Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@forester/src/epoch_manager.rs`:
- Around line 914-994: This spawns an unbounded OS thread + dedicated Tokio
runtime per new tree (inside the block creating cancel_tx/completion_tx and
thread_handle) which can oversubscribe the host; instead, route new-tree work
through the existing tree-processing concurrency limiter used by normal trees
(the same semaphore/pool guarded by max_parallel_tree_workers()/the struct's
worker semaphore) and reuse the existing worker runtime rather than building a
new Tokio runtime per tree. Change the code that spawns a thread and builds a
runtime for each new tree (the closure calling process_queue and using
cancel_rx/completion_rx) to acquire the common semaphore/pool before scheduling
work, submit the processing task onto the shared runtime/task queue (or spawn
onto existing worker threads), and only keep the cancellation/completion
channels and register_new_tree_worker/NewTreeWorker for lifecycle tracking
without creating a dedicated runtime per tree.

In `@forester/tests/legacy/batched_state_async_indexer_test.rs`:
- Line 90: Remove the duplicate prover startup: the call to spawn_prover() after
init(Some(LightValidatorConfig { enable_prover: true, ... })) should be deleted
because init already starts the prover when enable_prover is true; locate the
test in batched_state_async_indexer_test.rs and remove the explicit
spawn_prover() invocation to avoid binding the same port twice and the
subsequent unwrap() panic.

In `@prover/client/src/proof_types/batch_address_append/proof_inputs.rs`:
- Around line 219-230: The code truncates new_element_values to batch_len but
not the related low_element_* slices; to make intent explicit and avoid indexing
surprises, create truncated slice bindings for each low_element slice (e.g.,
low_element_values, low_element_next_values, low_element_indices,
low_element_next_indices, and any other per-element input slices) using the same
..batch_len slice pattern before the loop/processing that uses them, and then
use those truncated bindings everywhere instead of indexing the original
vectors; keep the existing
staged_changelog/staged_indexed_changelog/staged_sparse_merkle_tree logic
unchanged.

In `@prover/client/src/prover.rs`:
- Around line 85-86: The current health-check boolean combines TCP read success
and a curl fallback which can mask non-200 HTTP responses; change the logic in
the health check block (the bytes_read check in prover.rs) so that when
bytes_read > 0 you return the TCP result directly by calling
has_http_ok_status(&response[..bytes_read]) and only call
health_check_once_with_curl(timeout) when the TCP path failed (e.g., bytes_read
== 0 or earlier connect/write/read errors); update the conditional controlling
those calls (the bytes_read branch) to implement this explicit fall-through
behavior.
- Around line 175-202: The local binding spawn_result captures the result of the
async block but the block returns () so the variable is unused; remove the
unnecessary spawn_result binding and simply await the async block inline (or use
let _ = ...await) where the Command::new(&prover_path) / wait_for_prover_health
/ monitor_prover_child logic runs, then keep IS_LOADING.store(false,
Ordering::Release) afterwards—this cleans up the dead variable while preserving
the startup, health-check, and child-monitor behavior.

In `@prover/client/tests/batch_address_append.rs`:
- Around line 109-124: The call to
get_batch_address_append_circuit_inputs(...).unwrap() in the warmup phase
returns circuit inputs that are currently discarded; update the call site (the
invocation of get_batch_address_append_circuit_inputs with warmup_* args) to
make the intent explicit by either assigning the result to a clearly named
placeholder (e.g. let _warmup_inputs = ...) or by adding a concise comment
before the call explaining "result intentionally discarded — only side effects
on sparse_merkle_tree, changelog, and indexed_changelog are needed for warmup",
keeping the unwrap as-is; reference the symbols
get_batch_address_append_circuit_inputs, sparse_merkle_tree, changelog, and
indexed_changelog when making the change.
- Line 128: The variable remaining_values is misleading because it binds the
full slice &new_element_values[..]; rename remaining_values to batch_values (or
remove the alias and use new_element_values directly) and update every usage of
remaining_values in the test to the new name so the intent matches the data
(references: remaining_values, new_element_values in the batch_address_append
test).

