o2-tools 0.3.21-rc

//! Integration coverage for prop deployment and cross-contract invariants.

use super::*;

/// Submission-age bound the harness runs the feed at: wide enough that a
/// test may publish at any timestamp it likes and still exercise the POOL's
/// own staleness rules rather than the feed's.
const TEST_MAX_OFFCHAIN_AGE_SECONDS: u64 = 10_000_000_000;

/// How far behind the chain the harness's publish clock starts. Far enough
/// that thousands of publishes stay in the past, small enough to sit well
/// inside [`TEST_MAX_OFFCHAIN_AGE_SECONDS`].
const PUBLISH_CLOCK_LAG_SECONDS: u64 = 1_000_000;
use crate::{
    call_data,
    fn_selector,
    order_book_deploy::{
        OrderArgs,
        OrderBookConfigurables,
        OrderBookDeploy,
        OrderBookDeployConfig,
        OrderType,
    },
    parallel_nonce::{
        build_parallel_nonce,
        generate_parallel_session_signing_payload,
    },
    prop::{
        BaseDebtRepaidFromCollateral,
        CallContractArg,
        CallParams,
        DiscountScope,
        MarginContractCallEvent,
        MarginPoolLiquidatorChanged,
        MarginWithdrawn,
        ParallelMultiCallContractArgs,
        ParallelSessionArgs,
        PriceInput,
        ProlongPeriod,
        ProlongTrigger,
        PropAccountContract,
        PropAccountOracleProxyContract,
        PropAccountProxyContract,
        QuoteRepaidFromCollateral,
        Secp256k1,
        SessionClosed,
        SessionOpened,
        SessionProlonged,
        SessionSeized,
        SettlementReason,
        Signature,
        State,
        TierParams,
        TierVersionPublished,
        Time,
        UserDiscount,
        UserDiscountChanged,
        UserDiscountsRemoved,
    },
    trial_trade_account::generate_trial_trade_approval_signing_payload,
};
use fuels::{
    programs::responses::CallResponse,
    test_helpers::{
        AssetConfig,
        ChainConfig,
        DbType,
        NodeConfig,
        WalletsConfig,
        launch_custom_provider_and_get_wallets,
    },
    types::U256,
};
use futures::TryStreamExt;
use std::time::{
    SystemTime,
    UNIX_EPOCH,
};

const TIER_ID: u64 = 1;
/// Mirrors the pool's `DISCOUNT_MANAGER_ROLE` constant - the one role
/// `set_user_discount` accepts.
const DISCOUNT_MANAGER_ROLE: u64 = 1;
const COLLATERAL: u64 = 2_000_000;
const LINE: u64 = 10_000_000;

struct PropFixture {
    _node_db: Option<tempfile::TempDir>,
    collateral_asset: AssetId,
    base_asset: AssetId,
    deployer: Wallet,
    user: Wallet,
    outsider: Wallet,
    deployment: PropDeployment<Wallet>,
    order_book: OrderBookDeploy<Wallet>,
    child_id: ContractId,
    account: PropAccountContract<Wallet>,
    nonce_position: u8,
    /// Strictly increasing source of `publish_time`s. The production feed
    /// refuses a timestamp in the future or at/below an asset's replay
    /// floor, so the harness runs a deterministic clock seeded WELL behind
    /// the chain: every publish is newer than the last and still comfortably
    /// in the past. The tier's `max_price_age` is `u64::MAX`, so how far
    /// behind it sits never reaches the pool's own staleness rule.
    publish_clock: std::sync::atomic::AtomicU64,
}

impl PropFixture {
    async fn new() -> Self {
        Self::new_with_node_config(None, None).await
    }

    async fn new_with_historical_storage() -> Self {
        let node_db = tempfile::tempdir().unwrap();
        let database_type = DbType::RocksDb(Some(node_db.path().to_path_buf()));
        Self::new_with_node_config(
            Some(NodeConfig {
                database_type,
                historical_execution: true,
                ..NodeConfig::default()
            }),
            Some(node_db),
        )
        .await
    }

    async fn new_with_node_config(
        node_config: Option<NodeConfig>,
        node_db: Option<tempfile::TempDir>,
    ) -> Self {
        let collateral_asset = AssetId::new([0x31; 32]);
        let base_asset = AssetId::new([0x32; 32]);
        let initial_balance = 100_000_000_000u64;
        let mut wallets = launch_custom_provider_and_get_wallets(
            WalletsConfig::new_multiple_assets(
                3,
                vec![
                    AssetConfig {
                        id: AssetId::default(),
                        num_coins: 4,
                        coin_amount: initial_balance,
                    },
                    AssetConfig {
                        id: collateral_asset,
                        num_coins: 4,
                        coin_amount: initial_balance,
                    },
                    AssetConfig {
                        id: base_asset,
                        num_coins: 4,
                        coin_amount: initial_balance,
                    },
                ],
            ),
            node_config,
            Some(ChainConfig::local_testnet()),
        )
        .await
        .unwrap();
        let outsider = wallets.pop().unwrap();
        let user = wallets.pop().unwrap();
        let deployer = wallets.pop().unwrap();

        // These tests publish at fixed timestamps (0, 1, hand-rolled
        // staleness) to drive the pool's OWN price rules, so the feed's
        // submission-age bound is opened wide rather than worked around.
        let mut config = PropDeployConfig::new(collateral_asset);
        config.max_offchain_age_seconds = Some(TEST_MAX_OFFCHAIN_AGE_SECONDS);
        let deployment = PropDeployment::deploy(&deployer, &config).await.unwrap();

        let order_book_configurables = OrderBookConfigurables::default()
            .with_MAKER_FEE(0u64.into())
            .unwrap()
            .with_TAKER_FEE(0u64.into())
            .unwrap()
            .with_MIN_ORDER(1)
            .unwrap()
            .with_DUST(0)
            .unwrap();
        let order_book = OrderBookDeploy::deploy(
            &deployer,
            base_asset,
            collateral_asset,
            &OrderBookDeployConfig::with_configurables(order_book_configurables),
        )
        .await
        .unwrap();

        deployment
            .price_feed
            .methods()
            .set_asset_decimals(collateral_asset, 6)
            .call()
            .await
            .unwrap();
        deployment
            .price_feed
            .methods()
            .set_asset_decimals(base_asset, 9)
            .call()
            .await
            .unwrap();
        let chain_now = deployer
            .try_provider()
            .unwrap()
            .latest_block_time()
            .await
            .unwrap()
            .map(|time| time.timestamp() as u64)
            .unwrap_or(0);
        let publish_clock =
            std::sync::atomic::AtomicU64::new(chain_now - PUBLISH_CLOCK_LAG_SECONDS);
        let first_publish =
            publish_clock.fetch_add(1, std::sync::atomic::Ordering::Relaxed) + 1;
        deployment
            .price_feed
            .methods()
            .publish_prices(vec![
                PriceInput {
                    asset: collateral_asset,
                    bid: 1_000_000_000_000_000_000u64.into(),
                    ask: 1_000_000_000_000_000_000u64.into(),
                    timestamp: first_publish,
                },
                PriceInput {
                    asset: base_asset,
                    bid: 2_000_000_000_000_000_000u64.into(),
                    ask: 2_000_000_000_000_000_000u64.into(),
                    timestamp: first_publish,
                },
            ])
            .call()
            .await
            .unwrap();

        let tier_params = TierParams {
            line: LINE,
            leverage: 5,
            duration: 64_800,
            maintenance_bps: 250,
            open_buffer_bps: 375,
            liq_price_factor: 9_900,
            // Six hours is free, and it is the term every fixture session
            // opens on: `64_800 + 21_600` is the 86_400 these tests have
            // always run with, at the same zero entry cost. Prolonging is
            // priced, so the fee tests use Day.
            prolong_fee: [0, 6_000, 76_000, 738_000],
            max_credit_line_bps: 20_000,
            max_price_age: u64::MAX,
            open_fee: 0,
            profit_share_bps: 1_000,
            price_band_bps: 1_000,
        };
        let tier_response = deployment
            .pool
            .methods()
            .publish_tier_version(
                TIER_ID,
                tier_params.clone(),
                vec![order_book.contract_id],
            )
            .with_contract_ids(&[order_book.contract_id, deployment.price_feed_id])
            .call()
            .await
            .unwrap();
        let tier_events = tier_response
            .decode_logs_with_type::<TierVersionPublished>()
            .unwrap();
        assert_eq!(tier_events.len(), 1);
        assert_eq!(tier_events[0].params, tier_params);
        assert_eq!(tier_events[0].threshold_floor, 8_250_000);
        // The pool-wide base-repay fee rides along on every tier version, so a
        // consumer reading only these events can price the conversion the
        // tier's own assets are closed at. Asserted against the DEPLOY config
        // rather than a literal: the whole point is that the event reports the
        // configurable this pool was actually built with.
        assert_eq!(tier_events[0].base_repay_fee_ppm, config.base_repay_fee_ppm);
        assert_eq!(
            tier_events[0].auto_prolong_periods,
            vec![ProlongPeriod::SixHours, ProlongPeriod::Day]
        );
        assert!(tier_events[0].timestamp.unix != 0);

        for (asset, amount) in
            [(collateral_asset, 50_000_000), (base_asset, 10_000_000_000)]
        {
            deployer
                .force_transfer_to_contract(
                    deployment.pool.contract_id(),
                    amount,
                    asset,
                    TxPolicies::default(),
                )
                .await
                .unwrap();
        }

        let parent = Identity::Address(user.address());
        let child = deployment.deploy_account(&user, parent, 0).await.unwrap();
        let child_id = child.contract_id();
        let account = PropAccountContract::new(child_id, user.clone());
        let opened_response = account
            .methods()
            .start_session(TIER_ID, COLLATERAL, ProlongPeriod::SixHours)
            .call_params(CallParameters::new(COLLATERAL, collateral_asset, u64::MAX))
            .unwrap()
            .with_contract_ids(&[
                deployment.oracle_id,
                deployment.pool_id,
                deployment.registry_id,
            ])
            .call()
            .await
            .unwrap();
        let opened_events = deployment
            .pool
            .log_decoder()
            .decode_logs_with_type::<SessionOpened>(&opened_response.tx_status.receipts)
            .unwrap();
        assert_eq!(opened_events.len(), 1);
        assert_eq!(opened_events[0].account, child_id);
        assert_eq!(opened_events[0].parent, parent);
        assert_eq!(
            opened_events[0].expires_at,
            opened_events[0].started_at + 86_400
        );
        assert_eq!(opened_events[0].open_fee, 0);
        assert_eq!(opened_events[0].fees_accrued, 0);
        assert!(opened_events[0].timestamp.unix != 0);

        let expiry = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .unwrap()
            .as_secs()
            + 86_400;
        account
            .methods()
            .set_session(ParallelSessionArgs {
                nonce: U256::zero(),
                session_id: Identity::Address(user.address()),
                expiry: Time { unix: expiry },
                contract_ids: vec![],
            })
            .with_contract_ids(&[deployment.oracle_id])
            .call()
            .await
            .unwrap();

        Self {
            _node_db: node_db,
            collateral_asset,
            base_asset,
            deployer,
            user,
            outsider,
            deployment,
            order_book,
            child_id,
            account,
            nonce_position: 0,
            publish_clock,
        }
    }

    fn pool_call(
        &self,
        function_selector: Vec<u8>,
        coins: u64,
        asset_id: AssetId,
        call_data: Option<Vec<u8>>,
    ) -> CallContractArg {
        CallContractArg {
            contract_id: self.deployment.pool_id,
            function_selector: Bytes(function_selector),
            call_params: CallParams {
                coins,
                asset_id,
                gas: 10_000_000,
            },
            call_data: call_data.map(Bytes),
        }
    }

    async fn signed_calls(
        &mut self,
        call_contract_args: Vec<CallContractArg>,
    ) -> (Signature, Signature, ParallelMultiCallContractArgs) {
        // Chain time, not wall clock: tests that push the node's clock forward
        // would otherwise sign a nonce that is already expired on arrival.
        let wall_clock = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .unwrap()
            .as_secs();
        let chain = self
            .user
            .try_provider()
            .unwrap()
            .latest_block_time()
            .await
            .unwrap()
            .map(|time| time.timestamp() as u64)
            .unwrap_or(0);
        let now = wall_clock.max(chain);
        let nonce = build_parallel_nonce(0, now + 3_600, 0, self.nonce_position);
        self.nonce_position += 1;
        let calls = ParallelMultiCallContractArgs {
            nonce,
            call_contract_args,
        };
        let user_message = generate_parallel_session_signing_payload(
            calls.nonce,
            calls.call_contract_args.clone(),
        );
        let chain_id = self
            .user
            .provider()
            .consensus_parameters()
            .await
            .unwrap()
            .chain_id();
        let cosigner_message = generate_trial_trade_approval_signing_payload(
            *chain_id,
            self.child_id,
            calls.nonce,
            calls.call_contract_args.clone(),
        );
        let user_signature = self.user.signer().sign(user_message).await.unwrap();
        let cosigner_signature =
            self.deployer.signer().sign(cosigner_message).await.unwrap();

        (
            Signature::Secp256k1(Secp256k1 {
                bits: *user_signature,
            }),
            Signature::Secp256k1(Secp256k1 {
                bits: *cosigner_signature,
            }),
            calls,
        )
    }

    async fn call_account(
        &mut self,
        calls: Vec<CallContractArg>,
        variable_outputs: usize,
    ) -> Result<CallResponse<()>> {
        let (user_signature, cosigner_signature, calls) = self.signed_calls(calls).await;
        Ok(self
            .account
            .methods()
            .call_contracts(user_signature, cosigner_signature, calls)
            .with_contracts(&[
                &self.deployment.oracle,
                &self.deployment.pool,
                &self.deployment.price_feed,
                &self.deployment.registry,
                &self.order_book.order_book,
            ])
            .with_variable_output_policy(VariableOutputPolicy::Exactly(variable_outputs))
            .call()
            .await?)
    }

    async fn session(&self) -> crate::prop::SessionView {
        self.deployment
            .pool
            .methods()
            .get_session(self.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
            .unwrap()
    }

    async fn pool_balance(&self, asset: AssetId) -> u64 {
        self.deployer
            .try_provider()
            .unwrap()
            .get_contract_asset_balance(&self.deployment.pool_id, &asset)
            .await
            .unwrap()
    }

    async fn account_balance(&self, asset: AssetId) -> u64 {
        self.deployer
            .try_provider()
            .unwrap()
            .get_contract_asset_balance(&self.child_id, &asset)
            .await
            .unwrap()
    }

    async fn lines(&self) -> crate::prop::SessionLines {
        self.deployment
            .pool
            .methods()
            .get_session_lines(self.child_id)
            .with_contract_ids(&[
                self.child_id,
                self.order_book.contract_id,
                self.deployment.price_feed_id,
            ])
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    }

    /// The signed session value the two legs encode:
    /// `V = k + collateral - fees + holdings - debts - drawn_quote`.
    async fn session_value(&self) -> i128 {
        let lines = self.lines().await;
        i128::try_from(lines.positive.as_u128()).unwrap()
            - i128::try_from(lines.negative.as_u128()).unwrap()
    }

    /// The next `publish_time` from the harness's monotonic clock.
    fn next_publish_time(&self) -> u64 {
        self.publish_clock
            .fetch_add(1, std::sync::atomic::Ordering::Relaxed)
            + 1
    }

    async fn publish_base_price(&self, price: u128) {
        self.deployment
            .price_feed
            .methods()
            .publish_prices(vec![PriceInput {
                asset: self.base_asset,
                bid: price,
                ask: price,
                timestamp: self.next_publish_time(),
            }])
            .call()
            .await
            .unwrap();
    }

    /// Rests an order for the deployer, the counterparty the account trades
    /// against. The asset sent with the call decides the side.
    async fn rest_order(&self, price: u64, quantity: u64, asset: AssetId, coins: u64) {
        self.order_book
            .order_book
            .methods()
            .create_order(OrderArgs {
                price,
                quantity,
                order_type: OrderType::Spot,
            })
            .call_params(CallParameters::new(coins, asset, u64::MAX))
            .unwrap()
            .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
            .call()
            .await
            .unwrap();
    }

    fn book_call(
        &self,
        price: u64,
        quantity: u64,
        asset: AssetId,
        coins: u64,
    ) -> CallContractArg {
        CallContractArg {
            contract_id: self.order_book.contract_id,
            function_selector: Bytes(fn_selector!(create_order(OrderArgs))),
            call_params: CallParams {
                coins,
                asset_id: asset,
                gas: 10_000_000,
            },
            call_data: Some(Bytes(call_data!(OrderArgs {
                price,
                quantity,
                order_type: OrderType::Spot,
            }))),
        }
    }

    fn settle_book_call(&self) -> CallContractArg {
        CallContractArg {
            contract_id: self.order_book.contract_id,
            function_selector: Bytes(fn_selector!(settle_balance(Identity))),
            call_params: CallParams {
                coins: 0,
                asset_id: AssetId::default(),
                gas: 10_000_000,
            },
            call_data: Some(Bytes(call_data!(Identity::ContractId(self.child_id)))),
        }
    }

    fn draw_call(&self, amount: u64) -> CallContractArg {
        self.pool_call(
            fn_selector!(draw(u64)),
            0,
            AssetId::default(),
            Some(call_data!(amount)),
        )
    }

    fn prolong_call(&self, times: u64) -> CallContractArg {
        self.pool_call(
            fn_selector!(prolong_session(ProlongPeriod, u64)),
            0,
            AssetId::default(),
            Some(call_data!(ProlongPeriod::Day, times)),
        )
    }

    fn repay_base_from_collateral_call(
        &self,
        asset: AssetId,
        amount: u64,
    ) -> CallContractArg {
        self.pool_call(
            fn_selector!(repay_base_from_collateral(AssetId, u64)),
            0,
            AssetId::default(),
            Some(call_data!(asset, amount)),
        )
    }

    fn repay_from_collateral_call(&self, amount: u64) -> CallContractArg {
        self.pool_call(
            fn_selector!(repay_from_collateral(u64)),
            0,
            AssetId::default(),
            Some(call_data!(amount)),
        )
    }

    /// The same signed-call path with a caller-chosen contract-input set, so a
    /// test can prove what a call does NOT need in its transaction. Anything a
    /// call touches and the list omits reverts the whole thing.
    async fn call_account_with_contract_ids(
        &mut self,
        calls: Vec<CallContractArg>,
        contract_ids: &[ContractId],
    ) -> Result<CallResponse<()>> {
        let (user_signature, cosigner_signature, calls) = self.signed_calls(calls).await;
        Ok(self
            .account
            .methods()
            .call_contracts(user_signature, cosigner_signature, calls)
            .with_contract_ids(contract_ids)
            .with_variable_output_policy(VariableOutputPolicy::Exactly(0))
            .call()
            .await?)
    }

    async fn debt(&self, asset: AssetId) -> u64 {
        self.deployment
            .pool
            .methods()
            .get_debt(self.child_id, asset)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    }

    /// An OUTSIDE funder topping the session up. It holds no session of its
    /// own, so none of the self-funding restrictions apply to it and the
    /// collateral it posts is not share-bearing.
    async fn fund_collateral(&self, amount: u64) {
        self.deployment
            .pool
            .clone()
            .with_account(self.outsider.clone())
            .methods()
            .add_collateral(self.child_id)
            .call_params(CallParameters::new(amount, self.collateral_asset, u64::MAX))
            .unwrap()
            .call()
            .await
            .unwrap();
    }

    async fn bad_debt(&self) -> u64 {
        self.deployment
            .pool
            .methods()
            .get_bad_debt()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    }

    async fn is_liquidatable(&self) -> bool {
        let lines = self.lines().await;
        lines.positive <= lines.negative + lines.threshold
    }

    /// The keeper's forced exit, from a wallet with no claim on the session.
    async fn liquidate(&self) -> CallResponse<()> {
        self.deployment
            .pool
            .clone()
            .with_account(self.outsider.clone())
            .methods()
            .liquidate(self.child_id, vec![])
            .with_contracts(&[
                &self.account,
                &self.deployment.oracle,
                &self.order_book.order_book,
                &self.deployment.price_feed,
            ])
            .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
            .call()
            .await
            .unwrap()
    }

    async fn close_session(&self) -> CallResponse<()> {
        self.account
            .methods()
            .close_session(vec![])
            .with_contracts(&[
                &self.deployment.pool,
                &self.deployment.oracle,
                &self.order_book.order_book,
                &self.deployment.price_feed,
            ])
            .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
            .call()
            .await
            .unwrap()
    }

    fn closed_event(&self, response: &CallResponse<()>) -> SessionClosed {
        let closed = self
            .deployment
            .pool
            .log_decoder()
            .decode_logs_with_type::<SessionClosed>(&response.tx_status.receipts)
            .unwrap();
        assert_eq!(closed.len(), 1);
        closed.into_iter().next().unwrap()
    }
}

async fn expire_fixture_session(fixture: &PropFixture) {
    let session = fixture.session().await;
    let provider = fixture.outsider.try_provider().unwrap();
    let latest = provider
        .latest_block_time()
        .await
        .unwrap()
        .expect("local chain has a latest block time");
    let seconds_until_expired =
        session.expires_at.saturating_sub(latest.timestamp() as u64) + 1;
    let expired_time = latest
        .checked_add_signed(chrono::TimeDelta::seconds(seconds_until_expired as i64))
        .expect("test expiry timestamp is representable");
    provider
        .produce_blocks(1, Some(expired_time))
        .await
        .unwrap();

    fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .expire_session(fixture.child_id, vec![])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
}

async fn occupied_pool_storage_slots(fixture: &PropFixture) -> usize {
    fixture
        .deployer
        .try_provider()
        .unwrap()
        .client()
        .contract_storage_slots(&fixture.deployment.pool_id)
        .await
        .unwrap()
        .try_collect::<Vec<_>>()
        .await
        .unwrap()
        .len()
}

