTURE.md](./ARCHITECTURE.md)                                 | Modules, storage strategy, event architecture             |
+| [EVENTS.md](./EVENTS.md)                                             | Full event payload reference                              |
+| [EVENT-DRIVEN-GUIDE.md](./EVENT-DRIVEN-GUIDE.md)                     | Indexing, replay, RPC retention                           |
+| [architecture/storage_and_ttl.md](./architecture/storage_and_ttl.md) | Storage tiers and TTL                                     |
+| [API.md](./API.md)                                                   | Charge and charge-history APIs                            |
+| [GLOSSARY.md](./GLOSSARY.md)                                         | Protocol terminology                                      |
diff --git a/docs/CONTRIBUTING-CONTRACT.md b/docs/CONTRIBUTING-CONTRACT.md
index ebfe4f10..fb462521 100644
--- a/docs/CONTRIBUTING-CONTRACT.md
+++ b/docs/CONTRIBUTING-CONTRACT.md
@@ -51,6 +51,7 @@ contract/src/
 ```
 
 **Rules:**
+
 - Business logic belongs in a focused module, not in `lib.rs`.
 - `lib.rs` only wires public contract functions to module helpers — no logic inline.
 - `bench.rs` and `test.rs` are gated with `#[cfg(test)]`.
@@ -181,13 +182,13 @@ test_daily_limit_removed_event_emitted
 
 Every new public function needs at minimum:
 
-| Test | What it verifies |
-|------|-----------------|
-| Happy path | Function succeeds under normal conditions |
-| Precondition failure | Correct error when inputs are invalid |
-| Auth enforcement | Panics when called without the required auth |
-| State after | Storage reflects the expected change |
-| Event emitted | The correct event was published (for state-changing functions) |
+| Test                 | What it verifies                                               |
+| -------------------- | -------------------------------------------------------------- |
+| Happy path           | Function succeeds under normal conditions                      |
+| Precondition failure | Correct error when inputs are invalid                          |
+| Auth enforcement     | Panics when called without the required auth                   |
+| State after          | Storage reflects the expected change                           |
+| Event emitted        | The correct event was published (for state-changing functions) |
 
 ### Asserting events
 
@@ -230,12 +231,12 @@ Benchmark tests live in `contract/src/bench.rs` and measure CPU instruction coun
 
 ### Baselines
 
-| Function | CPU instructions | Memory bytes |
-|----------|-----------------|--------------|
-| `subscribe()` | ~4 200 000 | ~200 000 |
-| `charge()` | ~3 800 000 | ~180 000 |
-| `pay_per_use()` | ~3 600 000 | ~170 000 |
-| `batch_charge()` — 10 users | ~28 000 000 | ~1 200 000 |
+| Function                    | CPU instructions | Memory bytes |
+| --------------------------- | ---------------- | ------------ |
+| `subscribe()`               | ~4 200 000       | ~200 000     |
+| `charge()`                  | ~3 800 000       | ~180 000     |
+| `pay_per_use()`             | ~3 600 000       | ~170 000     |
+| `batch_charge()` — 10 users | ~28 000 000      | ~1 200 000   |
 
 Thresholds in `bench.rs` include ~10% headroom. If your change shifts a baseline by more than 5%, update the table and the constant.
 
@@ -314,6 +315,7 @@ The full error reference is in [`docs/ERROR-CODES.md`](../docs/ERROR-CODES.md).
 Before opening a pull request against `main`:
 
 **Contract**
+
 - [ ] `cargo test` passes with no failures
 - [ ] `cargo clippy -- -D warnings` passes with no warnings
 - [ ] `cargo check` passes
@@ -326,16 +328,19 @@ Before opening a pull request against `main`:
 - [ ] `#![no_std]` is preserved — no `std::` imports anywhere
 
 **Benchmarks**
+
 - [ ] If your change touches `subscribe`, `charge`, `pay_per_use`, or `batch_charge`, run `cargo test bench -- --nocapture` and confirm instruction counts are within the documented baselines
 - [ ] Update `bench.rs` constants and the baselines table if a deliberate change shifts a baseline
 
 **Documentation**
+
 - [ ] New public functions are added to [`docs/API.md`](API.md)
 - [ ] New events are added to [`docs/EVENTS.md`](EVENTS.md)
 - [ ] New error codes are added to [`docs/ERROR-CODES.md`](ERROR-CODES.md)
 - [ ] PR description explains what changed, why, and links to the relevant issue
 
 **CI**
+
 - [ ] The `Backend (Rust)` GitHub Actions workflow passes (`cargo build` + `cargo test`)
 
 ---
diff --git a/docs/CONTRIBUTING-FRONTEND.md b/docs/CONTRIBUTING-FRONTEND.md
index 911a9326..c4889f3a 100644
--- a/docs/CONTRIBUTING-FRONTEND.md
+++ b/docs/CONTRIBUTING-FRONTEND.md
@@ -47,6 +47,7 @@ export const MyComponent: FC<Props> = ({ title }) => {
 ```
 
 **Rules of thumb**
+
 - Prefer small components (one responsibility).
 - Prefer derived values via `useMemo`.
 - Avoid side effects in render (no async calls directly in the component body).
@@ -60,10 +61,12 @@ export const MyComponent: FC<Props> = ({ title }) => {
 Hooks under `frontend/src/hooks/` should follow consistent conventions so contributors can compose them confidently.
 
 ### Naming
+
 - Use the React hook naming convention: `useSomething`.
 - If a hook manages a resource, name it around the resource: `useWallet`, `useSubscriptions`, `useContractEvents`.
 
 ### Return shape
+
 Prefer a clear, stable return object containing:
 
 - state values (e.g. `loading`, `error`, `data`)
@@ -81,17 +84,20 @@ type UseXReturn = {
 ```
 
 Guidelines:
+
 - Keep return keys stable; avoid reordering or conditional return types.
 - For async actions, either:
   - return a Promise directly from the action function, or
   - expose `loading`/`error` updated by the action.
 
 ### Cleanup & effects
+
 - If you attach listeners (window events, timers, subscriptions), always remove them in `useEffect` cleanup.
 - Avoid stale closures: put functions in dependency arrays or use `useCallback` when returning callbacks.
 - Do not start network requests in multiple places; centralize in hooks and expose `refresh`/`sync` actions.
 
 ### Side-effect boundary
+
 - Components should be mostly presentational.
 - Hooks should own side effects:
   - `useEffect` for subscriptions/polling
@@ -107,6 +113,7 @@ Frontend tests use Vitest configured with `jsdom` and RTL helpers.
 - RTL setup: `frontend/src/setupTests.ts`
 
 ### What to test
+
 - Component behavior that depends on props/state
 - Hook behavior that exposes actions/state (prefer testing the resulting UI)
 - Accessibility-critical UI: buttons/inputs have labels and interactive elements are reachable
@@ -126,7 +133,9 @@ describe("MyComponent", () => {
   it("renders the title", () => {
     render(<MyComponent title="  Hello  " />);
 
-    expect(screen.getByRole("heading", { level: 2 })).toHaveTextContent("Hello");
+    expect(screen.getByRole("heading", { level: 2 })).toHaveTextContent(
+      "Hello",
+    );
   });
 
   it("is keyboard operable (example)", async () => {
@@ -141,6 +150,7 @@ describe("MyComponent", () => {
 ```
 
 Notes:
+
 - Prefer queries by role/label/text (`getByRole`, `getByLabelText`) rather than `getByTestId`.
 - For async UI, use `await screen.findBy*` or `await waitFor(...)`.
 
@@ -160,6 +170,7 @@ npm test
 The app uses CSS custom properties (design tokens) defined in `frontend/src/index.css`.
 
 ### Required conventions
+
 - Use tokens via `var(--token-name)` instead of hard-coded colors/sizes.
 - Prefer existing tokens (`--color-*`, `--space-*`, `--text-*`, `--radius-*`, `--transition-*`).
 - For theme-aware styling, ensure your CSS works with:
@@ -167,10 +178,12 @@ The app uses CSS custom properties (design tokens) defined in `frontend/src/inde
   - `[data-theme="light"]` overrides
 
 ### Styling components
+
 - Use existing utility classes/util patterns where possible.
 - If you introduce new styles, keep them token-based (no hard-coded theme-dependent values).
 
 ### Accessibility-related CSS utilities
+
 - Use the `.sr-only` utility class for non-visual text when necessary (e.g., describing status changes).
 
 ---
@@ -180,12 +193,14 @@ The app uses CSS custom properties (design tokens) defined in `frontend/src/inde
 Frontend changes must remain accessible.
 
 ### Interaction & keyboard navigation
+
 - Every interactive element must be reachable and operable via keyboard:
   - Buttons should be `<button>` (not clickable `<div>`).
   - Links should be `<a href=...>`.
 - Visible focus is required for keyboard users. If you style focus, do not remove it.
 
 ### Labels & ARIA
+
 - Form controls must have accessible names:
   - `label` + `htmlFor` (preferred)
   - or `aria-label` / `aria-labelledby`
@@ -195,13 +210,16 @@ Frontend changes must remain accessible.
   - and/or existing patterns such as the accessibility announcement hook.
 
 ### Modal/dialog requirements
+
 - Ensure modal content is:
   - labeled (e.g., `aria-labelledby`)
   - keyboard dismissible per existing behavior
   - does not trap focus incorrectly (follow existing modal component patterns)
 
 ### Practical checklist
+
 Before merging, verify:
+
 - [ ] Interactive controls have accessible names
 - [ ] Keyboard users can reach all actions
 - [ ] Images/icons have appropriate `aria-label` or are marked decorative
@@ -214,23 +232,28 @@ Before merging, verify:
 Before opening a PR, confirm:
 
 ### Code & architecture
+
 - [ ] Components do not import `@stellar/stellar-sdk` directly
 - [ ] Contract interactions go through `src/stellar.ts` (via hooks/services)
 - [ ] New hooks follow conventions (stable return shape, cleanup of side effects)
 
 ### Tests
+
 - [ ] Added/updated Vitest + RTL tests for new or changed behavior
 - [ ] Queries in tests prefer role/label/text
 
 ### Styling
+
 - [ ] New styles use CSS custom properties (`var(--*)`)
 - [ ] Theme-aware styling works with `[data-theme="light"]`
 
 ### Accessibility
+
 - [ ] Keyboard navigation works for all new interactive UI
 - [ ] ARIA/labels are correct (no unlabeled controls)
 
 ### CI / quality gates
+
 - [ ] `npm run lint` passes
 - [ ] `npm run format` (Prettier) has been applied
 - [ ] `npm run build` passes
@@ -240,5 +263,5 @@ Before opening a PR, confirm:
 ## Reference: Frontend architecture
 
 For architectural background (hook composition, `stellar.ts` responsibilities), see:
-- `docs/FRONTEND.md`
 
+- `docs/FRONTEND.md`
diff --git a/docs/DAILY-LIMITS.md b/docs/DAILY-LIMITS.md
index e03a2dbe..7fdd71a6 100644
--- a/docs/DAILY-LIMITS.md
+++ b/docs/DAILY-LIMITS.md
@@ -44,11 +44,11 @@ Standard recurring charges via `charge()` / `batch_charge()` **do not** consume
 
 All daily-limit state lives in **temporary** Soroban storage under three keys (see `DataKey` in `contract/src/lib.rs`):
 
-| Key | Type stored | Purpose |
-| --- | --- | --- |
-| `DailyLimit(user)` | `i128` (stroops) | The user-configured cap |
-| `DailySpent(user)` | `i128` (stroops) | Accumulated gross spend in the current window |
-| `DayStart(user)` | `()` (presence marker) | Anchors the start of the current ~24-hour window |
+| Key                | Type stored            | Purpose                                          |
+| ------------------ | ---------------------- | ------------------------------------------------ |
+| `DailyLimit(user)` | `i128` (stroops)       | The user-configured cap                          |
+| `DailySpent(user)` | `i128` (stroops)       | Accumulated gross spend in the current window    |
+| `DayStart(user)`   | `()` (presence marker) | Anchors the start of the current ~24-hour window |
 
 **Units:** All amounts are **stroops**. `1 XLM = 10,000,000` stroops. Example: a 10 XLM limit is `100_000_000` stroops (`10_0000000` in Rust literal style used throughout the contract tests).
 
@@ -80,12 +80,12 @@ When `set_daily_limit` writes `DailyLimit`, and when `record_spend` creates `Day
 
 ### Why this is approximate, not exact
 
-| Factor | Effect |
-| --- | --- |
-| Variable ledger close time | If ledgers close faster or slower than 5 s, real time drifts from 24 h |
-| Network congestion / empty slots | Close intervals can stretch, delaying TTL expiry in wall-clock terms |
-| Testnet vs Pubnet timing | Testnet ledgers can be less regular; do not assume exact midnight resets |
-| TTL is ledger-count based | Expiry is tied to `sequence_number` advancement, not `timestamp` alone |
+| Factor                           | Effect                                                                   |
+| -------------------------------- | ------------------------------------------------------------------------ |
+| Variable ledger close time       | If ledgers close faster or slower than 5 s, real time drifts from 24 h   |
+| Network congestion / empty slots | Close intervals can stretch, delaying TTL expiry in wall-clock terms     |
+| Testnet vs Pubnet timing         | Testnet ledgers can be less regular; do not assume exact midnight resets |
+| TTL is ledger-count based        | Expiry is tied to `sequence_number` advancement, not `timestamp` alone   |
 
 So “after 24 hours” means **after approximately 17,280 ledgers have closed since the TTL was last set for that key** — not “at 00:00 UTC.”
 
@@ -135,11 +135,11 @@ Error surface for UIs: simulate the transaction first; on `DailyLimitExceeded`,
 
 There is no separate per-merchant or per-recipient daily budget. Example from contract tests (`test_pay_per_use_to_daily_limit_shared_with_pay_per_use`):
 
-| Step | Call | Limit | Cumulative spent | Result |
-| --- | --- | --- | --- | --- |
-| 1 | `set_daily_limit(user, 10 XLM)` | 10 XLM | 0 | OK |
-| 2 | `pay_per_use(user, 6 XLM)` | 10 XLM | 6 XLM | OK |
-| 3 | `pay_per_use_to(user, 6 XLM, recipient)` | 10 XLM | would be 12 | **Rejected** (`DailyLimitExceeded`) |
+| Step | Call                                     | Limit  | Cumulative spent | Result                              |
+| ---- | ---------------------------------------- | ------ | ---------------- | ----------------------------------- |
+| 1    | `set_daily_limit(user, 10 XLM)`          | 10 XLM | 0                | OK                                  |
+| 2    | `pay_per_use(user, 6 XLM)`               | 10 XLM | 6 XLM            | OK                                  |
+| 3    | `pay_per_use_to(user, 6 XLM, recipient)` | 10 XLM | would be 12      | **Rejected** (`DailyLimitExceeded`) |
 
 Routing payment to a different recipient does **not** create a second pool. Frontends that offer both “pay merchant” and “pay custom recipient” must sum pending intent against the **same** remaining balance.
 
@@ -196,12 +196,12 @@ remaining = if limit is Some(L): max(L - spent, 0) else: unbounded
 
 ### Interpretation matrix
 
-| `get_daily_limit` | `get_day_start` | `get_daily_spent` | Meaning |
-| --- | --- | --- | --- |
-| `None` | `false` | `0` | No cap; no window started |
-| `None` | `true` | `> 0` | Cap expired/removed but window marker still alive until TTL (rare mid-transition); treat as uncapped |
-| `Some(L)` | `false` | `0` | Cap set; no spend yet today (or window expired and not yet spent) |
-| `Some(L)` | `true` | `S` | Active window; remaining ≈ `L - S` |
+| `get_daily_limit` | `get_day_start` | `get_daily_spent` | Meaning                                                                                              |
+| ----------------- | --------------- | ----------------- | ---------------------------------------------------------------------------------------------------- |
+| `None`            | `false`         | `0`               | No cap; no window started                                                                            |
+| `None`            | `true`          | `> 0`             | Cap expired/removed but window marker still alive until TTL (rare mid-transition); treat as uncapped |
+| `Some(L)`         | `false`         | `0`               | Cap set; no spend yet today (or window expired and not yet spent)                                    |
+| `Some(L)`         | `true`          | `S`               | Active window; remaining ≈ `L - S`                                                                   |
 
 **Concrete example:** Limit is 10 XLM (`100_000_000` stroops), spent is 7 XLM (`70_000_000` stroops), remaining is **3 XLM** (`30_000_000` stroops). A `pay_per_use` of 4 XLM would panic; 3 XLM would succeed and leave remaining at 0.
 
@@ -221,11 +221,11 @@ Assume `1 XLM = 10_000_000` stroops.
 
 ### Example A — within limit
 
-| Action | Amount (XLM) | Amount (stroops) | Spent after | Remaining (limit 10 XLM) |
-| --- | --- | --- | --- | --- |
-| `set_daily_limit` | 10 | `100_000_000` | 0 | 10 XLM |
-| `pay_per_use` | 4 | `40_000_000` | 4 XLM | 6 XLM |
-| `pay_per_use` | 3 | `30_000_000` | 7 XLM | 3 XLM |
+| Action            | Amount (XLM) | Amount (stroops) | Spent after | Remaining (limit 10 XLM) |
+| ----------------- | ------------ | ---------------- | ----------- | ------------------------ |
+| `set_daily_limit` | 10           | `100_000_000`    | 0           | 10 XLM                   |
+| `pay_per_use`     | 4            | `40_000_000`     | 4 XLM       | 6 XLM                    |
+| `pay_per_use`     | 3            | `30_000_000`     | 7 XLM       | 3 XLM                    |
 
 ### Example B — single-call overspend blocked
 
@@ -338,9 +338,7 @@ async function readI128(
     fee: BASE_FEE,
     networkPassphrase,
   })
-    .addOperation(
-      contract.call(method, new Address(user).toScVal()),
-    )
+    .addOperation(contract.call(method, new Address(user).toScVal()))
     .setTimeout(30)
     .build();
 
@@ -390,7 +388,11 @@ export async function loadDailyLimitView(user: string) {
 
   const spentVal = spent ?? 0n;
   const remaining =
-    limit === null || limit === undefined ? null : limit > spentVal ? limit - spentVal : 0n;
+    limit === null || limit === undefined
+      ? null
+      : limit > spentVal
+        ? limit - spentVal
+        : 0n;
 
   return {
     limitLabel: limit == null ? "Not set" : formatXlm(limit),
@@ -399,9 +401,7 @@ export async function loadDailyLimitView(user: string) {
     dayWindowActive: dayActive,
     // Example: limit 10 XLM, spent 7 XLM → remaining 3 XLM
     progressPct:
-      limit != null && limit > 0n
-        ? Number((spentVal * 100n) / limit)
-        : 0,
+      limit != null && limit > 0n ? Number((spentVal * 100n) / limit) : 0,
   };
 }
 ```
@@ -461,17 +461,17 @@ cargo test daily_limit
 
 Notable cases:
 
-| Test | Behavior covered |
-| --- | --- |
-| `test_daily_limit_allows_spend_within_limit` | Single spend under cap |
-| `test_daily_limit_blocks_overspend` | Single spend over cap |
-| `test_daily_limit_accumulates_across_calls` | Multi-call accumulation |
-| `test_daily_limit_blocks_cumulative_overspend` | Cumulative breach |
-| `test_daily_limit_visibility_and_spend_tracking` | `get_daily_limit` / `get_daily_spent` lifecycle |
-| `test_daily_limit_day_start_boundary` | TTL / sequence expiry resets spent |
-| `test_pay_per_use_to_daily_limit_shared_with_pay_per_use` | Shared budget across entrypoints |
-| `test_daily_limit_set_event_emitted` / `test_daily_limit_removed_event_emitted` | Events |
-| `test_get_day_start_visibility` | `get_day_start` before/after spend and after remove |
+| Test                                                                            | Behavior covered                                    |
+| ------------------------------------------------------------------------------- | --------------------------------------------------- |
+| `test_daily_limit_allows_spend_within_limit`                                    | Single spend under cap                              |
+| `test_daily_limit_blocks_overspend`                                             | Single spend over cap                               |
+| `test_daily_limit_accumulates_across_calls`                                     | Multi-call accumulation                             |
+| `test_daily_limit_blocks_cumulative_overspend`                                  | Cumulative breach                                   |
+| `test_daily_limit_visibility_and_spend_tracking`                                | `get_daily_limit` / `get_daily_spent` lifecycle     |
+| `test_daily_limit_day_start_boundary`                                           | TTL / sequence expiry resets spent                  |
+| `test_pay_per_use_to_daily_limit_shared_with_pay_per_use`                       | Shared budget across entrypoints                    |
+| `test_daily_limit_set_event_emitted` / `test_daily_limit_removed_event_emitted` | Events                                              |
+| `test_get_day_start_visibility`                                                 | `get_day_start` before/after spend and after remove |
 
 ---
 
diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
index 5ab7c94b..1e395308 100644
--- a/docs/DEPLOYMENT.md
+++ b/docs/DEPLOYMENT.md
@@ -6,13 +6,13 @@ Covers building the FlowPay contract, deploying to Testnet and Mainnet using the
 
 ## Prerequisites
 
-| Tool | Version | Install |
-|------|---------|---------|
-| Rust | 1.70+ | `curl https://sh.rustup.rs -sSf \| sh` |
-| wasm32 target | — | `rustup target add wasm32-unknown-unknown` |
-| Soroban CLI | 21.x | `cargo install --locked soroban-cli` |
-| Node.js | 18+ | [nodejs.org](https://nodejs.org/) |
-| Freighter Wallet | — | [freighter.app](https://www.freighter.app/) |
+| Tool             | Version | Install                                     |
+| ---------------- | ------- | ------------------------------------------- |
+| Rust             | 1.70+   | `curl https://sh.rustup.rs -sSf \| sh`      |
+| wasm32 target    | —       | `rustup target add wasm32-unknown-unknown`  |
+| Soroban CLI      | 21.x    | `cargo install --locked soroban-cli`        |
+| Node.js          | 18+     | [nodejs.org](https://nodejs.org/)           |
+| Freighter Wallet | —       | [freighter.app](https://www.freighter.app/) |
 
 Verify your setup:
 
@@ -44,6 +44,7 @@ bash scripts/deploy.sh --network testnet --source <DEPLOYER_KEYPAIR> --token <SA
 ```
 
 The script:
+
 1. Uploads the WASM and obtains a hash.
 2. Deploys the contract and captures the contract ID.
 3. Calls `initialize(token, admin)` with the provided SAC address.
@@ -93,12 +94,12 @@ bash scripts/verify-contract.sh --network <testnet|mainnet> --id <CONTRACT_ID>
 
 The script calls the following read functions and asserts expected values:
 
-| Check | Expected |
-|-------|----------|
-| `get_schema_version` | Latest version |
-| `get_health` | `is_healthy: true` |
-| Token configured | Non-empty address |
-| Admin configured | Non-empty address |
+| Check                | Expected           |
+| -------------------- | ------------------ |
+| `get_schema_version` | Latest version     |
+| `get_health`         | `is_healthy: true` |
+| Token configured     | Non-empty address  |
+| Admin configured     | Non-empty address  |
 
 You can also run these manually:
 
@@ -125,10 +126,10 @@ Subsequent calls are safe no-ops. See [Migration History](#migration-history) be
 
 ### Migration History
 
-| Version | Changes |
-|---------|---------|
-| v1 | Initial schema |
-| v2 | Added `SchemaVersion`, `Referral`, `SubscriptionMeta`, `ChargeHistory` keys |
+| Version | Changes                                                                     |
+| ------- | --------------------------------------------------------------------------- |
+| v1      | Initial schema                                                              |
+| v2      | Added `SchemaVersion`, `Referral`, `SubscriptionMeta`, `ChargeHistory` keys |
 
 ---
 
@@ -189,11 +190,11 @@ FlowPay does not support automatic rollback. To revert to a previous WASM:
 
 ## Frontend Environment Variables
 
-| Variable | Required | Default | Description |
-|----------|----------|---------|-------------|
-| `VITE_CONTRACT_ID` | Yes | `""` | Deployed contract ID |
-| `VITE_RPC_URL` | No | `https://soroban-testnet.stellar.org` | Soroban RPC endpoint |
-| `VITE_NETWORK_PASSPHRASE` | No | `Networks.TESTNET` | Stellar network passphrase |
+| Variable                  | Required | Default                               | Description                |
+| ------------------------- | -------- | ------------------------------------- | -------------------------- |
+| `VITE_CONTRACT_ID`        | Yes      | `""`                                  | Deployed contract ID       |
+| `VITE_RPC_URL`            | No       | `https://soroban-testnet.stellar.org` | Soroban RPC endpoint       |
+| `VITE_NETWORK_PASSPHRASE` | No       | `Networks.TESTNET`                    | Stellar network passphrase |
 
 ---
 
diff --git a/docs/ERROR-CODES.md b/docs/ERROR-CODES.md
index eeb54004..894044c3 100644
--- a/docs/ERROR-CODES.md
+++ b/docs/ERROR-CODES.md
@@ -12,39 +12,39 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ## Quick-Reference Table
 
-| Code | Name | Category | When it occurs (short) |
-| --- | --- | --- | --- |
-| 1 | `AlreadyInitialized` | State | `initialize()` called twice |
-| 2 | `AmountMustBePositive` | Validation | Amount ≤ 0 |
-| 3 | `IntervalMustBePositive` | Validation | Interval ≤ 0 |
-| 4 | `NoSubscriptionFound` | State | No subscription for user/token |
-| 5 | `SubscriptionInactive` | State | Charge/pay on cancelled sub |
-| 6 | `IntervalNotElapsed` | Limit | Charge before interval ends |
-| 7 | `NotInitialized` | State | Call before `initialize()` |
-| 8 | `InsufficientAllowance` | Auth / Limit | Token allowance too low |
-| 9 | `GracePeriodElapsed` | Limit | Charge after grace window |
-| 10 | `MerchantNotWhitelisted` | Auth | Merchant not on whitelist |
-| 11 | `SelfReferral` | Validation | Referrer == subscriber |
-| 12 | `InvalidTokenAddress` | Validation | Token is not a contract/SAC |
-| 13 | `InvalidFeeBps` | Validation | Fee bps > 10000 |
-| 14 | `MetadataLabelTooLong` | Validation | Label > 64 bytes |
-| 15 | `AmountExceedsMaximum` | Limit | Amount above max |
-| 16 | `SubscriptionNotActive` | State | Op requires active sub |
-| 17 | `SubscriptionPaused` | State | Charge while user-paused |
-| 18 | `ContractPaused` | State | Op while protocol paused |
-| 19 | `IntervalTooShort` | Validation | Interval below min floor |
-| 20 | `BatchTooLarge` | Limit | Batch size above max |
-| 21 | `ZeroBalanceAvailable` | State | Merchant withdraw with 0 |
-| 22 | `MerchantFrozen` | Auth | Subscribe to frozen merchant |
-| 23 | `NoPendingProposal` | State | Commit without proposal |
-| 24 | `SubscriptionAlreadyActive` | State | Transfer target already subscribed |
-| 25 | `DailyLimitExceeded` | Limit | `pay_per_use` over daily cap |
-| 26 | `InvalidFeeCollector` | Validation | Fee collector invalid |
-| 27 | `InvalidPauseExpiry` | Validation | Pause expiry not in future |
-| 28 | `GlobalVolumeExceeded` | Limit | Protocol volume cap hit |
-| 29 | `InvalidBatchSize` | Validation | Configured batch limit invalid |
-| 30 | `ContractPausedError` | State | Subscribe while paused |
-| 32 | `InvalidRecipient` | Validation | Recipient address invalid |
+| Code | Name                        | Category     | When it occurs (short)             |
+| ---- | --------------------------- | ------------ | ---------------------------------- |
+| 1    | `AlreadyInitialized`        | State        | `initialize()` called twice        |
+| 2    | `AmountMustBePositive`      | Validation   | Amount ≤ 0                         |
+| 3    | `IntervalMustBePositive`    | Validation   | Interval ≤ 0                       |
+| 4    | `NoSubscriptionFound`       | State        | No subscription for user/token     |
+| 5    | `SubscriptionInactive`      | State        | Charge/pay on cancelled sub        |
+| 6    | `IntervalNotElapsed`        | Limit        | Charge before interval ends        |
+| 7    | `NotInitialized`            | State        | Call before `initialize()`         |
+| 8    | `InsufficientAllowance`     | Auth / Limit | Token allowance too low            |
+| 9    | `GracePeriodElapsed`        | Limit        | Charge after grace window          |
+| 10   | `MerchantNotWhitelisted`    | Auth         | Merchant not on whitelist          |
+| 11   | `SelfReferral`              | Validation   | Referrer == subscriber             |
+| 12   | `InvalidTokenAddress`       | Validation   | Token is not a contract/SAC        |
+| 13   | `InvalidFeeBps`             | Validation   | Fee bps > 10000                    |
+| 14   | `MetadataLabelTooLong`      | Validation   | Label > 64 bytes                   |
+| 15   | `AmountExceedsMaximum`      | Limit        | Amount above max                   |
+| 16   | `SubscriptionNotActive`     | State        | Op requires active sub             |
+| 17   | `SubscriptionPaused`        | State        | Charge while user-paused           |
+| 18   | `ContractPaused`            | State        | Op while protocol paused           |
+| 19   | `IntervalTooShort`          | Validation   | Interval below min floor           |
+| 20   | `BatchTooLarge`             | Limit        | Batch size above max               |
+| 21   | `ZeroBalanceAvailable`      | State        | Merchant withdraw with 0           |
+| 22   | `MerchantFrozen`            | Auth         | Subscribe to frozen merchant       |
+| 23   | `NoPendingProposal`         | State        | Commit without proposal            |
+| 24   | `SubscriptionAlreadyActive` | State        | Transfer target already subscribed |
+| 25   | `DailyLimitExceeded`        | Limit        | `pay_per_use` over daily cap       |
+| 26   | `InvalidFeeCollector`       | Validation   | Fee collector invalid              |
+| 27   | `InvalidPauseExpiry`        | Validation   | Pause expiry not in future         |
+| 28   | `GlobalVolumeExceeded`      | Limit        | Protocol volume cap hit            |
+| 29   | `InvalidBatchSize`          | Validation   | Configured batch limit invalid     |
+| 30   | `ContractPausedError`       | State        | Subscribe while paused             |
+| 32   | `InvalidRecipient`          | Validation   | Recipient address invalid          |
 
 > **Note:** Code `31` is intentionally unused. Source of truth: [`contract/src/errors.rs`](../contract/src/errors.rs).
 
@@ -54,10 +54,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 1 — `AlreadyInitialized`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Calling `initialize()` on a contract that already has an admin/token configured |
-| **Immediate cause** | Instance storage already holds initialization state |
+| Field               | Detail                                                                          |
+| ------------------- | ------------------------------------------------------------------------------- |
+| **When it occurs**  | Calling `initialize()` on a contract that already has an admin/token configured |
+| **Immediate cause** | Instance storage already holds initialization state                             |
 
 **Recovery steps**
 
@@ -71,10 +71,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 2 — `AmountMustBePositive`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `subscribe()`, `pay_per_use()`, or amount setters receive `amount <= 0` |
-| **Immediate cause** | Validation rejects non-positive amounts |
+| Field               | Detail                                                                  |
+| ------------------- | ----------------------------------------------------------------------- |
+| **When it occurs**  | `subscribe()`, `pay_per_use()`, or amount setters receive `amount <= 0` |
+| **Immediate cause** | Validation rejects non-positive amounts                                 |
 
 **Recovery steps**
 
@@ -88,10 +88,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 3 — `IntervalMustBePositive`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `subscribe()` (or interval setters) receive `interval <= 0` |
-| **Immediate cause** | Interval failed the positive check |
+| Field               | Detail                                                      |
+| ------------------- | ----------------------------------------------------------- |
+| **When it occurs**  | `subscribe()` (or interval setters) receive `interval <= 0` |
+| **Immediate cause** | Interval failed the positive check                          |
 
 **Recovery steps**
 
@@ -105,10 +105,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 4 — `NoSubscriptionFound`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `charge()`, `pause()`, `resume()`, `cancel()`, getters, or related ops for a user with no stored subscription |
-| **Immediate cause** | Persistent storage has no `Subscription` for that user |
+| Field               | Detail                                                                                                        |
+| ------------------- | ------------------------------------------------------------------------------------------------------------- |
+| **When it occurs**  | `charge()`, `pause()`, `resume()`, `cancel()`, getters, or related ops for a user with no stored subscription |
+| **Immediate cause** | Persistent storage has no `Subscription` for that user                                                        |
 
 **Recovery steps**
 
@@ -122,10 +122,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 5 — `SubscriptionInactive`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Charging or paying against a cancelled / inactive subscription |
-| **Immediate cause** | Subscription exists but `active == false` |
+| Field               | Detail                                                         |
+| ------------------- | -------------------------------------------------------------- |
+| **When it occurs**  | Charging or paying against a cancelled / inactive subscription |
+| **Immediate cause** | Subscription exists but `active == false`                      |
 
 **Recovery steps**
 
@@ -139,10 +139,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 6 — `IntervalNotElapsed`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `charge()` / batch charge before `last_charged + interval` |
-| **Immediate cause** | Billing interval has not completed |
+| Field               | Detail                                                     |
+| ------------------- | ---------------------------------------------------------- |
+| **When it occurs**  | `charge()` / batch charge before `last_charged + interval` |
+| **Immediate cause** | Billing interval has not completed                         |
 
 **Recovery steps**
 
@@ -156,9 +156,9 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 7 — `NotInitialized`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Any operational call before successful `initialize()` |
+| Field               | Detail                                                        |
+| ------------------- | ------------------------------------------------------------- |
+| **When it occurs**  | Any operational call before successful `initialize()`         |
 | **Immediate cause** | Admin/token (or related) config missing from instance storage |
 
 **Recovery steps**
@@ -173,10 +173,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 8 — `InsufficientAllowance`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Charge or subscribe path finds token allowance below required amount |
-| **Immediate cause** | SAC `allowance(user → FlowPay)` is too low or spent down |
+| Field               | Detail                                                               |
+| ------------------- | -------------------------------------------------------------------- |
+| **When it occurs**  | Charge or subscribe path finds token allowance below required amount |
+| **Immediate cause** | SAC `allowance(user → FlowPay)` is too low or spent down             |
 
 **Recovery steps**
 
@@ -190,9 +190,9 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 9 — `GracePeriodElapsed`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Charge attempted after `last_charged + interval + grace_period` |
+| Field               | Detail                                                             |
+| ------------------- | ------------------------------------------------------------------ |
+| **When it occurs**  | Charge attempted after `last_charged + interval + grace_period`    |
 | **Immediate cause** | Billing window closed; subscription treated as lapsed for charging |
 
 **Recovery steps**
@@ -207,10 +207,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 10 — `MerchantNotWhitelisted`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Subscribe when whitelist mode is enabled and merchant is not listed |
-| **Immediate cause** | `is_whitelist_enabled` and merchant missing from whitelist storage |
+| Field               | Detail                                                              |
+| ------------------- | ------------------------------------------------------------------- |
+| **When it occurs**  | Subscribe when whitelist mode is enabled and merchant is not listed |
+| **Immediate cause** | `is_whitelist_enabled` and merchant missing from whitelist storage  |
 
 **Recovery steps**
 
@@ -224,9 +224,9 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 11 — `SelfReferral`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `subscribe()` with `referrer == user` |
+| Field               | Detail                                    |
+| ------------------- | ----------------------------------------- |
+| **When it occurs**  | `subscribe()` with `referrer == user`     |
 | **Immediate cause** | Referral validation rejects self-referral |
 
 **Recovery steps**
@@ -240,10 +240,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 12 — `InvalidTokenAddress`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Initialize/subscribe with a non-contract / invalid SAC address |
-| **Immediate cause** | Address fails contract/SAC validation |
+| Field               | Detail                                                         |
+| ------------------- | -------------------------------------------------------------- |
+| **When it occurs**  | Initialize/subscribe with a non-contract / invalid SAC address |
+| **Immediate cause** | Address fails contract/SAC validation                          |
 
 **Recovery steps**
 
@@ -257,10 +257,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 13 — `InvalidFeeBps`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Fee proposal/set with `bps > 10000` |
-| **Immediate cause** | Basis points outside `[0, 10000]` |
+| Field               | Detail                              |
+| ------------------- | ----------------------------------- |
+| **When it occurs**  | Fee proposal/set with `bps > 10000` |
+| **Immediate cause** | Basis points outside `[0, 10000]`   |
 
 **Recovery steps**
 
@@ -274,10 +274,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 14 — `MetadataLabelTooLong`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `set_metadata` / subscribe-with-metadata label longer than 64 bytes |
-| **Immediate cause** | Label byte length > 64 |
+| Field               | Detail                                                              |
+| ------------------- | ------------------------------------------------------------------- |
+| **When it occurs**  | `set_metadata` / subscribe-with-metadata label longer than 64 bytes |
+| **Immediate cause** | Label byte length > 64                                              |
 
 **Recovery steps**
 
@@ -290,9 +290,9 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 15 — `AmountExceedsMaximum`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Payment/subscription amount above protocol max |
+| Field               | Detail                                         |
+| ------------------- | ---------------------------------------------- |
+| **When it occurs**  | Payment/subscription amount above protocol max |
 | **Immediate cause** | Amount failed `require_valid_amount` max check |
 
 **Recovery steps**
@@ -307,10 +307,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 16 — `SubscriptionNotActive`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Lifecycle ops (e.g. pause flows) that require an active subscription |
-| **Immediate cause** | Subscription state is not active |
+| Field               | Detail                                                               |
+| ------------------- | -------------------------------------------------------------------- |
+| **When it occurs**  | Lifecycle ops (e.g. pause flows) that require an active subscription |
+| **Immediate cause** | Subscription state is not active                                     |
 
 **Recovery steps**
 
@@ -324,10 +324,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 17 — `SubscriptionPaused`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `charge()` / `pay_per_use()` while the user has paused the subscription |
-| **Immediate cause** | Pause flag / pause-until state blocks billing |
+| Field               | Detail                                                                  |
+| ------------------- | ----------------------------------------------------------------------- |
+| **When it occurs**  | `charge()` / `pay_per_use()` while the user has paused the subscription |
+| **Immediate cause** | Pause flag / pause-until state blocks billing                           |
 
 **Recovery steps**
 
@@ -341,10 +341,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 18 — `ContractPaused`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Sensitive operations while the admin circuit breaker is on |
-| **Immediate cause** | Instance `ContractPaused` flag is true |
+| Field               | Detail                                                     |
+| ------------------- | ---------------------------------------------------------- |
+| **When it occurs**  | Sensitive operations while the admin circuit breaker is on |
+| **Immediate cause** | Instance `ContractPaused` flag is true                     |
 
 **Recovery steps**
 
@@ -358,10 +358,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 19 — `IntervalTooShort`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Interval `< 60` or below admin `min_interval` |
-| **Immediate cause** | Floor check in subscribe/validation |
+| Field               | Detail                                        |
+| ------------------- | --------------------------------------------- |
+| **When it occurs**  | Interval `< 60` or below admin `min_interval` |
+| **Immediate cause** | Floor check in subscribe/validation           |
 
