o2-tools 0.4.3-rc

//! The prepaid ("Turbo") overlay: forfeited entries, the free
//! performance-gated rollover, the cosigned deadline that grants or ends it,
//! the atomic v2 publication and the sales switch.
//!
//! Every behaviour here is keyed on the `TurboTerms` sidecar a tier version
//! may carry. The legacy suites prove the other half of the contract: a tier
//! WITHOUT terms — every session the fixture opens — behaves exactly as it
//! always did, and these tests re-prove it in-place where the two cohorts
//! meet (top-ups, the sales switch).

use super::*;
use crate::{
    prop::{
        RolloverWithdrawalRecorded,
        SessionRolledOver,
        SessionSeized,
        TicketSettled,
        TierEnabledChanged,
        TierVersionPublishedV2,
        TurboTerms,
    },
    prop_expiry::generate_pool_expiry_signing_payload,
};

/// A tier id the fixture never uses, so the fixture's own session stays on
/// its legacy terms while these tests sell the prepaid ones beside it.
const TURBO_TIER_ID: u64 = 7;
/// `line / leverage` — the deposit half of the price, forfeited at close.
const TURBO_DEPOSIT: u64 = 250_000;
/// The fee half of the price, paid to the platform inside the opening call.
const TURBO_FEE: u64 = 25_000;
/// What the user actually sends: the whole price, deposit and fee together.
/// A PURCHASE, not a posting: the fee leaves for the platform at the door,
/// the deposit stays with the pool as the session's first-loss bucket, and
/// the session itself opens on zero collateral and zero accrued fees.
const TURBO_ENTRY: u64 = TURBO_DEPOSIT + TURBO_FEE;
/// 9% of the line: the profit a rollover demands above the anchor.
const ROLLOVER_BAR: u64 = 900_000;
/// The account size the tier sells — `deposit * leverage`. A prepaid ticket
/// buys this whatever it cost, so a discount must leave it untouched.
const TURBO_LINE: u64 = TURBO_DEPOSIT * 40;

/// The launch shape: `leverage 40` prices the deposit at `line/40`,
/// `maintenance_bps 100` leaves the pool a 1%-of-line cushion under the
/// user's 1.5% drawdown, and the tier sells SEVEN DAYS by name — the pool
/// refuses any other period at open, `validate_turbo_tier` pins the
/// prolong fees to zero so nothing is purchasable or armable, and the
/// free rollover is the only extension that exists.
fn turbo_tier_params() -> TierParams {
    turbo_tier_params_for(LINE)
}

/// The same shape at any account size: deposit `line/40`, the price being
/// deposit + fee, the drawdown 1.5% of the line over a 1%-of-line pool
/// cushion — the three shipped price points are this one function at
/// 10_000_000 / 5_000_000 / 2_500_000.
fn turbo_tier_params_for(line: u64) -> TierParams {
    TierParams {
        line,
        leverage: 40,
        duration: 0,
        maintenance_bps: 100,
        open_buffer_bps: 101,
        liq_price_factor: 9_900,
        prolong_fee: [0, 0, 0, 0],
        max_credit_line_bps: 20_000,
        max_price_age: u64::MAX,
        open_fee: line / 400,
        profit_share_bps: 0,
        price_band_bps: 1_000,
    }
}

fn turbo_terms(max_loss_bps: [u64; 4]) -> TurboTerms {
    TurboTerms {
        max_loss_bps,
        // The finalised product: 9% of the line earns a free week, three
        // times, each widening the drawdown.
        rollover_profit_bps: 900,
        max_rollovers: 3,
    }
}

/// The shipped escalator: 1.5% / 2% / 2.5% / 3% of the line.
const DRAWDOWN_SCHEDULE: [u64; 4] = [150, 200, 250, 300];

/// The tier, armed for settlement: published, then given a cosigner whose
/// signature `expire_or_rollover` will accept. Every test that reaches a
/// prepaid deadline needs both.
async fn publish_turbo_tier(fixture: &PropFixture, terms: TurboTerms) -> u32 {
    let version = publish_turbo_tier_unarmed(fixture, terms).await;
    // `expire_or_rollover` turns on `outside` - a figure only the keeper can
    // supply - so the pool takes it under COSIGNATURE rather than from a
    // privileged caller. The pool keeps its OWN cosigner, independent of the
    // oracle's; the fixture's deployer plays it.
    fixture
        .deployment
        .pool
        .methods()
        .set_expiry_cosigner(fixture.deployer.address())
        .call()
        .await
        .unwrap();
    version
}

/// The publication alone, leaving the pool with NO expiry cosigner - the
/// state every pool is in before governance arms one, in which no prepaid
/// deadline can be settled at all.
///
/// One call, one publication: the economics, the terms and the books land
/// atomically, and the version they create is sellable only after all of
/// them exist. Returns the version new sessions will pin.
async fn publish_turbo_tier_unarmed(fixture: &PropFixture, terms: TurboTerms) -> u32 {
    let response = fixture
        .deployment
        .pool
        .methods()
        .publish_tier_v2(
            TURBO_TIER_ID,
            turbo_tier_params(),
            terms.clone(),
            vec![fixture.order_book.contract_id],
        )
        .with_contract_ids(&[
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .call()
        .await
        .unwrap();
    let version = response.value;
    let published = response
        .decode_logs_with_type::<TierVersionPublishedV2>()
        .unwrap();
    assert_eq!(published.len(), 1);
    assert_eq!(published[0].tier_id, TURBO_TIER_ID);
    assert_eq!(published[0].version, version);
    assert_eq!(published[0].terms, terms);
    assert_eq!(published[0].rollover_window_seconds, 21_600);
    // Derived under the prepaid regime (`k = line`), so the static floor
    // reads `line + maintenance` - above `V` by construction, which is
    // exactly why a prepaid session never uses it: the drawdown schedule
    // is its only floor, and publication requires one.
    assert_eq!(published[0].k, 10_000_000);
    assert_eq!(published[0].threshold_floor, 10_100_000);
    // The V2 publication does NOT emit the legacy event: a pre-restructure
    // consumer must skip this tier, never render it as refundable.
    assert!(
        response
            .decode_logs_with_type::<TierVersionPublished>()
            .unwrap()
            .is_empty()
    );
    version
}

/// Closes the fixture's legacy session and opens a prepaid one on the same
/// account — the reusable-container property doing exactly what it is for.
async fn open_turbo_session(fixture: &PropFixture) -> SessionOpened {
    fixture.close_session().await;
    start_turbo_session(fixture).await
}

/// The opening half alone, for a test whose account is already sessionless.
async fn start_turbo_session(fixture: &PropFixture) -> SessionOpened {
    start_turbo_session_paying(fixture, TURBO_ENTRY).await
}

/// The same, paying an exact `entry` — the price is the deposit plus the
/// fee, and a turbo entry must equal it to the unit, so a discounted entry
/// pays a smaller total and a wrong one is refused.
async fn start_turbo_session_paying(fixture: &PropFixture, entry: u64) -> SessionOpened {
    let response = fixture
        .account
        .methods()
        .start_session(TURBO_TIER_ID, entry, ProlongPeriod::Week)
        .call_params(CallParameters::new(
            entry,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contract_ids(&[
            fixture.deployment.oracle_id,
            fixture.deployment.pool_id,
            fixture.deployment.registry_id,
        ])
        // The fee half of the price leaves for the platform's ADDRESS inside
        // this very call, and an address transfer needs an output to land on
        // — the zero-fee legacy fixture never had to provide one.
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap();
    let opened = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<SessionOpened>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(opened.len(), 1);
    opened.into_iter().next().unwrap()
}

/// Re-arms the account's session key from CHAIN time.
///
/// The fixture arms it for a day, matching its own one-day legacy tier. A
/// seven-day turbo term outlives that by design, so any test that jumps the
/// chain across a term has to re-issue the key before it can drive the
/// account again — the parent may always do so, and `set_session` simply
/// overwrites the stored key.
async fn refresh_session_key(fixture: &PropFixture) {
    let chain = fixture
        .user
        .try_provider()
        .unwrap()
        .latest_block_time()
        .await
        .unwrap()
        .map(|time| time.timestamp() as u64)
        .unwrap_or(0);
    fixture
        .account
        .methods()
        .set_session(ParallelSessionArgs {
            nonce: U256::zero(),
            session_id: Identity::Address(fixture.user.address()),
            expiry: Time {
                unix: chain + 86_400,
            },
            contract_ids: vec![],
        })
        .with_contract_ids(&[fixture.deployment.oracle_id])
        .call()
        .await
        .unwrap();
}

/// Moves the chain just past the session's deadline WITHOUT expiring it.
async fn advance_past_expiry(fixture: &PropFixture) {
    let session = fixture.session().await;
    let provider = fixture.outsider.try_provider().unwrap();
    let latest = provider
        .latest_block_time()
        .await
        .unwrap()
        .expect("local chain has a latest block time");
    let seconds = session.expires_at.saturating_sub(latest.timestamp() as u64) + 1;
    let target = latest
        .checked_add_signed(chrono::TimeDelta::seconds(seconds as i64))
        .expect("test expiry timestamp is representable");
    provider.produce_blocks(1, Some(target)).await.unwrap();
}

/// The keeper settling a PREPAID deadline, driven the way the backend drives
/// it: it declares how much of the session's value arrived from outside, and
/// what it decided to do, and cosigns both.
///
/// Kept fallible throughout — half of what these tests prove is which
/// settlements the pool REFUSES.
async fn try_settle(
    fixture: &PropFixture,
    outside: u64,
    roll: bool,
) -> Result<CallResponse<()>> {
    let signature =
        expiry_cosignature(fixture, outside, roll, fixture.deployer.clone()).await;
    settle_with(fixture, outside, roll, signature, None).await
}

/// The settlement call with the signature and the submitter handed in — for
/// the tests that present a forged one, a stale one, or one carried by
/// somebody other than the keeper.
async fn settle_with(
    fixture: &PropFixture,
    outside: u64,
    roll: bool,
    signature: Signature,
    caller: Option<Wallet>,
) -> Result<CallResponse<()>> {
    let pool = match caller {
        Some(caller) => fixture.deployment.pool.clone().with_account(caller),
        None => fixture.deployment.pool.clone(),
    };
    Ok(pool
        .methods()
        .expire_or_rollover(fixture.child_id, vec![], outside, roll, signature)
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await?)
}

/// The keeper closing the session out. Nothing arrived from outside, and it
/// decided the week was not earned.
async fn try_expire(fixture: &PropFixture) -> Result<CallResponse<()>> {
    try_settle(fixture, 0, false).await
}

/// The keeper claiming the free week. Nothing arrived from outside — these
/// sessions earn what they earn — so the pool's bar sees the whole gain.
async fn try_roll(fixture: &PropFixture) -> Result<CallResponse<()>> {
    try_settle(fixture, 0, true).await
}

/// The PERMISSIONLESS deadline, driven by `caller`. Legacy sessions settle
/// here; a prepaid one must not.
async fn try_legacy_expire(
    fixture: &PropFixture,
    caller: Wallet,
) -> Result<CallResponse<()>> {
    Ok(fixture
        .deployment
        .pool
        .clone()
        .with_account(caller)
        .methods()
        .expire_session(fixture.child_id, vec![])
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await?)
}

/// The expiry cosignature over the session as it stands RIGHT NOW.
///
/// Reads `session_id` and `expires_at` off chain rather than tracking them,
/// because both move: a roll bumps the deadline a week on, which is exactly
/// what spends the previous signature. `signer` is a parameter so a test can
/// present a signature from the wrong key.
async fn expiry_cosignature(
    fixture: &PropFixture,
    outside: u64,
    roll: bool,
    signer: Wallet,
) -> Signature {
    let session = fixture
        .deployment
        .pool
        .methods()
        .get_session(fixture.child_id)
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value
        .expect("no session to settle");
    let chain_id = fixture
        .user
        .provider()
        .consensus_parameters()
        .await
        .unwrap()
        .chain_id();
    let message = generate_pool_expiry_signing_payload(
        *chain_id,
        fixture.deployment.pool.contract_id(),
        fixture.child_id,
        session.session_id,
        session.expires_at,
        outside,
        roll,
    );
    Signature::Secp256k1(Secp256k1 {
        bits: *signer.signer().sign(message).await.unwrap(),
    })
}

async fn rollover_view(fixture: &PropFixture) -> crate::prop::RolloverView {
    fixture
        .deployment
        .pool
        .methods()
        .get_rollover(fixture.child_id)
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value
        .unwrap()
}