#[test]
fn settlement_reason_wire_order_matches_backend_abi() {
    fn discriminant(reason: SettlementReason) -> u64 {
        match fuels::core::traits::Tokenizable::into_token(reason) {
            fuels::types::Token::Enum(selector) => selector.0,
            token => panic!("expected enum token, got {token:?}"),
        }
    }

    assert_eq!(discriminant(SettlementReason::UserClose), 0);
    assert_eq!(discriminant(SettlementReason::Expiry), 1);
    assert_eq!(discriminant(SettlementReason::Liquidation), 2);
}

#[tokio::test]
async fn admin_controls_the_liquidator() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let fixture = PropFixture::new().await;
    let deployer = Identity::Address(fixture.deployer.address());
    let liquidator = Identity::Address(fixture.outsider.address());

    assert_eq!(
        fixture
            .deployment
            .pool
            .methods()
            .liquidator()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        deployer
    );

    let outsider_pool = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone());
    assert!(
        outsider_pool
            .methods()
            .set_liquidator(liquidator)
            .call()
            .await
            .is_err()
    );
    for invalid in [
        Identity::Address(Address::zeroed()),
        Identity::ContractId(ContractId::zeroed()),
    ] {
        assert!(
            fixture
                .deployment
                .pool
                .methods()
                .set_liquidator(invalid)
                .call()
                .await
                .is_err()
        );
    }

    let response = fixture
        .deployment
        .pool
        .methods()
        .set_liquidator(liquidator)
        .call()
        .await
        .unwrap();
    let events = response
        .decode_logs_with_type::<MarginPoolLiquidatorChanged>()
        .unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].old_liquidator, deployer);
    assert_eq!(events[0].new_liquidator, liquidator);
    assert!(events[0].timestamp.unix != 0);
    assert_eq!(
        fixture
            .deployment
            .pool
            .methods()
            .liquidator()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        liquidator
    );
}

#[tokio::test]
async fn live_withdrawal_emits_canonical_event() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let amount = 100_000;

    fixture
        .user
        .force_transfer_to_contract(
            fixture.child_id,
            amount,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, amount)),
    );
    let response = fixture.call_account(vec![withdraw], 2).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<MarginWithdrawn>(&response.tx_status.receipts)
        .unwrap();

    assert_eq!(events.len(), 1);
    assert_eq!(events[0].account, fixture.child_id);
    assert_eq!(events[0].session_id, 1);
    assert_eq!(events[0].asset_id, fixture.collateral_asset);
    assert_eq!(events[0].amount, amount);
    assert_eq!(events[0].from_account, amount);
    assert_eq!(events[0].from_pool, 0);
    assert_eq!(events[0].from_capitalised, 0);
    assert_eq!(events[0].share_qty, 10_000);
    assert_eq!(events[0].new_collateral, COLLATERAL);
    assert_eq!(events[0].new_credit_line, LINE);
    assert_eq!(events[0].capitalised_total, 0);
    assert!(events[0].timestamp.unix != 0);
}

#[tokio::test]
async fn outside_funders_can_rescue_debt_but_self_funding_still_requires_a_clean_slate() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let lines = fixture
        .deployment
        .pool
        .methods()
        .get_session_lines(fixture.child_id)
        .with_contract_ids(&[
            fixture.child_id,
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert_eq!(lines.positive, U256::from(LINE));
    assert_eq!(lines.negative, U256::zero());
    assert_eq!(lines.threshold, U256::from(8_250_000u64));
    assert_eq!(lines.freeze, U256::from(8_375_000u64));

    let liquidation_error = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .liquidate(fixture.child_id, vec![])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .call()
        .await
        .unwrap_err();
    assert!(
        liquidation_error.to_string().contains("NotLiquidatable"),
        "permissionless liquidation should reach the objective health gate: {liquidation_error:#}"
    );

    let draw_amount = 1_000_000;
    let draw = fixture.pool_call(
        fn_selector!(draw(u64)),
        0,
        AssetId::default(),
        Some(call_data!(draw_amount)),
    );
    fixture.call_account(vec![draw], 1).await.unwrap();

    let rescue_amount = 500_000;
    fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .add_collateral(fixture.child_id)
        .call_params(CallParameters::new(
            rescue_amount,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .call()
        .await
        .unwrap();
    let rescued = fixture.session().await;
    assert_eq!(rescued.drawn_quote, draw_amount);
    assert_eq!(rescued.collateral, COLLATERAL + rescue_amount);
    assert_eq!(rescued.credit_line, LINE + rescue_amount);
    assert_eq!(rescued.capitalised, 0);

    let self_amount = 100_000;
    fixture
        .user
        .force_transfer_to_contract(
            fixture.child_id,
            self_amount,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
    let self_top_up = fixture.pool_call(
        fn_selector!(add_collateral(ContractId)),
        self_amount,
        fixture.collateral_asset,
        Some(call_data!(fixture.child_id)),
    );
    let error = fixture
        .call_account(vec![self_top_up], 0)
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("QuoteOutstanding"),
        "unexpected self-funding error: {error:#}"
    );

    let return_quote = fixture.pool_call(
        fn_selector!(return_quote()),
        draw_amount,
        fixture.collateral_asset,
        None,
    );
    fixture.call_account(vec![return_quote], 0).await.unwrap();
    let self_top_up = fixture.pool_call(
        fn_selector!(add_collateral(ContractId)),
        self_amount,
        fixture.collateral_asset,
        Some(call_data!(fixture.child_id)),
    );
    fixture.call_account(vec![self_top_up], 0).await.unwrap();
    let capitalised = fixture.session().await;
    assert_eq!(capitalised.drawn_quote, 0);
    assert_eq!(capitalised.capitalised, self_amount);

    let borrow_amount = 1_000_000_000u64;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, borrow_amount)),
    );
    fixture.call_account(vec![borrow], 1).await.unwrap();

    fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .add_collateral(fixture.child_id)
        .call_params(CallParameters::new(
            rescue_amount,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .call()
        .await
        .unwrap();
    let rescued_debt = fixture.session().await;
    assert_eq!(rescued_debt.capitalised, self_amount);

    fixture
        .user
        .force_transfer_to_contract(
            fixture.child_id,
            self_amount,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
    let self_top_up = fixture.pool_call(
        fn_selector!(add_collateral(ContractId)),
        self_amount,
        fixture.collateral_asset,
        Some(call_data!(fixture.child_id)),
    );
    let error = fixture
        .call_account(vec![self_top_up], 0)
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("DebtsOutstanding"),
        "unexpected self-funding error: {error:#}"
    );

    assert_oracle_proxy_is_upgradeable(&fixture).await;
    assert_new_pool_defaults_do_not_require_a_create_manifest(&fixture).await;
}

#[tokio::test]
async fn outsider_can_expire_an_elapsed_session() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let fixture = PropFixture::new().await;
    let session = fixture.session().await;
    let provider = fixture.outsider.try_provider().unwrap();
    let latest = provider
        .latest_block_time()
        .await
        .unwrap()
        .expect("local chain has a latest block time");
    let seconds_until_expired =
        session.expires_at.saturating_sub(latest.timestamp() as u64) + 1;
    let expired_time = latest
        .checked_add_signed(chrono::TimeDelta::seconds(seconds_until_expired as i64))
        .expect("test expiry timestamp is representable");
    provider
        .produce_blocks(1, Some(expired_time))
        .await
        .unwrap();

    let response = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .expire_session(fixture.child_id, vec![])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap();

    let events = response.decode_logs_with_type::<SessionClosed>().unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].reason, SettlementReason::Expiry);
    assert!(events[0].timestamp.unix > session.expires_at);
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
}

#[tokio::test]
async fn expiry_routes_in_kind_debt_repayment_to_the_liquidator() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let liquidator = Identity::Address(fixture.outsider.address());
    fixture
        .deployment
        .pool
        .methods()
        .set_liquidator(liquidator)
        .call()
        .await
        .unwrap();

    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_debts(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );

    let borrowed = 1_000_000_000u64;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, borrowed)),
    );
    fixture.call_account(vec![borrow], 1).await.unwrap();
    assert!(
        fixture
            .deployment
            .pool
            .methods()
            .has_debts(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
    assert_eq!(
        fixture
            .deployment
            .pool
            .methods()
            .get_debt(fixture.child_id, fixture.base_asset)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        borrowed
    );
    let pool_after_borrow = fixture.pool_balance(fixture.base_asset).await;
    let liquidator_before = fixture
        .outsider
        .get_asset_balance(&fixture.base_asset)
        .await
        .unwrap();

    let session = fixture.session().await;
    let provider = fixture.outsider.try_provider().unwrap();
    let latest = provider
        .latest_block_time()
        .await
        .unwrap()
        .expect("local chain has a latest block time");
    let seconds_until_expired =
        session.expires_at.saturating_sub(latest.timestamp() as u64) + 1;
    let expired_time = latest
        .checked_add_signed(chrono::TimeDelta::seconds(seconds_until_expired as i64))
        .expect("test expiry timestamp is representable");
    provider
        .produce_blocks(1, Some(expired_time))
        .await
        .unwrap();

    let response = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .expire_session(fixture.child_id, vec![])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::Exactly(2))
        .call()
        .await
        .unwrap();

    let seized = response.decode_logs_with_type::<SessionSeized>().unwrap();
    assert_eq!(seized.len(), 1);
    assert_eq!(seized[0].account, fixture.child_id);
    assert_eq!(seized[0].session_id, session.session_id);
    assert_eq!(seized[0].reason, SettlementReason::Expiry);
    assert_eq!(seized[0].liquidator, liquidator);
    // The account was carrying its own cover: it owed the base and was still
    // holding every unit of it. All three vectors say so, and the debt line
    // survives BECAUSE it is gross.
    assert_eq!(seized[0].holdings, vec![(fixture.base_asset, borrowed)]);
    assert_eq!(seized[0].debt, vec![(fixture.base_asset, borrowed)]);
    assert_eq!(seized[0].transferred, vec![(fixture.base_asset, borrowed)]);
    // The netted view of that same pair, from the same call: the holding
    // cancels the debt and the close reports nothing owed. Not wrong - and no
    // use to a liquidator, which cannot tell this apart from a session that
    // never borrowed at all. The gross pair above is what tells it that the
    // asset it is being handed is the asset it owes, so it buys nothing.
    let closed = fixture.closed_event(&response);
    assert!(closed.cancelled_debt.is_empty());
    assert!(seized[0].timestamp.unix > session.expires_at);
    assert_eq!(
        fixture.pool_balance(fixture.base_asset).await,
        pool_after_borrow
    );
    assert_eq!(
        fixture
            .outsider
            .get_asset_balance(&fixture.base_asset)
            .await
            .unwrap(),
        liquidator_before + u128::from(borrowed)
    );
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
    assert_eq!(
        fixture
            .deployment
            .pool
            .methods()
            .get_debt(fixture.child_id, fixture.base_asset)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        0
    );
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_debts(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
}

#[tokio::test]
async fn settlement_clears_session_scoped_accounting_storage() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;

    let clean_fixture = PropFixture::new_with_historical_storage().await;
    expire_fixture_session(&clean_fixture).await;
    let clean_close_slots = occupied_pool_storage_slots(&clean_fixture).await;

    let mut debt_fixture = PropFixture::new_with_historical_storage().await;
    let borrowed = 1_000_000_000u64;
    let borrow = debt_fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(debt_fixture.base_asset, borrowed)),
    );
    debt_fixture.call_account(vec![borrow], 1).await.unwrap();
    expire_fixture_session(&debt_fixture).await;
    let debt_close_slots = occupied_pool_storage_slots(&debt_fixture).await;

    assert_eq!(
        debt_close_slots, clean_close_slots,
        "settlement left debt, debt-asset index, or received-asset storage behind",
    );

    let mut netted_fixture = PropFixture::new_with_historical_storage().await;
    let netted = 1_000_000u64;
    let draw = netted_fixture.draw_call(netted);
    netted_fixture.call_account(vec![draw], 1).await.unwrap();
    let repay = netted_fixture.repay_from_collateral_call(netted);
    netted_fixture.call_account(vec![repay], 0).await.unwrap();
    expire_fixture_session(&netted_fixture).await;

    assert_eq!(
        occupied_pool_storage_slots(&netted_fixture).await,
        clean_close_slots,
        "settlement left the session's `decapitalised` memo behind, where a \
         re-opened session could inherit it",
    );
}

#[tokio::test]
async fn liquidation_routes_the_basket_after_the_accounts_short_trade() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let liquidator = Identity::Address(fixture.outsider.address());
    fixture
        .deployment
        .pool
        .methods()
        .set_liquidator(liquidator)
        .call()
        .await
        .unwrap();

    let quantity = 1_000_000_000u64;
    let sale_proceeds = 2_000_000u64;
    fixture
        .order_book
        .order_book
        .methods()
        .create_order(OrderArgs {
            price: sale_proceeds,
            quantity,
            order_type: OrderType::Spot,
        })
        .call_params(CallParameters::new(
            sale_proceeds,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap();

    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = CallContractArg {
        contract_id: fixture.order_book.contract_id,
        function_selector: Bytes(fn_selector!(create_order(OrderArgs))),
        call_params: CallParams {
            coins: quantity,
            asset_id: fixture.base_asset,
            gas: 10_000_000,
        },
        call_data: Some(Bytes(call_data!(OrderArgs {
            price: sale_proceeds,
            quantity,
            order_type: OrderType::Spot,
        }))),
    };
    let settle_book = CallContractArg {
        contract_id: fixture.order_book.contract_id,
        function_selector: Bytes(fn_selector!(settle_balance(Identity))),
        call_params: CallParams {
            coins: 0,
            asset_id: AssetId::default(),
            gas: 10_000_000,
        },
        call_data: Some(Bytes(call_data!(Identity::ContractId(fixture.child_id,)))),
    };
    fixture
        .call_account(vec![borrow, sell, settle_book], 2)
        .await
        .unwrap();

    let adverse_price = 10_000_000_000_000_000_000u128;
    fixture
        .deployment
        .price_feed
        .methods()
        .publish_prices(vec![PriceInput {
            asset: fixture.base_asset,
            bid: adverse_price,
            ask: adverse_price,
            timestamp: fixture.next_publish_time(),
        }])
        .call()
        .await
        .unwrap();

    let lines = fixture
        .deployment
        .pool
        .methods()
        .get_session_lines(fixture.child_id)
        .with_contract_ids(&[
            fixture.child_id,
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert!(lines.positive <= lines.negative + lines.threshold);

    let pool_cash_before = fixture.pool_balance(fixture.collateral_asset).await;
    let liquidator_before = fixture
        .outsider
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let response = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .liquidate(fixture.child_id, vec![])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap();

    let seized = response.decode_logs_with_type::<SessionSeized>().unwrap();
    let seized_cash = COLLATERAL + sale_proceeds;
    assert_eq!(seized.len(), 1);
    assert_eq!(seized[0].account, fixture.child_id);
    assert_eq!(seized[0].reason, SettlementReason::Liquidation);
    assert_eq!(seized[0].liquidator, liquidator);
    // The mirror of the expiry case: the account sold the base it borrowed, so
    // it holds none of the asset it owes. Nothing nets, and the debt line has to
    // be bought back with the cash it holds instead.
    assert_eq!(
        seized[0].holdings,
        vec![(fixture.collateral_asset, sale_proceeds)]
    );
    assert_eq!(seized[0].debt, vec![(fixture.base_asset, quantity)]);
    assert_eq!(
        seized[0].transferred,
        vec![(fixture.collateral_asset, seized_cash)]
    );
    // `transferred` exceeds `holdings` by the funded collateral, which the pool
    // held all along and released to the liquidator on the way out. No quote
    // debt line: this session never drew.
    assert_eq!(seized_cash - sale_proceeds, COLLATERAL);
    assert!(seized[0].timestamp.unix != 0);
    assert_eq!(
        fixture
            .outsider
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        liquidator_before + u128::from(seized_cash)
    );
    assert_eq!(
        fixture.pool_balance(fixture.collateral_asset).await,
        pool_cash_before - COLLATERAL
    );

    let closed = response.decode_logs_with_type::<SessionClosed>().unwrap();
    assert_eq!(closed.len(), 1);
    assert_eq!(closed[0].reason, SettlementReason::Liquidation);
    assert!(closed[0].profit_is_negative);
    assert!(closed[0].bad_debt != 0);
    assert_eq!(
        closed[0].cancelled_debt,
        vec![(fixture.base_asset, quantity)]
    );
    assert!(closed[0].payout_parent.is_empty());
    assert!(closed[0].payout_platform.is_empty());
    assert_eq!(
        fixture
            .deployment
            .pool
            .methods()
            .get_bad_debt()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        closed[0].bad_debt
    );
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
}

/// A long that fell, taken by the keeper instead of netted away. He drew quote
/// and bought the base with it, so he owes the pool 2_000_000 of QUOTE and not
/// one unit of any borrowed asset - and the debt table only ever holds borrowed
/// assets, because `borrow` refuses COLLATERAL_ASSET and sends it through
/// `draw`. `SessionClosed.cancelled_debt` is therefore EMPTY here while the pool
/// is unmistakably owed money, which is the blind spot the quote line exists to
/// cover.
///
/// It is reported net of the collateral the pool keeps. The 2_000_000 of funded
/// collateral answers the draw inside the pool - unlike an asset debt, whose
/// covering coins ship out in the basket - so the raw draw would have the
/// liquidator redeposit money the pool already holds. What is genuinely still
/// owed is the 198_000 of residual value the pool credited the parent for a
/// position it then handed away, and that is the line this test pins: an order
/// of magnitude below the draw.
#[tokio::test]
async fn a_liquidated_draw_reports_the_quote_the_debt_table_cannot_hold() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let liquidator = Identity::Address(fixture.outsider.address());
    fixture
        .deployment
        .pool
        .methods()
        .set_liquidator(liquidator)
        .call()
        .await
        .unwrap();

    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(cost, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(cost, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    assert_eq!(fixture.account_balance(fixture.base_asset).await, quantity);
    // Every unit of the draw is in the position. There is no cash anywhere to
    // sweep back at settlement, so `held_cash` will be zero.
    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);
    assert_eq!(fixture.session().await.drawn_quote, cost);

    // The base falls to a tenth: the position marks at 200_000 against a
    // 2_000_000 draw, which puts `V` at 8_200_000 and hands the session to the
    // keeper.
    fixture
        .publish_base_price(200_000_000_000_000_000u128)
        .await;
    assert_eq!(fixture.session_value().await, 8_200_000);
    assert!(
        fixture.is_liquidatable().await,
        "the session must be the keeper's for this test to mean anything"
    );

    let liquidator_before = fixture
        .outsider
        .get_asset_balance(&fixture.base_asset)
        .await
        .unwrap();
    let response = fixture.liquidate().await;
    let closed = fixture.closed_event(&response);
    let seized = response.decode_logs_with_type::<SessionSeized>().unwrap();
    assert_eq!(seized.len(), 1);
    assert_eq!(seized[0].account, fixture.child_id);
    assert_eq!(seized[0].session_id, closed.session_id);
    assert_eq!(seized[0].reason, SettlementReason::Liquidation);
    assert_eq!(seized[0].liquidator, liquidator);

    // Everything the account had was the position, and the whole of it goes to
    // the liquidator. No quote either way: the draw was spent, so there was none
    // left on the account to sweep and none left in the session to hand over.
    assert_eq!(seized[0].holdings, vec![(fixture.base_asset, quantity)]);
    assert_eq!(seized[0].transferred, vec![(fixture.base_asset, quantity)]);

    // 200_000 marked, less the 1% `liq_price_factor` haircut a forced exit
    // settles at: what the pool credited the parent for the position it then
    // gave away. Of the 2_000_000 draw, the other 1_802_000 of funded
    // collateral stays with the pool and answers it there - so THIS, not the
    // draw, is the quote debt line. Reporting the raw draw would have the
    // basket buy back ten times what the pool is actually short.
    let credited = 198_000u64;
    assert_eq!(seized[0].debt, vec![(fixture.collateral_asset, credited)]);
    // The point of the field, stated as the difference it makes: reading the
    // close event alone, a liquidator would see no debt at all here.
    assert!(closed.cancelled_debt.is_empty());
    assert_eq!(closed.user_net, credited);
    assert_eq!(
        closed.payout_parent,
        vec![(fixture.collateral_asset, credited)]
    );
    assert_eq!(closed.reason, SettlementReason::Liquidation);
    assert!(closed.profit_is_negative);
    // Funded collateral covered the loss in full, so nothing was written off -
    // the quote line above is a live claim on the basket, not bad debt.
    assert_eq!(closed.bad_debt, 0);
    assert_eq!(
        fixture
            .outsider
            .get_asset_balance(&fixture.base_asset)
            .await
            .unwrap(),
        liquidator_before + u128::from(quantity)
    );
}

/// Both debt legs at once, against a single holding - the shape a liquidator
/// actually has to reason about. He borrowed the base AND drew quote, spent the
/// draw on more of the base, and the base fell.
///
/// Two debts and one asset. The netted view collapses that to a third thing: the
/// base debt disappears into the holding it is covered by, the quote debt is not
/// in the debt table to begin with, and what is left describes neither leg. The
/// gross pair keeps them apart, which is the only form in which the decision
/// "sell this to buy that" can be made at all.
#[tokio::test]
async fn a_seized_session_reports_both_debt_legs_against_one_holding() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let liquidator = Identity::Address(fixture.outsider.address());
    fixture
        .deployment
        .pool
        .methods()
        .set_liquidator(liquidator)
        .call()
        .await
        .unwrap();

    let bought = 1_000_000_000u64;
    let borrowed = 100_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(cost, bought, fixture.base_asset, bought)
        .await;

    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, borrowed)),
    );
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(cost, bought, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![borrow, draw, buy, fixture.settle_book_call()], 3)
        .await
        .unwrap();
    // One asset on the balance, carrying both the borrowed position and the one
    // the draw paid for. Not a unit of quote left anywhere.
    assert_eq!(
        fixture.account_balance(fixture.base_asset).await,
        borrowed + bought
    );
    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);
    assert_eq!(fixture.session().await.drawn_quote, cost);