In `@sdk-libs/client/src/indexer/photon_indexer.rs`:
- Around line 1145-1162: The second, redundant validation can be removed: inside
the block that computes expected_siblings and expected_total (using
STATE_MERKLE_TREE_HEIGHT and STATE_MERKLE_TREE_CANOPY_DEPTH) keep only the first
check that compares x.proof.len() to expected_total and the subsequent
computation of proof_len if needed, but drop the impossible second check that
compares proof_len to expected_siblings (the IndexerError::InvalidParameters
branch referencing proof_len vs expected_siblings) since it can never fail when
the first check passes.
- Around line 1693-1695: The assignment of tree_next_insertion_index currently
uses aq.start_index (a pagination offset) which is wrong; replace that value
with the actual next leaf index from the tree state—e.g., call
address_tree_bundle.right_most_index() (or derive from queue_indices/queue state
if Photon API is missing the field) when setting tree_next_insertion_index in
the struct initializer where start_index, tree_next_insertion_index, root_seq
are set; ensure tree_next_insertion_index represents the sparse tree insertion
point used to initialize staging trees rather than the pagination offset.

In `@sdk-libs/client/src/indexer/types/queue.rs`:
- Around line 198-203: The lookup-based proof reconstruction uses the unstable
is_multiple_of API when computing sibling_pos in reconstruct_proof_with_lookup;
replace the unstable call with a stable parity check (e.g., test pos % 2 == 0 or
pos & 1 == 0) when deciding sibling_pos, and ensure the same replacement is
applied to the sibling index computation inside reconstruct_proof_with_lookup so
behavior remains identical but uses stable Rust methods.
- Around line 274-286: Replace the unstable is_multiple_of call in the test
helper's loop with a stable check using modulus: instead of
pos.is_multiple_of(2) use pos % 2 == 0 (or equivalent) when computing
sibling_pos inside the loop that constructs node_index (the block that inserts
into nodes via nodes.entry(node_index).or_insert_with(||
hash_from_node(node_index))) and ensure the same change is applied to any other
occurrences in build_queue_data so pos is updated correctly before pos /= 2.
- Around line 175-177: Add a doc comment to the proof_count method explaining
that it returns the number of complete proof entries by taking the minimum of
addresses.len() and low_element_indices.len(); document that if those two
vectors diverge the method reports only the count of fully-paired elements
(i.e., the number of valid address→low_element_index pairs) so callers
understand the invariant and why min(...) is used; mention the related fields
addresses and low_element_indices in the comment for clarity.

In `@sdk-libs/client/src/interface/load_accounts.rs`:
- Around line 164-165: The loop that iterates over
cold_atas.chunks(MAX_ATAS_PER_IX).zip(ata_proofs) causes MissingAtaContext.index
to be the local chunk index instead of the global ATA index; fix build_ata_load
error reporting by computing and preserving the global index: iterate with
enumerate over chunks (e.g., for (chunk_idx, (chunk, proof)) in
cold_atas.chunks(MAX_ATAS_PER_IX).zip(ata_proofs).enumerate()), compute
chunk_start = chunk_idx * MAX_ATAS_PER_IX, and when constructing any
MissingAtaContext (inside build_ata_load or just before calling it) set index =
chunk_start + local_index (where local_index is the position within chunk) so
the reported MissingAtaContext.index refers to the original cold_atas index.
- Around line 135-139: The three concurrent pipelines (fetch_proof_batches,
fetch_proofs_batched, fetch_individual_proofs) each buffer up to
PROOF_FETCH_CONCURRENCY, creating up to 3x the intended concurrent
get_validity_proof calls; change the implementation to use a single shared
concurrency limiter instead of independent buffers. Add a shared limiter (e.g.,
a tokio::sync::Semaphore or an Arc<Limiter>) and pass it into
fetch_proof_batches, fetch_proofs_batched, and fetch_individual_proofs; have
each proof-fetching operation acquire a permit before calling get_validity_proof
and release it after, so the global concurrency across all pipelines is bounded
by PROOF_FETCH_CONCURRENCY (or another configured global limit) rather than
per-pipeline. Ensure constructors/signatures for those functions accept the
shared limiter and use it wherever get_validity_proof is awaited.

