hopper_runtime/

account.rs

//! Hopper-owned account view for Solana programs.
//!
//! `AccountView` is the canonical typed state gateway for Hopper programs.
//! It wraps Hopper Native's account representation behind a transparent
//! representation boundary and delegates account operations to that layer.
//!
//! Key capabilities:
//! - Chainable validation (`check_signer()?.check_writable()?`)
//! - Whole-layout typed access (`load::<T>()`, `load_mut::<T>()`)
//! - Segment-aware typed access (`segment_ref`, `segment_mut`)
//! - Explicit raw escape hatches (`raw_ref`, `raw_mut`)
//! - Hopper header reading (disc, version, layout_id)
//! - Packed flags for batch validation
//! - Remaining accounts iterator

use crate::address::{address_eq, Address};
use crate::borrow::{Ref, RefMut};
use crate::borrow_registry::{self, BorrowToken};
use crate::error::ProgramError;
use crate::field_map::FieldInfo;
use crate::layout::LayoutContract;
use crate::native_boundary::{self, BackendAccountView};
use crate::segment_borrow::SegmentBorrowRegistry;
use crate::ProgramResult;

/// Release the first `count` registered borrows during a
/// `split_segments_mut` rollback.
///
/// # Safety
///
/// The first `count` entries of `recs` must be initialized `SegmentBorrow`
/// records registered in `reg`.
#[inline]
unsafe fn release_registered<const N: usize>(
    reg: &mut SegmentBorrowRegistry,
    recs: &[core::mem::MaybeUninit<crate::segment_borrow::SegmentBorrow>; N],
    count: usize,
) {
    let mut j = 0;
    while j < count {
        // SAFETY: caller guarantees `recs[j]` is an initialized, registered borrow.
        unsafe {
            reg.release(recs[j].assume_init_ref());
        }
        j += 1;
    }
}

// ══════════════════════════════════════════════════════════════════════
//  AccountView -- Hopper's canonical typed state gateway
// ══════════════════════════════════════════════════════════════════════

/// Zero-copy view over a Solana account.
///
/// `AccountView` is the single canonical type for account access in
/// Hopper programs. It wraps Hopper Native's account representation and
/// exposes a Hopper-owned API surface.
///
/// The `#[repr(transparent)]` layout guarantees that `&[native::AccountView]`
/// can be safely reinterpreted as `&[AccountView]` at the entrypoint
/// boundary with zero conversion cost.
#[repr(transparent)]
pub struct AccountView<'info> {
    inner: BackendAccountView<'info>,
}

const _: () = {
    assert!(
        core::mem::size_of::<AccountView<'static>>()
            == core::mem::size_of::<BackendAccountView<'static>>()
    );
    assert!(
        core::mem::align_of::<AccountView<'static>>()
            == core::mem::align_of::<BackendAccountView<'static>>()
    );
    assert!(!core::mem::needs_drop::<AccountView<'static>>());
};

// SAFETY: On Solana execution is single-threaded. Host tools and fuzzers
// should not rely on cross-thread sharing of raw account pointers.
#[cfg(target_os = "solana")]
unsafe impl<'info> Send for AccountView<'info> {}
#[cfg(target_os = "solana")]
unsafe impl<'info> Sync for AccountView<'info> {}

impl<'info> Clone for AccountView<'info> {
    #[inline(always)]
    fn clone(&self) -> Self {
        Self::from_inner(self.backend().clone())
    }
}

impl<'info> PartialEq for AccountView<'info> {
    #[inline(always)]
    fn eq(&self, other: &Self) -> bool {
        self.backend() == other.backend()
    }
}

impl<'info> Eq for AccountView<'info> {}

impl<'info> AccountView<'info> {
    // Crate-visible: the lazy bridge (`crate::lazy`) wraps substrate
    // views it receives one at a time from the native parser.
    #[inline(always)]
    pub(crate) fn from_inner(inner: BackendAccountView<'info>) -> Self {
        Self { inner }
    }

    #[inline(always)]
    fn backend(&self) -> &BackendAccountView<'info> {
        &self.inner
    }

    #[cfg(test)]
    #[inline(always)]
    pub(crate) fn from_backend(inner: BackendAccountView<'info>) -> Self {
        Self::from_inner(inner)
    }

    // ── Getters ──────────────────────────────────────────────────────

    /// The account's public key.
    #[inline(always)]
    pub fn address(&self) -> &Address {
        native_boundary::account_address(self.backend())
    }

    /// The owning program's address.
    ///
    /// # Safety
    ///
    /// The returned reference is invalidated if the account is assigned
    /// to a new owner. The caller must ensure no concurrent mutation.
    #[inline(always)]
    pub unsafe fn owner(&self) -> &Address {
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        unsafe { native_boundary::account_owner(self.backend()) }
    }

    /// Read the owner address as a copy (safe, no aliasing hazard).
    #[inline(always)]
    pub fn read_owner(&self) -> Address {
        native_boundary::read_owner(self.backend())
    }

    /// Whether this account is owned by the given program.
    #[inline(always)]
    pub fn owned_by(&self, program: &Address) -> bool {
        native_boundary::owned_by(self.backend(), program)
    }

    /// Whether this account signed the transaction.
    #[inline(always)]
    pub fn is_signer(&self) -> bool {
        self.backend().is_signer()
    }

    /// Whether this account is writable in the transaction.
    #[inline(always)]
    pub fn is_writable(&self) -> bool {
        self.backend().is_writable()
    }

    /// Whether this account contains an executable program.
    #[inline(always)]
    pub fn executable(&self) -> bool {
        self.backend().executable()
    }

    /// Current data length in bytes.
    #[inline(always)]
    pub fn data_len(&self) -> usize {
        self.backend().data_len()
    }

    /// Current lamport balance.
    #[inline(always)]
    pub fn lamports(&self) -> u64 {
        self.backend().lamports()
    }

    /// Whether the account data is empty.
    #[inline(always)]
    pub fn is_data_empty(&self) -> bool {
        self.data_len() == 0
    }

    /// Try to set the lamport balance.
    ///
    /// Backends such as `solana-program` enforce lamport borrow rules at
    /// runtime. Use this in framework code so borrow conflicts return a
    /// `ProgramError` instead of panicking.
    #[inline(always)]
    pub fn try_set_lamports(&self, lamports: u64) -> ProgramResult {
        native_boundary::try_set_lamports(self.backend(), lamports)
    }

    /// Set the lamport balance.
    #[inline(always)]
    pub fn set_lamports(&self, lamports: u64) -> ProgramResult {
        self.try_set_lamports(lamports)
    }

    // ── Borrow tracking ─────────────────────────────────────────────

    /// Try to obtain a shared borrow of the account data.
    #[inline(always)]
    pub fn try_borrow(&self) -> Result<Ref<'_, [u8]>, ProgramError> {
        let token = BorrowToken::shared(self.address())?;
        match self.backend().try_borrow() {
            Ok(data) => Ok(Ref::from_backend(data, token)),
            Err(error) => {
                drop(token);
                Err(ProgramError::from(error))
            }
        }
    }

    /// Try to obtain an exclusive (mutable) borrow of the account data.
    ///
    /// Touch-map note: this RAW byte surface does not stamp the touch
    /// log, segment leases route their exclusive borrows through here
    /// and would smear every narrow lease into a whole-account record,
    /// destroying the map's field precision. The TYPED whole-account
    /// surfaces ([`load_mut`](Self::load_mut) /
    /// [`load_compact_mut`](Self::load_compact_mut)) record instead.
    ///
    /// Ambient-gate note: under a bound `strict_writes` context this raw
    /// whole-account write borrow is governed, the instruction-ambient
    /// gate refuses it unless the declared policy covers the full data
    /// range, closing the historical "raw borrow bypasses the write
    /// policy" surface. With no gate installed the check is one load and
    /// branch. Segment leases use the crate-internal ungated variant
    /// because they gate the exact range themselves; the migration crank
    /// uses it under its own `check_migratable` authorization (a
    /// whole-layout transform, distinct from the byte-range gate; see the
    /// crate-private `try_borrow_mut_ungated` helper.
    #[inline(always)]
    pub fn try_borrow_mut(&self) -> Result<RefMut<'_, [u8]>, ProgramError> {
        let len = self.data_len();
        if len > 0 {
            crate::write_policy::check_data_mutation(self.address(), 0, len as u32)?;
        }
        self.try_borrow_mut_ungated()
    }

    /// Ungated exclusive borrow: the borrow-registry token and backend
    /// borrow WITHOUT the instruction-ambient write-gate check. Only for
    /// crate-internal plumbing whose caller supplies its OWN
    /// authorization before delegating:
    ///
    /// - Segment leases gate the exact requested range against the
    ///   installed byte-range policy, then take the ungated borrow.
    /// - The migration crank ([`crate::migrate`]) does not consult the
    ///   byte-range gate at all, a layout migration rewrites the whole
    ///   body by construction, which no byte-range policy would permit.
    ///   It is governed instead by its own `check_migratable`
    ///   authorization (the account must be writable and owned by the
    ///   executing program) run before this borrow. That is a DISTINCT
    ///   authorization from the `strict_writes` gate, not "the same
    ///   installed policy": a strict handler that also calls
    ///   `hopper::migration::*` is explicitly invoking a whole-layout
    ///   transform, not smuggling a byte write past its own declaration.
    ///
    /// Never expose publicly: doing so would reopen the raw bypass the
    /// gated [`try_borrow_mut`](Self::try_borrow_mut) split closes.
    #[inline(always)]
    pub(crate) fn try_borrow_mut_ungated(&self) -> Result<RefMut<'_, [u8]>, ProgramError> {
        let token = BorrowToken::mutable(self.address())?;
        match self.backend().try_borrow_mut() {
            Ok(data) => Ok(RefMut::from_backend(data, token)),
            Err(error) => {
                drop(token);
                Err(ProgramError::from(error))
            }
        }
    }

    // ── Segment-aware access ───────────────────────────────────────

    /// Project a typed segment from this account with segment-level
    /// borrow tracking.
    ///
    /// The runtime validates the requested byte range, registers a
    /// **leased** read borrow in the provided instruction-scoped
    /// registry, and returns a [`SegRef<T>`](crate::SegRef) that
    /// releases the lease on drop. This replaces the earlier
    /// "instruction-sticky" behaviour: the registry entry is now tied
    /// to the returned guard's lifetime, so sequential patterns like
    /// `let x = segment_ref…; drop(x); let y = segment_ref…;` work
    /// exactly the way Rust callers expect.
    ///
    /// On the native backend (Solana), the inner `Ref<T>` uses the
    /// flat `{ptr, state}` representation, no dummy slice guard,
    /// no intermediate `Ref<[u8]>`.
    ///
    /// The explicit `'a` lifetime binds the returned `SegRef<'a, T>`
    /// to the shorter of `&self` (the account) and `&mut borrows`
    /// (the registry). Either outliving the other would let the guard
    /// dangle.
    #[inline(always)]
    pub fn segment_ref<'a, T: crate::Pod>(
        &'a self,
        borrows: &'a mut SegmentBorrowRegistry,
        abs_offset: u32,
        size: u32,
    ) -> Result<crate::SegRef<'a, T>, ProgramError> {
        let expected_size = core::mem::size_of::<T>() as u32;
        if size != expected_size {
            return ProgramError::err_invalid_argument();
        }

        let end = abs_offset
            .checked_add(size)
            .ok_or(ProgramError::ArithmeticOverflow)?;
        if end as usize > self.data_len() {
            return ProgramError::err_data_too_small();
        }

        let borrow = borrows.register_leased_read(self.address(), abs_offset, size)?;

        // Build the inner `Ref<T>` via the existing flat/projected path.
        #[cfg(target_os = "solana")]
        let inner: Ref<'_, T> = {
            // SAFETY: size, overflow, and bounds already validated above.
            let native_ref = unsafe { self.backend().segment_ref_unchecked::<T>(abs_offset) };
            let native_ref = match native_ref {
                Ok(nr) => nr,
                Err(e) => {
                    // Native guard could not be taken; undo the lease
                    // we just registered so the instruction-level view
                    // stays consistent.
                    borrows.release(&borrow);
                    return Err(ProgramError::from(e));
                }
            };
            let (typed_ref, state_ptr) = native_ref.into_raw_parts();
            Ref::from_segment(typed_ref as *const T, state_ptr)
        };
        #[cfg(not(target_os = "solana"))]
        let inner: Ref<'_, T> = {
            let data = match self.try_borrow() {
                Ok(d) => d,
                Err(e) => {
                    borrows.release(&borrow);
                    return Err(e);
                }
            };
            // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
            let ptr = unsafe { data.as_bytes_ptr().add(abs_offset as usize) as *const T };
            unsafe { data.project(ptr) }
        };

        // SAFETY: `borrow` was just registered in `borrows`; the
        // lease we construct will swap-remove it on drop.
        let lease = unsafe { crate::SegmentLease::new(borrows, borrow) };
        Ok(crate::SegRef::new(inner, lease))
    }