    // The base falls to a tenth. The borrowed leg shrinks with it, so `V` lands
    // where the pure long landed: 8_200_000, and the keeper's.
    fixture
        .publish_base_price(200_000_000_000_000_000u128)
        .await;
    assert_eq!(fixture.session_value().await, 8_200_000);
    assert!(fixture.is_liquidatable().await);

    let response = fixture.liquidate().await;
    let closed = fixture.closed_event(&response);
    let seized = response.decode_logs_with_type::<SessionSeized>().unwrap();
    assert_eq!(seized.len(), 1);

    // Both debts, named and separate: the base the account borrowed, and the
    // quote left of its draw. The base line survives even though the account is
    // holding eleven times the asset to cover it - which is exactly what tells
    // the liquidator it can settle that leg out of the basket and buy nothing.
    // The quote line is NOT the 2_000_000 draw: the pool kept 1_802_000 of the
    // funded collateral against it and owes itself nothing for that part, so
    // the true shortfall is what it credited the parent for the seized
    // position - the same 198_000 the pure-long case pins.
    assert_eq!(
        seized[0].debt,
        vec![
            (fixture.base_asset, borrowed),
            (fixture.collateral_asset, 198_000),
        ]
    );
    // One holding, gross: the borrowed position and the bought one are the same
    // asset and arrive as one line.
    assert_eq!(
        seized[0].holdings,
        vec![(fixture.base_asset, borrowed + bought)]
    );
    assert_eq!(
        seized[0].transferred,
        vec![(fixture.base_asset, borrowed + bought)]
    );

    // What the same close looks like netted, and why it cannot be worked from:
    // the base debt has vanished into the holding, and the quote debt was never
    // representable here at all. Nothing owed, on an account that owed twice.
    assert!(closed.cancelled_debt.is_empty());
    assert_eq!(closed.reason, SettlementReason::Liquidation);
}

/// The tier shape the entry-term design exists for: NO base duration and NO
/// joining fee, four terms priced by their own `prolong_fee`. The opener picks
/// how long he wants, and that choice is the whole entry price - so one tier
/// sells four products.
#[tokio::test]
async fn a_zero_duration_tier_sells_its_term_at_the_door() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let fixture = PropFixture::new().await;

    const WEEK_FEE: u64 = 76_000;
    let tier_params = TierParams {
        line: LINE,
        leverage: 5,
        // The session lives exactly as long as the term it buys.
        duration: 0,
        maintenance_bps: 250,
        open_buffer_bps: 375,
        liq_price_factor: 9_900,
        prolong_fee: [6_000, 21_000, WEEK_FEE, 738_000],
        max_credit_line_bps: 20_000,
        max_price_age: u64::MAX,
        // No joining fee: the term IS the price.
        open_fee: 0,
        profit_share_bps: 1_000,
        price_band_bps: 1_000,
    };
    fixture
        .deployment
        .pool
        .methods()
        .publish_tier_version(TIER_ID, tier_params, vec![fixture.order_book.contract_id])
        .with_contract_ids(&[
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .call()
        .await
        .unwrap();

    let parent = Identity::Address(fixture.user.address());
    let child = fixture
        .deployment
        .deploy_account(&fixture.user, parent, 1)
        .await
        .unwrap();
    let account = PropAccountContract::new(child.contract_id(), fixture.user.clone());
    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();

    let opened_response = account
        .methods()
        .start_session(TIER_ID, COLLATERAL, ProlongPeriod::Week)
        .call_params(CallParameters::new(
            COLLATERAL,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            fixture.deployment.pool_id,
            fixture.deployment.registry_id,
        ])
        // The term is paid for at the door, so the coins leave in this call.
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap();
    let opened = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<SessionOpened>(&opened_response.tx_status.receipts)
        .unwrap();

    assert_eq!(opened.len(), 1);
    // The whole entry price is the chosen term's fee, and it is already gone.
    assert_eq!(opened[0].open_fee, WEEK_FEE);
    assert_eq!(opened[0].fees_accrued, WEEK_FEE);
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        platform_before + u128::from(WEEK_FEE)
    );
    // A week and not a second more: with no base duration the term bought is
    // the entire life of the session.
    assert_eq!(
        opened[0].expires_at - opened[0].started_at,
        604_800,
        "a zero-duration tier must grant exactly the purchased term"
    );
    // Priced off the collateral NET of what it just paid, like any other fee:
    // `k` (8_000_000) plus 2_000_000 - 76_000.
    assert_eq!(opened[0].credit_line, 9_924_000);
}

#[tokio::test]
async fn prolongation_fee_can_move_a_session_through_its_health_lines() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let before = fixture.session().await;
    let times = 300u64;
    let expected_fee = 1_800_000u64;
    // Day, because six hours is the free ENTRY term in this fixture and a
    // prolongation must be paid for.
    let expected_extension = 86_400u64 * times;
    let prolong = fixture.pool_call(
        fn_selector!(prolong_session(ProlongPeriod, u64)),
        0,
        AssetId::default(),
        Some(call_data!(ProlongPeriod::Day, times)),
    );

    // The fee leaves the pool inside this very call, so the transaction has to
    // carry a variable output for it - a prolongation is no longer a pure
    // ledger write.
    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let pool_before = fixture.pool_balance(fixture.collateral_asset).await;
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let events = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    let call_events = response
        .decode_logs_with_type::<MarginContractCallEvent>()
        .unwrap();
    assert_eq!(call_events.len(), 1);
    assert_eq!(
        call_events[0].authority,
        Identity::Address(fixture.user.address())
    );
    assert_eq!(call_events[0].called_contract, fixture.deployment.pool_id);
    assert!(call_events[0].timestamp.unix != 0);
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].period, ProlongPeriod::Day);
    assert_eq!(events[0].times, times);
    assert_eq!(events[0].seconds, expected_extension);
    assert_eq!(events[0].trigger, ProlongTrigger::User);
    assert_eq!(events[0].fee, expected_fee);
    // Charged AND paid in the same call, which is why one counter says both.
    assert_eq!(events[0].fees_accrued, expected_fee);

    // The money really moved: out of the pool, into the platform payout
    // identity, in the amount the event reported.
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        platform_before + u128::from(expected_fee)
    );
    assert_eq!(
        fixture.pool_balance(fixture.collateral_asset).await,
        pool_before - expected_fee
    );

    let after = fixture.session().await;
    assert_eq!(after.expires_at, before.expires_at + expected_extension);
    // `collateral` stays GROSS and `fees_accrued` still counts the fee, which
    // is what keeps the line and both health lines exactly where they were
    // when the fee merely accrued. Only the coins moved.
    assert_eq!(after.fees_accrued, expected_fee);

    let lines = fixture
        .deployment
        .pool
        .methods()
        .get_session_lines(fixture.child_id)
        .with_contract_ids(&[
            fixture.child_id,
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert!(lines.positive <= lines.negative + lines.freeze);
    assert!(lines.positive <= lines.negative + lines.threshold);
}

/// The OTHER entry fee. Every other test in this file runs a tier with
/// `open_fee` at zero, so the opening payout has no coverage there - and it
/// is the one fee charged against collateral that arrives in the very same
/// call, which is why it can never fail for want of pool inventory.
///
/// Pins both halves. The coins reach the platform inside `start_session`, so
/// the opening transaction now needs a variable output it never needed before.
/// And the session the user is left holding is bit-for-bit the one the accrual
/// model gave him - same gross collateral, same `fees_accrued`, same line, same
/// value - because paying early moves coins, not value. At the close the
/// platform collects nothing further: it already has the fee, and the parent's
/// cheque plus that fee is exactly what he funded.
#[tokio::test]
async fn the_open_fee_reaches_the_platform_inside_the_opening_call() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let fixture = PropFixture::new().await;

    // 100 bps of the 10_000_000 line. New sessions pin the latest version, so
    // publishing one is enough - the fixture's own session keeps version 1.
    let open_fee = 100_000u64;
    let tier_params = TierParams {
        line: LINE,
        leverage: 5,
        duration: 86_400,
        maintenance_bps: 250,
        open_buffer_bps: 375,
        liq_price_factor: 9_900,
        // Six hours free, so the entry costs exactly `open_fee`.
        prolong_fee: [0, 21_000, 76_000, 738_000],
        max_credit_line_bps: 20_000,
        max_price_age: u64::MAX,
        // 100 bps of LINE, as an amount.
        open_fee,
        profit_share_bps: 1_000,
        price_band_bps: 1_000,
    };
    fixture
        .deployment
        .pool
        .methods()
        .publish_tier_version(TIER_ID, tier_params, vec![fixture.order_book.contract_id])
        .with_contract_ids(&[
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .call()
        .await
        .unwrap();

    let parent = Identity::Address(fixture.user.address());
    let child = fixture
        .deployment
        .deploy_account(&fixture.user, parent, 1)
        .await
        .unwrap();
    let child_id = child.contract_id();
    let account = PropAccountContract::new(child_id, fixture.user.clone());

    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let pool_before = fixture.pool_balance(fixture.collateral_asset).await;

    let opened_response = account
        .methods()
        .start_session(TIER_ID, COLLATERAL, ProlongPeriod::SixHours)
        .call_params(CallParameters::new(
            COLLATERAL,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            fixture.deployment.pool_id,
            fixture.deployment.registry_id,
        ])
        // The fee leaves in this call. Without the output the whole open
        // reverts, which is the deploy-side consequence of charging early.
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap();
    let opened = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<SessionOpened>(&opened_response.tx_status.receipts)
        .unwrap();
    assert_eq!(opened.len(), 1);
    assert_eq!(opened[0].open_fee, open_fee);
    assert_eq!(opened[0].fees_accrued, open_fee);
    // Gross, exactly as it was posted: the fee is not deducted from the ledger,
    // only from the pool's balance.
    assert_eq!(opened[0].collateral, COLLATERAL);
    // `k` plus the collateral NET of the fee - the same line the accrual model
    // priced, because the line always read the net.
    assert_eq!(opened[0].credit_line, 9_900_000);

    // 2_000_000 in, 100_000 straight back out to the platform.
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        platform_before + u128::from(open_fee)
    );
    assert_eq!(
        fixture.pool_balance(fixture.collateral_asset).await,
        pool_before + COLLATERAL - open_fee
    );

    // `V = k + collateral - fees` is untouched by the payout.
    let value = fixture
        .deployment
        .pool
        .methods()
        .get_session_lines(child_id)
        .with_contract_ids(&[
            child_id,
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert_eq!(value.positive - value.negative, U256::from(9_900_000u64));

    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let close_response = account
        .methods()
        .close_session(vec![])
        .with_contracts(&[
            &fixture.deployment.pool,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    let closed = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<SessionClosed>(&close_response.tx_status.receipts)
        .unwrap();
    assert_eq!(closed.len(), 1);
    let closed = &closed[0];

    // The closing claim is the profit share and nothing else. No profit here,
    // and the fee is long gone, so the close collects nothing at all.
    assert_eq!(closed.fees_accrued, open_fee);
    assert_eq!(closed.platform_total, 0);
    assert!(closed.payout_platform.is_empty());
    assert_eq!(closed.bad_debt, 0);
    assert_eq!(closed.user_net, COLLATERAL - open_fee);
    assert_eq!(
        closed.payout_parent,
        vec![(fixture.collateral_asset, COLLATERAL - open_fee)]
    );

    // Nothing created, nothing destroyed: the parent's cheque plus the fee the
    // platform took at open is precisely what he funded.
    let parent_gain = (fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap()
        - parent_before) as u64;
    assert_eq!(parent_gain + open_fee, COLLATERAL);
}

async fn assert_oracle_proxy_is_upgradeable(fixture: &PropFixture) {
    let expected_owner =
        State::Initialized(Identity::Address(fixture.deployer.address()));
    assert_eq!(
        fixture
            .deployment
            .oracle_proxy
            .methods()
            .proxy_target()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(ContractId::from(fixture.deployment.oracle_blob_id))
    );
    assert_eq!(
        fixture
            .deployment
            .oracle_proxy
            .methods()
            .proxy_owner()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        expected_owner
    );
    assert!(
        fixture
            .deployment
            .oracle_proxy
            .methods()
            .initialize_proxy()
            .call()
            .await
            .is_err()
    );
    assert!(
        fixture
            .deployment
            .oracle
            .methods()
            .initialize()
            .call()
            .await
            .is_err()
    );

    let outsider_proxy = PropAccountOracleProxyContract::new(
        fixture.deployment.oracle_id,
        fixture.outsider.clone(),
    );
    assert!(
        outsider_proxy
            .methods()
            .set_proxy_target(ContractId::from(fixture.deployment.account_blob_id,))
            .call()
            .await
            .is_err()
    );
    assert!(
        fixture
            .deployment
            .oracle_proxy
            .methods()
            .set_proxy_target(ContractId::zeroed())
            .call()
            .await
            .is_err()
    );

    fixture
        .deployment
        .oracle_proxy
        .methods()
        .set_proxy_target(ContractId::from(fixture.deployment.account_blob_id))
        .call()
        .await
        .unwrap();
    assert_eq!(
        fixture
            .deployment
            .oracle_proxy
            .methods()
            .proxy_target()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(ContractId::from(fixture.deployment.account_blob_id))
    );
    fixture
        .deployment
        .oracle_proxy
        .methods()
        .set_proxy_target(ContractId::from(fixture.deployment.oracle_blob_id))
        .call()
        .await
        .unwrap();

    assert_eq!(
        fixture
            .deployment
            .oracle
            .methods()
            .get_prop_account_impl()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(ContractId::from(fixture.deployment.account_blob_id))
    );
    assert_eq!(
        fixture
            .deployment
            .oracle
            .methods()
            .get_prop_margin_pool()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(fixture.deployment.pool_id)
    );
    assert_eq!(
        PropAccountProxyContract::new(fixture.child_id, fixture.user.clone(),)
            .methods()
            .oracle()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        fixture.deployment.oracle_id
    );
}

async fn assert_new_pool_defaults_do_not_require_a_create_manifest(
    fixture: &PropFixture,
) {
    let proxy_configurables = PropMarginPoolProxyContractConfigurables::default()
        .with_INITIAL_OWNER(State::Initialized(Identity::Address(
            fixture.deployer.address(),
        )))
        .unwrap()
        .with_INITIAL_TARGET(ContractId::from(fixture.deployment.pool_blob_id))
        .unwrap();
    let proxy_contract = regular_contract(
        PROP_MARGIN_POOL_PROXY_BYTECODE,
        PROP_MARGIN_POOL_PROXY_STORAGE,
        Salt::from([0x77; 32]),
    )
    .unwrap()
    .with_configurables(proxy_configurables);
    let (proxy_id, is_new) = deploy_regular(&fixture.deployer, proxy_contract)
        .await
        .unwrap();
    assert!(is_new);

    let proxy = PropMarginPoolProxyContract::new(proxy_id, fixture.deployer.clone());
    proxy.methods().initialize_proxy().call().await.unwrap();
    let pool = PropMarginPoolContract::new(proxy_id, fixture.deployer.clone());

    assert!(
        !pool
            .methods()
            .is_initialized()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
    assert_eq!(
        pool.methods()
            .get_bad_debt()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        0
    );
}

/// The netting is two pool-side ledgers falling together: no coins move and the
/// session's value does not budge. It must work while the session is frozen out
/// of the order book, because digging out is the entire point.
#[tokio::test]
async fn repay_from_collateral_nets_the_draw_below_the_freeze_line() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    // Drawn PAST the posted collateral, which the tier's leverage allows and
    // which the netting therefore cannot fully clear.
    let drawn = 2_500_000u64;
    let netted = COLLATERAL;
    let draw = fixture.draw_call(drawn);
    fixture.call_account(vec![draw], 1).await.unwrap();
    // 275 six-hour extensions accrue 1_650_000 of fees: enough to freeze the
    // session, not enough to make it liquidatable.
    let prolong = fixture.prolong_call(275);
    fixture.call_account(vec![prolong], 1).await.unwrap();

    let before = fixture.session().await;
    let value_before = fixture.session_value().await;
    let lines = fixture.lines().await;
    assert_eq!(before.fees_accrued, 1_650_000);
    assert_eq!(before.credit_line, 8_350_000);
    assert_eq!(value_before, 8_350_000);
    assert!(
        lines.positive <= lines.negative + lines.freeze,
        "the session must be below the freeze line for this test to mean anything"
    );
    assert!(lines.positive > lines.negative + lines.threshold);

    // The draw outruns the collateral, and only the collateral can be netted.
    let repay = fixture.repay_from_collateral_call(drawn);
    let error = fixture.call_account(vec![repay], 0).await.unwrap_err();
    assert!(
        error.to_string().contains("InsufficientBalance"),
        "unexpected netting error: {error:#}"
    );

    let pool_cash_before = fixture.pool_balance(fixture.collateral_asset).await;
    let account_cash_before = fixture.account_balance(fixture.collateral_asset).await;
    let repay = fixture.repay_from_collateral_call(netted);
    let response = fixture.call_account(vec![repay], 0).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<QuoteRepaidFromCollateral>(&response.tx_status.receipts)
        .unwrap();

    assert_eq!(events.len(), 1);
    assert_eq!(events[0].account, fixture.child_id);
    assert_eq!(events[0].session_id, before.session_id);
    assert_eq!(events[0].amount, netted);
    assert_eq!(events[0].new_drawn_quote, drawn - netted);
    assert_eq!(events[0].new_collateral, 0);
    // The line prices off collateral NET of fees, and no collateral is left to
    // back it, so it falls back to bare `k`.
    assert_eq!(events[0].new_credit_line, 8_000_000);
    assert_eq!(events[0].from_capitalised, 0);
    assert_eq!(events[0].capitalised_total, 0);
    assert_eq!(events[0].decapitalised_total, netted);
    assert!(events[0].timestamp.unix != 0);

    let after = fixture.session().await;
    assert_eq!(after.drawn_quote, drawn - netted);
    assert_eq!(after.collateral, 0);
    assert_eq!(after.credit_line, 8_000_000);
    // The memo lives on the session itself, so the number the event reports and
    // the number settlement will read are the same storage slot - there is no
    // side table left to drift out of step with the log.
    assert_eq!(after.decapitalised, events[0].decapitalised_total);
    assert_eq!(after.decapitalised, netted);
    // Not one coin moved, and the pool's view of the session's value is
    // exactly where it was.
    assert_eq!(
        fixture.pool_balance(fixture.collateral_asset).await,
        pool_cash_before
    );
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        account_cash_before
    );
    assert_eq!(fixture.session_value().await, value_before);

    let repay = fixture.repay_from_collateral_call(0);
    let error = fixture.call_account(vec![repay], 0).await.unwrap_err();
    assert!(
        error.to_string().contains("AmountIsZero"),
        "unexpected netting error: {error:#}"
    );
}

/// The netting carries NO health gate, and this is the case that proves it may
/// not. It cannot move `V` - both ledgers fall by the same `amount`, holdings
/// and debts are untouched, and the live threshold reads only the tier's terms
/// and the absorption cost - so a gate could never fire on anything the call
/// DID. It could only refuse a session that was already the liquidator's, which
/// is precisely the user this call exists to dig out.
///
/// The proof that the refusal would buy the pool nothing: the SAME underwater
/// session is liquidated twice, once with a netting in the middle and once
/// without, and the keeper's exit and every payout come out identical.
#[tokio::test]
async fn netting_while_liquidatable_changes_nothing_the_keeper_collects() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;

    async fn underwater_then_liquidated(netted: bool) -> SessionClosed {
        let mut fixture = PropFixture::new().await;
        let drawn = 1_000_000u64;
        let draw = fixture.draw_call(drawn);
        fixture.call_account(vec![draw], 1).await.unwrap();
        // 300 extensions accrue 1_800_000 of fees, putting `V` at 8_200_000 -
        // under the tier's 8_250_000 threshold.
        let prolong = fixture.prolong_call(300);
        fixture.call_account(vec![prolong], 1).await.unwrap();
        assert_eq!(fixture.session_value().await, 8_200_000);
        assert!(
            fixture.is_liquidatable().await,
            "the session must be the liquidator's for this test to mean anything"
        );

        if netted {
            let repay = fixture.repay_from_collateral_call(drawn);
            fixture.call_account(vec![repay], 0).await.unwrap();
            let after = fixture.session().await;
            assert_eq!(after.drawn_quote, 0);
            assert_eq!(after.collateral, COLLATERAL - drawn);
            // Netting did not buy him one unit of health, and the keeper's
            // exit is still open the instant the call returns.
            assert_eq!(fixture.session_value().await, 8_200_000);
            assert!(
                fixture.is_liquidatable().await,
                "the netting must not be an escape from liquidation"
            );
        }

        let closed = fixture.closed_event(&fixture.liquidate().await);
        assert!(
            !fixture
                .deployment
                .pool
                .methods()
                .has_session(fixture.child_id)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        );
        closed
    }

    let plain = underwater_then_liquidated(false).await;
    let netted = underwater_then_liquidated(true).await;
    let collateral_asset = AssetId::new([0x31; 32]);

    assert_eq!(plain.reason, SettlementReason::Liquidation);
    assert_eq!(netted.reason, plain.reason);
    // The pool marks the same session at the same value either way...
    assert_eq!(plain.v, 8_200_000);
    assert_eq!(netted.v, plain.v);
    assert!(!plain.v_is_negative && !netted.v_is_negative);
    // ...and hands out the same money. The netting's `+1_000_000` of measured
    // profit is met by `-1_000_000` of funded collateral, so `distributable`,
    // the platform's claim and the parent's remainder never move.
    //
    // The 1_800_000 of prolongation fees was collected 300 calls ago, so the
    // CLOSE collects nothing: `fees_accrued` is money already gone, taken off
    // the funded collateral and claimed by nobody again. The platform's total
    // take on the session is unchanged at 1_800_000 -
    // `fees_accrued + platform_total` - and so is the parent's, which is the
    // invariant this test exists to pin.
    assert_eq!(plain.fees_accrued, 1_800_000);
    assert_eq!(netted.fees_accrued, plain.fees_accrued);
    assert_eq!(plain.platform_total, 0);
    assert_eq!(netted.platform_total, plain.platform_total);
    assert_eq!(plain.fees_accrued + plain.platform_total, 1_800_000);
    assert!(plain.payout_platform.is_empty());
    assert_eq!(netted.payout_platform, plain.payout_platform);
    assert_eq!(plain.user_net, netted.user_net);
    // The parent's remainder is what it always was: the 2_000_000 he funded
    // less the 1_800_000 of fees. The fee left earlier, not in a larger amount.
    assert_eq!(plain.user_net, COLLATERAL - 1_800_000);
    assert_eq!(
        plain.payout_parent,
        vec![(collateral_asset, COLLATERAL - 1_800_000)]
    );
    assert_eq!(plain.payout_parent, netted.payout_parent);
    assert_eq!(plain.bad_debt, 0);
    assert_eq!(netted.bad_debt, plain.bad_debt);
}

