o2-tools 0.4.3-rc

//! Exits with the order book in the picture, and the account's second life.
//!
//! Every existing exit test hands the pool an EMPTY cleanup list, so the whole
//! cancel-then-drain half of `absorb` was untested. That half is where the
//! liveness risk lives: a lock the pool cannot see is a session nobody can
//! close, and a lock the pool forgets to count is a seizure at the wrong price.

use super::*;
use crate::{
    order_book_deploy::Side,
    prop::PropOrderBookCleanup,
};

/// The account's resting order on the fixture's book at `price`, as the pool's
/// cleanup list wants it.
async fn resting_cleanup(
    fixture: &PropFixture,
    side: Side,
    price: u64,
) -> PropOrderBookCleanup {
    let orders = fixture
        .order_book
        .order_book
        .methods()
        .get_orders_at_price(side, price)
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    let order_ids = orders
        .into_iter()
        .filter(|order| order.trader_id == Identity::ContractId(fixture.child_id))
        .map(|order| order.order_id)
        .collect::<Vec<_>>();
    assert!(!order_ids.is_empty(), "the account has no resting order");
    PropOrderBookCleanup {
        order_book: fixture.order_book.contract_id,
        order_ids,
    }
}

// ---------------------------------------------------------------------------
// A resting order at the door.
// ---------------------------------------------------------------------------

/// A session cannot leave while any of its value is still locked in a book.
/// The pool has no way to price an open order, so it insists the books are
/// EMPTY - and gives the caller the one tool that empties them, the cleanup
/// list it drives through the account before it looks.
#[tokio::test]
async fn a_close_is_refused_while_an_order_rests_and_the_cleanup_list_frees_it() {
    let mut fixture = PropFixture::new().await;

    // Draw, then park the whole draw in an unfilled buy well below the market.
    let draw = fixture.draw_call(1_000_000);
    let rest = fixture.book_call(
        1_000_000,
        1_000_000_000,
        fixture.collateral_asset,
        1_000_000,
    );
    fixture.call_account(vec![draw, rest], 1).await.unwrap();
    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);

    // Net the draw away so the close's own gates are satisfied and the book is
    // the only thing left standing between the session and the door.
    let net = fixture.repay_from_collateral_call(1_000_000);
    fixture.call_account(vec![net], 0).await.unwrap();
    assert_eq!(fixture.session().await.drawn_quote, 0);

    let error = fixture
        .account
        .methods()
        .close_session(Vec::<PropOrderBookCleanup>::new())
        .with_contracts(&[
            &fixture.deployment.pool,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("BookNotDrained"),
        "value locked in a book cannot be settled at any price: {error:#}"
    );

    // Handed the order, the pool cancels it through the account, settles the
    // book, and only then values what came home.
    let cleanup = resting_cleanup(&fixture, Side::Buy, 1_000_000).await;
    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let response = fixture
        .account
        .methods()
        .close_session(vec![cleanup])
        .with_contracts(&[
            &fixture.deployment.pool,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    let closed = fixture.closed_event(&response);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.bad_debt, 0);
    assert_eq!(
        closed.platform_total, 0,
        "the netting is principal coming home, not profit"
    );
    assert_eq!(closed.user_net, COLLATERAL);
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap()
            - parent_before,
        COLLATERAL as u128,
        "the whole entry came back to the parent"
    );
    assert_eq!(
        fixture
            .order_book
            .order_book
            .methods()
            .get_total_balance_of(Identity::ContractId(fixture.child_id))
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        (0, 0)
    );
}

/// The same rule from the keeper's side, and it is the one that matters most:
/// a session whose whole value is resting in an order LOOKS underwater to the
/// pool, because the valuation walk counts what the account holds and a book
/// lock is not held by the account.
///
/// The drain check is what makes that safe. The keeper must cancel first, and
/// once the cash is home the session values correctly - so the order cannot be
/// used to manufacture a seizure, and the pool cannot seize around it either.
#[tokio::test]
async fn a_keeper_must_cancel_before_it_can_judge_and_the_cancel_answers_the_judgement() {
    let mut fixture = PropFixture::new().await;