 **Recovery steps**
 
@@ -374,10 +374,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 20 — `BatchTooLarge`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `batch_charge` (or related batch APIs) with too many entries |
-| **Immediate cause** | Batch length exceeds configured/hard max (typically 100) |
+| Field               | Detail                                                       |
+| ------------------- | ------------------------------------------------------------ |
+| **When it occurs**  | `batch_charge` (or related batch APIs) with too many entries |
+| **Immediate cause** | Batch length exceeds configured/hard max (typically 100)     |
 
 **Recovery steps**
 
@@ -391,10 +391,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 21 — `ZeroBalanceAvailable`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `withdraw_merchant_revenue()` with zero accrued balance |
-| **Immediate cause** | Merchant revenue storage is empty/zero |
+| Field               | Detail                                                  |
+| ------------------- | ------------------------------------------------------- |
+| **When it occurs**  | `withdraw_merchant_revenue()` with zero accrued balance |
+| **Immediate cause** | Merchant revenue storage is empty/zero                  |
 
 **Recovery steps**
 
@@ -408,10 +408,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 22 — `MerchantFrozen`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Subscribe to a merchant frozen by admin |
-| **Immediate cause** | Merchant freeze flag set |
+| Field               | Detail                                  |
+| ------------------- | --------------------------------------- |
+| **When it occurs**  | Subscribe to a merchant frozen by admin |
+| **Immediate cause** | Merchant freeze flag set                |
 
 **Recovery steps**
 
@@ -424,10 +424,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 23 — `NoPendingProposal`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Two-step commit (`accept_admin`, fee/grace commit, etc.) with no proposal |
-| **Immediate cause** | Temporary proposal storage missing or expired |
+| Field               | Detail                                                                    |
+| ------------------- | ------------------------------------------------------------------------- |
+| **When it occurs**  | Two-step commit (`accept_admin`, fee/grace commit, etc.) with no proposal |
+| **Immediate cause** | Temporary proposal storage missing or expired                             |
 
 **Recovery steps**
 
@@ -441,10 +441,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 24 — `SubscriptionAlreadyActive`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `transfer_subscription` to an address that already has an active subscription |
-| **Immediate cause** | Target user already holds an active sub |
+| Field               | Detail                                                                        |
+| ------------------- | ----------------------------------------------------------------------------- |
+| **When it occurs**  | `transfer_subscription` to an address that already has an active subscription |
+| **Immediate cause** | Target user already holds an active sub                                       |
 
 **Recovery steps**
 
@@ -457,10 +457,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 25 — `DailyLimitExceeded`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `pay_per_use` would push `DailySpent + amount` over `DailyLimit` |
-| **Immediate cause** | User-set daily spending cap |
+| Field               | Detail                                                           |
+| ------------------- | ---------------------------------------------------------------- |
+| **When it occurs**  | `pay_per_use` would push `DailySpent + amount` over `DailyLimit` |
+| **Immediate cause** | User-set daily spending cap                                      |
 
 **Recovery steps**
 
@@ -474,10 +474,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 26 — `InvalidFeeCollector`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Fee config uses an invalid collector (e.g. the contract’s own address) |
-| **Immediate cause** | Fee module validation rejected collector |
+| Field               | Detail                                                                 |
+| ------------------- | ---------------------------------------------------------------------- |
+| **When it occurs**  | Fee config uses an invalid collector (e.g. the contract’s own address) |
+| **Immediate cause** | Fee module validation rejected collector                               |
 
 **Recovery steps**
 
@@ -490,10 +490,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 27 — `InvalidPauseExpiry`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | `pause_until` / pause APIs with expiry not strictly in the future |
-| **Immediate cause** | `expiry_timestamp <= now` |
+| Field               | Detail                                                            |
+| ------------------- | ----------------------------------------------------------------- |
+| **When it occurs**  | `pause_until` / pause APIs with expiry not strictly in the future |
+| **Immediate cause** | `expiry_timestamp <= now`                                         |
 
 **Recovery steps**
 
@@ -506,10 +506,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 28 — `GlobalVolumeExceeded`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | A charge would exceed the protocol global volume cap |
-| **Immediate cause** | Global volume accounting hit the configured ceiling |
+| Field               | Detail                                               |
+| ------------------- | ---------------------------------------------------- |
+| **When it occurs**  | A charge would exceed the protocol global volume cap |
+| **Immediate cause** | Global volume accounting hit the configured ceiling  |
 
 **Recovery steps**
 
@@ -523,10 +523,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 29 — `InvalidBatchSize`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Admin/config sets an invalid batch size limit at initialize or update |
-| **Immediate cause** | Configured batch limit fails validation |
+| Field               | Detail                                                                |
+| ------------------- | --------------------------------------------------------------------- |
+| **When it occurs**  | Admin/config sets an invalid batch size limit at initialize or update |
+| **Immediate cause** | Configured batch limit fails validation                               |
 
 **Recovery steps**
 
@@ -539,9 +539,9 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 30 — `ContractPausedError`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | New `subscribe()` (and similar entry paths) while the contract is paused |
+| Field               | Detail                                                                                          |
+| ------------------- | ----------------------------------------------------------------------------------------------- |
+| **When it occurs**  | New `subscribe()` (and similar entry paths) while the contract is paused                        |
 | **Immediate cause** | Pause flag blocks new subscriptions (`ContractPausedError` distinct from code 18 on some paths) |
 
 **Recovery steps**
@@ -556,10 +556,10 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### 32 — `InvalidRecipient`
 
-| Field | Detail |
-| --- | --- |
-| **When it occurs** | Transfer/withdraw paths with an invalid recipient (e.g. contract address where an account is required) |
-| **Immediate cause** | Recipient failed address-type validation |
+| Field               | Detail                                                                                                 |
+| ------------------- | ------------------------------------------------------------------------------------------------------ |
+| **When it occurs**  | Transfer/withdraw paths with an invalid recipient (e.g. contract address where an account is required) |
+| **Immediate cause** | Recipient failed address-type validation                                                               |
 
 **Recovery steps**
 
@@ -572,12 +572,12 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ## Error Categories
 
-| Category | Codes | Typical owners |
-| --- | --- | --- |
-| Auth / access | 8, 10, 22 | User + admin |
-| State | 1, 4, 5, 7, 16, 17, 18, 21, 23, 24, 30 | Deployer, user, admin, keeper |
-| Validation | 2, 3, 11, 12, 13, 14, 19, 26, 27, 29, 32 | Client / admin tooling |
-| Limit / timing | 6, 9, 15, 20, 25, 28 | Keeper + user |
+| Category       | Codes                                    | Typical owners                |
+| -------------- | ---------------------------------------- | ----------------------------- |
+| Auth / access  | 8, 10, 22                                | User + admin                  |
+| State          | 1, 4, 5, 7, 16, 17, 18, 21, 23, 24, 30   | Deployer, user, admin, keeper |
+| Validation     | 2, 3, 11, 12, 13, 14, 19, 26, 27, 29, 32 | Client / admin tooling        |
+| Limit / timing | 6, 9, 15, 20, 25, 28                     | Keeper + user                 |
 
 ---
 
@@ -622,15 +622,15 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 `batch_charge` is designed so **per-user failures should not abort the whole batch** when returned as `ChargeResult`. Full transaction panics (e.g. `BatchTooLarge`, `ContractPaused`) abort the invocation.
 
-| Error / result | Keeper action | Alert? |
-| --- | --- | --- |
-| Interval not elapsed / Skipped | Continue; normal | No |
-| InsufficientAllowance | Log user; optional user notify webhook | Low |
-| GracePeriodElapsed | Log + count; investigate cycle lag if spike | Yes if spike |
-| SubscriptionPaused / Inactive / None | Skip; prune index cache | No |
-| BatchTooLarge (20) | Lower page size; split batch | Yes |
-| ContractPaused (18) / ContractPausedError (30) | **Stop** the loop; page on-call | Critical |
-| RPC / timeout | Retry with backoff; failover RPC | Yes after N retries |
+| Error / result                                 | Keeper action                               | Alert?              |
+| ---------------------------------------------- | ------------------------------------------- | ------------------- |
+| Interval not elapsed / Skipped                 | Continue; normal                            | No                  |
+| InsufficientAllowance                          | Log user; optional user notify webhook      | Low                 |
+| GracePeriodElapsed                             | Log + count; investigate cycle lag if spike | Yes if spike        |
+| SubscriptionPaused / Inactive / None           | Skip; prune index cache                     | No                  |
+| BatchTooLarge (20)                             | Lower page size; split batch                | Yes                 |
+| ContractPaused (18) / ContractPausedError (30) | **Stop** the loop; page on-call             | Critical            |
+| RPC / timeout                                  | Retry with backoff; failover RPC            | Yes after N retries |
 
 **Recovery checklist for keepers**
 
@@ -644,35 +644,35 @@ Use the [quick-reference table](#quick-reference-table) for lookups, then jump t
 
 ### Show to the user (user-facing copy)
 
-| Codes | Guidance |
-| --- | --- |
-| 8 | “Increase your token allowance and try again.” |
-| 9 | “This subscription lapsed. Please subscribe again.” |
-| 11 | “You cannot refer yourself.” |
-| 14 | “Label must be 64 bytes or fewer.” |
-| 17 | “Resume your subscription to continue.” |
-| 22 | “This merchant is temporarily unavailable.” |
-| 24 | “Destination already has an active subscription.” |
-| 25 | “Daily spending limit reached. Try a smaller amount or wait.” |
-| 27 | “Pick a pause end time in the future.” |
-| 2, 3, 15, 19 | Inline field validation messages |
+| Codes        | Guidance                                                      |
+| ------------ | ------------------------------------------------------------- |
+| 8            | “Increase your token allowance and try again.”                |
+| 9            | “This subscription lapsed. Please subscribe again.”           |
+| 11           | “You cannot refer yourself.”                                  |
+| 14           | “Label must be 64 bytes or fewer.”                            |
+| 17           | “Resume your subscription to continue.”                       |
+| 22           | “This merchant is temporarily unavailable.”                   |
+| 24           | “Destination already has an active subscription.”             |
+| 25           | “Daily spending limit reached. Try a smaller amount or wait.” |
+| 27           | “Pick a pause end time in the future.”                        |
+| 2, 3, 15, 19 | Inline field validation messages                              |
 
 ### Handle silently or as soft status (no scary toast)
 
-| Codes | Guidance |
-| --- | --- |
-| 6 | Expected when polling early — show “Next charge at …” |
-| 4, 5 | Reflect empty/cancelled state in UI |
-| Keeper-only Skipped equivalents | Do not surface as errors |
+| Codes                           | Guidance                                              |
+| ------------------------------- | ----------------------------------------------------- |
+| 6                               | Expected when polling early — show “Next charge at …” |
+| 4, 5                            | Reflect empty/cancelled state in UI                   |
+| Keeper-only Skipped equivalents | Do not surface as errors                              |
 
 ### Escalate / maintenance banner (not “you did something wrong”)
 
-| Codes | Guidance |
-| --- | --- |
-| 7, 18, 30 | “Service temporarily unavailable.” |
-| 10 | “Merchant pending approval.” |
-| 28 | “Protocol capacity reached; try later.” |
-| 20, 29 | Operator/config bugs — log to telemetry, don’t blame user |
+| Codes     | Guidance                                                  |
+| --------- | --------------------------------------------------------- |
+| 7, 18, 30 | “Service temporarily unavailable.”                        |
+| 10        | “Merchant pending approval.”                              |
+| 28        | “Protocol capacity reached; try later.”                   |
+| 20, 29    | Operator/config bugs — log to telemetry, don’t blame user |
 
 Always map numeric Soroban contract errors to this document before inventing new copy.
 
diff --git a/docs/EVENT-DRIVEN-GUIDE.md b/docs/EVENT-DRIVEN-GUIDE.md
index a431da70..083ce406 100644
--- a/docs/EVENT-DRIVEN-GUIDE.md
+++ b/docs/EVENT-DRIVEN-GUIDE.md
@@ -1,6 +1,6 @@
 # Event-Driven Integration Cookbook
 
-[`docs/EVENTS.md`](EVENTS.md) is a reference: it lists every event the FlowPay contract emits and the shape of its payload. This guide is the companion **cookbook** — it shows you how to actually *build* something on top of those events: a keeper, an analytics pipeline, a notification service, or a reconciliation job.
+[`docs/EVENTS.md`](EVENTS.md) is a reference: it lists every event the FlowPay contract emits and the shape of its payload. This guide is the companion **cookbook** — it shows you how to actually _build_ something on top of those events: a keeper, an analytics pipeline, a notification service, or a reconciliation job.
 
 If you are looking for "what event fires when `X` happens", go to [EVENTS.md](EVENTS.md). If you are looking for "how do I reliably consume these events without missing or double-processing anything", you're in the right place. Merchants wiring `subscribed` / `charged` / `cancelled` / `pay_per_use` into a billing dashboard should also read the [Merchant Integration Cookbook](MERCHANT-INTEGRATION.md#4-handling-events).
 
@@ -80,7 +80,7 @@ A few properties matter for anyone building an integration:
 - **Events are per-ledger, per-transaction.** A single `batch_charge()` call can emit multiple `charged` events (one per user actually charged) inside one transaction, all attached to the same `ledger` and `txHash`.
 - **Events are not stored forever.** Soroban RPC only retains events for a limited retention window (this varies by RPC provider, but assume something on the order of a week on public RPC infrastructure). If you need history older than that, you must have already captured and persisted it — there is no "replay from genesis" via `getEvents`.
 
-This last point is the reason event-driven integrations need a *cursor* (see below) instead of re-querying "all events" on every run.
+This last point is the reason event-driven integrations need a _cursor_ (see below) instead of re-querying "all events" on every run.
 
 ---
 
@@ -129,7 +129,7 @@ do {
 
 [`scripts/replay-events.ts`](../scripts/replay-events.ts) implements exactly this pattern for backfilling a historical ledger range in batches (see `fetchBatch()`), which is the reference implementation to read alongside this section.
 
-**The rule that matters:** always persist the *last processed ledger* (or the last `pagingToken`) as your cursor. On every poll, resume from there — never from a hardcoded `startLedger`, or you will reprocess (and potentially double-react to) the same events forever.
+**The rule that matters:** always persist the _last processed ledger_ (or the last `pagingToken`) as your cursor. On every poll, resume from there — never from a hardcoded `startLedger`, or you will reprocess (and potentially double-react to) the same events forever.
 
 ### Filtering by topic
 
@@ -151,15 +151,15 @@ const response = await server.getEvents({
 });
 ```
 
-For most integrations, fetch *all* contract events and branch in application code — topic filters are an optimization once volume grows.
+For most integrations, fetch _all_ contract events and branch in application code — topic filters are an optimization once volume grows.
 
 ### Recommended polling interval
 
-| Consumer class | Recommended interval | Why |
-|---|---|---|
-| Real-time dashboards / notifications | **3–5 seconds** | Matches Soroban ~5 s ledger close; faster wastes RPC quota. [`watch-events.ts`](../scripts/watch-events.ts) defaults to `POLL_INTERVAL_MS = 3000`. |
-| Keepers reacting to events | **30–60 seconds** | Billing cycles are not sub-minute (see [`docs/KEEPER.md`](KEEPER.md)). |
-| Analytics / reconciliation jobs | **minutes to hours** | Usually process a completed ledger range, not the chain tip. |
+| Consumer class                       | Recommended interval | Why                                                                                                                                                |
+| ------------------------------------ | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Real-time dashboards / notifications | **3–5 seconds**      | Matches Soroban ~5 s ledger close; faster wastes RPC quota. [`watch-events.ts`](../scripts/watch-events.ts) defaults to `POLL_INTERVAL_MS = 3000`. |
+| Keepers reacting to events           | **30–60 seconds**    | Billing cycles are not sub-minute (see [`docs/KEEPER.md`](KEEPER.md)).                                                                             |
+| Analytics / reconciliation jobs      | **minutes to hours** | Usually process a completed ledger range, not the chain tip.                                                                                       |
 
 Polling faster than the ledger close time wastes RPC quota without getting you fresher data; polling much slower than your reaction SLA means your keeper/notifier lags behind real activity.
 
@@ -176,7 +176,7 @@ Event consumers must be idempotent. There are several concrete reasons the same
 3. **RPC node reorg/catch-up quirks.** Public RPC providers occasionally re-serve a small overlap window around their own indexing checkpoints.
 4. **Manual replay.** Running [`replay-events.ts`](../scripts/replay-events.ts) to backfill a range you've already processed (e.g., after a bug fix) will legitimately re-emit events you already have.
 
-None of these mean the chain emitted the event twice — the contract only publishes each event once, in the one transaction that triggered it. It's the *consumer side* that can observe the same event more than once.
+None of these mean the chain emitted the event twice — the contract only publishes each event once, in the one transaction that triggered it. It's the _consumer side_ that can observe the same event more than once.
 
 ### Deduplication key: `tx_hash` + `event_name` + `ledger`
 
@@ -221,7 +221,7 @@ async function upsertEvent(event: ParsedEvent): Promise<void> {
     `INSERT INTO contract_events (ledger, tx_hash, event_name, user_address, payload)
      VALUES ($1, $2, $3, $4, $5)
      ON CONFLICT (ledger, tx_hash, event_name, user_address) DO NOTHING`,
-    [event.ledger, event.txHash, event.type, event.user, event.data]
+    [event.ledger, event.txHash, event.type, event.user, event.data],
   );
 }
 ```
@@ -234,14 +234,15 @@ Replaying the same ledger range twice then produces the same final state — no
 
 **Within a single transaction**, events are ordered exactly as the contract published them — Soroban preserves publish order within one contract invocation. For FlowPay, this means if `batch_charge()` charges users A, B, C in that order, the returned events (and the `ChargeResult` vector) preserve that order.
 
-**Within a single ledger**, transactions execute in the order the network applies them, and `getEvents` returns events in ledger-then-transaction-then-publish order. So events *within* one `getEvents` response for a given ledger are ordered.
+**Within a single ledger**, transactions execute in the order the network applies them, and `getEvents` returns events in ledger-then-transaction-then-publish order. So events _within_ one `getEvents` response for a given ledger are ordered.
 
-**Across ledgers fetched via polling, ordering is only as good as your poll loop.** If you fetch ledger range `[100, 105]` in one call, you get events in ledger order. But if two separate poll ticks fetch overlapping or out-of-sequence ranges (e.g., due to a bug in cursor handling, or fetching from two different RPC nodes with different indexing lag), you can *observe* events out of ledger order at the consumer even though the chain itself has a strict order.
+**Across ledgers fetched via polling, ordering is only as good as your poll loop.** If you fetch ledger range `[100, 105]` in one call, you get events in ledger order. But if two separate poll ticks fetch overlapping or out-of-sequence ranges (e.g., due to a bug in cursor handling, or fetching from two different RPC nodes with different indexing lag), you can _observe_ events out of ledger order at the consumer even though the chain itself has a strict order.
 
 **Practical guidance:**
+
 - If your reaction genuinely depends on order (e.g., a reconciliation job replaying `subscribed` → `charged` → `cancelled` to reconstruct a subscription's lifecycle), sort the batch you fetch by `(ledger, event index within ledger)` before processing, rather than assuming arrival order from RPC is authoritative — [`watch-events.ts`](../scripts/watch-events.ts) does this defensively (`newEvents.sort((a, b) => a.timestamp - b.timestamp)`) even though same-ledger events are already ordered.
 - Never assume "the event I received most recently is the newest state." Always key final state off the event's `ledger` (and transaction position within it if you need sub-ledger precision), not off wall-clock receipt time.
-- Do not parallelize processing of events for the *same user* — process them sequentially in ledger order, or you can apply a `charged` event before the `subscribed` event that created the subscription it belongs to.
+- Do not parallelize processing of events for the _same user_ — process them sequentially in ledger order, or you can apply a `charged` event before the `subscribed` event that created the subscription it belongs to.
 
 ---
 
@@ -251,7 +252,7 @@ Below are four illustrative patterns for reacting to FlowPay events. These are *
 
 ### 1. Keeper pattern
 
-A keeper doesn't strictly need to *consume* events to do its job (it drives `batch_charge()` proactively based on subscriber state, see [`docs/KEEPER.md`](KEEPER.md)) — but keepers commonly watch `charged` / `GracePeriodElapsed`-adjacent state to decide retry cadence and to avoid re-attempting users who were already charged this cycle by a concurrent keeper run.
+A keeper doesn't strictly need to _consume_ events to do its job (it drives `batch_charge()` proactively based on subscriber state, see [`docs/KEEPER.md`](KEEPER.md)) — but keepers commonly watch `charged` / `GracePeriodElapsed`-adjacent state to decide retry cadence and to avoid re-attempting users who were already charged this cycle by a concurrent keeper run.
 
 ```ts
 async function reactToChargeEvents(events: ParsedEvent[]) {
@@ -302,13 +303,15 @@ async function notifyUser(event: ParsedEvent) {
   const inserted = await db.query(
     `INSERT INTO notification_log (dedup_key) VALUES ($1)
      ON CONFLICT DO NOTHING RETURNING dedup_key`,
-    [dedupKey(event)]
+    [dedupKey(event)],
   );
   if (inserted.rowCount === 0) return; // already notified for this event
 
   switch (event.type) {
     case "charged":
-      await sendEmail(event.user, "payment-successful", { amount: event.amount });
+      await sendEmail(event.user, "payment-successful", {
+        amount: event.amount,
+      });
       break;
     case "cancelled":
       await sendEmail(event.user, "subscription-cancelled", {});
@@ -332,7 +335,9 @@ async function reconcile(fromLedger: number, toLedger: number) {
   for (const chainEvent of chainCharges) {
     const stored = await db.findCharge(dedupKey(chainEvent));
     if (!stored) {
-      console.warn(`Reconciliation gap: missing charge ${dedupKey(chainEvent)}`);
+      console.warn(
+        `Reconciliation gap: missing charge ${dedupKey(chainEvent)}`,
+      );
       await upsertEvent(chainEvent); // backfill
     }
   }
@@ -373,38 +378,38 @@ Combine this with the [reconciliation pattern](#4-reconciliation-pattern) run on
 
 ### Reliability pattern matrix
 
-| Failure mode | Symptom | Mitigation |
-|---|---|---|
-| RPC endpoint down | `getEvents` throws / times out | Retry with backoff; fall back to a secondary RPC URL; don't advance cursor |
-| Consumer crash mid-batch | Some events in a batch processed, some not | Idempotent upsert keyed on `ledger:txHash:eventName:user`; only persist cursor after full batch commit |
-| Cursor stuck / stale | Consumer alive but chain tip keeps moving away | Gap detection (`latestLedger - lastProcessedLedger`) with alerting threshold |
-| RPC event retention expiry | Old ledger range no longer queryable via `getEvents` | Never let the cursor fall behind the RPC's retention window; page proactively, don't wait to backfill |
-| Duplicate delivery | Same event observed twice across polls/replay | Composite dedup key + upsert semantics (never plain insert) |
-| Out-of-order arrival across polls | Later state applied before earlier state | Sort by `(ledger, position-in-ledger)` before applying; never trust receipt order |
+| Failure mode                      | Symptom                                              | Mitigation                                                                                             |
+| --------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| RPC endpoint down                 | `getEvents` throws / times out                       | Retry with backoff; fall back to a secondary RPC URL; don't advance cursor                             |
+| Consumer crash mid-batch          | Some events in a batch processed, some not           | Idempotent upsert keyed on `ledger:txHash:eventName:user`; only persist cursor after full batch commit |
+| Cursor stuck / stale              | Consumer alive but chain tip keeps moving away       | Gap detection (`latestLedger - lastProcessedLedger`) with alerting threshold                           |
+| RPC event retention expiry        | Old ledger range no longer queryable via `getEvents` | Never let the cursor fall behind the RPC's retention window; page proactively, don't wait to backfill  |
+| Duplicate delivery                | Same event observed twice across polls/replay        | Composite dedup key + upsert semantics (never plain insert)                                            |
+| Out-of-order arrival across polls | Later state applied before earlier state             | Sort by `(ledger, position-in-ledger)` before applying; never trust receipt order                      |
 
 ---
 
 ## Event → Consumer Reference Table
 
-| Event | Typical consumer | Why |
-|---|---|---|
-| `subscribed` | Analytics, Notifications | New subscriber count; welcome/confirmation message |
-| `charged` | Keeper, Analytics, Notifications, Reconciliation | Core revenue signal; payment receipt; reconciliation anchor |
-| `pay_per_use` | Analytics, Notifications | One-off usage billing signal |
-| `paused` / `resumed` | Analytics | Active-subscriber accounting |
-| `cancelled` | Analytics, Notifications | Churn tracking; cancellation confirmation |
-| `referred` | Analytics | Referral attribution |
-| `sub_amount_updated` / `sub_interval_updated` | Analytics, Notifications | Plan-change confirmation; MRR recalculation |
-| `merchant_added` / `merchant_removed` | Analytics, Notifications | Merchant directory sync |
-| `merchant_frozen` / `merchant_unfrozen` | Notifications, Reconciliation | Urgent operational alert to the affected merchant |
-| `merchant_withdrawal` | Analytics, Reconciliation | Merchant payout ledger |
-| `merch_hist_cleared` | Analytics, Reconciliation | Merchant revenue-history wipe — reset aggregates |
-| `daily_limit_set` / `daily_limit_removed` | Analytics | User risk/spend-limit configuration tracking |
-| `contract_paused` / `contract_unpaused` | Notifications, Reconciliation | Protocol-wide incident signal — page operators |
-| `admin_transferred` / `upgraded` | Reconciliation | Security-sensitive audit trail |
-| `min_interval` | Analytics, Reconciliation | Protocol policy change — billing eligibility floor |
-| `fee_proposed` / `fee_committed` | Analytics, Reconciliation | Fee-schedule audit trail |
-| `grace_period_proposed` / `grace_period_committed` | Analytics | Billing-policy audit trail |
+| Event                                              | Typical consumer                                 | Why                                                         |
+| -------------------------------------------------- | ------------------------------------------------ | ----------------------------------------------------------- |
+| `subscribed`                                       | Analytics, Notifications                         | New subscriber count; welcome/confirmation message          |
+| `charged`                                          | Keeper, Analytics, Notifications, Reconciliation | Core revenue signal; payment receipt; reconciliation anchor |
+| `pay_per_use`                                      | Analytics, Notifications                         | One-off usage billing signal                                |
+| `paused` / `resumed`                               | Analytics                                        | Active-subscriber accounting                                |
+| `cancelled`                                        | Analytics, Notifications                         | Churn tracking; cancellation confirmation                   |
+| `referred`                                         | Analytics                                        | Referral attribution                                        |
+| `sub_amount_updated` / `sub_interval_updated`      | Analytics, Notifications                         | Plan-change confirmation; MRR recalculation                 |
+| `merchant_added` / `merchant_removed`              | Analytics, Notifications                         | Merchant directory sync                                     |
+| `merchant_frozen` / `merchant_unfrozen`            | Notifications, Reconciliation                    | Urgent operational alert to the affected merchant           |
+| `merchant_withdrawal`                              | Analytics, Reconciliation                        | Merchant payout ledger                                      |
+| `merch_hist_cleared`                               | Analytics, Reconciliation                        | Merchant revenue-history wipe — reset aggregates            |
+| `daily_limit_set` / `daily_limit_removed`          | Analytics                                        | User risk/spend-limit configuration tracking                |
+| `contract_paused` / `contract_unpaused`            | Notifications, Reconciliation                    | Protocol-wide incident signal — page operators              |
+| `admin_transferred` / `upgraded`                   | Reconciliation                                   | Security-sensitive audit trail                              |
+| `min_interval`                                     | Analytics, Reconciliation                        | Protocol policy change — billing eligibility floor          |
+| `fee_proposed` / `fee_committed`                   | Analytics, Reconciliation                        | Fee-schedule audit trail                                    |
+| `grace_period_proposed` / `grace_period_committed` | Analytics                                        | Billing-policy audit trail                                  |
 
 See [`docs/EVENTS.md`](EVENTS.md) for the full payload schema of each event.
 
@@ -412,10 +417,10 @@ See [`docs/EVENTS.md`](EVENTS.md) for the full payload schema of each event.
 
 ## Reference Implementations
 
-| Script | Demonstrates |
-|---|---|
-| [`scripts/watch-events.ts`](../scripts/watch-events.ts) | Live polling loop, in-memory dedup (`ledger:txHash:eventType:user`), color-coded real-time output, 3 s poll interval |
-| [`scripts/replay-events.ts`](../scripts/replay-events.ts) | Cursor-based pagination over a historical ledger range, batch processing, upsert integration point |
+| Script                                                    | Demonstrates                                                                                                         |
+| --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| [`scripts/watch-events.ts`](../scripts/watch-events.ts)   | Live polling loop, in-memory dedup (`ledger:txHash:eventType:user`), color-coded real-time output, 3 s poll interval |
+| [`scripts/replay-events.ts`](../scripts/replay-events.ts) | Cursor-based pagination over a historical ledger range, batch processing, upsert integration point                   |
 
 Both scripts are intentionally minimal reference implementations — the patterns above show how to extend them into keeper, analytics, notification, or reconciliation services.
 
diff --git a/docs/FRONTEND-COMPONENTS.md b/docs/FRONTEND-COMPONENTS.md
index 62481bfe..a57182bc 100644
--- a/docs/FRONTEND-COMPONENTS.md
+++ b/docs/FRONTEND-COMPONENTS.md
@@ -23,11 +23,11 @@ Props and signatures below are taken from TypeScript sources under `frontend/src
 
 Debounced Stellar address field with Ed25519 validation and valid/error CSS states.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `label` | `string` | yes | Form label |
-| `value` | `string` | yes | Current address |
-| `onChange` | `(value: string) => void` | yes | Fires on each keystroke |
+| Prop       | Type                      | Required | Description             |
+| ---------- | ------------------------- | -------- | ----------------------- |
+| `label`    | `string`                  | yes      | Form label              |
+| `value`    | `string`                  | yes      | Current address         |
+| `onChange` | `(value: string) => void` | yes      | Fires on each keystroke |
 
 **State:** `error`  
 **Hooks:** `useDebounce(value, 300)`  
@@ -45,11 +45,11 @@ Debounced Stellar address field with Ed25519 validation and valid/error CSS stat
 
 Shows SAC allowance vs subscription amount with Healthy / Warning / Critical badges.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `userKey` | `string` | yes | Subscriber public key |
-| `subscriptionAmount` | `bigint` | yes | Period amount (stroops) |
-| `refreshTrigger` | `number` | yes | Bump to re-fetch |
+| Prop                 | Type     | Required | Description             |
+| -------------------- | -------- | -------- | ----------------------- |
+| `userKey`            | `string` | yes      | Subscriber public key   |
+| `subscriptionAmount` | `bigint` | yes      | Period amount (stroops) |
+| `refreshTrigger`     | `number` | yes      | Bump to re-fetch        |
 
 **State:** `allowance`, `loading`  
 **Edge cases:** Fetch failure → “Unavailable”; Critical if `allowance < amount`; Warning if `< 3× amount`.
@@ -62,9 +62,9 @@ Shows SAC allowance vs subscription amount with Healthy / Warning / Critical bad
 
 Compact XLM balance for the wallet bar; skeleton while first load.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `address` | `string` | yes | Account public key |
+| Prop      | Type     | Required | Description        |
+| --------- | -------- | -------- | ------------------ |
+| `address` | `string` | yes      | Account public key |
 
 **Hooks:** `useStellarBalance(address)`  
 **Edge cases:** Skeleton only when `loading && !stale`.
@@ -77,11 +77,11 @@ Compact XLM balance for the wallet bar; skeleton while first load.
 
 Accessible confirm/cancel dialog with focus trap.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `message` | `string` | yes | Confirmation copy |
-| `onConfirm` | `() => void` | yes | Confirm |
-| `onCancel` | `() => void` | yes | Cancel / dismiss |
+| Prop        | Type         | Required | Description       |
+| ----------- | ------------ | -------- | ----------------- |
+| `message`   | `string`     | yes      | Confirmation copy |
+| `onConfirm` | `() => void` | yes      | Confirm           |
+| `onCancel`  | `() => void` | yes      | Cancel / dismiss  |
 
 **Hooks:** `useFocusTrap`  
 **Edge cases:** Overlay click cancels; Esc via focus trap.
@@ -94,11 +94,11 @@ Accessible confirm/cancel dialog with focus trap.
 
 Freighter connect CTA, or install link when the extension is missing.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `onConnect` | `() => void` | yes | Connect handler |
-| `error` | `string \| null` | yes | Error to display |
-| `loading` | `boolean` | no (default `false`) | Disables button; shows spinner |
+| Prop        | Type             | Required             | Description                    |
+| ----------- | ---------------- | -------------------- | ------------------------------ |
+| `onConnect` | `() => void`     | yes                  | Connect handler                |
+| `error`     | `string \| null` | yes                  | Error to display               |
+| `loading`   | `boolean`        | no (default `false`) | Disables button; shows spinner |
 
 **Hooks:** `useFreighterAvailable`
 
@@ -110,10 +110,10 @@ Freighter connect CTA, or install link when the extension is missing.
 
 Copies text with short-lived success/error icon feedback.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `text` | `string` | yes | Clipboard payload |
-| `ariaLabel` | `string` | no (default `"Copy address"`) | Accessible name |
+| Prop        | Type     | Required                      | Description       |
+| ----------- | -------- | ----------------------------- | ----------------- |
+| `text`      | `string` | yes                           | Clipboard payload |
+| `ariaLabel` | `string` | no (default `"Copy address"`) | Accessible name   |
 
 **Hooks:** `useClipboard`
 
@@ -125,11 +125,11 @@ Copies text with short-lived success/error icon feedback.
 
 Displays daily PPU limit, today’s spend, and remaining; opens the limit modal via `onOpen`.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `userKey` | `string` | yes | Subscriber key |
-| `refreshTrigger` | `number` | yes | Re-fetch trigger |
-| `onOpen` | `() => void` | yes | “Set limit” click |
+| Prop             | Type         | Required | Description       |
+| ---------------- | ------------ | -------- | ----------------- |
+| `userKey`        | `string`     | yes      | Subscriber key    |
+| `refreshTrigger` | `number`     | yes      | Re-fetch trigger  |
+| `onOpen`         | `() => void` | yes      | “Set limit” click |
 
 **State:** `dailyLimit`, `dailySpent`, `loading`, `error`  
 **Edge cases:** Remaining `"Exceeded"` if negative; null limit → “Not set”.
@@ -142,13 +142,13 @@ Displays daily PPU limit, today’s spend, and remaining; opens the limit modal
 
 Modal to set the daily PPU spending cap (`buildSetDailyLimitTx` + wallet sign).
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `userKey` | `string` | yes | Subscriber key |
-| `onSign` | `(xdr: string) => Promise<string>` | yes | Sign & submit |
-| `onClose` | `() => void` | yes | Dismiss |
-| `onSuccess` | `() => void` | yes | After success |
-| `announce` | `(message: string) => void` | yes | A11y live region |
+| Prop        | Type                               | Required | Description      |
+| ----------- | ---------------------------------- | -------- | ---------------- |
+| `userKey`   | `string`                           | yes      | Subscriber key   |
+| `onSign`    | `(xdr: string) => Promise<string>` | yes      | Sign & submit    |
+| `onClose`   | `() => void`                       | yes      | Dismiss          |
+| `onSuccess` | `() => void`                       | yes      | After success    |
+| `announce`  | `(message: string) => void`        | yes      | A11y live region |
 
 **State:** `currentLimit`, `amount`, `submitting`, `error`  
 **Hooks:** `useToast`, `useFocusTrap`
@@ -161,14 +161,14 @@ Modal to set the daily PPU spending cap (`buildSetDailyLimitTx` + wallet sign).
 
 Subscriber hub: subscription card, allowance/daily limit, charge history, pay-per-use, RPC warnings, and related modals.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `userKey` | `string` | yes | Connected subscriber |
-| `onSign` | `(xdr: string) => Promise<string>` | yes | Wallet sign helper |
-| `refreshTrigger` | `number` | yes | External re-fetch bump |
-| `announce` | `(message: string) => void` | yes | Screen-reader announce |
-| `onCancelled` | `() => void` | no | After cancel |
-| `onPayPerUse` | `(amount: bigint) => void` | no | After PPU success |
+| Prop             | Type                               | Required | Description            |
+| ---------------- | ---------------------------------- | -------- | ---------------------- |
+| `userKey`        | `string`                           | yes      | Connected subscriber   |
+| `onSign`         | `(xdr: string) => Promise<string>` | yes      | Wallet sign helper     |
+| `refreshTrigger` | `number`                           | yes      | External re-fetch bump |
+| `announce`       | `(message: string) => void`        | yes      | Screen-reader announce |
+| `onCancelled`    | `() => void`                       | no       | After cancel           |
+| `onPayPerUse`    | `(amount: bigint) => void`         | no       | After PPU success      |
 
 **State:** `showDailyLimit`, `showIncreaseAllowance`, `allowanceRefresh`, `dailyLimitRefresh`, `ppuInputRef`  
 **Hooks:** `useSubscriptionSync`, `usePolling` (30s if active), `useToast`, `useRpcHealth`, `useTransaction`, `useRegisterShortcuts`  
@@ -186,10 +186,10 @@ Subscriber hub: subscription card, allowance/daily limit, charge history, pay-pe
 
 Catches render errors in a subtree; optional custom fallback.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `children` | `ReactNode` | yes | Wrapped tree |
-| `fallback` | `ReactNode` | no | Custom error UI |
+| Prop       | Type        | Required | Description     |
+| ---------- | ----------- | -------- | --------------- |
+| `children` | `ReactNode` | yes      | Wrapped tree    |
+| `fallback` | `ReactNode` | no       | Custom error UI |
 
 **State:** `error` (+ `reset()`)  
 **Edge cases:** Logs `componentStack` in development; default UI reloads the page.
@@ -202,14 +202,14 @@ Catches render errors in a subtree; optional custom fallback.
 
 Approves SAC allowance for the FlowPay contract (recommended ≈ 6 billing cycles).
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `userKey` | `string` | yes | Owner key |
-| `subscriptionAmount` | `bigint` | yes | Period amount |
-| `onSign` | `(xdr: string) => Promise<string>` | yes | Sign helper |
-| `onClose` | `() => void` | yes | Dismiss |
-| `onSuccess` | `() => void` | yes | After approve |
-| `announce` | `(message: string) => void` | yes | A11y announce |
+| Prop                 | Type                               | Required | Description   |
+| -------------------- | ---------------------------------- | -------- | ------------- |
+| `userKey`            | `string`                           | yes      | Owner key     |
+| `subscriptionAmount` | `bigint`                           | yes      | Period amount |
+| `onSign`             | `(xdr: string) => Promise<string>` | yes      | Sign helper   |
+| `onClose`            | `() => void`                       | yes      | Dismiss       |
+| `onSuccess`          | `() => void`                       | yes      | After approve |
+| `announce`           | `(message: string) => void`        | yes      | A11y announce |
 
 **Edge cases:** Errors if `VITE_TOKEN_CONTRACT_ID` / `VITE_CONTRACT_ID` unset; failed fetch treats allowance as `0n`.
 
@@ -221,10 +221,10 @@ Approves SAC allowance for the FlowPay contract (recommended ≈ 6 billing cycle
 
 Billing interval select from `BILLING_INTERVALS`, plus custom days → seconds.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `value` | `number` | yes | Interval in seconds |
-| `onChange` | `(seconds: number) => void` | yes | New interval |
+| Prop       | Type                        | Required | Description         |
+| ---------- | --------------------------- | -------- | ------------------- |
+| `value`    | `number`                    | yes      | Interval in seconds |
+| `onChange` | `(seconds: number) => void` | yes      | New interval        |
 
 **State:** `isCustom`, `customDays`  
 **Edge cases:** Non-preset `value` starts in custom mode; custom only emits when `seconds > 0`.
@@ -237,11 +237,11 @@ Billing interval select from `BILLING_INTERVALS`, plus custom days → seconds.
 
 Merchant view: revenue, 7-day sparkline, virtualized subscribers, batch charge of due subs.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `merchantKey` | `string` | yes | Merchant public key |
-| `onSign` | `(xdr: string) => Promise<string>` | yes | Sign helper |
-| `refreshTrigger` | `number` | yes | External refresh |
+| Prop             | Type                               | Required | Description         |
+| ---------------- | ---------------------------------- | -------- | ------------------- |
+| `merchantKey`    | `string`                           | yes      | Merchant public key |
+| `onSign`         | `(xdr: string) => Promise<string>` | yes      | Sign helper         |
+| `refreshTrigger` | `number`                           | yes      | External refresh    |
 
 **State:** `subscribers`, `revenue`, `revenueHistory`, `loading`, `error`, `outcomes`  
 **Hooks:** `useTransaction`, `useVirtualList`, `usePolling` (30s)  
@@ -267,9 +267,9 @@ Testnet vs Mainnet badge from `NETWORK_PASSPHRASE` (“Public Global” → Main
 
 Live countdown to next charge; “Overdue” when past.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `nextChargeTimestamp` | `number` | yes | Unix seconds |
+| Prop                  | Type     | Required | Description  |
+| --------------------- | -------- | -------- | ------------ |
+| `nextChargeTimestamp` | `number` | yes      | Unix seconds |
 
 **State:** `countdown` (`days`, `hours`, `minutes`, `overdue`)  
 **Edge cases:** Updates every 60s; minute precision only.
@@ -282,10 +282,10 @@ Live countdown to next charge; “Overdue” when past.
 
 PPU amount input with local + contract max validation.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `onPay` | `(amount: bigint) => Promise<void>` | yes | Submit handler |
-| `loading` | `boolean` | yes | Disables controls |
+| Prop      | Type                                | Required | Description       |
+| --------- | ----------------------------------- | -------- | ----------------- |
+| `onPay`   | `(amount: bigint) => Promise<void>` | yes      | Submit handler    |
+| `loading` | `boolean`                           | yes      | Disables controls |
 
 **State:** `amount`, `error`, `lastValue`, `convertedStroops`  
 **Hooks:** `useDebounce(300)`  
@@ -299,9 +299,9 @@ PPU amount input with local + contract max validation.
 
 Accessible SVG sparkline for 7-day revenue `bigint[]` with a hidden data table.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `history` | `bigint[]` | yes | Daily revenue points |
+| Prop      | Type       | Required | Description          |
+| --------- | ---------- | -------- | -------------------- |
+| `history` | `bigint[]` | yes      | Daily revenue points |
 
 **Edge cases:** Empty → “No data”; `maxVal === 0` uses `1n` to avoid division by zero.
 
@@ -313,10 +313,10 @@ Accessible SVG sparkline for 7-day revenue `bigint[]` with a hidden data table.
 
 Modal listing registered shortcuts (+ Esc); focus-trapped.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `shortcuts` | `KeyboardShortcut[]` | yes | `{ key, description, action }` |
-| `onClose` | `() => void` | yes | Dismiss |
+| Prop        | Type                 | Required | Description                    |
+| ----------- | -------------------- | -------- | ------------------------------ |
+| `shortcuts` | `KeyboardShortcut[]` | yes      | `{ key, description, action }` |
+| `onClose`   | `() => void`         | yes      | Dismiss                        |
 
 ---
 
@@ -334,10 +334,10 @@ Loading placeholder mirroring `SubscriptionCard` (`aria-busy`). Default export i
 
 CSS spinner.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `size` | `"sm" \| "md" \| "lg"` | no (default `"md"`) | Size class |
-| `className` | `string` | no | Extra classes |
+| Prop        | Type                   | Required            | Description   |
+| ----------- | ---------------------- | ------------------- | ------------- |
+| `size`      | `"sm" \| "md" \| "lg"` | no (default `"md"`) | Size class    |
+| `className` | `string`               | no                  | Extra classes |
 
 ---
 
@@ -347,11 +347,11 @@ CSS spinner.
 
 XLM amount input debounced to stroops via `onChange`.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `label` | `string` | yes | Label |
-| `onChange` | `(stroops: bigint \| null) => void` | yes | Parsed stroops or null |
-| `disabled` | `boolean` | no | Disable input |
+| Prop       | Type                                | Required | Description            |
+| ---------- | ----------------------------------- | -------- | ---------------------- |
+| `label`    | `string`                            | yes      | Label                  |
+| `onChange` | `(stroops: bigint \| null) => void` | yes      | Parsed stroops or null |
+| `disabled` | `boolean`                           | no       | Disable input          |
 
 **Hooks:** `useDebounce(300)`  
 **Edge cases:** Same min/max/decimal rules as PPU; blur validates immediately.
@@ -364,13 +364,13 @@ XLM amount input debounced to stroops via `onChange`.
 
 New subscription form: merchant, amount, interval; builds and signs subscribe tx.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `userKey` | `string` | yes | Subscriber |
-| `onSign` | `(xdr: string) => Promise<string>` | yes | Sign helper |
-| `onSuccess` | `() => void` | yes | After subscribe |
-| `announce` | `(message: string) => void` | yes | A11y |
-| `onSubscribed` | `() => void` | no | Extra success callback |
+| Prop           | Type                               | Required | Description            |
+| -------------- | ---------------------------------- | -------- | ---------------------- |
+| `userKey`      | `string`                           | yes      | Subscriber             |
+| `onSign`       | `(xdr: string) => Promise<string>` | yes      | Sign helper            |
+| `onSuccess`    | `() => void`                       | yes      | After subscribe        |
+| `announce`     | `(message: string) => void`        | yes      | A11y                   |
+| `onSubscribed` | `() => void`                       | no       | Extra success callback |
 
 **State:** `merchant`, `amount`, `interval`  
 **Hooks:** `useFormValidation`, `useDebounce(merchant, 500)`, `useToast`, `useTransaction`  
@@ -386,20 +386,25 @@ Active subscription summary with pause/resume/cancel, countdown, trial badge, an
 
 Declared `SubscriptionCardProps` plus required `userKey` at the call site:
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `subscription` | `Subscription` | yes | On-chain subscription |
-| `userKey` | `string` | yes | Subscriber key (`SubscriptionCardProps & { userKey: string }`) |
-| `onSign` | `(xdr: string) => Promise<string>` | yes | Sign helper |
-| `onRefresh` | `() => void` | yes | Refresh after mutations |
-| `onCancelled` | `() => void` | no | After cancel |
+| Prop           | Type                               | Required | Description                                                    |
+| -------------- | ---------------------------------- | -------- | -------------------------------------------------------------- |
+| `subscription` | `Subscription`                     | yes      | On-chain subscription                                          |
+| `userKey`      | `string`                           | yes      | Subscriber key (`SubscriptionCardProps & { userKey: string }`) |
+| `onSign`       | `(xdr: string) => Promise<string>` | yes      | Sign helper                                                    |
+| `onRefresh`    | `() => void`                       | yes      | Refresh after mutations                                        |
+| `onCancelled`  | `() => void`                       | no       | After cancel                                                   |
 
 **State:** `showPauseConfirm`, `showCancelConfirm`, `cancelLoading`, `cancelStatus`  
 **Hooks:** `useSubscriptionSync`, `usePauseResume`, `useRegisterShortcuts`  
 **Edge cases:** Trial badge when `now < last_charged + trial_duration`; next charge `"—"` if inactive/paused; cancel uses optimistic `mutate`; shortcut `x` opens cancel.
 