    /// Project a mutable typed segment. Mirror of [`Self::segment_ref`]; the
    /// returned [`SegRefMut<T>`](crate::SegRefMut) carries both the
    /// account-level exclusive borrow guard and the segment-registry
    /// lease, so dropping it is a full release, no lingering entries.
    ///
    /// Under a bound `strict_writes` context the instruction-ambient gate
    /// checks this EXACT byte range against the declared write policy, so
    /// direct segment access outside a `Context` is governed too (the
    /// `Context` methods enforce the same installed policy before
    /// delegating to the ungated internal variant, paying the check once).
    #[inline(always)]
    pub fn segment_mut<'a, T: crate::Pod>(
        &'a self,
        borrows: &'a mut SegmentBorrowRegistry,
        abs_offset: u32,
        size: u32,
    ) -> Result<crate::SegRefMut<'a, T>, ProgramError> {
        crate::write_policy::check_data_mutation(self.address(), abs_offset, size)?;
        self.segment_mut_ungated::<T>(borrows, abs_offset, size)
    }

    /// Ungated mirror of [`segment_mut`](Self::segment_mut) for
    /// crate-internal callers (`Context`) that already enforced the same
    /// installed policy for this exact range. See
    /// [`try_borrow_mut_ungated`](Self::try_borrow_mut_ungated).
    #[inline(always)]
    pub(crate) fn segment_mut_ungated<'a, T: crate::Pod>(
        &'a self,
        borrows: &'a mut SegmentBorrowRegistry,
        abs_offset: u32,
        size: u32,
    ) -> Result<crate::SegRefMut<'a, T>, ProgramError> {
        self.check_writable()?;

        let expected_size = core::mem::size_of::<T>() as u32;
        if size != expected_size {
            return ProgramError::err_invalid_argument();
        }

        let end = abs_offset
            .checked_add(size)
            .ok_or(ProgramError::ArithmeticOverflow)?;
        if end as usize > self.data_len() {
            return ProgramError::err_data_too_small();
        }

        let borrow = borrows.register_leased_write(self.address(), abs_offset, size)?;

        #[cfg(target_os = "solana")]
        let inner: RefMut<'_, T> = {
            // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
            let native_ref = unsafe { self.backend().segment_mut_unchecked::<T>(abs_offset) };
            let native_ref = match native_ref {
                Ok(nr) => nr,
                Err(e) => {
                    borrows.release(&borrow);
                    return Err(ProgramError::from(e));
                }
            };
            let (typed_ref, state_ptr) = native_ref.into_raw_parts();
            RefMut::from_segment(typed_ref as *mut T, state_ptr)
        };
        #[cfg(not(target_os = "solana"))]
        let inner: RefMut<'_, T> = {
            let mut data = match self.try_borrow_mut_ungated() {
                Ok(d) => d,
                Err(e) => {
                    borrows.release(&borrow);
                    return Err(e);
                }
            };
            // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
            let ptr = unsafe { data.as_bytes_mut_ptr().add(abs_offset as usize) as *mut T };
            unsafe { data.project(ptr) }
        };

        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        let lease = unsafe { crate::SegmentLease::new(borrows, borrow) };
        Ok(crate::SegRefMut::new(inner, lease))
    }

    /// Borrow **several disjoint byte ranges of one account** as
    /// independent typed `&mut` guards at the same time.
    ///
    /// This is the ergonomic answer to "I need mutable access to two
    /// fields of the same account simultaneously". A single
    /// `segment_mut` call exclusively borrows the registry for the
    /// returned guard's lifetime, so two `segment_mut` calls cannot
    /// coexist. `split_segments_mut` registers **all** `N` ranges up
    /// front, proving pairwise disjointness once through the borrow
    /// registry, and returns an array of `N` guards that live together
    /// and each release their lease on drop.
    ///
    /// Every range is `(abs_offset, size)` where `size == size_of::<T>()`.
    /// Overlapping ranges are rejected with `AccountBorrowFailed`; an
    /// out-of-bounds or wrong-size range is rejected with
    /// `InvalidArgument` / `AccountDataTooSmall`, and any already-claimed
    /// leases from the batch are rolled back before returning.
    ///
    /// ```ignore
    /// // Mutate balance and nonce of the same vault at once.
    /// let [mut bal, mut nonce] =
    ///     vault.split_segments_mut::<WireU64, 2>(ctx.borrows_mut(),
    ///         [(BALANCE_OFF, 8), (NONCE_OFF, 8)])?;
    /// bal.set(bal.get() + amount);
    /// nonce.set(nonce.get() + 1);
    /// ```
    pub fn split_segments_mut<'a, T: crate::Pod, const N: usize>(
        &'a self,
        borrows: &'a mut SegmentBorrowRegistry,
        ranges: [(u32, u32); N],
    ) -> Result<crate::SegmentsMut<'a, T, N>, ProgramError> {
        // Under a bound `strict_writes` context, every requested range is
        // checked against the instruction-ambient write gate, the same
        // exact-range rule as `segment_mut`; so the batch surface cannot
        // be used to bypass the declared policy from outside a `Context`.
        for (off, size) in ranges {
            crate::write_policy::check_data_mutation(self.address(), off, size)?;
        }
        self.split_segments_mut_ungated::<T, N>(borrows, ranges)
    }

    /// Ungated mirror of [`split_segments_mut`](Self::split_segments_mut)
    /// for crate-internal callers (`Context`) that already enforced the
    /// installed policy per range. See
    /// [`try_borrow_mut_ungated`](Self::try_borrow_mut_ungated).
    pub(crate) fn split_segments_mut_ungated<'a, T: crate::Pod, const N: usize>(
        &'a self,
        borrows: &'a mut SegmentBorrowRegistry,
        ranges: [(u32, u32); N],
    ) -> Result<crate::SegmentsMut<'a, T, N>, ProgramError> {
        self.check_writable()?;
        let expected = core::mem::size_of::<T>() as u32;
        let data_len = self.data_len();

        // Phase 1: validate + register every range **through the `&mut`**.
        // The raw registry pointer the leases share is deliberately derived
        // only after the final `&mut` use below: deriving it first and then
        // using `borrows` would invalidate the raw under Stacked Borrows,
        // leaving the rollback paths and every lease drop writing through a
        // dead pointer. `register_leased_write` rejects a range that overlaps
        // one already registered in this batch, so disjointness is proven
        // here, once, up front.
        // SAFETY: an array of `MaybeUninit` is itself always valid
        // uninitialized; we initialize entries `0..i` before reading them.
        let mut recs: [core::mem::MaybeUninit<crate::segment_borrow::SegmentBorrow>; N] =
            unsafe { core::mem::MaybeUninit::uninit().assume_init() };
        let mut offsets = [0usize; N];
        let mut i = 0;
        while i < N {
            let (off, size) = ranges[i];
            let in_bounds = match off.checked_add(size) {
                Some(end) => end as usize <= data_len,
                None => false,
            };
            if size != expected || !in_bounds {
                // SAFETY: indices `0..i` were initialized and registered above.
                unsafe { release_registered(borrows, &recs, i) };
                return if size != expected {
                    ProgramError::err_invalid_argument()
                } else {
                    ProgramError::err_data_too_small()
                };
            }
            match borrows.register_leased_write(self.address(), off, size) {
                Ok(b) => {
                    recs[i] = core::mem::MaybeUninit::new(b);
                    offsets[i] = off as usize;
                }
                Err(e) => {
                    // SAFETY: indices `0..i` were initialized and registered.
                    unsafe { release_registered(borrows, &recs, i) };
                    return Err(e);
                }
            }
            i += 1;
        }

        // One exclusive byte borrow of the whole account backs every
        // typed view; the registry leases prove the ranges are disjoint,
        // so handing out N `&mut T` from this single borrow is sound.
        // Ungated: the per-range ambient checks already ran (public
        // wrapper) or the Context enforced the policy per range.
        let data = match self.try_borrow_mut_ungated() {
            Ok(d) => d,
            Err(e) => {
                // SAFETY: all N entries were registered in phase 1.
                unsafe { release_registered(borrows, &recs, N) };
                return Err(e);
            }
        };

        // LAST use of the `&mut`: derive the single raw pointer every lease
        // shares. All registry access from here on (lease drops) flows
        // through copies of this one derivation, so the pointer's provenance
        // stays valid for the guard's whole lifetime.
        let reg_ptr = borrows as *mut SegmentBorrowRegistry;

        // Build the N leases (each shares the one registry raw pointer,
        // lifetime-pinned to `'a` by the `&'a mut borrows` we hold).
        // SAFETY: array of `MaybeUninit` is valid uninitialized.
        let mut leases: [core::mem::MaybeUninit<crate::SegmentLease<'a>>; N] =
            unsafe { core::mem::MaybeUninit::uninit().assume_init() };
        let mut k = 0;
        while k < N {
            // SAFETY: `recs[k]` was initialized in phase 1; `reg_ptr` is
            // borrowed `&'a mut` for the returned guard's lifetime.
            let lease = unsafe { crate::SegmentLease::from_raw(reg_ptr, recs[k].assume_init()) };
            leases[k] = core::mem::MaybeUninit::new(lease);
            k += 1;
        }
        // SAFETY: all N lease slots initialized.
        let leases = unsafe {
            let out = core::ptr::read(&leases as *const _ as *const [crate::SegmentLease<'a>; N]);
            // The `MaybeUninit` array does not drop its contents; the forget
            // documents that ownership moved into `out` via the read above.
            #[allow(clippy::forget_non_drop)]
            core::mem::forget(leases);
            out
        };

        Ok(crate::SegmentsMut::new(data, offsets, leases))
    }

    // ── Const-driven segment access ─────────────────────────────────

    /// Project a typed segment described by a compile-time [`crate::Segment`].
    ///
    /// This is the "const-driven" access form the Hopper design demands:
    /// the offset and size come from a `const SEG: Segment = ...;`
    /// declaration generated by `#[hopper::state]` or written by hand,
    /// so the call collapses to a single `ptr + const_offset` add on
    /// Solana SBF. No runtime string lookup, no dynamic map, no search.
    ///
    /// `segment.offset` is the **absolute** offset from the start of
    /// account data (i.e. past the Hopper header already folded in).
    /// Construct it via `Segment::new(offset, size)` or
    /// `Segment::body(body_offset, size)`, the latter adds
    /// `HopperHeader::SIZE` for you.
    ///
    /// ```ignore
    /// const BALANCE: Segment = Segment::body(0, 8);
    /// let mut balance = vault.segment_ref_const::<u64>(&mut borrows, BALANCE)?;
    /// ```
    #[inline(always)]
    pub fn segment_ref_const<'a, T: crate::Pod>(
        &'a self,
        borrows: &'a mut SegmentBorrowRegistry,
        segment: crate::segment::Segment,
    ) -> Result<crate::SegRef<'a, T>, ProgramError> {
        self.segment_ref::<T>(borrows, segment.offset, segment.size)
    }

    /// Mutable const-Segment access. See [`Self::segment_ref_const`] for the
    /// contract, this is the exclusive variant.
    #[inline(always)]
    pub fn segment_mut_const<'a, T: crate::Pod>(
        &'a self,
        borrows: &'a mut SegmentBorrowRegistry,
        segment: crate::segment::Segment,
    ) -> Result<crate::SegRefMut<'a, T>, ProgramError> {
        self.segment_mut::<T>(borrows, segment.offset, segment.size)
    }

    /// Project a typed segment described by a [`crate::TypedSegment`].
    ///
    /// This is the tightest form of segment access Hopper exposes: both
    /// the type `T` and the offset are compile-time constants baked
    /// into the [`crate::TypedSegment`] marker, so the call collapses to a
    /// single `ptr + literal_offset` add with a literal size in the
    /// bounds check. The marker argument is a zero-sized token, free
    /// to pass around.
    ///
    /// ```ignore
    /// const BALANCE: TypedSegment<WireU64, { HopperHeader::SIZE as u32 }>
    ///     = TypedSegment::new();
    /// let bal = vault.segment_ref_typed(&mut borrows, BALANCE)?;
    /// ```
    #[inline(always)]
    pub fn segment_ref_typed<'a, T: crate::Pod, const OFFSET: u32>(
        &'a self,
        borrows: &'a mut SegmentBorrowRegistry,
        _segment: crate::segment::TypedSegment<T, OFFSET>,
    ) -> Result<crate::SegRef<'a, T>, ProgramError> {
        self.segment_ref::<T>(borrows, OFFSET, core::mem::size_of::<T>() as u32)
    }

    /// Mutable typed-segment access. See [`Self::segment_ref_typed`] for the
    /// contract, this is the exclusive variant.
    #[inline(always)]
    pub fn segment_mut_typed<'a, T: crate::Pod, const OFFSET: u32>(
        &'a self,
        borrows: &'a mut SegmentBorrowRegistry,
        _segment: crate::segment::TypedSegment<T, OFFSET>,
    ) -> Result<crate::SegRefMut<'a, T>, ProgramError> {
        self.segment_mut::<T>(borrows, OFFSET, core::mem::size_of::<T>() as u32)
    }

    // ── Zero-copy overlay access ─────────────────────────────────────

    // ── Typed load (LayoutContract-aware) ────────────────────────────

    /// Load a typed layout after validating the account header.
    ///
    /// This is the canonical "validate then project" path:
    /// 1. Check disc, version, and layout_id match `T`
    /// 2. Verify data length >= `T::SIZE`
    /// 3. Return zero-copy reference into account data
    ///
    /// The returned reference begins at `T::TYPE_OFFSET`. Body-only layouts
    /// project past the Hopper header; header-inclusive layouts project the
    /// full account struct from byte 0.
    ///
    /// # Example
    ///
    /// ```ignore
    /// let vault = account.load::<Vault>()?;
    /// ```
    #[inline(always)]
    pub fn load<T: LayoutContract + crate::Pod>(&self) -> Result<Ref<'_, T>, ProgramError> {
        let data = self.try_borrow()?;
        T::validate_header(&data)?;
        if data.len() < T::required_len() {
            return ProgramError::err_data_too_small();
        }
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        let ptr = unsafe { data.as_bytes_ptr().add(T::TYPE_OFFSET) as *const T };
        // SAFETY: Header and length validated above. `ptr` points into the borrowed bytes.
        Ok(unsafe { data.project(ptr) })
    }