/// With no health gate the call reads storage and nothing else: no oracle, no
/// walk over the tier's books, and nothing but the pool among the transaction's
/// contract inputs. Proved the only way the VM lets you prove it - by leaving
/// the price feed and the book OUT of the input set, which reverts the whole
/// transaction the moment the contract touches either.
///
/// This is what makes the call safe to reach for in a crisis: a stale or
/// unreachable price feed can never trap a user inside a draw.
#[tokio::test]
async fn netting_asks_for_neither_the_price_feed_nor_the_books() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    // The whole draw goes into an unmatched buy: nothing on the account,
    // 1_000_000 of quote resting on the book. A distressed user very often has
    // orders resting precisely because he is mid-unwind.
    let drawn = 1_000_000u64;
    let draw = fixture.draw_call(drawn);
    let buy = fixture.book_call(2_000_000, 500_000_000, fixture.collateral_asset, drawn);
    fixture.call_account(vec![draw, buy], 2).await.unwrap();
    let prolong = fixture.prolong_call(275);
    fixture.call_account(vec![prolong], 1).await.unwrap();

    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);
    assert_eq!(
        fixture
            .order_book
            .order_book
            .methods()
            .get_total_balance_of(Identity::ContractId(fixture.child_id))
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        (0, drawn)
    );
    let value_before = fixture.session_value().await;
    assert_eq!(value_before, 8_350_000);

    // Only the oracle the account itself needs to authorise the session, and
    // the pool being called. No price feed, no book, no registry.
    let repay = fixture.repay_from_collateral_call(drawn);
    fixture
        .call_account_with_contract_ids(
            vec![repay],
            &[fixture.deployment.oracle_id, fixture.deployment.pool_id],
        )
        .await
        .unwrap();

    let after = fixture.session().await;
    assert_eq!(after.drawn_quote, 0);
    assert_eq!(after.collateral, COLLATERAL - drawn);
    assert_eq!(fixture.session_value().await, value_before);
    // The resting order is exactly where it was: the netting reads books, moves
    // coins and cancels orders precisely never.
    assert_eq!(
        fixture
            .order_book
            .order_book
            .methods()
            .get_total_balance_of(Identity::ContractId(fixture.child_id))
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        (0, drawn)
    );

    // Collateral is left over but the draw is gone, so the netting is bounded
    // by the draw and not by the pot it is netted against.
    let repay = fixture.repay_from_collateral_call(1);
    let error = fixture.call_account(vec![repay], 0).await.unwrap_err();
    assert!(
        error.to_string().contains("OverRepay"),
        "unexpected netting error: {error:#}"
    );
}

/// The netting does not require a clean slate, and must not: the story it was
/// written for has the user close the quote leg while an in-kind short is still
/// open. `withdraw` is a DRAIN - coins leave and the pool's claim stays put -
/// so it demands `drawn_quote` and every debt at zero. This is an
/// EXTINGUISHMENT: the amount never leaves the contract, it cancels the pool's
/// own claim, so the pool's net position is identical to the coin across it
/// however many debts are open.
#[tokio::test]
async fn netting_clears_a_draw_while_an_asset_debt_is_still_open() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    let sale = 2_000_000u64;
    let drawn = 1_000_000u64;

    // Short the base and draw quote beside it: an in-kind debt and a cash draw
    // outstanding at the same time.
    fixture
        .rest_order(sale, quantity, fixture.collateral_asset, sale)
        .await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(sale, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    let draw = fixture.draw_call(drawn);
    fixture.call_account(vec![draw], 1).await.unwrap();

    assert_eq!(fixture.debt(fixture.base_asset).await, quantity);
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        sale + drawn
    );
    let value_before = fixture.session_value().await;
    let pool_cash_before = fixture.pool_balance(fixture.collateral_asset).await;

    let repay = fixture.repay_from_collateral_call(drawn);
    fixture.call_account(vec![repay], 0).await.unwrap();

    let after = fixture.session().await;
    assert_eq!(after.drawn_quote, 0);
    assert_eq!(after.collateral, COLLATERAL - drawn);
    // The debt leg is untouched, `V` has not moved, and not one coin did.
    assert_eq!(fixture.debt(fixture.base_asset).await, quantity);
    assert_eq!(fixture.session_value().await, value_before);
    assert_eq!(
        fixture.pool_balance(fixture.collateral_asset).await,
        pool_cash_before
    );
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        sale + drawn
    );

    // And the doors that stay shut while the pool is still owed an asset stay
    // shut. The draw is gone, so each of these now fails on the DEBT.
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, 1u64)),
    );
    let error = fixture.call_account(vec![withdraw], 2).await.unwrap_err();
    assert!(
        error.to_string().contains("DebtsOutstanding"),
        "the netting must not open a drain: {error:#}"
    );
    let capitalise = fixture.pool_call(
        fn_selector!(add_collateral(ContractId)),
        1,
        fixture.collateral_asset,
        Some(call_data!(fixture.child_id)),
    );
    let error = fixture.call_account(vec![capitalise], 0).await.unwrap_err();
    assert!(
        error.to_string().contains("DebtsOutstanding"),
        "self-funding must still need a clean slate: {error:#}"
    );
    let error = fixture
        .account
        .methods()
        .close_session(vec![])
        .with_contracts(&[
            &fixture.deployment.pool,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("DebtsOutstanding"),
        "a voluntary close must still need the debt repaid: {error:#}"
    );

    // Now close the short in kind and leave properly. The base never moved, so
    // the round trip is flat and the parent gets exactly its collateral back -
    // the `decapitalised` memo is what stops the netted 1_000_000 being taxed
    // as profit he never made.
    fixture
        .rest_order(sale, quantity, fixture.base_asset, quantity)
        .await;
    let buy_back = fixture.book_call(sale, quantity, fixture.collateral_asset, sale);
    let repay_in_kind =
        fixture.pool_call(fn_selector!(repay()), quantity, fixture.base_asset, None);
    fixture
        .call_account(vec![buy_back, fixture.settle_book_call(), repay_in_kind], 2)
        .await
        .unwrap();
    assert_eq!(fixture.debt(fixture.base_asset).await, 0);

    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.bad_debt, 0);
    assert_eq!(
        closed.platform_total, 0,
        "a flat round trip owes the platform nothing: {:?}",
        closed.payout_platform
    );
    assert_eq!(
        closed.payout_parent,
        vec![(fixture.collateral_asset, COLLATERAL)]
    );
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        parent_before + u128::from(COLLATERAL)
    );
}

/// The netting must not hand back borrowing power. The line falls by at most
/// the amount netted while the draw falls by exactly it, so the headroom a
/// session has under its loan cap is the same number on both sides of the call
/// - which is why the cap needs no re-check inside it.
#[tokio::test]
async fn netting_leaves_the_loan_cap_headroom_exactly_where_it_was() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let drawn = 1_000_000u64;
    let draw = fixture.draw_call(drawn);
    fixture.call_account(vec![draw], 1).await.unwrap();
    let before = fixture.session().await;
    let headroom = before.credit_line - before.drawn_quote;
    assert_eq!(headroom, 9_000_000);

    let repay = fixture.repay_from_collateral_call(drawn);
    fixture.call_account(vec![repay], 0).await.unwrap();
    let after = fixture.session().await;
    assert_eq!(after.drawn_quote, 0);
    assert_eq!(after.credit_line, before.credit_line - drawn);
    assert_eq!(after.credit_line - after.drawn_quote, headroom);

    // To the last unit: the whole headroom draws, and one more does not.
    let draw = fixture.draw_call(headroom + 1);
    let error = fixture.call_account(vec![draw], 1).await.unwrap_err();
    assert!(
        error.to_string().contains("LoanCapExceeded"),
        "the netting must not widen the cap: {error:#}"
    );
    let draw = fixture.draw_call(headroom);
    fixture.call_account(vec![draw], 1).await.unwrap();
    assert_eq!(fixture.session().await.drawn_quote, headroom);
}

/// Above the tier cap the line stops tracking collateral, so a netting that
/// drops the draw does NOT drop the line with it and the session gets its
/// headroom back. That is the cap's doing, not the netting's, and it creates
/// nothing: the line after the call is `min(k + collateral, cap)` to the unit -
/// exactly what a plain deposit of that collateral earns, with no memory of the
/// draw netted away. The pool's cash and exposure only ever improve across it.
#[tokio::test]
async fn netting_at_the_tier_cap_returns_headroom_the_collateral_still_earns() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    // `k` is the line the tier grants against no collateral at all; `cap` is
    // `line * max_credit_line_bps`, the ceiling collateral can never buy past.
    const K: u64 = 8_000_000;
    const CAP: u64 = 20_000_000;
    let line_for = |collateral: u64| (K + collateral).min(CAP);

    // Over-collateralise until the line pins to the cap with room to spare:
    // 20_000_000 of collateral would earn 28_000_000 uncapped.
    fixture.fund_collateral(18_000_000).await;
    let funded = fixture.session().await;
    assert_eq!(funded.collateral, 20_000_000);
    assert_eq!(funded.credit_line, CAP);
    assert_eq!(funded.capitalised, 0, "an outside funder buys no share");

    let drawn = 5_000_000u64;
    let draw = fixture.draw_call(drawn);
    fixture.call_account(vec![draw], 1).await.unwrap();
    let before = fixture.session().await;
    let headroom_before = before.credit_line - before.drawn_quote;
    assert_eq!(headroom_before, 15_000_000);
    let pool_cash_before = fixture.pool_balance(fixture.collateral_asset).await;
    let value_before = fixture.session_value().await;
    assert_eq!(value_before, 28_000_000);

    let repay = fixture.repay_from_collateral_call(drawn);
    fixture.call_account(vec![repay], 0).await.unwrap();

    let after = fixture.session().await;
    assert_eq!(after.drawn_quote, 0);
    assert_eq!(after.collateral, 15_000_000);
    // Still capped, so the line did not move and the headroom grew by the whole
    // netted amount. Said out loud because it is the one number that does.
    assert_eq!(after.credit_line, CAP);
    assert_eq!(
        after.credit_line - after.drawn_quote,
        headroom_before + drawn
    );
    // It earned that line, it did not inherit it: nothing is reachable here
    // that a deposit of the same collateral could not reach directly.
    assert_eq!(after.credit_line, line_for(after.collateral));
    // `V` is invariant even though the line held still, because `credit_line`
    // cancels between the two legs. Not a coin moved either way.
    assert_eq!(fixture.session_value().await, value_before);
    assert_eq!(
        fixture.pool_balance(fixture.collateral_asset).await,
        pool_cash_before
    );

    // Re-drawing the whole line is what the cap always allowed against this
    // collateral, and one unit past it is still refused.
    let draw = fixture.draw_call(CAP + 1);
    let error = fixture.call_account(vec![draw], 1).await.unwrap_err();
    assert!(
        error.to_string().contains("LoanCapExceeded"),
        "the cap must still bind after a netting: {error:#}"
    );
    let draw = fixture.draw_call(CAP);
    fixture.call_account(vec![draw], 1).await.unwrap();
    assert_eq!(fixture.session().await.drawn_quote, CAP);

    // And netting the collateral away entirely drops the line out of the capped
    // band the moment the collateral stops earning it - all the way back to the
    // bare `k` the tier grants for nothing.
    let repay = fixture.repay_from_collateral_call(15_000_000);
    fixture.call_account(vec![repay], 0).await.unwrap();
    let uncapped = fixture.session().await;
    assert_eq!(uncapped.collateral, 0);
    assert_eq!(uncapped.drawn_quote, CAP - 15_000_000);
    assert_eq!(uncapped.credit_line, line_for(uncapped.collateral));
    assert_eq!(uncapped.credit_line, K);
    // Through all of it the pool never paid out and its claim only shrank.
    assert_eq!(
        fixture.pool_balance(fixture.collateral_asset).await,
        pool_cash_before - CAP
    );
}

/// The case the design has to survive: a loan at the tier cap, a crash that
/// wipes the position out, and a loss past every unit of collateral the user
/// posted. The netting is available to him the whole way down - and it moves
/// not one unit of that loss onto the pool. The same journey is liquidated
/// twice, netted and not, and the bad debt the pool books is identical.
#[tokio::test]
async fn a_crash_past_the_whole_collateral_books_the_same_bad_debt_either_way() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;

    async fn capped_loan_then_crash(netted: bool) -> (SessionClosed, u64) {
        let mut fixture = PropFixture::new().await;
        // 12_000_000 is the LEAST collateral that pins the line to the
        // 20_000_000 cap, so this is the most the tier will ever lend against
        // the least collateral that earns it - the thinnest legal position.
        fixture.fund_collateral(10_000_000).await;
        let drawn = 20_000_000u64;
        let quantity = 10_000_000_000u64;
        let session = fixture.session().await;
        assert_eq!(session.collateral, 12_000_000);
        assert_eq!(session.credit_line, drawn);

        fixture
            .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
            .await;
        let draw = fixture.draw_call(drawn);
        let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, drawn);
        fixture
            .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
            .await
            .unwrap();
        assert_eq!(fixture.account_balance(fixture.base_asset).await, quantity);
        assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);

        // The base falls to a hundredth of what he paid: the position is worth
        // 200_000 against a 20_000_000 draw, and 12_000_000 of collateral
        // cannot begin to cover the gap.
        fixture.publish_base_price(20_000_000_000_000_000u128).await;
        let value_before = fixture.session_value().await;
        assert_eq!(value_before, 200_000);
        assert!(fixture.is_liquidatable().await);

        if netted {
            // Every unit of collateral he has, and not one more.
            let repay = fixture.repay_from_collateral_call(12_000_000);
            fixture.call_account(vec![repay], 0).await.unwrap();
            let after = fixture.session().await;
            assert_eq!(after.collateral, 0);
            assert_eq!(after.drawn_quote, 8_000_000);
            assert_eq!(after.credit_line, 8_000_000);
            assert_eq!(fixture.session_value().await, value_before);
            assert!(fixture.is_liquidatable().await);

            let repay = fixture.repay_from_collateral_call(1);
            let error = fixture.call_account(vec![repay], 0).await.unwrap_err();
            assert!(
                error.to_string().contains("InsufficientBalance"),
                "the collateral is spent and the netting must say so: {error:#}"
            );
        }

        let closed = fixture.closed_event(&fixture.liquidate().await);
        (closed, fixture.bad_debt().await)
    }

    let (plain, plain_book) = capped_loan_then_crash(false).await;
    let (netted, netted_book) = capped_loan_then_crash(true).await;

    assert_eq!(plain.reason, SettlementReason::Liquidation);
    assert_eq!(netted.reason, plain.reason);
    assert_eq!(plain.v, 200_000);
    assert_eq!(netted.v, plain.v);
    // 20_000_000 lent against a position worth 198_000 after the haircut, less
    // the 12_000_000 of collateral that absorbs the loss first. The netting
    // consumed that same 12_000_000 up front instead - same hole, same side.
    assert_eq!(plain.bad_debt, 7_802_000);
    assert_eq!(netted.bad_debt, plain.bad_debt);
    assert_eq!(plain_book, plain.bad_debt);
    assert_eq!(netted_book, plain_book);
    // Nobody is paid out of a hole this deep, in either world, and the whole
    // position goes to the liquidator to work off-contract.
    assert_eq!(plain.user_net, 0);
    assert_eq!(netted.user_net, plain.user_net);
    assert_eq!(plain.platform_total, 0);
    assert_eq!(netted.platform_total, plain.platform_total);
    assert!(plain.payout_parent.is_empty() && netted.payout_parent.is_empty());
    assert!(plain.payout_platform.is_empty() && netted.payout_platform.is_empty());
}

/// `withdraw`'s account leg is share-bearing because, with `drawn_quote` and
/// every in-kind debt at zero, anything resting on the account could only have
/// been TRADED there. The netting is the one call that breaks that premise: it
/// moves funded collateral out against the draw and leaves it on the account as
/// PRINCIPAL, which `withdrawal_portions` then drains FIRST. Without consuming
/// the `decapitalised` memo, the user pays a profit share on his own capital -
/// and settlement cannot give it back, because the share base saturates at zero.
///
/// Both halves are pinned here in one journey: the netted principal comes back
/// untaxed, and the profit earned on top of it is still charged in full.
#[tokio::test]
async fn netting_returns_principal_untaxed_while_real_profit_still_pays() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let principal = 1_000_000u64;
    let quantity = 500_000_000u64;
    let sale = 1_500_000u64;
    let profit = sale - principal;
    // Netting spends funded collateral, and `withdraw` holds the tier's entry
    // ticket as a STANDING floor, so the session needs headroom above
    // `required_collateral` for the withdrawal below to be legal at all. Top up
    // from an outside funder first: this test is about the SHARE, not the floor.
    let topped_up = COLLATERAL + 2_000_000;
    fixture.fund_collateral(2_000_000).await;
    assert_eq!(fixture.session().await.collateral, topped_up);

    // Draw, then net it straight back off. The cash stays on the account, but
    // it is now the user's OWN collateral, not borrowed quote.
    let draw = fixture.draw_call(principal);
    fixture.call_account(vec![draw], 1).await.unwrap();
    let repay = fixture.repay_from_collateral_call(principal);
    let response = fixture.call_account(vec![repay], 0).await.unwrap();
    let netted = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<QuoteRepaidFromCollateral>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(netted[0].decapitalised_total, principal);
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        principal
    );
    assert_eq!(fixture.session().await.collateral, topped_up - principal);

    // Trade that principal into a real 500_000 of profit: buy the base at 2.0
    // and sell it back at 3.0.
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, principal);
    fixture
        .call_account(vec![buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture
        .rest_order(3_000_000, quantity, fixture.collateral_asset, sale)
        .await;
    let sell = fixture.book_call(3_000_000, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        sale
    );

    // Take the whole account balance out. `withdrawal_portions` drains the
    // account leg first, so this is the exact call that used to tax principal.
    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, sale)),
    );
    let response = fixture.call_account(vec![withdraw], 2).await.unwrap();
    let withdrawn = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<MarginWithdrawn>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(withdrawn.len(), 1);
    assert_eq!(withdrawn[0].amount, sale);
    assert_eq!(withdrawn[0].from_account, sale);
    assert_eq!(withdrawn[0].from_pool, 0);
    // 10% of the 500_000 he actually earned, and NOT one unit of the
    // 1_000_000 of his own capital the netting parked on the account.
    assert_eq!(
        withdrawn[0].share_qty,
        profit / 10,
        "the netted principal must not be taxed as profit"
    );
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        parent_before + u128::from(sale - profit / 10)
    );

    // The memo is spent, so settlement does not correct the same principal a
    // second time, and the books reconcile: the whole remaining collateral
    // comes back, 500_000 was earned, 50_000 of it shared, and nothing else
    // moved.
    let remaining = topped_up - principal;
    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.bad_debt, 0);
    assert_eq!(closed.platform_total, 0);
    assert_eq!(
        closed.payout_parent,
        vec![(fixture.collateral_asset, remaining)]
    );
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        parent_before + u128::from(sale - profit / 10 + remaining)
    );
}

/// The netting reads its account from `caller_contract()`, so it can only ever
/// touch the session of whoever is calling. A wallet has no session to net.
#[tokio::test]
async fn only_a_contract_with_a_session_can_net_a_draw() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let draw = fixture.draw_call(1_000_000);
    fixture.call_account(vec![draw], 1).await.unwrap();

    let error = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .repay_from_collateral(1_000_000)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("CallerNotContract"),
        "a wallet must not be able to net anybody's draw: {error:#}"
    );
    assert_eq!(fixture.session().await.drawn_quote, 1_000_000);
    assert_eq!(fixture.session().await.collateral, COLLATERAL);
}

/// A long that fell. He drew quote and bought the base; the base halved. He
/// cannot repay the draw without selling into the loss, and `withdraw` demands
/// `drawn_quote == 0`, so without the netting he is stuck holding the position.
#[tokio::test]
async fn a_long_that_fell_nets_its_draw_away_and_closes_cleanly() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(cost, quantity, fixture.base_asset, quantity)
        .await;

    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(cost, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    assert_eq!(fixture.account_balance(fixture.base_asset).await, quantity);
    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);

    // The base halves: the position is worth 1_000_000 against a 2_000_000
    // draw, and there is no cash left anywhere to return.
    fixture
        .publish_base_price(1_000_000_000_000_000_000u128)
        .await;
    let value_before = fixture.session_value().await;
    assert_eq!(value_before, 9_000_000);

    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let error = fixture.call_account(vec![withdraw], 2).await.unwrap_err();
    assert!(
        error.to_string().contains("QuoteOutstanding"),
        "the draw is what traps him: {error:#}"
    );

    let repay = fixture.repay_from_collateral_call(cost);
    fixture.call_account(vec![repay], 0).await.unwrap();
    let after = fixture.session().await;
    assert_eq!(after.drawn_quote, 0);
    assert_eq!(after.collateral, COLLATERAL - cost);
    assert_eq!(fixture.session_value().await, value_before);

    // The draw is gone, so `QuoteOutstanding` no longer bites - but the netting
    // spent every unit of funded collateral to get there, and the tier's entry
    // ticket is a STANDING floor. A partial exit is refused while the session
    // sits under it, on the account leg exactly as on the pool leg.
    let released = 100_000_000u64;
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, released)),
    );
    let error = fixture.call_account(vec![withdraw], 2).await.unwrap_err();
    assert!(
        error.to_string().contains("BelowTierCollateral"),
        "a session funded below its tier floor must not release anything: {error:#}"
    );