 ```tsx
-<SubscriptionCard subscription={sub} userKey={pk} onSign={sign} onRefresh={refresh} />
+<SubscriptionCard
+  subscription={sub}
+  userKey={pk}
+  onSign={sign}
+  onRefresh={refresh}
+/>
 ```
 
 ---
@@ -410,9 +415,9 @@ Declared `SubscriptionCardProps` plus required `userKey` at the call site:
 
 Paginated charge history from `charged` events; CSV export; stale-while-revalidate UI.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `userKey` | `string` | yes | Filter address |
+| Prop      | Type     | Required | Description    |
+| --------- | -------- | -------- | -------------- |
+| `userKey` | `string` | yes      | Filter address |
 
 **Hooks:** `useContractEvents("charged", userKey)`  
 **Edge cases:** Parses nested `_value`; `PAGE_SIZE=20`; explorer links hardcode **testnet**.
@@ -425,9 +430,9 @@ Paginated charge history from `charged` events; CSV export; stale-while-revalida
 
 Contract health: RPC, pause, token config, active subscription count.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `callerKey` | `string` | yes | Caller for `getContractHealth` |
+| Prop        | Type     | Required | Description                    |
+| ----------- | -------- | -------- | ------------------------------ |
+| `callerKey` | `string` | yes      | Caller for `getContractHealth` |
 
 **Edge cases:** Token not configured → yellow; pause → red; retry on error.
 
@@ -439,11 +444,11 @@ Contract health: RPC, pause, token config, active subscription count.
 
 Main nav among dashboard / subscribe / merchant / admin.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `tabs` | `readonly Tab[]` | yes | `"dashboard" \| "subscribe" \| "merchant" \| "admin"` |
-| `activeTab` | `Tab` | yes | Current tab |
-| `onTabChange` | `(tab: Tab) => void` | yes | Tab change |
+| Prop          | Type                 | Required | Description                                           |
+| ------------- | -------------------- | -------- | ----------------------------------------------------- |
+| `tabs`        | `readonly Tab[]`     | yes      | `"dashboard" \| "subscribe" \| "merchant" \| "admin"` |
+| `activeTab`   | `Tab`                | yes      | Current tab                                           |
+| `onTabChange` | `(tab: Tab) => void` | yes      | Tab change                                            |
 
 ---
 
@@ -453,10 +458,10 @@ Main nav among dashboard / subscribe / merchant / admin.
 
 Renders the toast queue; optional explorer link for `txHash`.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `toasts` | `Toast[]` | yes | From `useToast` |
-| `onRemove` | `(id: number) => void` | yes | Dismiss |
+| Prop       | Type                   | Required | Description     |
+| ---------- | ---------------------- | -------- | --------------- |
+| `toasts`   | `Toast[]`              | yes      | From `useToast` |
+| `onRemove` | `(id: number) => void` | yes      | Dismiss         |
 
 **Edge cases:** Returns `null` if empty.
 
@@ -468,10 +473,10 @@ Renders the toast queue; optional explorer link for `txHash`.
 
 Connected wallet strip: address, copy, balance, network, disconnect, tx queue depth.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `publicKey` | `string` | yes | Connected key |
-| `onDisconnect` | `() => void` | yes | Disconnect |
+| Prop           | Type         | Required | Description   |
+| -------------- | ------------ | -------- | ------------- |
+| `publicKey`    | `string`     | yes      | Connected key |
+| `onDisconnect` | `() => void` | yes      | Disconnect    |
 
 **Hooks:** `useTxQueue`  
 **Edge cases:** Queue badge only if `queueDepth > 0`.
@@ -484,10 +489,10 @@ Connected wallet strip: address, copy, balance, network, disconnect, tx queue de
 
 Admin tool to validate subscription integrity and submit repair transactions.
 
-| Prop | Type | Required | Description |
-| --- | --- | --- | --- |
-| `adminKey` | `string` | yes | Connected wallet (must be contract admin) |
-| `onSign` | `(xdr: string) => Promise<string>` | yes | Sign helper |
+| Prop       | Type                               | Required | Description                               |
+| ---------- | ---------------------------------- | -------- | ----------------------------------------- |
+| `adminKey` | `string`                           | yes      | Connected wallet (must be contract admin) |
+| `onSign`   | `(xdr: string) => Promise<string>` | yes      | Sign helper                               |
 
 **State:** `userAddress`, `validatedAddress`, `report`, `validationPhase`, `validationError`, `showRepairConfirm`, `repairResultCount`, `subscriptionRefresh`  
 **Hooks:** `useAdmin`, `useToast`, `useTransaction`, `useSubscription`  
@@ -497,35 +502,35 @@ Admin tool to validate subscription integrity and submit repair transactions.
 
 ## Hooks
 
-| Hook | Purpose | Signature (summary) | Edge cases |
-| --- | --- | --- | --- |
-| `useAccessibility` | ARIA live-region announcer | `() => { announcement, announce }` | Clears then re-sets via `rAF` so the same message re-announces |
-| `useKeyboardShortcuts` | Global key handlers | `(options?) => KeyboardShortcut[]` | Ignores events in inputs / contentEditable |
-| `useFocusTrap` | Trap Tab focus; Esc → `onEscape` | `(ref, active, onEscape?) => void` | No-op if inactive or no focusables |
-| `useErrorBoundary` | Manual error state for async handlers | `() => { error, captureError, reset }` | Does **not** catch render errors |
-| `useResponsive` | Breakpoints via `matchMedia` | `() => { isMobile, isTablet, isDesktop }` | Mobile ≤639, tablet 640–1023, desktop ≥1024 |
-| `useContractId` | Validate `VITE_CONTRACT_ID` | `() => { contractId, valid, error }` | Missing/invalid → empty id, `valid: false` |
-| `useRpcHealth` | Poll RPC with backoff / circuit breaker | `() => UseRpcHealthResult` | 3 failures open circuit; latency >2s → `degraded` |
-| `useSubscription` | Fetch one subscription | `(userKey, refreshTrigger?) => { subscription, loading, error, refresh }` | Circuit open → `"RPC unavailable"` |
-| `usePolling` | Interval callback with fresh ref | `({ callback, interval, enabled? }) => void` | Disabled clears interval; no immediate call on mount |
-| `useFormValidation` | Subscribe-form sync + async validation | `() => { errors, validate, isValid, validating, validateAsync }` | Aborts prior async with `AbortController` |
-| `useTheme` | Dark/light via localStorage | `() => { theme, toggle }` | Default `"dark"`; sets `data-theme` on `<html>` |
-| `useToast` | Toast queue (auto-dismiss 5s) | `() => { toasts, addToast, removeToast }` | Duplicate messages allowed; default variant `"info"` |
-| `useTransaction` | Queue + submit signed tx; poll confirmation | `() => { status, hash, error, submit }` | Circuit open rejects; 30s poll timeout |
-| `useWallet` | Freighter connect / persist / sign | `() => { publicKey, connect, signAndSubmit, disconnect, error, connecting, ready }` | Polls Freighter 3×300ms on restore |
-| `useVirtualList` | Windowed list (3-row overscan) | `<T>(items, itemHeight, containerHeight) => { visibleItems, totalHeight, offsetY, onScroll }` | Empty / non-positive heights → empty visible set |
-| `useAnalytics` | Opt-in event track + batch flush | `() => { isOptedIn, setOptIn, track }` | No-op if opted out; flush at 10 events / 5s / hidden |
-| `useNetworkCheck` | Compare Freighter vs app passphrase | `() => { networkMatch, walletNetwork }` | Optimistic `true` before check |
-| `usePauseResume` | Pause/resume txs | `(userKey, onSign, onRefresh) => { pause, resume, pauseTx, resumeTx }` | Calls `onRefresh` after success |
-| `useSubscriberCount` | Active count from subscribed−cancelled events | `() => { count, loading, stale }` | Caps pages (`MAX_PAGES=50`) |
-| `useSubscriptionSync` | Fetch + optimistic `mutate` with rollback | `(userKey, refreshTrigger?) => { subscription, loading, status, error, mutate, refresh }` | Failed cancel rolls optimistic `active: false` back |
-| `useStellarBalance` | Cached/deduped XLM balance | `(address, staleAfterMs?) => UseStellarBalanceResult` | Min fetch interval 5s; module cache |
-| `useAdmin` | Compare wallet to on-chain admin | `(publicKey \| null) => UseAdminResult` | Null key clears state |
-| `useLocalStorage` | `useState` synced to `localStorage` JSON | `<T>(key, initial) => [value, setValue]` | Parse errors → initial |
-| `useFreighterAvailable` | Detect `window.freighter` after mount | `() => { available, installUrl }` | Starts `false` until effect |
-| `useClipboard` | `navigator.clipboard.writeText` | `(timeout?) => { copied, error, copy }` | Failure sets boolean `error` |
-| `useContractEvents` | Fetch/paginate contract events | `(eventName, address?, maxEvents?) => { events, loading, error, refresh, loadMore, hasMore }` | Keeps last `maxEvents` (default 50) |
-| `useDebounce` | Debounce any value | `<T>(value, delay?) => T` | Clears timer on change/unmount |
+| Hook                    | Purpose                                       | Signature (summary)                                                                           | Edge cases                                                     |
+| ----------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
+| `useAccessibility`      | ARIA live-region announcer                    | `() => { announcement, announce }`                                                            | Clears then re-sets via `rAF` so the same message re-announces |
+| `useKeyboardShortcuts`  | Global key handlers                           | `(options?) => KeyboardShortcut[]`                                                            | Ignores events in inputs / contentEditable                     |
+| `useFocusTrap`          | Trap Tab focus; Esc → `onEscape`              | `(ref, active, onEscape?) => void`                                                            | No-op if inactive or no focusables                             |
+| `useErrorBoundary`      | Manual error state for async handlers         | `() => { error, captureError, reset }`                                                        | Does **not** catch render errors                               |
+| `useResponsive`         | Breakpoints via `matchMedia`                  | `() => { isMobile, isTablet, isDesktop }`                                                     | Mobile ≤639, tablet 640–1023, desktop ≥1024                    |
+| `useContractId`         | Validate `VITE_CONTRACT_ID`                   | `() => { contractId, valid, error }`                                                          | Missing/invalid → empty id, `valid: false`                     |
+| `useRpcHealth`          | Poll RPC with backoff / circuit breaker       | `() => UseRpcHealthResult`                                                                    | 3 failures open circuit; latency >2s → `degraded`              |
+| `useSubscription`       | Fetch one subscription                        | `(userKey, refreshTrigger?) => { subscription, loading, error, refresh }`                     | Circuit open → `"RPC unavailable"`                             |
+| `usePolling`            | Interval callback with fresh ref              | `({ callback, interval, enabled? }) => void`                                                  | Disabled clears interval; no immediate call on mount           |
+| `useFormValidation`     | Subscribe-form sync + async validation        | `() => { errors, validate, isValid, validating, validateAsync }`                              | Aborts prior async with `AbortController`                      |
+| `useTheme`              | Dark/light via localStorage                   | `() => { theme, toggle }`                                                                     | Default `"dark"`; sets `data-theme` on `<html>`                |
+| `useToast`              | Toast queue (auto-dismiss 5s)                 | `() => { toasts, addToast, removeToast }`                                                     | Duplicate messages allowed; default variant `"info"`           |
+| `useTransaction`        | Queue + submit signed tx; poll confirmation   | `() => { status, hash, error, submit }`                                                       | Circuit open rejects; 30s poll timeout                         |
+| `useWallet`             | Freighter connect / persist / sign            | `() => { publicKey, connect, signAndSubmit, disconnect, error, connecting, ready }`           | Polls Freighter 3×300ms on restore                             |
+| `useVirtualList`        | Windowed list (3-row overscan)                | `<T>(items, itemHeight, containerHeight) => { visibleItems, totalHeight, offsetY, onScroll }` | Empty / non-positive heights → empty visible set               |
+| `useAnalytics`          | Opt-in event track + batch flush              | `() => { isOptedIn, setOptIn, track }`                                                        | No-op if opted out; flush at 10 events / 5s / hidden           |
+| `useNetworkCheck`       | Compare Freighter vs app passphrase           | `() => { networkMatch, walletNetwork }`                                                       | Optimistic `true` before check                                 |
+| `usePauseResume`        | Pause/resume txs                              | `(userKey, onSign, onRefresh) => { pause, resume, pauseTx, resumeTx }`                        | Calls `onRefresh` after success                                |
+| `useSubscriberCount`    | Active count from subscribed−cancelled events | `() => { count, loading, stale }`                                                             | Caps pages (`MAX_PAGES=50`)                                    |
+| `useSubscriptionSync`   | Fetch + optimistic `mutate` with rollback     | `(userKey, refreshTrigger?) => { subscription, loading, status, error, mutate, refresh }`     | Failed cancel rolls optimistic `active: false` back            |
+| `useStellarBalance`     | Cached/deduped XLM balance                    | `(address, staleAfterMs?) => UseStellarBalanceResult`                                         | Min fetch interval 5s; module cache                            |
+| `useAdmin`              | Compare wallet to on-chain admin              | `(publicKey \| null) => UseAdminResult`                                                       | Null key clears state                                          |
+| `useLocalStorage`       | `useState` synced to `localStorage` JSON      | `<T>(key, initial) => [value, setValue]`                                                      | Parse errors → initial                                         |
+| `useFreighterAvailable` | Detect `window.freighter` after mount         | `() => { available, installUrl }`                                                             | Starts `false` until effect                                    |
+| `useClipboard`          | `navigator.clipboard.writeText`               | `(timeout?) => { copied, error, copy }`                                                       | Failure sets boolean `error`                                   |
+| `useContractEvents`     | Fetch/paginate contract events                | `(eventName, address?, maxEvents?) => { events, loading, error, refresh, loadMore, hasMore }` | Keeps last `maxEvents` (default 50)                            |
+| `useDebounce`           | Debounce any value                            | `<T>(value, delay?) => T`                                                                     | Clears timer on change/unmount                                 |
 
 Also related: `useRegisterShortcuts` from `frontend/src/context/ShortcutRegistry` (used by Dashboard / SubscriptionCard; not under `hooks/`).
 
@@ -539,11 +544,11 @@ Also related: `useRegisterShortcuts` from `frontend/src/context/ShortcutRegistry
 
 In-flight dedupe + TTL LRU cache for RPC reads (cap 100; default TTL 5s).
 
-| Export | Signature | Notes |
-| --- | --- | --- |
-| `DEFAULT_TTL_MS` | `number` (= `5000`) | Default cache window |
-| `dedupedCall` | `<T>(key, fn, ttlMs?) => Promise<T>` | Concurrent same-key calls share one Promise |
-| `_clearCacheForTesting` | `() => void` | Tests only |
+| Export                  | Signature                            | Notes                                       |
+| ----------------------- | ------------------------------------ | ------------------------------------------- |
+| `DEFAULT_TTL_MS`        | `number` (= `5000`)                  | Default cache window                        |
+| `dedupedCall`           | `<T>(key, fn, ttlMs?) => Promise<T>` | Concurrent same-key calls share one Promise |
+| `_clearCacheForTesting` | `() => void`                         | Tests only                                  |
 
 Failures are not cached. Encode all args in the key (e.g. `"getSubscription:G…"`).
 
@@ -555,11 +560,11 @@ Failures are not cached. Encode all args in the key (e.g. `"getSubscription:G…
 
 Typed Soroban `xdr.ScVal` decoders; throws `ScValDecodeError` on mismatch.
 
-| Export | Notes |
-| --- | --- |
-| `ScValDecodeError` | Fields `expectedType`, `actualType` |
-| `ScValDecoder.decodeI128` / `decodeU64` / `decodeBool` / `decodeAddress` / `decodeString` / `decodeSymbol` | Primitive decoders |
-| `decodeOption` / `decodeVec` / `decodeStruct` | Composite; `scvVoid` → `null` for options; unknown struct keys skipped |
+| Export                                                                                                     | Notes                                                                  |
+| ---------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
+| `ScValDecodeError`                                                                                         | Fields `expectedType`, `actualType`                                    |
+| `ScValDecoder.decodeI128` / `decodeU64` / `decodeBool` / `decodeAddress` / `decodeString` / `decodeSymbol` | Primitive decoders                                                     |
+| `decodeOption` / `decodeVec` / `decodeStruct`                                                              | Composite; `scvVoid` → `null` for options; unknown struct keys skipped |
 
 Prefer for contract read decoding; struct schema keys must match on-chain field names.
 
@@ -571,10 +576,10 @@ Prefer for contract read decoding; struct schema keys must match on-chain field
 
 Serialize wallet/tx submissions so only one build/sign runs at a time.
 
-| Export | Signature | Notes |
-| --- | --- | --- |
+| Export               | Signature                                | Notes                          |
+| -------------------- | ---------------------------------------- | ------------------------------ |
 | `enqueueTransaction` | `<T>(buildAndSign, label) => Promise<T>` | Queue continues after failures |
-| `useTxQueue` | `() => { pendingLabel, queueDepth }` | Used by `WalletBar` |
+| `useTxQueue`         | `() => { pendingLabel, queueDepth }`     | Used by `WalletBar`            |
 
 `useTransaction` wraps submits with label `"Transaction"`.
 
@@ -584,11 +589,11 @@ Serialize wallet/tx submissions so only one build/sign runs at a time.
 
 Complexity ranking for the surfaces contributors change most often:
 
-| Rank | Component | Why |
-| ---: | --- | --- |
-| 1 | **MerchantDashboard** | Virtualized list, multi-source refresh, batch-charge simulation + outcomes, polling |
-| 2 | **Dashboard** | Orchestrates many children, RPC banners, shortcuts, lazy history, refresh counters |
-| 3 | **SubscriptionCard** | Pause/resume/cancel confirm flow, optimistic mutate, trial badge, shortcut `x` |
+| Rank | Component             | Why                                                                                 |
+| ---: | --------------------- | ----------------------------------------------------------------------------------- |
+|    1 | **MerchantDashboard** | Virtualized list, multi-source refresh, batch-charge simulation + outcomes, polling |
+|    2 | **Dashboard**         | Orchestrates many children, RPC banners, shortcuts, lazy history, refresh counters  |
+|    3 | **SubscriptionCard**  | Pause/resume/cancel confirm flow, optimistic mutate, trial badge, shortcut `x`      |
 
 ### Adding a field to SubscriptionCard
 
diff --git a/docs/FRONTEND.md b/docs/FRONTEND.md
index 42602317..2bf21467 100644
--- a/docs/FRONTEND.md
+++ b/docs/FRONTEND.md
@@ -16,13 +16,13 @@ The architecture separates responsibilities into:
 
 # Technology Stack
 
-| Technology | Purpose |
-|------------|---------|
-| React | Component based UI |
-| TypeScript | Static typing |
-| Vite | Development server and bundler |
-| Stellar SDK | Building and signing Stellar transactions |
-| Soroban RPC | Smart contract communication |
+| Technology       | Purpose                                   |
+| ---------------- | ----------------------------------------- |
+| React            | Component based UI                        |
+| TypeScript       | Static typing                             |
+| Vite             | Development server and bundler            |
+| Stellar SDK      | Building and signing Stellar transactions |
+| Soroban RPC      | Smart contract communication              |
 | Freighter Wallet | Wallet connection and transaction signing |
 
 ---
diff --git a/docs/GLOSSARY.md b/docs/GLOSSARY.md
index 6025a014..bd24ad35 100644
--- a/docs/GLOSSARY.md
+++ b/docs/GLOSSARY.md
@@ -5,16 +5,19 @@
 ## A
 
 ### Active Count
+
 The number of subscriptions currently considered active by the contract. It changes when users subscribe and cancel. See the `ActiveCount` storage key and `get_active_count()`.
 
 Source: `contract/src/subscription_count.rs`, `DataKey::ActiveCount`.
 
 ### Admin
+
 The privileged address authorized to perform administrative actions (initialization, configuration changes, proposals, and commits). Admin actions are generally protected by `require_auth()` checks. The current admin may be transferred via a two-step workflow.
 
 Source: `contract/src/admin.rs`, `DataKey::Admin`, `transfer_admin()` / `accept_admin()`.
 
 ### Append-only Subscriber Index
+
 A persistent list-like structure used to track subscriber addresses for iteration and paging patterns. It supports reading “subscriber at index” without rewriting the full list each time. The contract keeps an associated size counter.
 
 Source: `contract/src/subscription_count.rs`, `DataKey::SubscriberIndex(i)` and `SubscriberIndexSize`.
@@ -22,6 +25,7 @@ Source: `contract/src/subscription_count.rs`, `DataKey::SubscriberIndex(i)` and
 ## B
 
 ### Batch Charge
+
 A permissionless operation that attempts to charge multiple subscribers in one transaction. Instead of failing the whole transaction on ordinary eligibility issues, it returns per-user outcomes. This improves throughput for the keeper workflow.
 
 Source: `contract/src/batch.rs`, `batch_charge()`.
@@ -29,21 +33,25 @@ Source: `contract/src/batch.rs`, `batch_charge()`.
 ## C
 
 ### Contract Paused
+
 A global state flag that blocks most user-facing write operations (subscription write paths) while enabled. Read-only methods generally continue to work. The contract provides `pause_contract()` / `unpause_contract()` and `is_contract_paused()`.
 
 Source: `contract/src/lib.rs`, `contract/src/storage.rs`, `DataKey::ContractPaused`.
 
 ### Charge Grace Window
+
 A time window after the scheduled billing time during which a charge is still considered valid. If the grace period elapses, charging returns a grace-related error/result. The window is controlled by grace-period proposal and commit calls.
 
 Source: `contract/src/grace.rs`, `ContractError::GracePeriodElapsed`, `DataKey::GracePeriod`.
 
 ### Charge History
+
 A stored list/vector of charge timestamps associated with a subscriber. The contract caps the list length (documented as “up to 12”) and supports paging and clearing. Used for analytics and to validate billing behavior.
 
 Source: `contract/src/subscription_history.rs`, `DataKey::ChargeHistory(user)`.
 
 ### Contract Schema Version
+
 An integer representing the current on-chain storage schema version. It is updated by the `migrate()` workflow and exposed via `get_schema_version()`. Client behavior and storage migrations may depend on this value.
 
 Source: `contract/src/migration.rs`, `DataKey::SchemaVersion`.
@@ -51,11 +59,13 @@ Source: `contract/src/migration.rs`, `DataKey::SchemaVersion`.
 ## D
 
 ### Daily Limit
+
 A temporary per-subscriber cap that restricts total spendable amount via `pay_per_use()` within an approximate 24-hour TTL. It is set by `set_daily_limit()` and enforced on each one-time payment. The contract stores both the configured limit and the accumulated spend.
 
 Source: `contract/src/spending_limit.rs`, `DataKey::DailyLimit(user)`, `DataKey::DailySpent(user)`.
 
 ### Daily Spent
+
 The running total of stroops spent “today” via `pay_per_use()` for a specific subscriber. It is tracked in temporary storage with the same TTL behavior as the daily limit. It’s used to enforce that spend does not exceed the configured daily limit.
 
 Source: `contract/src/spending_limit.rs`, `DataKey::DailySpent(user)`.
@@ -63,6 +73,7 @@ Source: `contract/src/spending_limit.rs`, `DataKey::DailySpent(user)`.
 ## E
 
 ### Events
+
 The contract emits structured events for key lifecycle operations and state transitions. Off-chain services (indexers, dashboards) rely on these events for analytics and for driving keeper workflows. See `docs/EVENTS.md` for the canonical schema, and `docs/EVENT-DRIVEN-GUIDE.md` for polling, deduplication, reaction patterns, and reliability.
 
 Source: `contract/src/events.rs`, `docs/EVENTS.md`, `docs/EVENT-DRIVEN-GUIDE.md`.
@@ -70,11 +81,13 @@ Source: `contract/src/events.rs`, `docs/EVENTS.md`, `docs/EVENT-DRIVEN-GUIDE.md`
 ## F
 
 ### Fee BPS
+
 Fee configuration expressed in basis points (BPS). The contract uses fee BPS to compute a protocol fee split during eligible recurring charges. Fee BPS values are set via proposal/commit and exposed through getters.
 
 Source: `contract/src/fee.rs`, `DataKey::FeeBps`, `propose_fee()` / `commit_fee()`.
 
 ### Fee Collector
+
 The address that receives protocol-fee transfers (when a fee is configured). It is paired with Fee BPS in fee configuration. The keeper or payment execution path may transfer funds to this address.
 
 Source: `contract/src/fee.rs`, `DataKey::FeeCollector`.
@@ -82,11 +95,13 @@ Source: `contract/src/fee.rs`, `DataKey::FeeCollector`.
 ## G
 
 ### Grace Period
+
 The configured grace duration (in seconds) applied to recurring charge eligibility. During the grace period, charges are accepted even if they occur shortly after the scheduled time. After the grace period elapses, charging is prevented.
 
 Source: `contract/src/grace.rs`, `DataKey::GracePeriod`.
 
 ### Grace Period Proposal / Commit
+
 Two-step workflow for updating the grace period, similar to other admin-configured parameters. A proposer sets a pending value, then an admin commits the change to make it active. This avoids instantaneous misconfiguration.
 
 Source: `contract/src/grace.rs`, `DataKey::PendingGracePeriod`.
@@ -94,6 +109,7 @@ Source: `contract/src/grace.rs`, `DataKey::PendingGracePeriod`.
 ## K
 
 ### Keeper
+
 The off-chain process responsible for triggering scheduled recurring charges. The keeper is the only required runtime piece for billing automation, because the contract does not schedule itself. Keeper workflows call `charge()` or `batch_charge()`.
 
 Source: `docs/KEEPER.md`, contract API docs describing permissionless `charge()` usage.
@@ -101,11 +117,13 @@ Source: `docs/KEEPER.md`, contract API docs describing permissionless `charge()`
 ## L
 
 ### Locked/Eligibility Checks (Interval)
+
 The contract enforces that recurring charges only occur when the billing interval has elapsed. If the call is made too early, the operation returns an interval-related error/result. Interval rules apply to both `charge()` and `batch_charge()` paths.
 
 Source: `contract/src/charge_exec.rs`, `ContractError::IntervalNotElapsed`.
 
 ### Min Interval
+
 The minimum allowed billing interval floor configured by admin. This prevents subscriptions from being created with intervals that are too short. The contract exposes `set_min_interval()` / `get_min_interval()`.
 
 Source: `contract/src/min_interval.rs`, `DataKey::MinInterval`.
@@ -113,6 +131,7 @@ Source: `contract/src/min_interval.rs`, `DataKey::MinInterval`.
 ## M
 
 ### Merchant
+
 The receiving party for subscription payments and protocol-fee splits. Merchants are typically whitelisted (optional) and can be frozen to block charges. Revenue accounting is tracked per merchant.
 
 Source: `contract/src/whitelist.rs`, `contract/src/merchant_stats.rs`.
@@ -120,16 +139,19 @@ Source: `contract/src/whitelist.rs`, `contract/src/merchant_stats.rs`.
 See also: [Merchant Integration Cookbook](./MERCHANT-INTEGRATION.md).
 
 ### Merchant Frozen
+
 A merchant-level state that prevents charges to a frozen merchant. This is independent of the global contract pause. When enabled, attempts to charge such merchants fail with merchant freeze related errors/panics.
 
 Source: `contract/src/whitelist.rs`, `DataKey::MerchantFrozen(merchant)`.
 
 ### Merchant Revenue
+
 The cumulative amount credited to a merchant across all successful charges and eligible one-time payments. It is stored as a running total and exposed via `get_merchant_revenue()`. Daily buckets are tracked separately.
 
 Source: `contract/src/merchant_stats.rs`, `DataKey::MerchantRevenue(merchant)`.
 
 ### Merchant Revenue Day Bucket
+
 A persistent daily bucket for per-day revenue analytics. The contract stores revenue keyed by merchant and day identifier. This enables reporting via `get_merchant_revenue_history()`.
 
 Source: `contract/src/merchant_stats.rs`, `DataKey::MerchantRevenueDay(merchant, day)`.
@@ -137,16 +159,19 @@ Source: `contract/src/merchant_stats.rs`, `DataKey::MerchantRevenueDay(merchant,
 ## P
 
 ### Permissionless Charge
+
 A design choice where charging for recurring payments can be invoked without `user.require_auth()`. This enables keepers to call `charge()` and `batch_charge()` for any eligible subscriber. Eligibility is still validated on-chain (interval, pause, grace period, merchant freeze, etc.).
 
 Source: `docs/API.md` (Auth lines), `contract/src/charge_exec.rs`.
 
 ### Protocol Fee
+
 The protocol-level fee charged on recurring billing flows, expressed using fee BPS and transferred to the configured fee collector address. Fees may be skipped based on configuration or special cases (e.g., 0 BPS). Fee behavior is part of the `charge()` execution.
 
 Source: `contract/src/fee.rs`, `docs/API.md` describing protocol fee accounting.
 
 ### Protocol Stats
+
 A read-only view summarizing on-chain protocol configuration and runtime health counters. It includes active counts, fee configuration, grace period, whitelist enabled flag, schema version, and contract pause state. Exposed via `get_protocol_stats()`.
 
 Source: `contract/src/lib.rs`, `ProtocolStats` struct.
@@ -154,11 +179,13 @@ Source: `contract/src/lib.rs`, `ProtocolStats` struct.
 ## R
 
 ### Referrer
+
 An optional address recorded at subscription creation time. The contract stores the referrer for later retrieval and emits a `referred` event. This can be used to support referral analytics. PayFlow does not automatically pay referrers on-chain; see [REFERRALS.md](./REFERRALS.md) for architecture and off-chain payout patterns.
 
 Source: `contract/src/referral.rs`, `get_referrer()`, `DataKey::Referral(user)`.
 
 ### Replay Safety (Idempotent Migration)
+
 A property where certain admin workflows (like `migrate`) can be called multiple times safely. This reduces operational risk during upgrades. In the docs, this is described as “safe to call multiple times.”
 
 Source: `contract/src/migration.rs`, `migrate()` docs in `docs/API.md`.
@@ -166,26 +193,31 @@ Source: `contract/src/migration.rs`, `migrate()` docs in `docs/API.md`.
 ## S
 
 ### SAC Token (Subscription Allowance Currency)
+
 The token contract used as the payment asset for subscription and one-time transfers. It is stored/selected during `initialize()` and used for `transfer_from` calls. In docs, SAC is the token required for subscription payments.
 
 Source: `contract/src/lib.rs` (initialize token docs), `contract/src/token.rs`.
 
 ### Schema Version (Storage Schema Version)
+
 See “Contract Schema Version”; the term is often used interchangeably in docs when referring to `schema_version` fields in health reports and protocol stats.
 
 Source: `contract/src/lib.rs` (`ProtocolStats`, `HealthReport`), `contract/src/migration.rs`.
 
 ### Subscription
+
 A stored record representing a subscriber’s recurring billing agreement. It includes merchant, amount, interval, next-charge tracking fields, active/paused flags, selected token, optional referrer, a label, and an optional trial duration. The contract returns it via `get_subscription()`.
 
 Source: `contract/src/lib.rs` (`Subscription` struct), `DataKey::Subscription(user)`.
 
 ### Subscription Metadata
+
 A short, human-readable label attached to a subscription (e.g., plan name). It’s set via `set_metadata()` and read via `get_metadata()` / `get_subscription_label()`. Metadata is stored separately from the core subscription record.
 
 Source: `contract/src/subscription_metadata.rs`, `DataKey::SubscriptionMeta(user)`.
 
 ### Subscriber
+
 A user address that owns a subscription record and may authorize one-time or recurring spend operations. Subscriber identity is used as the primary key for subscription storage and charge history. Many functions take a `user: Address` parameter representing the subscriber.
 
 Source: `docs/API.md` (parameter naming), `contract/src/lib.rs` (`Subscription(Address)` keys).
@@ -193,6 +225,7 @@ Source: `docs/API.md` (parameter naming), `contract/src/lib.rs` (`Subscription(A
 ## T
 
 ### Trial Duration / Trial Period
+
 A subscriber-specific optional delay before the first recurring charge after subscription creation. It is specified during subscription calls and used to compute trial end time. The end timestamp is exposed via `get_trial_end()`.
 
 Source: `contract/src/trial.rs`, `Subscription.trial_duration`, `get_trial_end()`.
@@ -200,6 +233,7 @@ Source: `contract/src/trial.rs`, `Subscription.trial_duration`, `get_trial_end()
 ## U
 
 ### TTL (Time-To-Live)
+
 A storage lifetime mechanism used for temporary entries (e.g., daily limits) and for refreshing persistent entries. The contract relies on TTL behavior to automatically expire daily limit configuration and spend counters. Some persistent entries are refreshed via TTL extensions.
 
 Source: docs in `docs/API.md` and `contract/src/storage.rs`.
@@ -207,12 +241,13 @@ Source: docs in `docs/API.md` and `contract/src/storage.rs`.
 ## W
 
 ### Whitelist Enabled
+
 A global toggle enabling merchant whitelist checks during subscription creation and/or charge eligibility. When enabled, merchants must be present in the whitelist to accept subscriptions. It is stored in instance storage and exposed via `set_whitelist_enabled()` / `is_whitelist_enabled()`.
 
 Source: `contract/src/whitelist.rs`, `DataKey::WhitelistEnabled`.
 
 ### Whitelisted Merchant
+
 A merchant address allowed to participate when the whitelist is enabled. Whitelist membership is updated via `add_merchant()` and `remove_merchant()`. Charge eligibility may fail if the merchant is not whitelisted.
 
 Source: `contract/src/whitelist.rs`, `DataKey::MerchantWhitelist(merchant)`.
-
diff --git a/docs/INTEGRATION-GUIDE.md b/docs/INTEGRATION-GUIDE.md
index a6a4038b..970f84ee 100644
--- a/docs/INTEGRATION-GUIDE.md
+++ b/docs/INTEGRATION-GUIDE.md
@@ -11,6 +11,7 @@ This guide is designed for third-party applications (such as SaaS billing dashbo
 Before writing any integration code, ensure your environment is set up.
 
 ### Dependencies
+
 You will need the official Stellar JavaScript/TypeScript SDK:
 
 ```bash
@@ -18,7 +19,9 @@ npm install @stellar/stellar-sdk
 ```
 
 ### Authentication
+
 Depending on your integration, you will authenticate transactions via:
+
 1. **Client-side (Wallets):** Freighter, Albedo, or xBull.
 2. **Server-side (Keepers/Backend):** Raw Stellar keypairs (using `Keypair.fromSecret()`).
 
@@ -26,14 +29,16 @@ Depending on your integration, you will authenticate transactions via:
 
 ## 2. Testnet Sandbox Setup
 
-While developing, you should point your application to the Stellar Testnet. 
+While developing, you should point your application to the Stellar Testnet.
 
 **Testnet Configuration:**
+
 - **RPC URL:** `https://soroban-testnet.stellar.org`
 - **Network Passphrase:** `Test SDF Network ; September 2015`
 
 **Funding Test Accounts:**
 You can instantly fund testing accounts using Friendbot:
+
 ```javascript
 const response = await fetch(`https://friendbot.stellar.org?addr=${publicKey}`);
 ```
@@ -45,13 +50,13 @@ const response = await fetch(`https://friendbot.stellar.org?addr=${publicKey}`);
 To interact with the PayFlow smart contract, instantiate it using the Stellar SDK.
 