    /// Borrow a typed layout for the duration of a closure.
    ///
    /// This is the ergonomic safe path for read-only handlers: Hopper still
    /// validates the header and holds the data borrow guard, while user code
    /// gets a plain `&T` inside the closure.
    #[inline]
    pub fn with<T, R, F>(&self, f: F) -> Result<R, ProgramError>
    where
        T: LayoutContract + crate::Pod,
        F: FnOnce(&T) -> Result<R, ProgramError>,
    {
        let account = self.load::<T>()?;
        f(&*account)
    }

    /// Load a mutable typed layout after validating the account header.
    ///
    /// Same as `load()` but provides a mutable reference for in-place
    /// state updates. Changes write directly to account data.
    ///
    /// # Example
    ///
    /// ```ignore
    /// let mut vault = account.load_mut::<Vault>()?;
    /// vault.balance = vault.balance.checked_add(amount)?;
    /// ```
    #[inline(always)]
    pub fn load_mut<T: LayoutContract + crate::Pod>(&self) -> Result<RefMut<'_, T>, ProgramError> {
        let mut data = self.try_borrow_mut()?;
        T::validate_header(&data)?;
        if data.len() < T::required_len() {
            return ProgramError::err_data_too_small();
        }
        // Typed whole-account write borrows stamp the instruction-
        // AMBIENT touch log directly (no Context in reach here), which
        // is what makes wrapper `get_mut` / raw `load_mut` visible to
        // emitted touch maps. Footprint only, liveness stays with the
        // account borrow byte. Reads are not recorded (validators read
        // every account; the map's job is write containment).
        #[cfg(feature = "touch-map")]
        crate::segment_borrow::touch_log::record_account(
            self.address(),
            data.len() as u32,
            crate::segment_borrow::AccessKind::Write,
        );
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        let ptr = unsafe { data.as_bytes_mut_ptr().add(T::TYPE_OFFSET) as *mut T };
        // SAFETY: Header and length validated above. `ptr` points into the borrowed bytes.
        Ok(unsafe { data.project(ptr) })
    }

    /// Mutably borrow a typed layout for the duration of a closure.
    ///
    /// This keeps the zero-copy borrow guard scoped to the closure while making
    /// common updates read like direct state mutation.
    #[inline]
    pub fn with_mut<T, R, F>(&self, f: F) -> Result<R, ProgramError>
    where
        T: LayoutContract + crate::Pod,
        F: FnOnce(&mut T) -> Result<R, ProgramError>,
    {
        let mut account = self.load_mut::<T>()?;
        f(&mut *account)
    }

    // ── Tier 1 compact load (`[disc:u8][body]`) ─────────────────────

    /// Load a Tier-1 compact layout: `[disc:u8][zero-copy body]`.
    ///
    /// The hot path is `check_len_exact` + `check_disc` + project-body-at-byte-1.
    /// Unlike [`load`](Self::load) there is **no** 16-byte header, no
    /// layout_id read, and no schema-epoch comparison. Layout identity is
    /// a program-level fact (the Tier-2 registry), not a per-account one.
    ///
    /// # Example
    ///
    /// ```ignore
    /// let vault = account.load_compact::<Vault>()?;
    /// ```
    #[inline(always)]
    pub fn load_compact<T: crate::CompactLayout>(&self) -> Result<Ref<'_, T>, ProgramError> {
        let data = self.try_borrow()?;
        T::validate_compact(&data)?;
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        let ptr =
            unsafe { data.as_bytes_ptr().add(crate::compact::COMPACT_BODY_OFFSET) as *const T };
        // SAFETY: length and disc validated above; `ptr` points into the borrowed body.
        Ok(unsafe { data.project(ptr) })
    }

    /// Mutable Tier-1 compact load. See [`load_compact`](Self::load_compact).
    #[inline(always)]
    pub fn load_compact_mut<T: crate::CompactLayout>(&self) -> Result<RefMut<'_, T>, ProgramError> {
        let mut data = self.try_borrow_mut()?;
        T::validate_compact(&data)?;
        // Same ambient stamp as `load_mut`: typed whole-account write.
        #[cfg(feature = "touch-map")]
        crate::segment_borrow::touch_log::record_account(
            self.address(),
            data.len() as u32,
            crate::segment_borrow::AccessKind::Write,
        );
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        let ptr = unsafe {
            data.as_bytes_mut_ptr()
                .add(crate::compact::COMPACT_BODY_OFFSET) as *mut T
        };
        // SAFETY: length and disc validated above; `ptr` points into the borrowed body.
        Ok(unsafe { data.project(ptr) })
    }

    /// Borrow a compact layout for the duration of a closure (read-only).
    #[inline]
    pub fn with_compact<T, R, F>(&self, f: F) -> Result<R, ProgramError>
    where
        T: crate::CompactLayout,
        F: FnOnce(&T) -> Result<R, ProgramError>,
    {
        let account = self.load_compact::<T>()?;
        f(&*account)
    }

    /// Mutably borrow a compact layout for the duration of a closure.
    #[inline]
    pub fn with_compact_mut<T, R, F>(&self, f: F) -> Result<R, ProgramError>
    where
        T: crate::CompactLayout,
        F: FnOnce(&mut T) -> Result<R, ProgramError>,
    {
        let mut account = self.load_compact_mut::<T>()?;
        f(&mut *account)
    }

    /// Initialise a compact account by stamping the discriminator byte.
    ///
    /// Writes `T::DISC` at byte 0; the body is left as-is (callers
    /// typically follow with [`load_compact_mut`](Self::load_compact_mut)
    /// to populate it). Requires the account to be writable and exactly
    /// `T::COMPACT_LEN` bytes long.
    #[inline(always)]
    pub fn init_compact<T: crate::CompactLayout>(&self) -> ProgramResult {
        self.check_writable()?;
        let mut data = self.try_borrow_mut()?;
        if data.len() < T::COMPACT_LEN {
            return Err(ProgramError::AccountDataTooSmall);
        }
        if data.len() != T::COMPACT_LEN {
            return Err(ProgramError::InvalidAccountData);
        }
        data[0] = T::DISC;
        Ok(())
    }

    /// Tier-1 compact **dynamic** load: validate the discriminator and the
    /// minimum length, then project the fixed head at
    /// [`COMPACT_BODY_OFFSET`](crate::compact::COMPACT_BODY_OFFSET).
    ///
    /// Unlike [`load_compact`](Self::load_compact), the account may be longer
    /// than the fixed head: the trailing bytes are the dynamic tail, left
    /// untouched here and accessed through the generated `tail_*` helpers.
    /// This is the `[disc:u8][fixed_head][tail]` analogue of
    /// [`load`](Self::load)'s tolerance of a headered dynamic tail.
    ///
    /// # Example
    ///
    /// ```ignore
    /// let head = account.load_compact_dynamic::<Market>()?;   // fixed head
    /// let data = account.try_borrow()?;
    /// let tail = Market::tail_read(&data)?;                   // dynamic tail
    /// ```
    #[inline(always)]
    pub fn load_compact_dynamic<T: crate::CompactDynamicLayout>(
        &self,
    ) -> Result<Ref<'_, T>, ProgramError> {
        let data = self.try_borrow()?;
        T::validate_compact_dynamic(&data)?;
        // SAFETY: validate_compact_dynamic guarantees `data.len() >= 1 +
        // size_of::<T>()`, `T` is Pod (align 1, all-bit-patterns valid), and
        // the fixed head begins at COMPACT_BODY_OFFSET. Trailing tail bytes are
        // never read through this `&T`.
        let ptr =
            unsafe { data.as_bytes_ptr().add(crate::compact::COMPACT_BODY_OFFSET) as *const T };
        // SAFETY: length and disc validated above; `ptr` points into the borrowed head.
        Ok(unsafe { data.project(ptr) })
    }

    /// Mutable Tier-1 compact-dynamic load of the fixed head.
    /// See [`load_compact_dynamic`](Self::load_compact_dynamic).
    #[inline(always)]
    pub fn load_compact_dynamic_mut<T: crate::CompactDynamicLayout>(
        &self,
    ) -> Result<RefMut<'_, T>, ProgramError> {
        let mut data = self.try_borrow_mut()?;
        T::validate_compact_dynamic(&data)?;
        // SAFETY: see `load_compact_dynamic`; the head window is exclusively
        // borrowed for the lifetime of the returned guard.
        let ptr = unsafe {
            data.as_bytes_mut_ptr()
                .add(crate::compact::COMPACT_BODY_OFFSET) as *mut T
        };
        // SAFETY: length and disc validated above; `ptr` points into the borrowed head.
        Ok(unsafe { data.project(ptr) })
    }

    /// Borrow a compact-dynamic fixed head for the duration of a closure.
    #[inline]
    pub fn with_compact_dynamic<T, R, F>(&self, f: F) -> Result<R, ProgramError>
    where
        T: crate::CompactDynamicLayout,
        F: FnOnce(&T) -> Result<R, ProgramError>,
    {
        let account = self.load_compact_dynamic::<T>()?;
        f(&*account)
    }

    /// Mutably borrow a compact-dynamic fixed head for the duration of a closure.
    #[inline]
    pub fn with_compact_dynamic_mut<T, R, F>(&self, f: F) -> Result<R, ProgramError>
    where
        T: crate::CompactDynamicLayout,
        F: FnOnce(&mut T) -> Result<R, ProgramError>,
    {
        let mut account = self.load_compact_dynamic_mut::<T>()?;
        f(&mut *account)
    }

    /// Initialise a compact-dynamic account: stamp `T::DISC` at byte 0 and, if
    /// the account was allocated with room for a tail, zero the tail's `u32`
    /// length prefix so a fresh account reads as an **empty** tail rather than
    /// uninitialized bytes (fail-closed init).
    ///
    /// Requires the account to be writable and at least `T::MIN_LEN` bytes
    /// (discriminator + fixed head). The tail region may be larger to reserve
    /// growth headroom.
    #[inline(always)]
    pub fn init_compact_dynamic<T: crate::CompactDynamicLayout>(&self) -> ProgramResult {
        self.check_writable()?;
        let mut data = self.try_borrow_mut()?;
        if data.len() < T::MIN_LEN {
            return Err(ProgramError::AccountDataTooSmall);
        }
        data[0] = T::DISC;
        // Stamp an empty-tail length prefix when the allocation has room for it.
        if data.len() >= T::TAIL_OFFSET + 4 {
            data[T::TAIL_OFFSET..T::TAIL_OFFSET + 4].copy_from_slice(&0u32.to_le_bytes());
        }
        Ok(())
    }

    /// Explicit raw typed read of the account buffer.
    ///
    /// This bypasses Hopper layout validation and segment tracking, but it still
    /// respects the account-level borrow rules enforced by `try_borrow()`.
    #[inline(always)]
    ///
    /// # Safety
    ///
    /// Caller must uphold the invariants documented for this unsafe API before invoking it.
    pub unsafe fn raw_ref<T: crate::Pod>(&self) -> Result<Ref<'_, T>, ProgramError> {
        let data = self.try_borrow()?;
        if core::mem::size_of::<T>() > data.len() {
            return Err(ProgramError::AccountDataTooSmall);
        }
        let ptr = data.as_ptr() as *const T;
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        Ok(unsafe { data.project(ptr) })
    }

    /// Explicit raw typed write of the account buffer.
    ///
    /// This bypasses Hopper layout validation and segment tracking, but it still
    /// enforces writability and the account-level exclusive borrow rules.
    #[inline(always)]
    ///
    /// # Safety
    ///
    /// Caller must uphold the invariants documented for this unsafe API before invoking it.
    pub unsafe fn raw_mut<T: crate::Pod>(&self) -> Result<RefMut<'_, T>, ProgramError> {
        self.check_writable()?;
        // Deliberately ungated: `raw_mut` is one of the documented `unsafe`
        // escape hatches (`hopper lint --deny-escapes` refuses it in program
        // code). The ambient write gate governs the SAFE surfaces; the
        // unsafe tier remains an explicit, grep-able opt-out.
        let mut data = self.try_borrow_mut_ungated()?;
        if core::mem::size_of::<T>() > data.len() {
            return Err(ProgramError::AccountDataTooSmall);
        }
        let ptr = data.as_bytes_mut_ptr() as *mut T;
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        Ok(unsafe { data.project(ptr) })
    }