/// A prepaid publication is one transaction, and its refusals are whole:
/// an incoherent configuration leaves NO trace - no version, no terms,
/// nothing sellable. And once published, the terms are immutable by
/// construction rather than by guard: no call that could change them
/// exists, so there is no retroactive-terms attack to refuse and no
/// publish-then-attach race to police.
#[tokio::test]
async fn a_turbo_publication_is_atomic_and_refuses_incoherent_terms_whole() {
    let fixture = PropFixture::new().await;
    let pool = fixture.deployment.pool.clone();

    let before = pool
        .methods()
        .current_tier_version(TURBO_TIER_ID)
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert_eq!(before, None, "the turbo tier does not exist yet");

    // A FORFEIT-ONLY shape - drawdown, no rollover - is a real product:
    // the floor is measured from the LINE and needs no anchor (an absent
    // rollover row is term one forever), so the schedule stands on its own.
    // Published on its own id so the atomicity checks below still start
    // from a tier that does not exist.
    let mut forfeit_only = turbo_terms(DRAWDOWN_SCHEDULE);
    forfeit_only.rollover_profit_bps = 0;
    forfeit_only.max_rollovers = 0;
    pool.methods()
        .publish_tier_v2(
            TURBO_TIER_ID + 2,
            turbo_tier_params(),
            forfeit_only,
            vec![fixture.order_book.contract_id],
        )
        .with_contract_ids(&[
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .call()
        .await
        .expect("a forfeit-only prepaid tier publishes");

    // A schedule with a zero in ANY step the session can reach is refused at
    // publish. Step 0 opens the session already on its liquidation line; a
    // later zero is worse, because a rollover re-anchors to `V` and the user
    // is seized on the block after he EARNS that week - and the publication
    // is immutable, so the version could never be repaired. The escalator
    // must also never narrow.
    for (schedule, what) in [
        ([0, 200, 250, 300], "a dead first step"),
        ([150, 0, 250, 300], "a dead middle step"),
        ([150, 200, 250, 0], "a dead last step"),
        ([150, 100, 250, 300], "a step that narrows"),
    ] {
        let mut bad = turbo_terms(DRAWDOWN_SCHEDULE);
        bad.max_loss_bps = schedule;
        let error = pool
            .methods()
            .publish_tier_v2(
                TURBO_TIER_ID,
                turbo_tier_params(),
                bad,
                vec![fixture.order_book.contract_id],
            )
            .with_contract_ids(&[
                fixture.order_book.contract_id,
                fixture.deployment.price_feed_id,
            ])
            .call()
            .await
            .unwrap_err();
        assert!(
            error.to_string().contains("InvalidTurboTerms"),
            "{what} must be refused: {error:#}"
        );
    }

    // Two preconditions of the zero-collateral model, each refused whole.
    // A tier with NO drawdown would sell sessions born liquidatable (with
    // the pool funding the whole line, the legacy floor sits above `V`
    // from birth); and a cap under the line would truncate the line the
    // seat is born holding.
    let mut floorless = turbo_terms(DRAWDOWN_SCHEDULE);
    floorless.max_loss_bps = [0, 0, 0, 0];
    for (params, bad, what) in [
        (turbo_tier_params(), floorless, "a tier selling no drawdown"),
        (
            {
                let mut narrow = turbo_tier_params();
                narrow.max_credit_line_bps = 9_999;
                narrow
            },
            turbo_terms(DRAWDOWN_SCHEDULE),
            "a cap under the line",
        ),
    ] {
        let error = pool
            .methods()
            .publish_tier_v2(
                TURBO_TIER_ID,
                params,
                bad,
                vec![fixture.order_book.contract_id],
            )
            .with_contract_ids(&[
                fixture.order_book.contract_id,
                fixture.deployment.price_feed_id,
            ])
            .call()
            .await
            .unwrap_err();
        assert!(
            error.to_string().contains("InvalidTurboTerms"),
            "{what} must be refused: {error:#}"
        );
    }

    // A step the session can NEVER reach is nobody's business: this tier
    // sells one rollover, so only steps 0 and 1 are ever indexed.
    let mut short = turbo_terms([150, 200, 0, 0]);
    short.max_rollovers = 1;
    pool.methods()
        .publish_tier_v2(
            TURBO_TIER_ID + 1,
            turbo_tier_params(),
            short,
            vec![fixture.order_book.contract_id],
        )
        .with_contract_ids(&[
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .call()
        .await
        .expect("only reachable steps are policed");

    // Only the admin publishes, exactly as with the legacy call.
    let error = pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .publish_tier_v2(
            TURBO_TIER_ID,
            turbo_tier_params(),
            turbo_terms(DRAWDOWN_SCHEDULE),
            vec![fixture.order_book.contract_id],
        )
        .with_contract_ids(&[
            fixture.order_book.contract_id,
            fixture.deployment.price_feed_id,
        ])
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("AccessControlNotAuthorized"),
        "{error:#}"
    );

    // ATOMICITY: every refusal above left NO trace - the tier still does
    // not exist. A refused publication is whole, like the successful one.
    // refused publication leaves no half-published version behind.
    let after = pool
        .methods()
        .current_tier_version(TURBO_TIER_ID)
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert_eq!(after, None, "a refused publication must leave no trace");

    // The happy path, then the two kinds side by side: the v2 version
    // carries its terms, and the legacy tier the fixture booted with -
    // published through the v1 call - carries none.
    let version = publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    let stored = pool
        .methods()
        .get_turbo_terms(TURBO_TIER_ID, version)
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert_eq!(stored, Some(turbo_terms(DRAWDOWN_SCHEDULE)));
    assert_eq!(
        pool.methods()
            .get_turbo_terms(TIER_ID, 1)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        None,
        "a legacy publication never carries terms"
    );
    // And the live legacy session stays legacy, with the turbo tier beside it.
    assert_eq!(
        pool.methods()
            .session_turbo_terms(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        None,
    );
}

/// The rollout as it will actually be run: the new product ships on NEW
/// tier ids, and the old ids are switched off so they sell nothing further.
/// Neither half touches a session that is already open.
///
/// The switch is sales-only by design. An old session keeps its pinned
/// terms and every call it ever had — which is the whole backward-compat
/// promise, and the reason this is not the design doc's `deprecated`, which
/// deliberately stops prolongation too in order to wind a bad version down.
#[tokio::test]
async fn switching_an_old_tier_off_stops_its_sales_and_strands_no_session() {
    let mut fixture = PropFixture::new().await;
    let pool = fixture.deployment.pool.clone();

    // Every tier is enabled by default, including ones published before the
    // switch existed — the storage default has to mean "open for business".
    assert!(
        pool.methods()
            .is_tier_enabled(TIER_ID)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );

    // The new product goes out on its own tier id, beside the old one.
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;

    // Only the admin may work the switch.
    let error = pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .set_tier_enabled(TIER_ID, false)
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("AccessControlNotAuthorized"),
        "{error:#}"
    );

    let response = pool
        .methods()
        .set_tier_enabled(TIER_ID, false)
        .call()
        .await
        .unwrap();
    let changed = response
        .decode_logs_with_type::<TierEnabledChanged>()
        .unwrap();
    assert_eq!(changed.len(), 1);
    assert_eq!(changed[0].tier_id, TIER_ID);
    assert!(!changed[0].enabled);
    assert!(
        !pool
            .methods()
            .is_tier_enabled(TIER_ID)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );

    // The session the old tier already sold owes the switch nothing: it
    // still reports its own cohort and still buys time on its pinned terms.
    assert_eq!(
        pool.methods()
            .session_turbo_terms(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        None,
    );
    let response = fixture
        .call_account(vec![fixture.prolong_call(1)], 1)
        .await
        .unwrap();
    let prolonged = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<SessionProlonged>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(prolonged.len(), 1);
    assert_eq!(prolonged[0].fee, 6_000);

    // But it sells nothing further...
    fixture.close_session().await;
    let error = fixture
        .account
        .methods()
        .start_session(TIER_ID, COLLATERAL, ProlongPeriod::SixHours)
        .call_params(CallParameters::new(
            COLLATERAL,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contracts(&[
            &fixture.deployment.oracle,
            &fixture.deployment.pool,
            &fixture.deployment.registry,
        ])
        .call()
        .await
        .unwrap_err();
    assert!(error.to_string().contains("TierDisabled"), "{error:#}");

    // ...while the new tier sells the new product on the same account,
    // which is already sessionless after the close above.
    let opened = start_turbo_session(&fixture).await;
    assert_eq!(opened.tier_id, TURBO_TIER_ID);
    assert_eq!(
        pool.methods()
            .session_turbo_terms(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(turbo_terms(DRAWDOWN_SCHEDULE)),
    );

    // And the switch is reversible - it closes a shop, it does not burn one.
    pool.methods()
        .set_tier_enabled(TIER_ID, true)
        .call()
        .await
        .unwrap();
    assert!(
        pool.methods()
            .is_tier_enabled(TIER_ID)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
    );
}

/// The entry is a price: the fee leaves at the door, the deposit leaves at
/// the close, and a break-even user walks away with exactly nothing — while
/// every coin is accounted to the platform.
#[tokio::test]
async fn a_turbo_entry_is_forfeited_whole_and_the_walkaway_is_profits_only() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;

    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let opened = open_turbo_session(&fixture).await;
    // The purchase posts NOTHING: the ledger opens at zero, the line whole.
    assert_eq!(opened.collateral, 0);
    assert_eq!(opened.open_fee, TURBO_FEE);
    assert_eq!(opened.fees_accrued, 0);
    assert_eq!(opened.credit_line, LINE);
    // The anchor is `V` at open: the line, exactly.
    let view = rollover_view(&fixture).await;
    assert_eq!(view.anchor, LINE);
    assert_eq!(view.rollovers_used, 0);
    assert_eq!(view.max_rollovers, 3);
    assert_eq!(view.profit_required, ROLLOVER_BAR);
    // The fee half of the price reached the platform inside the opening call.
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        platform_before + TURBO_FEE as u128
    );

    // A break-even close: the deposit is forfeited, not refunded.
    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let response = fixture.close_session().await;
    let closed = fixture.closed_event(&response);
    assert_eq!(closed.user_net, 0);
    assert!(closed.payout_parent.is_empty());
    let settled = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<TicketSettled>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(settled.len(), 1);
    assert_eq!(settled[0].ticket, TURBO_DEPOSIT);
    assert_eq!(
        settled[0].to_platform, TURBO_DEPOSIT,
        "no loss, so no absorption"
    );
    assert_eq!(settled[0].absorbed_by_pool, 0);
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        platform_before + TURBO_ENTRY as u128,
        "the platform's whole take is the price: fee at the door, deposit at the close"
    );
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        parent_before,
        "a break-even prepaid user gets exactly nothing back"
    );
}

/// A prepaid ticket cannot be NETTED away - structurally.
///
/// `draw -> repay_from_collateral` moves no coins, so it slips past every
/// gate that watches value leaving. Under the old deposit-as-collateral
/// model that walk made a non-refundable entry refundable in two calls and
/// a guard had to chase it. Now the ticket never enters `collateral` at
/// all: the session's ledger is zero, `amount <= collateral` refuses every
/// netting by plain arithmetic, and there is no guard left to get wrong.
#[tokio::test]
async fn a_prepaid_ticket_cannot_be_netted_away() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;

    let platform_before = fixture
        .deployer
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    open_turbo_session(&fixture).await;

    // Draw the deposit, then try to net it against funded collateral.
    let draw = fixture.draw_call(TURBO_DEPOSIT);
    fixture.call_account(vec![draw], 1).await.unwrap();
    let repay = fixture.repay_from_collateral_call(TURBO_DEPOSIT);
    let error = fixture.call_account(vec![repay], 0).await.unwrap_err();
    let refusal = format!("{error:?}");
    assert!(
        refusal.contains("INSUFFICIENT_BALANCE")
            || refusal.contains("InsufficientBalance"),
        "there is no collateral to net - the ticket is not in the ledger: {refusal}"
    );
    assert_eq!(
        fixture.session().await.collateral,
        0,
        "the refused netting moved nothing, and there was nothing to move"
    );

    // Hand the draw back the honest way and close: the ticket is forfeited in
    // full and the user walks away with nothing.
    let ret = fixture.pool_call(
        fn_selector!(return_quote(u64)),
        TURBO_DEPOSIT,
        fixture.collateral_asset,
        Some(call_data!(TURBO_DEPOSIT)),
    );
    fixture.call_account(vec![ret], 0).await.unwrap();

    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let response = fixture.close_session().await;
    let closed = fixture.closed_event(&response);
    assert_eq!(closed.user_net, 0);
    let settled = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<TicketSettled>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(settled.len(), 1);
    assert_eq!(
        settled[0].to_platform, TURBO_DEPOSIT,
        "the whole deposit reaches the platform"
    );
    assert_eq!(
        fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        platform_before + TURBO_ENTRY as u128,
        "the platform's take is the whole price"
    );
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        parent_before,
        "and the parent gets nothing back"
    );
}