 ```javascript
-import { rpc, Contract, xdr, Keypair, Networks } from '@stellar/stellar-sdk';
+import { rpc, Contract, xdr, Keypair, Networks } from "@stellar/stellar-sdk";
 
 // Initialize the RPC server
-const server = new rpc.Server('https://soroban-testnet.stellar.org');
+const server = new rpc.Server("https://soroban-testnet.stellar.org");
 
 // The deployed PayFlow contract ID
-const CONTRACT_ID = 'C...'; 
+const CONTRACT_ID = "C...";
 const payFlowContract = new Contract(CONTRACT_ID);
 ```
 
@@ -59,40 +64,54 @@ const payFlowContract = new Contract(CONTRACT_ID);
 
 ## 4. Subscribing a User Programmatically
 
-Subscribing requires two steps: 
+Subscribing requires two steps:
+
 1. **Token Allowance:** The user must approve the PayFlow contract to pull funds.
 2. **Subscribe:** The user calls the `subscribe` function on PayFlow.
 
 ```javascript
-async function subscribeUser(userKeypair, merchantAddress, amountStroops, intervalSeconds, tokenAddress) {
+async function subscribeUser(
+  userKeypair,
+  merchantAddress,
+  amountStroops,
+  intervalSeconds,
+  tokenAddress,
+) {
   const source = await server.getAccount(userKeypair.publicKey());
-  
+
   // 1. Build the Subscribe transaction
-  const tx = new TransactionBuilder(source, { fee: '1000', networkPassphrase: Networks.TESTNET })
+  const tx = new TransactionBuilder(source, {
+    fee: "1000",
+    networkPassphrase: Networks.TESTNET,
+  })
     .addOperation(
-      payFlowContract.call('subscribe',
-        xdr.ScVal.scvAddress(userKeypair.publicKey()),   // user
-        xdr.ScVal.scvAddress(merchantAddress),           // merchant
-        xdr.ScVal.scvI128(new xdr.Int128Parts({          // amount
+      payFlowContract.call(
+        "subscribe",
+        xdr.ScVal.scvAddress(userKeypair.publicKey()), // user
+        xdr.ScVal.scvAddress(merchantAddress), // merchant
+        xdr.ScVal.scvI128(
+          new xdr.Int128Parts({
+            // amount
             hi: xdr.Int64.fromString("0"),
-            lo: xdr.Uint64.fromString(amountStroops.toString())
-        })), 
+            lo: xdr.Uint64.fromString(amountStroops.toString()),
+          }),
+        ),
         xdr.ScVal.scvU64(xdr.Uint64.fromString(intervalSeconds.toString())), // interval
-        xdr.ScVal.scvAddress(tokenAddress),              // token
-        xdr.ScVal.scvVoid(),                             // trial_period (Option<u64> -> None)
-        xdr.ScVal.scvVoid()                              // referrer (Option<Address> -> None)
-      )
+        xdr.ScVal.scvAddress(tokenAddress), // token
+        xdr.ScVal.scvVoid(), // trial_period (Option<u64> -> None)
+        xdr.ScVal.scvVoid(), // referrer (Option<Address> -> None)
+      ),
     )
     .setTimeout(30)
     .build();
 
   // 2. Sign and submit
   tx.sign(userKeypair);
-  
+
   // Note: Use server.prepareTransaction() in production for correct fee estimation
   const preparedTx = await server.prepareTransaction(tx);
   preparedTx.sign(userKeypair);
-  
+
   const response = await server.sendTransaction(preparedTx);
   return response;
 }
@@ -107,19 +126,22 @@ async function subscribeUser(userKeypair, merchantAddress, amountStroops, interv
 ```javascript
 async function processBatchCharges(keeperKeypair, userAddresses) {
   const source = await server.getAccount(keeperKeypair.publicKey());
-  
+
   // Build SCVal array of addresses
-  const scvUsers = userAddresses.map(addr => xdr.ScVal.scvAddress(addr));
+  const scvUsers = userAddresses.map((addr) => xdr.ScVal.scvAddress(addr));
   const scvVecUsers = xdr.ScVal.scvVec(scvUsers);
 
-  const tx = new TransactionBuilder(source, { fee: '1000', networkPassphrase: Networks.TESTNET })
-    .addOperation(payFlowContract.call('batch_charge', scvVecUsers))
+  const tx = new TransactionBuilder(source, {
+    fee: "1000",
+    networkPassphrase: Networks.TESTNET,
+  })
+    .addOperation(payFlowContract.call("batch_charge", scvVecUsers))
     .setTimeout(30)
     .build();
 
   const preparedTx = await server.prepareTransaction(tx);
   preparedTx.sign(keeperKeypair);
-  
+
   return await server.sendTransaction(preparedTx);
 }
 ```
@@ -133,19 +155,17 @@ PayFlow emits structured events that you can poll using the Soroban RPC `getEven
 ```javascript
 async function listenForCharges() {
   const response = await server.getEvents({
-    startLedger: 1000000, 
+    startLedger: 1000000,
     filters: [
       {
         type: "contract",
         contractIds: [CONTRACT_ID],
-        topics: [
-          [xdr.ScVal.scvSymbol("charged").toXDR("base64")]
-        ]
-      }
-    ]
+        topics: [[xdr.ScVal.scvSymbol("charged").toXDR("base64")]],
+      },
+    ],
   });
 
-  response.events.forEach(event => {
+  response.events.forEach((event) => {
     console.log(`Charge processed at ledger: ${event.ledger}`);
     // Decode event.value here to get amount, merchant, and timestamp
   });
@@ -176,16 +196,20 @@ Common errors you should catch:
 - **Token Allowance Failed:** If the token contract throws an error during a charge, the user likely revoked their allowance or has an insufficient balance.
 
 **Handling Errors:**
+
 ```javascript
 try {
-    const preparedTx = await server.prepareTransaction(tx);
-    // ...
+  const preparedTx = await server.prepareTransaction(tx);
+  // ...
 } catch (error) {
-    if (error.response?.data?.extras?.result_codes?.operations) {
-        console.error("Contract Execution Failed:", error.response.data.extras.result_codes.operations);
-    } else {
-        console.error("RPC Error:", error);
-    }
+  if (error.response?.data?.extras?.result_codes?.operations) {
+    console.error(
+      "Contract Execution Failed:",
+      error.response.data.extras.result_codes.operations,
+    );
+  } else {
+    console.error("RPC Error:", error);
+  }
 }
 ```
 
@@ -201,19 +225,23 @@ The full mechanics — ring buffer diagram, worked examples, and an offset/limit
 async function getChargeHistoryPage(userAddress, offset, limit) {
   const source = await server.getAccount(userAddress);
 
-  const tx = new TransactionBuilder(source, { fee: '1000', networkPassphrase: Networks.TESTNET })
+  const tx = new TransactionBuilder(source, {
+    fee: "1000",
+    networkPassphrase: Networks.TESTNET,
+  })
     .addOperation(
-      payFlowContract.call('get_charge_history_page',
+      payFlowContract.call(
+        "get_charge_history_page",
         xdr.ScVal.scvAddress(userAddress),
         xdr.ScVal.scvU32(offset),
-        xdr.ScVal.scvU32(limit)
-      )
+        xdr.ScVal.scvU32(limit),
+      ),
     )
     .setTimeout(30)
     .build();
 
   const sim = await server.simulateTransaction(tx);
-  if ('error' in sim) throw new Error(sim.error);
+  if ("error" in sim) throw new Error(sim.error);
 
   // sim.result.retval decodes to a Vec<u64> of charge timestamps (oldest → newest).
   return sim.result.retval;
diff --git a/docs/KEEPER.md b/docs/KEEPER.md
index 3ee4a177..cacc2249 100644
--- a/docs/KEEPER.md
+++ b/docs/KEEPER.md
@@ -29,13 +29,13 @@ The contract also enforces a configurable grace period. If a charge is attempted
 
 `batch_charge(users)` accepts a list of user addresses and processes each one independently — a failure on one address does not abort the rest. Each entry in the returned `Vec<ChargeResult>` is one of:
 
-| Result | Meaning |
-|--------|---------|
-| `Charged` | Funds transferred successfully |
-| `Skipped` | Interval has not elapsed yet |
-| `NoSubscription` | No subscription found for this address |
-| `Inactive` | Subscription is cancelled |
-| `Paused` | Subscription is paused by the user |
+| Result               | Meaning                                    |
+| -------------------- | ------------------------------------------ |
+| `Charged`            | Funds transferred successfully             |
+| `Skipped`            | Interval has not elapsed yet               |
+| `NoSubscription`     | No subscription found for this address     |
+| `Inactive`           | Subscription is cancelled                  |
+| `Paused`             | Subscription is paused by the user         |
 | `GracePeriodElapsed` | Charge window expired; subscription lapsed |
 
 The keeper must page through the full subscriber index using `get_subscriber_index_size()` and `get_subscriber_at(offset)`, then pass slices of addresses to `batch_charge()`.
@@ -176,15 +176,15 @@ if __name__ == "__main__":
 
 All configuration is read from environment variables. No config file is required.
 
-| Variable | Required | Default | Description |
-|----------|----------|---------|-------------|
-| `KEEPER_CONTRACT_ID` | Yes | — | Deployed FlowPay contract ID |
-| `KEEPER_RPC_URL` | Yes | — | Soroban RPC endpoint (e.g. `https://soroban-testnet.stellar.org`) |
-| `KEEPER_SECRET_KEY` | Yes | — | Stellar secret key for the keeper account (starts with `S`) |
-| `KEEPER_INTERVAL` | No | `3600` | Seconds between charge cycles |
-| `KEEPER_PAGE_SIZE` | No | `100` | Addresses per `batch_charge()` call (max 100) |
-| `KEEPER_ALERT_WEBHOOK` | No | — | Webhook URL for alert notifications |
-| `KEEPER_MIN_BALANCE_XLM` | No | `10` | Alert threshold for keeper account balance |
+| Variable                 | Required | Default | Description                                                       |
+| ------------------------ | -------- | ------- | ----------------------------------------------------------------- |
+| `KEEPER_CONTRACT_ID`     | Yes      | —       | Deployed FlowPay contract ID                                      |
+| `KEEPER_RPC_URL`         | Yes      | —       | Soroban RPC endpoint (e.g. `https://soroban-testnet.stellar.org`) |
+| `KEEPER_SECRET_KEY`      | Yes      | —       | Stellar secret key for the keeper account (starts with `S`)       |
+| `KEEPER_INTERVAL`        | No       | `3600`  | Seconds between charge cycles                                     |
+| `KEEPER_PAGE_SIZE`       | No       | `100`   | Addresses per `batch_charge()` call (max 100)                     |
+| `KEEPER_ALERT_WEBHOOK`   | No       | —       | Webhook URL for alert notifications                               |
+| `KEEPER_MIN_BALANCE_XLM` | No       | `10`    | Alert threshold for keeper account balance                        |
 
 Store `KEEPER_SECRET_KEY` in a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.) — never commit it to source control.
 
@@ -195,10 +195,10 @@ Store `KEEPER_SECRET_KEY` in a secrets manager (AWS Secrets Manager, HashiCorp V
 The right interval depends on the shortest subscription interval used in your deployment.
 
 | Shortest subscription interval | Recommended keeper cadence |
-|-------------------------------|---------------------------|
-| 1 day (86 400 s) | Every hour |
-| 1 week | Every 4–6 hours |
-| 1 month | Every 12–24 hours |
+| ------------------------------ | -------------------------- |
+| 1 day (86 400 s)               | Every hour                 |
+| 1 week                         | Every 4–6 hours            |
+| 1 month                        | Every 12–24 hours          |
 
 Run the keeper more frequently than the shortest subscription interval so that users are charged promptly and the grace period buffer is not consumed by keeper downtime.
 
@@ -210,13 +210,13 @@ For most deployments, **hourly** is the correct default. The full charge cycle f
 
 ### Key metrics to track
 
-| Metric | Warning threshold | Critical threshold | Action |
-|--------|-------------------|--------------------|--------|
-| Keeper account balance | < 50 XLM | < 10 XLM | Top up immediately |
-| Cycle duration | > 2 min | > 5 min | Check RPC health |
-| Failed `batch_charge` calls | > 0 | > 5% of pages | Review error logs |
-| Time since last successful cycle | > 1.5× interval | > 2× interval | Page on-call |
-| `GracePeriodElapsed` results | Any | — | Investigate missed cycles |
+| Metric                           | Warning threshold | Critical threshold | Action                    |
+| -------------------------------- | ----------------- | ------------------ | ------------------------- |
+| Keeper account balance           | < 50 XLM          | < 10 XLM           | Top up immediately        |
+| Cycle duration                   | > 2 min           | > 5 min            | Check RPC health          |
+| Failed `batch_charge` calls      | > 0               | > 5% of pages      | Review error logs         |
+| Time since last successful cycle | > 1.5× interval   | > 2× interval      | Page on-call              |
+| `GracePeriodElapsed` results     | Any               | —                  | Investigate missed cycles |
 
 ### Prometheus / Alertmanager example
 
@@ -379,12 +379,12 @@ Renew the lease before it expires. If a leader crashes, the lock expires and a f
 
 ### Incident response
 
-| Symptom | First check | Resolution |
-|---------|-------------|------------|
-| No cycles for > 2 h | `journalctl -u payflow-keeper` | Restart service; check balance |
-| `GracePeriodElapsed` spikes | Keeper uptime during the window | Manually invoke missed pages; investigate root cause |
-| `batch_charge` throws `InvalidArgument` | Contract upgrade happened | Redeploy keeper with updated ABI |
-| Cycle takes > 5 min | RPC node latency | Switch to a backup RPC endpoint |
+| Symptom                                 | First check                     | Resolution                                           |
+| --------------------------------------- | ------------------------------- | ---------------------------------------------------- |
+| No cycles for > 2 h                     | `journalctl -u payflow-keeper`  | Restart service; check balance                       |
+| `GracePeriodElapsed` spikes             | Keeper uptime during the window | Manually invoke missed pages; investigate root cause |
+| `batch_charge` throws `InvalidArgument` | Contract upgrade happened       | Redeploy keeper with updated ABI                     |
+| Cycle takes > 5 min                     | RPC node latency                | Switch to a backup RPC endpoint                      |
 
 ---
 
diff --git a/docs/MAINNET-DEPLOYMENT.md b/docs/MAINNET-DEPLOYMENT.md
index ca1e3e0f..6984d093 100644
--- a/docs/MAINNET-DEPLOYMENT.md
+++ b/docs/MAINNET-DEPLOYMENT.md
@@ -10,16 +10,16 @@ For day-to-day Testnet steps, see [`DEPLOYMENT.md`](DEPLOYMENT.md). For audit ga
 
 > Real funds must not flow through an unaudited Mainnet deployment.
 
-- [ ] **Independent security audit complete** — findings remediations merged; report (or summary) published or accepted by maintainers. *Why:* Mainnet holds user allowances and merchant revenue.
-- [ ] **Audit WASM hash matches release artifact** — SHA256 of `flow_pay.wasm` recorded in release notes. *Why:* prevents deploying an unaudited binary.
+- [ ] **Independent security audit complete** — findings remediations merged; report (or summary) published or accepted by maintainers. _Why:_ Mainnet holds user allowances and merchant revenue.
+- [ ] **Audit WASM hash matches release artifact** — SHA256 of `flow_pay.wasm` recorded in release notes. _Why:_ prevents deploying an unaudited binary.
 - [ ] **Key management plan approved**
   - [ ] Admin key on a **hardware wallet** (or equivalent HSM)
   - [ ] Prefer **multisig / multi-party** admin (Stellar multisig thresholds) over a single hot key
   - [ ] Deployer key separate from long-term admin key where possible
   - [ ] Keeper keys are hot keys with **limited XLM** and no admin rights  
-  *Why:* admin compromise can pause, freeze merchants, or change fees.
-- [ ] **Emergency runbook rehearsed** — who can call `pause_contract()`, who to page, how to unpause. *Why:* reduces incident MTTR.
-- [ ] **Fee governance configured** — intended `bps` and fee collector (not the contract address). Two-step propose/commit understood. *Why:* fee mistakes are costly on Mainnet.
+        _Why:_ admin compromise can pause, freeze merchants, or change fees.
+- [ ] **Emergency runbook rehearsed** — who can call `pause_contract()`, who to page, how to unpause. _Why:_ reduces incident MTTR.
+- [ ] **Fee governance configured** — intended `bps` and fee collector (not the contract address). Two-step propose/commit understood. _Why:_ fee mistakes are costly on Mainnet.
 
 ---
 
@@ -99,10 +99,10 @@ soroban contract invoke \
 # Expected: success; subsequent initialize must fail with AlreadyInitialized (1)
 ```
 
-- [ ] WASM upload succeeded; hash matches Phase 1 record  
-- [ ] Contract ID recorded in password manager / ops vault  
-- [ ] `initialize` succeeded exactly once  
-- [ ] Admin address is the intended hardware/multisig account  
+- [ ] WASM upload succeeded; hash matches Phase 1 record
+- [ ] Contract ID recorded in password manager / ops vault
+- [ ] `initialize` succeeded exactly once
+- [ ] Admin address is the intended hardware/multisig account
 
 ### Optional: migrate
 
@@ -114,7 +114,7 @@ soroban contract invoke \
   -- migrate
 ```
 
-- [ ] `migrate` run if this WASM introduces schema changes; safe no-op otherwise  
+- [ ] `migrate` run if this WASM introduces schema changes; safe no-op otherwise
 
 ---
 
@@ -137,18 +137,18 @@ soroban contract invoke --id <CONTRACT_ID> --network mainnet -- get_schema_versi
 # Expected: version matching release notes
 ```
 
-- [ ] Health check passes  
-- [ ] Token and admin configured (non-empty)  
-- [ ] Schema version matches release  
+- [ ] Health check passes
+- [ ] Token and admin configured (non-empty)
+- [ ] Schema version matches release
 - [ ] **First-subscriber smoke test** (small amount)
-  1. Approve SAC allowance to the contract  
-  2. `subscribe` with a short-but-valid interval  
-  3. Trigger `charge` after interval (or keeper page)  
-  4. Confirm token balances / events  
+  1. Approve SAC allowance to the contract
+  2. `subscribe` with a short-but-valid interval
+  3. Trigger `charge` after interval (or keeper page)
+  4. Confirm token balances / events
 - [ ] **Monitoring live**
-  - [ ] Keeper metrics + balance alerts ([`KEEPER.md`](KEEPER.md))  
-  - [ ] RPC error-rate alerts  
-  - [ ] Pause / anomaly alerts for ops  
+  - [ ] Keeper metrics + balance alerts ([`KEEPER.md`](KEEPER.md))
+  - [ ] RPC error-rate alerts
+  - [ ] Pause / anomaly alerts for ops
 
 ---
 
@@ -164,24 +164,24 @@ VITE_RPC_URL=https://soroban-mainnet.stellar.org
 VITE_NETWORK_PASSPHRASE=Public Global Stellar Network ; September 2015
 ```
 
-- [ ] Production frontend env updated and redeployed  
-- [ ] Wallet network prompts show **Mainnet** (not Testnet)  
-- [ ] Feature flags / maintenance banner cleared  
+- [ ] Production frontend env updated and redeployed
+- [ ] Wallet network prompts show **Mainnet** (not Testnet)
+- [ ] Feature flags / maintenance banner cleared
 
 ### DNS / CDN
 
-- [ ] Production DNS records point at the go-live frontend  
-- [ ] CDN/cache purged after env deploy  
-- [ ] TLS certificates valid  
-- [ ] Status page / uptime check pointed at production URL  
+- [ ] Production DNS records point at the go-live frontend
+- [ ] CDN/cache purged after env deploy
+- [ ] TLS certificates valid
+- [ ] Status page / uptime check pointed at production URL
 
 ### Public announcement checklist
 
-- [ ] Contract ID + WASM hash published  
-- [ ] Audit report link published  
-- [ ] Known limitations summarized ([`SECURITY.md`](SECURITY.md))  
-- [ ] Support / disclosure channel listed (`security@payflow.dev`)  
-- [ ] Keeper operators notified of Mainnet contract ID and cadence  
+- [ ] Contract ID + WASM hash published
+- [ ] Audit report link published
+- [ ] Known limitations summarized ([`SECURITY.md`](SECURITY.md))
+- [ ] Support / disclosure channel listed (`security@payflow.dev`)
+- [ ] Keeper operators notified of Mainnet contract ID and cadence
 
 ---
 
@@ -189,8 +189,8 @@ VITE_NETWORK_PASSPHRASE=Public Global Stellar Network ; September 2015
 
 FlowPay does not auto-rollback. If a critical issue appears:
 
-1. Admin: `pause_contract()` immediately.  
-2. Follow [`DEPLOYMENT.md` Rollback Procedure](DEPLOYMENT.md#rollback-procedure) to restore a prior WASM hash if required.  
+1. Admin: `pause_contract()` immediately.
+2. Follow [`DEPLOYMENT.md` Rollback Procedure](DEPLOYMENT.md#rollback-procedure) to restore a prior WASM hash if required.
 3. Re-run `verify-contract.sh` and keeper health checks before `unpause_contract()`.
 
 ---
diff --git a/docs/MERCHANT-INTEGRATION.md b/docs/MERCHANT-INTEGRATION.md
index 8bdb3966..c15a9644 100644
--- a/docs/MERCHANT-INTEGRATION.md
+++ b/docs/MERCHANT-INTEGRATION.md
@@ -22,13 +22,13 @@ If you are building a SaaS billing dashboard, a marketplace settlement backend,
 
 ### 1.1 Prerequisites
 
-| Requirement | Notes |
-| --- | --- |
-| Stellar account (G…) | Your merchant wallet. Fund it on Testnet via [Friendbot](https://friendbot.stellar.org). |
+| Requirement                  | Notes                                                                                                                    |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| Stellar account (G…)         | Your merchant wallet. Fund it on Testnet via [Friendbot](https://friendbot.stellar.org).                                 |
 | Deployed PayFlow contract ID | Set as `VITE_CONTRACT_ID` in the frontend, or pass `--id` to the Soroban CLI. See [`docs/DEPLOYMENT.md`](DEPLOYMENT.md). |
-| Token (SAC) address | The Stellar Asset Contract subscribers will pay with (e.g. Testnet XLM SAC). |
-| Node.js 18+ / TypeScript | For the examples below. Install `@stellar/stellar-sdk`. |
-| Soroban / Stellar CLI | For CLI walkthroughs (`soroban` / `stellar`). |
+| Token (SAC) address          | The Stellar Asset Contract subscribers will pay with (e.g. Testnet XLM SAC).                                             |
+| Node.js 18+ / TypeScript     | For the examples below. Install `@stellar/stellar-sdk`.                                                                  |
+| Soroban / Stellar CLI        | For CLI walkthroughs (`soroban` / `stellar`).                                                                            |
 
 Install the SDK:
 
@@ -45,10 +45,10 @@ Testnet defaults used throughout this guide:
 
 PayFlow can optionally restrict which addresses may receive subscriptions via a **merchant whitelist**:
 
-| State | Behavior |
-| --- | --- |
-| Whitelist **disabled** (`is_whitelist_enabled() == false`) | Any address can be passed as `merchant` in `subscribe()`. No admin action required. |
-| Whitelist **enabled** | `subscribe()` panics with `ContractError::MerchantNotWhitelisted` unless the merchant was added via `add_merchant()`. |
+| State                                                      | Behavior                                                                                                              |
+| ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| Whitelist **disabled** (`is_whitelist_enabled() == false`) | Any address can be passed as `merchant` in `subscribe()`. No admin action required.                                   |
+| Whitelist **enabled**                                      | `subscribe()` panics with `ContractError::MerchantNotWhitelisted` unless the merchant was added via `add_merchant()`. |
 
 Additionally, admins can **freeze** a merchant (`freeze_merchant`). A frozen merchant cannot accept new subscriptions; check status with `is_merchant_frozen`.
 
@@ -120,7 +120,7 @@ function addressVal(addr: string): xdr.ScVal {
 async function buildTx(
   sourcePublicKey: string,
   method: string,
-  args: xdr.ScVal[]
+  args: xdr.ScVal[],
 ): Promise<string> {
   const account = await server.getAccount(sourcePublicKey);
   const contract = new Contract(CONTRACT_ID);
@@ -146,7 +146,7 @@ async function buildTx(
 async function simulateRead(
   sourcePublicKey: string,
   method: string,
-  args: xdr.ScVal[]
+  args: xdr.ScVal[],
 ): Promise<xdr.ScVal | null> {
   const account = await server.getAccount(sourcePublicKey);
   const contract = new Contract(CONTRACT_ID);
@@ -197,10 +197,10 @@ Amounts are always in **stroops** (1 XLM = 10,000,000 stroops). See [API.md —
 
 There are two related notions:
 
-| Concept | Meaning |
-| --- | --- |
-| **Wallet balance** | After a successful `charge` / `pay_per_use`, the **net** tokens are already in your Stellar account (or fee-recipient address). You can spend them immediately like any other token balance. |
-| **Tracked revenue (`get_merchant_revenue`)** | A persistent on-chain counter of cumulative net revenue. Useful for dashboards and for `withdraw_merchant_revenue`. |
+| Concept                                      | Meaning                                                                                                                                                                                      |
+| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Wallet balance**                           | After a successful `charge` / `pay_per_use`, the **net** tokens are already in your Stellar account (or fee-recipient address). You can spend them immediately like any other token balance. |
+| **Tracked revenue (`get_merchant_revenue`)** | A persistent on-chain counter of cumulative net revenue. Useful for dashboards and for `withdraw_merchant_revenue`.                                                                          |
 
 `withdraw_merchant_revenue` transfers the **tracked** amount from the **contract’s** token balance to the merchant, then resets the counter to zero. It is available when:
 
@@ -219,13 +219,13 @@ Merchants can redirect net proceeds to a different address via `MerchantFeeRecip
 
 ### 3.1 On-chain counters
 
-| Function | Returns | Use |
-| --- | --- | --- |
-| [`get_merchant_sub_count(merchant)`](API.md#get_merchant_sub_count) | `u32` | Active subscriber count for your merchant address. |
-| [`get_merchant_subscriber_count(merchant)`](API.md#get_merchant_subscriber_count) | `u64` | Same underlying `MerchantSubCount` storage (wider type). Prefer either; both stay in sync. |
-| [`get_merchant_revenue(merchant)`](API.md#get_merchant_revenue) | `i128` | Cumulative tracked net revenue in stroops. |
-| [`get_merchant_revenue_history(merchant, days)`](API.md#get_merchant_revenue_history) | `Vec<i128>` | Recent per-charge / daily history entries (oldest → newest). |
-| [`get_merchant_revenue_day(merchant, day)`](API.md#get_merchant_revenue_day) | `i128` | Single day bucket (`day = ledger_timestamp / 86400`). |
+| Function                                                                              | Returns     | Use                                                                                        |
+| ------------------------------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------ |
+| [`get_merchant_sub_count(merchant)`](API.md#get_merchant_sub_count)                   | `u32`       | Active subscriber count for your merchant address.                                         |
+| [`get_merchant_subscriber_count(merchant)`](API.md#get_merchant_subscriber_count)     | `u64`       | Same underlying `MerchantSubCount` storage (wider type). Prefer either; both stay in sync. |
+| [`get_merchant_revenue(merchant)`](API.md#get_merchant_revenue)                       | `i128`      | Cumulative tracked net revenue in stroops.                                                 |
+| [`get_merchant_revenue_history(merchant, days)`](API.md#get_merchant_revenue_history) | `Vec<i128>` | Recent per-charge / daily history entries (oldest → newest).                               |
+| [`get_merchant_revenue_day(merchant, day)`](API.md#get_merchant_revenue_day)          | `i128`      | Single day bucket (`day = ledger_timestamp / 86400`).                                      |
 
 CLI:
 
@@ -297,7 +297,7 @@ for (const row of mine) {
   console.log(
     row.subscriber,
     `amount=${row.amount}`,
-    `next=${new Date(row.nextChargeAt * 1000).toISOString()}`
+    `next=${new Date(row.nextChargeAt * 1000).toISOString()}`,
   );
 }
 ```
@@ -306,13 +306,13 @@ For production-grade cursor pagination, gap detection, and deduplication, follow
 
 ### 3.3 Health checks merchants should run
 
-| Check | Call | Healthy signal |
-| --- | --- | --- |
-| Still whitelisted | `is_merchant_whitelisted` | `true` when whitelist is on |
-| Not frozen | `is_merchant_frozen` | `false` |
-| Contract not paused | `is_contract_paused` | `false` |
-| Subscribers accruing | `get_merchant_sub_count` | Matches your off-chain index |
-| Revenue moving | `get_merchant_revenue` / `charged` events | Increases after keeper cycles |
+| Check                | Call                                      | Healthy signal                |
+| -------------------- | ----------------------------------------- | ----------------------------- |
+| Still whitelisted    | `is_merchant_whitelisted`                 | `true` when whitelist is on   |
+| Not frozen           | `is_merchant_frozen`                      | `false`                       |
+| Contract not paused  | `is_contract_paused`                      | `false`                       |
+| Subscribers accruing | `get_merchant_sub_count`                  | Matches your off-chain index  |
+| Revenue moving       | `get_merchant_revenue` / `charged` events | Increases after keeper cycles |
 
 ---
 
@@ -320,12 +320,12 @@ For production-grade cursor pagination, gap detection, and deduplication, follow
 
 Merchants should subscribe (via RPC polling) to four core events. Full schemas live in [`docs/EVENTS.md`](EVENTS.md).
 
-| Event | Topics | What it means for you | Suggested action |
-| --- | --- | --- | --- |
-| `subscribed` | `["subscribed", user]` | A user just started (or switched to) billing **you**. Payload includes merchant, amount, interval. | Upsert subscriber in your DB; schedule entitlement provisioning; verify `merchant` is your address. |
-| `charged` | `["charged", user]` | A recurring charge succeeded. Payload: `{ merchant, gross, fee, net, charged_at }`. | Credit the user for the billing period; append to revenue ledger; reconcile against `get_merchant_revenue`. |
-| `cancelled` | `["cancelled", user]` | Subscription deactivated. | Revoke access; decrement local active count; stop expecting further charges. |
-| `pay_per_use` | `["pay_per_use", user]` | One-time / metered payment. Payload: `(merchant, amount)`. | Deliver the metered unit of work; update usage counters. |
+| Event         | Topics                  | What it means for you                                                                              | Suggested action                                                                                            |
+| ------------- | ----------------------- | -------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| `subscribed`  | `["subscribed", user]`  | A user just started (or switched to) billing **you**. Payload includes merchant, amount, interval. | Upsert subscriber in your DB; schedule entitlement provisioning; verify `merchant` is your address.         |
+| `charged`     | `["charged", user]`     | A recurring charge succeeded. Payload: `{ merchant, gross, fee, net, charged_at }`.                | Credit the user for the billing period; append to revenue ledger; reconcile against `get_merchant_revenue`. |
+| `cancelled`   | `["cancelled", user]`   | Subscription deactivated.                                                                          | Revoke access; decrement local active count; stop expecting further charges.                                |
+| `pay_per_use` | `["pay_per_use", user]` | One-time / metered payment. Payload: `(merchant, amount)`.                                         | Deliver the metered unit of work; update usage counters.                                                    |
 
 Also watch (ops / risk):
 
@@ -338,7 +338,12 @@ Also watch (ops / risk):
 ```typescript
 /** Poll recent events and handle the merchant-relevant set. */
 export async function pollMerchantEvents(merchant: string, cursor?: string) {
-  const interesting = ["subscribed", "charged", "cancelled", "pay_per_use"] as const;
+  const interesting = [
+    "subscribed",
+    "charged",
+    "cancelled",
+    "pay_per_use",
+  ] as const;
 
   for (const name of interesting) {
     // fetchEvents filters by topic[0] === eventName (see stellar.ts)
@@ -362,7 +367,12 @@ export async function pollMerchantEvents(merchant: string, cursor?: string) {
           console.log("new sub", ev.address, data);
           break;
         case "charged":
-          console.log("charged", ev.address, "net=", data?._value?.net ?? data?.net);
+          console.log(
+            "charged",
+            ev.address,
+            "net=",
+            data?._value?.net ?? data?.net,
+          );
           break;
         case "cancelled":
           console.log("cancelled", ev.address);
@@ -432,7 +442,7 @@ A successful withdrawal emits `merchant_withdrawal` with the amount transferred.
 ```typescript
 /** Build a signable withdraw_merchant_revenue transaction (merchant must sign). */
 export async function buildWithdrawMerchantRevenueTx(
-  merchant: string
+  merchant: string,
 ): Promise<string> {
   return buildTx(merchant, "withdraw_merchant_revenue", [addressVal(merchant)]);
 }
@@ -499,26 +509,26 @@ The deployment has `set_whitelist_enabled(true)` and your address is not in `Mer
 
 ### Why did `withdraw_merchant_revenue` panic?
 
-| Symptom | Cause | Fix |
-| --- | --- | --- |
-| `ZeroBalanceAvailable` (#21) | Tracked revenue ≤ 0 | Wait for charges, or you already withdrew |
-| Auth failure | Wrong signer | Sign as the merchant address |
-| Contract paused | Admin pause | Wait for unpause |
-| Transfer failure | Contract token balance too low | Ensure the contract holds the tracked amount of the initialized token |
+| Symptom                      | Cause                          | Fix                                                                   |
+| ---------------------------- | ------------------------------ | --------------------------------------------------------------------- |
+| `ZeroBalanceAvailable` (#21) | Tracked revenue ≤ 0            | Wait for charges, or you already withdrew                             |
+| Auth failure                 | Wrong signer                   | Sign as the merchant address                                          |
+| Contract paused              | Admin pause                    | Wait for unpause                                                      |
+| Transfer failure             | Contract token balance too low | Ensure the contract holds the tracked amount of the initialized token |
 
 ---
 
 ## 7. Related Docs
 
-| Doc | Why |
-| --- | --- |
-| [`INTEGRATION-GUIDE.md`](INTEGRATION-GUIDE.md) | Subscriber-side subscribe / charge / events |
-| [`API.md`](API.md) | Full contract reference (merchant + admin entrypoints) |
-| [`EVENTS.md`](EVENTS.md) / [`EVENT-DRIVEN-GUIDE.md`](EVENT-DRIVEN-GUIDE.md) | Event schemas and reliable consumption |
-| [`KEEPER.md`](KEEPER.md) | Running the off-chain bill collector merchants depend on |
-| [`SUBSCRIBER-LIFECYCLE.md`](SUBSCRIBER-LIFECYCLE.md) | Trial, pause, cancel, grace semantics |
-| [`ARCHITECTURE.md`](ARCHITECTURE.md) | Storage keys, fee path, module map |
-| [`ERROR-CODES.md`](ERROR-CODES.md) | Numeric contract errors |
-| [`SECURITY.md`](SECURITY.md) | Auth matrix for merchant vs admin calls |
-| [`MULTI-TOKEN.md`](MULTI-TOKEN.md) | Per-subscription tokens and fee recipients |
-| [`DEPLOYMENT.md`](DEPLOYMENT.md) | Deploying / configuring a testnet instance |
+| Doc                                                                         | Why                                                      |
+| --------------------------------------------------------------------------- | -------------------------------------------------------- |
+| [`INTEGRATION-GUIDE.md`](INTEGRATION-GUIDE.md)                              | Subscriber-side subscribe / charge / events              |
+| [`API.md`](API.md)                                                          | Full contract reference (merchant + admin entrypoints)   |
+| [`EVENTS.md`](EVENTS.md) / [`EVENT-DRIVEN-GUIDE.md`](EVENT-DRIVEN-GUIDE.md) | Event schemas and reliable consumption                   |
+| [`KEEPER.md`](KEEPER.md)                                                    | Running the off-chain bill collector merchants depend on |
+| [`SUBSCRIBER-LIFECYCLE.md`](SUBSCRIBER-LIFECYCLE.md)                        | Trial, pause, cancel, grace semantics                    |
+| [`ARCHITECTURE.md`](ARCHITECTURE.md)                                        | Storage keys, fee path, module map                       |
+| [`ERROR-CODES.md`](ERROR-CODES.md)                                          | Numeric contract errors                                  |
+| [`SECURITY.md`](SECURITY.md)                                                | Auth matrix for merchant vs admin calls                  |
+| [`MULTI-TOKEN.md`](MULTI-TOKEN.md)                                          | Per-subscription tokens and fee recipients               |
+| [`DEPLOYMENT.md`](DEPLOYMENT.md)                                            | Deploying / configuring a testnet instance               |
diff --git a/docs/MULTI-TOKEN.md b/docs/MULTI-TOKEN.md
index 08051a60..2158b41e 100644
--- a/docs/MULTI-TOKEN.md
+++ b/docs/MULTI-TOKEN.md
@@ -1,6 +1,6 @@
 # Multi-Token Architecture Guide
 
-This guide explains how PayFlow supports multiple Stellar Asset Contract (SAC) tokens, how that capability is implemented at the storage level, how to deploy and operate it, what it means for protocol fees, how a subscriber switches tokens, and — just as importantly — what it does *not* do.
+This guide explains how PayFlow supports multiple Stellar Asset Contract (SAC) tokens, how that capability is implemented at the storage level, how to deploy and operate it, what it means for protocol fees, how a subscriber switches tokens, and — just as importantly — what it does _not_ do.
 