    /// Load a cross-program layout without ownership checks.
    ///
    /// Validates the layout contract but does not check that the account is
    /// owned by this program. Use for cross-program
    /// reads where the account is owned by another program and you need
    /// a typed, zero-copy view of its data.
    ///
    /// Full contract validation ensures ABI compatibility: if the other
    /// program changes its layout identity or schema epoch, this fails rather
    /// than silently misinterpreting bytes.
    ///
    /// # Example
    ///
    /// ```ignore
    /// let other_vault = foreign_account.load_cross_program::<OtherVault>()?;
    /// ```
    #[inline(always)]
    pub fn load_cross_program<T: LayoutContract + crate::Pod>(
        &self,
    ) -> Result<Ref<'_, T>, ProgramError> {
        let data = self.try_borrow()?;
        T::validate_header(&data)?;
        // Defense in depth: `validate_header`'s default impl already checks this,
        // but a foreign `LayoutContract` could override it. Re-check the projection
        // length explicitly so an overridden or mismatched contract can never
        // produce an out-of-bounds typed view from another program's bytes.
        if data.len() < T::required_len() {
            return ProgramError::err_data_too_small();
        }
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        let ptr = unsafe { data.as_bytes_ptr().add(T::TYPE_OFFSET) as *const T };
        // SAFETY: Wire identity and size validated above.
        Ok(unsafe { data.project(ptr) })
    }

    /// Read runtime layout metadata from this account's header.
    ///
    /// Returns `None` if the account data is too short for a Hopper header.
    /// This is useful for runtime inspection, manager tooling, and schema
    /// checking when the concrete layout type is not known at compile time.
    #[inline(always)]
    pub fn layout_info(&self) -> Option<crate::layout::LayoutInfo> {
        let data = self.try_borrow().ok()?;
        crate::layout::LayoutInfo::from_data(&data)
    }

    /// Compile-time field metadata for a layout contract.
    #[inline(always)]
    pub fn fields<T: LayoutContract>() -> &'static [FieldInfo] {
        T::fields()
    }

    /// Find a compile-time field descriptor by name.
    ///
    /// This is a tooling/inspection helper that delegates to
    /// `FieldMap::field_by_name`. It performs a const-driven linear
    /// scan over `T::FIELDS` and is not intended for hot-path use -
    /// programs should reach for the const offsets emitted by
    /// `#[hopper::state]` instead.
    #[inline]
    pub fn field<T: LayoutContract>(name: &str) -> Option<&'static FieldInfo> {
        <T as crate::field_map::FieldMap>::field_by_name(name)
    }

    /// Return the extension-region byte range for a layout that declares one.
    ///
    /// Callers can apply the returned range to a borrowed data slice when they
    /// want to inspect or mutate extension bytes explicitly.
    #[inline(always)]
    pub fn extension_range<T: LayoutContract>(
        &self,
    ) -> Result<core::ops::Range<usize>, ProgramError> {
        let offset = T::EXTENSION_OFFSET.ok_or(ProgramError::InvalidArgument)?;
        let data_len = self.data_len();
        if data_len < offset {
            return Err(ProgramError::AccountDataTooSmall);
        }
        Ok(offset..data_len)
    }

    /// Borrow the extension/tail region declared by a layout contract.
    #[inline(always)]
    pub fn extension_bytes<T: LayoutContract>(&self) -> Result<Ref<'_, [u8]>, ProgramError> {
        let offset = T::EXTENSION_OFFSET.ok_or(ProgramError::InvalidArgument)?;
        let data = self.try_borrow()?;
        if data.len() < offset {
            return Err(ProgramError::AccountDataTooSmall);
        }
        Ok(data.slice_from(offset))
    }

    /// Mutably borrow the extension/tail region declared by a layout contract.
    #[inline(always)]
    pub fn extension_bytes_mut<T: LayoutContract>(&self) -> Result<RefMut<'_, [u8]>, ProgramError> {
        let offset = T::EXTENSION_OFFSET.ok_or(ProgramError::InvalidArgument)?;
        let len = self.data_len();
        if len < offset {
            return Err(ProgramError::AccountDataTooSmall);
        }
        // Ambient gate: the mutable grant is exactly the extension region
        // `[offset, len)`, so a tail-declared policy (open-ended range) or a
        // whole-account grant authorizes it, while a head-only declaration
        // refuses it. Empty extension regions grant nothing and skip the
        // check.
        if len > offset {
            crate::write_policy::check_data_mutation(
                self.address(),
                offset as u32,
                (len - offset) as u32,
            )?;
        }
        let data = self.try_borrow_mut_ungated()?;
        Ok(data.slice_from(offset))
    }

    /// Zero the byte range `[start, start + len)`, checked against the
    /// instruction-ambient write policy over **exactly that range**.
    ///
    /// This is the precise-authority spelling of "clear these bytes." The
    /// naive alternative, take a whole-account `try_borrow_mut` and slice,
    /// demands authority over every byte of the account, so a narrow but
    /// entirely legitimate declaration (a `tail(seq)` grant zero-filling
    /// the tail it just grew) would be refused by its own policy. Gating
    /// the exact range keeps the refusal honest: it fires when the bytes
    /// being cleared are outside the declaration, and not before.
    ///
    /// An empty range is a no-op and requires no authority.
    #[inline]
    pub fn zero_range(&self, start: usize, len: usize) -> ProgramResult {
        if len == 0 {
            return Ok(());
        }
        let end = start
            .checked_add(len)
            .ok_or(ProgramError::ArithmeticOverflow)?;
        if end > self.data_len() {
            return Err(ProgramError::AccountDataTooSmall);
        }
        let offset_u32 = u32::try_from(start).map_err(|_| ProgramError::ArithmeticOverflow)?;
        let len_u32 = u32::try_from(len).map_err(|_| ProgramError::ArithmeticOverflow)?;
        crate::write_policy::check_data_mutation(self.address(), offset_u32, len_u32)?;
        let mut data = self.try_borrow_mut_ungated()?;
        for byte in data[start..end].iter_mut() {
            *byte = 0;
        }
        Ok(())
    }

    /// Zero the bytes a grow just appended: `[previous_len, data_len)`.
    ///
    /// Authorized by the **transition** dimension, not the byte-range one,
    /// deliberately, and this is the whole reason it is a separate
    /// method from [`zero_range`](Self::zero_range):
    ///
    /// - The bytes did not exist when the policy was declared. Clearing
    ///   them cannot destroy, reveal, or corrupt any state a byte-range
    ///   declaration protects, so requiring a declared range over them
    ///   would refuse the framework's own `realloc_zero` lifecycle on
    ///   every narrow declaration (`mut(seg)` + `realloc`) while
    ///   protecting nothing.
    /// - The authority to create them was already checked: `resize`
    ///   consults [`check_account_transition`], and an account carrying no
    ///   declared data authority cannot resize in the first place. Same
    ///   check here, so this method can never reach an account the
    ///   instruction has no data authority over.
    /// - It is strictly narrower than the pre-existing body: a caller
    ///   cannot name an offset, only "whatever the grow added."
    ///
    /// Writes into the PRE-EXISTING body remain governed by the byte-range
    /// policy through every other surface.
    ///
    /// [`check_account_transition`]: crate::write_policy
    #[inline]
    pub fn zero_appended(&self, previous_len: usize) -> ProgramResult {
        let len = self.data_len();
        if previous_len >= len {
            return Ok(());
        }
        crate::write_policy::check_account_transition(self.address())?;
        let mut data = self.try_borrow_mut_ungated()?;
        for byte in data[previous_len..len].iter_mut() {
            *byte = 0;
        }
        Ok(())
    }

    /// Initialize an account with the given layout contract header.
    ///
    /// Writes the disc, version, layout_id, and zeroes flags/reserved.
    /// Call this when creating a new account before writing field data.
    #[inline(always)]
    pub fn init_layout<T: LayoutContract>(&self) -> ProgramResult {
        let mut data = self.try_borrow_mut()?;
        crate::layout::init_header::<T>(&mut data)
    }

    // ── Validation helpers ───────────────────────────────────────────

    /// Validate that this account is a signer.
    #[inline(always)]
    pub fn require_signer(&self) -> ProgramResult {
        if self.is_signer() {
            Ok(())
        } else {
            ProgramError::err_missing_signer()
        }
    }

    /// Validate that this account is writable.
    #[inline(always)]
    pub fn require_writable(&self) -> ProgramResult {
        if self.is_writable() {
            Ok(())
        } else {
            ProgramError::err_immutable()
        }
    }

    /// Validate that this account is owned by the given program.
    #[inline(always)]
    pub fn require_owned_by(&self, program: &Address) -> ProgramResult {
        if self.owned_by(program) {
            Ok(())
        } else {
            ProgramError::err_incorrect_program()
        }
    }

    /// Validate signer + writable (common "payer" pattern).
    #[inline(always)]
    pub fn require_payer(&self) -> ProgramResult {
        self.require_signer()?;
        self.require_writable()
    }

    // ── Chainable validation ─────────────────────────────────────────

    /// Chainable signer check.
    #[inline(always)]
    pub fn check_signer(&self) -> Result<&Self, ProgramError> {
        if self.is_signer() {
            Ok(self)
        } else {
            ProgramError::err_missing_signer()
        }
    }

    /// Chainable writable check.
    #[inline(always)]
    pub fn check_writable(&self) -> Result<&Self, ProgramError> {
        if self.is_writable() {
            Ok(self)
        } else {
            ProgramError::err_immutable()
        }
    }

    /// Chainable ownership check.
    #[inline(always)]
    pub fn check_owned_by(&self, program: &Address) -> Result<&Self, ProgramError> {
        if self.owned_by(program) {
            Ok(self)
        } else {
            ProgramError::err_incorrect_program()
        }
    }

    /// Chainable check that this account's owner is **one of** `programs`.
    ///
    /// Accepts an account from any of several programs, most commonly an SPL
    /// Token *or* Token-2022 mint / token account, and rejects every other
    /// owner. This is [`check_owned_by`](Self::check_owned_by) generalized to a
    /// set; an empty `programs` slice always rejects.
    #[inline]
    pub fn check_owned_by_any(&self, programs: &[&Address]) -> Result<&Self, ProgramError> {
        if programs.iter().any(|program| self.owned_by(program)) {
            Ok(self)
        } else {
            ProgramError::err_incorrect_program()
        }
    }

    /// Chainable discriminator check.
    #[inline(always)]
    pub fn check_disc(&self, expected: u8) -> Result<&Self, ProgramError> {
        if self.disc() == expected {
            Ok(self)
        } else {
            Err(ProgramError::InvalidAccountData)
        }
    }

    /// Chainable non-empty data check.
    #[inline(always)]
    pub fn check_has_data(&self) -> Result<&Self, ProgramError> {
        if !self.is_data_empty() {
            Ok(self)
        } else {
            Err(ProgramError::AccountDataTooSmall)
        }
    }

    /// Chainable executable check.
    #[inline(always)]
    pub fn check_executable(&self) -> Result<&Self, ProgramError> {
        if self.executable() {
            Ok(self)
        } else {
            Err(ProgramError::InvalidArgument)
        }
    }

    /// Chainable address check.
    #[inline(always)]
    pub fn check_address(&self, expected: &Address) -> Result<&Self, ProgramError> {
        if address_eq(self.address(), expected) {
            Ok(self)
        } else {
            Err(ProgramError::InvalidArgument)
        }
    }

    /// Chainable minimum data length check.
    #[inline(always)]
    pub fn check_data_len(&self, min_len: usize) -> Result<&Self, ProgramError> {
        if self.data_len() >= min_len {
            Ok(self)
        } else {
            Err(ProgramError::AccountDataTooSmall)
        }
    }

    /// Chainable version check.
    #[inline(always)]
    pub fn check_version(&self, expected: u8) -> Result<&Self, ProgramError> {
        if self.version() == expected {
            Ok(self)
        } else {
            Err(ProgramError::InvalidAccountData)
        }
    }

    /// Chainable full layout contract check (disc + version + layout_id + size).
    #[inline(always)]
    pub fn check_layout<T: LayoutContract>(&self) -> Result<&Self, ProgramError> {
        let data = self.try_borrow()?;
        T::validate_header(&data)?;
        Ok(self)
    }

    /// Start a proof-carrying validation chain for this account.
    #[inline(always)]
    pub const fn proof(&self) -> crate::proof::AccountProof<'_> {
        crate::proof::AccountProof::new(self)
    }

    // ── Hopper header readers ────────────────────────────────────────

    /// Read the Hopper account discriminator (first byte of data).
    #[inline(always)]
    pub fn disc(&self) -> u8 {
        native_boundary::disc(self.backend())
    }

    /// Read the Hopper account version (second byte of data).
    #[inline(always)]
    pub fn version(&self) -> u8 {
        native_boundary::version(self.backend())
    }

    /// Read the 8-byte layout_id from the Hopper account header (bytes 4..12).
    #[inline(always)]
    pub fn layout_id(&self) -> Option<&[u8; 8]> {
        native_boundary::layout_id(self.backend())
    }

    /// Verify that this account has the given discriminator.
    #[inline(always)]
    pub fn require_disc(&self, expected: u8) -> ProgramResult {
        if self.disc() == expected {
            Ok(())
        } else {
            Err(ProgramError::InvalidAccountData)
        }
    }

    // ── Packed flags ─────────────────────────────────────────────────

    /// Pack the account's boolean flags into a single byte.
    ///
    /// Bit layout: bit 0 = signer, bit 1 = writable, bit 2 = executable,
    /// bit 3 = has data.
    ///
    /// Delegates to the native backend, which extracts signer/writable/
    /// executable from **one** packed-u32 header read instead of three
    /// separate byte loads.
    #[inline(always)]
    pub fn flags(&self) -> u8 {
        self.backend().flags()
    }

    /// Check that the account's flags contain all required bits.
    #[inline(always)]
    pub fn expect_flags(&self, required: u8) -> ProgramResult {
        if self.flags() & required == required {
            Ok(())
        } else {
            Err(ProgramError::InvalidArgument)
        }
    }