    // He is not trapped, though - the full exit has no such floor, and returns
    // the WHOLE position at par. The netting moved 2_000_000 out of funded
    // collateral, which inflates measured profit by exactly that much; the
    // session's `decapitalised` memo takes it straight back out, so the
    // platform charges no share on a position that LOST money.
    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.platform_total, 0);
    assert!(
        closed.payout_platform.is_empty(),
        "a netted draw must not be taxed as profit: {:?}",
        closed.payout_platform
    );
    assert_eq!(closed.payout_parent, vec![(fixture.base_asset, quantity)]);
    assert_eq!(closed.bad_debt, 0);
}

/// A short that rose. He borrowed the base, sold it, and bought it back higher
/// with drawn quote. The in-kind debt is settled but the draw is not, and there
/// is no cash left to return it with.
#[tokio::test]
async fn a_short_that_rose_nets_its_draw_away_and_closes_cleanly() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    let sale = 2_000_000u64;
    let buy_back = 3_000_000u64;
    fixture
        .rest_order(sale, quantity, fixture.collateral_asset, sale)
        .await;

    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(sale, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        sale
    );

    // The base rises by half: buying the borrowed quantity back costs
    // 3_000_000 against the 2_000_000 the sale raised.
    fixture
        .publish_base_price(3_000_000_000_000_000_000u128)
        .await;
    fixture
        .rest_order(buy_back, quantity, fixture.base_asset, quantity)
        .await;

    let draw = fixture.draw_call(buy_back - sale);
    let buy = fixture.book_call(buy_back, quantity, fixture.collateral_asset, buy_back);
    let repay_in_kind =
        fixture.pool_call(fn_selector!(repay()), quantity, fixture.base_asset, None);
    fixture
        .call_account(
            vec![draw, buy, fixture.settle_book_call(), repay_in_kind],
            2,
        )
        .await
        .unwrap();

    let before = fixture.session().await;
    assert_eq!(before.drawn_quote, buy_back - sale);
    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);
    assert_eq!(fixture.account_balance(fixture.base_asset).await, 0);
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_debts(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
    let value_before = fixture.session_value().await;

    let repay = fixture.repay_from_collateral_call(before.drawn_quote);
    fixture.call_account(vec![repay], 0).await.unwrap();
    let after = fixture.session().await;
    assert_eq!(after.drawn_quote, 0);
    assert_eq!(after.collateral, COLLATERAL - before.drawn_quote);
    assert_eq!(fixture.session_value().await, value_before);

    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.bad_debt, 0);
    assert_eq!(closed.platform_total, 0);
    assert_eq!(
        closed.payout_parent,
        vec![(fixture.collateral_asset, after.collateral)]
    );
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        parent_before + u128::from(after.collateral)
    );
}

/// The settlement-level reconciliation, and the reason `decapitalised` exists.
///
/// A voluntary close demands the pool be owed NOTHING, so the same profitable
/// journey is run twice with the two legal ways of getting there: selling into
/// the position and paying the draw back in cash, versus netting it against
/// posted collateral. The two leave the user holding completely different
/// baskets - 2_000_000 of funded collateral plus half the position, against no
/// collateral and all of it - yet the platform must walk away with the same
/// money, because the user earned the same 2_000_000 either way. The netting
/// shifts 2_000_000 from funded collateral into measured profit, so without the
/// `decapitalised` correction the platform would charge its share on 4_000_000
/// of "profit" instead of the 2_000_000 actually made.
#[tokio::test]
async fn netting_leaves_the_platforms_settlement_take_exactly_where_it_was() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;

    async fn profitable_long_then_close(netted: bool) -> SessionClosed {
        let mut fixture = PropFixture::new().await;
        let quantity = 1_000_000_000u64;
        let cost = 2_000_000u64;
        fixture
            .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
            .await;

        let draw = fixture.draw_call(cost);
        let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
        fixture
            .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
            .await
            .unwrap();

        // The base doubles: 2_000_000 of real, share-bearing profit.
        fixture
            .publish_base_price(4_000_000_000_000_000_000u128)
            .await;

        if netted {
            // Route A: net the draw against posted collateral. No coins move,
            // the whole position stays on the account.
            let repay = fixture.repay_from_collateral_call(cost);
            fixture.call_account(vec![repay], 0).await.unwrap();
            let session = fixture.session().await;
            assert_eq!(session.drawn_quote, 0);
            assert_eq!(session.collateral, 0);
            assert_eq!(fixture.account_balance(fixture.base_asset).await, quantity);
        } else {
            // Route B: sell half the position at the new mark and hand the
            // 2_000_000 straight back. Collateral is untouched; half the base
            // is gone.
            let sold = quantity / 2;
            fixture
                .rest_order(4_000_000, sold, fixture.collateral_asset, cost)
                .await;
            let sell = fixture.book_call(4_000_000, sold, fixture.base_asset, sold);
            let return_quote = fixture.pool_call(
                fn_selector!(return_quote()),
                cost,
                fixture.collateral_asset,
                None,
            );
            fixture
                .call_account(vec![sell, fixture.settle_book_call(), return_quote], 2)
                .await
                .unwrap();
            let session = fixture.session().await;
            assert_eq!(session.drawn_quote, 0);
            assert_eq!(session.collateral, COLLATERAL);
            assert_eq!(
                fixture.account_balance(fixture.base_asset).await,
                quantity - sold
            );
        }
        fixture.closed_event(&fixture.close_session().await)
    }

    /// What the platform actually walked away with, priced at the closing
    /// marks: base at 4.0 (9 decimals) into collateral units (6 decimals).
    fn realised_take(closed: &SessionClosed, collateral: AssetId) -> u128 {
        closed
            .payout_platform
            .iter()
            .map(|(asset, amount)| {
                if *asset == collateral {
                    u128::from(*amount)
                } else {
                    u128::from(*amount) * 4 / 1_000
                }
            })
            .sum()
    }

    let plain = profitable_long_then_close(false).await;
    let netted = profitable_long_then_close(true).await;
    let collateral_asset = AssetId::new([0x31; 32]);

    // 10% of the 2_000_000 the position actually earned, in both worlds.
    assert_eq!(plain.platform_total, 200_000);
    assert_eq!(netted.platform_total, plain.platform_total);
    assert_eq!(realised_take(&plain, collateral_asset), 200_000);
    assert_eq!(realised_take(&netted, collateral_asset), 200_000);
    // The user is whole in both too, up to the single base unit the in-kind
    // split rounds in the pool's favour when a shortfall has to be covered.
    assert!(
        plain.user_net.abs_diff(netted.user_net) <= 1,
        "the route to a clean slate moved the user's settlement: {} vs {}",
        plain.user_net,
        netted.user_net
    );
    assert_eq!(plain.bad_debt, 0);
    assert_eq!(netted.bad_debt, 0);
}

/// The other half of the share story, and the shape that would leak if the
/// correction ever double counted: profit CAPITALISED into collateral already
/// owes the platform its share, and netting takes that collateral back out.
/// Striking the capitalised balance and deferring the remainder are two halves
/// of ONE correction - together they move the share base by exactly the amount
/// netted, matching the exactly-that-much rise in measured profit. Applying
/// both to the full amount would erase a real claim, and the pool would eat it
/// at close with an empty basket to blame.
#[tokio::test]
async fn capitalised_profit_survives_a_netting_and_is_still_shared_at_close() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    let sale = 3_000_000u64;
    let profit = sale - cost;

    // Buy the base with drawn quote, watch it rise by half, sell it back and
    // return the draw: 1_000_000 of realised, share-bearing profit in cash.
    fixture
        .rest_order(cost, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(cost, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    fixture
        .publish_base_price(3_000_000_000_000_000_000u128)
        .await;
    fixture
        .rest_order(sale, quantity, fixture.collateral_asset, sale)
        .await;
    let sell = fixture.book_call(sale, quantity, fixture.base_asset, quantity);
    let return_quote = fixture.pool_call(
        fn_selector!(return_quote()),
        cost,
        fixture.collateral_asset,
        None,
    );
    fixture
        .call_account(vec![sell, fixture.settle_book_call(), return_quote], 2)
        .await
        .unwrap();
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        profit
    );

    // Capitalise it: the profit becomes funded collateral and stops showing up
    // in measured P&L, which is exactly what `capitalised` is for.
    let capitalise = fixture.pool_call(
        fn_selector!(add_collateral(ContractId)),
        profit,
        fixture.collateral_asset,
        Some(call_data!(fixture.child_id)),
    );
    fixture.call_account(vec![capitalise], 0).await.unwrap();
    let capitalised = fixture.session().await;
    assert_eq!(capitalised.collateral, COLLATERAL + profit);
    assert_eq!(capitalised.capitalised, profit);

    // Draw against it and net the draw straight back off: the capitalised
    // balance is struck, and nothing is deferred because it covered the whole
    // netting.
    let draw = fixture.draw_call(profit);
    fixture.call_account(vec![draw], 1).await.unwrap();
    let repay = fixture.repay_from_collateral_call(profit);
    let response = fixture.call_account(vec![repay], 0).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<QuoteRepaidFromCollateral>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].from_capitalised, profit);
    assert_eq!(events[0].capitalised_total, 0);
    assert_eq!(
        events[0].decapitalised_total, 0,
        "the netting was covered by the capitalised balance, so deferring any \
         of it as well would count the same correction twice",
    );

    let netted = fixture.session().await;
    assert_eq!(netted.collateral, COLLATERAL);
    assert_eq!(netted.drawn_quote, 0);
    assert_eq!(netted.capitalised, 0);
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        profit
    );

    // The profit is back in the account and back in measured P&L, so the
    // platform still collects its 10% of the 1_000_000 the user really made.
    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.platform_total, profit / 10);
    assert_eq!(
        closed.payout_platform,
        vec![(fixture.collateral_asset, profit / 10)]
    );
    assert_eq!(
        closed.payout_parent,
        vec![(fixture.collateral_asset, COLLATERAL + profit - profit / 10)]
    );
    assert_eq!(closed.bad_debt, 0);
}

/// Found while proving the netting cannot underflow, and pre-existing:
/// `prolong` reprices the line off the collateral NET of accrued fees, so a
/// long-lived session can end up owing more quote than its line expresses.
/// Subtracting that unsigned reverts, and this is the single valuation path
/// behind `liquidate`, `expire_session` and `get_session_lines` - so the
/// session could be neither valued nor closed, with the pool's principal
/// outstanding the whole time.
#[tokio::test]
async fn a_session_prolonged_past_its_line_can_still_be_valued_and_liquidated() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let drawn = 9_000_000u64;
    let draw = fixture.draw_call(drawn);
    fixture.call_account(vec![draw], 1).await.unwrap();
    // 300 six-hour extensions accrue 1_800_000 of fees against 2_000_000 of
    // collateral, pricing the line at 8_200_000 - under the 9_000_000 drawn.
    let prolong = fixture.prolong_call(300);
    fixture.call_account(vec![prolong], 1).await.unwrap();

    let session = fixture.session().await;
    assert_eq!(session.fees_accrued, 1_800_000);
    assert_eq!(session.credit_line, 8_200_000);
    assert!(
        session.credit_line < session.drawn_quote,
        "the fixture must reach the overdrawn state this test is about"
    );

    let lines = fixture.lines().await;
    // The 800_000 deficit sits on the NEGATIVE leg beside the fees, not clamped
    // away: 1_800_000 of equity the line does not express plus the 9_000_000 of
    // drawn cash still on the account, against 2_600_000.
    assert_eq!(lines.positive, U256::from(10_800_000u64));
    assert_eq!(lines.negative, U256::from(2_600_000u64));
    assert_eq!(fixture.session_value().await, 8_200_000);
    // Clamping the deficit at zero would have reported 9_000_000 here - too
    // healthy by exactly the deficit, and enough to clear the line below.
    assert!(
        lines.positive <= lines.negative + lines.threshold,
        "an overdrawn session must be liquidatable, not merely valuable"
    );

    let response = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .liquidate(fixture.child_id, vec![])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    let closed = response.decode_logs_with_type::<SessionClosed>().unwrap();
    assert_eq!(closed.len(), 1);
    assert_eq!(closed[0].reason, SettlementReason::Liquidation);
    assert_eq!(closed[0].v, 8_200_000);
    assert!(!closed[0].v_is_negative);
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
}

/// The netting is deliberately gated on NEITHER `paused` NOR expiry. It only
/// ever shrinks the pool's outstanding cash, so neither an emergency stop nor a
/// lapsed deadline may trap a user inside a draw - the same reasoning that
/// leaves `return_quote` and `repay` open.
#[tokio::test]
async fn netting_survives_a_pause_and_an_elapsed_deadline() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let half = 500_000u64;
    let draw = fixture.draw_call(half * 2);
    fixture.call_account(vec![draw], 1).await.unwrap();

    fixture
        .deployment
        .pool
        .methods()
        .pause()
        .call()
        .await
        .unwrap();
    let draw = fixture.draw_call(1);
    let error = fixture.call_account(vec![draw], 1).await.unwrap_err();
    assert!(
        error.to_string().contains("Paused"),
        "the pause must actually be in force: {error:#}"
    );
    let repay = fixture.repay_from_collateral_call(half);
    fixture.call_account(vec![repay], 0).await.unwrap();
    fixture
        .deployment
        .pool
        .methods()
        .unpause()
        .call()
        .await
        .unwrap();

    // Outlive the pool session with the account's own signing session, so the
    // clock below expires only the thing under test.
    let session = fixture.session().await;
    fixture
        .account
        .methods()
        .set_session(ParallelSessionArgs {
            nonce: U256::one(),
            session_id: Identity::Address(fixture.user.address()),
            expiry: Time {
                unix: session.expires_at + 86_400,
            },
            contract_ids: vec![],
        })
        .with_contract_ids(&[fixture.deployment.oracle_id])
        .call()
        .await
        .unwrap();

    let provider = fixture.outsider.try_provider().unwrap();
    let latest = provider
        .latest_block_time()
        .await
        .unwrap()
        .expect("local chain has a latest block time");
    let expired_time = latest
        .checked_add_signed(chrono::TimeDelta::seconds(
            (session.expires_at.saturating_sub(latest.timestamp() as u64) + 1) as i64,
        ))
        .expect("test expiry timestamp is representable");
    provider
        .produce_blocks(1, Some(expired_time))
        .await
        .unwrap();

    let repay = fixture.repay_from_collateral_call(half);
    fixture.call_account(vec![repay], 0).await.unwrap();
    let after = fixture.session().await;
    assert_eq!(after.drawn_quote, 0);
    assert_eq!(after.collateral, COLLATERAL - half * 2);

    // And the keeper's exit is still there afterwards.
    expire_fixture_session(&fixture).await;
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
}

/// The tier's entry ticket is a STANDING floor, and this is the attack that
/// proved it was not. `withdraw` bounded `BelowTierCollateral` on the
/// `from_pool` leg only, which was sound while account cash could only be
/// TRADED profit. `repay_from_collateral` breaks that premise: it debits
/// `collateral` and parks the principal on the account, where
/// `withdrawal_portions` drains it FIRST - so `draw -> net -> withdraw` walked
/// the entire posted collateral out of a LIVE session through the unguarded
/// leg, in one atomic transaction, and left it running an 8_000_000 line with
/// nothing behind it.
///
/// All three routes are pinned here, because the first fix I tried closed only
/// the first: the principal can be taken as quote, or converted to a tier asset
/// and taken in kind, and either way the session must not be able to re-lever
/// afterwards.
#[tokio::test]
async fn netting_cannot_walk_funded_collateral_below_the_tier_floor() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let floor = LINE / 5; // required_collateral = 2_000_000 = the whole fixture stake

    // The direct route was always shut: with collateral AT the floor there is
    // no pool-leg headroom, so not one unit comes out.
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, 1u64)),
    );
    let error = fixture.call_account(vec![withdraw], 2).await.unwrap_err();
    assert!(
        error.to_string().contains("BelowTierCollateral"),
        "the pool leg must still hold the floor: {error:#}"
    );

    // Route 1 - net, then take the principal out as quote through the account
    // leg. This is the one that used to succeed.
    let drawn = 1_624_999u64;
    let draw = fixture.draw_call(drawn);
    let net = fixture.repay_from_collateral_call(drawn);
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, drawn)),
    );
    let error = fixture
        .call_account(vec![draw, net, withdraw], 6)
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("BelowTierCollateral"),
        "the account leg must hold the same floor: {error:#}"
    );

    // Nothing landed: the whole batch reverted, so the session is untouched.
    let session = fixture.session().await;
    assert_eq!(session.collateral, COLLATERAL);
    assert_eq!(session.drawn_quote, 0);
    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);

    // Route 2 - net, convert the principal into a tier asset, then take it out
    // in kind. The floor reads `collateral`, never the withdrawn asset, so
    // changing the principal's clothes buys nothing.
    let quantity = 500_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(1_000_000);
    let net = fixture.repay_from_collateral_call(1_000_000);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, 1_000_000);
    fixture
        .call_account(vec![draw, net, buy, fixture.settle_book_call()], 3)
        .await
        .unwrap();
    let session = fixture.session().await;
    assert_eq!(session.collateral, COLLATERAL - 1_000_000);
    assert!(
        session.collateral < floor,
        "the walk did put it under the floor"
    );
    assert_eq!(fixture.account_balance(fixture.base_asset).await, quantity);

    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let error = fixture.call_account(vec![withdraw], 2).await.unwrap_err();
    assert!(
        error.to_string().contains("BelowTierCollateral"),
        "an in-kind exit must not escape the floor either: {error:#}"
    );

    // Route 3 - and a session sitting under the floor cannot re-lever into the
    // pool's own capital, because the line it would draw against is the one the
    // collateral no longer earns. `k` is still 8_000_000 of line here.
    assert_eq!(session.credit_line, LINE - LINE / 5 + session.collateral);
    let redraw = fixture.draw_call(session.credit_line);
    fixture.call_account(vec![redraw], 2).await.unwrap();
    let levered = fixture.session().await;
    assert_eq!(levered.drawn_quote, levered.credit_line);
    // It IS reachable - the floor guards value LEAVING, not borrowing - but the
    // principal never left, so it is still sitting in `holdings` backing the
    // draw, and the session is exactly as healthy as before.
    assert!(
        !fixture.is_liquidatable().await,
        "the netted principal is still on the account, so the session is sound"
    );
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, 1u64)),
    );
    let error = fixture.call_account(vec![withdraw], 2).await.unwrap_err();
    assert!(
        error.to_string().contains("QuoteOutstanding"),
        "and it still cannot take anything out: {error:#}"
    );
}

/// Control for the memo ledger across a long interleaving: three
/// `draw -> repay_from_collateral` cycles build a 3_000_000 memo while OUTSIDE
/// top-ups (which are not share-bearing and never touch the memo) keep the
/// session above its floor. The pile is then traded into a real 1_500_000 of
/// profit and taken out. The platform must charge its share on the profit and
/// on nothing else.
#[tokio::test]
async fn repeated_netting_with_outside_top_ups_still_taxes_only_profit() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    // Headroom first, so the nettings never drive the session under its floor.
    fixture.fund_collateral(4_000_000).await;
    let mut netted = 0u64;
    for _ in 0..3 {
        let draw = fixture.draw_call(1_000_000);
        let net = fixture.repay_from_collateral_call(1_000_000);
        fixture.call_account(vec![draw, net], 2).await.unwrap();
        netted += 1_000_000;
    }
    let session = fixture.session().await;
    assert_eq!(session.collateral, COLLATERAL + 4_000_000 - netted);
    assert_eq!(session.drawn_quote, 0);
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        netted
    );

    // Trade the netted pile into a genuine 1_500_000: buy at 2.0, sell at 3.0.
    let quantity = 1_500_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, netted);
    fixture
        .call_account(vec![buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    let sale = 4_500_000u64;
    fixture
        .rest_order(3_000_000, quantity, fixture.collateral_asset, sale)
        .await;
    let sell = fixture.book_call(3_000_000, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        sale
    );

    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, sale)),
    );
    let response = fixture.call_account(vec![withdraw], 3).await.unwrap();
    let withdrawn = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<MarginWithdrawn>(&response.tx_status.receipts)
        .unwrap();
    // 10% of the 1_500_000 earned, and nothing on the 3_000_000 of principal
    // three separate nettings parked on the account.
    assert_eq!(
        withdrawn[0].share_qty,
        (sale - netted) / 10,
        "the memo must survive repeated nettings and outside top-ups intact"
    );
}

/// A voluntary close settles at PAR, and par is only the honest price when the
/// pool is owed nothing. `settle_session` used to gate on the IN-KIND debt index
/// alone, so a user who never called `borrow` closed with an empty index while
/// still owing the entire quote draw - and took the `liq_price_factor` haircut
/// with him on a session a keeper was already entitled to seize. Measured at
/// the time: 200_000 to the owner against the 118_000 a keeper would have left
/// him, exactly 1% of the 8_200_000 position.
///
/// Both halves of "owed" are now required at zero, matching `withdraw` and
/// self-funding. The keeper's price is what the pool keeps.
#[tokio::test]
async fn a_voluntary_close_is_refused_while_the_quote_draw_is_outstanding() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let drawn = 10_000_000u64;
    let quantity = 5_000_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(drawn);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, drawn);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    // Base to 1.64: the position marks 8_200_000 against a 10_000_000 draw, and
    // the session crosses the liquidation line.
    fixture
        .publish_base_price(1_640_000_000_000_000_000u128)
        .await;
    assert!(fixture.is_liquidatable().await);
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_debts(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        "no in-kind debt was ever created - only a quote draw"
    );

    // The empty in-kind index is no longer enough.
    let error = fixture
        .account
        .methods()
        .close_session(vec![])
        .with_contracts(&[
            &fixture.deployment.pool,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("QuoteOutstanding"),
        "a par close must not be available while the pool is still owed cash: {error:#}"
    );