 If you only need the mechanics of approving an allowance and subscribing with a specific token, jump to [Subscribing with Custom Tokens](#subscribing-with-custom-tokens) and the [Full CLI Walkthrough](#full-cli-walkthrough). If you're deciding how to deploy PayFlow for a multi-token product, read [Architecture](#architecture-per-subscription-tokens) and [Deployment Models](#deployment-models) first.
 
@@ -112,7 +112,7 @@ if token.clone().to_xdr(env).get(7) == Some(0) {
 }
 ```
 
-This check confirms the address is *shaped like* a contract address. It does **not** verify the contract actually implements the token interface, has been initialized, or is a genuine SAC rather than an arbitrary Soroban contract — that failure mode surfaces later, as a panic inside `check_allowance()` or the first `transfer_from()`, when the non-token contract's `allowance`/`transfer_from` entry points don't exist or misbehave.
+This check confirms the address is _shaped like_ a contract address. It does **not** verify the contract actually implements the token interface, has been initialized, or is a genuine SAC rather than an arbitrary Soroban contract — that failure mode surfaces later, as a panic inside `check_allowance()` or the first `transfer_from()`, when the non-token contract's `allowance`/`transfer_from` entry points don't exist or misbehave.
 
 ---
 
@@ -133,7 +133,7 @@ Deploy one FlowPay contract instance. Subscribers choose their own `token` per `
 **Cons:**
 
 - The admin, `fee_collector`, and every merchant must be prepared to receive and manage balances in however many distinct tokens their subscribers choose. There is no on-chain aggregation across tokens (see [Fee Implications](#fee-implications)).
-- A bug or pause (`pause_contract()`) affects subscribers across *all* tokens simultaneously, since it's one instance.
+- A bug or pause (`pause_contract()`) affects subscribers across _all_ tokens simultaneously, since it's one instance.
 - Per-token analytics (e.g., "total USDC-denominated revenue") must be computed off-chain by filtering `charged` events on the token address emitted in `subscribe`/`subscribed` events, since `merchant_stats.rs` revenue counters are token-agnostic integers.
 
 ### Model B: Separate contract instance per base token
@@ -154,12 +154,12 @@ Deploy multiple FlowPay instances (`soroban contract deploy` once per instance),
 
 ### Choosing between them
 
-| | Model A: single instance | Model B: per-token instances |
-| --- | --- | --- |
-| Contract deployments | 1 | N |
-| Subscriber can mix tokens freely | Yes, per-subscription | No — must pick an instance |
-| Admin/whitelist/grace period scope | Shared across all tokens | Isolated per token |
-| Best for | Consumer apps where users bring their own token | Businesses that want strict per-asset isolation (e.g., regulatory reasons) |
+|                                    | Model A: single instance                        | Model B: per-token instances                                               |
+| ---------------------------------- | ----------------------------------------------- | -------------------------------------------------------------------------- |
+| Contract deployments               | 1                                               | N                                                                          |
+| Subscriber can mix tokens freely   | Yes, per-subscription                           | No — must pick an instance                                                 |
+| Admin/whitelist/grace period scope | Shared across all tokens                        | Isolated per token                                                         |
+| Best for                           | Consumer apps where users bring their own token | Businesses that want strict per-asset isolation (e.g., regulatory reasons) |
 
 Nothing prevents combining them: deploy a handful of instances for tokens you want isolated (e.g., a regulated stablecoin), while letting a shared "general" instance accept anything else.
 
@@ -188,17 +188,17 @@ token_client.transfer_from(&env.current_contract_address(), user, &collector, &f
 
 Assume `fee_bps = 250` (2.5%) and `fee_collector = F`.
 
-| Subscriber | `sub.token` | `sub.amount` | Fee transferred to `F` | Net to merchant |
-| --- | --- | --- | --- | --- |
-| Alice | USDC SAC | 100.0000000 USDC | 2.5000000 USDC | 97.5000000 USDC |
-| Bob | XLM SAC | 50.0000000 XLM | 1.2500000 XLM | 48.7500000 XLM |
-| Carol | REWARD SAC | 1000.0000000 REWARD | 25.0000000 REWARD | 975.0000000 REWARD |
+| Subscriber | `sub.token` | `sub.amount`        | Fee transferred to `F` | Net to merchant    |
+| ---------- | ----------- | ------------------- | ---------------------- | ------------------ |
+| Alice      | USDC SAC    | 100.0000000 USDC    | 2.5000000 USDC         | 97.5000000 USDC    |
+| Bob        | XLM SAC     | 50.0000000 XLM      | 1.2500000 XLM          | 48.7500000 XLM     |
+| Carol      | REWARD SAC  | 1000.0000000 REWARD | 25.0000000 REWARD      | 975.0000000 REWARD |
 
 `F` ends up holding balances in three unrelated tokens. **PayFlow never converts, swaps, or nets these against each other** — `get_fee(env) -> Option<(Address, u32)>` returns one collector address and one bps value for the whole contract; it has no per-token override. If you need per-token fee rates or per-token fee collectors, that requires either Deployment Model B (a separate instance, and therefore a separate `propose_fee`/`commit_fee` pair, per token) or a contract change — it is not configurable today.
 
 ### Merchant-level fee recipient override
 
-Independently of the token, a merchant can redirect *their own* net proceeds to a different address via `DataKey::MerchantFeeRecipient(merchant)`:
+Independently of the token, a merchant can redirect _their own_ net proceeds to a different address via `DataKey::MerchantFeeRecipient(merchant)`:
 
 ```rust
 let merchant_dest: Address = env
@@ -226,7 +226,7 @@ let should_increment = existing.as_ref().is_none_or(|s| !s.active);
 Practical implications:
 
 1. **All fields reset, not just `token`.** You must resupply `merchant`, `amount`, `interval`, `trial_period`, and `referrer` (referral is actually preserved separately via `DataKey::Referral`, immutable after first write — see the [lifecycle spec](./spec/lifecycle_spec.md#referral-data) — but `amount`/`interval`/`trial_period` are not carried over from the old record). There's no partial "just update the token" call.
-2. **A new allowance is required.** The subscriber must call `approve()` on the *new* token contract before the new `subscribe()` call, or it fails with `ContractError::InsufficientAllowance`. The allowance previously granted on the *old* token is untouched by this call — it isn't revoked automatically. If you want to stop the contract from being able to pull the old token, the subscriber should separately reduce that allowance to zero on the old token contract.
+2. **A new allowance is required.** The subscriber must call `approve()` on the _new_ token contract before the new `subscribe()` call, or it fails with `ContractError::InsufficientAllowance`. The allowance previously granted on the _old_ token is untouched by this call — it isn't revoked automatically. If you want to stop the contract from being able to pull the old token, the subscriber should separately reduce that allowance to zero on the old token contract.
 3. **Charge history and cancellation state are token-agnostic and persist.** `ChargeHistory(user)` and `SubscriptionMeta(user)` are keyed by user address, not by token, so switching tokens does not reset or fork your charge history — old charges recorded in the old token remain in the same paged history alongside new charges in the new token, with no field distinguishing which token each timestamp was charged in. If you need per-token charge auditing, reconstruct it off-chain from `charged` events (which do include `sub.token` implicitly via the subscription state at charge time) rather than from `get_charge_history_page`.
 4. **`active_count` is not double-counted.** Because the subscriber already had an active subscription, `should_increment` evaluates to `false`, so switching tokens does not inflate `ActiveCount`.
 
@@ -410,7 +410,14 @@ soroban contract invoke \
 ### TypeScript: subscribing with an explicit token
 
 ```typescript
-import { Contract, TransactionBuilder, BASE_FEE, nativeToScVal, Address, xdr } from "@stellar/stellar-sdk";
+import {
+  Contract,
+  TransactionBuilder,
+  BASE_FEE,
+  nativeToScVal,
+  Address,
+  xdr,
+} from "@stellar/stellar-sdk";
 import { server, CONTRACT_ID, NETWORK_PASSPHRASE } from "./stellar";
 
 function addressVal(addr: string): xdr.ScVal {
@@ -423,7 +430,7 @@ async function subscribeWithToken(
   merchant: string,
   amountStroops: bigint,
   intervalSeconds: number,
-  tokenAddress: string
+  tokenAddress: string,
 ): Promise<string> {
   const contract = new Contract(CONTRACT_ID);
   const account = await server.getAccount(user);
@@ -441,8 +448,8 @@ async function subscribeWithToken(
         nativeToScVal(intervalSeconds, { type: "u64" }),
         addressVal(tokenAddress), // per-subscription token — see Architecture above
         nativeToScVal(null, { type: "option" }), // trial_period: None
-        nativeToScVal(null, { type: "option" })  // referrer: None
-      )
+        nativeToScVal(null, { type: "option" }), // referrer: None
+      ),
     )
     .setTimeout(30)
     .build();
@@ -460,5 +467,5 @@ async function subscribeWithToken(
 
 - All amounts are in stroops (the smallest unit of whichever token is in use — decimal precision is defined by that token's contract, typically 7 for SAC-wrapped classic assets).
 - The protocol fee, if enabled, is always charged in the same token as the subscription it's deducted from (see [Fee Implications](#fee-implications)).
-- A single user address can hold multiple independent subscriptions to different merchants, each with its own token — the one-subscription-per-user limit is per `(user)` key, so a second `subscribe()` call to a *different* merchant while the first is still active is what [Switching Tokens](#switching-tokens) describes; PayFlow does not key subscriptions by `(user, merchant)`, so there is exactly one active `Subscription` slot per user at a time.
+- A single user address can hold multiple independent subscriptions to different merchants, each with its own token — the one-subscription-per-user limit is per `(user)` key, so a second `subscribe()` call to a _different_ merchant while the first is still active is what [Switching Tokens](#switching-tokens) describes; PayFlow does not key subscriptions by `(user, merchant)`, so there is exactly one active `Subscription` slot per user at a time.
 - The token address must be a valid SAC contract, not a classic Stellar asset issuer/asset-code pair (see [Token address validation](#token-address-validation)).
diff --git a/docs/ONBOARDING.md b/docs/ONBOARDING.md
index c7652a7b..7dd7354f 100644
--- a/docs/ONBOARDING.md
+++ b/docs/ONBOARDING.md
@@ -3,6 +3,7 @@
 Welcome! This guide walks you from "I just heard about FlowPay" to "my first PR is open," assuming only general Rust and TypeScript experience — no prior Soroban, Stellar, or smart-contract background required.
 
 This is a narrative walkthrough. For reference material once you're up and running, see:
+
 - [`CONTRIBUTING.md`](../CONTRIBUTING.md) — full contribution reference (branching, commit style, PR checklist)
 - [`docs/CONTRIBUTING-CONTRACT.md`](CONTRIBUTING-CONTRACT.md) — contract/Rust conventions in depth
 - [`docs/CONTRIBUTING-FRONTEND.md`](CONTRIBUTING-FRONTEND.md) — frontend/React conventions in depth
@@ -275,7 +276,7 @@ Cross-check [`docs/CONTRIBUTING-CONTRACT.md`](CONTRIBUTING-CONTRACT.md) — it h
 - A new contract function that doesn't call `user.require_auth()` before mutating state.
 - Frontend component importing `@stellar/stellar-sdk` directly instead of going through `src/stellar.ts`.
 - Documentation added without updating the corresponding reference doc (e.g., a new event not added to [`docs/EVENTS.md`](EVENTS.md)).
-- PR description too thin to understand *why* the change was made.
+- PR description too thin to understand _why_ the change was made.
 
 ### PR checklist
 
@@ -285,12 +286,12 @@ Before opening, run through [`CONTRIBUTING.md`](../CONTRIBUTING.md#pull-request-
 
 ## 6. Troubleshooting
 
-| Problem | Likely cause | Fix |
-|---|---|---|
-| `error[E0463]: can't find crate for 'core'` (or similar) when building the contract | Missing the `wasm32-unknown-unknown` target | `rustup target add wasm32-unknown-unknown` |
-| `cargo test` fails with `unresolved import` or dependency errors right after cloning | Stale/partial `Cargo.lock` or first-time dependency download interrupted | `cd contract && cargo clean && cargo test` |
-| `npm run test` / `npm run build` fails immediately with module-not-found errors | `npm install` wasn't run, or was run in the wrong directory | Make sure you're in `frontend/` (not repo root) before running `npm install` |
-| `cargo clippy -- -D warnings` fails on code you didn't touch | You're on a stale `master` that predates a clippy/toolchain update | `git fetch origin && git rebase origin/master` |
-| Frontend dev server starts but the UI shows contract errors / can't fetch data | `VITE_CONTRACT_ID` not set (or points at a contract that isn't deployed on the network your `VITE_RPC_URL` targets) | Follow [`docs/DEPLOYMENT.md`](DEPLOYMENT.md) to deploy a testnet contract, then set `.env.local` accordingly — or skip running the live UI if your change doesn't need it |
+| Problem                                                                              | Likely cause                                                                                                        | Fix                                                                                                                                                                       |
+| ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `error[E0463]: can't find crate for 'core'` (or similar) when building the contract  | Missing the `wasm32-unknown-unknown` target                                                                         | `rustup target add wasm32-unknown-unknown`                                                                                                                                |
+| `cargo test` fails with `unresolved import` or dependency errors right after cloning | Stale/partial `Cargo.lock` or first-time dependency download interrupted                                            | `cd contract && cargo clean && cargo test`                                                                                                                                |
+| `npm run test` / `npm run build` fails immediately with module-not-found errors      | `npm install` wasn't run, or was run in the wrong directory                                                         | Make sure you're in `frontend/` (not repo root) before running `npm install`                                                                                              |
+| `cargo clippy -- -D warnings` fails on code you didn't touch                         | You're on a stale `master` that predates a clippy/toolchain update                                                  | `git fetch origin && git rebase origin/master`                                                                                                                            |
+| Frontend dev server starts but the UI shows contract errors / can't fetch data       | `VITE_CONTRACT_ID` not set (or points at a contract that isn't deployed on the network your `VITE_RPC_URL` targets) | Follow [`docs/DEPLOYMENT.md`](DEPLOYMENT.md) to deploy a testnet contract, then set `.env.local` accordingly — or skip running the live UI if your change doesn't need it |
 
 If you hit something not covered here, open a GitHub Discussion or comment on your issue — see [Questions](../CONTRIBUTING.md#questions) in `CONTRIBUTING.md`.
diff --git a/docs/REFERRAL.md b/docs/REFERRAL.md
index 70784862..ff9c7cfd 100644
--- a/docs/REFERRAL.md
+++ b/docs/REFERRAL.md
@@ -20,6 +20,7 @@ For the full architecture, fee/payout mechanics, referral link workflows, and Ty
 ## How Referral Tracking Works
 
 PayFlow includes a simple, built-in referral tracking system:
+
 - Stores a referrer address for each subscriber
 - Emits an event when a referred user subscribes
 - Prevents self-referrals
@@ -34,6 +35,7 @@ Referral data is stored in persistent storage under `DataKey::Referral(user_addr
 To track referrals, pass the referrer address in the `referrer` parameter when calling `subscribe()`.
 
 ### Key Points:
+
 - `referrer` is optional (can be `null`)
 - If provided, the referrer cannot be the same as the user (self-referrals are not allowed)
 - If a user re-subscribes with a new referrer, it replaces the old one
@@ -50,6 +52,7 @@ pub fn get_referrer(env: Env, user: Address) -> Option<Address>
 ```
 
 This returns:
+
 - `Some(referrer_address)` if a referrer was recorded
 - `None` if no referrer was recorded (or it was cleared)
 
@@ -60,6 +63,7 @@ This returns:
 When a user subscribes with a referrer, PayFlow emits a `referred` event:
 
 ### Event Details:
+
 - **Event Name**: `referred`
 - **Topic Keys**: `["referred", user_address]`
 - **Payload Schema**: `referrer: Address`
@@ -78,16 +82,19 @@ When a user subscribes with a referrer, PayFlow emits a `referred` event:
 PayFlow's referral tracking is a building block - you can build your own custom referral reward system on top of it. Here are some ideas:
 
 ### Example 1: One-Time Signup Bonus
+
 1. Listen for `referred` events
 2. When a new user subscribes with a referrer, send a bonus token to the referrer
 3. Optional: Require the new user to make their first payment before rewarding the referrer
 
 ### Example 2: Recurring Commission
+
 1. Listen for `charged` events
 2. For each charge, check if the user has a referrer using `get_referrer()`
 3. If they do, send a percentage of the charged amount to the referrer as commission
 
 ### Example 3: Tiered Rewards
+
 - Track how many referrals each referrer has made
 - Give higher commission rates for referrers with more referrals
 
diff --git a/docs/REFERRALS.md b/docs/REFERRALS.md
index 5bcdd892..45542fe5 100644
--- a/docs/REFERRALS.md
+++ b/docs/REFERRALS.md
@@ -29,13 +29,13 @@ A shorter usage overview also lives in [`REFERRAL.md`](./REFERRAL.md). For stora
 
 PayFlow's referral feature is an **on-chain attribution layer**, not an on-chain reward vault.
 
-| Concern | On-chain? | Where |
-| --- | --- | --- |
-| Record who referred a subscriber | Yes | `DataKey::Referral(user)` + `Subscription.referrer` |
-| Emit attribution event | Yes | `referred` event |
-| Reject self-referral | Yes | `ContractError::SelfReferral` (code `11`) |
-| Split protocol fees to a fee collector | Yes | `fee.rs` (`FeeCollector` / `FeeBps`) — **not** referrer-aware |
-| Pay referrer bonuses / commissions | **No** | Off-chain (or a separate reward contract) using events + `get_referrer` |
+| Concern                                | On-chain? | Where                                                                   |
+| -------------------------------------- | --------- | ----------------------------------------------------------------------- |
+| Record who referred a subscriber       | Yes       | `DataKey::Referral(user)` + `Subscription.referrer`                     |
+| Emit attribution event                 | Yes       | `referred` event                                                        |
+| Reject self-referral                   | Yes       | `ContractError::SelfReferral` (code `11`)                               |
+| Split protocol fees to a fee collector | Yes       | `fee.rs` (`FeeCollector` / `FeeBps`) — **not** referrer-aware           |
+| Pay referrer bonuses / commissions     | **No**    | Off-chain (or a separate reward contract) using events + `get_referrer` |
 
 The contract stores a single optional referrer address per subscriber and emits a `referred` event when that address is set. Integrators use that attribution signal to run signup bonuses, recurring commissions, or tiered rewards outside the core FlowPay transfer path.
 
@@ -66,13 +66,13 @@ The contract stores a single optional referrer address per subscriber and emits
 
 ### Module responsibilities
 
-| Layer | Responsibility |
-| --- | --- |
-| `contract/src/referral.rs` | Store, read, and clear `DataKey::Referral(user)`; reject self-referral; emit `referred`. |
-| `contract/src/lib.rs` (`subscribe_inner`, `cancel_inner`) | Pass `referrer` into storage on subscribe; remove referral on cancel; expose `get_referrer`. |
-| `contract/src/events.rs` | `publish_referred(env, user, referrer)`. |
-| Frontend / integrator | Resolve a referral **code or link** to a Stellar address; pass it as `referrer` on subscribe. |
-| Off-chain rewards service | Index `referred` / `charged` events; compute commissions; pay referrers. |
+| Layer                                                     | Responsibility                                                                                |
+| --------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
+| `contract/src/referral.rs`                                | Store, read, and clear `DataKey::Referral(user)`; reject self-referral; emit `referred`.      |
+| `contract/src/lib.rs` (`subscribe_inner`, `cancel_inner`) | Pass `referrer` into storage on subscribe; remove referral on cancel; expose `get_referrer`.  |
+| `contract/src/events.rs`                                  | `publish_referred(env, user, referrer)`.                                                      |
+| Frontend / integrator                                     | Resolve a referral **code or link** to a Stellar address; pass it as `referrer` on subscribe. |
+| Off-chain rewards service                                 | Index `referred` / `charged` events; compute commissions; pay referrers.                      |
 
 ---
 
@@ -85,13 +85,13 @@ The contract stores a single optional referrer address per subscriber and emits
 Referral(Address), // keyed by subscriber (referred user)
 ```
 
-| Property | Value |
-| --- | --- |
-| Storage type | **Persistent** |
-| Value type | `Address` (the referrer) |
-| Written by | `referral::store_referral` during `subscribe` / `subscribe_with_metadata` |
-| Removed by | `referral::remove_referral` during `cancel` / `cancel_and_refund_prorated`, or `store_referral(..., None)` on resubscribe |
-| Read by | `get_referrer(user)` and off-chain indexers |
+| Property     | Value                                                                                                                     |
+| ------------ | ------------------------------------------------------------------------------------------------------------------------- |
+| Storage type | **Persistent**                                                                                                            |
+| Value type   | `Address` (the referrer)                                                                                                  |
+| Written by   | `referral::store_referral` during `subscribe` / `subscribe_with_metadata`                                                 |
+| Removed by   | `referral::remove_referral` during `cancel` / `cancel_and_refund_prorated`, or `store_referral(..., None)` on resubscribe |
+| Read by      | `get_referrer(user)` and off-chain indexers                                                                               |
 
 ### Subscription struct field
 
@@ -167,12 +167,12 @@ Both funnel into `subscribe_inner`, which calls `referral::store_referral`.
 
 ### 4. Events
 
-| Event | Topics | Payload | When |
-| --- | --- | --- | --- |
-| `referred` | `("referred", user)` | `referrer: Address` | Referrer successfully stored on subscribe |
-| `subscribed` | `("subscribed", user)` | subscription fields | Every successful subscribe |
-| `charged` | `("charged", user)` | `(merchant, amount, timestamp)` | Successful recurring charge — used for recurring commissions |
-| `cancelled` | `("cancelled", user)` | `()` | Subscription cancelled |
+| Event        | Topics                 | Payload                         | When                                                         |
+| ------------ | ---------------------- | ------------------------------- | ------------------------------------------------------------ |
+| `referred`   | `("referred", user)`   | `referrer: Address`             | Referrer successfully stored on subscribe                    |
+| `subscribed` | `("subscribed", user)` | subscription fields             | Every successful subscribe                                   |
+| `charged`    | `("charged", user)`    | `(merchant, amount, timestamp)` | Successful recurring charge — used for recurring commissions |
+| `cancelled`  | `("cancelled", user)`  | `()`                            | Subscription cancelled                                       |
 
 ---
 
@@ -232,10 +232,10 @@ charged(user, amount)
 
 Example numbers (off-chain, not enforced by FlowPay):
 
-| Charge amount | Commission bps | Payout to referrer |
-| --- | --- | --- |
-| 50_0000000 stroops (50 XLM) | 500 (5%) | 2_5000000 stroops |
-| 10_0000000 stroops (10 XLM) | 250 (2.5%) | 2500000 stroops |
+| Charge amount               | Commission bps | Payout to referrer |
+| --------------------------- | -------------- | ------------------ |
+| 50_0000000 stroops (50 XLM) | 500 (5%)       | 2_5000000 stroops  |
+| 10_0000000 stroops (10 XLM) | 250 (2.5%)     | 2500000 stroops    |
 
 #### Model C — Tiered rewards
 
@@ -315,12 +315,12 @@ const referrer = await resolveReferrer(code);
 
 ### Step 6 — Track conversions
 
-| Signal | Use |
-| --- | --- |
-| Landing with `?ref=` | Click / visit analytics |
-| Successful `subscribe` + `referred` event | Attribution confirmed on-chain |
-| First `charged` event | Paid conversion (recommended for rewards) |
-| `get_referrer(user)` | Ad-hoc lookup / support tooling |
+| Signal                                    | Use                                       |
+| ----------------------------------------- | ----------------------------------------- |
+| Landing with `?ref=`                      | Click / visit analytics                   |
+| Successful `subscribe` + `referred` event | Attribution confirmed on-chain            |
+| First `charged` event                     | Paid conversion (recommended for rewards) |
+| `get_referrer(user)`                      | Ad-hoc lookup / support tooling           |
 
 ### Validation checklist for links
 
@@ -347,9 +347,9 @@ subscribe(
 )
 ```
 
-| Parameter | Type | Referral role |
-| --- | --- | --- |
-| `user` | `Address` | Subscriber (must sign). Cannot equal `referrer`. |
+| Parameter  | Type              | Referral role                                                              |
+| ---------- | ----------------- | -------------------------------------------------------------------------- |
+| `user`     | `Address`         | Subscriber (must sign). Cannot equal `referrer`.                           |
 | `referrer` | `Option<Address>` | Optional referrer to store. `None` clears any prior referral on overwrite. |
 
 Auth: `user.require_auth()`.
@@ -372,9 +372,9 @@ Same referral semantics as `subscribe`, with an additional `label: String` (max
 get_referrer(env: Env, user: Address) -> Option<Address>
 ```
 
-| Parameter | Type | Description |
-| --- | --- | --- |
-| `user` | `Address` | Subscriber whose referrer to look up |
+| Parameter | Type      | Description                          |
+| --------- | --------- | ------------------------------------ |
+| `user`    | `Address` | Subscriber whose referrer to look up |
 
 Auth: none.
 
@@ -382,11 +382,11 @@ Returns: `Some(referrer)` if `DataKey::Referral(user)` exists; `None` otherwise
 
 ### Internal helpers (not public entry points)
 
-| Function | Module | Behavior |
-| --- | --- | --- |
-| `store_referral` | `referral.rs` | Set or clear referral; emit `referred` when set |
-| `get_referrer` | `referral.rs` | Persistent read |
-| `remove_referral` | `referral.rs` | Delete key (used by cancel) |
+| Function          | Module        | Behavior                                        |
+| ----------------- | ------------- | ----------------------------------------------- |
+| `store_referral`  | `referral.rs` | Set or clear referral; emit `referred` when set |
+| `get_referrer`    | `referral.rs` | Persistent read                                 |
+| `remove_referral` | `referral.rs` | Delete key (used by cancel)                     |
 
 ---
 
@@ -514,13 +514,13 @@ function optionAddress(addr: string | null): xdr.ScVal {
   }
   return nativeToScVal(
     { tag: "Some", val: addressVal(addr) },
-    { type: "option" }
+    { type: "option" },
   );
 }
 
 /** Read ?ref= and map to a Stellar address via your backend. */
 export async function referrerFromUrl(
-  lookup: (code: string) => Promise<string | null>
+  lookup: (code: string) => Promise<string | null>,
 ): Promise<string | null> {
   const code =
     new URLSearchParams(window.location.search).get("ref") ??
@@ -547,8 +547,11 @@ export async function buildSubscribeWithReferrer(params: {
     params.trialPeriodSec == null
       ? nativeToScVal(null, { type: "option" })
       : nativeToScVal(
-          { tag: "Some", val: nativeToScVal(params.trialPeriodSec, { type: "u64" }) },
-          { type: "option" }
+          {
+            tag: "Some",
+            val: nativeToScVal(params.trialPeriodSec, { type: "u64" }),
+          },
+          { type: "option" },
         );
 
   const tx = new TransactionBuilder(account, {
@@ -564,8 +567,8 @@ export async function buildSubscribeWithReferrer(params: {
         nativeToScVal(params.intervalSec, { type: "u64" }),
         addressVal(params.token),
         trial,
-        optionAddress(params.referrer)
-      )
+        optionAddress(params.referrer),
+      ),
     )
     .setTimeout(30)
     .build();
@@ -589,7 +592,7 @@ async function subscribeWithReferral(
   amountXlm: number,
   intervalSec: number,
   referrerAddress: string | null,
-  onSign: (xdr: string) => Promise<string>
+  onSign: (xdr: string) => Promise<string>,
 ) {
   const stroops = BigInt(Math.round(amountXlm * 10_000_000));
   const xdr = await buildSubscribeTx(
@@ -599,7 +602,7 @@ async function subscribeWithReferral(
     BigInt(intervalSec),
     DEFAULT_TOKEN,
     referrerAddress, // null = no referral
-    "" // label / symbol placeholder used by current helper
+    "", // label / symbol placeholder used by current helper
   );
   return onSign(xdr);
 }
@@ -695,8 +698,8 @@ Pipeline:
 
 ## Error Handling
 
-| Code | Name | Cause | Integrator action |
-| --- | --- | --- | --- |
+| Code | Name           | Cause                           | Integrator action                                  |
+| ---- | -------------- | ------------------------------- | -------------------------------------------------- |
 | `11` | `SelfReferral` | `referrer == user` in subscribe | Drop self codes; show “You cannot refer yourself.” |
 
 See [`ERROR-CODES.md`](./ERROR-CODES.md) for the full catalog.
@@ -715,17 +718,17 @@ See [`ERROR-CODES.md`](./ERROR-CODES.md) for the full catalog.
 
 ## Related Source Files
 
-| Path | Role |
-| --- | --- |
-| [`contract/src/referral.rs`](../contract/src/referral.rs) | Store / get / remove referral; self-referral check; event |
-| [`contract/src/lib.rs`](../contract/src/lib.rs) | `subscribe`, `get_referrer`, `DataKey::Referral`, `Subscription.referrer` |
-| [`contract/src/events.rs`](../contract/src/events.rs) | `publish_referred` |
-| [`contract/src/errors.rs`](../contract/src/errors.rs) | `SelfReferral = 11` |
-| [`contract/src/fee.rs`](../contract/src/fee.rs) | Protocol fee split (not referrer-aware) |
-| [`frontend/src/stellar.ts`](../frontend/src/stellar.ts) | `buildSubscribeTx(..., referrer, ...)` |
-| [`docs/REFERRAL.md`](./REFERRAL.md) | Short usage guide |
-| [`docs/EVENTS.md`](./EVENTS.md) | `referred` event schema |
-| [`docs/API.md`](./API.md) | Full API reference |
+| Path                                                      | Role                                                                      |
+| --------------------------------------------------------- | ------------------------------------------------------------------------- |
+| [`contract/src/referral.rs`](../contract/src/referral.rs) | Store / get / remove referral; self-referral check; event                 |
+| [`contract/src/lib.rs`](../contract/src/lib.rs)           | `subscribe`, `get_referrer`, `DataKey::Referral`, `Subscription.referrer` |
+| [`contract/src/events.rs`](../contract/src/events.rs)     | `publish_referred`                                                        |
+| [`contract/src/errors.rs`](../contract/src/errors.rs)     | `SelfReferral = 11`                                                       |
+| [`contract/src/fee.rs`](../contract/src/fee.rs)           | Protocol fee split (not referrer-aware)                                   |
+| [`frontend/src/stellar.ts`](../frontend/src/stellar.ts)   | `buildSubscribeTx(..., referrer, ...)`                                    |
+| [`docs/REFERRAL.md`](./REFERRAL.md)                       | Short usage guide                                                         |
+| [`docs/EVENTS.md`](./EVENTS.md)                           | `referred` event schema                                                   |
+| [`docs/API.md`](./API.md)                                 | Full API reference                                                        |
 
 ---
 
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 8a965522..a95d2ae7 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -54,44 +54,44 @@ The contract is built to fail closed. If a precondition is violated, the call pa
 
 ## Auth Model
 
-| Function | Required signer |
-| --- | --- |
-| `subscribe()` | `user` |
-| `subscribe_with_metadata()` | `user` |
-| `charge()` | None |
-| `extend_subscription_ttl()` | None |
-| `pay_per_use()` | `user` |
-| `cancel()` | `user` |
-| `pause()` | `user` |
-| `resume()` | `user` |
-| `transfer_admin()` | current admin |
-| `accept_admin()` | pending admin |
-| `upgrade()` | current implementation does not enforce a signer in the wrapper |
-| `set_subscription_amount()` | admin |
-| `set_subscription_interval()` | admin |
-| `set_min_interval()` | admin |
-| `add_merchant()` | admin |
-| `remove_merchant()` | admin |
-| `set_whitelist_enabled()` | admin |
-| `freeze_merchant()` | admin |
-| `unfreeze_merchant()` | admin |
-| `propose_fee()` | admin |
-| `commit_fee()` | admin |
-| `propose_grace_period()` | admin |
-| `commit_grace_period()` | admin |
-| `withdraw_merchant_revenue()` | merchant |
-| `set_daily_limit()` | `user` |
-| `remove_daily_limit()` | `user` |
-| `set_metadata()` | `user` |
-| `clear_metadata()` | `user` |
-| `clear_charge_history()` | `user` |
-| `transfer_subscription()` | `user` |
-| read-only getters | none |
-| `pause_contract()` / `unpause_contract()` | admin |
-| `clear_merchant_revenue_history()` | admin |
-| `reset_merchant_revenue()` | admin |
-| `set_initial_admin()` | none |
-| `migrate()` | none |
+| Function                                  | Required signer                                                 |
+| ----------------------------------------- | --------------------------------------------------------------- |
+| `subscribe()`                             | `user`                                                          |
+| `subscribe_with_metadata()`               | `user`                                                          |
+| `charge()`                                | None                                                            |
+| `extend_subscription_ttl()`               | None                                                            |
+| `pay_per_use()`                           | `user`                                                          |
+| `cancel()`                                | `user`                                                          |
+| `pause()`                                 | `user`                                                          |
+| `resume()`                                | `user`                                                          |
+| `transfer_admin()`                        | current admin                                                   |
+| `accept_admin()`                          | pending admin                                                   |
+| `upgrade()`                               | current implementation does not enforce a signer in the wrapper |
+| `set_subscription_amount()`               | admin                                                           |
+| `set_subscription_interval()`             | admin                                                           |
+| `set_min_interval()`                      | admin                                                           |
+| `add_merchant()`                          | admin                                                           |
+| `remove_merchant()`                       | admin                                                           |
+| `set_whitelist_enabled()`                 | admin                                                           |
+| `freeze_merchant()`                       | admin                                                           |
+| `unfreeze_merchant()`                     | admin                                                           |
+| `propose_fee()`                           | admin                                                           |
+| `commit_fee()`                            | admin                                                           |
+| `propose_grace_period()`                  | admin                                                           |
+| `commit_grace_period()`                   | admin                                                           |
+| `withdraw_merchant_revenue()`             | merchant                                                        |
+| `set_daily_limit()`                       | `user`                                                          |
+| `remove_daily_limit()`                    | `user`                                                          |
+| `set_metadata()`                          | `user`                                                          |
+| `clear_metadata()`                        | `user`                                                          |
+| `clear_charge_history()`                  | `user`                                                          |
+| `transfer_subscription()`                 | `user`                                                          |
+| read-only getters                         | none                                                            |
+| `pause_contract()` / `unpause_contract()` | admin                                                           |
+| `clear_merchant_revenue_history()`        | admin                                                           |
+| `reset_merchant_revenue()`                | admin                                                           |
+| `set_initial_admin()`                     | none                                                            |
+| `migrate()`                               | none                                                            |
 
 The current contract uses a mix of direct `require_auth()` checks and admin helper enforcement. That is intentional, but the auth path should be reviewed whenever a new public function is added.
 
diff --git a/docs/STRUCTURE.md b/docs/STRUCTURE.md
index 5c084435..3f2158fe 100644
--- a/docs/STRUCTURE.md
+++ b/docs/STRUCTURE.md
@@ -44,28 +44,28 @@ Defines the package metadata and dependencies:
 
 The main contract file. Contains:
 
-| Item | Kind | Description |
-| --- | --- | --- |
-| `DataKey` | `enum` | Storage key variants: `Subscription(Address)` and `Token` |
-| `Subscription` | `struct` | Per-user subscription data: merchant, amount, interval, last_charged, active |
-| `FlowPay` | `struct` | The contract entry point (tagged `#[contract]`) |
-| `initialize()` | function | One-time setup — stores the token address |
-| `subscribe()` | function | Creates/updates a subscription |
-| `charge()` | function | Permissionless — triggers a recurring charge |
-| `pay_per_use()` | function | Instant microtransaction |
-| `cancel()` | function | Deactivates a subscription |
-| `get_subscription()` | function | Read-only view |
+| Item                 | Kind     | Description                                                                  |
+| -------------------- | -------- | ---------------------------------------------------------------------------- |
+| `DataKey`            | `enum`   | Storage key variants: `Subscription(Address)` and `Token`                    |
+| `Subscription`       | `struct` | Per-user subscription data: merchant, amount, interval, last_charged, active |
+| `FlowPay`            | `struct` | The contract entry point (tagged `#[contract]`)                              |
+| `initialize()`       | function | One-time setup — stores the token address                                    |
+| `subscribe()`        | function | Creates/updates a subscription                                               |
+| `charge()`           | function | Permissionless — triggers a recurring charge                                 |
+| `pay_per_use()`      | function | Instant microtransaction                                                     |
+| `cancel()`           | function | Deactivates a subscription                                                   |
+| `get_subscription()` | function | Read-only view                                                               |
 
 ### `contract/src/test.rs`
 
 Unit tests using the Soroban test environment. Contains:
 
-| Item | Description |
-| --- | --- |
-| `setup()` | Shared helper — deploys token + contract, mints tokens, approves allowance |
-| `test_subscribe_and_charge` | Happy path: subscribe → advance time → charge |
-| `test_cancel` | Verifies `active = false` after cancel |
-| `test_charge_too_early` | Verifies panic when interval hasn't elapsed |
+| Item                        | Description                                                                |
+| --------------------------- | -------------------------------------------------------------------------- |
+| `setup()`                   | Shared helper — deploys token + contract, mints tokens, approves allowance |
+| `test_subscribe_and_charge` | Happy path: subscribe → advance time → charge                              |
+| `test_cancel`               | Verifies `active = false` after cancel                                     |
+| `test_charge_too_early`     | Verifies panic when interval hasn't elapsed                                |
 
 ---
 
@@ -95,27 +95,27 @@ frontend/
 
 The contract interaction layer. All `@stellar/stellar-sdk` usage is isolated here. Components never import the SDK directly.
 
-| Export | Description |
-| --- | --- |
-| `RPC_URL` | Soroban RPC endpoint (testnet) |
-| `NETWORK_PASSPHRASE` | `Networks.TESTNET` |
-| `CONTRACT_ID` | Read from `VITE_CONTRACT_ID` env var |
-| `server` | `Server` instance for RPC calls |
-| `buildSubscribeTx()` | Builds + simulates a `subscribe` transaction, returns XDR |
-| `buildCancelTx()` | Builds + simulates a `cancel` transaction, returns XDR |
+| Export               | Description                                                 |
+| -------------------- | ----------------------------------------------------------- |
+| `RPC_URL`            | Soroban RPC endpoint (testnet)                              |
+| `NETWORK_PASSPHRASE` | `Networks.TESTNET`                                          |
+| `CONTRACT_ID`        | Read from `VITE_CONTRACT_ID` env var                        |
+| `server`             | `Server` instance for RPC calls                             |
+| `buildSubscribeTx()` | Builds + simulates a `subscribe` transaction, returns XDR   |
+| `buildCancelTx()`    | Builds + simulates a `cancel` transaction, returns XDR      |
 | `buildPayPerUseTx()` | Builds + simulates a `pay_per_use` transaction, returns XDR |
-| `getSubscription()` | Simulates `get_subscription`, parses and returns the result |
+| `getSubscription()`  | Simulates `get_subscription`, parses and returns the result |
 
 ### `frontend/src/hooks/useWallet.ts`
 
 React hook for Freighter wallet integration.
 
-| Export | Description |
-| --- | --- |
-| `publicKey` | The connected wallet's public key, or `null` |
-| `connect()` | Prompts Freighter connection |
+| Export               | Description                                                      |
+| -------------------- | ---------------------------------------------------------------- |
+| `publicKey`          | The connected wallet's public key, or `null`                     |
+| `connect()`          | Prompts Freighter connection                                     |
 | `signAndSubmit(xdr)` | Signs a transaction with Freighter and submits it to the network |
-| `error` | Error message string, or `null` |
+| `error`              | Error message string, or `null`                                  |
 
 ### `frontend/src/components/SubscribeForm.tsx`
 
@@ -178,9 +178,9 @@ docs/
 
 ## Root Files
 
-| File | Description |
-| --- | --- |
-| `.gitignore` | Excludes `target/`, `node_modules/`, `dist/`, `.env*`, `.soroban/`, `*.wasm` |
-| `CONTRIBUTING.md` | How to contribute: setup, branching, guidelines, PR checklist |
-| `LICENSE` | MIT License |
-| `README.md` | Project overview, features, quick start, contract reference |
+| File              | Description                                                                  |
+| ----------------- | ---------------------------------------------------------------------------- |
+| `.gitignore`      | Excludes `target/`, `node_modules/`, `dist/`, `.env*`, `.soroban/`, `*.wasm` |
+| `CONTRIBUTING.md` | How to contribute: setup, branching, guidelines, PR checklist                |
+| `LICENSE`         | MIT License                                                                  |
+| `README.md`       | Project overview, features, quick start, contract reference                  |
diff --git a/docs/SUBSCRIBER-LIFECYCLE.md b/docs/SUBSCRIBER-LIFECYCLE.md
index abc7699d..f42755d9 100644
--- a/docs/SUBSCRIBER-LIFECYCLE.md
+++ b/docs/SUBSCRIBER-LIFECYCLE.md
@@ -84,7 +84,7 @@ A narrative walkthrough of everything that can happen to a PayFlow subscription,
                                  └───────────────┘
 ```
 