In `@sdk-libs/client/src/local_test_validator.rs`:
- Around line 119-128: The spawned validator process (created with
Command::new("sh")... and assigned to the dropped variable _child when
use_surfpool is false) is intentionally detached and lacks any cleanup path;
change the implementation to retain and expose the Child handle so callers/tests
can terminate the validator: either store the Child in a shared structure (e.g.,
a static Mutex/OnceCell) or return it from the function that starts the
validator (so callers receive the Child and can call kill/await), and update any
callers/tests to call .kill()/.wait() or drop appropriately during teardown;
ensure the symbol names to change are the creation site where _child is assigned
and the surrounding function that gates on use_surfpool.
- Around line 60-62: The code silently no-ops when get_project_root() returns
None; update the containing function (e.g., the function that calls
get_project_root() in local_test_validator.rs) to return a Result and propagate
an error instead of doing nothing, or at minimum log a clear warning and return
an Err variant so the caller knows the validator failed to start; specifically,
replace the current early-return/no-op on None from get_project_root() with a
branch that calls processLogger.error/warn (or uses anyhow::bail) and returns
Err(...) from the function that constructs and spawns the command (referencing
get_project_root and the function that formats/executes the "cli/test_bin/run
test-validator" command) so failures are observable by callers/tests.

In `@sdk-libs/client/src/utils.rs`:
- Around line 36-46: The code builds light_path from the git rev-parse output
without checking Command::output() success, so on git failure you may produce an
invalid path or panic; update the block around the
std::process::Command::new("git") call to check output.status.success() (or
handle Err from .output()) and return None (or an appropriate error) if the
command failed, only parsing stdout into light_protocol_toplevel and
constructing light_path when the status is success; reference the existing
Command invocation, the light_protocol_toplevel variable and the light_path
PathBuf construction to find and fix the logic.

In `@sdk-libs/program-test/src/indexer/test_indexer.rs`:
- Around line 2593-2607: The retry loop currently uses the `?` operator when
reading the response body and when decoding via `build_compressed_proof`, which
causes early exit on transient failures; change the
`response_result.text().await.map_err(...) ?` and
`build_compressed_proof(&body)?` sites to explicit error handling: capture the
errors into `last_error` (e.g., set last_error =
Some(IndexerError::CustomError(...)) or wrap the build error similarly) and
continue the loop instead of returning, and only return
`Ok(ValidityProofWithContext { accounts: account_proof_inputs, addresses:
address_proof_inputs, proof: ... })` when both reading and decoding succeed;
ensure you reference `response_result`, `build_compressed_proof`,
`ValidityProofWithContext`, `account_proof_inputs`, `address_proof_inputs`, and
`last_error` when implementing the changes.

In `@sdk-libs/sdk-types/src/interface/program/decompression/processor.rs`:
- Line 129: The public field token_seeds uses the confusing type
Vec<Vec<Vec<u8>>>; define a small alias or newtype (e.g., type SeedsPerSigner =
Vec<Vec<u8>>; or pub struct SignerSeedGroups(pub Vec<SeedsPerSigner>);) to
represent “one seed group per signer PDA” and replace token_seeds:
Vec<Vec<Vec<u8>>> with token_seeds: SeedsPerSignerGroups (or the chosen name)
and update the other occurrence referenced (the second use at the later
location) to use the new alias/newtype so the public API is readable and less
error-prone.