    // Netting every unit of collateral does not buy the par exit either - the
    // draw outruns the collateral, so some of it survives.
    let repay = fixture.repay_from_collateral_call(COLLATERAL);
    fixture.call_account(vec![repay], 0).await.unwrap();
    let after = fixture.session().await;
    assert_eq!(after.collateral, 0);
    assert_eq!(after.drawn_quote, drawn - COLLATERAL);
    let error = fixture
        .account
        .methods()
        .close_session(vec![])
        .with_contracts(&[
            &fixture.deployment.pool,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("QuoteOutstanding"),
        "still owed 8_000_000: {error:#}"
    );

    // And the keeper's exit is right there, priced with the haircut the pool
    // needs to unwind a basket it did not choose to hold.
    let closed = fixture.closed_event(&fixture.liquidate().await);
    assert_eq!(closed.reason, SettlementReason::Liquidation);
    assert_eq!(closed.bad_debt, 0);
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
}

/// The in-kind sibling of the quote netting, and the position it exists for: a
/// short that moved against the user. He borrowed the base and sold it; to
/// close in kind he must BUY it back at a price he can no longer afford, and
/// every clean exit - `withdraw`, self-funding, the voluntary close - demands an
/// empty debt index. This converts the obligation straight out of collateral,
/// priced at the ASK because buying it back is what the pool must now do.
#[tokio::test]
async fn repay_base_from_collateral_closes_a_short_the_user_cannot_buy_back() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    let sale = 2_000_000u64;
    // What the position marks at the ask is exactly what the pool CHARGES:
    // the PLAIN ask, no `liq_price_factor` widening. The conversion's whole
    // premium over the mark is `BASE_REPAY_FEE_PPM`, nothing else.
    let marked = 3_000_000u64;
    let charged = marked;
    let fee = charged / 10_000; // 100 ppm of an even value, no rounding
    // Headroom, so the whole short can be closed from collateral.
    fixture.fund_collateral(4_000_000).await;
    let funded = COLLATERAL + 4_000_000;

    // Short: borrow the base and sell it at 2.0.
    fixture
        .rest_order(2_000_000, quantity, fixture.collateral_asset, sale)
        .await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    assert_eq!(fixture.debt(fixture.base_asset).await, quantity);
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        sale
    );

    // The base rises by half. Buying it back costs 3_000_000 against the
    // 2_000_000 the sale raised - he is 1_000_000 short and holds no base.
    fixture
        .publish_base_price(3_000_000_000_000_000_000u128)
        .await;
    let pool_cash_before = fixture.pool_balance(fixture.collateral_asset).await;
    let account_cash_before = fixture.account_balance(fixture.collateral_asset).await;
    let platform_cash_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();

    // The fee leaves in this call now, so the transaction carries an output for
    // it - the same builder change prolongation needed.
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    let response = fixture.call_account(vec![repay], 1).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<BaseDebtRepaidFromCollateral>(
            &response.tx_status.receipts,
        )
        .unwrap();

    assert_eq!(events.len(), 1);
    assert_eq!(events[0].asset_id, fixture.base_asset);
    assert_eq!(events[0].amount, quantity);
    // Struck at the ASK, not the bid: closing a short is a purchase.
    assert_eq!(events[0].ask, U256::from(3_000_000_000_000_000_000u64));
    assert_eq!(
        events[0].value, charged,
        "the plain ask, with no liq_price_factor widening"
    );
    // 100 ppm of the charged value - one basis point, the order book's scale.
    assert_eq!(events[0].fee, fee);
    assert_eq!(events[0].debt_total, 0);
    assert_eq!(events[0].decapitalised_total, charged);
    assert_eq!(events[0].from_capitalised, 0);

    let after = fixture.session().await;
    assert_eq!(after.collateral, funded - charged);
    // The fee is charged BESIDE the ledger - NOT debited from `collateral` as
    // well, which would bill it twice. It is now also PAID in this same call,
    // and `fees_accrued` records both facts with one number.
    assert_eq!(after.fees_accrued, fee);
    assert_eq!(
        after.credit_line,
        LINE - LINE / 5 + after.collateral - after.fees_accrued
    );
    assert_eq!(fixture.debt(fixture.base_asset).await, 0);
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_debts(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        "the debt index must be clear, which is what unblocks every exit"
    );
    // The CONVERSION still moves no coins - the debt is extinguished against
    // the ledger, exactly like its quote sibling. The only thing that leaves is
    // the fee, straight to the platform, which is the whole of the difference
    // from the accrual model.
    assert_eq!(
        fixture.pool_balance(fixture.collateral_asset).await,
        pool_cash_before - fee
    );
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        platform_cash_before + u128::from(fee)
    );
    // The account is untouched either way: the fee comes out of the pool's
    // balance against the user's collateral claim, never off his own cash.
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        account_cash_before
    );

    // And the clean exit is open now. He shorted at 2.0 and closed at 3.0, so
    // he is down 1_000_000 plus the 300 fee - and the platform collects nothing
    // FURTHER, because it already has the fee and a loss carries no share.
    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.bad_debt, 0);
    // The fee was collected at the repayment, so the close claims nothing.
    assert_eq!(closed.platform_total, 0);
    assert_eq!(closed.fees_accrued, fee);
    // 6_000_000 in, the short cost 1_030_304 more to close than the sale
    // raised, and the platform took the 304 fee and nothing else - a loss
    // carries no profit share. The parent's cheque is UNCHANGED by paying the
    // fee earlier: settlement takes `fees_accrued` off the funded cash instead
    // of claiming it, and the two cancel to the unit.
    let expected = funded - (charged - sale) - fee;
    assert_eq!(
        closed.payout_parent,
        vec![(fixture.collateral_asset, expected)]
    );
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        parent_before + u128::from(expected)
    );
    let _ = marked;
}

/// The guards, and the rounding that stops the fee being sliced away. Charged
/// on the quote value and rounded UP, so a repayment small enough that 100 ppm
/// floors to zero still pays one unit - the rule every other fee here follows.
#[tokio::test]
async fn repay_base_from_collateral_guards_its_inputs_and_rounds_the_fee_up() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    fixture.fund_collateral(4_000_000).await;
    fixture
        .rest_order(2_000_000, quantity, fixture.collateral_asset, 2_000_000)
        .await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    // The quote leg is not an in-kind debt and nets without a price.
    let repay = fixture.repay_base_from_collateral_call(fixture.collateral_asset, 1);
    let error = fixture.call_account(vec![repay], 1).await.unwrap_err();
    assert!(
        error.to_string().contains("UseRepayQuote"),
        "the collateral asset must be routed to the quote netting: {error:#}"
    );

    // Bounded by the debt in both directions.
    for bad in [0u64, quantity + 1] {
        let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, bad);
        let error = fixture.call_account(vec![repay], 1).await.unwrap_err();
        assert!(
            error.to_string().contains("OverRepay"),
            "unexpected error for amount {bad}: {error:#}"
        );
    }

    // A sliver: 2_500_000 base units at 2.0 is 5_000 of quote, and 100 ppm of
    // that is 0.5 - which must round UP, not away.
    let sliver = 2_500_000u64;
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, sliver);
    let response = fixture.call_account(vec![repay], 1).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<BaseDebtRepaidFromCollateral>(
            &response.tx_status.receipts,
        )
        .unwrap();
    // 5_000 at the plain ask - the charge, with no widening on top.
    assert_eq!(events[0].value, 5_000);
    assert_eq!(events[0].fee, 1, "a floored fee would be free");
    assert_eq!(events[0].debt_total, quantity - sliver);
    assert_eq!(fixture.session().await.fees_accrued, 1);

    // And it cannot spend collateral the session does not have: the remaining
    // debt marks well past the funded balance once the price runs.
    fixture
        .publish_base_price(100_000_000_000_000_000_000u128)
        .await;
    let repay =
        fixture.repay_base_from_collateral_call(fixture.base_asset, quantity - sliver);
    let error = fixture.call_account(vec![repay], 1).await.unwrap_err();
    assert!(
        error.to_string().contains("InsufficientBalance"),
        "collateral must bound the conversion: {error:#}"
    );
}

// ---------------------------------------------------------------------------
// RED TEAM: adversarial coverage for `repay_base_from_collateral`.
//
// Every test below was written to BREAK the new call, not to document it. The
// ones that fail are findings; the ones that pass are attacks the contract
// turned away and are kept as regression cover.
// ---------------------------------------------------------------------------

/// ACCEPTED BEHAVIOUR, exactly bounded. `repay_base_from_collateral` pays the
/// ORACLE ASK with NO haircut and carries no health gate, so the same
/// underwater short run twice - seized by a keeper, and escaped through the
/// conversion - pays the owner MORE on the escape. What he keeps is the
/// `liq_price_factor` provision a seizure would have collected, less the
/// conversion's own fee.
///
/// This is the design's chosen trade, not a finding: the escape hands the pool
/// a clean quote credit instead of a basket to unwind, and the ppm fee is the
/// whole price of that convenience. The test pins the giveaway to the exact
/// provision-minus-fee difference so a pricing regression on either side -
/// the conversion or the settlement - moves a number someone has to look at.
#[tokio::test]
async fn red_team_a_liquidatable_short_buys_a_par_exit_out_of_the_keepers_hands() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;

    // The same journey both times, and the session is underwater on the PRICE
    // rather than on fees - which is what keeps the par exit affordable.
    //
    // The two conditions pull against each other. Liquidatable means
    // `V = k + collateral + proceeds - debt < k + maintenance`; affordable
    // means `debt + fee <= collateral`, since the fee leaves the pool the
    // moment it is charged. Together they demand `proceeds < maintenance`, so
    // the short must be SMALL and the move against it LARGE: 100_000_000 base
    // sold at 2.0 for 200_000, then marked at 19.6 for a 1_960_000 debt
    // against 2_000_000 of collateral. `V` lands at 8_240_000, under the
    // tier's 8_250_000 threshold, and the 196 fee still fits.
    async fn underwater_short(escaped: bool) -> (SessionClosed, u64) {
        let mut fixture = PropFixture::new().await;
        let quantity = 100_000_000u64;

        fixture
            .rest_order(2_000_000, quantity, fixture.collateral_asset, 200_000)
            .await;
        let borrow = fixture.pool_call(
            fn_selector!(borrow(AssetId, u64)),
            0,
            AssetId::default(),
            Some(call_data!(fixture.base_asset, quantity)),
        );
        let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
        fixture
            .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
            .await
            .unwrap();

        fixture
            .publish_base_price(19_600_000_000_000_000_000u128)
            .await;

        assert_eq!(fixture.session_value().await, 8_240_000);
        assert!(
            fixture.is_liquidatable().await,
            "the keeper must already own this session or the test means nothing"
        );

        let parent_before = fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap();
        let closed = if escaped {
            let repay =
                fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
            fixture.call_account(vec![repay], 1).await.unwrap();
            // The escape does not even pretend to fix the session's health: it
            // is STILL under the liquidation line the instant before it closes
            // itself at par.
            assert!(
                fixture.is_liquidatable().await,
                "the par exit is taken by a session the keeper still owns"
            );
            fixture.closed_event(&fixture.close_session().await)
        } else {
            fixture.closed_event(&fixture.liquidate().await)
        };
        let parent_after = fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap();
        (closed, (parent_after - parent_before) as u64)
    }

    let (seized, seized_paid) = underwater_short(false).await;
    let (escaped, escaped_paid) = underwater_short(true).await;

    assert_eq!(seized.reason, SettlementReason::Liquidation);
    assert_eq!(escaped.reason, SettlementReason::UserClose);
    assert_eq!(seized.bad_debt, 0);
    assert_eq!(escaped.bad_debt, 0);

    // The escape pays the owner exactly the provision the seizure would have
    // collected, less the conversion fee. The debt marks at 1_960_000; a
    // seizure charges it widened to ceil(1_960_000 * 10_000 / 9_900)
    // = 1_979_798, the conversion charges the plain mark plus its 196 fee.
    let provision = 1_979_798u64 - 1_960_000;
    let fee = 196u64;
    assert_eq!(
        escaped_paid,
        seized_paid + provision - fee,
        "the conversion must sell the liquidation provision for its fee and \
         nothing else (seized event {seized:#?}, escaped event {escaped:#?})"
    );
}

/// ACCEPTED BEHAVIOUR, and the exact opposite of what the quote netting pins:
/// a base repay CAN lift a session out of the keeper's hands.
///
/// Closing a base debt removes that debt's `absorption_cost`, and the live
/// liquidation threshold is `k + max(absorption_cost, maintenance)`. Above the
/// maintenance floor the threshold therefore FALLS by roughly 101 bps of the
/// value repaid, while `V` falls only by the conversion's ppm fee - charged at
/// the PLAIN ask, the call gives up the neutrality the widened ask used to
/// buy, and a session just past the line steps back over it. Accepted for the
/// same reason the par exit is: the pool trades a basket it would have had to
/// unwind for a clean quote credit, so an owner de-risking his own session is
/// the outcome the pool wants, not an attack on it.
#[tokio::test]
async fn red_team_repay_base_from_collateral_unliquidates_a_session_the_keeper_owns() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    // A short big enough that the debt's own absorption cost, not the tier's
    // fixed 250_000 maintenance, is what sets the liquidation threshold.
    let quantity = 6_500_000_000u64;
    fixture.fund_collateral(11_260_000).await;
    fixture
        .rest_order(2_000_000, quantity, fixture.collateral_asset, 13_000_000)
        .await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    // The base doubles. The debt marks at 26_000_000 and its absorption cost
    // (262_627) overtakes the tier's maintenance floor.
    fixture
        .publish_base_price(4_000_000_000_000_000_000u128)
        .await;
    let before = fixture.lines().await;
    let threshold_before = before.threshold.as_u128() as u64;
    let value_before = fixture.session_value().await;
    assert!(
        fixture.is_liquidatable().await,
        "the keeper must already own this session or the test means nothing"
    );

    // 600_000 of collateral - 2.3% of the marked debt - and a 60 unit fee.
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, 150_000_000);
    let response = fixture.call_account(vec![repay], 1).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<BaseDebtRepaidFromCollateral>(
            &response.tx_status.receipts,
        )
        .unwrap();
    let value = events[0].value;
    let fee = events[0].fee;

    // The charge is the plain mark: 150_000_000 base at 4.0 is 600_000, and
    // the fee is 100 ppm of it.
    assert_eq!(value, 600_000);
    assert_eq!(fee, 60);

    let after = fixture.lines().await;
    let threshold_after = after.threshold.as_u128() as u64;
    let value_after = fixture.session_value().await;
    // The two sides of the escape, each pinned to its own arithmetic: `V`
    // falls by exactly the fee (the repay itself swaps 600_000 of collateral
    // for 600_000 of debt at the same plain mark), while the threshold gives
    // up the repaid slice's whole absorption provision. The provision outruns
    // the fee ~100:1, which is precisely what lets the session step back over
    // the line.
    assert_eq!(value_after, value_before - i128::from(fee));
    let released = threshold_before - threshold_after;
    assert!(
        released > fee,
        "the release must outrun the fee for the escape to exist: \
         released {released}, fee {fee}"
    );
    assert!(
        !fixture.is_liquidatable().await,
        "the plain-ask conversion de-risks the session past the line; value \
         {value}, fee {fee}, threshold {threshold_before} -> {threshold_after}"
    );

    // The keeper's exit is genuinely closed, on chain and not just in the
    // reader: the seizure reverts and the session lives on.
    let error = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .liquidate(fixture.child_id, vec![])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("NotLiquidatable"),
        "the keeper must be refused after the escape: {error:#}"
    );
    assert!(
        fixture
            .deployment
            .pool
            .methods()
            .has_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
}

/// An EXPIRED session must not be able to pick its own mark. `expire_session`
/// prices the SAME obligation at `liq_price_factor`, so leaving this call open
/// past the deadline would be a race between the owner and the keeper over who
/// gets to choose it - which is why this one carries `require_live` where its
/// value-neutral quote sibling does not.
///
/// The in-kind `repay` stays ungated, so a user holding the asset is never
/// trapped by the liveness gate.
#[tokio::test]
async fn red_team_an_expired_short_cannot_pick_its_own_mark() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    fixture.fund_collateral(4_000_000).await;
    fixture
        .rest_order(2_000_000, quantity, fixture.collateral_asset, 2_000_000)
        .await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    // Outlive the pool session with the account's own signing session, so the
    // clock below expires only the thing under test.
    let session = fixture.session().await;
    fixture
        .account
        .methods()
        .set_session(ParallelSessionArgs {
            nonce: U256::one(),
            session_id: Identity::Address(fixture.user.address()),
            expiry: Time {
                unix: session.expires_at + 86_400,
            },
            contract_ids: vec![],
        })
        .with_contract_ids(&[fixture.deployment.oracle_id])
        .call()
        .await
        .unwrap();

    let provider = fixture.outsider.try_provider().unwrap();
    let latest = provider
        .latest_block_time()
        .await
        .unwrap()
        .expect("local chain has a latest block time");
    let expired_time = latest
        .checked_add_signed(chrono::TimeDelta::seconds(
            (session.expires_at.saturating_sub(latest.timestamp() as u64) + 1) as i64,
        ))
        .expect("test expiry timestamp is representable");
    provider
        .produce_blocks(1, Some(expired_time))
        .await
        .unwrap();

    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    let error = fixture.call_account(vec![repay], 1).await.unwrap_err();
    assert!(
        error.to_string().contains("SessionEnded"),
        "an expired session must not choose the mark its keeper would have set: {error:#}"
    );

    // The keeper's exit is there, and it applies the forced haircut.
    expire_fixture_session(&fixture).await;
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
}

/// A wide oracle spread cannot be farmed. Both legs are
/// checked: a bare short, where the call must charge the same ASK the risk gate
/// already marks the debt at, so `V` moves by the fee alone; and a debt fully
/// offset by a holding of the same asset, where `portfolio_legs` nets the two to
/// zero but the call charges the ask anyway and leaves the survivor marked at
/// the BID - the user eats the spread and the pool keeps it.
#[tokio::test]
async fn red_team_a_wide_oracle_spread_is_charged_on_the_ask_and_cannot_be_farmed() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    fixture.fund_collateral(18_000_000).await;
    // Bid 2.0, ask 3.0 - a full point of spread, which `publish_base_price`
    // cannot express.
    fixture
        .deployment
        .price_feed
        .methods()
        .publish_prices(vec![PriceInput {
            asset: fixture.base_asset,
            bid: 2_000_000_000_000_000_000u128,
            ask: 3_000_000_000_000_000_000u128,
            timestamp: fixture.next_publish_time(),
        }])
        .call()
        .await
        .unwrap();

    // Leg one: a bare short. Borrow, sell at 2.0, repay from collateral.
    fixture
        .rest_order(2_000_000, quantity, fixture.collateral_asset, 2_000_000)
        .await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    let before = fixture.session_value().await;
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    let response = fixture.call_account(vec![repay], 1).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<BaseDebtRepaidFromCollateral>(
            &response.tx_status.receipts,
        )
        .unwrap();
    assert_eq!(
        events[0].ask,
        U256::from(3_000_000_000_000_000_000u64),
        "the sell side of the book is what a buy-back costs"
    );
    // 3_000_000 at the plain ask - the ASK is what a buy-back costs, and
    // with no widening the fee is the only charge over the mark.
    assert_eq!(
        events[0].value, 3_000_000,
        "priced at the ask, never the bid or a mid"
    );
    assert_eq!(events[0].fee, 300);
    // The gate marks this debt at the same plain ask the charge uses, so the
    // conversion is V-neutral except for the fee.
    assert_eq!(fixture.session_value().await, before - 300);

    // Leg two: a debt fully covered by a holding of the same asset. The gate
    // nets them to zero; the call still charges the ask and leaves the coins
    // marked at the bid.
    let before = fixture.session_value().await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    fixture.call_account(vec![borrow], 1).await.unwrap();
    assert_eq!(
        fixture.session_value().await,
        before,
        "a debt covered in kind is worth nothing to the gate either way"
    );
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    fixture.call_account(vec![repay], 1).await.unwrap();
    assert_eq!(
        fixture.session_value().await,
        before - (3_000_000 - 2_000_000) - 300,
        "the survivor is marked at the BID while the charge is the ASK, so the \
         user pays the whole spread plus the fee to convert a self-covered debt"
    );
}

/// Slicing a repayment cannot beat doing it once. Both the
/// quote value and the fee round UP per call, so N slices cost at least what one
/// call costs, and a dust slice pays a 100% fee rather than a free one.
#[tokio::test]
async fn red_team_slicing_a_base_repay_never_beats_doing_it_once() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;

    async fn short_then_repay(slices: u64) -> (u64, u64) {
        let mut fixture = PropFixture::new().await;
        let quantity = 1_000_000_000u64;
        fixture.fund_collateral(4_000_000).await;
        fixture
            .rest_order(2_000_000, quantity, fixture.collateral_asset, 2_000_000)
            .await;
        let borrow = fixture.pool_call(
            fn_selector!(borrow(AssetId, u64)),
            0,
            AssetId::default(),
            Some(call_data!(fixture.base_asset, quantity)),
        );
        let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
        fixture
            .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
            .await
            .unwrap();

        let before = fixture.session().await.collateral;
        let slice = quantity / slices;
        for index in 0..slices {
            let amount = if index + 1 == slices {
                quantity - slice * (slices - 1)
            } else {
                slice
            };
            let repay =
                fixture.repay_base_from_collateral_call(fixture.base_asset, amount);
            fixture.call_account(vec![repay], 1).await.unwrap();
        }
        let after = fixture.session().await;
        assert_eq!(fixture.debt(fixture.base_asset).await, 0);
        (before - after.collateral, after.fees_accrued)
    }

    let (one_value, one_fee) = short_then_repay(1).await;
    let (many_value, many_fee) = short_then_repay(7).await;
    // 2_000_000 at the plain ask; 100 ppm of that is 200.
    assert_eq!(one_value, 2_000_000);
    assert_eq!(one_fee, 200);
    assert!(
        many_value >= one_value && many_fee >= one_fee,
        "seven slices cost {many_value}/{many_fee} against {one_value}/{one_fee} for one"
    );