-Every state below is defined purely by the two flags on the `Subscription` record (`active`, `paused`) plus the current ledger timestamp compared against `last_charged`, `interval`, and the global `grace_period`. There is no separate "status" enum stored anywhere — a subscription's state is always *derived*, never stored directly, which is why every state description below starts from the stored fields.
+Every state below is defined purely by the two flags on the `Subscription` record (`active`, `paused`) plus the current ledger timestamp compared against `last_charged`, `interval`, and the global `grace_period`. There is no separate "status" enum stored anywhere — a subscription's state is always _derived_, never stored directly, which is why every state description below starts from the stored fields.
 
 ```rust
 pub struct Subscription {
@@ -105,7 +105,7 @@ pub struct Subscription {
 
 ## 1. Nonexistent
 
-**What it means:** No `Subscription(user)` record exists in persistent storage. This is the starting state for every address, and the state a cancelled subscriber's *identity* never fully leaves — see [Cancelled](#7-cancelled) for why "nonexistent" and "cancelled" are actually different states in this contract.
+**What it means:** No `Subscription(user)` record exists in persistent storage. This is the starting state for every address, and the state a cancelled subscriber's _identity_ never fully leaves — see [Cancelled](#7-cancelled) for why "nonexistent" and "cancelled" are actually different states in this contract.
 
 **How to enter it:** This is the default — nothing to do. A subscriber only reaches this state before their first `subscribe()` call.
 
@@ -201,7 +201,7 @@ See [Pause and Resume, In Depth](#pause-and-resume-in-depth) for the indefinite-
 
 **How to exit it:** only `subscribe()` / `subscribe_with_metadata()` — a full new subscription that overwrites the cancelled record.
 
-**Operations allowed:** nothing on the cancelled subscription itself — `pay_per_use()` ❌, `charge()` ❌, `pause()`/`resume()` ❌, `cancel()` ❌ (already cancelled, `NoSubscriptionFound` does *not* apply here — a second `cancel()` call re-reads the same inactive record. Check the current contract behavior in [`lib.rs::cancel_inner`](../contract/src/lib.rs) before relying on idempotency, since the lifecycle spec's transition table treats double-cancel as blocked rather than erroring). `subscribe()` ✅ to start over.
+**Operations allowed:** nothing on the cancelled subscription itself — `pay_per_use()` ❌, `charge()` ❌, `pause()`/`resume()` ❌, `cancel()` ❌ (already cancelled, `NoSubscriptionFound` does _not_ apply here — a second `cancel()` call re-reads the same inactive record. Check the current contract behavior in [`lib.rs::cancel_inner`](../contract/src/lib.rs) before relying on idempotency, since the lifecycle spec's transition table treats double-cancel as blocked rather than erroring). `subscribe()` ✅ to start over.
 
 ```bash
 soroban contract invoke --id <CONTRACT_ID> --source <USER_KEY> --network testnet -- \
@@ -236,12 +236,12 @@ It returns `Some(last_charged)` exactly while `last_charged` is still in the fut
 
 **Worked example.** Alice subscribes at `t = 1,000,000` with a 7-day trial (`trial_period = 604800`) to a merchant charging 10 USDC every 30 days (`interval = 2592000`):
 
-| Time | `last_charged` | State | `get_trial_end()` |
-| --- | --- | --- | --- |
-| `t = 1,000,000` (subscribe) | `1,604,800` | Active (Trial) | `Some(1,604,800)` |
-| `t = 1,300,000` (mid-trial) | `1,604,800` | Active (Trial) — `pay_per_use()` still works | `Some(1,604,800)` |
-| `t = 1,700,000` (trial over) | `1,604,800` | Active (Standard) — not yet chargeable | `None` |
-| `t = 4,196,800` (`1,604,800 + 2,592,000`) | `1,604,800` | Active (Chargeable) — first `charge()` succeeds here | `None` |
+| Time                                      | `last_charged` | State                                                | `get_trial_end()` |
+| ----------------------------------------- | -------------- | ---------------------------------------------------- | ----------------- |
+| `t = 1,000,000` (subscribe)               | `1,604,800`    | Active (Trial)                                       | `Some(1,604,800)` |
+| `t = 1,300,000` (mid-trial)               | `1,604,800`    | Active (Trial) — `pay_per_use()` still works         | `Some(1,604,800)` |
+| `t = 1,700,000` (trial over)              | `1,604,800`    | Active (Standard) — not yet chargeable               | `None`            |
+| `t = 4,196,800` (`1,604,800 + 2,592,000`) | `1,604,800`    | Active (Chargeable) — first `charge()` succeeds here | `None`            |
 
 ```bash
 soroban contract invoke --id <CONTRACT_ID> --source <USER_KEY> --network testnet -- \
@@ -271,15 +271,15 @@ With `grace_period > 0`, the valid charge window becomes:
 - Inside the window: `charge()` succeeds normally.
 - After the window closes: `charge()` panics with `ContractError::GracePeriodElapsed`, and the subscription is now [Active (Grace Expired)](#5-active-grace-expired).
 
-Grace period changes are **not retroactive** — each `charge()` call evaluates the grace period against whatever value is configured *at charge time*, not at subscribe time, so raising or lowering it affects every existing subscriber's next charge immediately.
+Grace period changes are **not retroactive** — each `charge()` call evaluates the grace period against whatever value is configured _at charge time_, not at subscribe time, so raising or lowering it affects every existing subscriber's next charge immediately.
 
 **Worked example.** `grace_period = 86400` (1 day). Bob's subscription has `last_charged = 2,000,000`, `interval = 604800` (7 days), so the charge window is `[2,604,800, 2,691,200]`.
 
-| `now` | Inside window? | `charge()` result |
-| --- | --- | --- |
-| `2,600,000` | No — before `2,604,800` | `IntervalNotElapsed` |
-| `2,650,000` | Yes | Succeeds; `last_charged` resets to `2,650,000` |
-| `2,700,000` (no charge happened) | No — after `2,691,200` | `GracePeriodElapsed`; now in Active (Grace Expired) |
+| `now`                            | Inside window?          | `charge()` result                                   |
+| -------------------------------- | ----------------------- | --------------------------------------------------- |
+| `2,600,000`                      | No — before `2,604,800` | `IntervalNotElapsed`                                |
+| `2,650,000`                      | Yes                     | Succeeds; `last_charged` resets to `2,650,000`      |
+| `2,700,000` (no charge happened) | No — after `2,691,200`  | `GracePeriodElapsed`; now in Active (Grace Expired) |
 
 ---
 
@@ -363,7 +363,7 @@ No refund is issued — the subscriber keeps whatever they already paid for the
 
 ### Cancel with prorated refund — `cancel_and_refund_prorated(user, merchant)`
 
-This variant requires **both** the subscriber's and the merchant's authorization (`user.require_auth()` *and* `merchant.require_auth()` — a merchant can't be forced into refunding, and a subscriber can't self-refund from the merchant's pocket unilaterally):
+This variant requires **both** the subscriber's and the merchant's authorization (`user.require_auth()` _and_ `merchant.require_auth()` — a merchant can't be forced into refunding, and a subscriber can't self-refund from the merchant's pocket unilaterally):
 
 ```rust
 let elapsed = now.saturating_sub(sub.last_charged);
@@ -376,7 +376,7 @@ if refund > 0 {
 cancel_inner(&env, &user);
 ```
 
-The refund is a straight linear proration of the *current* billing period: the fraction of the interval not yet consumed, times the subscription amount. It transfers directly from the merchant's own token balance back to the user — this is a merchant-funded refund, not something PayFlow itself escrows, so the merchant address must hold (and have approved, if their token requires it for `transfer`) enough balance to cover it, or the transfer panics and the whole cancellation reverts.
+The refund is a straight linear proration of the _current_ billing period: the fraction of the interval not yet consumed, times the subscription amount. It transfers directly from the merchant's own token balance back to the user — this is a merchant-funded refund, not something PayFlow itself escrows, so the merchant address must hold (and have approved, if their token requires it for `transfer`) enough balance to cover it, or the transfer panics and the whole cancellation reverts.
 
 **Worked example.** Carol's subscription: `amount = 30 XLM`, `interval = 30 days (2,592,000s)`, last charged at `t = 5,000,000`. She cancels with proration at `t = 5,864,000` (10 days, or 864,000 seconds, into the period):
 
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 1a9f48a1..bdc790ba 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -180,12 +180,12 @@ npm run test
 
 ### Admin subscription repair panel
 
-| Test file | Coverage |
-| --- | --- |
-| `subscriptionValidation.test.ts` | Violation formatting and failure detection |
-| `useAdmin.test.tsx` | Admin wallet authorization |
+| Test file                          | Coverage                                                              |
+| ---------------------------------- | --------------------------------------------------------------------- |
+| `subscriptionValidation.test.ts`   | Violation formatting and failure detection                            |
+| `useAdmin.test.tsx`                | Admin wallet authorization                                            |
 | `SubscriptionRepairPanel.test.tsx` | Validation/repair UI states, event count display, unauthorized repair |
-| `AdminDashboard.test.tsx` | Dashboard integration and read-only guidance |
+| `AdminDashboard.test.tsx`          | Dashboard integration and read-only guidance                          |
 
 ---
 
@@ -276,7 +276,7 @@ The reference keeper implementation in [`docs/KEEPER.md`](KEEPER.md#running-the-
 Before a keeper is allowed to submit real `batch_charge` transactions, test its **read path** in isolation:
 
 - Paging through the subscriber index (`get_subscriber_index_size()` / `get_subscriber_at(offset)`) without calling `batch_charge` at all.
-- Computing which addresses *would* be due for a charge this cycle (comparing `last_charged + interval` against current time) and logging that list instead of submitting it.
+- Computing which addresses _would_ be due for a charge this cycle (comparing `last_charged + interval` against current time) and logging that list instead of submitting it.
 
 This validates pagination and due-date logic against a real deployment without moving any funds — critical to test in isolation because a bug in "who is due" logic (e.g., an off-by-one in interval math) is invisible if you only ever look at `batch_charge`'s aggregate result.
 
@@ -361,10 +361,10 @@ Use a distinct `--seed` per scenario you want to keep independent (e.g., `--seed
 
 ### What runs in CI today
 
-| Workflow | Steps | Covers |
-|---|---|---|
+| Workflow                                          | Steps                                                                | Covers                                                                                                                                                                                                                                                                                                  |
+| ------------------------------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | [`Backend (Rust)`](../.github/workflows/rust.yml) | `cargo clippy -- -D warnings`, `cargo build`, `cargo test --verbose` | All contract unit tests **and** the benchmark tests in `bench.rs` (they're plain `#[test]` functions, so `cargo test` runs them too — see [`docs/development/performance-benchmarking.md`](development/performance-benchmarking.md#ci-integration) for adding a dedicated `--nocapture` reporting step) |
-| [`Frontend`](../.github/workflows/frontend.yml) | `npm ci`, `npm run lint`, `npx prettier --check .`, `npm run build` | Linting, formatting, and a production build — note this workflow does **not** currently run `npm run test` (the Vitest suite) as a separate step; `npm run build` only type-checks and bundles |
+| [`Frontend`](../.github/workflows/frontend.yml)   | `npm ci`, `npm run lint`, `npx prettier --check .`, `npm run build`  | Linting, formatting, and a production build — note this workflow does **not** currently run `npm run test` (the Vitest suite) as a separate step; `npm run build` only type-checks and bundles                                                                                                          |
 
 ### What requires manual testing
 
@@ -379,7 +379,7 @@ Nothing in CI touches a real network — there is no testnet RPC access from Git
 - **A new contract unit or benchmark test**: add it to `contract/src/test.rs` (or `bench.rs`) — it's picked up automatically by the existing `cargo test --verbose` step, no workflow change needed.
 - **A new frontend unit test**: add it under `frontend/src/**/__tests__/` — picked up automatically by Vitest's default discovery, but remember the `Frontend` workflow doesn't currently invoke `npm run test` at all (see table above); if you want frontend unit tests enforced in CI, add a step to [`.github/workflows/frontend.yml`](../.github/workflows/frontend.yml):
   ```yaml
-      - name: Test
-        run: npm run test
+  - name: Test
+    run: npm run test
   ```
 - **A new integration/E2E/keeper check**: these require live testnet access and a funded account, which GitHub Actions doesn't have configured today. Automating any of them means provisioning a CI secret for a funded testnet keypair and accepting real network flakiness in CI — treat this as a deliberate infrastructure decision, not a drop-in workflow step, and discuss it in an issue before implementing it.
diff --git a/docs/architecture/storage_and_ttl.md b/docs/architecture/storage_and_ttl.md
index b70ebb84..6ca6d683 100644
--- a/docs/architecture/storage_and_ttl.md
+++ b/docs/architecture/storage_and_ttl.md
@@ -12,11 +12,11 @@ Source of truth: `DataKey` in [`contract/src/lib.rs`](../../contract/src/lib.rs)
 
 FlowPay uses all three Soroban tiers.
 
-| Storage tier | Lifecycle | When expired | Use in FlowPay |
-| :--- | :--- | :--- | :--- |
-| **Instance** | Tied to the contract instance | Contract becomes unusable until instance TTL is bumped | Protocol-wide config, admin, counters, pause flags |
-| **Persistent** | Per-key | Archived (evicted); can be restored for a fee | Long-lived per-user / per-merchant state that must not be lost forever |
-| **Temporary** | Per-key | **Permanently deleted**; not restorable | Daily spending caps and short-lived two-step proposals |
+| Storage tier   | Lifecycle                     | When expired                                           | Use in FlowPay                                                         |
+| :------------- | :---------------------------- | :----------------------------------------------------- | :--------------------------------------------------------------------- |
+| **Instance**   | Tied to the contract instance | Contract becomes unusable until instance TTL is bumped | Protocol-wide config, admin, counters, pause flags                     |
+| **Persistent** | Per-key                       | Archived (evicted); can be restored for a fee          | Long-lived per-user / per-merchant state that must not be lost forever |
+| **Temporary**  | Per-key                       | **Permanently deleted**; not restorable                | Daily spending caps and short-lived two-step proposals                 |
 
 ### When to use each tier
 
@@ -28,11 +28,11 @@ FlowPay uses all three Soroban tiers.
 
 ## 2. TTL constants
 
-| Constant / literal | Value (ledgers) | Approx. time (5s ledgers) | Used for |
-| :--- | ---: | :--- | :--- |
-| `SUBSCRIPTION_TTL_LEDGERS` | `6_307_200` | ~1 year | Subscriptions, metadata, charge history, fee recipient, subscriber index slots; instance bump target |
-| Merchant-stats literal | `1_555_200` | ~90 days | Merchant revenue, day buckets, revenue history, merchant sub counts |
-| `LEDGERS_PER_DAY` / `17280` | `17_280` | ~24 hours | Daily limit keys; `PendingFee` / `PendingGracePeriod` / `PendingUpgrade` |
+| Constant / literal          | Value (ledgers) | Approx. time (5s ledgers) | Used for                                                                                             |
+| :-------------------------- | --------------: | :------------------------ | :--------------------------------------------------------------------------------------------------- |
+| `SUBSCRIPTION_TTL_LEDGERS`  |     `6_307_200` | ~1 year                   | Subscriptions, metadata, charge history, fee recipient, subscriber index slots; instance bump target |
+| Merchant-stats literal      |     `1_555_200` | ~90 days                  | Merchant revenue, day buckets, revenue history, merchant sub counts                                  |
+| `LEDGERS_PER_DAY` / `17280` |        `17_280` | ~24 hours                 | Daily limit keys; `PendingFee` / `PendingGracePeriod` / `PendingUpgrade`                             |
 
 Subscription persistent keys typically use threshold `SUBSCRIPTION_TTL_LEDGERS / 2` and extend-to `SUBSCRIPTION_TTL_LEDGERS` (see `storage::extend_subscription_ttl`). Some keys bump with full/full. Temporary keys usually extend with threshold = extend-to = `17_280`.
 
@@ -42,41 +42,41 @@ Subscription persistent keys typically use threshold `SUBSCRIPTION_TTL_LEDGERS /
 
 All variants from `DataKey` in `contract/src/lib.rs` are listed below. “None” under TTL policy means no explicit `extend_ttl` call was found for that key — it relies on network defaults and risks archival if never bumped.
 
-| DataKey | Value type | Storage tier | TTL policy | Written by | Read by |
-| :--- | :--- | :--- | :--- | :--- | :--- |
-| `Subscription(Address)` | `Subscription` | persistent | `extend_ttl` ~½→1 year via `extend_subscription_ttl` / `bump_subscription` | `subscribe`, `subscribe_with_metadata`, `charge` / `batch_charge`, `cancel*`, `pause*`, `resume`, `batch_pause_subscriptions`, `set_subscription_amount`, `set_subscription_interval`, `transfer_subscription`, `migrate` | `get_subscription`, charge / PPU / cancel / pause / resume / next-charge helpers, `migrate`, and other flows that load the sub first |
-| `Token` | `Address` | instance | Shares instance TTL (`bump_instance_ttl`) | `initialize` | `get_token`, `withdraw_merchant_revenue`, `contract_health_check` |
-| `Admin` | `Address` | instance | Shares instance TTL | `initialize` → `admin::initialize_admin`, `accept_admin`, `set_initial_admin` | `get_admin`, `admin::require_admin` callers, `accept_admin`, `contract_health_check` |
-| `GracePeriod` | `u64` | instance | Instance bump on read/commit | `commit_grace_period` | `get_grace_period`, `charge`, `batch_charge`, `is_charge_due`, `get_protocol_stats` |
-| `MerchantWhitelist(Address)` | `bool` (presence = whitelisted) | persistent | None | `add_merchant`, `whitelist_batch_add`; removed by `remove_merchant` / `whitelist_batch_remove` | `is_merchant_whitelisted`, `subscribe*`, `pay_per_use_to` |
-| `WhitelistEnabled` | `bool` | instance | Shares instance TTL | `set_whitelist_enabled` | `is_whitelist_enabled`, `subscribe*`, `pay_per_use_to`, `get_protocol_stats` |
-| `MerchantFrozen(Address)` | `bool` (presence = frozen) | persistent | None | `freeze_merchant`; removed by `unfreeze_merchant` | `is_merchant_frozen`, `subscribe*` |
-| `FeeCollector` | `Address` | instance | Shares instance TTL | `commit_fee`; removed by `clear_fee` | `get_fee`, `get_fee_collector`, `get_protocol_stats`, fee transfers in charge / PPU |
-| `FeeBps` | `u32` | instance | Shares instance TTL | `commit_fee`; removed by `clear_fee` | `get_fee`, `get_protocol_stats`, fee transfers |
-| `ActiveCount` | `u64` | instance | Shares instance TTL | `subscribe*` (inc), `cancel*` (dec) | `get_active_count`, `get_protocol_stats`, `contract_health_check` |
-| `MerchantRevenue(Address)` | `i128` | persistent | `extend_ttl(1_555_200, 1_555_200)` on write | charge / PPU → `increment_revenue*`; `reset_merchant_revenue`; `withdraw_merchant_revenue` | `get_merchant_revenue`, `withdraw_merchant_revenue` |
-| `MerchantRevenueDay(Address, u64)` | `i128` | persistent | `extend_ttl(1_555_200, 1_555_200)` on write / `bump_merchant_revenue_day` | `increment_revenue_with_daily`; removed by `prune_merchant_revenue_days` | `get_merchant_revenue_day`, `bump_merchant_revenue_day` |
-| `DailyLimit(Address)` | `i128` | temporary | `extend_ttl(17_280, 17_280)` on set | `set_daily_limit`; removed by `remove_daily_limit` | `get_daily_limit`, `pay_per_use*` → `enforce_limit` |
-| `DailySpent(Address)` | `i128` | temporary | `extend_ttl(17_280, 17_280)` on `record_spend` | `pay_per_use*` → `record_spend`; removed by `remove_daily_limit` | `get_daily_spent`, `enforce_limit` / `record_spend` |
-| `DayStart(Address)` | `()` unit marker | temporary | `extend_ttl(17_280, 17_280)` on first spend of day | `record_spend` (if absent); removed by `remove_daily_limit` | `get_daily_spent`, `record_spend` (`temporary().has`) |
-| `Referral(Address)` | `Address` | persistent | None | `subscribe*` → `store_referral`; removed on `cancel*` | `get_referrer` |
-| `SchemaVersion` | `u32` | instance | Shares instance TTL | `migrate` (sets current schema version) | `get_schema_version`, `migrate`, `get_protocol_stats`, `contract_health_check` (defaults to `1` if unset) |
-| `SubscriptionMeta(Address)` | `String` (max 64 bytes) | persistent | `extend_ttl` ~1 year on set | `set_metadata`, `subscribe_with_metadata`; removed by `clear_metadata` | `get_metadata`, `get_subscription_label` |
-| `ChargeHistory(Address)` | `Vec<u64>` (rolling, max 12) | persistent | `extend_ttl` ~½→1 year on record | charge → `record_charge`; removed by `clear_charge_history` / `prune_charge_history` | `get_charge_history`, `get_charge_history_page` |
-| `GlobalVolumeWindow` | `GlobalVolumeWindow { current_window_start, accumulated_volume }` | instance | Shares instance TTL | charge / PPU → `check_and_update_global_volume` | same path (no public getter) |
-| `MaxBatchSize` | `u32` | instance | Shares instance TTL | `set_max_batch_size` | `get_max_batch_size`, `batch_charge` (default `50` if unset) |
-| `ContractPaused` | `bool` | instance | Shares instance TTL | `pause_contract`, `unpause_contract` | `is_contract_paused`, `get_protocol_stats`, `subscribe*`, `ensure_contract_not_paused`, `contract_health_check` |
-| `MinInterval` | `u64` | instance | Shares instance TTL | `set_min_interval` | `get_min_interval`, `subscribe*` (default `3600` if unset) |
-| `MerchantRevenueHistory(Address)` | `Vec<i128>` | persistent | `extend_ttl(1_555_200, 1_555_200)` on append | `increment_revenue_with_daily`; removed by `clear_merchant_revenue_history` | `get_merchant_revenue_history` |
-| `SubscriberIndex(u64)` | `Address` | persistent | `extend_ttl` ~1 year on append | `subscribe*` → `append_subscriber_index` | `get_subscriber_at`, `get_subscriber_page` |
-| `SubscriberIndexSize` | `u64` | persistent | None on this key | `append_subscriber_index` | `get_subscriber_count`, `get_subscriber_page`, `append_subscriber_index` |
-| `MerchantSubCount(Address)` | `u64` | persistent | `extend_ttl(1_555_200, 1_555_200)` on inc/dec | `subscribe*` / `cancel*` → merchant sub count helpers | `get_merchant_subscriber_count`, `get_merchant_sub_count` |
-| `PendingAdmin` | `Address` | instance | Shares instance TTL | `transfer_admin`; removed by `accept_admin` | `accept_admin` |
-| `PendingFee` | `(Address, u32)` | temporary | `extend_ttl(17_280, 17_280)` on propose | `propose_fee`; removed by `commit_fee` | `commit_fee` |
-| `MerchantFeeRecipient(Address)` | `Address` | persistent | `extend_ttl` ~1 year on set | `set_merchant_fee_recipient` | `get_merchant_fee_recipient`; fee transfer during charge |
-| `PendingGracePeriod` | `u64` | temporary | `extend_ttl(17_280, 17_280)` on propose | `propose_grace_period`; removed by `commit_grace_period` | `commit_grace_period` |
-| `PendingUpgrade` | `BytesN<32>` | temporary | `extend_ttl(17_280, 17_280)` on propose | `propose_upgrade`; removed by `commit_upgrade` | `commit_upgrade` |
-| `PauseExpiry(Address)` | `u64` | persistent | None | `pause` (`u64::MAX`), `pause_until`; removed by `resume` / auto-resume in charge | `charge` / `batch_charge` → `try_auto_resume` (no public getter) |
+| DataKey                            | Value type                                                        | Storage tier | TTL policy                                                                 | Written by                                                                                                                                                                                                                | Read by                                                                                                                              |
+| :--------------------------------- | :---------------------------------------------------------------- | :----------- | :------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :----------------------------------------------------------------------------------------------------------------------------------- |
+| `Subscription(Address)`            | `Subscription`                                                    | persistent   | `extend_ttl` ~½→1 year via `extend_subscription_ttl` / `bump_subscription` | `subscribe`, `subscribe_with_metadata`, `charge` / `batch_charge`, `cancel*`, `pause*`, `resume`, `batch_pause_subscriptions`, `set_subscription_amount`, `set_subscription_interval`, `transfer_subscription`, `migrate` | `get_subscription`, charge / PPU / cancel / pause / resume / next-charge helpers, `migrate`, and other flows that load the sub first |
+| `Token`                            | `Address`                                                         | instance     | Shares instance TTL (`bump_instance_ttl`)                                  | `initialize`                                                                                                                                                                                                              | `get_token`, `withdraw_merchant_revenue`, `contract_health_check`                                                                    |
+| `Admin`                            | `Address`                                                         | instance     | Shares instance TTL                                                        | `initialize` → `admin::initialize_admin`, `accept_admin`, `set_initial_admin`                                                                                                                                             | `get_admin`, `admin::require_admin` callers, `accept_admin`, `contract_health_check`                                                 |
+| `GracePeriod`                      | `u64`                                                             | instance     | Instance bump on read/commit                                               | `commit_grace_period`                                                                                                                                                                                                     | `get_grace_period`, `charge`, `batch_charge`, `is_charge_due`, `get_protocol_stats`                                                  |
+| `MerchantWhitelist(Address)`       | `bool` (presence = whitelisted)                                   | persistent   | None                                                                       | `add_merchant`, `whitelist_batch_add`; removed by `remove_merchant` / `whitelist_batch_remove`                                                                                                                            | `is_merchant_whitelisted`, `subscribe*`, `pay_per_use_to`                                                                            |
+| `WhitelistEnabled`                 | `bool`                                                            | instance     | Shares instance TTL                                                        | `set_whitelist_enabled`                                                                                                                                                                                                   | `is_whitelist_enabled`, `subscribe*`, `pay_per_use_to`, `get_protocol_stats`                                                         |
+| `MerchantFrozen(Address)`          | `bool` (presence = frozen)                                        | persistent   | None                                                                       | `freeze_merchant`; removed by `unfreeze_merchant`                                                                                                                                                                         | `is_merchant_frozen`, `subscribe*`                                                                                                   |
+| `FeeCollector`                     | `Address`                                                         | instance     | Shares instance TTL                                                        | `commit_fee`; removed by `clear_fee`                                                                                                                                                                                      | `get_fee`, `get_fee_collector`, `get_protocol_stats`, fee transfers in charge / PPU                                                  |
+| `FeeBps`                           | `u32`                                                             | instance     | Shares instance TTL                                                        | `commit_fee`; removed by `clear_fee`                                                                                                                                                                                      | `get_fee`, `get_protocol_stats`, fee transfers                                                                                       |
+| `ActiveCount`                      | `u64`                                                             | instance     | Shares instance TTL                                                        | `subscribe*` (inc), `cancel*` (dec)                                                                                                                                                                                       | `get_active_count`, `get_protocol_stats`, `contract_health_check`                                                                    |
+| `MerchantRevenue(Address)`         | `i128`                                                            | persistent   | `extend_ttl(1_555_200, 1_555_200)` on write                                | charge / PPU → `increment_revenue*`; `reset_merchant_revenue`; `withdraw_merchant_revenue`                                                                                                                                | `get_merchant_revenue`, `withdraw_merchant_revenue`                                                                                  |
+| `MerchantRevenueDay(Address, u64)` | `i128`                                                            | persistent   | `extend_ttl(1_555_200, 1_555_200)` on write / `bump_merchant_revenue_day`  | `increment_revenue_with_daily`; removed by `prune_merchant_revenue_days`                                                                                                                                                  | `get_merchant_revenue_day`, `bump_merchant_revenue_day`                                                                              |
+| `DailyLimit(Address)`              | `i128`                                                            | temporary    | `extend_ttl(17_280, 17_280)` on set                                        | `set_daily_limit`; removed by `remove_daily_limit`                                                                                                                                                                        | `get_daily_limit`, `pay_per_use*` → `enforce_limit`                                                                                  |
+| `DailySpent(Address)`              | `i128`                                                            | temporary    | `extend_ttl(17_280, 17_280)` on `record_spend`                             | `pay_per_use*` → `record_spend`; removed by `remove_daily_limit`                                                                                                                                                          | `get_daily_spent`, `enforce_limit` / `record_spend`                                                                                  |
+| `DayStart(Address)`                | `()` unit marker                                                  | temporary    | `extend_ttl(17_280, 17_280)` on first spend of day                         | `record_spend` (if absent); removed by `remove_daily_limit`                                                                                                                                                               | `get_daily_spent`, `record_spend` (`temporary().has`)                                                                                |
+| `Referral(Address)`                | `Address`                                                         | persistent   | None                                                                       | `subscribe*` → `store_referral`; removed on `cancel*`                                                                                                                                                                     | `get_referrer`                                                                                                                       |
+| `SchemaVersion`                    | `u32`                                                             | instance     | Shares instance TTL                                                        | `migrate` (sets current schema version)                                                                                                                                                                                   | `get_schema_version`, `migrate`, `get_protocol_stats`, `contract_health_check` (defaults to `1` if unset)                            |
+| `SubscriptionMeta(Address)`        | `String` (max 64 bytes)                                           | persistent   | `extend_ttl` ~1 year on set                                                | `set_metadata`, `subscribe_with_metadata`; removed by `clear_metadata`                                                                                                                                                    | `get_metadata`, `get_subscription_label`                                                                                             |
+| `ChargeHistory(Address)`           | `Vec<u64>` (rolling, max 12)                                      | persistent   | `extend_ttl` ~½→1 year on record                                           | charge → `record_charge`; removed by `clear_charge_history` / `prune_charge_history`                                                                                                                                      | `get_charge_history`, `get_charge_history_page`                                                                                      |
+| `GlobalVolumeWindow`               | `GlobalVolumeWindow { current_window_start, accumulated_volume }` | instance     | Shares instance TTL                                                        | charge / PPU → `check_and_update_global_volume`                                                                                                                                                                           | same path (no public getter)                                                                                                         |
+| `MaxBatchSize`                     | `u32`                                                             | instance     | Shares instance TTL                                                        | `set_max_batch_size`                                                                                                                                                                                                      | `get_max_batch_size`, `batch_charge` (default `50` if unset)                                                                         |
+| `ContractPaused`                   | `bool`                                                            | instance     | Shares instance TTL                                                        | `pause_contract`, `unpause_contract`                                                                                                                                                                                      | `is_contract_paused`, `get_protocol_stats`, `subscribe*`, `ensure_contract_not_paused`, `contract_health_check`                      |
+| `MinInterval`                      | `u64`                                                             | instance     | Shares instance TTL                                                        | `set_min_interval`                                                                                                                                                                                                        | `get_min_interval`, `subscribe*` (default `3600` if unset)                                                                           |
+| `MerchantRevenueHistory(Address)`  | `Vec<i128>`                                                       | persistent   | `extend_ttl(1_555_200, 1_555_200)` on append                               | `increment_revenue_with_daily`; removed by `clear_merchant_revenue_history`                                                                                                                                               | `get_merchant_revenue_history`                                                                                                       |
+| `SubscriberIndex(u64)`             | `Address`                                                         | persistent   | `extend_ttl` ~1 year on append                                             | `subscribe*` → `append_subscriber_index`                                                                                                                                                                                  | `get_subscriber_at`, `get_subscriber_page`                                                                                           |
+| `SubscriberIndexSize`              | `u64`                                                             | persistent   | None on this key                                                           | `append_subscriber_index`                                                                                                                                                                                                 | `get_subscriber_count`, `get_subscriber_page`, `append_subscriber_index`                                                             |
+| `MerchantSubCount(Address)`        | `u64`                                                             | persistent   | `extend_ttl(1_555_200, 1_555_200)` on inc/dec                              | `subscribe*` / `cancel*` → merchant sub count helpers                                                                                                                                                                     | `get_merchant_subscriber_count`, `get_merchant_sub_count`                                                                            |
+| `PendingAdmin`                     | `Address`                                                         | instance     | Shares instance TTL                                                        | `transfer_admin`; removed by `accept_admin`                                                                                                                                                                               | `accept_admin`                                                                                                                       |
+| `PendingFee`                       | `(Address, u32)`                                                  | temporary    | `extend_ttl(17_280, 17_280)` on propose                                    | `propose_fee`; removed by `commit_fee`                                                                                                                                                                                    | `commit_fee`                                                                                                                         |
+| `MerchantFeeRecipient(Address)`    | `Address`                                                         | persistent   | `extend_ttl` ~1 year on set                                                | `set_merchant_fee_recipient`                                                                                                                                                                                              | `get_merchant_fee_recipient`; fee transfer during charge                                                                             |
+| `PendingGracePeriod`               | `u64`                                                             | temporary    | `extend_ttl(17_280, 17_280)` on propose                                    | `propose_grace_period`; removed by `commit_grace_period`                                                                                                                                                                  | `commit_grace_period`                                                                                                                |
+| `PendingUpgrade`                   | `BytesN<32>`                                                      | temporary    | `extend_ttl(17_280, 17_280)` on propose                                    | `propose_upgrade`; removed by `commit_upgrade`                                                                                                                                                                            | `commit_upgrade`                                                                                                                     |
+| `PauseExpiry(Address)`             | `u64`                                                             | persistent   | None                                                                       | `pause` (`u64::MAX`), `pause_until`; removed by `resume` / auto-resume in charge                                                                                                                                          | `charge` / `batch_charge` → `try_auto_resume` (no public getter)                                                                     |
 
 ```mermaid
 graph TD
@@ -189,11 +189,11 @@ pub fn set_daily_limit(env: &Env, user: &Address, limit: i128) {
 
 ## 7. Cross-references
 
-| Area | Docs / APIs |
-| :--- | :--- |
-| Public function contracts | [API.md](../API.md) |
-| Two-step `Pending*` flows | [two-step-auth.md](./two-step-auth.md) |
-| High-level storage table | [ARCHITECTURE.md](../ARCHITECTURE.md#storage-strategy) |
-| Daily limits product guide | [DAILY-LIMITS.md](../DAILY-LIMITS.md) |
+| Area                       | Docs / APIs                                            |
+| :------------------------- | :----------------------------------------------------- |
+| Public function contracts  | [API.md](../API.md)                                    |
+| Two-step `Pending*` flows  | [two-step-auth.md](./two-step-auth.md)                 |
+| High-level storage table   | [ARCHITECTURE.md](../ARCHITECTURE.md#storage-strategy) |
+| Daily limits product guide | [DAILY-LIMITS.md](../DAILY-LIMITS.md)                  |
 
 When adding a new `DataKey` variant: pick the tier deliberately, document TTL here, wire writers/readers, and update [API.md](../API.md) if a public getter/setter is exposed.
diff --git a/docs/architecture/two-step-auth.md b/docs/architecture/two-step-auth.md
index f2fbe158..c72e5051 100644
--- a/docs/architecture/two-step-auth.md
+++ b/docs/architecture/two-step-auth.md
@@ -27,7 +27,7 @@ A single-step admin call is one signed transaction away from an irreversible, co
 - **Wrong address.** Transferring admin to a mistyped or unreachable address in one step would permanently lock the contract out of any admin action — there'd be no admin left who could undo it.
 - **Compromised key, single window.** If an admin key is compromised, a single-step design lets one signed transaction do irreversible damage (drain fees to an attacker address, "upgrade" to malicious WASM) with no opportunity for anyone to notice and react in between.
 
