refactor: dedup latest-non-deprecated loop, add missing tests, extract ZERO_ADDRESS_STR

a) router-registry: extract fn latest_non_deprecated helper to eliminate
   the byte-for-byte duplicate reverse-iteration loop that existed in both
   get_latest and the no-constraint branch of get_latest_with_constraint.
   Both callers now delegate to the single shared helper.

b) router-access: add test_get_role_parent_returns_none_when_not_set to
   cover the baseline case that get_role_parent returns None for a role
   that was never passed to set_role_parent. Mirrors the existing
   test_get_role_admin_returns_none_when_not_set.

c) router-access: add test_is_blacklisted_reflects_blacklist_state to
   directly exercise the is_blacklisted view function (false -> true after
   blacklist() -> false after unblacklist()), which was previously only
   covered indirectly through has_role tests.

d) router-core: extract ZERO_ADDRESS_STR constant so the Stellar zero
   address literal is defined in one place and referenced by both
   register_route and register_route_internal.

Author: miller070

contracts/router-access/src/lib.rs

@@ -1700,4 +1700,32 @@ mod tests {
         assert_eq!(result, Err(Ok(AccessError::HierarchyCycle)));
         assert_eq!(client.get_role_parent(&role_c), None);
     }
+
+    #[test]
+    fn test_get_role_parent_returns_none_when_not_set() {
+        // Mirrors test_get_role_admin_returns_none_when_not_set for get_role_parent.
+        // A role that has never been passed to set_role_parent must report no parent.
+        let (env, _admin, client) = setup();
+        let role = String::from_str(&env, "orphan-role");
+
+        assert_eq!(client.get_role_parent(&role), None);
+    }
+
+    #[test]
+    fn test_is_blacklisted_reflects_blacklist_state() {
+        // Directly exercises is_blacklisted: false → true after blacklist() → false after unblacklist().
+        let (env, admin, client) = setup();
+        let addr = Address::generate(&env);
+
+        // Fresh address is not blacklisted
+        assert!(!client.is_blacklisted(&addr));
+
+        // After blacklisting it becomes true
+        client.blacklist(&admin, &addr);
+        assert!(client.is_blacklisted(&addr));
+
+        // After un-blacklisting it goes back to false
+        client.unblacklist(&admin, &addr);
+        assert!(!client.is_blacklisted(&addr));
+    }
 }

contracts/router-core/src/lib.rs

@@ -189,6 +189,13 @@ pub enum RouterError {
 const MAX_RECURSION_DEPTH: u32 = 10;
 // ── Constants ─────────────────────────────────────────────────────────────────
 
+/// The Stellar "zero" address — used as a sentinel for "no owner" / invalid address checks.
+///
+/// A single source-of-truth for the literal so that a typo in one validation
+/// point cannot silently diverge from another, and any future change only
+/// needs to be made here.
+const ZERO_ADDRESS_STR: &str = "GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF";
+
 /// Minimum remaining TTL (in ledgers) before instance storage is extended.
 /// ~30 days at 5 s/ledger.
 const INSTANCE_TTL_THRESHOLD: u32 = 17280 * 30;
@@ -281,7 +288,7 @@ impl RouterCore {
         // Validate address is not the zero address
         let zero_address = Address::from_string(&String::from_str(
             &env,
-            "GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF",
+            ZERO_ADDRESS_STR,
         ));
         if address == zero_address {
             return Err(RouterError::InvalidAddress);
@@ -2168,7 +2175,7 @@ impl RouterCore {
         // Validate address is not the zero address
         let zero_address = Address::from_string(&String::from_str(
             env,
-            "GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF",
+            ZERO_ADDRESS_STR,
         ));
         if address == zero_address {
             return Err(RouterError::InvalidAddress);

contracts/router-registry/src/lib.rs

@@ -316,22 +316,7 @@ impl RouterRegistry {
         if versions.is_empty() {
             return Err(RegistryError::NotFound);
         }
-        // Iterate in reverse to find latest non-deprecated
-        let len = versions.len();
-        let mut i = len;
-        while i > 0 {
-            i -= 1;
-            let v = versions.get(i).ok_or(RegistryError::NotFound)?;
-            let entry: ContractEntry = env
-                .storage()
-                .instance()
-                .get(&DataKey::Entry(name.clone(), v))
-                .ok_or(RegistryError::NotFound)?;
-            if !entry.deprecated {
-                return Ok(entry);
-            }
-        }
-        Err(RegistryError::AllVersionsDeprecated)
+        Self::latest_non_deprecated(&env, &name, &versions)
     }
 
     /// Get the latest non-deprecated entry matching a semver constraint.
@@ -357,23 +342,12 @@ impl RouterRegistry {
     ) -> Result<ContractEntry, RegistryError> {
         let versions = Self::get_versions_list(&env, &name);
 
-        // If no constraint, use get_latest logic
+        // If no constraint, delegate to the shared helper (same semantics as get_latest)
         if constraint.is_none() {
-            let len = versions.len();
-            let mut i = len;
-            while i > 0 {
-                i -= 1;
-                let v = versions.get(i).ok_or(RegistryError::NotFound)?;
-                let entry: ContractEntry = env
-                    .storage()
-                    .instance()
-                    .get(&DataKey::Entry(name.clone(), v))
-                    .ok_or(RegistryError::NotFound)?;
-                if !entry.deprecated {
-                    return Ok(entry);
-                }
+            if versions.is_empty() {
+                return Err(RegistryError::NotFound);
             }
-            return Err(RegistryError::AllVersionsDeprecated);
+            return Self::latest_non_deprecated(&env, &name, &versions);
         }
 
         let constraint_str = constraint.unwrap();
@@ -782,6 +756,40 @@ impl RouterRegistry {
 
 
 
+    /// Iterates `versions` in descending order and returns the first
+    /// [`ContractEntry`] for `name` that is not deprecated.
+    ///
+    /// This is the single shared implementation used by both
+    /// [`get_latest`](Self::get_latest) and the "no constraint" branch of
+    /// [`get_latest_with_constraint`](Self::get_latest_with_constraint).
+    /// Any future change to "how we pick the latest non-deprecated version"
+    /// only needs to be made here.
+    ///
+    /// # Errors
+    /// * [`RegistryError::NotFound`] — if a version index lookup fails.
+    /// * [`RegistryError::AllVersionsDeprecated`] — if every version is deprecated.
+    fn latest_non_deprecated(
+        env: &Env,
+        name: &String,
+        versions: &Vec<u32>,
+    ) -> Result<ContractEntry, RegistryError> {
+        let len = versions.len();
+        let mut i = len;
+        while i > 0 {
+            i -= 1;
+            let v = versions.get(i).ok_or(RegistryError::NotFound)?;
+            let entry: ContractEntry = env
+                .storage()
+                .instance()
+                .get(&DataKey::Entry(name.clone(), v))
+                .ok_or(RegistryError::NotFound)?;
+            if !entry.deprecated {
+                return Ok(entry);
+            }
+        }
+        Err(RegistryError::AllVersionsDeprecated)
+    }
+
     fn get_versions_list(env: &Env, name: &String) -> Vec<u32> {
         env.storage()
             .instance()