    // And dust is never free: one base unit is worth a fraction of a collateral
    // unit, and both the value and the fee round up to one.
    let mut fixture = PropFixture::new().await;
    let quantity = 1_000_000_000u64;
    fixture.fund_collateral(4_000_000).await;
    fixture
        .rest_order(2_000_000, quantity, fixture.collateral_asset, 2_000_000)
        .await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, 1);
    let response = fixture.call_account(vec![repay], 1).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<BaseDebtRepaidFromCollateral>(
            &response.tx_status.receipts,
        )
        .unwrap();
    // One base unit marks at 1 after the round-up.
    assert_eq!(events[0].value, 1);
    assert_eq!(events[0].fee, 1, "dust pays a whole unit, never zero");
}

/// BOUNDARY. `withdraw` calls the tier's entry ticket a STANDING
/// floor - "no withdrawal may leave the session funded below it" - and
/// `netting_cannot_walk_funded_collateral_below_the_tier_floor` is the attack
/// that made it unconditional. `repay_base_from_collateral` walks straight past
/// it: it is bounded by `value <= session.collateral` and by nothing else, so it
/// takes funded collateral to ZERO on a LIVE session, which then still draws its
/// whole 8_000_000 line with no posted margin behind it.
///
/// `withdraw` still holds the money in - that guard is genuinely unconditional -
/// but the floor itself is no longer standing.
#[tokio::test]
async fn the_tier_floor_bounds_withdrawals_not_conversions() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    // The session opens at exactly the tier's entry ticket, 2_000_000: 1e9
    // base marks at 2_000_000 and is CHARGED at exactly that plain mark.
    let quantity = 1_000_000_000u64;
    assert_eq!(fixture.session().await.collateral, COLLATERAL);

    // Borrow the base and keep it: 2_000_000 of value moves onto the account.
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    fixture.call_account(vec![borrow], 1).await.unwrap();

    // Pay the debt off out of collateral. The tier FLOOR still does not bound
    // this - only the fee does: the 1 bp charged on the closed debt is money
    // leaving for the platform, so the collateral must cover it as well as the
    // principal.
    let base_repay_fee = 200u64;
    fixture.fund_collateral(base_repay_fee).await;
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    fixture.call_account(vec![repay], 1).await.unwrap();
    let after = fixture.session().await;
    // Everything the floor would have protected is gone - the conversion took
    // the collateral to exactly the fees it owes, far below the tier floor.
    // Everything the floor would have protected is gone: the conversion took
    // the collateral down to exactly the fee it owes, far below the tier
    // floor. What it cannot do is take it BELOW that and leave the platform
    // paid out of the pool's own inventory.
    assert_eq!(after.fees_accrued, base_repay_fee);
    assert_eq!(after.collateral, base_repay_fee);
    assert_eq!(after.credit_line, LINE - LINE / 5);
    assert!(
        fixture
            .deployment
            .pool
            .methods()
            .has_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        "and the session is still live"
    );

    // `withdraw` does hold - its floor guard is phrased on the collateral and
    // fires unconditionally, so the value cannot actually leave this way.
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let error = fixture.call_account(vec![withdraw], 2).await.unwrap_err();
    assert!(
        error.to_string().contains("BelowTierCollateral"),
        "the withdrawal floor must still hold: {error:#}"
    );

    // The session can re-lever against the bare `k` the tier grants for nothing.
    let draw = fixture.draw_call(after.credit_line);
    fixture.call_account(vec![draw], 1).await.unwrap();
    let drawn = fixture.session().await;
    assert_eq!(drawn.drawn_quote, LINE - LINE / 5);
    // The fee it still owes is all that is left of the collateral.
    assert_eq!(drawn.collateral, base_repay_fee);

    // And that is where the pool's protection actually lives. The floor guards
    // value LEAVING - it fired above - not value CONVERTING, exactly as
    // `repay_from_collateral` may net a draw against the last unit of
    // collateral. Flooring the conversion would trap the distressed short this
    // call exists to release. What bounds the risk is the liquidation gate, and
    // it is intact: the moment the position turns, the keeper takes it.
    fixture.publish_base_price(10_000_000_000_000_000u128).await;
    assert!(
        fixture.is_liquidatable().await,
        "a session running on the pool's own capital must be seizable the instant \
         its equity goes"
    );
    let closed = fixture.closed_event(&fixture.liquidate().await);
    assert_eq!(closed.reason, SettlementReason::Liquidation);
}

/// The remaining guards. The pause the call inherits really
/// bites, an asset that was never borrowed has no debt row to close, and the
/// in-kind `repay` really is the ungated escape the pause comment promises.
#[tokio::test]
async fn red_team_the_base_repay_guards_hold_under_a_pause_and_an_unknown_asset() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    fixture.call_account(vec![borrow], 1).await.unwrap();

    // An asset that is not in the tier and was never borrowed has no debt.
    let stranger = AssetId::new([0x77; 32]);
    let repay = fixture.repay_base_from_collateral_call(stranger, 1);
    let error = fixture.call_account(vec![repay], 1).await.unwrap_err();
    assert!(
        error.to_string().contains("OverRepay"),
        "an unborrowed asset has nothing to close: {error:#}"
    );

    fixture
        .deployment
        .pool
        .methods()
        .pause()
        .call()
        .await
        .unwrap();
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    let error = fixture.call_account(vec![repay], 1).await.unwrap_err();
    assert!(
        error.to_string().contains("Paused"),
        "the marked repay must stop with every other marked operation: {error:#}"
    );

    // The promised escape hatch: in-kind `repay` is ungated, so a user holding
    // the asset is never trapped by the pause.
    let repay_in_kind =
        fixture.pool_call(fn_selector!(repay()), quantity, fixture.base_asset, None);
    fixture.call_account(vec![repay_in_kind], 0).await.unwrap();
    assert_eq!(fixture.debt(fixture.base_asset).await, 0);
}

// ---------------------------------------------------------------------------
// AUDIT: independent review of `repay_base_from_collateral`.
// ---------------------------------------------------------------------------

/// AUDIT - FINDING. `repay_from_collateral` justifies skipping the loan-cap
/// re-check in so many words: "the line falls by at most `amount` while the
/// draw falls by exactly `amount`, so a session inside its cap stays inside
/// it." The in-kind sibling inherits the omission but not the argument.
///
/// `require_loan_cap` prices an in-kind debt at the PLAIN ask (`mark`). This
/// call charges that same mark plus a convenience fee and reprices the line
/// off the reduced collateral. So the measured exposure falls by `mark` while
/// the line falls by `mark + fee` - and the cap slack shrinks by the FEE on
/// every call, with nothing left to notice. A session sitting exactly on its
/// line is left OVER it.
#[tokio::test]
async fn audit_base_repay_leaves_the_session_over_its_loan_cap() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    // 5e8 base marks at 1_000_000 on the plain ask of 2.0 - the exact number
    // `require_loan_cap` adds - so a 9_000_000 draw sits the session on the
    // last unit of its 10_000_000 line.
    let quantity = 500_000_000u64;
    let mark = 1_000_000u64;
    let drawn = 9_000_000u64;

    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    fixture.call_account(vec![borrow], 1).await.unwrap();
    let draw = fixture.draw_call(drawn);
    fixture.call_account(vec![draw], 1).await.unwrap();

    let before = fixture.session().await;
    assert_eq!(before.collateral, COLLATERAL);
    assert_eq!(before.credit_line, LINE);
    assert_eq!(before.drawn_quote, drawn);
    // Exactly at the cap: the pool refuses one more unit of exposure.
    let over = fixture.draw_call(1);
    let error = fixture.call_account(vec![over], 1).await.unwrap_err();
    assert!(
        error.to_string().contains("LoanCapExceeded"),
        "the session must start ON its cap for this test to mean anything: {error:#}"
    );

    // Close the whole in-kind debt out of collateral.
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    let response = fixture.call_account(vec![repay], 1).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<BaseDebtRepaidFromCollateral>(
            &response.tx_status.receipts,
        )
        .unwrap();
    let value = events[0].value;
    let fee = events[0].fee;
    assert_eq!(value, 1_000_000, "the plain mark, no widening");
    assert_eq!(fee, 100, "100 ppm of 1_000_000");

    let after = fixture.session().await;
    assert_eq!(after.collateral, COLLATERAL - value);
    assert_eq!(after.drawn_quote, drawn, "the draw is untouched");
    assert_eq!(fixture.debt(fixture.base_asset).await, 0);

    // The exposure the cap measures is now the draw alone, and the line no
    // longer covers it.
    // collateral 2_000_000 -> 1_000_000, fees_accrued 100: drawn_quote
    // 9_000_000 against a credit_line of 8_999_900, a standing breach of
    // exactly the fee.
    assert!(
        after.drawn_quote > after.credit_line,
        "the loan cap must still hold after a repayment: drawn {} against a line of {}",
        after.drawn_quote,
        after.credit_line
    );
    assert_eq!(
        after.drawn_quote - after.credit_line,
        (value - mark) + fee,
        "the breach is exactly the fee the line gave up and the cap's \
         plain-ask measure never saw"
    );

    // It is a state the session simply sits in: healthy on the gate, refused by
    // every writer that re-checks, and corrected by nobody.
    assert!(
        !fixture.is_liquidatable().await,
        "the over-cap session is not seizable, so the breach persists"
    );
    let draw = fixture.draw_call(1);
    let error = fixture.call_account(vec![draw], 1).await.unwrap_err();
    assert!(error.to_string().contains("LoanCapExceeded"), "{error:#}");
}

/// AUDIT - CLEAN. The `decapitalised` memo this call writes is denominated in
/// quote and consumed by `withdraw`'s COLLATERAL_ASSET leg - a consumer whose
/// stated justification ("principal the netting parked on the account") is not
/// what happened here: the collateral went to extinguish an ASSET debt and
/// nothing was parked anywhere. Run the whole session and count.
///
/// It reconciles to the unit. The memo is not a claim about where the coins
/// went, it is a fixed correction to the settlement profit measure, and
/// `withdraw` removes exactly as much future measured profit as it exempts.
/// Spending it early is arithmetically the same as spending it at close.
#[tokio::test]
async fn audit_base_repay_memo_taxes_exactly_the_realised_gain_through_withdraw() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    let sale = 2_000_000u64;
    // Outside money, so none of the collateral is share-bearing `capitalised`
    // and the profit share below has exactly one thing to measure.
    fixture.fund_collateral(8_000_000).await;
    let funded = COLLATERAL + 8_000_000;
    assert_eq!(fixture.session().await.collateral, funded);

    // Short: borrow the base and sell it at 2.0.
    fixture
        .rest_order(2_000_000, quantity, fixture.collateral_asset, sale)
        .await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    assert_eq!(
        fixture.account_balance(fixture.collateral_asset).await,
        sale
    );

    // The base halves, so the short is in the money and the conversion is
    // cheap. Close it from collateral rather than buying the base back.
    fixture
        .publish_base_price(1_000_000_000_000_000_000u128)
        .await;
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    let response = fixture.call_account(vec![repay], 1).await.unwrap();
    let repaid = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<BaseDebtRepaidFromCollateral>(
            &response.tx_status.receipts,
        )
        .unwrap();
    let value = repaid[0].value;
    let fee = repaid[0].fee;
    assert_eq!(value, 1_000_000);
    assert_eq!(fee, 100);
    assert_eq!(repaid[0].decapitalised_total, value);
    assert_eq!(fixture.session().await.decapitalised, value);
    // What he actually made: the sale raised `sale`, closing cost `value`.
    let realised = sale - value;

    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();

    // Take the whole account balance out while the memo is still live. This is
    // the leg that exempts `from_account` up to the memo.
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, sale)),
    );
    let response = fixture.call_account(vec![withdraw], 4).await.unwrap();
    let withdrawn = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<MarginWithdrawn>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(withdrawn.len(), 1);
    // `fees_accrued` is reserved on the account leg and paid from the pool leg.
    assert_eq!(withdrawn[0].from_account, sale - fee);
    assert_eq!(withdrawn[0].from_pool, fee);
    // 10% of what the memo did NOT exempt.
    assert_eq!(withdrawn[0].share_qty, (sale - fee - value).div_ceil(10));
    // And the withdrawal SPENT the memo. It was paid out here, so settlement
    // must find nothing left to subtract - the correction is applied once
    // whichever call gets to the principal first.
    assert_eq!(fixture.session().await.decapitalised, 0);

    let closed = fixture.closed_event(&fixture.close_session().await);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.bad_debt, 0);
    // Three collection points now, not two: the share taken at the withdrawal,
    // the share taken at the close, and `fees_accrued` - the conversion fee,
    // which left at the repayment call rather than waiting for settlement.
    // Summing all three is what keeps this a statement about the platform's
    // TAKE rather than about the closing event.
    assert_eq!(closed.fees_accrued, fee);
    let platform_total =
        withdrawn[0].share_qty + closed.platform_total + closed.fees_accrued;
    let parent_gain = (fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap()
        - parent_before) as u64;

    // Nothing created, nothing destroyed.
    assert_eq!(
        parent_gain + platform_total,
        funded + realised,
        "parent {parent_gain} + platform {platform_total} must be the {funded} funded \
         plus the {realised} realised"
    );
    // And the platform's whole take is the share on the REALISED gain plus the
    // conversion fee. The memo neither over- nor under-exempts: the only slack
    // is one unit of ceiling, in the platform's favour.
    // funded 10_000_000, value 1_000_000, fee 100, realised 1_000_000: the
    // share collects at the withdrawal and the close, the fee at the
    // repayment. Paying the fee early moved it out of the closing column and
    // into the repayment column; the total did not move.
    let expected = realised.div_ceil(10) + fee;
    assert!(
        platform_total >= expected && platform_total <= expected + 2,
        "platform took {platform_total} against {expected} = 10% of the {realised} \
         realised plus the {fee} fee (withdraw {}, close {}, repayment {})",
        withdrawn[0].share_qty,
        closed.platform_total,
        closed.fees_accrued
    );
}

/// AUDIT - CLEAN. The uncovered health shape: a debt PARTLY covered in kind, so
/// closing it flips the asset leg from the negative side to the positive one.
/// The keeper's gap must not improve across that flip either - the call
/// charges the ASK while the survivor is only ever marked at the BID, so `V`
/// drops by the spread and the fee while the threshold (pinned to the
/// maintenance floor here) does not move at all.
#[tokio::test]
async fn audit_base_repay_never_narrows_the_gap_when_the_asset_leg_flips_sides() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;

    let quantity = 1_000_000_000u64;
    let sold = 500_000_000u64;
    fixture.fund_collateral(4_000_000).await;

    // Borrow 1e9 and sell HALF: net short 5e8, with 5e8 still held.
    fixture
        .rest_order(2_000_000, sold, fixture.collateral_asset, 1_000_000)
        .await;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    let sell = fixture.book_call(2_000_000, sold, fixture.base_asset, sold);
    fixture
        .call_account(vec![borrow, sell, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    assert_eq!(fixture.debt(fixture.base_asset).await, quantity);
    assert_eq!(fixture.account_balance(fixture.base_asset).await, sold);

    let before = fixture.lines().await;
    let before_v = fixture.session_value().await;
    let before_gap = before_v - i128::try_from(before.threshold.as_u128()).unwrap();
    assert_eq!(before_v, 14_000_000);

    // Close the WHOLE debt from collateral. The leg it was on turns into a
    // 5e8 holding.
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    let response = fixture.call_account(vec![repay], 1).await.unwrap();
    let events = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<BaseDebtRepaidFromCollateral>(
            &response.tx_status.receipts,
        )
        .unwrap();
    assert_eq!(events[0].value, 2_000_000, "the WHOLE 1e9 at the plain ask");
    assert_eq!(events[0].fee, 200);
    assert_eq!(fixture.debt(fixture.base_asset).await, 0);

    let after = fixture.lines().await;
    let after_v = fixture.session_value().await;
    let after_gap = after_v - i128::try_from(after.threshold.as_u128()).unwrap();
    assert!(
        after_v < before_v,
        "V must fall across the flip: {before_v} -> {after_v}"
    );
    assert!(
        after_gap < before_gap,
        "the gap to the liquidation line must never widen: {before_gap} -> {after_gap}"
    );
    assert_eq!(
        before_gap - after_gap,
        i128::from((events[0].value - 2_000_000) + events[0].fee),
        "the gap gives up exactly the fee - the charge equals the plain mark and \
         the bid/ask spread is zero here, so nothing else is charged"
    );
}

/// A PLAIN registry upgrade — one that knows nothing about margin — must
/// not drop the registry's prop wiring.
///
/// This is the devnet outage, reduced: `deploy_trade_account_registry`
/// rebuilds the registry's implementation blob from a fresh deploy config,
/// and every configurable that config does not repeat reverts to its
/// default. The five `PROP_*` values default to ZERO, so the upgrade
/// leaves `prop_register_contract` CALLing address zero and every margin
/// registration reverts with `ContractNotFound`. Only the margin SYSTEM
/// phase writes those values back, and the ordinary steady state skips it.
///
/// The `default()` half is the point of the test: it pins the bug, so a
/// `live_prop_config` that quietly stopped preserving anything could not
/// pass by asserting a value it never had to restore.
#[tokio::test]
async fn a_plain_registry_upgrade_keeps_the_prop_wiring() {
    use crate::trade_account_registry::{
        TradeAccountRegistryConfigurables,
        TradeAccountRegistryDeployConfig,
        TradeAccountRegistryManager,
    };

    let fixture = PropFixture::new().await;
    let registry = TradeAccountRegistryManager::new(
        fixture.deployer.clone(),
        fixture.deployment.registry_id,
    );
    let oracle_id = fixture.deployment.oracle_id;

    let wiring = async |registry: &TradeAccountRegistryManager<Wallet>| {
        let oracle = registry
            .registry
            .methods()
            .get_prop_oracle_id()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value;
        let account_proxy = registry
            .registry
            .methods()
            .default_prop_bytecode()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value;
        (oracle, account_proxy)
    };

    // The fixture's registry is margin-wired: that is the state an
    // upgrade has to carry across.
    let (live_oracle, live_account_proxy) = wiring(&registry).await;
    assert_eq!(live_oracle, oracle_id);
    assert_ne!(live_account_proxy, ContractId::zeroed());

    // Captured BEFORE the upgrade, exactly as the deploy does it — the
    // values are read off the chain, so a caller that reads them after
    // clobbering them would read zeros back.
    let preserved = registry
        .live_prop_config(TradeAccountRegistryConfigurables::default())
        .await
        .unwrap();

    // THE FIX: a plain upgrade that threads the live wiring through.
    registry
        .upgrade(
            ContractId::zeroed(),
            ContractId::zeroed(),
            &TradeAccountRegistryDeployConfig {
                registry_config: preserved,
                ..Default::default()
            },
        )
        .await
        .unwrap();
    let (oracle_after_fix, proxy_after_fix) = wiring(&registry).await;
    assert_eq!(
        oracle_after_fix, oracle_id,
        "the upgrade must preserve PROP_ACCOUNT_ORACLE_CONTRACT_ID"
    );
    assert_eq!(
        proxy_after_fix, live_account_proxy,
        "the upgrade must preserve DEFAULT_PROP_ACCOUNT_PROXY"
    );

    // THE BUG: the same upgrade built from a bare default config. Zeroed
    // wiring is what made every devnet registration revert.
    registry
        .upgrade(
            ContractId::zeroed(),
            ContractId::zeroed(),
            &TradeAccountRegistryDeployConfig::default(),
        )
        .await
        .unwrap();
    let (oracle_after_bug, proxy_after_bug) = wiring(&registry).await;
    assert_eq!(
        oracle_after_bug,
        ContractId::zeroed(),
        "a default-config upgrade zeroes the oracle - the regression this guards"
    );
    assert_eq!(proxy_after_bug, ContractId::zeroed());

    // And the repair is idempotent from a zeroed registry: nothing is
    // left to read, so the caller must supply the values again — which is
    // precisely why the margin system phase, not the plain upgrade, owns
    // them.
    let carried: Configurables = registry
        .live_prop_config(TradeAccountRegistryConfigurables::default())
        .await
        .unwrap()
        .into();
    assert!(
        carried.offsets_with_data.is_empty(),
        "a zeroed registry has no wiring to carry, and must not invent any"
    );
}

/// A pool's ADDRESS must survive a change to the pool, or an "upgrade"
/// silently FORKS the pool and orphans the funded one.
///
/// The proxy is seeded with a bootstrap blob so its address does not
/// depend on the implementation's CONFIGURABLES — but the bootstrap id is
/// itself a hash of the pool BYTECODE, so anything that moves the
/// derivation moves the pool. That is how devnet ended up with a second,
/// empty pool while the funded one kept every session.
///
/// `salt` stands in for the bytecode here: it is the other input to the
/// same derivation, and unlike the bytecode it can be perturbed without
/// rebuilding contracts. The first half proves the derivation really does
/// move; the second proves `existing_pool` overrides it.
#[tokio::test]
async fn a_pinned_pool_survives_a_derivation_change() {
    let fixture = PropFixture::new().await;
    let funded_pool = fixture.deployment.pool_id;

    // A different derivation input, standing in for a release that
    // changes the pool's bytecode.
    let mut moved = PropDeployConfig::new(fixture.collateral_asset);
    moved.salt = Salt::new([0x5a; 32]);

    // THE BUG, enacted rather than predicted: unpinned, the same system
    // deploys a DIFFERENT pool, leaving `funded_pool` orphaned.
    let derived = PropDeployment::deploy(&fixture.deployer, &moved)
        .await
        .unwrap();
    assert_ne!(
        derived.pool_id, funded_pool,
        "the derivation must actually move, or this test proves nothing"
    );

    // THE FIX: pinned, the same moved derivation resolves the pool that
    // already exists instead of forking again.
    moved.existing_pool = Some(funded_pool);
    let deployed = PropDeployment::deploy(&fixture.deployer, &moved)
        .await
        .unwrap();
    assert_eq!(
        deployed.pool_id, funded_pool,
        "a pinned pool must win over the derivation in the real run"
    );