In `@sdk-libs/sdk-types/src/interface/program/decompression/token.rs`:
- Around line 151-153: The code currently only pushes the vault PDA seed group
into ctx.token_seeds (ctx.token_seeds.push(seeds.iter().map(|seed|
seed.to_vec()).collect() in the decompression token flow), but when
token::owner_seeds ≠ token::seeds derive_owner() produces a different owner PDA
and processor.rs later marks the owner account (account_metas[data.owner as
usize + transfer2_packed_start].is_signer = true) without providing signer seeds
for it; fix by including the owner PDA seeds as a separate signer seed group
when owner_seeds differs from seeds (i.e., push token::owner_seeds mapped to
Vec<u8> into ctx.token_seeds in addition to the vault seeds, making sure the
order of seed groups matches how account_metas are constructed for the Transfer2
CPI), or alternatively change the signer-marking logic to only mark the owner as
signer when the owner PDA equals the vault PDA.

---

Outside diff comments:
In `@forester/src/epoch_manager.rs`:
- Around line 4775-4788: The shutdown branch currently wins the tokio::select!
and drops epoch_manager.run(), preventing NewTreeWorker cleanup
(shutdown_new_tree_workers()) from running; modify the code so the shutdown
signal is propagated into EpochManager rather than canceling it — either add a
cancellation-aware entry point (e.g., change EpochManager::run() to accept a
shutdown signal/Receiver) or implement an explicit async
EpochManager::shutdown() that you call and await here when shutdown wins; ensure
you reference EpochManager::run(), EpochManager::shutdown() (if added), and the
shutdown_new_tree_workers()/NewTreeWorker cleanup path so the manager completes
its epilogue before returning.
- Around line 558-574: The scopeguard closure currently aborts
current_previous_handle, tree_discovery_handle, and balance_check_handle
together which allows tree_discovery_handle to remain live while
shutdown_new_tree_workers() drains and cancels workers; change the shutdown
sequence so tree_discovery_handle is aborted before any call that drains or
cancels NewTreeWorker instances (i.e., ensure tree_discovery_handle.abort() runs
prior to invoking shutdown_new_tree_workers() or draining the worker vector),
update the closure or surrounding teardown logic to call
tree_discovery_handle.abort() first and then perform
shutdown_new_tree_workers(), and apply the same ordering fix at the other
teardown site referenced around lines 678-681 so discovery cannot register new
workers after the drain starts.

In `@forester/src/processor/v2/strategy/address.rs`:
- Around line 170-205: The data_start_index returned by fetch_queue_data is set
to streaming_queue.tree_next_insertion_index(), which misaligns with how
get_batch_snapshot interprets the start offset (it indexes directly into the
data arrays populated from StreamingAddressQueue::start_index()); update
fetch_queue_data to set data_start_index = streaming_queue.start_index()
(preserving tree_next_insertion_index use for staging tree creation), or
alternatively, keep data_start_index as-is but adjust build_proof_job calls to
rebase snapshot offsets before calling get_batch_snapshot (compute
adjusted_start = start + (streaming_queue.start_index() -
streaming_queue.tree_next_insertion_index()) and pass adjusted_start), and
ensure reconcile_alignment still compares indices using the same base (use
StreamingAddressQueue::start_index() when checking overlap).

In `@sdk-libs/client/src/local_test_validator.rs`:
- Around line 71-97: The loop builds a shell command string by concatenating
unescaped values (sbf_programs, upgradeable_programs'
program_id/program_path/upgrade_authority, validator_args), which risks shell
interpretation of special characters; change to constructing the process
invocation with std::process::Command (e.g., the run binary created via
format!("{}/cli/test_bin/run", project_root.trim()) and the "test-validator"
subcommand) and add each flag/argument with .arg or .args instead of string
concatenation, mapping each sbf_program to .args(&["--sbf-program",
&sbf_program.0, &sbf_program.1]), each upgradeable_program to
.args(&["--upgradeable-program", &upgradeable_program.program_id,
&upgradeable_program.program_path, &upgradeable_program.upgrade_authority"]),
conditionally add "--skip-prover" and "--use-surfpool" with .arg, and append
config.validator_args via .args to avoid passing through a shell; alternatively,
if you must build a shell string, apply proper escaping using a crate like
shell-escape for the same fields.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@prover/client/src/proof_types/batch_address_append/json.rs`:
- Around line 22-23: Add the missing LowElementNextIndices field to the
BatchAddressAppendParametersJSON schema so the Go server accepts and forwards
the Rust client's lowElementNextIndices JSON key; update the struct to include a
LowElementNextIndices []string `json:"lowElementNextIndices"` field (and any
corresponding export/serialization logic), then ensure the marshal/unmarshal
helpers and the code that assembles circuit inputs (e.g., wherever
BatchAddressAppendParametersJSON is converted to circuit parameters) propagate
LowElementNextIndices into the circuit input mapping so the Rust
low_element_next_indices values are preserved end-to-end.