/// A prepaid session takes a top-up on the same terms as a legacy one, from
/// an outsider included.
///
/// It once refused every funder, and the reason was the rollover bar: a gift
/// raises `V` without being earned, so an outsider could buy a user his free
/// week. The bar no longer counts outside money — the keeper supplies what
/// arrived and the pool nets it off — so the ban lost its reason and went
/// with it. A gift now does what a gift should: it funds the line, and it is
/// still there for the user at settlement.
#[tokio::test]
async fn a_top_up_lands_on_a_prepaid_session_as_it_does_on_a_legacy_one() {
    let fixture = PropFixture::new().await;

    // The legacy fixture session accepts an outside top-up, exactly as before.
    fixture.fund_collateral(100_000).await;
    assert_eq!(fixture.session().await.collateral, COLLATERAL + 100_000);

    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .add_collateral(fixture.child_id)
        .call_params(CallParameters::new(
            100_000,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .call()
        .await
        .expect("an outsider may fund a prepaid session's line");

    // It landed, and it landed as LINE: the gift is the ONLY collateral a
    // prepaid session ever has - the entry itself posted nothing.
    let session = fixture.session().await;
    assert_eq!(session.collateral, 100_000);
}

/// The prepaid floor counts LATER fees. A top-up is the one collateral a
/// prepaid session has, `repay_base_from_collateral` is the one call that
/// accrues a fee against it - and the pool leg then pays the top-up back
/// out NET of that fee. Pinned as a boundary, one unit each way, because
/// every other prepaid test runs with `fees_accrued` at zero.
#[tokio::test]
async fn a_topped_up_seat_withdraws_its_top_up_net_of_later_fees() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    let top_up = 100_000u64;
    fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.user.clone())
        .methods()
        .add_collateral(fixture.child_id)
        .call_params(CallParameters::new(
            top_up,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .call()
        .await
        .unwrap();

    // Borrow a sliver of base and net it back out of the top-up: 10^7 base
    // units cost 20_000 quote at the 2.0 ask, plus the 100 ppm fee of 2.
    let quantity = 10_000_000u64;
    let value = 20_000u64;
    let fee = 2u64;
    let borrow = fixture.pool_call(
        fn_selector!(borrow(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, quantity)),
    );
    fixture.call_account(vec![borrow], 1).await.unwrap();
    let repay = fixture.repay_base_from_collateral_call(fixture.base_asset, quantity);
    fixture.call_account(vec![repay], 1).await.unwrap();

    let session = fixture.session().await;
    assert_eq!(session.collateral, top_up - value);
    assert_eq!(session.fees_accrued, fee);

    // One unit past the fee-netted top-up is refused by name...
    let withdrawable = top_up - value - fee;
    let over = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, withdrawable + 1)),
    );
    let error = fixture.call_account(vec![over], 2).await.unwrap_err();
    let refusal = format!("{error:?}");
    assert!(
        refusal.contains("BELOW_TIER_COLLATERAL")
            || refusal.contains("BelowTierCollateral"),
        "the fee's cover may not leave: {refusal}"
    );

    // ...and the exact figure goes home, leaving only the fee's cover.
    let take = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, withdrawable)),
    );
    fixture.call_account(vec![take], 2).await.unwrap();
    assert_eq!(fixture.session().await.collateral, fee);
}

/// The flat journey: no profit means no rollover — not due before the
/// window, not earned inside it — and expiry forfeits the stake.
#[tokio::test]
async fn a_flat_turbo_session_earns_nothing_and_expires_into_forfeit() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    advance_past_expiry(&fixture).await;

    // Nothing was earned, so the ONE deadline call absorbs rather than
    // rolling. There is no separate refusal to observe any more: the
    // outcome IS the observation.
    let response = try_expire(&fixture).await.unwrap();
    let closed = fixture.closed_event(&response);
    assert!(matches!(closed.reason, SettlementReason::Expiry));
    let settled = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<TicketSettled>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(settled.len(), 1);
    assert_eq!(settled[0].ticket, TURBO_DEPOSIT);
    assert_eq!(settled[0].to_platform, TURBO_DEPOSIT);

    // A zero-activity seat owes nothing and is routed nothing: the ticket
    // the pool already holds settles the whole exit, so the five-term
    // identity closes at zero on both sides.
    let seized = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<SessionSeized>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(seized.len(), 1);
    assert!(seized[0].debt.is_empty(), "{:?}", seized[0].debt);
    assert!(
        seized[0].transferred.is_empty(),
        "{:?}",
        seized[0].transferred
    );
}

/// The winning journey, end to end: a 20% gain outranks the deadline, the
/// roll is free and re-bases the anchor, and the escalator's next step then
/// holds the winner to 2% below the NEW anchor — where the static floor
/// would have let the whole profit burn back off.
#[tokio::test]
async fn a_nine_percent_winner_is_rolled_by_the_expiry_trigger() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // Long one whole base at 2.0, then mark it at 4.0: +2_000_000 of profit,
    // twice the 1_000_000 the rollover demands.
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture
        .publish_base_price(4_000_000_000_000_000_000u128)
        .await;
    assert_eq!(fixture.session_value().await, 12_000_000);

    let expires_before = fixture.session().await.expires_at;
    advance_past_expiry(&fixture).await;

    // The deadline does not take the earned extension away - it GRANTS it.
    // One permissionless trigger ends the term, and what it does with it
    // depends only on what the session earned: the anchor re-bases to the
    // valuation that earned it and the deadline moves a week from where it
    // stood.
    let response = try_roll(&fixture).await.unwrap();
    let rolled = response
        .decode_logs_with_type::<SessionRolledOver>()
        .unwrap();
    assert_eq!(rolled.len(), 1);
    assert_eq!(rolled[0].rollovers_used, 1);
    assert_eq!(rolled[0].max_rollovers, 3);
    assert_eq!(rolled[0].anchor, 12_000_000);
    assert_eq!(rolled[0].profit_required, ROLLOVER_BAR);
    assert_eq!(rolled[0].new_expires_at, expires_before + 604_800);
    assert_eq!(fixture.session().await.expires_at, expires_before + 604_800);

    // The second period gives the whole gain back: `V` returns to the line.
    // He is NOT liquidated for that. The drawdown is sold on the account
    // SIZE, so handing back profit lands him exactly where he started, with
    // the second term's allowance still ahead of him - a floor that had
    // re-anchored to his 12_000_000 peak would have taken the account here,
    // which is the trailing drawdown this product does not sell.
    fixture
        .publish_base_price(2_000_000_000_000_000_000u128)
        .await;
    assert_eq!(fixture.session_value().await, 10_000_000);
    let lines = fixture.lines().await;
    // The line: 10_000_000 − the escalator's second step (2% of the line)
    // + the absorption cost of the 2_000_000 position it still holds
    // (1% haircut = 20_000), which rides ON TOP of the user's allowance
    // rather than flooring it.
    assert_eq!(lines.threshold, U256::from(9_820_000u64));
    assert!(
        !fixture.is_liquidatable().await,
        "giving back the gain is not a loss of principal"
    );

    // Only a real loss past the term's allowance takes him. At 1.8 the
    // basket is worth 1_800_000, so `V` is 9_800_000 against a line of
    // 10_000_000 − 200_000 + 18_000 = 9_818_000.
    fixture
        .publish_base_price(1_800_000_000_000_000_000u128)
        .await;
    assert_eq!(fixture.session_value().await, 9_800_000);
    assert_eq!(fixture.lines().await.threshold, U256::from(9_818_000u64));
    assert!(fixture.is_liquidatable().await);
    let closed = fixture.closed_event(&fixture.liquidate().await);
    assert!(matches!(closed.reason, SettlementReason::Liquidation));
    assert!(
        closed.payout_parent.is_empty(),
        "the forfeited stake absorbed the loss and the rest went to the platform"
    );
}

/// A withdrawal leaves the anchor FIXED and grows a separate `withdrawn`
/// tally. The anchor is the rollover BAR's baseline, so moving it would sell
/// a free week for money that was only passed through; the tally is what
/// keeps genuinely banked profit counting toward the next rollover.
///
/// The drawdown floor is not involved either way - it is derived from the
/// tier's LINE, so no sequence of deposits and withdrawals can widen it.
#[tokio::test]
async fn withdrawing_banked_profit_leaves_the_anchor_fixed() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // Cash resting on the account with no draw and no debt is profit by
    // construction — placed directly, as the withdraw suite does.
    let banked = 100_000u64;
    fixture
        .user
        .force_transfer_to_contract(
            fixture.child_id,
            banked,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
    // Nothing is reserved against banked profit: the fee was part of the
    // purchase, never a charge owed by the session, so the whole of it is
    // the user's to take.
    let withdrawable = banked;
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, withdrawable)),
    );
    let response = fixture.call_account(vec![withdraw], 2).await.unwrap();
    let recorded = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<RolloverWithdrawalRecorded>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(recorded.len(), 1);
    assert_eq!(recorded[0].amount, withdrawable);
    assert_eq!(recorded[0].withdrawn_total, withdrawable);
    // The anchor is the period-start baseline and does NOT move on a
    // withdrawal - only the withdrawn tally grows. The floor stays put.
    let view = rollover_view(&fixture).await;
    assert_eq!(view.anchor, LINE);
    assert_eq!(view.withdrawn, withdrawable);
}

/// The accepted-loss tail, proven on chain: a tier may sell a drawdown
/// wider than the deposit funds, and settlement books the shortfall as bad
/// debt. Here the FIRST step is already 3% of the line — floor 9,700,000,
/// below the pool's 9,750,000 principal — so no rollover is needed to reach
/// it. The line is the anchor less the allowance, never clamped at `k`.
#[tokio::test]
async fn a_tier_can_sell_a_drawdown_wider_than_the_pools_principal() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms([300, 300, 300, 300])).await;
    open_turbo_session(&fixture).await;

    // Flat, at open: the floor is 3% below the line, deeper than the
    // ticket's first-loss bucket reaches - the tail past the ticket is the
    // pool's accepted loss.
    let ticket_edge = LINE - TURBO_DEPOSIT;
    let threshold = fixture.lines().await.threshold;
    assert_eq!(threshold, U256::from(LINE - LINE * 300 / 10_000));
    assert!(
        threshold < U256::from(ticket_edge),
        "the sold drawdown reaches past the ticket"
    );

    // Trade down past it and be liquidated into bad debt.
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture
        .publish_base_price(1_500_000_000_000_000_000u128)
        .await;
    assert!(fixture.is_liquidatable().await);

    let bad_debt_before = fixture.bad_debt().await;
    let closed = fixture.closed_event(&fixture.liquidate().await);
    assert!(matches!(closed.reason, SettlementReason::Liquidation));
    assert!(
        closed.bad_debt != 0,
        "a liquidation below the principal must book the shortfall"
    );
    assert_eq!(fixture.bad_debt().await, bad_debt_before + closed.bad_debt);
}

/// The rule the product settled on: the weekly target is a FLAT 9% of the
/// account size — $900 on a $10K account, every week, never re-based — and
/// a withdrawal during the week still counts toward it.
///
/// This is the case that makes the two halves inseparable. A user who makes
/// $2K and banks it ends the week with his NAV back at the line, so a naive
/// "did NAV grow by 9%?" test would refuse him the rollover he earned. The
/// anchor is what remembers: it falls by exactly what left, so `V - anchor`
/// still reads the whole $2K. Algebraically it is the same quantity as
/// `(NAV + withdrawn) - start`, and this test pins it end to end.
#[tokio::test]
async fn a_banked_week_still_counts_toward_a_target_that_never_moves() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // ...and a prepaid one identifies as prepaid, carrying the exact terms
    // it was sold under.
    assert_eq!(
        fixture
            .deployment
            .pool
            .methods()
            .session_turbo_terms(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(turbo_terms(DRAWDOWN_SCHEDULE)),
    );

    let opening = rollover_view(&fixture).await;
    assert_eq!(opening.anchor, LINE);
    assert_eq!(opening.profit_required, ROLLOVER_BAR);

    // ── Make 2_000_000 — more than twice the 900_000 bar ─────────────────
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture
        .publish_base_price(4_000_000_000_000_000_000u128)
        .await;
    assert_eq!(fixture.session_value().await, 12_000_000);

    // ── Bank it: sell out, clear the draw, take the profit off the desk ──
    fixture
        .rest_order(4_000_000, quantity, fixture.collateral_asset, 4_000_000)
        .await;
    let sell = fixture.book_call(4_000_000, quantity, fixture.base_asset, quantity);
    let return_quote = fixture.pool_call(
        fn_selector!(return_quote()),
        cost,
        fixture.collateral_asset,
        None,
    );
    fixture
        .call_account(vec![sell, fixture.settle_book_call(), return_quote], 2)
        .await
        .unwrap();
    let banked = fixture.account_balance(fixture.collateral_asset).await
        - fixture.session().await.fees_accrued;
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, banked)),
    );
    fixture.call_account(vec![withdraw], 2).await.unwrap();