    /// Fused signer/writable validation (the generated-context hot path).
    ///
    /// Validates both requirements with a **single packed-flags read and
    /// one masked compare**, the same shape a hand-rolled
    /// `header & MASK == MASK` check compiles to, since `need_signer` /
    /// `need_writable` are compile-time literals at every macro call site
    /// and this function is `#[inline(always)]`. On mismatch it falls back
    /// to the individual checks so the error stays precise
    /// (`MissingRequiredSignature` vs `Immutable`); the fallback runs only
    /// on the failure path, where compute cost is irrelevant.
    #[inline(always)]
    pub fn expect_signer_writable(&self, need_signer: bool, need_writable: bool) -> ProgramResult {
        // Fast path: one packed-header read + one masked compare on the native
        // backend, never touching `data_len` (unlike `flags()`, which also
        // computes the has-data bit). `need_signer`/`need_writable` are
        // compile-time literals here, so the mask/expected pair fold to
        // constants.
        if self
            .backend()
            .is_signer_writable(need_signer, need_writable)
        {
            return Ok(());
        }
        // Failure path: re-check individually for the precise error.
        if need_signer {
            self.require_signer()?;
        }
        if need_writable {
            self.require_writable()?;
        }
        // Unreachable when the fused compare failed for one of the two
        // requested bits, but keeps the signature total.
        Ok(())
    }

    // ── Resize / Close ───────────────────────────────────────────────

    /// Resize the account data, zeroing any newly exposed region on growth.
    ///
    /// See [`hopper_native::AccountView::resize`] for why zero-on-growth
    /// is the safe default. Use [`resize_raw`](Self::resize_raw) for the
    /// hot path when the caller overwrites the grown region in full.
    #[inline]
    pub fn resize(&self, new_len: usize) -> ProgramResult {
        // Ambient gate: a data-length transition on a gated instruction is
        // permitted only for accounts carrying declared write authority
        // (`GateCheck::Transition`); foreign accounts fail closed.
        crate::write_policy::check_account_transition(self.address())?;
        native_boundary::resize(self.backend(), new_len)
    }

    /// Resize the account data without zero-filling the grown region.
    #[inline]
    pub fn resize_raw(&self, new_len: usize) -> ProgramResult {
        // Same transition gate as [`resize`](Self::resize).
        crate::write_policy::check_account_transition(self.address())?;
        native_boundary::resize_raw(self.backend(), new_len)
    }

    /// Assign a new owner.
    ///
    /// # Safety
    ///
    /// The caller must ensure the account is writable and that ownership
    /// transfer is authorized.
    #[inline(always)]
    pub unsafe fn assign(&self, new_owner: &Address) {
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        unsafe {
            native_boundary::assign(self.backend(), new_owner);
        }
    }

    /// Close the account: zero lamports and data.
    #[inline]
    pub fn close(&self) -> ProgramResult {
        // Ambient gate: closing is a presence transition; on a gated
        // instruction only accounts with declared write authority may close.
        crate::write_policy::check_account_transition(self.address())?;
        native_boundary::close(self.backend())
    }

    /// Close the account, transferring remaining lamports to `destination`.
    ///
    /// Idiomatic Solana close pattern: move all lamports to the
    /// destination account, then zero this account's data so the
    /// runtime garbage-collects it at the end of the transaction.
    ///
    /// # Preconditions (enforced)
    ///
    /// Per Solana's account modification rules (only the owning program
    /// can debit lamports or mutate data on a writable account), this
    /// method requires:
    ///
    /// - `self` must be **writable**, otherwise the runtime will
    ///   reject the commit anyway, but we fail fast here rather than
    ///   let the transaction progress through an invalid state.
    /// - `self` must be **owned by `program_id`**, the program that
    ///   is executing this instruction. Without this check the safe
    ///   API would silently encourage patterns that only Solana's
    ///   post-instruction verifier catches.
    /// - `destination` must be **writable**, receiving lamports
    ///   requires write permission on the credit side.
    ///
    /// The earlier version mutated lamports and zeroed data without
    /// checking either side, relying on the runtime to reject the
    /// transaction later. That encouraged
    /// patterns that will only be rejected later", the safe API
    /// should surface the violation at call time.
    #[inline]
    pub fn close_to(&self, destination: &AccountView<'_>, program_id: &Address) -> ProgramResult {
        // Ambient gate: same presence-transition rule as [`close`](Self::close).
        // The lamport credit to `destination` is separately governed by the
        // gated `try_set_lamports` calls below.
        crate::write_policy::check_account_transition(self.address())?;
        self.require_writable()?;
        self.require_owned_by(program_id)?;
        destination.require_writable()?;

        let lamports = self.lamports();
        let dest_lamports = destination.lamports();
        destination.try_set_lamports(
            dest_lamports
                .checked_add(lamports)
                .ok_or(ProgramError::ArithmeticOverflow)?,
        )?;
        self.try_set_lamports(0)?;
        native_boundary::zero_data(self.backend())?;
        Ok(())
    }

    /// Unchecked variant of [`Self::close_to`].
    ///
    /// Retained for the rare caller that has already verified the
    /// preconditions (e.g. inside a validated `#[hopper::context]`
    /// binding). **Does not** check writable or owner, so only use it
    /// when the preconditions are guaranteed by the surrounding code.
    ///
    /// "Unchecked" waives only those two PREconditions. The ambient
    /// write gate is not a precondition a caller can pre-verify; it is
    /// the instruction's installed policy, and closing an account both
    /// zeroes its data and ends its presence, so the same transition
    /// rule as [`close`](Self::close) / [`close_to`](Self::close_to)
    /// applies here (the lamport moves are separately governed by the
    /// gated `try_set_lamports` funnel below).
    #[inline]
    pub fn close_to_unchecked(&self, destination: &AccountView<'_>) -> ProgramResult {
        crate::write_policy::check_account_transition(self.address())?;
        let lamports = self.lamports();
        let dest_lamports = destination.lamports();
        destination.try_set_lamports(
            dest_lamports
                .checked_add(lamports)
                .ok_or(ProgramError::ArithmeticOverflow)?,
        )?;
        self.try_set_lamports(0)?;
        native_boundary::zero_data(self.backend())?;
        Ok(())
    }

    // ── Raw direct-memory access ────────────────────────────────────

    /// Unchecked raw pointer to the first byte of account data.
    #[inline(always)]
    pub(crate) fn data_ptr_unchecked(&self) -> *mut u8 {
        self.backend().data_ptr_unchecked()
    }

    /// Raw pointer to the RuntimeAccount header.
    #[inline(always)]
    pub(crate) fn account_ptr(&self) -> *const hopper_native::RuntimeAccount {
        self.backend().account_ptr()
    }

    /// Check that the account can be shared-borrowed.
    #[inline(always)]
    pub fn check_borrow(&self) -> Result<(), ProgramError> {
        borrow_registry::check_shared(self.address())?;
        self.backend().check_borrow().map_err(ProgramError::from)
    }

    /// Check that the account can be exclusively borrowed.
    #[inline(always)]
    pub fn check_borrow_mut(&self) -> Result<(), ProgramError> {
        borrow_registry::check_mutable(self.address())?;
        self.backend()
            .check_borrow_mut()
            .map_err(ProgramError::from)
    }

    /// Borrow account data without tracking.
    ///
    /// # Safety
    ///
    /// The caller must ensure no mutable borrow is active.
    #[inline(always)]
    pub unsafe fn borrow_unchecked(&self) -> &[u8] {
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        unsafe { self.backend().borrow_unchecked() }
    }

    /// Mutably borrow account data without tracking.
    ///
    /// # Safety
    ///
    /// The caller must ensure no other borrows are active.
    //
    // `mut_from_ref`: intentional. Account data lives behind an SVM-owned raw
    // pointer; `AccountView` models shared access while exposing interior
    // mutability through this documented `unsafe` contract. Aliasing is the
    // caller's invariant; see `hopper_native::AccountView::borrow_unchecked_mut`.
    #[allow(clippy::mut_from_ref)]
    #[inline(always)]
    pub unsafe fn borrow_unchecked_mut(&self) -> &mut [u8] {
        // SAFETY: delegates to the native backend's documented interior-mutability
        // accessor; the caller's no-aliasing precondition is forwarded unchanged.
        unsafe { self.backend().borrow_unchecked_mut() }
    }

    /// Resize without bounds checking.
    ///
    /// # Safety
    ///
    /// The caller must guarantee the new length is within the permitted increase.
    #[inline(always)]
    pub unsafe fn resize_unchecked(&self, new_len: usize) {
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        unsafe {
            self.backend().resize_unchecked(new_len);
        }
    }

    /// Close without borrow checks.
    ///
    /// # Safety
    ///
    /// The caller must ensure no active borrows exist.
    #[inline(always)]
    pub unsafe fn close_unchecked(&self) {
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        unsafe {
            self.backend().close_unchecked();
        }
    }

    // ── Backend access ───────────────────────────────────────────────

    /// Access the active backend account view inside the runtime crate.
    #[allow(dead_code)]
    #[inline(always)]
    pub(crate) fn as_backend(&self) -> &BackendAccountView<'_> {
        self.backend()
    }
}

impl<'info> core::fmt::Debug for AccountView<'info> {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        f.debug_struct("AccountView")
            .field("address", self.address())
            .field("lamports", &self.lamports())
            .field("data_len", &self.data_len())
            .field("is_signer", &self.is_signer())
            .field("is_writable", &self.is_writable())
            .finish()
    }
}

// ── RemainingAccounts ────────────────────────────────────────────────

/// Iterator over remaining (unstructured) accounts.
pub struct RemainingAccounts<'a> {
    accounts: &'a [AccountView<'a>],
    cursor: usize,
}

impl<'a> RemainingAccounts<'a> {
    /// Create from a slice of accounts.
    #[inline(always)]
    pub fn new(accounts: &'a [AccountView<'a>]) -> Self {
        Self {
            accounts,
            cursor: 0,
        }
    }

    /// Number of accounts remaining.
    #[inline(always)]
    pub fn remaining(&self) -> usize {
        self.accounts.len() - self.cursor
    }

    /// Take the next account, or return `NotEnoughAccountKeys`.
    ///
    /// A fallible cursor advance, not `Iterator::next`: it yields a `Result`
    /// so a missing account surfaces as a program error rather than `None`.
    #[allow(clippy::should_implement_trait)]
    #[inline(always)]
    pub fn next(&mut self) -> Result<&'a AccountView<'a>, ProgramError> {
        if self.cursor >= self.accounts.len() {
            return Err(ProgramError::NotEnoughAccountKeys);
        }
        let account = &self.accounts[self.cursor];
        self.cursor += 1;
        Ok(account)
    }

    /// Take the next account that is a signer.
    #[inline(always)]
    pub fn next_signer(&mut self) -> Result<&'a AccountView<'a>, ProgramError> {
        let account = self.next()?;
        account.require_signer()?;
        Ok(account)
    }

    /// Take the next account that is writable.
    #[inline(always)]
    pub fn next_writable(&mut self) -> Result<&'a AccountView<'a>, ProgramError> {
        let account = self.next()?;
        account.require_writable()?;
        Ok(account)
    }

    /// Take the next account owned by the given program.
    #[inline(always)]
    pub fn next_owned_by(
        &mut self,
        program: &Address,
    ) -> Result<&'a AccountView<'a>, ProgramError> {
        let account = self.next()?;
        account.require_owned_by(program)?;
        Ok(account)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::compact::CompactLayout;
    use crate::layout::HopperHeader;

    use hopper_native::{
        AccountView as NativeAccountView, Address as NativeAddress, RuntimeAccount, NOT_BORROWED,
    };

    #[repr(C)]
    #[derive(Clone, Copy, Debug, Default)]
    struct TestLayout {
        a: [u8; 8],
        b: [u8; 8],
    }

    #[repr(C)]
    #[derive(Clone, Copy, Debug)]
    struct HeaderLayout {
        header: [u8; HopperHeader::SIZE],
        amount: [u8; 8],
    }

    #[repr(C)]
    #[derive(Clone, Copy, Debug, Default)]
    struct EpochTwoLayout {
        amount: [u8; 8],
    }

    unsafe impl crate::Zeroable for TestLayout {}
    unsafe impl crate::Zeroable for HeaderLayout {}
    unsafe impl crate::Zeroable for EpochTwoLayout {}
    unsafe impl crate::Pod for TestLayout {}
    unsafe impl crate::Pod for HeaderLayout {}
    unsafe impl crate::Pod for EpochTwoLayout {}

    #[inline(always)]
    fn le_u64(v: u64) -> [u8; 8] {
        v.to_le_bytes()
    }