    // 1_800_000 drawn and entirely locked in an unfilled buy. Without the cash
    // on the account the legs read 8_200_000 against a threshold of 8_250_000.
    let draw = fixture.draw_call(1_800_000);
    let rest = fixture.book_call(
        1_000_000,
        1_800_000_000,
        fixture.collateral_asset,
        1_800_000,
    );
    fixture.call_account(vec![draw, rest], 1).await.unwrap();
    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);

    let keeper = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone());

    // Empty-handed, the keeper is stopped by the drain check before the
    // liquidation gate is ever evaluated.
    let error = keeper
        .methods()
        .liquidate(fixture.child_id, vec![])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("BookNotDrained"),
        "the gate is never read against a half-visible portfolio: {error:#}"
    );

    // Handed the order, the cancel runs first - and the cash it returns is
    // exactly what lifts the session back over the line.
    let cleanup = resting_cleanup(&fixture, Side::Buy, 1_000_000).await;
    let error = keeper
        .methods()
        .liquidate(fixture.child_id, vec![cleanup])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("NotLiquidatable"),
        "a session is judged on the cash the cancel brought home: {error:#}"
    );

    // The cancel happened even though the liquidation reverted? No - the whole
    // call rolled back, order and all, so the session is exactly as it was.
    assert_eq!(fixture.account_balance(fixture.collateral_asset).await, 0);
    assert_eq!(fixture.session().await.drawn_quote, 1_800_000);
    assert_ne!(
        fixture
            .order_book
            .order_book
            .methods()
            .get_total_balance_of(Identity::ContractId(fixture.child_id))
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        (0, 0),
        "a refused seizure leaves the order resting"
    );
}

/// Two markets, two locks, one exit. The drain check walks EVERY book in the
/// tier, so a cleanup list that frees one and forgets the other is refused -
/// which is what stops a session leaving value behind on a market nobody
/// remembered.
#[tokio::test]
async fn a_two_market_session_must_free_both_books_before_it_closes() {
    let mut fixture = PropFixture::new().await;

    // A second market in the same tier, admitted mid-session.
    let second_base = AssetId::new([0x91; 32]);
    let second = OrderBookDeploy::deploy(
        &fixture.deployer,
        second_base,
        fixture.collateral_asset,
        &OrderBookDeployConfig::default(),
    )
    .await
    .unwrap();
    fixture
        .deployment
        .price_feed
        .methods()
        .set_asset_decimals(second_base, 9)
        .call()
        .await
        .unwrap();
    fixture
        .deployment
        .price_feed
        .methods()
        .publish_prices(vec![PriceInput {
            asset: second_base,
            bid: 2_000_000_000_000_000_000u64.into(),
            ask: 2_000_000_000_000_000_000u64.into(),
            timestamp: fixture.next_publish_time(),
        }])
        .call()
        .await
        .unwrap();
    fixture
        .deployment
        .pool
        .methods()
        .add_books(TIER_ID, vec![second.contract_id])
        .with_contract_ids(&[second.contract_id, fixture.deployment.price_feed_id])
        .call()
        .await
        .unwrap();

    // Draw once, rest a buy on each market.
    let draw = fixture.draw_call(2_000_000);
    let rest_first = fixture.book_call(
        1_000_000,
        1_000_000_000,
        fixture.collateral_asset,
        1_000_000,
    );
    let rest_second = CallContractArg {
        contract_id: second.contract_id,
        function_selector: Bytes(fn_selector!(create_order(OrderArgs))),
        call_params: CallParams {
            coins: 1_000_000,
            asset_id: fixture.collateral_asset,
            gas: 10_000_000,
        },
        call_data: Some(Bytes(call_data!(OrderArgs {
            price: 1_000_000,
            quantity: 1_000_000_000,
            order_type: OrderType::Spot,
        }))),
    };
    let (user_signature, cosigner_signature, calls) = fixture
        .signed_calls(vec![draw, rest_first, rest_second])
        .await;
    fixture
        .account
        .methods()
        .call_contracts(user_signature, cosigner_signature, calls)
        .with_contracts(&[
            &fixture.deployment.oracle,
            &fixture.deployment.pool,
            &fixture.deployment.price_feed,
            &fixture.deployment.registry,
            &fixture.order_book.order_book,
            &second.order_book,
        ])
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap();

    let net = fixture.repay_from_collateral_call(2_000_000);
    fixture.call_account(vec![net], 0).await.unwrap();

    let first_cleanup = resting_cleanup(&fixture, Side::Buy, 1_000_000).await;
    let second_orders = second
        .order_book
        .methods()
        .get_orders_at_price(Side::Buy, 1_000_000)
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    let second_cleanup = PropOrderBookCleanup {
        order_book: second.contract_id,
        order_ids: second_orders
            .into_iter()
            .filter(|order| order.trader_id == Identity::ContractId(fixture.child_id))
            .map(|order| order.order_id)
            .collect(),
    };
    assert_eq!(second_cleanup.order_ids.len(), 1);