    // His NAV is back where he started — a naive NAV test would say he made
    // nothing this week.
    let nav = fixture.session_value().await;
    assert!(
        nav < (LINE + ROLLOVER_BAR) as i128,
        "the banked user's NAV is back near the line: {nav}"
    );

    let banked_view = rollover_view(&fixture).await;
    // The target did NOT move with him: still a flat 900_000.
    assert_eq!(
        banked_view.profit_required, ROLLOVER_BAR,
        "the weekly target is a flat share of the account size, never re-based"
    );
    // The anchor stays at the period start; the withdrawal is tallied
    // separately, so the week still scores the whole 2_000_000 he made:
    // `(V + withdrawn) - anchor`.
    assert_eq!(banked_view.anchor, LINE);
    assert_eq!(banked_view.withdrawn, banked);
    assert_eq!(
        nav + banked_view.withdrawn as i128 - banked_view.anchor as i128,
        2_000_000
    );

    // ── And he rolls, on a week whose NAV grew by almost nothing ─────────
    advance_past_expiry(&fixture).await;
    // Banking the profit must not cost him the week he earned: the expiry
    // trigger rolls him instead of closing him.
    let response = try_roll(&fixture).await.unwrap();
    let rolled = response
        .decode_logs_with_type::<SessionRolledOver>()
        .unwrap();
    assert_eq!(rolled.len(), 1);
    assert_eq!(rolled[0].rollovers_used, 1);
    // Next week's bar is the same 900_000, measured from the new baseline.
    assert_eq!(rolled[0].profit_required, ROLLOVER_BAR);
    assert_eq!(rolled[0].anchor as i128, nav);
    assert_eq!(rollover_view(&fixture).await.profit_required, ROLLOVER_BAR);
}

/// A PARTIAL withdrawal still counts: a user who made just over the bar and
/// took only part of it home has profit split across two places - what still
/// rests on the desk (`V - anchor`) and what he withdrew (`withdrawn`). Here
/// NEITHER half reaches the 900_000 bar on its own; only the sum does, and
/// the rollover gate must read the sum. This is the mirror of the banked-week
/// test, which drove `V` all the way back to the line - here both terms are
/// load-bearing at once.
#[tokio::test]
async fn a_partial_withdrawal_still_earns_the_rollover_on_the_sum() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    assert_eq!(rollover_view(&fixture).await.anchor, LINE);

    // Make exactly 1_000_000 - just over the 900_000 bar. Long one base at
    // 2.0, mark it at 3.0.
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture
        .publish_base_price(3_000_000_000_000_000_000u128)
        .await;
    assert_eq!(fixture.session_value().await, 11_000_000);

    // Realise it: sell the base back at 3.0 and clear the draw, leaving
    // 1_000_000 of quote profit resting on the account.
    fixture
        .rest_order(3_000_000, quantity, fixture.collateral_asset, 3_000_000)
        .await;
    let sell = fixture.book_call(3_000_000, quantity, fixture.base_asset, quantity);
    let return_quote = fixture.pool_call(
        fn_selector!(return_quote()),
        cost,
        fixture.collateral_asset,
        None,
    );
    fixture
        .call_account(vec![sell, fixture.settle_book_call(), return_quote], 2)
        .await
        .unwrap();

    // Take home only HALF: withdraw 500_000 of the 1_000_000 earned.
    let taken = 500_000u64;
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, taken)),
    );
    fixture.call_account(vec![withdraw], 2).await.unwrap();

    // 500_000 still rests on the desk and 500_000 was withdrawn. Neither
    // half reaches the 900_000 bar; the sum is the whole 1_000_000 he made.
    let nav = fixture.session_value().await;
    assert_eq!(nav, 10_500_000);
    let view = rollover_view(&fixture).await;
    assert_eq!(view.anchor, LINE);
    assert_eq!(view.withdrawn, taken);
    let on_desk = nav - LINE as i128;
    assert!(
        on_desk < ROLLOVER_BAR as i128 && (view.withdrawn as i128) < ROLLOVER_BAR as i128,
        "neither half alone clears the bar: on_desk={on_desk}, withdrawn={}",
        view.withdrawn
    );
    assert_eq!(on_desk + view.withdrawn as i128, 1_000_000);

    // And so he rolls: the gate reads `V + withdrawn`, not `V` alone.
    advance_past_expiry(&fixture).await;
    // A partial withdrawal must not cost him the week he earned.
    let response = try_roll(&fixture).await.unwrap();
    let rolled = response
        .decode_logs_with_type::<SessionRolledOver>()
        .unwrap();
    assert_eq!(rolled.len(), 1);
    assert_eq!(rolled[0].rollovers_used, 1);
    // The new period re-anchors at the current valuation and clears the tally.
    assert_eq!(rolled[0].anchor as i128, nav);
    assert_eq!(rollover_view(&fixture).await.withdrawn, 0);
}

// ---------------------------------------------------------------------------
// The product's user stories, as agreed with product — each test is one
// sentence from that conversation, proven on chain.
// ---------------------------------------------------------------------------

/// "7 day only account." The tier sells the week by NAME: any other period
/// is refused at the door, and the week runs exactly its 604_800 seconds —
/// there is no hand-crafted `start_session(.., Month)` that buys five weeks
/// for the price of one.
#[tokio::test]
async fn a_turbo_account_sells_exactly_seven_days() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    fixture.close_session().await;

    for period in [
        ProlongPeriod::SixHours,
        ProlongPeriod::Day,
        ProlongPeriod::Month,
    ] {
        let error = fixture
            .account
            .methods()
            .start_session(TURBO_TIER_ID, TURBO_ENTRY, period.clone())
            .call_params(CallParameters::new(
                TURBO_ENTRY,
                fixture.collateral_asset,
                u64::MAX,
            ))
            .unwrap()
            .with_contracts(&[
                &fixture.deployment.oracle,
                &fixture.deployment.pool,
                &fixture.deployment.registry,
            ])
            .call()
            .await
            .unwrap_err();
        assert!(
            error.to_string().contains("PeriodNotOffered"),
            "{period:?} must be refused by name, not by price: {error:#}"
        );
    }

    let opened = start_turbo_session(&fixture).await;
    assert_eq!(
        opened.expires_at - opened.started_at,
        604_800,
        "the week is the whole term - the tier's base duration is pinned to zero"
    );
}

/// "So basically, a user can pay for 1 week and get 3 free weeks." The
/// headline journey: one payment, three earned rollovers with the drawdown
/// widening each week, and after the cap even a profitable week ends the
/// account — the profits going home with the user.
#[tokio::test]
async fn one_payment_buys_at_most_four_weeks_and_the_last_profit_goes_home() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // One position, held for a month: 1 whole base bought at 2.0. Each
    // week's +1.0 price print is +1_000_000 of profit - comfortably past
    // the 900_000 bar.
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    // Weeks 1-3: earn, expire refused, roll free, drawdown steps.
    let mut price = 2_000_000_000_000_000_000u128;
    for week in 1u64..=3 {
        price += 1_000_000_000_000_000_000;
        fixture.publish_base_price(price).await;
        advance_past_expiry(&fixture).await;
        // Captured BEFORE the trigger, which now moves the deadline itself.
        let expires_before = fixture.session().await.expires_at;
        let response = try_roll(&fixture).await.unwrap();
        let rolled = response
            .decode_logs_with_type::<SessionRolledOver>()
            .unwrap();
        assert_eq!(rolled.len(), 1);
        assert_eq!(rolled[0].rollovers_used, week, "free week number {week}");
        assert_eq!(rolled[0].new_expires_at, expires_before + 604_800);

        // The drawdown escalator stepped WITH the roll: the live line is
        // the ACCOUNT SIZE less this week's allowance, plus the 1% haircut
        // cost of the held basket - every term exact.
        let anchor = rolled[0].anchor;
        assert!(
            anchor > LINE,
            "a winner's anchor climbs with him: {anchor} at week {}",
            week + 1
        );
        let allowance = LINE * DRAWDOWN_SCHEDULE[week as usize] / 10_000;
        let basket_value = (price / 1_000_000_000_000) as u64;
        let absorption = basket_value / 100;
        let lines = fixture.lines().await;
        assert_eq!(
            lines.threshold,
            U256::from(LINE - allowance + absorption),
            "week {}'s drawdown is {} bps of the LINE, not of the anchor \
             the roll just set",
            week + 1,
            DRAWDOWN_SCHEDULE[week as usize],
        );
    }

    // Week 4 is profitable TOO - but the cap is spent, so the deadline wins
    // and the account ends, forfeiting the stake and paying the profit out.
    fixture.publish_base_price(6_500_000_000_000_000_000).await;
    advance_past_expiry(&fixture).await;
    let response = try_expire(&fixture).await.unwrap();
    let closed = fixture.closed_event(&response);
    assert!(matches!(closed.reason, SettlementReason::Expiry));
    assert!(
        closed.user_net != 0,
        "the month's profit goes home with the user"
    );
    assert!(!closed.payout_parent.is_empty());
    let settled = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<TicketSettled>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(settled.len(), 1);
    assert_eq!(settled[0].ticket, TURBO_DEPOSIT);
    assert_eq!(settled[0].to_platform, TURBO_DEPOSIT);
}

/// "1.5% max drawdown" — in the FIRST week, before any roll: trading down
/// past 150_000 on the 10_000_000 line is the end of the account, and the
/// money reconciles to the unit.
#[tokio::test]
async fn the_first_week_liquidates_at_the_sold_drawdown() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // Long 1 base at 2.0, then a -10% print: -200_000 of the 150_000 the
    // first week allows.
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture.publish_base_price(1_800_000_000_000_000_000).await;

    // The line: anchor 10_000_000 - 150_000 + the 1% absorption cost of
    // the 1_800_000 basket = 9_868_000. V is 9_800_000 - under it.
    let lines = fixture.lines().await;
    assert_eq!(lines.threshold, U256::from(9_868_000u64));
    assert_eq!(fixture.session_value().await, 9_800_000);
    assert!(fixture.is_liquidatable().await);

    let response = fixture.liquidate().await;
    let closed = fixture.closed_event(&response);
    assert!(matches!(closed.reason, SettlementReason::Liquidation));
    // Money, to the unit: profit = -2_000_000 drawn + 1_800_000*0.99
    // credited = -218_000; the 250_000 ticket absorbs the loss first and
    // the 32_000 residue is the platform's; the user is paid nothing and
    // the pool books no bad debt.
    let settled = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<TicketSettled>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(settled.len(), 1);
    assert_eq!(settled[0].ticket, 250_000);
    assert_eq!(settled[0].absorbed_by_pool, 218_000);
    assert_eq!(settled[0].to_platform, 32_000);
    assert_eq!(closed.bad_debt, 0);
    assert!(closed.payout_parent.is_empty());
    assert_eq!(closed.user_net, 0);

    // The forced-exit routing keeps the five-term identity whole with the
    // TICKET on the held side - the pool has held those coins since the
    // open. The liquidator is billed only the true shortfall:
    // 2_000_000 drawn + 32_000 paid out - 250_000 ticket = 1_782_000,
    // exactly the basket value handed over - and is routed no cash.
    let seized = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<SessionSeized>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(seized.len(), 1);
    assert_eq!(
        seized[0].debt,
        vec![(fixture.collateral_asset, 1_782_000)],
        "the shortfall must not re-bill the ticket the pool already holds"
    );
    assert!(
        !seized[0]
            .transferred
            .iter()
            .any(|(asset, _)| *asset == fixture.collateral_asset),
        "no session quote remains to route: {:?}",
        seized[0].transferred
    );
}

/// "$250 for $10K / $150 for $5k / $75 for $2.5K" — the three price points
/// are one shape at three sizes, and each forfeits exactly its own deposit.
#[tokio::test]
async fn every_price_point_forfeits_its_own_deposit() {
    let fixture = PropFixture::new().await;
    fixture.close_session().await;