-Splitting each of these into a **propose** step (records the intent, changes nothing observable) and a separate **commit** (or **accept**) step (actually applies it) buys two things: a window — however short in practice — between intent and effect where the proposal is visible on-chain (via the `*_proposed` event) before it takes hold, and a requirement that the same authority (or, for admin transfer, a *different* authority) deliberately issue a second transaction. Neither step alone can complete the change.
+Splitting each of these into a **propose** step (records the intent, changes nothing observable) and a separate **commit** (or **accept**) step (actually applies it) buys two things: a window — however short in practice — between intent and effect where the proposal is visible on-chain (via the `*_proposed` event) before it takes hold, and a requirement that the same authority (or, for admin transfer, a _different_ authority) deliberately issue a second transaction. Neither step alone can complete the change.
 
 This does **not** make these operations timelocked in the sense of a mandatory delay — nothing stops an admin from calling `propose_fee` and `commit_fee` back to back in the same block. The protection is procedural (two distinct signed calls, one of which reveals intent via an event before the other executes), not a built-in cooldown.
 
@@ -39,7 +39,7 @@ PayFlow actually implements two different flavors of "two-step," and it's worth
 
 ### Propose → Commit (same authority)
 
-Used by **fee**, **grace period**, and **upgrade**. The admin calls `propose_*`, then the *same* admin later calls `commit_*`. This protects against fat-fingering and gives observers (anyone watching events) a chance to flag a bad proposal before it's committed — but it does **not** protect against a single compromised admin key, since that one key can perform both steps.
+Used by **fee**, **grace period**, and **upgrade**. The admin calls `propose_*`, then the _same_ admin later calls `commit_*`. This protects against fat-fingering and gives observers (anyone watching events) a chance to flag a bad proposal before it's committed — but it does **not** protect against a single compromised admin key, since that one key can perform both steps.
 
 ```text
    admin                              admin
@@ -53,7 +53,7 @@ Used by **fee**, **grace period**, and **upgrade**. The admin calls `propose_*`,
 
 ### Propose → Accept (different authority)
 
-Used only by **admin transfer**. The *current* admin calls `transfer_admin`, but the *new* admin — a different key entirely — must call `accept_admin` to complete the change. This is the stronger protection: it guarantees the new admin address is actually controlled by someone who can sign for it, and a compromised current-admin key alone cannot complete a transfer to an address the attacker doesn't control.
+Used only by **admin transfer**. The _current_ admin calls `transfer_admin`, but the _new_ admin — a different key entirely — must call `accept_admin` to complete the change. This is the stronger protection: it guarantees the new admin address is actually controlled by someone who can sign for it, and a compromised current-admin key alone cannot complete a transfer to an address the attacker doesn't control.
 
 ```text
  current admin                      proposed new admin
@@ -100,8 +100,8 @@ pub fn accept_admin(env: &Env) {
 └──────────────┘                        └───────────────────┘                     └────────────────┘
 ```
 
-- **Step 1 auth:** the *current* admin (`current_admin.require_auth()`).
-- **Step 2 auth:** the *proposed* admin (`pending.require_auth()`) — `A` (the old admin) cannot call `accept_admin` on `new`'s behalf, and `new` cannot self-nominate by calling `transfer_admin`.
+- **Step 1 auth:** the _current_ admin (`current_admin.require_auth()`).
+- **Step 2 auth:** the _proposed_ admin (`pending.require_auth()`) — `A` (the old admin) cannot call `accept_admin` on `new`'s behalf, and `new` cannot self-nominate by calling `transfer_admin`.
 - Until `accept_admin` is called, `A` remains the fully-functional admin — `PendingAdmin` being set does not restrict what `A` can still do.
 - Emits `admin_transferred(old_admin, new_admin)` only on successful completion of step 2.
 
@@ -201,7 +201,7 @@ pub fn commit_grace_period(env: &Env) {
 └────────────────────┘                              └───────────────────────────┘                            └────────────────────┘
 ```
 
-Both `propose_grace_period` and `commit_grace_period` call `admin::require_admin(env)`, which internally does `get_admin(env).require_auth()` — this flow *is* fully admin-gated on both steps, unlike protocol fee above. Applying a new grace period is **not retroactive**: `charge()` reads the live `GracePeriod` value at the moment it's called, so committing a change affects every subscriber's very next charge attempt, not just ones that subscribe afterward (see [SUBSCRIBER-LIFECYCLE.md § Grace Period, In Depth](../SUBSCRIBER-LIFECYCLE.md#grace-period-in-depth)).
+Both `propose_grace_period` and `commit_grace_period` call `admin::require_admin(env)`, which internally does `get_admin(env).require_auth()` — this flow _is_ fully admin-gated on both steps, unlike protocol fee above. Applying a new grace period is **not retroactive**: `charge()` reads the live `GracePeriod` value at the moment it's called, so committing a change affects every subscriber's very next charge attempt, not just ones that subscribe afterward (see [SUBSCRIBER-LIFECYCLE.md § Grace Period, In Depth](../SUBSCRIBER-LIFECYCLE.md#grace-period-in-depth)).
 
 ```bash
 # Step 1 — propose a new grace period (in seconds)
@@ -265,12 +265,12 @@ soroban contract invoke --id <CONTRACT_ID> --source <ADMIN_KEY> --network testne
 
 ## Storage and Expiry Reference
 
-| Flow | Pending key | Storage type | Expires without commit? | Step 1 auth | Step 2 auth |
-| --- | --- | --- | --- | --- | --- |
-| Admin transfer | `PendingAdmin` | instance | No — persists until accepted or overwritten by a new `transfer_admin` call | current admin | proposed (new) admin |
-| Protocol fee | `PendingFee` | temporary | Yes — ~17,280 ledgers (~1 day) after the last `propose_fee` call | *(undocumented gap — see above)* | *(undocumented gap — see above)* |
-| Grace period | `PendingGracePeriod` | temporary | Yes — ~17,280 ledgers (~1 day) after the last `propose_grace_period` call | admin | admin |
-| Contract upgrade | `PendingUpgrade` | temporary | Yes — ~17,280 ledgers (~1 day) after the last `propose_upgrade` call | admin | admin |
+| Flow             | Pending key          | Storage type | Expires without commit?                                                    | Step 1 auth                      | Step 2 auth                      |
+| ---------------- | -------------------- | ------------ | -------------------------------------------------------------------------- | -------------------------------- | -------------------------------- |
+| Admin transfer   | `PendingAdmin`       | instance     | No — persists until accepted or overwritten by a new `transfer_admin` call | current admin                    | proposed (new) admin             |
+| Protocol fee     | `PendingFee`         | temporary    | Yes — ~17,280 ledgers (~1 day) after the last `propose_fee` call           | _(undocumented gap — see above)_ | _(undocumented gap — see above)_ |
+| Grace period     | `PendingGracePeriod` | temporary    | Yes — ~17,280 ledgers (~1 day) after the last `propose_grace_period` call  | admin                            | admin                            |
+| Contract upgrade | `PendingUpgrade`     | temporary    | Yes — ~17,280 ledgers (~1 day) after the last `propose_upgrade` call       | admin                            | admin                            |
 
 Soroban's temporary storage entries become inaccessible once their TTL lapses — the entry isn't explicitly deleted by any PayFlow code, it simply stops existing from the contract's point of view, and a subsequent `commit_*` call reads it as absent and panics with `ContractError::NoPendingProposal`, identical to never having called `propose_*` at all.
 
@@ -289,7 +289,7 @@ Every `commit_*` function reads its pending key with `.unwrap_or_else(|| env.pan
 There is no dedicated `cancel_*` entry point for any of the four flows. In practice:
 
 - **Fee, grace period, upgrade:** call `propose_*` again with a different value to overwrite the pending one (the temporary-storage entry is simply replaced), or just do nothing — the proposal auto-expires after ~17,280 ledgers (~1 day) and a subsequent `commit_*` will fail with `NoPendingProposal` as if it were never proposed.
-- **Admin transfer:** the current admin can call `transfer_admin` again — either pointing at a different address, or at themselves — to overwrite `PendingAdmin`. Because this key lives in instance storage with no expiry, this is the *only* way to clear a stale or mistaken admin proposal; it will not time out on its own.
+- **Admin transfer:** the current admin can call `transfer_admin` again — either pointing at a different address, or at themselves — to overwrite `PendingAdmin`. Because this key lives in instance storage with no expiry, this is the _only_ way to clear a stale or mistaken admin proposal; it will not time out on its own.
 
 ### "My proposal seems to have disappeared"
 
diff --git a/docs/development/performance-benchmarking.md b/docs/development/performance-benchmarking.md
index 9a73fa76..5423b20e 100644
--- a/docs/development/performance-benchmarking.md
+++ b/docs/development/performance-benchmarking.md
@@ -89,22 +89,22 @@ Each benchmark prints two numbers:
 
 There's no universal "good" number — it depends entirely on what the function does. What you're actually watching for is:
 
-1. **Comparative stability.** The same function, called the same way, should produce (approximately) the same instruction count on every run — Soroban's budget metering is deterministic given deterministic inputs, so unlike wall-clock benchmarks, there's no run-to-run noise to average out. If a number changes between two runs of the *same* code, something is non-deterministic (e.g., iterating a `Map` whose insertion order affects iteration) and worth investigating on its own.
-2. **Proportionality to work done.** `batch_charge()` over 10 users measured at 6,706,059 instructions is roughly 13× `charge()`'s 508,118 — i.e., a bit more than linear in user count, since batch overhead (loading the subscriber list, one shared transaction context) is amortized but per-user work (storage read/write, token transfer, event emission) dominates. If a future change made `batch_charge` scale *worse* than linear with subscriber count, that would be a red flag independent of any fixed baseline.
+1. **Comparative stability.** The same function, called the same way, should produce (approximately) the same instruction count on every run — Soroban's budget metering is deterministic given deterministic inputs, so unlike wall-clock benchmarks, there's no run-to-run noise to average out. If a number changes between two runs of the _same_ code, something is non-deterministic (e.g., iterating a `Map` whose insertion order affects iteration) and worth investigating on its own.
+2. **Proportionality to work done.** `batch_charge()` over 10 users measured at 6,706,059 instructions is roughly 13× `charge()`'s 508,118 — i.e., a bit more than linear in user count, since batch overhead (loading the subscriber list, one shared transaction context) is amortized but per-user work (storage read/write, token transfer, event emission) dominates. If a future change made `batch_charge` scale _worse_ than linear with subscriber count, that would be a red flag independent of any fixed baseline.
 3. **Headroom under the enforced threshold.** `bench.rs` asserts each measured call stays under a `MAX_*_INSTRUCTIONS` constant (see below). As long as you're comfortably under threshold with margin, you're "good"; crossing it fails the test outright.
 
 ### Actual measured baselines vs. the threshold constants
 
 Running the suite locally produced instruction counts substantially **lower** than the `MAX_*_INSTRUCTIONS` threshold constants defined at the top of `bench.rs` (those constants were set with ~10% headroom over baselines recorded against an earlier SDK snapshot per the file's own doc comment). Concretely:
 
-| Function | Measured CPU | Threshold constant (`bench.rs`) | Headroom |
-|---|---|---|---|
-| `subscribe()` | 261,022 | `MAX_SUBSCRIBE_INSTRUCTIONS` = 4,620,000 | ~17.7× |
-| `charge()` | 508,118 | `MAX_CHARGE_INSTRUCTIONS` = 4,180,000 | ~8.2× |
-| `pay_per_use()` | 530,622 | `MAX_PAY_PER_USE_INSTRUCTIONS` = 3,960,000 | ~7.5× |
-| `batch_charge()` (10 users) | 6,706,059 | `MAX_BATCH_10_INSTRUCTIONS` = 30,800,000 | ~4.6× |
+| Function                    | Measured CPU | Threshold constant (`bench.rs`)            | Headroom |
+| --------------------------- | ------------ | ------------------------------------------ | -------- |
+| `subscribe()`               | 261,022      | `MAX_SUBSCRIBE_INSTRUCTIONS` = 4,620,000   | ~17.7×   |
+| `charge()`                  | 508,118      | `MAX_CHARGE_INSTRUCTIONS` = 4,180,000      | ~8.2×    |
+| `pay_per_use()`             | 530,622      | `MAX_PAY_PER_USE_INSTRUCTIONS` = 3,960,000 | ~7.5×    |
+| `batch_charge()` (10 users) | 6,706,059    | `MAX_BATCH_10_INSTRUCTIONS` = 30,800,000   | ~4.6×    |
 
-This gap is expected and not a bug: the threshold constants exist to catch *regressions*, not to track the current number tightly. They were set generously so ordinary feature work doesn't spuriously fail CI. If you're doing dedicated optimization work, use the **actual measured numbers** in the table above as your working baseline, not the threshold constants — the thresholds only tell you the outer bound before the benchmark test fails.
+This gap is expected and not a bug: the threshold constants exist to catch _regressions_, not to track the current number tightly. They were set generously so ordinary feature work doesn't spuriously fail CI. If you're doing dedicated optimization work, use the **actual measured numbers** in the table above as your working baseline, not the threshold constants — the thresholds only tell you the outer bound before the benchmark test fails.
 
 > Numbers on your machine may differ slightly by Soroban SDK / `soroban-env-host` patch version. Always treat "the number this exact benchmark printed on `master` before your change" as the ground truth for regression comparisons (see [Regression Detection](#regression-detection)), not the numbers hardcoded in this document.
 
@@ -159,13 +159,14 @@ Because the benchmarks are deterministic given the same code and SDK version, co
 
 ### What counts as a regression vs. noise
 
-Because Soroban's budget metering is deterministic (not wall-clock timing), there is no "run it 10 times and average" step — the same inputs against the same compiled contract produce the same instruction count every time. If two runs of *identical* code produce different numbers, that itself is a bug worth investigating (usually nondeterministic iteration order over an unordered collection), not something to average away.
+Because Soroban's budget metering is deterministic (not wall-clock timing), there is no "run it 10 times and average" step — the same inputs against the same compiled contract produce the same instruction count every time. If two runs of _identical_ code produce different numbers, that itself is a bug worth investigating (usually nondeterministic iteration order over an unordered collection), not something to average away.
 
 A meaningful regression is any increase not explained by an intentional feature change, especially in `charge()` or `batch_charge()` since those run on every keeper billing cycle across every active subscriber — a regression there multiplies across the whole subscriber base, unlike a one-time `subscribe()` cost.
 
 ### Comparing against a committed baseline
 
 Keep the "Actual measured baselines" table in this document current. When you deliberately shift a baseline by more than ~5%, update:
+
 1. This table.
 2. The baselines table in [`docs/CONTRIBUTING-CONTRACT.md`](../CONTRIBUTING-CONTRACT.md#benchmarks).
 3. The `MAX_*_INSTRUCTIONS` constants in `bench.rs` if the new number no longer leaves reasonable headroom under the threshold.
@@ -235,12 +236,12 @@ The `Backend (Rust)` workflow ([`.github/workflows/rust.yml`](../../.github/work
 To add a dedicated, visible benchmark-reporting step (rather than relying on failures buried in the general `cargo test` output), add a step after the existing `Run tests` step:
 
 ```yaml
-    - name: Run tests
-      run: cargo test --verbose
-      working-directory: contract
-    - name: Run benchmarks
-      run: cargo test --features testutils bench -- --nocapture
-      working-directory: contract
+- name: Run tests
+  run: cargo test --verbose
+  working-directory: contract
+- name: Run benchmarks
+  run: cargo test --features testutils bench -- --nocapture
+  working-directory: contract
 ```
 
 This re-runs the same benchmark tests (they already ran once as part of `cargo test --verbose` above) but with `--nocapture`, so the CPU/memory numbers for every benchmark show up directly in the Actions log for each PR — useful for a reviewer eyeballing whether a PR touching `subscribe`/`charge`/`pay_per_use`/`batch_charge` shifted the numbers, without needing to run anything locally.
diff --git a/docs/development/testing_runbook.md b/docs/development/testing_runbook.md
index e58365c1..1cbadbd2 100644
--- a/docs/development/testing_runbook.md
+++ b/docs/development/testing_runbook.md
@@ -15,12 +15,12 @@ Tests simulate time-based billing logic (renewal periods, grace windows, trial e
 fn test_subscription_renewal_after_interval() {
     let env = Env::default();
     let contract_id = env.register_contract(None, PayFlowContract);
-    
+
     // Create subscription at timestamp 1000
     env.ledger().set_timestamp(1000);
     let user = Address::random(&env);
     let merchant = Address::random(&env);
-    
+
     env.invoke_contract(
         &contract_id,
         &Symbol::new(&env, "subscribe"),
@@ -32,17 +32,17 @@ fn test_subscription_renewal_after_interval() {
             &86400i64,            // 24-hour interval
         ],
     );
-    
+
     // Advance time to next billing window
     env.ledger().set_timestamp(1000 + 86400 + 1); // Just past interval
-    
+
     // Verify charge is now eligible
     let eligible = env.invoke_contract(
         &contract_id,
         &Symbol::new(&env, "is_charge_eligible"),
         &vec![&env, &user],
     );
-    
+
     assert_eq!(eligible, true);
 }
 ```
@@ -54,16 +54,16 @@ fn test_subscription_renewal_after_interval() {
 fn test_grace_period_extends_charge_window() {
     let env = Env::default();
     let contract_id = env.register_contract(None, PayFlowContract);
-    
+
     env.ledger().set_timestamp(1000);
-    
+
     // Setup subscription
     let user = Address::random(&env);
     env.invoke_contract(&contract_id, &Symbol::new(&env, "subscribe"), &vec![/*...*/]);
-    
+
     // Simulate insufficient balance at charge time
     env.ledger().set_timestamp(1000 + 86400 + 1);
-    
+
     // Charge fails due to low balance
     let result = env.invoke_contract(
         &contract_id,
@@ -71,10 +71,10 @@ fn test_grace_period_extends_charge_window() {
         &vec![&env, &user],
     );
     assert!(result.is_err());
-    
+
     // Grace period window (1 hour) allows retry
     env.ledger().set_timestamp(1000 + 86400 + 3600);
-    
+
     let grace_result = env.invoke_contract(
         &contract_id,
         &Symbol::new(&env, "charge"),
@@ -91,21 +91,21 @@ fn test_grace_period_extends_charge_window() {
 fn test_trial_expires_after_duration() {
     let env = Env::default();
     let contract_id = env.register_contract(None, PayFlowContract);
-    
+
     env.ledger().set_timestamp(1000);
-    
+
     // Activate trial (30 days = 2592000 seconds)
     env.invoke_contract(
         &contract_id,
         &Symbol::new(&env, "activate_trial"),
         &vec![&env, &user],
     );
-    
+
     // Before expiration - trial active
     env.ledger().set_timestamp(1000 + 2591999);
     let status = check_subscription_status(&env, &contract_id, &user);
     assert_eq!(status, SubscriptionStatus::TrialActive);
-    
+
     // After expiration - trial expires
     env.ledger().set_timestamp(1000 + 2592001);
     let status = check_subscription_status(&env, &contract_id, &user);
@@ -121,23 +121,23 @@ fn test_trial_expires_after_duration() {
 #[test]
 fn test_charge_with_mock_token() {
     let env = Env::default();
-    
+
     // Deploy mock token contract
     let token = env.register_stellar_asset_contract(AssetType::Native);
     let token_client = TokenClient::new(&env, &token);
-    
+
     let user = Address::random(&env);
     let merchant = Address::random(&env);
-    
+
     // Mint initial balance to user
     token_client.mint(&user, &1_000_000_000i128);
-    
+
     // Deploy PayFlow contract
     let contract_id = env.register_contract(None, PayFlowContract);
-    
+
     // User approves PayFlow to spend tokens
     token_client.approve(&user, &contract_id, &1_000_000_000i128, &10000i64);
-    
+
     // Execute subscription
     env.invoke_contract(
         &contract_id,
@@ -150,7 +150,7 @@ fn test_charge_with_mock_token() {
             &86400i64,
         ],
     );
-    
+
     // Verify token approval consumed
     let balance = token_client.balance(&user);
     assert!(balance < 1_000_000_000i128);
@@ -165,16 +165,16 @@ fn test_charge_fails_with_insufficient_balance() {
     let env = Env::default();
     let token = env.register_stellar_asset_contract(AssetType::Native);
     let token_client = TokenClient::new(&env, &token);
-    
+
     let user = Address::random(&env);
     let merchant = Address::random(&env);
-    
+
     // Mint only 50 tokens to user
     token_client.mint(&user, &50i128);
-    
+
     let contract_id = env.register_contract(None, PayFlowContract);
     token_client.approve(&user, &contract_id, &50i128, &10000i64);
-    
+
     // Attempt subscription requiring 100 tokens
     let result = env.invoke_contract(
         &contract_id,
@@ -187,7 +187,7 @@ fn test_charge_fails_with_insufficient_balance() {
             &86400i64,
         ],
     );
-    
+
     // Should fail
     assert!(result.is_err());
 }
@@ -202,20 +202,20 @@ fn test_charge_fails_with_insufficient_balance() {
 fn test_subscription_ttl_extended_on_charge() {
     let env = Env::default();
     let contract_id = env.register_contract(None, PayFlowContract);
-    
+
     env.ledger().set_timestamp(1000);
-    
+
     // Create subscription
     let user = Address::random(&env);
     env.invoke_contract(&contract_id, &Symbol::new(&env, "subscribe"), &vec![/*...*/]);
-    
+
     // Get initial TTL
     let initial_ttl = env.ledger().max_live_until();
-    
+
     // Advance time and charge
     env.ledger().set_timestamp(1000 + 86400 + 1);
     env.invoke_contract(&contract_id, &Symbol::new(&env, "charge"), &vec![&env, &user]);
-    
+
     // TTL should be extended
     let new_ttl = env.ledger().max_live_until();
     assert!(new_ttl > initial_ttl);
@@ -232,7 +232,7 @@ fn test_subscription_ttl_extended_on_charge() {
 fn test_admin_freeze_panics_without_auth() {
     let env = Env::default();
     let contract_id = env.register_contract(None, PayFlowContract);
-    
+
     let unauthorized_user = Address::random(&env);
     env.as_contract(&contract_id, || {
         env.invoke_contract(
@@ -252,7 +252,7 @@ fn test_admin_freeze_panics_without_auth() {
 fn test_invalid_amount_panics() {
     let env = Env::default();
     let contract_id = env.register_contract(None, PayFlowContract);
-    
+
     let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
         env.invoke_contract(
             &contract_id,
@@ -264,7 +264,7 @@ fn test_invalid_amount_panics() {
             ],
         )
     }));
-    
+
     assert!(result.is_err());
 }
 ```
diff --git a/docs/integrations/frontend_integration.md b/docs/integrations/frontend_integration.md
index 05c227ff..cc65f223 100644
--- a/docs/integrations/frontend_integration.md
+++ b/docs/integrations/frontend_integration.md
@@ -18,13 +18,13 @@ The following operations are read-only and do not require authentication:
 **Code Example:**
 
 ```typescript
-import { StellarClient } from '@stellar/js-sdk';
+import { StellarClient } from "@stellar/js-sdk";
 
 const client = new StellarClient();
 
 // No signing required for read operations
 const status = await client.invoke({
-  method: 'get_subscription_status',
+  method: "get_subscription_status",
   args: {
     user_id: userId,
   },
@@ -44,7 +44,7 @@ Operations that modify state require a valid signature:
 
 ```typescript
 const signedInvocation = await client.invoke({
-  method: 'subscribe',
+  method: "subscribe",
   args: {
     merchant_id: merchantId,
     amount: tokenAmount,
@@ -70,11 +70,11 @@ enum SubscriptionStatus {
 // Parse returned value
 const statusCode = statusResponse.status;
 const statusMap = {
-  0: 'Active',
-  1: 'Paused',
-  2: 'Cancelled',
-  3: 'TrialActive',
-  4: 'GracePeriod',
+  0: "Active",
+  1: "Paused",
+  2: "Cancelled",
+  3: "TrialActive",
+  4: "GracePeriod",
 };
 
 const humanReadableStatus = statusMap[statusCode];
@@ -92,7 +92,7 @@ async function fetchAllSubscribers(pageSize = 100) {
 
   while (hasMore) {
     const page = await client.invoke({
-      method: 'get_subscriber_page',
+      method: "get_subscriber_page",
       args: {
         offset,
         limit: pageSize,
@@ -122,7 +122,7 @@ const [subscribers, setSubscribers] = useState([]);
 async function loadPage(pageNumber: number) {
   try {
     const data = await client.invoke({
-      method: 'get_subscriber_page',
+      method: "get_subscriber_page",
       args: {
         offset: pageNumber * PAGE_SIZE,
         limit: PAGE_SIZE,
@@ -131,7 +131,7 @@ async function loadPage(pageNumber: number) {
     setSubscribers(data.subscribers);
     setCurrentPage(pageNumber);
   } catch (error) {
-    console.error('Failed to load page:', error);
+    console.error("Failed to load page:", error);
   }
 }
 ```
@@ -141,7 +141,7 @@ async function loadPage(pageNumber: number) {
 ```typescript
 function SubscriptionCard({ subscription }) {
   const status = mapStatusCode(subscription.status);
-  
+
   return (
     <div className={`status-${status.toLowerCase()}`}>
       <h3>{subscription.merchant}</h3>
@@ -159,9 +159,9 @@ function SubscriptionCard({ subscription }) {
 try {
   const result = await client.invoke(/* ... */);
 } catch (error) {
-  if (error.includes('Unauthorized')) {
+  if (error.includes("Unauthorized")) {
     // Handle authentication failure
-  } else if (error.includes('InvalidAmount')) {
+  } else if (error.includes("InvalidAmount")) {
     // Handle validation error
   } else {
     // Log other errors
diff --git a/docs/operations/keeper_runbook.md b/docs/operations/keeper_runbook.md
index 0b31285d..3998f1d2 100644
--- a/docs/operations/keeper_runbook.md
+++ b/docs/operations/keeper_runbook.md
@@ -47,12 +47,12 @@ class KeeperBot:
         self.contract_id = contract_id
         self.keeper_keypair = keeper_keypair
         self.page_size = 100
-        
+
     def process_all_pages(self):
         """Process all subscription pages sequentially"""
         page_offset = 0
         total_charged = 0
-        
+
         while True:
             try:
                 # Invoke batch_charge for current page
@@ -65,25 +65,25 @@ class KeeperBot:
                     },
                     signer=self.keeper_keypair,
                 )
-                
+
                 charged_count = result.charged
                 total_charged += charged_count
                 logger.info(f"Page {page_offset}: Charged {charged_count} subscriptions")
-                
+
                 # If page returned fewer items than requested, we've reached the end
                 if charged_count < self.page_size:
                     logger.info(f"Completed cycle: {total_charged} total subscriptions charged")
                     break
-                
+
                 page_offset += self.page_size
-                
+
             except Exception as e:
                 logger.error(f"Failed to process page {page_offset}: {e}")
                 self.alert_operator("batch_charge failure", str(e))
                 break
-        
+
         return total_charged
-    
+
     def run_keeper_loop(self, interval_seconds=3600):
         """Main keeper loop: run batch_charge every interval_seconds"""
         while True:
@@ -92,11 +92,11 @@ class KeeperBot:
                 self.check_keeper_balance()
                 charged = self.process_all_pages()
                 logger.info(f"Cycle complete. Next run in {interval_seconds}s")
-                
+
             except Exception as e:
                 logger.error(f"Keeper loop error: {e}")
                 self.alert_operator("keeper_loop_error", str(e))
-            
+
             time.sleep(interval_seconds)
 ```
 
@@ -115,13 +115,13 @@ Rationale:
 
 ### Critical Metrics
 
-| Metric | Threshold | Action |
-|--------|-----------|--------|
-| **Keeper Account Balance** | < 10 XLM | CRITICAL - Refund keeper |
-| **Batch Charge Latency** | > 30 seconds | WARNING - Check network |
-| **Failed Charges** | > 5% of page | WARNING - Review error logs |
-| **Page Processing Time** | > 60 seconds | WARNING - Possible network congestion |
-| **Keeper Availability** | 100% uptime | CRITICAL - Ensure HA setup |
+| Metric                     | Threshold    | Action                                |
+| -------------------------- | ------------ | ------------------------------------- |
+| **Keeper Account Balance** | < 10 XLM     | CRITICAL - Refund keeper              |
+| **Batch Charge Latency**   | > 30 seconds | WARNING - Check network               |
+| **Failed Charges**         | > 5% of page | WARNING - Review error logs           |
+| **Page Processing Time**   | > 60 seconds | WARNING - Possible network congestion |
+| **Keeper Availability**    | 100% uptime  | CRITICAL - Ensure HA setup            |
 
 ### Health Check Implementation
 
@@ -134,18 +134,18 @@ def health_check(self):
         "failed_charges": self.get_failed_charge_count(),
         "time_since_last_cycle": time.time() - self.last_cycle_time,
     }
-    
+
     alerts = []
-    
+
     if health["keeper_balance"] < 10e7:  # 10 XLM in stroops
         alerts.append("CRITICAL: Keeper balance low")
-    
+
     if health["time_since_last_cycle"] > 7200:  # 2 hours
         alerts.append("CRITICAL: No successful charge cycle in 2 hours")
-    
+
     if health["failed_charges"] > 0:
         alerts.append(f"WARNING: {health['failed_charges']} failed charges")
-    
+
     return health, alerts
 ```
 
@@ -157,17 +157,17 @@ global:
   scrape_interval: 15s
 
 scrape_configs:
-  - job_name: 'keeper_metrics'
+  - job_name: "keeper_metrics"
     static_configs:
-      - targets: ['localhost:8000']
+      - targets: ["localhost:8000"]
 
 alerting:
   alertmanagers:
     - static_configs:
-        - targets: ['alertmanager:9093']
+        - targets: ["alertmanager:9093"]
 
 rule_files:
-  - 'keeper_alerts.yml'
+  - "keeper_alerts.yml"
 ```
 
 ```yaml
@@ -180,13 +180,13 @@ groups:
         for: 5m
         annotations:
           summary: "Keeper balance critically low"
-      
+
       - alert: BatchChargeFailure
         expr: rate(batch_charge_failures[5m]) > 0
         for: 5m
         annotations:
           summary: "Batch charge operation failed"
-      
+
       - alert: KeeperNotResponding
         expr: time() - keeper_last_ping > 3600
         for: 5m
@@ -203,6 +203,7 @@ groups:
 **Root Cause:** Keeper account has insufficient XLM for transaction fees
 
 **Resolution:**
+
 ```bash
 # Check current balance
 stellar account info keeper_account
@@ -223,6 +224,7 @@ stellar account info keeper_account
 **Root Cause:** Contract signature changed during deployment; keeper still using old ABI
 
 **Resolution:**
+
 ```bash
 # Update keeper bot with new contract ABI
 # Redeploy contract with new signature
@@ -239,6 +241,7 @@ stellar contract read --id CONTRACT_ID
 **Root Cause:** Page offset exceeds total subscription count; no early termination
 
 **Resolution:**
+
 ```python
 # Keeper should check for empty pages and exit loop
 if charged_count == 0 and page_offset > 0:
@@ -259,6 +262,7 @@ max_pages = (total_subs + page_size - 1) // page_size
 **Root Cause:** High load on RPC node or Stellar network congestion
 
 **Monitoring & Response:**
+
 ```python
 # Track latency percentiles
 latency_p95 = get_latency_percentile(95)
@@ -281,6 +285,7 @@ if latency_p95 > 30000:  # 30 seconds
 ```
 
 **Risks:**
+
 - Single point of failure
 - Missed billing cycles if keeper offline
 - No redundancy
@@ -295,7 +300,7 @@ class KeeperCluster:
     def __init__(self):
         self.redis = redis.Redis(host='redis-leader', port=6379)
         self.keeper_id = os.getenv('KEEPER_ID')
-    
+
     def acquire_leadership(self):
         """Attempt to become the active keeper"""
         acquired = self.redis.set(
@@ -305,7 +310,7 @@ class KeeperCluster:
             nx=True  # Only if key doesn't exist
         )
         return acquired
-    
+
     def maintain_leadership(self):
         """Renew leadership lease"""
         while True:
@@ -326,7 +331,7 @@ resource "kubernetes_deployment" "keeper" {
 
   spec {
     replicas = 3
-    
+
     template {
       spec {
         container {
@@ -607,11 +612,11 @@ Use this when billing is impaired, funds may be at risk, or the contract must be
 
 ### Severity & who to alert
 
-| Severity | Examples | Alert |
-| --- | --- | --- |
-| SEV-1 | Unexpected drains, admin key suspected compromise, uncontrolled charges | Page on-call **and** protocol admin; security@payflow.dev |
-| SEV-2 | Contract paused unexpectedly, keeper down > 1 interval, RPC total outage | Page on-call; notify merchants if charges delay |
-| SEV-3 | DLQ buildup, elevated skip rates, single-region RPC degrade | Ticket + Slack; fix in business hours |
+| Severity | Examples                                                                 | Alert                                                     |
+| -------- | ------------------------------------------------------------------------ | --------------------------------------------------------- |
+| SEV-1    | Unexpected drains, admin key suspected compromise, uncontrolled charges  | Page on-call **and** protocol admin; security@payflow.dev |
+| SEV-2    | Contract paused unexpectedly, keeper down > 1 interval, RPC total outage | Page on-call; notify merchants if charges delay           |
+| SEV-3    | DLQ buildup, elevated skip rates, single-region RPC degrade              | Ticket + Slack; fix in business hours                     |
 
 ### What to check (first 15 minutes)
 
@@ -658,7 +663,7 @@ systemctl stop payflow-keeper
 
 ### Recovery / unpause
 
-1. Root-cause fixed and verified on Testnet if applicable.  
+1. Root-cause fixed and verified on Testnet if applicable.
 2. Admin unpauses:
 
 ```bash
@@ -670,7 +675,7 @@ soroban contract invoke \
 # Expected: success
 ```
 
-3. Start keepers; drain DLQ with the recovery procedure.  
+3. Start keepers; drain DLQ with the recovery procedure.
 4. Post-incident: timeline, customer impact, follow-ups (see also [`docs/DEPLOYMENT.md`](../DEPLOYMENT.md) rollback notes).
 
 ### Verification
diff --git a/docs/security/audit-preparation.md b/docs/security/audit-preparation.md
index d23be02e..62cadfe0 100644
--- a/docs/security/audit-preparation.md
+++ b/docs/security/audit-preparation.md
@@ -83,23 +83,23 @@ Auditors should treat the following as **required properties** of a correct depl
 
 Mapped from [`threat_matrix.md`](threat_matrix.md) and [`SECURITY.md`](../SECURITY.md). Ratings are qualitative for briefing (Likelihood × Impact: L/M/H).
 