    // Freeing only the first market is not enough.
    let error = fixture
        .account
        .methods()
        .close_session(vec![first_cleanup.clone()])
        .with_contracts(&[
            &fixture.deployment.pool,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &second.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("BookNotDrained"),
        "the drain check walks every book the tier admitted: {error:#}"
    );

    // Both, and the session leaves with everything it came in with.
    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let response = fixture
        .account
        .methods()
        .close_session(vec![first_cleanup, second_cleanup])
        .with_contracts(&[
            &fixture.deployment.pool,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &second.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    let closed = fixture.closed_event(&response);
    assert_eq!(closed.reason, SettlementReason::UserClose);
    assert_eq!(closed.bad_debt, 0);
    assert_eq!(closed.user_net, COLLATERAL);
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap()
            - parent_before,
        COLLATERAL as u128
    );
}

// ---------------------------------------------------------------------------
// The account's second life.
// ---------------------------------------------------------------------------

/// Session IDs are never reused, and every accounting key is scoped by one.
/// A trader who closes and reopens gets a clean ledger rather than the
/// remains of the last one - which is what makes an account a durable
/// identity instead of a one-shot vehicle.
#[tokio::test]
async fn a_second_session_on_the_same_account_starts_from_a_clean_ledger() {
    let mut fixture = PropFixture::new().await;

    // A first life with everything the ledger can carry: a draw, an in-kind
    // debt, an accrued fee and a settlement receipt.
    let draw = fixture.draw_call(1_000_000);
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, 500_000_000u64)),
    );
    fixture.call_account(vec![draw, borrow], 2).await.unwrap();
    fixture
        .call_account(vec![fixture.prolong_call(1)], 1)
        .await
        .unwrap();

    let first = fixture.session().await;
    assert_eq!(first.session_id, 1);
    assert_eq!(first.fees_accrued, 6_000);

    let repay =
        fixture.pool_call(fn_selector!(repay()), 500_000_000, fixture.base_asset, None);
    let give_back = fixture.pool_call(
        fn_selector!(return_quote()),
        1_000_000,
        fixture.collateral_asset,
        None,
    );
    fixture
        .call_account(vec![repay, give_back], 0)
        .await
        .unwrap();
    fixture.close_session().await;

    // The parent takes the settlement home and posts it again.
    let second_entry = COLLATERAL;
    let response = fixture
        .account
        .methods()
        .start_session(TIER_ID, second_entry, ProlongPeriod::SixHours)
        .call_params(CallParameters::new(
            second_entry,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            fixture.deployment.pool_id,
            fixture.deployment.registry_id,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    let opened = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<SessionOpened>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(opened.len(), 1);
    assert_eq!(
        opened[0].session_id, 2,
        "IDs are monotonic, so the old keys can never be addressed again"
    );

    let second = fixture.session().await;
    assert_eq!(second.session_id, 2);
    assert_eq!(second.collateral, second_entry);
    assert_eq!(second.drawn_quote, 0, "the old draw did not follow it");
    assert_eq!(second.fees_accrued, 0, "nor the old fee");
    assert_eq!(second.capitalised, 0);
    assert_eq!(second.decapitalised, 0);
    assert_eq!(second.credit_line, 10_000_000);
    assert_eq!(fixture.debt(fixture.base_asset).await, 0);
    assert!(
        !fixture
            .deployment
            .pool
            .methods()
            .has_debts(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );

    // And the second life closes as cleanly as the first.
    fixture.close_session().await;
}