    // (tier_id, line, price): deposit = line/40, fee = line/400.
    for (tier_id, line) in [(8u64, 5_000_000u64), (9u64, 2_500_000u64)] {
        let deposit = line / 40;
        let fee = line / 400;
        let price = deposit + fee;
        fixture
            .deployment
            .pool
            .methods()
            .publish_tier_v2(
                tier_id,
                turbo_tier_params_for(line),
                turbo_terms(DRAWDOWN_SCHEDULE),
                vec![fixture.order_book.contract_id],
            )
            .with_contract_ids(&[
                fixture.order_book.contract_id,
                fixture.deployment.price_feed_id,
            ])
            .call()
            .await
            .unwrap();

        let platform_before = fixture
            .deployer
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap();
        let parent_before = fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap();
        fixture
            .account
            .methods()
            .start_session(tier_id, price, ProlongPeriod::Week)
            .call_params(CallParameters::new(
                price,
                fixture.collateral_asset,
                u64::MAX,
            ))
            .unwrap()
            .with_contracts(&[
                &fixture.deployment.oracle,
                &fixture.deployment.pool,
                &fixture.deployment.registry,
            ])
            .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
            .call()
            .await
            .unwrap();
        let response = fixture.close_session().await;
        let settled = fixture
            .deployment
            .pool
            .log_decoder()
            .decode_logs_with_type::<TicketSettled>(&response.tx_status.receipts)
            .unwrap();
        assert_eq!(settled.len(), 1, "line {line}");
        assert_eq!(settled[0].ticket, deposit, "line {line}");
        assert_eq!(settled[0].to_platform, deposit, "line {line}");
        assert_eq!(
            fixture
                .deployer
                .get_asset_balance(&fixture.collateral_asset)
                .await
                .unwrap(),
            platform_before + price as u128,
            "line {line}: the platform's whole take is the price"
        );
        assert_eq!(
            fixture
                .user
                .get_asset_balance(&fixture.collateral_asset)
                .await
                .unwrap(),
            parent_before - price as u128,
            "line {line}: a break-even user is out exactly the price"
        );
    }
}

/// "Profits can be withdrawn immediately as long as all open positions are
/// closed" — with the position open the withdrawal is refused; flat, the
/// same withdrawal pays the parent.
#[tokio::test]
async fn profits_withdraw_only_once_positions_are_closed() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // Banked cash on the account, and an OPEN position beside it.
    let banked = 100_000u64;
    fixture
        .user
        .force_transfer_to_contract(
            fixture.child_id,
            banked,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
    let quantity = 500_000_000u64;
    let cost = 1_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    let withdrawable = banked;
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, withdrawable)),
    );
    let error = fixture
        .call_account(vec![withdraw.clone()], 2)
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("QuoteOutstanding"),
        "an open position blocks the withdrawal: {error:#}"
    );

    // Close the position - sell it back and return the draw - and the SAME
    // withdrawal goes through, to the parent's wallet.
    fixture
        .rest_order(2_000_000, quantity, fixture.collateral_asset, cost)
        .await;
    let sell = fixture.book_call(2_000_000, quantity, fixture.base_asset, quantity);
    let return_quote = fixture.pool_call(
        fn_selector!(return_quote()),
        cost,
        fixture.collateral_asset,
        None,
    );
    fixture
        .call_account(vec![sell, fixture.settle_book_call(), return_quote], 2)
        .await
        .unwrap();
    let parent_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    fixture.call_account(vec![withdraw], 2).await.unwrap();
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        parent_before + withdrawable as u128,
        "flat, the profit is the user's immediately"
    );
}

/// "I will not close their orders" — a rollover keeps the user's resting
/// book untouched: the order is still working after the roll, and the
/// session trades on.
#[tokio::test]
async fn a_rollover_keeps_the_users_resting_orders() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // Earn the bar with a held position...
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture.publish_base_price(4_000_000_000_000_000_000).await;

    // ...and a resting SELL working on the book: half the base, far above.
    let resting = quantity / 2;
    let sell = fixture.book_call(8_000_000, resting, fixture.base_asset, resting);
    fixture.call_account(vec![sell], 1).await.unwrap();
    let (base_on_book, _) = fixture
        .order_book
        .order_book
        .methods()
        .get_total_balance_of(Identity::ContractId(fixture.child_id))
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert_eq!(base_on_book, resting);

    let session_before = fixture.session().await.session_id;
    advance_past_expiry(&fixture).await;
    try_roll(&fixture).await.unwrap();

    // The roll moved the deadline and NOTHING else: the resting order is
    // exactly where the user left it.
    let (base_after, _) = fixture
        .order_book
        .order_book
        .methods()
        .get_total_balance_of(Identity::ContractId(fixture.child_id))
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value;
    assert_eq!(
        base_after, resting,
        "a session that keeps its seat keeps its book"
    );
    assert_eq!(
        fixture.session().await.session_id,
        session_before,
        "same session, alive"
    );
}

/// "Extend Account: 20% discount for buying future turbo accounts" — the
/// on-chain half of that story.
///
/// A prepaid entry is a PRICE, not a deposit: the user hands it over and
/// never gets it back, so a discount cuts the WHOLE ticket — the forfeited
/// deposit as well as the fee. (On a legacy tier the deposit is the user's
/// own returnable margin, so only the fee moves there; that twin is pinned
/// separately.)
///
/// What the discount must NOT change is the account he gets. The line stays
/// the tier's line and the anchor stays with it, so a discounted user buys
/// the same size and the same drawdown; the pool funds the difference and
/// eats the shortfall if he is liquidated. That is the marketing cost, and
/// it is deliberate.
#[tokio::test]
async fn a_repurchase_discount_prices_the_whole_prepaid_ticket_down() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    // The first account runs its course.
    fixture.close_session().await;

    // The repurchase grant, exactly as analytics-api would issue it.
    let manager = Identity::Address(fixture.deployer.address());
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(DISCOUNT_MANAGER_ROLE, manager)
        .call()
        .await
        .unwrap();
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            Identity::Address(fixture.user.address()),
            None,
            Some(UserDiscount {
                discount_bps: 2_000,
                scope: DiscountScope::FirstPremium,
            }),
        )
        .call()
        .await
        .unwrap();

    // 20% off the WHOLE ticket: deposit and fee alike.
    let discounted_fee = TURBO_FEE * 8 / 10;
    let discounted_deposit = TURBO_DEPOSIT * 8 / 10;
    let opened =
        start_turbo_session_paying(&fixture, discounted_deposit + discounted_fee).await;
    assert_eq!(
        opened.open_fee, discounted_fee,
        "20% off the entry fee, reported as charged"
    );
    assert_eq!(opened.fees_accrued, 0, "the fee was bought, not owed");

    // ...and he still buys the SAME ACCOUNT. The line does not shrink with
    // the ticket, or a discount would quietly sell a smaller line and a
    // narrower drawdown than the tier advertises.
    assert_eq!(
        opened.credit_line, TURBO_LINE,
        "a discounted ticket buys the tier's full line"
    );
    let rollover = fixture
        .deployment
        .pool
        .methods()
        .get_rollover(fixture.child_id)
        .simulate(Execution::state_read_only())
        .await
        .unwrap()
        .value
        .expect("a rollover-bearing tier anchors at open");
    assert_eq!(
        rollover.anchor, TURBO_LINE,
        "and the bar he must clear is unmoved by the discount"
    );

    // At the close the pool settles the ticket he PAID, not the list price
    // - the bucket holds what actually arrived. His profit is untouched
    // either way: the residue is paid from the pool's own bucket, never
    // from the user's pot.
    fixture
        .deployer
        .force_transfer_to_contract(
            fixture.child_id,
            TURBO_DEPOSIT + 100_000,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
    let response = fixture.close_session().await;
    let settled = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<TicketSettled>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(settled.len(), 1);
    assert_eq!(
        settled[0].ticket, discounted_deposit,
        "the discounted ticket is what the pool holds and settles"
    );
    assert_eq!(settled[0].to_platform, discounted_deposit);
}

/// A non-collateral withdrawal — the one path that reads the oracle — still
/// lowers the anchor, by the BID value of what left, rounded down.
#[tokio::test]
async fn withdrawing_an_asset_lowers_the_anchor_at_the_oracle_bid() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // Base resting on the account with no debt behind it - profit in kind.
    let held = 500_000_000u64;
    fixture
        .user
        .force_transfer_to_contract(
            fixture.child_id,
            held,
            fixture.base_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.base_asset, held)),
    );
    let response = fixture.call_account(vec![withdraw], 2).await.unwrap();
    let recorded = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<RolloverWithdrawalRecorded>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(recorded.len(), 1);
    // 0.5 base at the 2.0 bid = 1_000_000 recorded as withdrawn; the anchor
    // is untouched.
    assert_eq!(recorded[0].amount, 1_000_000);
    assert_eq!(recorded[0].withdrawn_total, 1_000_000);
    let view = rollover_view(&fixture).await;
    assert_eq!(view.anchor, LINE);
    assert_eq!(view.withdrawn, 1_000_000);
}

/// The entry is the price, no more — through BOTH doors. A turbo account is
/// charged exactly once (the fee at open), takes exactly its price and not a
/// unit over, and refuses every top-up afterwards from every funder. There
/// is no way to fund a turbo session past its stake.
#[tokio::test]
async fn a_turbo_account_takes_its_price_and_never_a_unit_more() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    fixture.close_session().await;

    // OVER-POSTING at open is refused, not clamped: a deposit past the price
    // would be extra room out of the drawdown limit that returns at close.
    let error = fixture
        .account
        .methods()
        .start_session(TURBO_TIER_ID, TURBO_ENTRY + 1, ProlongPeriod::Week)
        .call_params(CallParameters::new(
            TURBO_ENTRY + 1,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .with_contracts(&[
            &fixture.deployment.oracle,
            &fixture.deployment.pool,
            &fixture.deployment.registry,
        ])
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("TurboEntryNotExact"),
        "a turbo entry over its price is refused: {error:#}"
    );

    // Under-posting past the required collateral is the existing floor; a
    // penny below the exact price (but at or above the deposit) is the new
    // one. Exactly the price opens.
    let opened = start_turbo_session_paying(&fixture, TURBO_ENTRY).await;
    assert_eq!(opened.collateral, 0, "the purchase posts nothing");
    assert_eq!(opened.open_fee, TURBO_FEE);
    assert_eq!(opened.fees_accrued, 0, "the fee was bought, not owed");

    // The one fee is the ONLY charge the account ever sees before it closes:
    // no period is prolongable (all refused) and the rollover is free. So
    // `fees_accrued` never moves.
    assert_eq!(fixture.session().await.fees_accrued, 0);

    // The exact-price rule governs the ENTRY, not the stake. A later top-up
    // is a different thing and lands normally — from the owner...
    fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.user.clone())
        .methods()
        .add_collateral(fixture.child_id)
        .call_params(CallParameters::new(
            1_000,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .call()
        .await
        .expect("a top-up is no longer refused — the bar nets outside money");

    // ...and from an unrelated third party too.
    fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .add_collateral(fixture.child_id)
        .call_params(CallParameters::new(
            1_000,
            fixture.collateral_asset,
            u64::MAX,
        ))
        .unwrap()
        .call()
        .await
        .expect("a gift funds the line like any other top-up");

    // What is exact is the ENTRY, and that is untouched by any of it: the
    // collateral is exactly the two top-ups - the entry itself is not in it.
    assert_eq!(fixture.session().await.collateral, 1_000 + 1_000);
}

/// Earns roughly `2_000_000` of profit in one week and BANKS all of it to
/// the parent wallet, leaving the session flat with its stake intact and
/// its anchor back at the line. Returns what was withdrawn.
///
/// Buy one base at 2.0, mark it at 4.0, sell it back, clear the draw, and
/// withdraw the realised cash net of the fee reserve — the real shape of a
/// user taking his week's profit off the desk.
async fn earn_and_bank_a_week(fixture: &mut PropFixture) -> u64 {
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture.publish_base_price(2_000_000_000_000_000_000).await;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture.publish_base_price(4_000_000_000_000_000_000).await;
    fixture
        .rest_order(4_000_000, quantity, fixture.collateral_asset, 4_000_000)
        .await;
    let sell = fixture.book_call(4_000_000, quantity, fixture.base_asset, quantity);
    let return_quote = fixture.pool_call(
        fn_selector!(return_quote()),
        cost,
        fixture.collateral_asset,
        None,
    );
    fixture
        .call_account(vec![sell, fixture.settle_book_call(), return_quote], 2)
        .await
        .unwrap();
    let banked = fixture.account_balance(fixture.collateral_asset).await
        - fixture.session().await.fees_accrued;
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, banked)),
    );
    fixture.call_account(vec![withdraw], 2).await.unwrap();
    banked
}

/// The whole life of a turbo account, good weeks and a bad one: pay once,
/// win three weeks and BANK each week's profit to the wallet, roll free
/// each time with the drawdown widening, then on the fourth week — the cap
/// spent — give the session back more than it holds and be liquidated into
/// bad debt. The money reconciles end to end: every banked week is safe in
/// the wallet, the stake is forfeited exactly once, and the loss past the
/// stake is the pool's, not the user's.
#[tokio::test]
async fn the_whole_life_of_a_turbo_account_good_weeks_and_a_bad_one() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;

    open_turbo_session(&fixture).await;
    // Measured from AFTER the entry is paid — the fixture's own legacy
    // session was closed and refunded inside `open_turbo_session`, so the
    // clean baseline is the wallet with the turbo account already open.
    let wallet_after_open = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();