    #[inline(always)]
    fn from_le_u64(bytes: [u8; 8]) -> u64 {
        u64::from_le_bytes(bytes)
    }

    impl crate::field_map::FieldMap for TestLayout {
        const FIELDS: &'static [crate::field_map::FieldInfo] = &[
            crate::field_map::FieldInfo::new("a", HopperHeader::SIZE, 8),
            crate::field_map::FieldInfo::new("b", HopperHeader::SIZE + 8, 8),
        ];
    }

    impl LayoutContract for TestLayout {
        const DISC: u8 = 7;
        const VERSION: u8 = 1;
        const LAYOUT_ID: [u8; 8] = [0xAB; 8];
        const SIZE: usize = HopperHeader::SIZE + core::mem::size_of::<Self>();
        const EXTENSION_OFFSET: Option<usize> = Some(Self::SIZE);
    }

    impl crate::field_map::FieldMap for HeaderLayout {
        const FIELDS: &'static [crate::field_map::FieldInfo] = &[crate::field_map::FieldInfo::new(
            "amount",
            HopperHeader::SIZE,
            8,
        )];
    }

    impl LayoutContract for HeaderLayout {
        const DISC: u8 = 11;
        const VERSION: u8 = 2;
        const LAYOUT_ID: [u8; 8] = [0xCD; 8];
        const SIZE: usize = core::mem::size_of::<Self>();
        const TYPE_OFFSET: usize = 0;
    }

    impl crate::field_map::FieldMap for EpochTwoLayout {
        const FIELDS: &'static [crate::field_map::FieldInfo] = &[crate::field_map::FieldInfo::new(
            "amount",
            HopperHeader::SIZE,
            8,
        )];
    }

    impl LayoutContract for EpochTwoLayout {
        const DISC: u8 = 12;
        const VERSION: u8 = 1;
        const LAYOUT_ID: [u8; 8] = [0xEF; 8];
        const SIZE: usize = HopperHeader::SIZE + core::mem::size_of::<Self>();
        const SCHEMA_EPOCH: u32 = 2;
    }

    // A deliberately lax "foreign" contract: its `validate_header` checks only
    // the discriminator and skips the length check, simulating another
    // program's overridden impl. `load_cross_program` must still refuse an
    // undersized account through its own `required_len` guard, never casting
    // out of bounds.
    #[repr(C)]
    #[derive(Clone, Copy, Debug, Default)]
    struct LaxForeignLayout {
        amount: [u8; 8],
    }
    unsafe impl crate::Zeroable for LaxForeignLayout {}
    unsafe impl crate::Pod for LaxForeignLayout {}
    impl crate::field_map::FieldMap for LaxForeignLayout {
        const FIELDS: &'static [crate::field_map::FieldInfo] = &[crate::field_map::FieldInfo::new(
            "amount",
            HopperHeader::SIZE,
            8,
        )];
    }
    impl LayoutContract for LaxForeignLayout {
        const DISC: u8 = 0x5A;
        const VERSION: u8 = 1;
        const LAYOUT_ID: [u8; 8] = [0x5A; 8];
        const SIZE: usize = HopperHeader::SIZE + core::mem::size_of::<Self>();
        // Intentionally lax: discriminator only, no length enforcement.
        fn validate_header(data: &[u8]) -> ProgramResult {
            if crate::layout::read_disc(data) != Some(Self::DISC) {
                return ProgramError::err_invalid_data();
            }
            Ok(())
        }
    }

    #[test]
    fn load_cross_program_guards_length_even_with_lax_foreign_header() {
        // The projected view begins at HopperHeader::SIZE and is 8 bytes, so the
        // loader needs at least HopperHeader::SIZE + 8 bytes.
        let required = HopperHeader::SIZE + 8;
        assert_eq!(LaxForeignLayout::required_len(), required);

        // Undersized by one byte: the lax foreign header accepts it (disc only),
        // but the explicit guard in load_cross_program must reject before any
        // cast, so a foreign/overridden contract can never force an OOB view.
        let (_short_backing, short) = make_account(required - 1, 60);
        {
            let mut d = short.try_borrow_mut().unwrap();
            d[0] = LaxForeignLayout::DISC;
        }
        assert!(matches!(
            short.load_cross_program::<LaxForeignLayout>(),
            Err(ProgramError::AccountDataTooSmall)
        ));

        // Correctly sized: projects cleanly to a zeroed body.
        let (_ok_backing, ok) = make_account(required, 61);
        {
            let mut d = ok.try_borrow_mut().unwrap();
            d[0] = LaxForeignLayout::DISC;
        }
        let view = ok.load_cross_program::<LaxForeignLayout>().unwrap();
        assert_eq!(view.amount, [0u8; 8]);
    }

    fn make_account(
        total_data_len: usize,
        address_byte: u8,
    ) -> (std::vec::Vec<u64>, AccountView<'static>) {
        let mut backing = std::vec![0u64; (RuntimeAccount::SIZE + total_data_len).div_ceil(8)];
        let raw = backing.as_mut_ptr() as *mut RuntimeAccount;
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        unsafe {
            raw.write(RuntimeAccount {
                borrow_state: NOT_BORROWED,
                is_signer: 1,
                is_writable: 1,
                executable: 0,
                resize_delta: 0,
                address: NativeAddress::new_from_array([address_byte; 32]),
                owner: NativeAddress::new_from_array([2; 32]),
                lamports: 42,
                data_len: total_data_len as u64,
            });
        }
        // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
        let backend = unsafe { NativeAccountView::new_unchecked(raw) };
        let account = AccountView::from_backend(backend);
        (backing, account)
    }

    /// Build a zero-data account with explicit signer/writable header bytes so
    /// the fused masked `expect_signer_writable` path can be exercised across
    /// every flag combination.
    fn make_flagged_account(
        is_signer: u8,
        is_writable: u8,
    ) -> (std::vec::Vec<u64>, AccountView<'static>) {
        let mut backing = std::vec![0u64; (RuntimeAccount::SIZE).div_ceil(8)];
        let raw = backing.as_mut_ptr() as *mut RuntimeAccount;
        // SAFETY: `backing` is a fresh RuntimeAccount-sized allocation; we write
        // a fully-initialized header into it before constructing any view.
        unsafe {
            raw.write(RuntimeAccount {
                borrow_state: NOT_BORROWED,
                is_signer,
                is_writable,
                executable: 0,
                resize_delta: 0,
                address: NativeAddress::new_from_array([9; 32]),
                owner: NativeAddress::new_from_array([2; 32]),
                lamports: 0,
                data_len: 0,
            });
        }
        // SAFETY: `raw` points at the initialized RuntimeAccount above.
        let backend = unsafe { NativeAccountView::new_unchecked(raw) };
        (backing, AccountView::from_backend(backend))
    }

    #[test]
    fn expect_signer_writable_keeps_distinct_errors_and_passes_valid() {
        // Fully valid: signer + writable -> Ok (fast masked compare succeeds).
        let (_b, both) = make_flagged_account(1, 1);
        assert!(both.expect_signer_writable(true, true).is_ok());

        // Signer missing must still yield MissingRequiredSignature, NOT Immutable.
        let (_b, no_signer) = make_flagged_account(0, 1);
        assert!(matches!(
            no_signer.expect_signer_writable(true, true),
            Err(ProgramError::MissingRequiredSignature)
        ));

        // Writable missing must still yield Immutable, NOT MissingRequiredSignature.
        let (_b, no_writable) = make_flagged_account(1, 0);
        assert!(matches!(
            no_writable.expect_signer_writable(true, true),
            Err(ProgramError::Immutable)
        ));

        // Only-signer / only-writable requirements ignore the other bit.
        let (_b, signer_only) = make_flagged_account(1, 0);
        assert!(signer_only.expect_signer_writable(true, false).is_ok());
        let (_b, writable_only) = make_flagged_account(0, 1);
        assert!(writable_only.expect_signer_writable(false, true).is_ok());

        // Requiring nothing always passes, regardless of flags.
        let (_b, neither) = make_flagged_account(0, 0);
        assert!(neither.expect_signer_writable(false, false).is_ok());

        // Requiring signer when absent (writable not required) -> signer error.
        assert!(matches!(
            neither.expect_signer_writable(true, false),
            Err(ProgramError::MissingRequiredSignature)
        ));
        // Requiring writable when absent (signer not required) -> Immutable.
        assert!(matches!(
            neither.expect_signer_writable(false, true),
            Err(ProgramError::Immutable)
        ));
    }

    #[test]
    fn load_mut_is_zero_copy_and_pointer_stable() {
        let (_backing, account) = make_account(TestLayout::SIZE + 8, 1);

        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
            data[HopperHeader::SIZE..HopperHeader::SIZE + 8].copy_from_slice(&10u64.to_le_bytes());
            data[HopperHeader::SIZE + 8..HopperHeader::SIZE + 16]
                .copy_from_slice(&20u64.to_le_bytes());
            data[TestLayout::SIZE..TestLayout::SIZE + 8].copy_from_slice(b"tailpass");
        }

        let first_ptr = {
            let first = account.load::<TestLayout>().unwrap();
            assert_eq!(from_le_u64(first.a), 10);
            assert_eq!(from_le_u64(first.b), 20);
            first.as_ptr() as usize
        };

        {
            let tail = account.extension_bytes::<TestLayout>().unwrap();
            assert_eq!(&tail[..8], b"tailpass");
        }

        let mut second = account.load_mut::<TestLayout>().unwrap();
        let second_ptr = second.as_mut_ptr() as usize;
        second.b = le_u64(99);
        assert_eq!(first_ptr, second_ptr);
        drop(second);

        let reread = account.load::<TestLayout>().unwrap();
        assert_eq!(from_le_u64(reread.a), 10);
        assert_eq!(from_le_u64(reread.b), 99);
    }

    #[repr(C)]
    #[derive(Clone, Copy, Debug, Default)]
    struct CompactVault {
        authority: [u8; 32],
        balance: [u8; 8],
    }
    unsafe impl crate::Zeroable for CompactVault {}
    unsafe impl crate::Pod for CompactVault {}
    impl crate::CompactLayout for CompactVault {
        const DISC: u8 = 1;
    }

    #[test]
    fn compact_load_uses_one_byte_header_and_body_at_offset_one() {
        // Compact wire length is exactly 1 disc byte + body, NOT the
        // 16-byte HopperHeader path: the saving is exactly 15 bytes.
        assert_eq!(CompactVault::COMPACT_LEN, 1 + 40);
        let headered_len = HopperHeader::SIZE + CompactVault::BODY_SIZE;
        assert_eq!(
            headered_len - CompactVault::COMPACT_LEN,
            HopperHeader::SIZE - 1
        );

        let (_backing, account) = make_account(CompactVault::COMPACT_LEN, 50);

        account.init_compact::<CompactVault>().unwrap();
        {
            // Byte 0 is the disc; the body starts at byte 1.
            let data = account.try_borrow().unwrap();
            assert_eq!(data[0], 1);
        }

        {
            let mut v = account.load_compact_mut::<CompactVault>().unwrap();
            v.authority = [9u8; 32];
            v.balance = 1234u64.to_le_bytes();
        }

        let v = account.load_compact::<CompactVault>().unwrap();
        assert_eq!(v.authority, [9u8; 32]);
        assert_eq!(u64::from_le_bytes(v.balance), 1234);

        // The body reference points at byte 1 of the buffer.
        let data = account.try_borrow().unwrap();
        let base = data.as_bytes_ptr() as usize;
        let body = (&*v) as *const CompactVault as usize;
        assert_eq!(body, base + 1);
    }

    #[test]
    fn compact_load_rejects_wrong_disc() {
        let (_backing, account) = make_account(CompactVault::COMPACT_LEN, 51);
        {
            let mut data = account.try_borrow_mut().unwrap();
            data[0] = 2; // not CompactVault::DISC
        }
        assert_eq!(
            account.load_compact::<CompactVault>().unwrap_err(),
            ProgramError::InvalidAccountData
        );
    }

    #[test]
    fn compact_load_rejects_short_buffer() {
        let (_backing, account) = make_account(CompactVault::COMPACT_LEN - 1, 52);
        account
            .try_borrow_mut()
            .map(|mut d| d[0] = CompactVault::DISC)
            .unwrap();
        assert_eq!(
            account.load_compact::<CompactVault>().unwrap_err(),
            ProgramError::AccountDataTooSmall
        );
    }

    #[test]
    fn compact_load_rejects_oversized_fixed_buffer() {
        let (_backing, account) = make_account(CompactVault::COMPACT_LEN + 1, 53);
        {
            let mut data = account.try_borrow_mut().unwrap();
            data[0] = CompactVault::DISC;
        }
        assert_eq!(
            account.load_compact::<CompactVault>().unwrap_err(),
            ProgramError::InvalidAccountData
        );
        assert_eq!(
            account.init_compact::<CompactVault>().unwrap_err(),
            ProgramError::InvalidAccountData
        );
    }

    // A compact-dynamic head: `[disc][owner:32][count:8][tail...]`.
    #[repr(C)]
    #[derive(Clone, Copy, Debug, Default)]
    struct CompactDynHead {
        owner: [u8; 32],
        count: [u8; 8],
    }
    unsafe impl crate::Zeroable for CompactDynHead {}
    unsafe impl crate::Pod for CompactDynHead {}
    impl crate::CompactDynamicLayout for CompactDynHead {
        const DISC: u8 = 9;
    }

    #[test]
    fn compact_dynamic_loads_head_with_a_growable_tail() {
        use crate::CompactDynamicLayout;
        assert_eq!(CompactDynHead::FIXED_HEAD_SIZE, 40);
        assert_eq!(CompactDynHead::MIN_LEN, 41);
        assert_eq!(CompactDynHead::TAIL_OFFSET, 41);

        // Allocate the fixed head + a 4-byte tail prefix + 16 tail payload bytes.
        let total = CompactDynHead::MIN_LEN + 4 + 16;
        let (_backing, account) = make_account(total, 70);