/// The sweep is scoped to the TIER's assets, so anything else the account is
/// holding is untouched by a close - it is not swept, not valued, not shared,
/// and it is still there for the parent afterwards. An airdrop is the user's,
/// not the pool's.
#[tokio::test]
async fn an_off_tier_holding_is_untouched_by_the_close_and_leaves_with_the_parent() {
    let fixture = PropFixture::new().await;

    let gift = AssetId::default();
    fixture
        .deployer
        .force_transfer_to_contract(fixture.child_id, 4_242, gift, TxPolicies::default())
        .await
        .unwrap();
    let held = fixture.account_balance(gift).await;
    assert!(held != 0);

    fixture.close_session().await;
    assert_eq!(
        fixture.account_balance(gift).await,
        held,
        "an asset outside the tier is not part of the settlement basket"
    );

    // With the session gone the parent can take it.
    let parent_before = fixture.user.get_asset_balance(&gift).await.unwrap();
    fixture
        .account
        .methods()
        .withdraw(gift, held)
        .with_contracts(&[&fixture.deployment.pool, &fixture.deployment.oracle])
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap();
    assert!(
        fixture.user.get_asset_balance(&gift).await.unwrap() > parent_before,
        "and it leaves with the parent"
    );
    assert_eq!(fixture.account_balance(gift).await, 0);
}

// ---------------------------------------------------------------------------
// Who may open one at all.
// ---------------------------------------------------------------------------

/// Registration is the ONLY thing that brings a prop account to life. The
/// proxy bakes its parent into its bytecode but keeps it out of storage until
/// the registry writes it, and the registry writes it only for the parent
/// itself, only once, and only over a proxy pointing at the oracle's current
/// implementation.
///
/// So an unregistered proxy - byte-for-byte identical to a real one - is
/// INERT: it has no parent, so nothing on it can be authorised. The pool's own
/// `NotPropAccount` sits behind that as a second lock.
#[tokio::test]
async fn an_unregistered_account_is_inert_until_its_parent_registers_it() {
    let fixture = PropFixture::new().await;

    let parent = Identity::Address(fixture.user.address());
    let configurables = PropAccountProxyContractConfigurables::default()
        .with_ORACLE_CONTRACT_ID(fixture.deployment.oracle_id)
        .unwrap()
        .with_PARENT(parent)
        .unwrap()
        .with_INDEX(99)
        .unwrap();
    let contract = regular_contract(
        PROP_ACCOUNT_PROXY_BYTECODE,
        PROP_ACCOUNT_PROXY_STORAGE,
        fixture.deployment.account_salt,
    )
    .unwrap()
    .with_configurables(configurables);
    let (unregistered_id, _) = deploy_regular(&fixture.user, contract).await.unwrap();

    let registry = &fixture.deployment.registry;
    assert!(
        !registry
            .methods()
            .prop_is_valid(unregistered_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );

    // Inert: the parent is baked into the bytecode but not into storage, so
    // even the owner route cannot authorise anything.
    let unregistered = PropAccountContract::new(unregistered_id, fixture.user.clone());
    let error = unregistered
        .methods()
        .start_session(TIER_ID, COLLATERAL, ProlongPeriod::SixHours)
        .call_params(CallParameters::new(
            COLLATERAL,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            fixture.deployment.pool_id,
            fixture.deployment.registry_id,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("InvalidParent"),
        "an unregistered proxy has no parent to authorise: {error:#}"
    );

    // And it cannot bring itself to life: `initialize` is the registry's.
    let error = PropAccountProxyContract::new(unregistered_id, fixture.user.clone())
        .methods()
        .initialize()
        .with_contract_ids(&[fixture.deployment.oracle_id, fixture.deployment.pool_id])
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("InvalidRegistry"),
        "only the registry initialises an account: {error:#}"
    );

    // Nor may a stranger register it on the parent's behalf.
    let error = TradeAccountRegistry::new(
        fixture.deployment.registry_id,
        fixture.outsider.clone(),
    )
    .methods()
    .prop_register_contract(unregistered_id, parent, 99)
    .with_contract_ids(&[
        fixture.deployment.oracle_id,
        unregistered_id,
        fixture.deployment.pool_id,
    ])
    .call()
    .await
    .unwrap_err();
    assert!(
        error.to_string().contains("NotParent"),
        "registration is claimed by the parent itself: {error:#}"
    );

    // The parent registers it, and the same account works.
    TradeAccountRegistry::new(fixture.deployment.registry_id, fixture.user.clone())
        .methods()
        .prop_register_contract(unregistered_id, parent, 99)
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            unregistered_id,
            fixture.deployment.pool_id,
        ])
        .call()
        .await
        .unwrap();
    assert!(
        registry
            .methods()
            .prop_is_valid(unregistered_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
    assert_eq!(
        registry
            .methods()
            .prop_parent(unregistered_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(parent)
    );