    // ── Weeks 1-3: win, bank the profit, roll free, drawdown widens ──────
    let mut total_banked = 0u64;
    let mut week = 0usize;
    while week < 3 {
        let banked = earn_and_bank_a_week(&mut fixture).await;
        total_banked += banked;

        // Banking dropped the anchor with the profit, so the week still
        // scores what it earned: the roll is due and owed.
        advance_past_expiry(&fixture).await;
        let response = try_roll(&fixture).await.unwrap();
        let rolled = response
            .decode_logs_with_type::<SessionRolledOver>()
            .unwrap();
        assert_eq!(rolled.len(), 1);
        assert_eq!(
            rolled[0].rollovers_used,
            week as u64 + 1,
            "free week number {}",
            week + 1
        );

        // The next week's drawdown is the escalator's next step, measured
        // from the ACCOUNT SIZE. Flat book after the sell, so no absorption
        // cost rides on it: the line is exactly `LINE − allowance`. The
        // anchor moved with the roll and the floor did NOT - that
        // separation is the whole point.
        let anchor = rolled[0].anchor;
        let allowance = LINE * DRAWDOWN_SCHEDULE[week + 1] / 10_000;
        // Reset the mark to the flat 2.0 so the line carries no basket cost.
        fixture.publish_base_price(2_000_000_000_000_000_000).await;
        assert_eq!(
            fixture.lines().await.threshold,
            U256::from(LINE - allowance),
            "week {}'s drawdown is {} bps of the line, and the anchor at \
             {anchor} does not move it",
            week + 2,
            DRAWDOWN_SCHEDULE[week + 1],
        );

        refresh_session_key(&fixture).await;
        week += 1;
    }
    assert_eq!(
        rollover_view(&fixture).await.rollovers_used,
        3,
        "three free weeks earned and consumed"
    );

    // The three banked weeks are already home, safe from whatever week four
    // does: the wallet is up by the withdrawals, less the one entry price.
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        wallet_after_open + total_banked as u128,
        "every banked week is in the wallet"
    );

    // ── Week 4, the bad one: cap spent, and the session gives it all back
    // and then some. Buy a base and let it fall 20% — a 400_000 loss on a
    // stake of 250_000, so profit goes to zero, through zero, and past what
    // the account holds. ──────────────────────────────────────────────────
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture.publish_base_price(1_600_000_000_000_000_000).await;
    assert!(fixture.is_liquidatable().await);

    // The cap is spent: even if it were somehow profitable, no roll remains,
    // so the deadline call ends the account instead of extending it.
    advance_past_expiry(&fixture).await;

    let bad_debt_before = fixture.bad_debt().await;
    let wallet_before_liq = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let closed = fixture.closed_event(&fixture.liquidate().await);
    assert!(matches!(closed.reason, SettlementReason::Liquidation));

    // The session lost more than its stake: the stake is forfeited whole and
    // the shortfall past it is the POOL's bad debt, not the user's — he
    // owes nothing beyond the entry he already paid.
    assert!(
        closed.profit_is_negative,
        "the session's own result is a loss"
    );
    assert!(
        closed.bad_debt != 0,
        "a loss past the stake must land as bad debt"
    );
    assert_eq!(
        fixture.bad_debt().await,
        bad_debt_before + closed.bad_debt,
        "the shortfall is booked, once"
    );
    assert_eq!(
        closed.user_net, 0,
        "a liquidated session pays the user nothing"
    );
    assert!(closed.payout_parent.is_empty());
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        wallet_before_liq,
        "the bad week takes nothing further from the user's banked profit"
    );

    // The account is empty and reusable: no session, no rollover row.
    assert!(
        fixture
            .deployment
            .pool
            .methods()
            .get_session(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
            .is_none()
    );
    assert!(
        fixture
            .deployment
            .pool
            .methods()
            .get_rollover(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
            .is_none()
    );

    // The whole life, reconciled: the user paid one entry, banked three
    // winning weeks, lost the fourth, and walks away UP by the banked profit
    // minus the price — never charged twice, never chased for the bad debt.
    let final_wallet = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    assert_eq!(
        final_wallet,
        wallet_after_open + total_banked as u128,
        "the bad week moved nothing in the wallet; the three good weeks stand"
    );
    assert!(
        total_banked > TURBO_ENTRY,
        "the banked profit dwarfs the one forfeited stake"
    );
}

/// The cohort boundary refuses in both directions: a LEGACY session cannot be
/// handed to the prepaid deadline call, and a turbo session cannot arm the
/// paid auto-renewal a prepaid tier does not offer. Neither product can reach
/// into the other's machinery.
#[tokio::test]
async fn the_cohort_boundary_refuses_each_product_the_others_machinery() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;

    // The fixture's own live session is on the LEGACY tier, and the call is
    // properly COSIGNED — so the refusal under test is the cohort one and
    // nothing else. A legacy session has no terms and nothing to roll; its
    // deadline belongs to the permissionless `expire_session`.
    let error = try_expire(&fixture).await.unwrap_err();
    assert!(
        error.to_string().contains("UsePermissionlessExpiry"),
        "a legacy deadline is settled by `expire_session`: {error:#}"
    );

    open_turbo_session(&fixture).await;

    // The paid auto-renewal cannot be armed, because a prepaid tier prices no
    // period — the free rollover is its only extension. Checked while the
    // session key is still live: the account's key outlives an hour, not a
    // week, so anything routed through `call_account` has to happen before
    // the clock jumps.
    let arm = fixture.pool_call(
        fn_selector!(set_auto_prolong(Option<ProlongPeriod>)),
        0,
        AssetId::default(),
        Some(call_data!(Some(ProlongPeriod::Day))),
    );
    let error = fixture.call_account(vec![arm], 0).await.unwrap_err();
    assert!(
        error.to_string().contains("PeriodNotOffered"),
        "a prepaid tier prices no period to arm: {error:#}"
    );

    // The other direction, and the one that keeps the prepaid promise: a
    // TURBO session handed to the permissionless call is refused rather than
    // absorbed. Absorbing it there would take away a week it may have
    // earned, decided by a caller who never had to say what arrived from
    // outside — which is the whole reason the prepaid deadline is cosigned.
    advance_past_expiry(&fixture).await;
    let error = try_legacy_expire(&fixture, fixture.deployer.clone())
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("UseExpireOrRollover"),
        "a prepaid deadline is settled by `expire_or_rollover`: {error:#}"
    );
    // An OUTSIDER gets the same answer — the permissionless door is closed to
    // this cohort by cohort, not by caller.
    let error = try_legacy_expire(&fixture, fixture.outsider.clone())
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("UseExpireOrRollover"),
        "the refusal is by cohort, not by caller: {error:#}"
    );
    // Past its deadline and still standing: the refusals settled nothing.
    assert!(
        fixture.session_opt().await.is_some(),
        "a refused deadline leaves the session untouched"
    );
}

/// The prepaid deadline is gated by a SIGNATURE, not by a caller, and the
/// difference is the point: `outside` is the keeper's word about how much of
/// the session's value arrived by transfer rather than being earned, and the
/// pool cannot check it. So the pool authorises the FIGURE — any relayer may
/// carry a signed one, and nobody can submit an unsigned one.
#[tokio::test]
async fn the_prepaid_deadline_takes_only_a_figure_its_own_cosigner_signed() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    advance_past_expiry(&fixture).await;

    // The wrong key. The outsider signs the very same bytes, and the pool
    // recovers an address that is not its cosigner.
    let forged = expiry_cosignature(&fixture, 0, false, fixture.outsider.clone()).await;
    let error = settle_with(&fixture, 0, false, forged, None)
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("InvalidExpiryCosigner"),
        "only the pool's own cosigner can settle a prepaid deadline: {error:#}"
    );

    // The right key, the WRONG figure. `outside` is signed over, so a
    // signature issued for 900_000 cannot be re-presented as zero — which is
    // exactly the substitution that would forge a free week.
    let for_another_figure =
        expiry_cosignature(&fixture, 900_000, false, fixture.deployer.clone()).await;
    let error = settle_with(&fixture, 0, false, for_another_figure, None)
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("InvalidExpiryCosigner"),
        "the signature pins the figure it authorised: {error:#}"
    );

    // Still standing: two refusals settled nothing.
    assert!(fixture.session_opt().await.is_some());

    // And the submitter is nobody in particular. The OUTSIDER carries a
    // signature the cosigner made, and it settles — that is what "authorise
    // the figure, not the caller" buys: the backend signs, any relayer pays
    // the gas.
    let signed = expiry_cosignature(&fixture, 0, false, fixture.deployer.clone()).await;
    let response = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .expire_or_rollover(fixture.child_id, vec![], 0, false, signed)
        .with_contracts(&[
            &fixture.account,
            &fixture.deployment.oracle,
            &fixture.order_book.order_book,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::EstimateMinimum)
        .call()
        .await
        .unwrap();
    assert!(matches!(
        fixture.closed_event(&response).reason,
        SettlementReason::Expiry
    ));
}

/// Before governance arms a cosigner the prepaid deadline does not settle AT
/// ALL — it does not fall open to anyone. A pool with no cosigner refuses
/// every settlement rather than accepting any signature, which is the loud
/// failure rather than the silent one.
#[tokio::test]
async fn an_unarmed_pool_settles_no_prepaid_deadline() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier_unarmed(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    advance_past_expiry(&fixture).await;

    assert!(
        fixture
            .deployment
            .pool
            .methods()
            .expiry_cosigner()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
            .is_none(),
        "the pool starts with no expiry cosigner"
    );

    let error = try_expire(&fixture).await.unwrap_err();
    assert!(
        error.to_string().contains("ExpiryCosignerNotSet"),
        "an unarmed pool refuses rather than accepting anyone: {error:#}"
    );
    assert!(fixture.session_opt().await.is_some());

    // Arming it is all that was missing.
    fixture
        .deployment
        .pool
        .methods()
        .set_expiry_cosigner(fixture.deployer.address())
        .call()
        .await
        .unwrap();
    let response = try_expire(&fixture).await.unwrap();
    assert!(matches!(
        fixture.closed_event(&response).reason,
        SettlementReason::Expiry
    ));
}

/// The cosigner is the POOL's, set by its own governance — not borrowed from
/// the account oracle. The two are independent addresses, and the oracle's
/// cosigner has no standing at the pool.
#[tokio::test]
async fn the_pool_keeps_its_own_expiry_cosigner_not_the_oracles() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier_unarmed(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    advance_past_expiry(&fixture).await;

    // Arm the pool with a DIFFERENT key from the one the oracle cosigns
    // batches with, and prove the pool follows its own.
    fixture
        .deployment
        .pool
        .methods()
        .set_expiry_cosigner(fixture.outsider.address())
        .call()
        .await
        .unwrap();
    assert_eq!(
        fixture
            .deployment
            .pool
            .methods()
            .expiry_cosigner()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value,
        Some(fixture.outsider.address())
    );

    // The oracle's cosigner — the deployer, who signs every batch in this
    // suite — is now the wrong key here.
    let error = try_expire(&fixture).await.unwrap_err();
    assert!(
        error.to_string().contains("InvalidExpiryCosigner"),
        "the pool does not defer to the oracle's cosigner: {error:#}"
    );

    // The pool's own key settles it.
    let signed = expiry_cosignature(&fixture, 0, false, fixture.outsider.clone()).await;
    let response = settle_with(&fixture, 0, false, signed, None).await.unwrap();
    assert!(matches!(
        fixture.closed_event(&response).reason,
        SettlementReason::Expiry
    ));
}

/// Only governance arms the cosigner. An outsider who could set it could
/// settle every prepaid deadline in the pool on his own word.
#[tokio::test]
async fn only_governance_arms_the_expiry_cosigner() {
    let fixture = PropFixture::new().await;
    let error = fixture
        .deployment
        .pool
        .clone()
        .with_account(fixture.outsider.clone())
        .methods()
        .set_expiry_cosigner(fixture.outsider.address())
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("AccessControlNotAuthorized"),
        "arming the cosigner is governance's alone: {error:#}"
    );
}

/// A gift is not a gain. Someone transfers the whole rollover bar straight
/// into the account — no trade, no risk — and the keeper reports it. The pool
/// nets it off and the week is not earned.
///
/// This is the attack the whole `outside` mechanism exists for: `holdings`
/// reads `balance_of(account, asset)`, so a transfer and a trading profit are
/// the same number to the chain. Only the keeper can tell them apart.
#[tokio::test]
async fn a_transferred_gift_does_not_buy_the_free_week() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // Flat: nothing earned, nothing lost.
    let value_before = fixture.session_value().await;