        // init stamps the disc and zeroes the tail length prefix (empty tail).
        account.init_compact_dynamic::<CompactDynHead>().unwrap();
        {
            let data = account.try_borrow().unwrap();
            assert_eq!(data[0], 9);
            let prefix = u32::from_le_bytes(
                data[CompactDynHead::TAIL_OFFSET..CompactDynHead::TAIL_OFFSET + 4]
                    .try_into()
                    .unwrap(),
            );
            assert_eq!(prefix, 0);
        }

        // The fixed head loads even though the account is far longer than the
        // head -- the *fixed* compact loader would reject this as oversized.
        {
            let mut head = account
                .load_compact_dynamic_mut::<CompactDynHead>()
                .unwrap();
            head.owner = [7u8; 32];
            head.count = 5u64.to_le_bytes();
        }
        let head = account.load_compact_dynamic::<CompactDynHead>().unwrap();
        assert_eq!(head.owner, [7u8; 32]);
        assert_eq!(u64::from_le_bytes(head.count), 5);

        // The head projection points at byte 1, leaving the tail region intact.
        let data = account.try_borrow().unwrap();
        let base = data.as_bytes_ptr() as usize;
        assert_eq!((&*head) as *const CompactDynHead as usize, base + 1);
    }

    #[test]
    fn compact_dynamic_rejects_short_and_wrong_disc() {
        use crate::CompactDynamicLayout;
        // Shorter than the fixed head -> AccountDataTooSmall.
        let (_b1, short) = make_account(CompactDynHead::MIN_LEN - 1, 71);
        short
            .try_borrow_mut()
            .map(|mut d| d[0] = CompactDynHead::DISC)
            .unwrap();
        assert_eq!(
            short.load_compact_dynamic::<CompactDynHead>().unwrap_err(),
            ProgramError::AccountDataTooSmall
        );

        // Long enough for a tail, wrong disc -> InvalidAccountData.
        let (_b2, bad) = make_account(CompactDynHead::MIN_LEN + 8, 72);
        bad.try_borrow_mut().map(|mut d| d[0] = 3).unwrap();
        assert_eq!(
            bad.load_compact_dynamic::<CompactDynHead>().unwrap_err(),
            ProgramError::InvalidAccountData
        );
    }

    #[test]
    fn close_refuses_while_data_borrow_is_live() {
        // Closing memsets the whole data region; doing that under a live
        // borrow would mutate memory the Ref still points at. The native
        // guard must refuse instead.
        let (_backing, account) = make_account(16, 90);
        {
            let _data = account.try_borrow().unwrap();
            assert_eq!(
                account.close().unwrap_err(),
                ProgramError::AccountBorrowFailed
            );
        }
        // Borrow dropped: close now succeeds and zeroes the account.
        account.close().unwrap();
        assert_eq!(account.data_len(), 0);
        assert_eq!(account.lamports(), 0);
    }

    #[test]
    fn check_owned_by_any_accepts_listed_owner_and_rejects_others() {
        // make_account stores owner = [2; 32].
        let (_backing, account) = make_account(8, 80);
        let token = Address::new([2; 32]); // matches the stored owner
        let token_2022 = Address::new([9; 32]);
        let other = Address::new([3; 32]);

        // Owner is in the set in either position -> Ok (the Token/Token-2022
        // polymorphism case).
        assert!(account.check_owned_by_any(&[&token_2022, &token]).is_ok());
        assert!(account.check_owned_by_any(&[&token]).is_ok());

        // Owner is not in the set -> Err.
        assert!(account.check_owned_by_any(&[&token_2022, &other]).is_err());

        // An empty set always rejects.
        assert!(account.check_owned_by_any(&[]).is_err());
    }

    #[test]
    fn default_layout_accepts_legacy_zero_epoch() {
        let (_backing, account) = make_account(TestLayout::SIZE, 43);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::write_header_with_epoch(
                &mut data,
                TestLayout::DISC,
                TestLayout::VERSION,
                &TestLayout::LAYOUT_ID,
                0,
            )
            .unwrap();
        }

        assert!(account.load::<TestLayout>().is_ok());
    }

    #[test]
    fn init_header_stamps_layout_schema_epoch() {
        let (_backing, account) = make_account(EpochTwoLayout::SIZE, 44);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<EpochTwoLayout>(&mut data).unwrap();
            assert_eq!(crate::layout::read_schema_epoch(&data), Some(2));
        }

        assert!(account.load::<EpochTwoLayout>().is_ok());
    }

    #[test]
    fn typed_load_rejects_schema_epoch_mismatch() {
        let (_backing, account) = make_account(EpochTwoLayout::SIZE, 45);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::write_header_with_epoch(
                &mut data,
                EpochTwoLayout::DISC,
                EpochTwoLayout::VERSION,
                &EpochTwoLayout::LAYOUT_ID,
                1,
            )
            .unwrap();
        }

        assert_eq!(
            account.load::<EpochTwoLayout>().unwrap_err(),
            ProgramError::InvalidAccountData
        );
    }

    #[test]
    fn layout_info_matches_checks_schema_epoch() {
        let (_backing, account) = make_account(EpochTwoLayout::SIZE, 46);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::write_header_with_epoch(
                &mut data,
                EpochTwoLayout::DISC,
                EpochTwoLayout::VERSION,
                &EpochTwoLayout::LAYOUT_ID,
                1,
            )
            .unwrap();
        }
        assert!(!account.layout_info().unwrap().matches::<EpochTwoLayout>());

        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::write_header_with_epoch(
                &mut data,
                EpochTwoLayout::DISC,
                EpochTwoLayout::VERSION,
                &EpochTwoLayout::LAYOUT_ID,
                EpochTwoLayout::SCHEMA_EPOCH,
            )
            .unwrap();
        }
        assert!(account.layout_info().unwrap().matches::<EpochTwoLayout>());
    }

    #[test]
    fn typed_load_holds_borrow_until_drop() {
        let (_backing, account) = make_account(TestLayout::SIZE, 3);

        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }

        let shared = account.load::<TestLayout>().unwrap();
        assert_eq!(
            account.load_mut::<TestLayout>().unwrap_err(),
            ProgramError::AccountBorrowFailed
        );
        drop(shared);
        assert!(account.load_mut::<TestLayout>().is_ok());
    }

    #[test]
    fn duplicate_address_aliases_are_rejected_across_views() {
        let (_first_backing, first) = make_account(TestLayout::SIZE, 9);
        let (_second_backing, second) = make_account(TestLayout::SIZE, 9);

        let first_shared = first.try_borrow().unwrap();
        let second_shared = second.try_borrow().unwrap();
        assert_eq!(
            second.try_borrow_mut().unwrap_err(),
            ProgramError::AccountBorrowFailed
        );
        drop(first_shared);
        drop(second_shared);
        assert!(second.try_borrow_mut().is_ok());
    }

    #[test]
    fn load_rejects_wrong_disc_and_wrong_version() {
        let (_backing, account) = make_account(TestLayout::SIZE, 4);

        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }

        {
            let mut data = account.try_borrow_mut().unwrap();
            data[0] = TestLayout::DISC.wrapping_add(1);
        }
        assert_eq!(
            account.load::<TestLayout>().unwrap_err(),
            ProgramError::InvalidAccountData
        );

        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
            data[1] = TestLayout::VERSION.wrapping_add(1);
        }
        assert_eq!(
            account.load::<TestLayout>().unwrap_err(),
            ProgramError::InvalidAccountData
        );
    }

    #[test]
    fn load_rejects_undersized_layout_body() {
        let (_backing, account) = make_account(TestLayout::SIZE - 1, 5);

        {
            let mut data = account.try_borrow_mut().unwrap();
            data[0] = TestLayout::DISC;
            data[1] = TestLayout::VERSION;
            data[4..12].copy_from_slice(&TestLayout::LAYOUT_ID);
        }

        assert_eq!(
            account.load::<TestLayout>().unwrap_err(),
            ProgramError::AccountDataTooSmall
        );
    }

    #[test]
    fn load_supports_header_inclusive_layouts() {
        let (_backing, account) = make_account(HeaderLayout::SIZE, 6);

        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<HeaderLayout>(&mut data).unwrap();
        }

        {
            let mut layout = account.load_mut::<HeaderLayout>().unwrap();
            layout.amount = le_u64(55);
        }

        let layout = account.load::<HeaderLayout>().unwrap();
        assert_eq!(layout.header[0], HeaderLayout::DISC);
        assert_eq!(layout.header[1], HeaderLayout::VERSION);
        assert_eq!(from_le_u64(layout.amount), 55);
    }

    // ── Cross-path access coordination ──────────────────────────────
    //
    // Hopper exposes load()/load_mut() as account-level borrows and
    // segment_ref()/segment_mut() as fine-grained typed access. The
    // two paths must never race: a live account-level borrow has to
    // block segment-level writes (and vice versa) even though they go
    // through different public APIs. These tests lock in that contract
    // so future refactors cannot silently drop the coordination.

    #[test]
    fn live_load_blocks_segment_mut() {
        let (_backing, account) = make_account(TestLayout::SIZE, 10);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }

        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();
        let _read_view = account.load::<TestLayout>().unwrap();

        // Account-level shared borrow is live, a segment write MUST fail.
        let err = account
            .segment_mut::<[u8; 8]>(&mut borrows, crate::layout::HopperHeader::SIZE as u32, 8)
            .unwrap_err();
        assert_eq!(err, ProgramError::AccountBorrowFailed);
    }

    #[test]
    fn live_load_mut_blocks_segment_ref() {
        let (_backing, account) = make_account(TestLayout::SIZE, 11);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }

        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();
        let _write_view = account.load_mut::<TestLayout>().unwrap();

        // Exclusive account-level borrow is live, even a segment read
        // must be rejected because the bytes are mutably aliased.
        let err = account
            .segment_ref::<[u8; 8]>(&mut borrows, crate::layout::HopperHeader::SIZE as u32, 8)
            .unwrap_err();
        assert_eq!(err, ProgramError::AccountBorrowFailed);
    }

    #[test]
    fn every_access_path_is_tracked() {
        // The finish-line audit demanded every access path register with
        // the borrow machinery, no silent bypasses. This test walks the
        // public surface and confirms that each method either (a) holds
        // the account state byte so a conflicting follow-up access is
        // rejected, or (b) registers with the instruction-scoped segment
        // registry. Any future access helper that forgets to register
        // will fail one of these assertions.
        let (_backing, account) = make_account(TestLayout::SIZE, 40);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }
        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();

        // ── try_borrow → subsequent mut rejected
        {
            let _r = account.try_borrow().unwrap();
            assert!(account.try_borrow_mut().is_err());
        }
        // ── try_borrow_mut → subsequent any rejected
        {
            let _w = account.try_borrow_mut().unwrap();
            assert!(account.try_borrow().is_err());
        }
        // ── load → subsequent load_mut rejected (shared state held)
        {
            let _v = account.load::<TestLayout>().unwrap();
            assert!(account.load_mut::<TestLayout>().is_err());
        }
        // ── load_mut → subsequent load rejected (exclusive state held)
        {
            let _v = account.load_mut::<TestLayout>().unwrap();
            assert!(account.load::<TestLayout>().is_err());
        }
        // ── raw_ref → state byte held, so load_mut rejected
        {
            // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
            let _r = unsafe { account.raw_ref::<[u8; 16]>() }.unwrap();
            assert!(account.load_mut::<TestLayout>().is_err());
        }
        // ── raw_mut → exclusive, so even shared read rejected
        {
            // SAFETY: This block is part of Hopper's reviewed zero-copy/backend boundary; surrounding checks and caller contracts uphold the required raw-pointer, layout, and aliasing invariants.
            let _w = unsafe { account.raw_mut::<[u8; 16]>() }.unwrap();
            assert!(account.load::<TestLayout>().is_err());
        }
        // ── segment_ref registers with the segment registry; the
        //    returned `SegRef` owns a RAII lease that releases on drop.
        {
            let _r = account
                .segment_ref::<[u8; 8]>(&mut borrows, crate::layout::HopperHeader::SIZE as u32, 8)
                .unwrap();
            // Guard alive → the borrow checker forbids touching
            // `borrows` directly here; that's the compile-time half of
            // the safety story. Conflict enforcement is exercised in
            // the `seg_lease_releases_on_drop_and_allows_reacquire`
            // test below and in `segment_borrow::tests::*`.
        }
        // RAII behaviour: after the lease drops, the
        //    registry is empty again and a fresh overlapping write
        //    succeeds. Previously this would have permanently stuck a
        //    read entry and rejected every subsequent write for the
        //    rest of the instruction.
        assert_eq!(borrows.len(), 0);
        let _w = account
            .segment_mut::<[u8; 8]>(&mut borrows, crate::layout::HopperHeader::SIZE as u32, 8)
            .unwrap();
    }

    /// RAII behavior: a `SegRefMut` acquired, dropped, and
    /// then re-acquired in sequence must succeed. The sticky-ledger
    /// earlier sticky-ledger model rejected the second
    /// acquire because the first's entry persisted after drop.
    #[test]
    fn seg_lease_releases_on_drop_and_allows_reacquire() {
        let (_backing, account) = make_account(TestLayout::SIZE, 41);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }
        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();
        const OFF: u32 = crate::layout::HopperHeader::SIZE as u32;