    // Registering it a second time is refused, so nobody can reparent a live
    // account out from under its owner.
    let error =
        TradeAccountRegistry::new(fixture.deployment.registry_id, fixture.user.clone())
            .methods()
            .prop_register_contract(unregistered_id, parent, 99)
            .with_contract_ids(&[
                fixture.deployment.oracle_id,
                unregistered_id,
                fixture.deployment.pool_id,
            ])
            .call()
            .await
            .unwrap_err();
    assert!(
        error.to_string().contains("AlreadyRegistered"),
        "an account has one parent for life: {error:#}"
    );

    unregistered
        .methods()
        .start_session(TIER_ID, COLLATERAL, ProlongPeriod::SixHours)
        .call_params(CallParameters::new(
            COLLATERAL,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            fixture.deployment.pool_id,
            fixture.deployment.registry_id,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    assert!(
        fixture
            .deployment
            .pool
            .methods()
            .get_session(unregistered_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
            .is_some()
    );
}

/// `start_session` sweeps the account clean before it opens, and the POOL
/// checks the same thing again on arrival. The second check is not redundant:
/// a session key can reach `open_session` directly, skipping the sweep, and
/// without it a session could be born holding a tier asset the pool never
/// counted as collateral and would later hand out as profit.
#[tokio::test]
async fn the_pool_refuses_to_open_on_an_account_that_is_still_holding() {
    let mut fixture = PropFixture::new().await;

    // A fresh sibling with a session key of its own.
    let parent = Identity::Address(fixture.user.address());
    let sibling = fixture
        .deployment
        .deploy_account(&fixture.user, parent, 7)
        .await
        .unwrap();
    let sibling_id = sibling.contract_id();
    let sibling_account = PropAccountContract::new(sibling_id, fixture.user.clone());
    let expiry = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs()
        + 86_400;
    sibling_account
        .methods()
        .set_session(ParallelSessionArgs {
            nonce: U256::zero(),
            session_id: Identity::Address(fixture.user.address()),
            expiry: Time { unix: expiry },
            contract_ids: vec![],
        })
        .with_contract_ids(&[fixture.deployment.oracle_id])
        .call()
        .await
        .unwrap();

    // Exactly the entry in collateral, plus a stray of the tier's base asset.
    for (asset, amount) in [
        (fixture.collateral_asset, COLLATERAL),
        (fixture.base_asset, 5_000),
    ] {
        fixture
            .deployer
            .force_transfer_to_contract(sibling_id, amount, asset, TxPolicies::default())
            .await
            .unwrap();
    }

    // The session key reaches `open_session` on the pool directly - no sweep.
    let open = CallContractArg {
        contract_id: fixture.deployment.pool_id,
        function_selector: Bytes(fn_selector!(open_session(u64, ProlongPeriod))),
        call_params: CallParams {
            coins: COLLATERAL,
            asset_id: fixture.collateral_asset,
            gas: 30_000_000,
        },
        call_data: Some(Bytes(call_data!(TIER_ID, ProlongPeriod::SixHours))),
    };
    let (user_signature, cosigner_signature, calls) =
        fixture.signed_calls_for(sibling_id, vec![open]).await;
    let error = sibling_account
        .methods()
        .call_contracts(user_signature, cosigner_signature, calls)
        .with_contracts(&[
            &fixture.deployment.oracle,
            &fixture.deployment.pool,
            &fixture.deployment.price_feed,
            &fixture.deployment.registry,
            &fixture.order_book.order_book,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("AccountNotEmpty"),
        "the pool counts what it was sent, not what the account happens to hold: {error:#}"
    );

    // Through the owner route the sweep runs first and the same account opens
    // cleanly, the stray going home to the parent.
    sibling_account
        .methods()
        .start_session(TIER_ID, COLLATERAL, ProlongPeriod::SixHours)
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            fixture.deployment.pool_id,
            fixture.deployment.registry_id,
        ])
        .call_params(CallParameters::new(
            COLLATERAL,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    assert_eq!(
        fixture
            .deployer
            .try_provider()
            .unwrap()
            .get_contract_asset_balance(&sibling_id, &fixture.base_asset)
            .await
            .unwrap(),
        0
    );
}