    // An outsider transfers the bar straight in. Nothing on chain marks this
    // as a gift rather than a gain.
    fixture
        .outsider
        .force_transfer_to_contract(
            fixture.child_id,
            ROLLOVER_BAR,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
    assert_eq!(
        fixture.session_value().await,
        value_before + ROLLOVER_BAR as i128,
        "the pool values the gift exactly as it would value a profit"
    );

    advance_past_expiry(&fixture).await;

    // Declared, the gift buys nothing: the pool subtracts it from its own bar
    // and refuses the roll rather than absorbing on a disagreement.
    let error = try_settle(&fixture, ROLLOVER_BAR, true).await.unwrap_err();
    assert!(
        error.to_string().contains("RolloverNotEarned"),
        "a declared gift is netted off the bar: {error:#}"
    );

    // And the declaration is the ONLY thing standing between the gift and a
    // free week — with it reported as zero the very same session rolls. That
    // is why the figure is cosigned rather than passed by whoever calls.
    try_roll(&fixture).await.unwrap();
}

/// Earned profit still rolls with a gift sitting alongside it. `outside` nets
/// off what arrived, never what was made — a user who genuinely earned his
/// week does not lose it because someone sent him money.
#[tokio::test]
async fn a_gift_alongside_real_profit_does_not_cost_the_earned_week() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // Earn the bar the honest way: long a base at 2.0, mark it at 4.0.
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture
        .publish_base_price(4_000_000_000_000_000_000u128)
        .await;

    // ...and receive a gift on top.
    let gift = 300_000u64;
    fixture
        .outsider
        .force_transfer_to_contract(
            fixture.child_id,
            gift,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();

    advance_past_expiry(&fixture).await;

    // The gift is declared and netted; the trading profit alone still clears
    // the bar, so the week is granted.
    let response = try_settle(&fixture, gift, true).await.unwrap();
    let rolled = response
        .decode_logs_with_type::<SessionRolledOver>()
        .unwrap();
    assert_eq!(rolled.len(), 1, "the earned week survives the netting");
    assert_eq!(rolled[0].rollovers_used, 1);
}

/// The front-run the signed decision exists to stop.
///
/// The settlement transaction is public. An attacker who reads `outside: 0`
/// out of the mempool can transfer the shortfall in ahead of it — and the pool
/// cannot tell that gift from a gain. Before the decision was signed, the
/// keeper's own call would then have granted the week. With it signed, the
/// keeper said ABSORB and absorb is what happens, whatever the balance says by
/// the time the call lands.
#[tokio::test]
async fn a_gift_landing_after_the_keeper_signed_cannot_turn_an_absorb_into_a_roll() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    advance_past_expiry(&fixture).await;

    // The keeper looks at a flat session, sees nothing earned, and signs
    // ABSORB with `outside: 0` — a true statement when it was made.
    let signature =
        expiry_cosignature(&fixture, 0, false, fixture.deployer.clone()).await;

    // The attacker front-runs it: the bar arrives as a transfer, so by the
    // time the keeper's call executes the pool's own valuation clears the bar.
    fixture
        .outsider
        .force_transfer_to_contract(
            fixture.child_id,
            ROLLOVER_BAR,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();

    // The stale call still lands — and still absorbs. The decision was signed,
    // so the gift bought nothing.
    let response = settle_with(&fixture, 0, false, signature, None)
        .await
        .unwrap();
    assert!(matches!(
        fixture.closed_event(&response).reason,
        SettlementReason::Expiry
    ));

    // The gift was the attacker's own money and it goes home with the user's
    // settlement, exactly like any other balance the account held.
    assert!(fixture.session_opt().await.is_none());
}

/// The decision is bound, so a signature cannot be re-pointed. A cosigned
/// ABSORB cannot be replayed as a roll, and a cosigned ROLL cannot be replayed
/// as an absorb.
#[tokio::test]
async fn a_cosigned_decision_cannot_be_flipped() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    advance_past_expiry(&fixture).await;

    let for_absorb =
        expiry_cosignature(&fixture, 0, false, fixture.deployer.clone()).await;
    let error = settle_with(&fixture, 0, true, for_absorb, None)
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("InvalidExpiryCosigner"),
        "an absorb signature does not authorise a roll: {error:#}"
    );

    let for_roll = expiry_cosignature(&fixture, 0, true, fixture.deployer.clone()).await;
    let error = settle_with(&fixture, 0, false, for_roll, None)
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("InvalidExpiryCosigner"),
        "a roll signature does not authorise an absorb: {error:#}"
    );
    assert!(fixture.session_opt().await.is_some());
}

/// A cosigned roll the pool disagrees with is REFUSED, not absorbed. Keeper
/// and pool disagreeing about what was earned is not a reason to settle the
/// user — it is a reason to stop, so the keeper can resubmit on figures they
/// both accept.
#[tokio::test]
async fn a_roll_the_pool_disagrees_with_is_refused_rather_than_absorbed() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    advance_past_expiry(&fixture).await;

    // Flat session, keeper asks for a roll anyway.
    let error = try_roll(&fixture).await.unwrap_err();
    assert!(
        error.to_string().contains("RolloverNotEarned"),
        "the pool keeps its veto over granting a week: {error:#}"
    );

    // Nothing settled: the session is still there for a correct call.
    assert!(fixture.session_opt().await.is_some());
    let response = try_expire(&fixture).await.unwrap();
    assert!(matches!(
        fixture.closed_event(&response).reason,
        SettlementReason::Expiry
    ));
}

/// A gift routed through `add_collateral` is the OTHER way outside money
/// reaches the bar, and it has to be netted just the same.
///
/// A top-up raises `collateral` — and the bar reads the session's value, of
/// which funded collateral is a part — while the anchor stays where the period
/// started. So an outsider funding a line moves the session toward its bar
/// exactly as a raw transfer does, and the keeper has to count both.
#[tokio::test]
async fn a_top_up_reaches_the_bar_like_any_other_outside_money() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    let value_before = fixture.session_value().await;
    fixture.fund_collateral(ROLLOVER_BAR).await;
    assert_eq!(
        fixture.session_value().await,
        value_before + ROLLOVER_BAR as i128,
        "a top-up moves the session's value as much as a transfer does"
    );

    advance_past_expiry(&fixture).await;
    let error = try_settle(&fixture, ROLLOVER_BAR, true).await.unwrap_err();
    assert!(
        error.to_string().contains("RolloverNotEarned"),
        "an outsider's top-up is outside money too: {error:#}"
    );
}

/// Donate, withdraw, repeat. `withdrawn` and `outside` are both cumulative
/// within a period, so a round trip nets to nothing however many times it is
/// run — the bar cannot be pumped by cycling the same coins.
#[tokio::test]
async fn cycling_the_same_coins_through_the_account_pumps_nothing() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    let cycle = 400_000u64;
    let mut donated = 0u64;
    for _ in 0..3 {
        fixture
            .outsider
            .force_transfer_to_contract(
                fixture.child_id,
                cycle,
                fixture.collateral_asset,
                TxPolicies::default(),
            )
            .await
            .unwrap();
        donated += cycle;

        // Straight back out to the parent wallet. `withdraw` credits the
        // period's `withdrawn` tally, which the bar adds back — so a coin that
        // arrived and left has to cancel exactly.
        let withdraw = fixture.pool_call(
            fn_selector!(withdraw(AssetId, u64)),
            0,
            AssetId::default(),
            Some(call_data!(fixture.collateral_asset, cycle)),
        );
        fixture.call_account(vec![withdraw], 2).await.unwrap();
    }

    advance_past_expiry(&fixture).await;

    // Three round trips of the bar's own size, and the session is exactly as
    // unearned as it started.
    let error = try_settle(&fixture, donated, true).await.unwrap_err();
    assert!(
        error.to_string().contains("RolloverNotEarned"),
        "a round trip nets to nothing, however many times it runs: {error:#}"
    );
}

/// A gift cannot widen the sold drawdown either. The floor is fixed to the
/// LINE the tier sold, so money arriving from outside raises the account's
/// value without moving the liquidation threshold under it.
#[tokio::test]
async fn a_gift_does_not_move_the_liquidation_floor() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    assert_eq!(fixture.lines().await.threshold, U256::from(9_850_000u64));
    fixture
        .outsider
        .force_transfer_to_contract(
            fixture.child_id,
            1_000_000,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
    assert_eq!(
        fixture.lines().await.threshold,
        U256::from(9_850_000u64),
        "the floor is the tier's, not the balance's"
    );
}

/// Settling twice takes nothing twice. Once a deadline is settled the session
/// is gone, and a second cosigned call finds nothing to settle.
#[tokio::test]
async fn a_settled_deadline_cannot_be_settled_again() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;
    advance_past_expiry(&fixture).await;

    // Sign TWO absorbs over the same live session, then spend one.
    let second = expiry_cosignature(&fixture, 0, false, fixture.deployer.clone()).await;
    try_expire(&fixture).await.unwrap();
    assert!(fixture.session_opt().await.is_none());

    let error = settle_with(&fixture, 0, false, second, None)
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("NoActiveSession"),
        "a spent deadline has nothing left to settle: {error:#}"
    );
}

/// A cosignature does not let the keeper act EARLY, in either direction.
///
/// This is the pool's own gate rather than the keeper's good behaviour, and
/// it is what bounds the damage a compromised cosigner could do: `absorb`
/// requires the deadline to have passed, and `roll_at_expiry` refuses before
/// it. So the worst a bad signature can do to a live session is nothing.
#[tokio::test]
async fn a_cosigned_settlement_cannot_act_before_the_deadline() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // The clock has NOT been moved: the session is live and mid-term.

    // A cosigned ABSORB is refused — the pool checks the deadline itself.
    let error = try_expire(&fixture).await.unwrap_err();
    assert!(
        error.to_string().contains("NotExpired"),
        "a live session cannot be absorbed on anyone's say-so: {error:#}"
    );

    // ...and a cosigned ROLL is refused too, even from a session that would
    // clear the bar: the free week extends FROM the deadline, so granting it
    // early would hand out a week the term had not yet used.
    fixture.fund_collateral(2_000_000).await;
    let error = try_roll(&fixture).await.unwrap_err();
    assert!(
        error.to_string().contains("RolloverNotEarned"),
        "a week cannot be claimed before the term runs out: {error:#}"
    );

    // Live and untouched throughout.
    let session = fixture.session().await;
    assert_eq!(session.collateral, 2_000_000);
    assert_eq!(
        fixture
            .deployment
            .pool
            .methods()
            .get_rollover(fixture.child_id)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
            .expect("still anchored")
            .rollovers_used,
        0,
        "no week was spent"
    );
}

/// Banking profit must not widen the sold drawdown. A user who makes his
/// week's profit and withdraws all of it sits back at the line, and is still
/// liquidated at 1.5% below it — the anchor is the period-start baseline and
/// a withdrawal does not lower it. Under a withdrawal-reduced anchor the
/// floor would drop with the money and let him lose far past the sold limit.
#[tokio::test]
async fn banking_profit_does_not_widen_the_sold_drawdown() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // At open, flat: the floor is 1.5% below the line.
    assert_eq!(fixture.lines().await.threshold, U256::from(9_850_000u64));

    // Make 2_000_000 and bank all of it (sell out, clear the draw, withdraw).
    let banked = earn_and_bank_a_week(&mut fixture).await;
    assert!(banked > 0);

    // Back at the line, flat. The floor is STILL 9_850_000: the anchor did
    // not follow the withdrawal down. The old reducing anchor put it at
    // line − banked − allowance, ~20% of room.
    fixture.publish_base_price(2_000_000_000_000_000_000).await;
    let view = rollover_view(&fixture).await;
    assert_eq!(view.anchor, LINE);
    assert_eq!(view.withdrawn, banked);
    assert_eq!(fixture.lines().await.threshold, U256::from(9_850_000u64));

    // A 10% move against a fresh position (−200_000, past the 150_000
    // allowance) liquidates him — which the widened floor would not have.
    let quantity = 1_000_000_000u64;
    let cost = 2_000_000u64;
    fixture
        .rest_order(2_000_000, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(2_000_000, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();
    fixture.publish_base_price(1_800_000_000_000_000_000).await;
    assert!(fixture.is_liquidatable().await);
}