In `@prover/client/src/proof.rs`:
- Around line 72-83: The function deserialize_hex_string_to_be_bytes currently
parses the entire hex string into a BigUint before enforcing the 32-byte limit;
preemptively validate trimmed_str length instead to avoid costly parsing of huge
inputs: after computing trimmed_str (from strip_prefix calls) check the hex
digit length and return ProverClientError::InvalidHexString if trimmed_str.len()
> 64 (or if it represents more than 64 hex chars), optionally also
handling/normalizing an odd-length hex string, and only then call
num_bigint::BigUint::from_str_radix and proceed with to_bytes_be().

---

Outside diff comments:
In `@forester/src/epoch_manager.rs`:
- Around line 570-586: The scopeguard that aborts producer tasks (the guard
capturing current_previous_handle, tree_discovery_handle, balance_check_handle
which aborts discover_trees_periodically and other producers) runs only at
function exit, so producers can spawn new workers while you later drain
new_tree_workers; to fix, ensure producers are stopped before draining:
explicitly abort or drop the producer handles (current_previous_handle.abort(),
tree_discovery_handle.abort(), balance_check_handle.abort() or drop the guard)
immediately prior to the code that drains new_tree_workers (the drain at/around
the previous Line 709 region), so no new workers can be registered during the
drain; keep the scopeguard or a new short-lived guard only for any remaining
cleanup that must run at exit.

---

Duplicate comments:
In `@forester/src/epoch_manager.rs`:
- Around line 943-953: The current code spawns a new OS thread and builds a
dedicated Tokio runtime inside thread_handle (using std::thread::spawn and
tokio::runtime::Builder in the closure that references
tree_schedule.tree_accounts.merkle_tree, run_id/thread_run_id) which bypasses
the bounded worker pool; instead, remove the per-tree std::thread::spawn +
tokio::runtime::Builder usage and submit the per-tree work onto the existing
bounded worker/orchestrator used for active work processing (use the shared
worker pool API the project already uses to schedule tasks or spawn blocking
work), passing tree_schedule.tree_accounts.merkle_tree and run_id into that task
so we don't create a new runtime or OS thread per discovered tree.

In `@prover/client/tests/batch_address_append.rs`:
- Line 127: The variable remaining_values is misleading because it is assigned
the full slice &new_element_values[..] (all 10 elements) rather than a true
"remainder"; rename remaining_values to batch_values (or use new_element_values
directly) wherever it's declared and used to accurately reflect it contains the
full batch, and update references in the test (e.g., the binding named
remaining_values and any subsequent uses) to the new name to improve clarity.
- Around line 108-123: Add a short inline comment where
get_batch_address_append_circuit_inputs::<{ DEFAULT_BATCH_ADDRESS_TREE_HEIGHT as
usize }>(...) is called and its result .unwrap() is discarded to make the intent
explicit: state that this call is a warmup which mutates sparse_merkle_tree,
changelog, and indexed_changelog and that the returned circuit inputs are
intentionally ignored. Reference the call to
get_batch_address_append_circuit_inputs and the mutated variables
sparse_merkle_tree, changelog, and indexed_changelog in the comment.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@forester/src/epoch_manager.rs`:
- Around line 2542-2548: The call to check_forester_eligibility is always
passing &tree_accounts.merkle_tree, which is incorrect for TreeType::StateV2
because V2 trees use the queue-based scheduling/eligibility key; compute the
proper eligibility key before the call (e.g., match on tree_accounts.tree_type /
TreeType::StateV2 and select the queue-based scheduling/eligibility key for V2,
otherwise use tree_accounts.merkle_tree) and pass that selected key (instead of
always tree_accounts.merkle_tree) into check_forester_eligibility alongside
epoch_pda, current_light_slot, and epoch_info so V2 trees use the queue-derived
eligible index.