    // Not merely the same id: the SAME pool, still carrying the fixture's
    // session. A fork would hand back a pristine one.
    let session = PropMarginPoolContract::new(deployed.pool_id, fixture.deployer.clone())
        .methods()
        .get_session(fixture.child_id)
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert!(
        session.is_some(),
        "the pinned pool must be the funded one, not a fresh deployment"
    );
}

/// `FeesNotCovered` cannot fire. It is dead, and this pins why.
///
/// The two gates `withdraw` runs, in order, are
///
///   collateral - from_pool - fees_accrued >= required_collateral   (floor)
///   collateral - from_pool                >= fees_accrued          (fees)
///
/// and `validate_tier` proves `required_collateral != 0`. So clearing the
/// floor already means `collateral - from_pool >= required_collateral +
/// fees_accrued`, which is STRICTLY greater than `fees_accrued` — the
/// second gate can never see a value the first did not already pass. That
/// was not true before the floor was measured net of fees; it is now.
///
/// The test drives the state that would once have tripped the fee gate —
/// fees large against collateral, and a withdrawal that would leave the
/// session funded below them — and shows the FLOOR refuses it first, at a
/// far smaller amount than the fee gate would ever have bitten at.
#[tokio::test]
async fn the_fee_cover_gate_is_unreachable_behind_the_net_floor() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let floor = LINE / 5; // required_collateral, the tier's entry ticket

    // Headroom to withdraw from, then fees worth a meaningful slice of it:
    // 100 days at the tier's 6_000 Day price.
    fixture.fund_collateral(1_000_000).await;
    // ONE variable output: the prolongation fee is transferred to the
    // platform payout inside the call.
    fixture
        .call_account(vec![fixture.prolong_call(100)], 1)
        .await
        .unwrap();

    let session = fixture.session().await;
    let collateral = session.collateral;
    let fees = session.fees_accrued;
    assert_eq!(collateral, COLLATERAL + 1_000_000);
    assert_eq!(fees, 600_000, "100 days at the Day price");

    // What each gate would bound the withdrawal at:
    //   floor: collateral - fees - required_collateral
    //   fees : collateral - fees            (far larger)
    let floor_allows = collateral - fees - floor;
    let fees_would_allow = collateral - fees;
    assert!(
        floor_allows < fees_would_allow,
        "the floor must bind first: {floor_allows} vs {fees_would_allow}"
    );

    // One unit past the FLOOR is refused by the floor — not by the fee
    // gate, which is still nowhere near.
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, floor_allows + 1)),
    );
    let error = fixture.call_account(vec![withdraw], 2).await.unwrap_err();
    let rendered = error.to_string();
    assert!(
        rendered.contains("BelowTierCollateral"),
        "the net floor is what binds: {error:#}"
    );
    assert!(
        !rendered.contains("FeesNotCovered"),
        "the fee gate must be unreachable: {error:#}"
    );

    // And exactly the floor's allowance passes, leaving the session funded
    // at the ticket with every fee still covered many times over.
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, floor_allows)),
    );
    fixture.call_account(vec![withdraw], 2).await.unwrap();
    let after = fixture.session().await;
    assert_eq!(after.collateral, collateral - floor_allows);
    assert_eq!(after.collateral - after.fees_accrued, floor);
}

/// A REDEPLOY moves the account implementation every margin account runs.
///
/// `INITIAL_PROP_ACCOUNT_IMPL` reaches storage only through the oracle's
/// one-time `initialize`, and a redeploy skips that branch — so baking a
/// fresh `account_blob_id` into the oracle's configurables and retargeting
/// its proxy, both of which the deploy does and both of which SUCCEED,
/// still left `get_prop_account_impl` answering with the previous blob.
/// Every account kept running the old bytecode while the deploy reported a
/// clean upgrade. This is the same defect the cosigner was given an
/// explicit reconcile for, and the price feed was given `set_price_feed`
/// for; the account implementation was the one left behind.
///
/// The drift is staged by pointing the oracle at a DIFFERENT real blob
/// (`validate_blob` asks only that the blob exists, so the pool's own
/// serves) rather than by perturbing the account bytecode, which has no
/// configurables to move. What the test proves is the reconcile: the
/// deploy must put the pointer back where the run's own artifacts say it
/// belongs, not leave whatever it finds.
#[tokio::test]
async fn a_redeploy_reconciles_the_account_implementation_on_the_oracle() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let fixture = PropFixture::new().await;
    let oracle = &fixture.deployment.oracle;
    let correct = ContractId::from(fixture.deployment.account_blob_id);

    assert_eq!(
        oracle
            .methods()
            .get_prop_account_impl()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(correct),
        "the first deploy initializes the pointer"
    );

    // Drift: some other real blob, as a stale implementation would be.
    let stale = ContractId::from(fixture.deployment.pool_blob_id);
    assert_ne!(stale, correct, "the stand-in must actually differ");
    oracle
        .methods()
        .set_prop_account_impl(stale)
        .call()
        .await
        .unwrap();

    // The same system, deployed again — the oracle already exists, so the
    // `initialize` branch is skipped and only an explicit reconcile can
    // move the pointer back.
    let mut config = PropDeployConfig::new(fixture.collateral_asset);
    config.max_offchain_age_seconds = Some(TEST_MAX_OFFCHAIN_AGE_SECONDS);
    let again = PropDeployment::deploy(&fixture.deployer, &config)
        .await
        .unwrap();
    assert_eq!(
        again.oracle_id, fixture.deployment.oracle_id,
        "the redeploy must resolve the SAME oracle, or this proves nothing"
    );

    assert_eq!(
        oracle
            .methods()
            .get_prop_account_impl()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(correct),
        "the redeploy must put the account implementation back"
    );
}

#[tokio::test]
async fn admin_controls_user_discounts() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let fixture = PropFixture::new().await;
    let user = Identity::Address(fixture.user.address());
    let raw = |tier_id: Option<u64>| {
        let pool = fixture.deployment.pool.clone();
        async move {
            pool.methods()
                .get_user_discount(user, tier_id)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        }
    };
    let resolved = |tier_id: u64| {
        let pool = fixture.deployment.pool.clone();
        async move {
            pool.methods()
                .resolve_user_discount(user, tier_id)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        }
    };

    // No grant in either slot: the user pays list price everywhere.
    assert_eq!(raw(None).await, None);
    assert_eq!(raw(Some(TIER_ID)).await, None);
    assert_eq!(resolved(TIER_ID).await, None);

    let wide = UserDiscount {
        discount_bps: 2_500,
        scope: DiscountScope::FirstPremium,
    };
    let tier_override = UserDiscount {
        discount_bps: 7_500,
        scope: DiscountScope::AllPremiums,
    };

    // Pricing favours is its OWN role, not a power of office: even the
    // ADMIN is refused until the role is granted.
    assert!(
        fixture
            .deployment
            .pool
            .methods()
            .set_user_discount(user, None, Some(wide.clone()))
            .call()
            .await
            .is_err()
    );

    // And the role's door is the admin's alone: a stranger cannot let
    // himself in.
    let manager = Identity::Address(fixture.outsider.address());
    let manager_pool = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone());
    assert!(
        manager_pool
            .methods()
            .grant_role(DISCOUNT_MANAGER_ROLE, manager)
            .call()
            .await
            .is_err()
    );
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(DISCOUNT_MANAGER_ROLE, manager)
        .call()
        .await
        .unwrap();
    assert!(
        fixture
            .deployment
            .pool
            .methods()
            .has_role(DISCOUNT_MANAGER_ROLE, manager)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );

    // More than everything cannot be forgiven, in either slot.
    for slot in [None, Some(TIER_ID)] {
        assert!(
            manager_pool
                .methods()
                .set_user_discount(
                    user,
                    slot,
                    Some(UserDiscount {
                        discount_bps: 10_001,
                        scope: DiscountScope::AllPremiums,
                    }),
                )
                .call()
                .await
                .is_err()
        );
    }

    // The user-wide grant lands in its slot and resolves for every tier.
    let response = manager_pool
        .methods()
        .set_user_discount(user, None, Some(wide.clone()))
        .call()
        .await
        .unwrap();
    let events = response
        .decode_logs_with_type::<UserDiscountChanged>()
        .unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].user, user);
    assert_eq!(events[0].tier_id, None);
    assert_eq!(events[0].discount, Some(wide.clone()));
    assert!(events[0].timestamp.unix != 0);
    assert_eq!(raw(None).await, Some(wide.clone()));
    assert_eq!(raw(Some(TIER_ID)).await, None);
    assert_eq!(resolved(TIER_ID).await, Some(wide.clone()));
    assert_eq!(resolved(TIER_ID + 1).await, Some(wide.clone()));

    // A tier override shadows the wide grant WHOLE - rate and scope - for
    // its tier alone, and leaves the wide slot untouched.
    let response = manager_pool
        .methods()
        .set_user_discount(user, Some(TIER_ID), Some(tier_override.clone()))
        .call()
        .await
        .unwrap();
    let events = response
        .decode_logs_with_type::<UserDiscountChanged>()
        .unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].tier_id, Some(TIER_ID));
    assert_eq!(events[0].discount, Some(tier_override.clone()));
    assert_eq!(raw(None).await, Some(wide.clone()));
    assert_eq!(raw(Some(TIER_ID)).await, Some(tier_override.clone()));
    assert_eq!(resolved(TIER_ID).await, Some(tier_override.clone()));
    assert_eq!(resolved(TIER_ID + 1).await, Some(wide.clone()));

    // Clearing the override uncovers the wide grant again...
    let response = manager_pool
        .methods()
        .set_user_discount(user, Some(TIER_ID), None)
        .call()
        .await
        .unwrap();
    let events = response
        .decode_logs_with_type::<UserDiscountChanged>()
        .unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].tier_id, Some(TIER_ID));
    assert_eq!(events[0].discount, None);
    assert_eq!(raw(Some(TIER_ID)).await, None);
    assert_eq!(resolved(TIER_ID).await, Some(wide.clone()));

    // ...and clearing the wide grant leaves list price everywhere.
    let response = manager_pool
        .methods()
        .set_user_discount(user, None, None)
        .call()
        .await
        .unwrap();
    let events = response
        .decode_logs_with_type::<UserDiscountChanged>()
        .unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].tier_id, None);
    assert_eq!(events[0].discount, None);
    assert_eq!(raw(None).await, None);
    assert_eq!(resolved(TIER_ID).await, None);

    // Revocation closes the door as fast as the grant opened it.
    fixture
        .deployment
        .pool
        .methods()
        .revoke_role(DISCOUNT_MANAGER_ROLE, manager)
        .call()
        .await
        .unwrap();
    assert!(
        manager_pool
            .methods()
            .set_user_discount(user, None, Some(wide))
            .call()
            .await
            .is_err()
    );
}

/// A `FirstPremium` grant prices the door and nothing else: the entry premium
/// is discounted and ROUNDED DOWN, while a later prolongation by the same
/// user pays list price.
#[tokio::test]
async fn a_discounted_entry_pays_the_rounded_down_premium() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let parent = Identity::Address(fixture.user.address());
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(
            DISCOUNT_MANAGER_ROLE,
            Identity::Address(fixture.deployer.address()),
        )
        .call()
        .await
        .unwrap();

    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            parent,
            None,
            Some(UserDiscount {
                discount_bps: 2_500,
                scope: DiscountScope::FirstPremium,
            }),
        )
        .call()
        .await
        .unwrap();

    // An entry fee chosen so a quarter off does not divide evenly:
    // 100_001 * 7_500 / 10_000 = 75_000.75, and the user pays 75_000.
    let open_fee = 100_001u64;
    let tier_params = TierParams {
        line: LINE,
        leverage: 5,
        duration: 64_800,
        maintenance_bps: 250,
        open_buffer_bps: 375,
        liq_price_factor: 9_900,
        prolong_fee: [0, 6_000, 76_000, 738_000],
        max_credit_line_bps: 20_000,
        max_price_age: u64::MAX,
        open_fee,
        profit_share_bps: 1_000,
        price_band_bps: 1_000,
    };
    fixture
        .deployment
        .pool
        .methods()
        .publish_tier_version(TIER_ID, tier_params, vec![fixture.order_book.contract_id])
        .with_contract_ids(&[
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .call()
        .await
        .unwrap();

    let child = fixture
        .deployment
        .deploy_account(&fixture.user, parent, 1)
        .await
        .unwrap();
    let account = PropAccountContract::new(child.contract_id(), fixture.user.clone());
    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let opened_response = account
        .methods()
        .start_session(TIER_ID, COLLATERAL, ProlongPeriod::SixHours)
        .call_params(CallParameters::new(
            COLLATERAL,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            fixture.deployment.pool_id,
            fixture.deployment.registry_id,
        ])
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap();
    let opened = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<SessionOpened>(&opened_response.tx_status.receipts)
        .unwrap();
    assert_eq!(opened.len(), 1);
    assert_eq!(opened[0].open_fee, 75_000);
    assert_eq!(opened[0].fees_accrued, 75_000);
    // The platform was paid the DISCOUNTED figure, and the line prices off
    // the collateral net of it: `k` (8_000_000) + 2_000_000 - 75_000.
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        platform_before + 75_000
    );
    assert_eq!(opened[0].credit_line, 9_925_000);

    // The same user prolongs the FIXTURE session: the grant stops at the
    // door, so the Day fee is the tier's own 6_000, `times` over.
    let prolong = fixture.prolong_call(3);
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let prolonged = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 18_000);
}

/// An `AllPremiums` grant reaches prolongation, comes off the whole bill
/// AFTER the `times` multiply, and rounds the fee DOWN. At `10_000` bps the
/// covered premiums are simply free - the period stays offered, because
/// `PeriodNotOffered` judges the tier's list price rather than the user's.
#[tokio::test]
async fn an_all_premiums_discount_prices_prolongation_rounded_down() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let parent = Identity::Address(fixture.user.address());
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(
            DISCOUNT_MANAGER_ROLE,
            Identity::Address(fixture.deployer.address()),
        )
        .call()
        .await
        .unwrap();

    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            parent,
            None,
            Some(UserDiscount {
                discount_bps: 3_333,
                scope: DiscountScope::AllPremiums,
            }),
        )
        .call()
        .await
        .unwrap();

    // Three Days list at 18_000; 18_000 * 6_667 / 10_000 = 12_000.6, so the
    // user pays 12_000 - one round-down on the whole bill, not one per term.
    let times = 3u64;
    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let pool_before = fixture.pool_balance(fixture.collateral_asset).await;
    let before = fixture.session().await;
    let prolong = fixture.prolong_call(times);
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let prolonged = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 12_000);
    assert_eq!(prolonged[0].fees_accrued, 12_000);
    // The discount changes the price of time, never the amount of it.
    assert_eq!(prolonged[0].seconds, 86_400 * times);
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        platform_before + 12_000
    );
    assert_eq!(
        fixture.pool_balance(fixture.collateral_asset).await,
        pool_before - 12_000
    );
    let after = fixture.session().await;
    assert_eq!(after.expires_at, before.expires_at + 86_400 * times);
    assert_eq!(after.fees_accrued, 12_000);

    // Total forgiveness: the same period, free of charge.
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            parent,
            None,
            Some(UserDiscount {
                discount_bps: 10_000,
                scope: DiscountScope::AllPremiums,
            }),
        )
        .call()
        .await
        .unwrap();
    let prolong = fixture.prolong_call(1);
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let prolonged = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 0);
    assert_eq!(prolonged[0].fees_accrued, 12_000);
}

/// A grant pinned to a tier prices that tier alone: on any other tier the
/// same user pays list price.
#[tokio::test]
async fn a_tier_scoped_discount_ignores_other_tiers() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let parent = Identity::Address(fixture.user.address());
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(
            DISCOUNT_MANAGER_ROLE,
            Identity::Address(fixture.deployer.address()),
        )
        .call()
        .await
        .unwrap();

    // Pinned to a tier the session is NOT on: list price.
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            parent,
            Some(TIER_ID + 1),
            Some(UserDiscount {
                discount_bps: 5_000,
                scope: DiscountScope::AllPremiums,
            }),
        )
        .call()
        .await
        .unwrap();
    let prolong = fixture.prolong_call(1);
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let prolonged = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 6_000);

    // Re-pinned to the session's own tier: half the Day fee.
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            parent,
            Some(TIER_ID),
            Some(UserDiscount {
                discount_bps: 5_000,
                scope: DiscountScope::AllPremiums,
            }),
        )
        .call()
        .await
        .unwrap();
    let prolong = fixture.prolong_call(1);
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let prolonged = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 3_000);
    assert_eq!(prolonged[0].fees_accrued, 9_000);
}

/// The two slots at work together. A user-wide grant prices every tier until
/// a tier override shadows it - WHOLE, rate and scope, never a blend - and a
/// ZERO override is the carve-out: that one tier back at list price while the
/// wide grant keeps pricing the rest.
#[tokio::test]
async fn a_tier_override_beats_the_user_wide_grant() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let mut fixture = PropFixture::new().await;
    let parent = Identity::Address(fixture.user.address());
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(
            DISCOUNT_MANAGER_ROLE,
            Identity::Address(fixture.deployer.address()),
        )
        .call()
        .await
        .unwrap();

    // Half off everywhere.
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            parent,
            None,
            Some(UserDiscount {
                discount_bps: 5_000,
                scope: DiscountScope::AllPremiums,
            }),
        )
        .call()
        .await
        .unwrap();
    let prolong = fixture.prolong_call(1);
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let prolonged = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 3_000);

    // A quarter-off override on the session's tier: WORSE than the wide
    // grant, and it still wins - an override is a replacement, not a floor.
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            parent,
            Some(TIER_ID),
            Some(UserDiscount {
                discount_bps: 2_500,
                scope: DiscountScope::AllPremiums,
            }),
        )
        .call()
        .await
        .unwrap();
    let prolong = fixture.prolong_call(1);
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let prolonged = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 4_500);

    // The zero override: this tier carved back to list price while the wide
    // grant stays in force for every other.
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            parent,
            Some(TIER_ID),
            Some(UserDiscount {
                discount_bps: 0,
                scope: DiscountScope::AllPremiums,
            }),
        )
        .call()
        .await
        .unwrap();
    let prolong = fixture.prolong_call(1);
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let prolonged = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 6_000);
    assert_eq!(
        fixture
            .deployment
            .pool
            .methods()
            .resolve_user_discount(parent, TIER_ID + 1)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(UserDiscount {
            discount_bps: 5_000,
            scope: DiscountScope::AllPremiums,
        })
    );

    // Clearing the override uncovers the wide grant for this tier again.
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(parent, Some(TIER_ID), None)
        .call()
        .await
        .unwrap();
    let prolong = fixture.prolong_call(1);
    let response = fixture.call_account(vec![prolong], 1).await.unwrap();
    let prolonged = response
        .decode_logs_with_type::<SessionProlonged>()
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 3_000);
    assert_eq!(prolonged[0].fees_accrued, 16_500);
}

/// `remove_user_discount` clears the slot it addresses, the same way
/// `set_user_discount` addresses one - a tier's override, or the
/// user-wide grant - behind the same role, and reports through its own
/// event so an audit can tell "priced at zero" from "no longer priced".
///
/// Clearing the wide grant deliberately leaves a tier override standing:
/// an override is the whole price for its tier, so removing the user's
/// discount there means removing that slot too.
#[tokio::test]
async fn removing_a_discount_clears_the_slot_it_addresses() {
    let _test_guard = PROP_DEPLOY_TEST_LOCK.lock().await;
    let fixture = PropFixture::new().await;
    let user = Identity::Address(fixture.user.address());
    const DISCOUNT_MANAGER_ROLE: u64 = 1;
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(
            DISCOUNT_MANAGER_ROLE,
            Identity::Address(fixture.deployer.address()),
        )
        .call()
        .await
        .unwrap();

    let grant = |bps| UserDiscount {
        discount_bps: bps,
        scope: DiscountScope::AllPremiums,
    };
    let resolved = |tier_id: u64| {
        let pool = fixture.deployment.pool.clone();
        async move {
            pool.methods()
                .resolve_user_discount(user, tier_id)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        }
    };

    for (slot, bps) in [(None, 1_000u64), (Some(TIER_ID), 5_000)] {
        fixture
            .deployment
            .pool
            .methods()
            .set_user_discount(user, slot, Some(grant(bps)))
            .call()
            .await
            .unwrap();
    }

    // Only the role may remove, exactly as only the role may grant.
    assert!(
        fixture
            .deployment
            .pool
            .clone()
            .with_account(fixture.outsider.clone())
            .methods()
            .remove_user_discount(user, None)
            .call()
            .await
            .is_err()
    );

    // The WIDE grant: gone for every tier it priced, while the override
    // keeps pricing its own.
    let response = fixture
        .deployment
        .pool
        .methods()
        .remove_user_discount(user, None)
        .call()
        .await
        .unwrap();
    let events = response
        .decode_logs_with_type::<UserDiscountsRemoved>()
        .unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].user, user);
    assert_eq!(events[0].tier_id, None);
    assert!(events[0].removed);
    assert!(events[0].timestamp.unix != 0);
    assert_eq!(resolved(TIER_ID).await, Some(grant(5_000)));
    assert_eq!(resolved(TIER_ID + 1).await, None);

    // The OVERRIDE: its tier falls back to list price, since the wide
    // grant is already gone.
    let response = fixture
        .deployment
        .pool
        .methods()
        .remove_user_discount(user, Some(TIER_ID))
        .call()
        .await
        .unwrap();
    let events = response
        .decode_logs_with_type::<UserDiscountsRemoved>()
        .unwrap();
    assert_eq!(events.len(), 1);
    assert_eq!(events[0].tier_id, Some(TIER_ID));
    assert!(events[0].removed);
    assert_eq!(resolved(TIER_ID).await, None);

    // Removing an empty slot is a logged no-op, not a revert - an
    // operator clearing twice must not need to care.
    let response = fixture
        .deployment
        .pool
        .methods()
        .remove_user_discount(user, Some(TIER_ID))
        .call()
        .await
        .unwrap();
    let events = response
        .decode_logs_with_type::<UserDiscountsRemoved>()
        .unwrap();
    assert_eq!(events.len(), 1);
    assert!(!events[0].removed);
}