/// A DISCOUNTED user's profit leaves as freely as a full-price user's.
///
/// Under the old deposit-as-collateral model this was the blocker bug: the
/// floor was the LIST deposit and a discounted ticket posted less, so every
/// withdrawal reverted for the life of the account. Zero-collateral removes
/// the floor entirely - nothing the user posted stands behind the line, so
/// his profit is his and the pool leg simply has nothing to give.
#[tokio::test]
async fn a_discounted_users_profit_withdraws_and_its_ticket_still_does_not() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;

    let manager = Identity::Address(fixture.deployer.address());
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(DISCOUNT_MANAGER_ROLE, manager)
        .call()
        .await
        .unwrap();
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            Identity::Address(fixture.user.address()),
            None,
            Some(UserDiscount {
                discount_bps: 5_000,
                scope: DiscountScope::FirstPremium,
            }),
        )
        .call()
        .await
        .unwrap();

    fixture.close_session().await;
    let entry = (TURBO_DEPOSIT + TURBO_FEE) / 2;
    start_turbo_session_paying(&fixture, entry).await;

    // Profit lands on the account as cash.
    let profit = 100_000u64;
    fixture
        .deployer
        .force_transfer_to_contract(
            fixture.child_id,
            profit,
            fixture.collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();

    // ...and leaves again, in full: `from_pool` is zero, so only a floor
    // read off RAW collateral would refuse this.
    let wallet_before = fixture
        .user
        .get_asset_balance(&fixture.collateral_asset)
        .await
        .unwrap();
    let withdraw = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, profit)),
    );
    fixture
        .call_account(vec![withdraw], 2)
        .await
        .expect("a discounted session's profit is the user's to take");
    assert_eq!(
        fixture
            .user
            .get_asset_balance(&fixture.collateral_asset)
            .await
            .unwrap(),
        wallet_before + u128::from(profit),
        "the whole profit reached the wallet"
    );

    // The TICKET stays where it is: one unit past the profit would have to
    // come from the pool leg, and a prepaid session's pool leg holds only
    // what a top-up added - here, nothing.
    let over = fixture.pool_call(
        fn_selector!(withdraw(AssetId, u64)),
        0,
        AssetId::default(),
        Some(call_data!(fixture.collateral_asset, 1_000u64)),
    );
    let error = fixture.call_account(vec![over], 2).await.unwrap_err();
    assert!(
        error.to_string().contains("BelowTierCollateral"),
        "the discounted ticket is no more withdrawable than a full-price \
         one: {error:#}"
    );
}

/// A prepaid session that ends holding a POSITION still settles its ticket
/// to the platform in full, and keeps its winnings.
///
/// Such a session cannot close itself — `close_session` refuses an
/// outstanding draw, and it can neither pay the draw in cash (it spent the
/// cash on the position) nor net a ticket it never had. The deadline is how
/// it really ends, and the settlement has to unwind three things at once:
/// repay the pool, settle the ticket, and pay the gain out in kind.
///
/// The old model needed an in-kind forfeit leg for this shape - the ticket
/// sat in `collateral` and could be converted into a tier asset. It cannot
/// any more: the ticket is quote the POOL has held since the open, so the
/// residue is one cash transfer whatever the session holds at close.
#[tokio::test]
async fn a_prepaid_session_holding_a_position_forfeits_its_ticket_at_the_deadline() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;
    open_turbo_session(&fixture).await;

    // Draw, and spend the draw on base at 2.0.
    let price = 2_000_000u64;
    let cost = 200_000u64;
    let quantity = cost * 1_000_000_000 / price;
    fixture
        .rest_order(price, quantity, fixture.base_asset, quantity)
        .await;
    let draw = fixture.draw_call(cost);
    let buy = fixture.book_call(price, quantity, fixture.collateral_asset, cost);
    fixture
        .call_account(vec![draw, buy, fixture.settle_book_call()], 2)
        .await
        .unwrap();

    // The position quadruples, and the draw is still owed.
    fixture
        .publish_base_price(8_000_000_000_000_000_000u128)
        .await;
    assert_eq!(
        fixture.session().await.drawn_quote,
        cost,
        "the draw cannot be cleared: no cash, and the ticket is not nettable"
    );

    let parent_base_before = fixture
        .user
        .get_asset_balance(&fixture.base_asset)
        .await
        .unwrap();
    advance_past_expiry(&fixture).await;
    let response = try_expire(&fixture).await.unwrap();

    // The whole ticket reaches the platform, in cash.
    let settled = fixture
        .deployment
        .pool
        .log_decoder()
        .decode_logs_with_type::<TicketSettled>(&response.tx_status.receipts)
        .unwrap();
    assert_eq!(settled.len(), 1);
    assert_eq!(
        settled[0].to_platform, TURBO_DEPOSIT,
        "the entry is non-refundable however the session ends"
    );

    // ...and the gain goes home to the parent, in kind.
    let base_paid = fixture
        .user
        .get_asset_balance(&fixture.base_asset)
        .await
        .unwrap()
        - parent_base_before;
    assert!(
        base_paid > 0,
        "the winnings are the user's: {:?}",
        fixture.closed_event(&response)
    );
}

/// A FULLY forgiven prepaid entry still cannot be opened - but the boundary
/// has moved, and is now one guard wide.
///
/// The POOL no longer minds: every prepaid session opens on zero collateral,
/// so a zero-priced seat is just the ordinary open with a zero payment. What
/// refuses it is the ACCOUNT's own `start_session`, which will not forward a
/// zero amount (`AmountIsZero`) - and the pool then refuses any non-zero
/// payment because a prepaid entry must equal its price exactly
/// (`TurboEntryNotExact`). The grant succeeds and the user is locked out.
///
/// Pinned rather than fixed: lifting it is one `require` in the account
/// contract plus a product decision that a free prepaid seat exists. A 90%
/// grant - the deepest discount the suite exercises live - opens normally,
/// so the boundary is exactly at 100%.
#[tokio::test]
async fn a_fully_forgiven_prepaid_entry_cannot_be_opened() {
    let fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;

    let manager = Identity::Address(fixture.deployer.address());
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(DISCOUNT_MANAGER_ROLE, manager)
        .call()
        .await
        .unwrap();
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            Identity::Address(fixture.user.address()),
            None,
            Some(UserDiscount {
                discount_bps: 10_000,
                scope: DiscountScope::FirstPremium,
            }),
        )
        .call()
        .await
        .expect("the pool admits a fully forgiven premium");
    fixture.close_session().await;

    // Paying the price — which is now zero — forwards nothing.
    let error = fixture
        .account
        .methods()
        .start_session(TURBO_TIER_ID, 0, ProlongPeriod::Week)
        .call_params(CallParameters::new(0, fixture.collateral_asset, u64::MAX))
        .unwrap()
        .with_contracts(&[
            &fixture.deployment.oracle,
            &fixture.deployment.pool,
            &fixture.deployment.registry,
        ])
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("AmountIsZero"),
        "a zero entry forwards no coins at all: {error:#}"
    );

    // ...and paying anything else is not the price.
    let error = fixture
        .account
        .methods()
        .start_session(TURBO_TIER_ID, 1, ProlongPeriod::Week)
        .call_params(CallParameters::new(1, fixture.collateral_asset, u64::MAX))
        .unwrap()
        .with_contracts(&[
            &fixture.deployment.oracle,
            &fixture.deployment.pool,
            &fixture.deployment.registry,
            &fixture.deployment.price_feed,
        ])
        .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
        .call()
        .await
        .unwrap_err();
    assert!(
        error.to_string().contains("TurboEntryNotExact"),
        "a prepaid entry must equal its price exactly: {error:#}"
    );
}

/// The COLLATERAL WALK, on a discounted session.
///
/// `draw -> repay_from_collateral -> withdraw` was the shape that once made
/// a non-refundable entry refundable: net the funded deposit onto the
/// account, then drain it through the account leg. A discounted session was
/// the hardest case, because the subsidy arithmetic gave the guard two
/// numbers to disagree about. There is nothing to disagree about now - the
/// ticket never enters `collateral`, so the netting finds a zero ledger and
/// refuses on plain arithmetic, at any discount.
#[tokio::test]
async fn a_discounted_session_cannot_walk_its_ticket_out_through_the_netting() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;

    let manager = Identity::Address(fixture.deployer.address());
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(DISCOUNT_MANAGER_ROLE, manager)
        .call()
        .await
        .unwrap();
    fixture
        .deployment
        .pool
        .methods()
        .set_user_discount(
            Identity::Address(fixture.user.address()),
            None,
            Some(UserDiscount {
                discount_bps: 5_000,
                scope: DiscountScope::FirstPremium,
            }),
        )
        .call()
        .await
        .unwrap();
    fixture.close_session().await;
    let entry = (TURBO_DEPOSIT + TURBO_FEE) / 2;
    let opened = start_turbo_session_paying(&fixture, entry).await;
    assert_eq!(
        opened.credit_line, TURBO_LINE,
        "a discounted ticket still buys the whole line"
    );

    // Draw the deposit and try to net it back against funded collateral. The
    // walk never gets as far as the withdrawal: a prepaid session may net only
    // what it ADDED, and this one has added nothing.
    let deposit_paid = TURBO_DEPOSIT / 2;
    let draw = fixture.draw_call(deposit_paid);
    fixture.call_account(vec![draw], 1).await.unwrap();
    let repay = fixture.repay_from_collateral_call(deposit_paid);
    let error = fixture.call_account(vec![repay], 0).await.unwrap_err();
    let refusal = format!("{error:?}");
    assert!(
        refusal.contains("INSUFFICIENT_BALANCE")
            || refusal.contains("InsufficientBalance"),
        "there is no collateral to net at any discount: {refusal}"
    );

    // The ledger is untouched, and the draw is still outstanding — the user
    // repays it with his own coins or carries it to settlement.
    let session = fixture.session().await;
    assert_eq!(session.collateral, 0, "the refused netting moved nothing");
    assert_eq!(session.drawn_quote, deposit_paid);
}

/// EVERY discount rate opens the same session: zero collateral, the whole
/// line, and the ticket out of reach because it is not in the ledger at
/// all. There is no subsidy arithmetic left to get wrong - the sweep now
/// proves the ABSENCE of rate-dependence rather than a delicate identity.
#[tokio::test]
async fn every_discount_rate_opens_exactly_on_the_floor_with_the_whole_line() {
    let mut fixture = PropFixture::new().await;
    publish_turbo_tier(&fixture, turbo_terms(DRAWDOWN_SCHEDULE)).await;

    let manager = Identity::Address(fixture.deployer.address());
    fixture
        .deployment
        .pool
        .methods()
        .grant_role(DISCOUNT_MANAGER_ROLE, manager)
        .call()
        .await
        .unwrap();
    // The fixture opens on its legacy session; the sweep needs the account
    // free before the first pass.
    fixture.close_session().await;

    // 0% (the control), 20%, 50%, 90% — and 99%, a rate whose deposit rounds
    // to a handful of units.
    for discount_bps in [0u64, 2_000, 5_000, 9_000, 9_900] {
        fixture
            .deployment
            .pool
            .methods()
            .set_user_discount(
                Identity::Address(fixture.user.address()),
                None,
                Some(UserDiscount {
                    discount_bps,
                    scope: DiscountScope::AllPremiums,
                }),
            )
            .call()
            .await
            .unwrap();

        let rate = 10_000 - discount_bps;
        let deposit = TURBO_DEPOSIT * rate / 10_000;
        let fee = TURBO_FEE * rate / 10_000;
        let opened = start_turbo_session_paying(&fixture, deposit + fee).await;

        assert_eq!(
            opened.credit_line, TURBO_LINE,
            "{discount_bps} bps off must still buy the tier's whole line"
        );
        assert_eq!(
            opened.collateral, 0,
            "{discount_bps} bps: the purchase posts nothing at any rate"
        );

        // Not a unit may leave a ledger that holds nothing...
        let over = fixture.pool_call(
            fn_selector!(withdraw(AssetId, u64)),
            0,
            AssetId::default(),
            Some(call_data!(fixture.collateral_asset, 1u64)),
        );
        let error = fixture.call_account(vec![over], 2).await.unwrap_err();
        let refusal = format!("{error:?}");
        assert!(
            refusal.contains("BELOW_TIER_COLLATERAL")
                || refusal.contains("BelowTierCollateral")
                || refusal.contains("InsufficientBalance"),
            "{discount_bps} bps: the ticket must be stuck: {refusal}"
        );

        // ...and profit sitting on the account leaves in full.
        let profit = 50_000u64;
        fixture
            .deployer
            .force_transfer_to_contract(
                fixture.child_id,
                profit,
                fixture.collateral_asset,
                TxPolicies::default(),
            )
            .await
            .unwrap();
        let take = fixture.pool_call(
            fn_selector!(withdraw(AssetId, u64)),
            0,
            AssetId::default(),
            Some(call_data!(fixture.collateral_asset, profit)),
        );
        fixture
            .call_account(vec![take], 2)
            .await
            .unwrap_or_else(|error| {
                panic!("{discount_bps} bps: profit must be withdrawable: {error:#}")
            });

        fixture.close_session().await;
    }
}