-| Threat | Category | L | I | Primary mitigations |
-| --- | --- | --- | --- | --- |
-| Token allowance draining via repeated charges | Access / funds | M | H | Per-tx max amount; min interval; grace window; SAC allowance ceiling |
-| Unauthenticated admin actions | Access control | L | H | `require_auth` / admin checks on privileged entrypoints; two-step admin transfer |
-| Short-interval spam / resource exhaustion | DoS | M | M | Min interval floor; batch size caps; pagination |
-| Excessive permissionless `charge()` calls | Abuse | H | L | Interval + grace checks; fail closed; no auth does not bypass amount rules |
-| Keeper downtime / delayed billing | Liveness | M | M | Off-chain HA keepers; monitoring; user re-subscribe after grace |
-| Admin key compromise | Access control | L | H | Hardware wallet / multisig before mainnet; pause circuit breaker |
-| Storage TTL expiry / stale temporary proposals | Integrity | M | M | Persistent TTL refresh on lifecycle; temp data treated as non-authoritative |
-| Malicious or buggy upgrade | Upgrade | L | H | Explicit migrate; governance of upgrade authority; WASM hash verification |
+| Threat                                         | Category       | L   | I   | Primary mitigations                                                              |
+| ---------------------------------------------- | -------------- | --- | --- | -------------------------------------------------------------------------------- |
+| Token allowance draining via repeated charges  | Access / funds | M   | H   | Per-tx max amount; min interval; grace window; SAC allowance ceiling             |
+| Unauthenticated admin actions                  | Access control | L   | H   | `require_auth` / admin checks on privileged entrypoints; two-step admin transfer |
+| Short-interval spam / resource exhaustion      | DoS            | M   | M   | Min interval floor; batch size caps; pagination                                  |
+| Excessive permissionless `charge()` calls      | Abuse          | H   | L   | Interval + grace checks; fail closed; no auth does not bypass amount rules       |
+| Keeper downtime / delayed billing              | Liveness       | M   | M   | Off-chain HA keepers; monitoring; user re-subscribe after grace                  |
+| Admin key compromise                           | Access control | L   | H   | Hardware wallet / multisig before mainnet; pause circuit breaker                 |
+| Storage TTL expiry / stale temporary proposals | Integrity      | M   | M   | Persistent TTL refresh on lifecycle; temp data treated as non-authoritative      |
+| Malicious or buggy upgrade                     | Upgrade        | L   | H   | Explicit migrate; governance of upgrade authority; WASM hash verification        |
 
 ### Threat categories for audit deep-dives
 
-1. **Access control** — admin, merchant freeze/whitelist, user auth boundaries  
-2. **Arithmetic / accounting** — fees, daily limits, global volume, revenue balances  
-3. **Reentrancy / external calls** — token contract interactions, fail-closed panics  
-4. **Liveness & operational** — keeper permissionless charge, pause behavior  
+1. **Access control** — admin, merchant freeze/whitelist, user auth boundaries
+2. **Arithmetic / accounting** — fees, daily limits, global volume, revenue balances
+3. **Reentrancy / external calls** — token contract interactions, fail-closed panics
+4. **Liveness & operational** — keeper permissionless charge, pause behavior
 
 ---
 
@@ -107,22 +107,22 @@ Mapped from [`threat_matrix.md`](threat_matrix.md) and [`SECURITY.md`](../SECURI
 
 ### In scope
 
-| Component | Path / artifact | Notes |
-| --- | --- | --- |
-| FlowPay Soroban contract | `contract/src/**` | All public entrypoints and modules |
-| Error taxonomy | `contract/src/errors.rs` | Panic codes and fail-closed behavior |
-| Build & tests | `contract/Cargo.toml`, `contract/src/test.rs` | Unit/integration tests in-repo |
-| Deployed WASM at audit tag | Release build `flow_pay.wasm` | Hash must match tag |
+| Component                  | Path / artifact                               | Notes                                |
+| -------------------------- | --------------------------------------------- | ------------------------------------ |
+| FlowPay Soroban contract   | `contract/src/**`                             | All public entrypoints and modules   |
+| Error taxonomy             | `contract/src/errors.rs`                      | Panic codes and fail-closed behavior |
+| Build & tests              | `contract/Cargo.toml`, `contract/src/test.rs` | Unit/integration tests in-repo       |
+| Deployed WASM at audit tag | Release build `flow_pay.wasm`                 | Hash must match tag                  |
 
 ### Out of scope (unless explicitly added)
 
-| Component | Reason |
-| --- | --- |
-| Frontend (`frontend/`) | UX / wallet integration; not on-chain fund custody logic |
-| Scripts (`scripts/`) | Operational helpers; not consensus-critical |
+| Component                          | Reason                                                                              |
+| ---------------------------------- | ----------------------------------------------------------------------------------- |
+| Frontend (`frontend/`)             | UX / wallet integration; not on-chain fund custody logic                            |
+| Scripts (`scripts/`)               | Operational helpers; not consensus-critical                                         |
 | Keeper bots / off-chain schedulers | Liveness dependency; document assumptions but not full code audit unless contracted |
-| Third-party SAC / Stellar core | Platform trust assumptions |
-| Marketing site / docs typos | Non-security unless they contradict invariants |
+| Third-party SAC / Stellar core     | Platform trust assumptions                                                          |
+| Marketing site / docs typos        | Non-security unless they contradict invariants                                      |
 
 ### Assumptions auditors may rely on
 
@@ -136,15 +136,15 @@ Mapped from [`threat_matrix.md`](threat_matrix.md) and [`SECURITY.md`](../SECURI
 
 Document these so reviewers do **not** file them as unexpected vulnerabilities without context.
 
-| Behavior | Why it exists | Residual risk |
-| --- | --- | --- |
-| **`charge()` / `batch_charge()` are permissionless** | Keepers (or anyone) must trigger billing without holding user keys | Spam txs / griefing gas; mitigated by interval checks and fail-closed transfers |
-| **Broad admin powers** (pause, freeze, fee, upgrade-related ops) | Early protocol needs emergency control | Key compromise impact is high — require HW wallet / multisig for mainnet |
-| **External keeper liveness** | Soroban has no native cron | Missed cycles → grace elapsed → user re-subscribe |
-| **No on-chain dispute layer** | Product scope | Failed/delayed charges handled operationally |
-| **Single-token-per-deployment default** | Simplifies accounting | Multi-token needs separate instances or future design |
-| **Temporary storage for daily limits / proposals** | TTL auto-reset / short-lived commits | Entries can disappear; code must tolerate absence |
-| **Upgrade wrapper present** | Allows bugfix evolution | Upgrade authority must be governed carefully |
+| Behavior                                                         | Why it exists                                                      | Residual risk                                                                   |
+| ---------------------------------------------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------- |
+| **`charge()` / `batch_charge()` are permissionless**             | Keepers (or anyone) must trigger billing without holding user keys | Spam txs / griefing gas; mitigated by interval checks and fail-closed transfers |
+| **Broad admin powers** (pause, freeze, fee, upgrade-related ops) | Early protocol needs emergency control                             | Key compromise impact is high — require HW wallet / multisig for mainnet        |
+| **External keeper liveness**                                     | Soroban has no native cron                                         | Missed cycles → grace elapsed → user re-subscribe                               |
+| **No on-chain dispute layer**                                    | Product scope                                                      | Failed/delayed charges handled operationally                                    |
+| **Single-token-per-deployment default**                          | Simplifies accounting                                              | Multi-token needs separate instances or future design                           |
+| **Temporary storage for daily limits / proposals**               | TTL auto-reset / short-lived commits                               | Entries can disappear; code must tolerate absence                               |
+| **Upgrade wrapper present**                                      | Allows bugfix evolution                                            | Upgrade authority must be governed carefully                                    |
 
 > Permissionless charge is **by design**: correctness comes from allowance + interval + active-state checks, not from keeper identity. See FAQ in [`README.md`](../../README.md) and [`SECURITY.md`](../SECURITY.md).
 
@@ -154,20 +154,20 @@ Document these so reviewers do **not** file them as unexpected vulnerabilities w
 
 Provide auditors with a short written brief containing:
 
-1. Tag / commit SHA and WASM hash  
-2. Link to this document + threat matrix  
-3. Top three concerns you want emphasized (e.g. fee math, pause paths, batch_charge)  
-4. Timeline and severity triage SLA  
+1. Tag / commit SHA and WASM hash
+2. Link to this document + threat matrix
+3. Top three concerns you want emphasized (e.g. fee math, pause paths, batch_charge)
+4. Timeline and severity triage SLA
 5. Disclosure preference (GitHub Security Advisories / email)
 
 ---
 
 ## 7. After the Audit
 
-- [ ] Triage findings by severity; assign owners  
-- [ ] Patch in private forks if needed; re-run full `cargo test`  
-- [ ] Re-audit or delta-review critical fixes  
-- [ ] Publish report (or summary) before mainnet  
-- [ ] Update [`SECURITY.md`](../SECURITY.md) status from “not audited” when complete  
+- [ ] Triage findings by severity; assign owners
+- [ ] Patch in private forks if needed; re-run full `cargo test`
+- [ ] Re-audit or delta-review critical fixes
+- [ ] Publish report (or summary) before mainnet
+- [ ] Update [`SECURITY.md`](../SECURITY.md) status from “not audited” when complete
 
 For mainnet go-live gates after audit, see [`MAINNET-DEPLOYMENT.md`](../MAINNET-DEPLOYMENT.md) (when present) and [`DEPLOYMENT.md`](../DEPLOYMENT.md).
diff --git a/docs/security/threat_matrix.md b/docs/security/threat_matrix.md
index 110724e3..2bc9382a 100644
--- a/docs/security/threat_matrix.md
+++ b/docs/security/threat_matrix.md
@@ -34,6 +34,7 @@
 **Threat:** Attacker exploits unlimited allowance to drain user tokens.
 
 **Attack Vector:**
+
 - Malicious merchant requests infinite allowance
 - User unknowingly approves excessive spending
 - Contract executes repeated charges exceeding authorized amount
@@ -63,6 +64,7 @@ fn validate_billing_interval(interval: u64) -> Result<(), Error> {
 ```
 
 **Mitigation Strategy:**
+
 - ✓ Hard cap on transaction amount (`MAX_AMOUNT`)
 - ✓ Minimum billing interval prevents rapid draining
 - ✓ User-controlled allowance limits at token level
@@ -75,6 +77,7 @@ fn validate_billing_interval(interval: u64) -> Result<(), Error> {
 **Threat:** Unauthorized caller attempts administrative operations.
 
 **Attack Vector:**
+
 - Attacker calls `admin_emergency_freeze()` without authorization
 - Attacker modifies critical parameters via `admin_update_*` functions
 - Contract state corrupted or service halted
@@ -86,11 +89,11 @@ fn validate_billing_interval(interval: u64) -> Result<(), Error> {
 fn admin_emergency_freeze(env: Env) -> Result<(), Error> {
     let admin = env.storage().instance().get::<Address>(&ADMIN_KEY)?;
     let caller = env.invoker();
-    
+
     if caller != admin {
         return Err(Error::Unauthorized);
     }
-    
+
     // Execute freeze logic
     Ok(())
 }
@@ -106,6 +109,7 @@ fn require_admin(env: &Env) -> Result<Address, Error> {
 ```
 
 **Mitigation Strategy:**
+
 - ✓ Every admin function validates `env.invoker()` against stored admin address
 - ✓ Admin address immutable after deployment (no transfer function)
 - ✓ All modifications require explicit authorization check
@@ -118,6 +122,7 @@ fn require_admin(env: &Env) -> Result<Address, Error> {
 **Threat:** Attacker uses minimal billing intervals to spam blockchain and exhaust resources.
 
 **Attack Vector:**
+
 - Create subscription with 1-second interval
 - Spam `batch_charge()` call thousands of times per minute
 - Exhaust keeper bot resources or degrade network performance
@@ -136,28 +141,29 @@ fn validate_charge_eligibility(
 ) -> Result<(), Error> {
     let next_charge_time = last_charge_time.checked_add(billing_interval)
         .ok_or(Error::ArithmeticOverflow)?;
-    
+
     if current_time < next_charge_time {
         return Err(Error::TooEarlyToCharge);
     }
-    
+
     Ok(())
 }
 
 // batch.rs: Pagination prevents single-transaction overload
 fn batch_charge(env: Env, page_offset: u32, page_size: u32) -> Result<u32, Error> {
     const MAX_PAGE_SIZE: u32 = 100;
-    
+
     if page_size > MAX_PAGE_SIZE {
         return Err(Error::PageSizeTooLarge);
     }
-    
+
     // Process only one page per invocation
     Ok(process_page(env, page_offset, page_size)?)
 }
 ```
 
 **Mitigation Strategy:**
+
 - ✓ Minimum 24-hour billing interval enforced at contract validation
 - ✓ `batch_charge()` processes limited pages per call (max 100 subscriptions)
 - ✓ Timestamp validation prevents charging same subscription twice in interval
@@ -181,6 +187,7 @@ fn admin_emergency_freeze(env: Env) -> Result<(), Error> {
 ```
 
 **Risks & Mitigations:**
+
 - **Risk:** Freezing contract stops all billing (potential revenue loss)
 - **Mitigation:** Only callable by admin; requires off-chain governance approval
 - **Risk:** Indefinite freeze state could orphan active subscriptions
diff --git a/docs/spec/lifecycle_spec.md b/docs/spec/lifecycle_spec.md
index 2c3f3e86..e0d3b780 100644
--- a/docs/spec/lifecycle_spec.md
+++ b/docs/spec/lifecycle_spec.md
@@ -46,17 +46,20 @@ A subscription exists in a multi-dimensional state space defined by:
 ### 1. Nonexistent
 
 **Storage Condition:**
+
 ```rust
 env.storage().persistent().get(&DataKey::Subscription(user)) == None
 ```
 
 **Characteristics:**
+
 - No subscription data exists for the user
 - Cannot be charged
 - Cannot be cancelled
 - Can be created via `subscribe()` or `subscribe_with_metadata()`
 
 **Valid Transitions:**
+
 - → **Active (Standard)** via `subscribe()` or `subscribe_with_metadata()`
 - → **Active (Trial)** via `subscribe()` or `subscribe_with_metadata()` with `trial_period: Some(u64)`
 
@@ -65,6 +68,7 @@ env.storage().persistent().get(&DataKey::Subscription(user)) == None
 ### 2. Active (Standard)
 
 **Storage Condition:**
+
 ```rust
 Subscription {
     active: true,
@@ -75,18 +79,21 @@ Subscription {
 ```
 
 **Characteristics:**
+
 - Fully operational subscription
 - `last_charged` equals subscription creation timestamp
 - Eligible for charge when `current_time >= last_charged + interval`
 - No trial period active
 
 **Valid Transitions:**
+
 - → **Active (Chargeable)** when `current_time >= last_charged + interval`
 - → **Paused** via `pause()`
 - → **Cancelled** via `cancel()`
 - → **Active (Standard)** via `subscribe()` (overwrites existing subscription)
 
 **Operations Allowed:**
+
 - `pay_per_use()`: ✅
 - `charge()`: ❌ (IntervalNotElapsed until chargeable)
 - `pause()`: ✅
@@ -97,6 +104,7 @@ Subscription {
 ### 3. Active (Trial)
 
 **Storage Condition:**
+
 ```rust
 Subscription {
     active: true,
@@ -107,18 +115,21 @@ Subscription {
 ```
 
 **Characteristics:**
+
 - Subscription is active but billing is deferred
 - `last_charged` is set to a future timestamp (`subscribe_time + trial_period`)
 - User can use `pay_per_use()` immediately
 - Cannot be charged until trial expires
 
 **Valid Transitions:**
+
 - → **Active (Standard)** when `current_time >= last_charged` (trial expires)
 - → **Active (Chargeable)** when `current_time >= last_charged + interval` (trial expires + interval elapses)
 - → **Paused** via `pause()`
 - → **Cancelled** via `cancel()`
 
 **Operations Allowed:**
+
 - `pay_per_use()`: ✅
 - `charge()`: ❌ (IntervalNotElapsed until trial expires)
 - `pause()`: ✅
@@ -129,6 +140,7 @@ Subscription {
 ### 4. Active (Chargeable)
 
 **Storage Condition:**
+
 ```rust
 Subscription {
     active: true,
@@ -139,17 +151,20 @@ where current_time >= T + interval
 ```
 
 **Characteristics:**
+
 - Billing interval has elapsed
 - Eligible for immediate charge
 - Still within grace period (if configured)
 
 **Valid Transitions:**
+
 - → **Active (Standard)** via `charge()` (resets `last_charged` to current timestamp)
 - → **Active (Grace Expired)** when `current_time > last_charged + interval + grace_period` (if grace period > 0)
 - → **Paused** via `pause()`
 - → **Cancelled** via `cancel()`
 
 **Operations Allowed:**
+
 - `pay_per_use()`: ✅
 - `charge()`: ✅
 - `pause()`: ✅
@@ -160,6 +175,7 @@ where current_time >= T + interval
 ### 5. Active (Grace Expired)
 
 **Storage Condition:**
+
 ```rust
 Subscription {
     active: true,
@@ -170,16 +186,19 @@ where grace_period > 0 && current_time > T + interval + grace_period
 ```
 
 **Characteristics:**
+
 - Charge window has elapsed
 - Grace period has expired
 - Charge attempts will fail with `GracePeriodElapsed`
 - Subscription remains active but unchargeable until interval advances again
 
 **Valid Transitions:**
+
 - → **Active (Standard)** via `subscribe()` (resets subscription state)
 - → **Cancelled** via `cancel()`
 
 **Operations Allowed:**
+
 - `pay_per_use()`: ✅
 - `charge()`: ❌ (GracePeriodElapsed)
 - `pause()`: ✅
@@ -190,6 +209,7 @@ where grace_period > 0 && current_time > T + interval + grace_period
 ### 6. Paused
 
 **Storage Condition:**
+
 ```rust
 Subscription {
     active: true,
@@ -199,16 +219,19 @@ Subscription {
 ```
 
 **Characteristics:**
+
 - Subscription exists and is marked active
 - All payment operations are blocked
 - `last_charged` is frozen (does not advance)
 - User retains control and can resume or cancel
 
 **Valid Transitions:**
+
 - → **Active (Standard)** or **Active (Chargeable)** via `resume()` (depends on current time vs `last_charged + interval`)
 - → **Cancelled** via `cancel()`
 
 **Operations Allowed:**
+
 - `pay_per_use()`: ❌ (subscription is paused)
 - `charge()`: ❌ (subscription is paused)
 - `pause()`: ❌ (already paused)
@@ -220,6 +243,7 @@ Subscription {
 ### 7. Cancelled
 
 **Storage Condition:**
+
 ```rust
 Subscription {
     active: false,
@@ -228,15 +252,18 @@ Subscription {
 ```
 
 **Characteristics:**
+
 - Subscription exists in storage but is marked inactive
 - All payment operations are permanently blocked
 - Cannot be resumed
 - Can only be replaced by resubscribing
 
 **Valid Transitions:**
+
 - → **Active (Standard)** or **Active (Trial)** via `subscribe()` or `subscribe_with_metadata()` (creates new subscription, overwrites cancelled state)
 
 **Operations Allowed:**
+
 - `pay_per_use()`: ❌ (subscription is not active)
 - `charge()`: ❌ (subscription is not active)
 - `pause()`: ❌ (subscription is not active)
@@ -323,11 +350,13 @@ Subscription {
 **Storage Key:** `DataKey::SubscriptionMeta(user)`
 
 **Structure:**
+
 ```rust
 String // max 64 bytes
 ```
 
 **Lifecycle:**
+
 - Created via `set_metadata()` or `subscribe_with_metadata()`
 - Persists independently of subscription state
 - Not deleted on `cancel()`
@@ -338,11 +367,13 @@ String // max 64 bytes
 **Storage Key:** `DataKey::ChargeHistory(user)`
 
 **Structure:**
+
 ```rust
 Vec<u64> // last 12 charge timestamps
 ```
 
 **Lifecycle:**
+
 - Appends a timestamp on each successful `charge()` call
 - Capped at 12 entries (FIFO)
 - Persists through pause/resume cycles
@@ -353,11 +384,13 @@ Vec<u64> // last 12 charge timestamps
 **Storage Key:** `DataKey::Referral(user)`
 
 **Structure:**
+
 ```rust
 Address // referrer address
 ```
 
 **Lifecycle:**
+
 - Set on first `subscribe()` or `subscribe_with_metadata()` call with `referrer: Some(Address)`
 - Immutable after first write
 - Persists through subscription rewrites
@@ -382,6 +415,7 @@ Address // referrer address
   - After window: `GracePeriodElapsed` error
 
 **State Integrity:**
+
 - Grace period changes do not retroactively affect existing subscriptions
 - Each `charge()` call evaluates grace period against the current global setting
 
@@ -392,6 +426,7 @@ Address // referrer address
 **Parameter:** `trial_period: Option<u64>` (passed to `subscribe()` or `subscribe_with_metadata()`)
 
 **Implementation:**
+
 ```rust
 let last_charged = match trial_period {
     Some(period) => now + period,
@@ -400,6 +435,7 @@ let last_charged = match trial_period {
 ```
 
 **State Implications:**
+
 - Trial subscriptions are immediately **Active** but not **Chargeable**
 - `pay_per_use()` works immediately during trial
 - First `charge()` can occur at `last_charged + interval` (i.e., `subscribe_time + trial_period + interval`)
@@ -411,16 +447,19 @@ let last_charged = match trial_period {
 ### Pause
 
 **Preconditions:**
+
 - Subscription must exist
 - `active == true`
 
 **State Changes:**
+
 ```rust
 sub.paused = true;
 // last_charged unchanged
 ```
 
 **Effect:**
+
 - Freezes subscription state
 - All payment operations blocked
 - Time does not advance billing eligibility
@@ -428,17 +467,20 @@ sub.paused = true;
 ### Resume
 
 **Preconditions:**
+
 - Subscription must exist
 - `active == true`
 - `paused == true`
 
 **State Changes:**
+
 ```rust
 sub.paused = false;
 // last_charged unchanged
 ```
 
 **Effect:**
+
 - Unfreezes subscription
 - Billing eligibility resumes based on original `last_charged` timestamp
 - If `current_time >= last_charged + interval` immediately after resume, subscription is **Active (Chargeable)**
@@ -450,11 +492,13 @@ sub.paused = false;
 **Operation:** `subscribe()` or `subscribe_with_metadata()` on a user with an existing subscription
 
 **Effect:**
+
 - Completely overwrites the existing subscription struct
 - Resets all fields (`merchant`, `amount`, `interval`, `last_charged`, `active`, `paused`, `token`)
 - Does not modify `active_count` if previous subscription was active (no double-increment)
 
 **Use Case:**
+
 - Upgrading/downgrading plan
 - Switching merchant
 - Switching token
@@ -467,15 +511,18 @@ sub.paused = false;
 **Operation:** `cancel()`
 
 **Preconditions:**
+
 - Subscription must exist
 
 **State Changes:**
+
 ```rust
 sub.active = false;
 // all other fields unchanged
 ```
 
 **Side Effects:**
+
 - Decrements `ActiveCount` (global counter)
 - Emits `cancelled` event
 - Does not delete subscription from storage
@@ -517,6 +564,7 @@ sub.active = false;
 **Storage:** `DataKey::GlobalVolumeWindow` (instance storage)
 
 **Structure:**
+
 ```rust
 pub struct GlobalVolumeWindow {
     pub current_window_start: u64,
@@ -529,6 +577,7 @@ pub struct GlobalVolumeWindow {
 **Window Duration:** `HOUR_IN_SECONDS = 3600`
 
 **Behavior:**
+
 - Tracks cumulative transaction volume across all users
 - Window resets when `current_time >= current_window_start + 3600`
 - Increments on every successful `charge()` and `pay_per_use()` transfer
@@ -536,6 +585,7 @@ pub struct GlobalVolumeWindow {
 - Uses `checked_add` to prevent overflow
 
 **State Integrity:**
+
 - Only successful transfers contribute to volume tracking
 - Failed transactions (e.g., insufficient balance) do not increment volume
 - Volume check occurs **after** `transfer_from()` succeeds
@@ -547,11 +597,13 @@ pub struct GlobalVolumeWindow {
 **Storage:** `DataKey::ContractPaused` (instance storage, `bool`)
 
 **Effect:**
+
 - When `true`, all protocol operations can be blocked (implementation-dependent)
 - Readable via `get_protocol_stats().contract_paused`
 - Controlled by admin via `pause_contract()` and `unpause_contract()`
 
 **Current Implementation:**
+
 - No operations currently check `ContractPaused` flag
 - Reserved for future emergency stop functionality
 
@@ -559,30 +611,30 @@ pub struct GlobalVolumeWindow {
 
 ## Summary of State Flags
 
-| State | `active` | `paused` | Chargeable | PPU Allowed |
-|---|---|---|---|---|
-| Nonexistent | N/A | N/A | ❌ | ❌ |
-| Active (Standard) | `true` | `false` | ❌ | ✅ |
-| Active (Trial) | `true` | `false` | ❌ | ✅ |
-| Active (Chargeable) | `true` | `false` | ✅ | ✅ |
-| Active (Grace Expired) | `true` | `false` | ❌ | ✅ |
-| Paused | `true` | `true` | ❌ | ❌ |
-| Cancelled | `false` | * | ❌ | ❌ |
+| State                  | `active` | `paused` | Chargeable | PPU Allowed |
+| ---------------------- | -------- | -------- | ---------- | ----------- |
+| Nonexistent            | N/A      | N/A      | ❌         | ❌          |
+| Active (Standard)      | `true`   | `false`  | ❌         | ✅          |
+| Active (Trial)         | `true`   | `false`  | ❌         | ✅          |
+| Active (Chargeable)    | `true`   | `false`  | ✅         | ✅          |
+| Active (Grace Expired) | `true`   | `false`  | ❌         | ✅          |
+| Paused                 | `true`   | `true`   | ❌         | ❌          |
+| Cancelled              | `false`  | *        | ❌         | ❌          |
 
 ---
 
 ## Appendix: Storage Schema
 
-| Key | Type | Scope | TTL |
-|---|---|---|---|
-| `Subscription(user)` | `Subscription` | Persistent | 6307200 ledgers (~1 year) |
-| `SubscriptionMeta(user)` | `String` | Persistent | Not extended by charge |
-| `ChargeHistory(user)` | `Vec<u64>` | Persistent | Not extended by charge |
-| `Referral(user)` | `Address` | Persistent | Not extended by charge |
-| `ActiveCount` | `u64` | Instance | Contract lifetime |
-| `GracePeriod` | `u64` | Instance | Contract lifetime |
-| `GlobalVolumeWindow` | `GlobalVolumeWindow` | Instance | Contract lifetime |
-| `ContractPaused` | `bool` | Instance | Contract lifetime |
+| Key                      | Type                 | Scope      | TTL                       |
+| ------------------------ | -------------------- | ---------- | ------------------------- |
+| `Subscription(user)`     | `Subscription`       | Persistent | 6307200 ledgers (~1 year) |
+| `SubscriptionMeta(user)` | `String`             | Persistent | Not extended by charge    |
+| `ChargeHistory(user)`    | `Vec<u64>`           | Persistent | Not extended by charge    |
+| `Referral(user)`         | `Address`            | Persistent | Not extended by charge    |
+| `ActiveCount`            | `u64`                | Instance   | Contract lifetime         |
+| `GracePeriod`            | `u64`                | Instance   | Contract lifetime         |
+| `GlobalVolumeWindow`     | `GlobalVolumeWindow` | Instance   | Contract lifetime         |
+| `ContractPaused`         | `bool`               | Instance   | Contract lifetime         |
 
 ---
 
diff --git a/scripts/replay-dlq.ts b/scripts/replay-dlq.ts
new file mode 100644
index 00000000..83993cd8
--- /dev/null
+++ b/scripts/replay-dlq.ts
@@ -0,0 +1,414 @@
+#!/usr/bin/env tsx
+/**
+ * replay-dlq.ts — Retry dead-letter queue entries for FlowPay keeper
+ *
+ * Reads dlq/failed-batches.jsonl (written by keeper.ts) line by line and
+ * resubmits each failed batch_charge. Successfully replayed entries are moved
+ * to dlq/replayed-batches.jsonl; permanently-failed entries are moved to
+ * dlq/dead-batches.jsonl so the file shrinks on each run.
+ *
+ * Usage
+ * ─────
+ *   CONTRACT_ID=C... KEEPER_SECRET=S... tsx replay-dlq.ts [--dry-run]
+ *
+ * Options
+ * ───────
+ *   --dry-run     Print what would be retried without submitting any transactions.
+ *   --help, -h    Show this help.
+ *
+ * Environment variables
+ * ─────────────────────
+ *   CONTRACT_ID          Required. Deployed FlowPay contract ID.
+ *   KEEPER_SECRET        Required. Stellar secret key (S…).
+ *   RPC_URL              Soroban RPC endpoint (default: testnet).
+ *   NETWORK_PASSPHRASE   Stellar network passphrase (default: testnet).
+ *   KEEPER_MAX_RETRIES   Retry attempts per entry (default: 3).
+ *   KEEPER_RETRY_BASE_MS Base delay in ms (default: 1000).
+ *   DLQ_FILE             Path to the input JSONL file (default: dlq/failed-batches.jsonl).
+ *   LOG_LEVEL            debug | info | warn | error (default: info).
+ *
+ * Exit codes
+ * ──────────
+ *   0 — all entries replayed (or DLQ empty, or --dry-run)
+ *   1 — one or more entries could not be replayed (moved to dead-batches.jsonl)
+ */
+
+import {
+  Contract,
+  Keypair,
+  Networks,
+  TransactionBuilder,
+  BASE_FEE,
+  nativeToScVal,
+  xdr,
+} from "@stellar/stellar-sdk";
+import { Server, assembleTransaction } from "@stellar/stellar-sdk/rpc";
+import {
+  existsSync,
+  readFileSync,
+  writeFileSync,
+  appendFileSync,
+  mkdirSync,
+} from "node:fs";
+import { dirname, resolve } from "node:path";
+
+// ── Configuration ─────────────────────────────────────────────────────────────
+
+const CONTRACT_ID = process.env.CONTRACT_ID ?? "";
+const KEEPER_SECRET = process.env.KEEPER_SECRET ?? "";
+const RPC_URL = process.env.RPC_URL ?? "https://soroban-testnet.stellar.org";
+const NETWORK_PASSPHRASE = (process.env.NETWORK_PASSPHRASE ??
+  Networks.TESTNET) as string;
+const KEEPER_MAX_RETRIES = parseInt(process.env.KEEPER_MAX_RETRIES ?? "3", 10);
+const KEEPER_RETRY_BASE_MS = parseInt(
+  process.env.KEEPER_RETRY_BASE_MS ?? "1000",
+  10,
+);
+const DLQ_FILE = resolve(process.env.DLQ_FILE ?? "dlq/failed-batches.jsonl");
+const LOG_LEVEL = (process.env.LOG_LEVEL ?? "info") as
+  "debug" | "info" | "warn" | "error";
+
+const DLQ_DIR = dirname(DLQ_FILE);
+const REPLAYED_FILE = resolve(DLQ_DIR, "replayed-batches.jsonl");
+const DEAD_FILE = resolve(DLQ_DIR, "dead-batches.jsonl");
+
+// ── Logging ───────────────────────────────────────────────────────────────────
+
+const LEVEL_ORDER: Record<string, number> = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3,
+};
+const activeLevel = LEVEL_ORDER[LOG_LEVEL] ?? 1;
+
+function log(
+  level: "debug" | "info" | "warn" | "error",
+  msg: string,
+  meta?: Record<string, unknown>,
+): void {
+  if ((LEVEL_ORDER[level] ?? 0) < activeLevel) return;
+  const entry = { ts: new Date().toISOString(), level, msg, ...(meta ?? {}) };
+  (level === "error" || level === "warn"
+    ? process.stderr
+    : process.stdout
+  ).write(JSON.stringify(entry) + "\n");
+}
+
+// ── Types (mirror DlqEntry from keeper.ts) ────────────────────────────────────
+
+interface DlqEntry {
+  timestamp: string;
+  offset: number;
+  limit: number;
+  error: string;
+  tx_xdr: string | null;
+  attempts: number;
+}
+
+// ── Permanent-failure detection ───────────────────────────────────────────────
+
+const PERMANENT_ERROR_PATTERNS: readonly string[] = [
+  "NoSubscriptionFound",
+  "SubscriptionInactive",
+  "ContractPaused",
+  "ContractPausedError",
+  "Unauthorized",
+];
+
+function isPermanentError(msg: string): boolean {
+  return PERMANENT_ERROR_PATTERNS.some((p) => msg.includes(p));
+}
+
+// ── Retry helper ──────────────────────────────────────────────────────────────
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+async function retryWithBackoff<T>(
+  fn: () => Promise<T>,
+  maxAttempts: number,
+  baseMs: number,
+  context: string,
+): Promise<T> {
+  let lastError: Error = new Error("unknown");
+
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+      if (isPermanentError(lastError.message)) throw lastError;
+      if (attempt < maxAttempts) {
+        const delay = baseMs * Math.pow(2, attempt - 1);
+        log("warn", `${context} attempt ${attempt}/${maxAttempts} failed`, {
+          error: lastError.message,
+          retry_in_ms: delay,
+        });
+        await sleep(delay);
+      }
+    }
+  }
+  throw lastError;
+}
+
+// ── RPC helpers ───────────────────────────────────────────────────────────────
+
+function parseChargeResults(retval: xdr.ScVal): {
+  charged: number;
+  skipped: number;
+} {
+  let charged = 0;
+  let skipped = 0;
+  for (const item of retval.vec() ?? []) {
+    try {
+      const name = item.switch().name;
+      if (name === "scvVec") {
+        item.vec()?.[0]?.sym()?.toString() === "Charged"
+          ? charged++
+          : skipped++;
+      } else if (name === "scvMap") {
+        item.map()?.[0]?.key()?.sym()?.toString() === "Charged"
+          ? charged++
+          : skipped++;
+      } else {
+        skipped++;
+      }
+    } catch {
+      skipped++;
+    }
+  }
+  return { charged, skipped };
+}
+
+async function replayEntry(
+  server: Server,
+  contract: Contract,
+  keypair: Keypair,
+  entry: DlqEntry,
+): Promise<{ charged: number; skipped: number }> {
+  const account = await server.getAccount(keypair.publicKey());
+
+  const tx = new TransactionBuilder(account, {
+    fee: BASE_FEE,
+    networkPassphrase: NETWORK_PASSPHRASE,
+  })
+    .addOperation(
+      contract.call(
+        "batch_charge",
+        nativeToScVal(entry.offset, { type: "u32" }),
+        nativeToScVal(entry.limit, { type: "u32" }),
+      ),
+    )
+    .setTimeout(60)
+    .build();
+
+  const simResult = await server.simulateTransaction(tx);
+  if ("error" in simResult)
+    throw new Error(`Simulation failed: ${simResult.error}`);
+
+  const assembled = assembleTransaction(tx, simResult).build();
+  assembled.sign(keypair);
+
+  const sendResult = await server.sendTransaction(assembled);
+  if (sendResult.status === "ERROR")
+    throw new Error(`Transaction rejected: ${JSON.stringify(sendResult)}`);
+
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    await sleep(2_000);
+    const status = await server.getTransaction(sendResult.hash);
+    if (status.status === "SUCCESS") {
+      const retval = (status as { returnValue?: xdr.ScVal }).returnValue;
+      if (!retval) return { charged: 0, skipped: 0 };
+      return parseChargeResults(retval);
+    }
+    if (status.status === "FAILED")
+      throw new Error(`Transaction failed on-chain: ${sendResult.hash}`);
+  }
+  throw new Error(`Transaction ${sendResult.hash} not confirmed within 30 s`);
+}
+
+// ── DLQ file helpers ──────────────────────────────────────────────────────────
+
+function parseDlqFile(filePath: string): DlqEntry[] {
+  if (!existsSync(filePath)) return [];
+  return readFileSync(filePath, "utf-8")
+    .split("\n")
+    .filter((l) => l.trim().length > 0)
+    .map((line, i) => {
+      try {
+        return JSON.parse(line) as DlqEntry;
+      } catch {
+        log("warn", `Skipping malformed DLQ line ${i + 1}`, { line });
+        return null;
+      }
+    })
+    .filter((e): e is DlqEntry => e !== null);
+}
+
+function appendToFile(filePath: string, entry: DlqEntry): void {
+  mkdirSync(dirname(filePath), { recursive: true });
+  appendFileSync(filePath, JSON.stringify(entry) + "\n", "utf-8");
+}
+
+// ── Main ──────────────────────────────────────────────────────────────────────
+
+async function main(): Promise<void> {
+  const argv = process.argv.slice(2);
+  const dryRun = argv.includes("--dry-run");
+
+  if (argv.includes("--help") || argv.includes("-h")) {
+    console.log(
+      [
+        "",
+        "Usage: tsx replay-dlq.ts [--dry-run]",
+        "",
+        "  --dry-run   Print entries that would be retried without submitting txns.",
+        "  --help      Show this help.",
+        "",
+        "Environment variables:",
+        "  CONTRACT_ID, KEEPER_SECRET, RPC_URL, NETWORK_PASSPHRASE,",
+        "  KEEPER_MAX_RETRIES, KEEPER_RETRY_BASE_MS, DLQ_FILE, LOG_LEVEL",
+        "",
+      ].join("\n"),
+    );
+    process.exit(0);
+  }
+
+  if (!CONTRACT_ID) {
+    console.error("FATAL: CONTRACT_ID is required.");
+    process.exit(1);
+  }
+  if (!KEEPER_SECRET && !dryRun) {
+    console.error("FATAL: KEEPER_SECRET is required.");
+    process.exit(1);
+  }
+
+  let keypair: Keypair | null = null;
+  if (!dryRun) {
+    try {
+      keypair = Keypair.fromSecret(KEEPER_SECRET);
+    } catch {
+      console.error("FATAL: KEEPER_SECRET is not a valid Stellar secret key.");
+      process.exit(1);
+    }
+  }
+
+  const entries = parseDlqFile(DLQ_FILE);
+
+  if (entries.length === 0) {
+    log("info", "DLQ is empty — nothing to replay.", { dlq_file: DLQ_FILE });
+    process.exit(0);
+  }
+
+  log("info", `Found ${entries.length} DLQ entries.`, {
+    dlq_file: DLQ_FILE,
+    dry_run: dryRun,
+  });
+
+  if (dryRun) {
+    for (const e of entries) {
+      log("info", "[dry-run] Would replay", {
+        offset: e.offset,
+        limit: e.limit,
+        original_error: e.error,
+        original_ts: e.timestamp,
+      });
+    }
+    process.exit(0);
+  }
+
+  const server = new Server(RPC_URL);
+  const contract = new Contract(CONTRACT_ID);
+
+  let replayed = 0;
+  let permanent = 0;
+  let stillFailed = 0;
+
+  // Remaining entries that were not successfully replayed.
+  const remaining: DlqEntry[] = [];
+
+  for (const entry of entries) {
+    const context = `DLQ entry offset=${entry.offset}`;
+
+    // Skip entries whose original error was permanent — they won't succeed now.
+    if (isPermanentError(entry.error)) {
+      log("warn", "Skipping permanent-error entry", {
+        offset: entry.offset,
+        error: entry.error,
+      });
+      appendToFile(DEAD_FILE, {
+        ...entry,
+        error: `[permanent] ${entry.error}`,
+        timestamp: new Date().toISOString(),
+      });
+      permanent++;
+      continue;
+    }
+
+    try {
+      const result = await retryWithBackoff(
+        () => replayEntry(server, contract, keypair!, entry),
+        KEEPER_MAX_RETRIES,
+        KEEPER_RETRY_BASE_MS,
+        context,
+      );
+
+      log("info", "Entry replayed successfully", {
+        offset: entry.offset,
+        limit: entry.limit,
+        charged: result.charged,
+        skipped: result.skipped,
+      });
+      appendToFile(REPLAYED_FILE, {
+        ...entry,
+        timestamp: new Date().toISOString(),
+      });
+      replayed++;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      log("error", "Entry failed after retries — moving to dead-batches", {
+        offset: entry.offset,
+        error: msg,
+      });
+      appendToFile(DEAD_FILE, {
+        ...entry,
+        error: msg,
+        timestamp: new Date().toISOString(),
+      });
+      stillFailed++;
+      remaining.push(entry);
+    }
+  }
+
+  // Rewrite the DLQ to contain only entries that still need attention.
+  mkdirSync(DLQ_DIR, { recursive: true });
+  writeFileSync(
+    DLQ_FILE,
+    remaining.map((e) => JSON.stringify(e)).join("\n") +
+      (remaining.length ? "\n" : ""),
+    "utf-8",
+  );
+
+  log("info", "Replay complete", {
+    replayed,
+    permanent,
+    still_failed: stillFailed,
+  });
+
+  process.exit(stillFailed > 0 ? 1 : 0);
+}
+
+main().catch((err: unknown) => {
+  console.error(
+    JSON.stringify({
+      ts: new Date().toISOString(),
+      level: "error",
+      msg: "Fatal unhandled error",
+      error: err instanceof Error ? err.message : String(err),
+    }),
+  );
+  process.exit(1);
+});