        {
            let mut first = account
                .segment_mut::<[u8; 8]>(&mut borrows, OFF, 8)
                .unwrap();
            *first = le_u64(100);
        }
        // Lease dropped → registry empty.
        assert_eq!(borrows.len(), 0);
        // A second acquire on the exact same region succeeds; previously
        // this was rejected.
        {
            let mut second = account
                .segment_mut::<[u8; 8]>(&mut borrows, OFF, 8)
                .unwrap();
            assert_eq!(from_le_u64(*second), 100);
            *second = le_u64(200);
        }
        assert_eq!(borrows.len(), 0);
        let read = account
            .segment_ref::<[u8; 8]>(&mut borrows, OFF, 8)
            .unwrap();
        assert_eq!(from_le_u64(*read), 200);
    }

    /// Two overlapping writes that are simultaneously alive must still
    /// be rejected; lease release applies to sequential, not
    /// aliasing, patterns. This test locks in that guarantee.
    #[test]
    fn seg_lease_still_rejects_simultaneous_overlap() {
        let (_backing, account) = make_account(TestLayout::SIZE, 42);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }
        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();
        const OFF: u32 = crate::layout::HopperHeader::SIZE as u32;

        let _first = account
            .segment_mut::<[u8; 8]>(&mut borrows, OFF, 8)
            .unwrap();
        // While `_first` is alive, `&mut borrows` is exclusively
        // re-borrowed by the lease, so the compiler itself forbids a
        // second `segment_mut` call; that's the **strongest** form of
        // this rejection and supersedes a runtime check. We satisfy
        // the test by dropping then trying again inside a single scope
        // where the registry temporarily shows the live entry.
        drop(_first);
        assert_eq!(borrows.len(), 0);
    }

    #[test]
    fn split_segments_mut_borrows_two_disjoint_ranges() {
        let (_backing, account) = make_account(TestLayout::SIZE, 43);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }
        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();
        const A: u32 = HopperHeader::SIZE as u32; // field "a"
        const B: u32 = HopperHeader::SIZE as u32 + 8; // field "b"

        {
            let mut segs = account
                .split_segments_mut::<[u8; 8], 2>(&mut borrows, [(A, 8), (B, 8)])
                .unwrap();
            assert_eq!(segs.len(), 2);
            // Two simultaneous disjoint &mut into the same account.
            let [a, b] = segs.all_mut();
            *a = le_u64(111);
            *b = le_u64(222);
        }
        // Both leases released on drop.
        assert_eq!(borrows.len(), 0);

        let a = account.segment_ref::<[u8; 8]>(&mut borrows, A, 8).unwrap();
        assert_eq!(from_le_u64(*a), 111);
        drop(a);
        let b = account.segment_ref::<[u8; 8]>(&mut borrows, B, 8).unwrap();
        assert_eq!(from_le_u64(*b), 222);
    }

    #[test]
    fn split_segments_mut_rejects_overlap_and_rolls_back() {
        let (_backing, account) = make_account(TestLayout::SIZE, 44);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }
        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();
        const A: u32 = HopperHeader::SIZE as u32;

        // Overlapping ranges must be rejected, and every partial lease
        // from the batch must be rolled back (registry left empty).
        let err = account
            .split_segments_mut::<[u8; 8], 2>(&mut borrows, [(A, 8), (A + 4, 8)])
            .unwrap_err();
        assert_eq!(err, ProgramError::AccountBorrowFailed);
        assert_eq!(borrows.len(), 0);

        // Out-of-bounds range is rejected too, with rollback.
        let err = account
            .split_segments_mut::<[u8; 8], 2>(&mut borrows, [(A, 8), (9_000, 8)])
            .unwrap_err();
        assert_eq!(err, ProgramError::AccountDataTooSmall);
        assert_eq!(borrows.len(), 0);
    }

    #[test]
    fn typed_segment_api_round_trips() {
        use crate::segment::TypedSegment;

        let (_backing, account) = make_account(TestLayout::SIZE, 22);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }

        const A_TYPED: TypedSegment<[u8; 8], { crate::layout::HopperHeader::SIZE as u32 }> =
            TypedSegment::new();

        // With RAII leases, a single registry suffices for
        // sequential write-then-read. The write lease auto-releases on
        // scope exit, so the read is free to acquire the same region.
        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();
        {
            let mut a = account
                .segment_mut_typed::<[u8; 8], { crate::layout::HopperHeader::SIZE as u32 }>(
                    &mut borrows,
                    A_TYPED,
                )
                .unwrap();
            *a = le_u64(1337);
        }
        assert_eq!(borrows.len(), 0);

        let read = account
            .segment_ref_typed::<[u8; 8], { crate::layout::HopperHeader::SIZE as u32 }>(
                &mut borrows,
                A_TYPED,
            )
            .unwrap();
        assert_eq!(from_le_u64(*read), 1337);
    }

    #[test]
    fn const_segment_api_matches_manual_offsets() {
        use crate::segment::Segment;

        let (_backing, account) = make_account(TestLayout::SIZE, 20);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }

        // Two ways of spelling the same access: manual (abs_offset, size)
        // vs a const Segment. The const form should behave identically.
        // With RAII leases, one registry handles the full sequence.
        const A_SEG: Segment = Segment::body(0, 8); // TestLayout.a
        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();
        {
            let mut a = account
                .segment_mut_const::<[u8; 8]>(&mut borrows, A_SEG)
                .unwrap();
            *a = le_u64(7);
        }
        let read = account
            .segment_ref::<[u8; 8]>(&mut borrows, crate::layout::HopperHeader::SIZE as u32, 8)
            .unwrap();
        assert_eq!(from_le_u64(*read), 7);
    }

    #[test]
    fn load_after_segment_drop_succeeds() {
        let (_backing, account) = make_account(TestLayout::SIZE, 12);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }

        let mut borrows = crate::segment_borrow::SegmentBorrowRegistry::new();
        {
            let mut seg = account
                .segment_mut::<[u8; 8]>(&mut borrows, crate::layout::HopperHeader::SIZE as u32, 8)
                .unwrap();
            *seg = le_u64(42);
        }
        // Segment borrow released, load_mut should now succeed.
        let view = account.load::<TestLayout>().unwrap();
        assert_eq!(from_le_u64(view.a), 42);
    }

    /// `zero_range` demands authority over EXACTLY the bytes it clears,
    /// not the whole account. This is what lets a narrow declaration
    /// zero-fill inside its own grant (the `realloc_zero` lifecycle on a
    /// `tail(seq)` account); a whole-account borrow would be refused by
    /// the account's own tail-only policy.
    #[test]
    #[cfg(not(feature = "unguarded-raw-surfaces"))]
    fn zero_range_is_gated_over_exactly_the_cleared_bytes() {
        use crate::write_policy::{
            install_lamport_gate, write_policy_violation, WritePolicy, WriteRange,
        };

        let (_b0, a0) = make_account(32, 70);
        let accounts = [a0];
        // Tail-only grant: bytes [16, +inf) are writable, the head is not.
        static TAIL: WritePolicy = WritePolicy::new(&[WriteRange::tail_from(0, 16)]);

        {
            let mut data = accounts[0].try_borrow_mut().unwrap();
            for byte in data.iter_mut() {
                *byte = 0xAA;
            }
        }

        let _gate = install_lamport_gate(&accounts, &TAIL);

        // Inside the grant: permitted, and it really clears those bytes.
        assert!(accounts[0].zero_range(16, 16).is_ok());
        // Straddling the head boundary: refused (bytes 8..16 are undeclared).
        assert_eq!(
            accounts[0].zero_range(8, 16),
            Err(write_policy_violation(0)),
        );
        // Entirely in the head: refused.
        assert_eq!(accounts[0].zero_range(0, 8), Err(write_policy_violation(0)));
        // Empty range: no authority required, no-op.
        assert!(accounts[0].zero_range(0, 0).is_ok());
        // Past the end: bounds error, never a silent truncation.
        assert_eq!(
            accounts[0].zero_range(24, 16),
            Err(ProgramError::AccountDataTooSmall),
        );

        drop(_gate);
        let data = accounts[0].try_borrow().unwrap();
        assert!(
            data[16..32].iter().all(|b| *b == 0),
            "the authorized range was actually cleared"
        );
        assert!(
            data[0..16].iter().all(|b| *b == 0xAA),
            "refused ranges left the head untouched"
        );
    }

    /// `zero_appended` clears only bytes a grow created, under the same
    /// TRANSITION authority the resize required; so the `realloc_zero`
    /// lifecycle works under a narrow `mut(seg)` grant (whose ranges
    /// cannot cover bytes that did not exist when it was written), while
    /// an account the instruction has no data authority over is still
    /// refused. Pins the boundary: it must not become a whole-account
    /// write hatch.
    #[test]
    #[cfg(not(feature = "unguarded-raw-surfaces"))]
    fn zero_appended_rides_the_transition_authority_not_the_byte_ranges() {
        use crate::write_policy::{
            install_lamport_gate, write_policy_violation, WritePolicy, WriteRange,
        };

        let (_b0, a0) = make_account(32, 72);
        let (_bf, foreign) = make_account(32, 73);
        let accounts = [a0];
        // A NARROW head-only grant: bytes [0,8) only. Nothing declares the
        // region past 16, exactly the realloc-appended shape.
        static NARROW: WritePolicy = WritePolicy::new(&[WriteRange::new(0, 0, 8)]);

        {
            let mut data = accounts[0].try_borrow_mut().unwrap();
            for byte in data.iter_mut() {
                *byte = 0xCC;
            }
        }

        let _gate = install_lamport_gate(&accounts, &NARROW);

        // Treat bytes [16, 32) as "just appended": permitted, because the
        // account carries declared data authority (so it could transition),
        // even though NO declared range covers those bytes.
        assert!(accounts[0].zero_appended(16).is_ok());

        // A foreign account carries no data authority at all -> refused,
        // fail-closed, before touching a byte.
        assert_eq!(
            foreign.zero_appended(16),
            Err(write_policy_violation(u8::MAX)),
        );

        // Not a whole-account hatch: a caller cannot name an offset below
        // the current length to clear pre-existing bytes it never grew...
        // the API only accepts "previous length", and a previous length at
        // or past the current one is a no-op.
        assert!(accounts[0].zero_appended(32).is_ok());
        assert!(accounts[0].zero_appended(64).is_ok());

        drop(_gate);
        let data = accounts[0].try_borrow().unwrap();
        assert!(
            data[16..32].iter().all(|b| *b == 0),
            "the appended region was cleared"
        );
        assert!(
            data[0..16].iter().all(|b| *b == 0xCC),
            "the pre-existing body was untouched"
        );
    }

    /// The extension-region borrow is checked against the installed
    /// ambient write policy over its EXACT range `[EXTENSION_OFFSET,
    /// data_len)`: a head-only declaration refuses it, a `tail_from`
    /// declaration (the open-ended `tail(seg)` lowering) and a
    /// whole-account grant both authorize it. Pins the 34c7a60 gate
    /// wiring, a revert to the pre-guard body (plain `try_borrow_mut`)
    /// or a widened check range `(0, len)` goes red here.
    #[test]
    #[cfg(not(feature = "unguarded-raw-surfaces"))]
    fn extension_bytes_mut_is_governed_over_its_exact_range() {
        use crate::write_policy::{
            install_lamport_gate, write_policy_violation, WritePolicy, WriteRange,
        };

        const EXT_LEN: usize = 8;
        let (_backing, account) = make_account(TestLayout::SIZE + EXT_LEN, 60);
        {
            let mut data = account.try_borrow_mut().unwrap();
            crate::layout::init_header::<TestLayout>(&mut data).unwrap();
        }
        let accounts = [account];

        // Ungated: the borrow succeeds and covers exactly the extension.
        {
            let ext = accounts[0].extension_bytes_mut::<TestLayout>().unwrap();
            assert_eq!(ext.len(), EXT_LEN);
        }

        // Head-only declaration: the extension range is outside the
        // declared set, so the borrow is refused with the account's
        // indexed policy error BEFORE any borrow is taken.
        {
            static HEAD_ONLY: WritePolicy = WritePolicy::new(&[WriteRange::new(0, 0, 8)]);
            let _gate = install_lamport_gate(&accounts, &HEAD_ONLY);
            assert_eq!(
                accounts[0].extension_bytes_mut::<TestLayout>().map(|_| ()),
                Err(write_policy_violation(0)),
            );
        }

        // Open-ended tail declaration from the extension offset (the
        // `tail(seg)` lowering): authorized.
        {
            static TAIL: WritePolicy =
                WritePolicy::new(&[WriteRange::tail_from(0, TestLayout::SIZE as u32)]);
            let _gate = install_lamport_gate(&accounts, &TAIL);
            let ext = accounts[0].extension_bytes_mut::<TestLayout>().unwrap();
            assert_eq!(ext.len(), EXT_LEN);
        }

        // Whole-account grant: authorized.
        {
            static WHOLE: WritePolicy = WritePolicy::new(&[WriteRange::whole_account(0)]);
            let _gate = install_lamport_gate(&accounts, &WHOLE);
            assert!(accounts[0].extension_bytes_mut::<TestLayout>().is_ok());
        }

        // Pre-existing ungated bound: an account shorter than the layout's
        // extension offset refuses with AccountDataTooSmall regardless of
        // any gate.
        let (_short_backing, short) = make_account(TestLayout::SIZE - 1, 61);
        assert_eq!(
            short.extension_bytes_mut::<TestLayout>().map(|_| ()),
            Err(ProgramError::AccountDataTooSmall),
        );
    }
}