In `@forester/tests/test_batch_append_spent.rs`:
- Around line 352-356: The timeout-based wait on the service JoinHandle can leak
a spawned task (and abort() won't stop spawn_blocking tasks); replace the
timeout(Duration::from_secs(5), service_handle).await pattern with an explicit
tokio::select! that awaits either the service_handle completion or a sleep
timeout, and in the timeout branch explicitly send the graceful shutdown signal
(use the existing shutdown_sender.send(())) and then wait a short additional
grace period for the handle to complete; if it still doesn't finish, fail the
test deterministically or refactor to remove the spawn_blocking wrapper around
run_pipeline::<LightClient>() so the handle can be properly cancelled. Ensure
references to service_handle, shutdown_sender.send(()),
run_pipeline::<LightClient>(), and spawn_blocking are used to locate and update
the code.

In `@prover/client/src/proof_types/batch_append/proof_inputs.rs`:
- Around line 131-142: The current batch validation only checks outer vector
lengths and does not validate each inner Merkle proof length, which leads to a
panic at the later try_into().unwrap() call; update the validation loop (the
section iterating over ("merkle_proofs", merkle_proofs.len())) to iterate each
element of merkle_proofs and verify its depth/length matches batch_size
expectations (or the expected depth for conversion) and if any inner proof has
an invalid length return Err(ProverClientError::GenericError(...)) instead of
allowing try_into().unwrap() to panic; ensure you reference and validate the
exact items used by the conversion that calls try_into().unwrap() so the
conversion can safely use try_into() without unwrap.

In `@prover/client/src/proof_types/non_inclusion/v2/json.rs`:
- Around line 28-29: The JSON struct field path_index (pub path_index: u64) and
the builder conversion that produces a u64 (the to_u64() call which currently
returns ProverClientError::IntegerConversion on failure) must be constrained to
the server-expected uint32 range: after converting the BigInt to u64, validate
that the value <= u32::MAX and return a clear ProverClientError if it exceeds
that bound, or else cast/truncate safely to u32 before assigning to path_index
(so the serialized JSON uses a 32-bit-compatible value); update the conversion
logic where input.index_hashed_indexed_element_leaf is converted to u64 to
perform this range check and error handling.

In `@prover/client/tests/init_merkle_tree.rs`:
- Around line 223-225: The test currently calls
.index_hashed_indexed_element_leaf.to_u64().unwrap(), which can panic; change
this to a fallible conversion that returns a Result and propagate or map the
error instead of unwrapping (e.g., replace the unwrap with a call that uses ? or
map_err to produce a descriptive test failure). Locate the use of
index_hashed_indexed_element_leaf and replace the to_u64().unwrap() with a
to_u64() handling path that converts the Option/Result into the test's
Result-returning flow (or maps the conversion error into a test error) so the
test fails deterministically without panicking.

---

Outside diff comments:
In `@forester/src/compressible/ctoken/compressor.rs`:
- Around line 49-59: Change the CTokenCompressor::new constructor to accept a
shared payer Keypair by taking either Arc<Keypair> or an impl Into<Arc<Keypair>>
(instead of an owned Keypair), and store that Arc directly in the struct's
payer_keypair field; update the new signature and the payer_keypair
initialization (referenced as pub fn new and the payer_keypair field) so callers
can pass a cloned Arc rather than cloning the Keypair itself.

In `@forester/src/compressible/ctoken/state.rs`:
- Around line 86-92: The method update_from_token currently accepts an owned
Token which forces callers to clone even if they already have shared ownership;
change its signature to accept token: impl Into<std::sync::Arc<Token>> (or a
concrete Arc<Token>) and convert it to an Arc inside the function so callers can
pass either Arc<Token> or Token without extra clones; apply the same change to
the other analogous method that currently takes Token (the one referenced around
the second occurrence) so both insertion/update paths use Arc<Token> and avoid
unnecessary ownership cloning.

---

Duplicate comments:
In `@forester/src/epoch_manager.rs`:
- Around line 943-954: The code currently spawns a new OS thread
(std::thread::spawn) and builds a fresh Tokio runtime per-tree
(Builder::new_multi_thread()...build()) which bypasses the shared worker
limiter; change this to run tree processing on the existing/shared runtime and
gate it with the global worker limiter returned by max_parallel_tree_workers():
instead of creating thread_handle and a per-tree runtime, acquire a permit from
the shared limiter (e.g. await limiter.acquire/ acquire_owned), then
tokio::spawn an async task that receives cancel_rx and uses completion_tx to
signal completion, reusing self_clone/run_id and
tree_schedule/tree_accounts.merkle_tree values; keep the oneshot
cancel_tx/cancel_rx and completion_tx/completion_rx semantics but remove the
per-tree runtime and std::thread::spawn so parallelism is controlled by the
shared limiter.

In `@prover/client/src/proof.rs`:
- Around line 72-83: In deserialize_hex_string_to_be_bytes, reject inputs that
would exceed 32 bytes before calling BigUint::from_str_radix: after computing
trimmed_str (the hex digits after removing "0x"/"0X"), strip leading '0'
characters to find the significant hex length and if that significant length is
greater than 64 hex chars (or if trimmed_str.len() > 64 and not just leading
zeros) return ProverClientError::InvalidHexString immediately; also handle
odd-length hex by allowing a single leading '0' pad rule when checking length so
you still reject anything representing >32 bytes without invoking big-int
parsing.

In `@sdk-libs/client/src/local_test_validator.rs`:
- Around line 59-60: When get_project_root() returns None the code silently does
nothing; change spawn_validator to surface a failure instead of no-op by
updating its signature to return a Result (e.g., pub async fn
spawn_validator(config: LightValidatorConfig) -> anyhow::Result<()>) and handle
the None case with an explicit error (use anyhow::bail! or return
Err(anyhow!(...)) with a clear message like "could not resolve project root").
Apply the same change to the other similar spawn_validator occurrence so both
functions consistently propagate or return a clear failure when
get_project_root() is None.
- Around line 118-133: The current spawn logic allows an early successful exit
to be treated as OK and then drops the child handle, preventing deterministic
teardown; change the post-spawn check so that if child.try_wait() returns
Some(_) (any exit) after the initial sleep it is treated as an error (fail the
test or return Err) rather than allowing a success, and stop dropping the Child:
return or store the spawned Child (the value from Command::new(...).spawn()) to
the caller so they can call wait()/kill() deterministically on teardown (or
implement Drop for the wrapper to kill the child). Concretely, update the block
around Command::new(...).spawn(), replace the assert! that accepts
status.success() with an unconditional error when try_wait() yields
Some(status), and change the function signature/ownership so the spawned Child
is returned or retained for controlled shutdown.

In `@sdk-libs/program-test/src/indexer/test_indexer.rs`:
- Around line 2594-2620: The match arm returns early on failures because the
code uses the `?` operator when reading the response body and when calling
`build_compressed_proof`, which prevents retries; change both to handle errors
like the send failures do: replace `response_result.text().await.map_err(...) ?`
with an explicit Result match (or `match response_result.text().await { Ok(body)
=> ..., Err(e) => { last_error = format!("failed to read prover response body:
{e}"); continue; } }`) and wrap `build_compressed_proof(&body)` similarly (e.g.
`match build_compressed_proof(&body) { Ok(p) => p, Err(e) => { last_error =
format!("failed to build compressed proof: {e}"); continue; } }`) so that
`ValidityProofWithContext` (using `account_proof_inputs` and
`address_proof_inputs`) is only returned on success and all transient failures
update `last_error` and allow the retry loop to continue.