o2_tools/

prop_deploy.rs

//! Deployment helpers for the independent prop-account contract family.
//!
//! Prop accounts consult a stable account-oracle proxy at runtime. The oracle,
//! registry and margin pool each retain independent SRC-14 upgrade authority.

/// Test-only: the ABI selector used by session fixtures.
#[cfg(test)]
use crate::prop::ProlongPeriod;
use crate::{
    blob_loader,
    prop::{
        PRICE_FEED_BYTECODE,
        PRICE_FEED_PROXY_BYTECODE,
        PRICE_FEED_PROXY_STORAGE,
        PRICE_FEED_STORAGE,
        PROP_ACCOUNT_BYTECODE,
        PROP_ACCOUNT_ORACLE_BYTECODE,
        PROP_ACCOUNT_ORACLE_PROXY_BYTECODE,
        PROP_ACCOUNT_ORACLE_PROXY_STORAGE,
        PROP_ACCOUNT_ORACLE_STORAGE,
        PROP_ACCOUNT_PROXY_BYTECODE,
        PROP_ACCOUNT_PROXY_STORAGE,
        PROP_ACCOUNT_STORAGE,
        PROP_MARGIN_POOL_BYTECODE,
        PROP_MARGIN_POOL_PROXY_BYTECODE,
        PROP_MARGIN_POOL_PROXY_STORAGE,
        PROP_MARGIN_POOL_STORAGE,
        PriceFeedContract,
        PriceFeedContractConfigurables,
        PriceFeedProxyContract,
        PriceFeedProxyContractConfigurables,
        PropAccountContract,
        PropAccountOracleContract,
        PropAccountOracleContractConfigurables,
        PropAccountOracleProxyContract,
        PropAccountOracleProxyContractConfigurables,
        PropAccountProxyContract,
        PropAccountProxyContractConfigurables,
        PropMarginPoolContract,
        PropMarginPoolContractConfigurables,
        PropMarginPoolProxyContract,
        PropMarginPoolProxyContractConfigurables,
        State,
    },
    trade_account_registry::{
        State as TradeAccountRegistryState,
        TRADE_ACCOUNT_REGISTER_BYTECODE,
        TRADE_ACCOUNT_REGISTER_PROXY_BYTECODE,
        TRADE_ACCOUNT_REGISTER_PROXY_STORAGE,
        TRADE_ACCOUNT_REGISTER_STORAGE,
        TradeAccountRegistry,
        TradeAccountRegistryConfigurables,
        TradeAccountRegistryDeployConfig,
        TradeAccountRegistryManager,
        TradeAccountRegistryProxy,
        TradeAccountRegistryProxyConfigurables,
    },
};
use anyhow::{
    Context,
    Result,
    ensure,
};
use fuels::{
    core::{
        Configurable,
        Configurables,
    },
    prelude::*,
    programs::contract::Regular,
    tx::StorageSlot,
    types::{
        Address,
        AssetId,
        ContractId,
        Identity,
        transaction_builders::Blob,
    },
};

/// An already-deployed shared trade-account registry to reuse for
/// prop-account registration instead of deploying a dedicated one. The
/// registry's implementation is UPGRADED in place (new blob, same proxy) to
/// carry the prop configurables, so the oracle ids it was deployed with must
/// be repeated — the fresh implementation blob embeds them again.
#[derive(Clone, Debug)]
pub struct ExistingRegistry {
    /// The registry proxy id every account resolution goes through.
    pub registry_id: ContractId,
    /// The trade-account oracle the registry validates against.
    pub trade_account_oracle_id: ContractId,
    /// The trial-trade-account oracle the registry validates against.
    pub trial_trade_account_oracle_id: ContractId,
}

/// Deployment-time settings for the prop-account system.
#[derive(Clone, Debug)]
pub struct PropDeployConfig {
    /// Asset used for collateral and quote accounting by the pool.
    pub collateral_asset: AssetId,
    /// Decimal precision of `collateral_asset`.
    pub collateral_decimals: u8,
    /// Maximum number of order books in one tier version.
    pub max_tier_books: u64,
    /// Fee charged by `repay_base_from_collateral`, in parts per million of the
    /// quote value of the debt closed. Same scale as the order book's taker fee,
    /// so `100` is one basis point.
    pub base_repay_fee_ppm: u64,
    /// Owner of the oracle implementation, feed, registry implementation and pool.
    /// Defaults to the deployer.
    pub owner: Option<Identity>,
    /// Owner of the oracle, registry and pool SRC-14 proxies. Defaults to the deployer.
    pub proxy_owner: Option<Identity>,
    /// Cosigner exposed by every prop account. Defaults to the deployer.
    pub cosigner: Option<Address>,
    /// Recipient of the platform share. Defaults to the deployer.
    pub platform_payout: Option<Identity>,
    /// Recipient of assets retained during forced settlement. Defaults to the deployer.
    pub liquidator: Option<Identity>,
    /// Deterministic salt used for all contracts in this deployment.
    pub salt: Salt,
    /// Maximum implementation words placed into each loader data blob.
    pub max_words_per_blob: usize,
    /// Reuse (and upgrade) an existing shared trade-account registry
    /// instead of deploying a dedicated one.
    pub existing_registry: Option<ExistingRegistry>,
    /// Stable margin-account oracle proxy to reuse and upgrade. An explicit
    /// ID takes precedence over the registry's live oracle, allowing repairs.
    /// If absent, reuse the registry's nonzero oracle before deriving a new one.
    pub existing_oracle: Option<ContractId>,
    /// Reuse an already-deployed price feed. When omitted, an initialized
    /// existing oracle supplies its pool's feed; otherwise a production feed
    /// is deployed behind its own SRC-14 proxy.
    pub existing_price_feed: Option<ContractId>,
    /// Submission-age bound written to the feed, in seconds. `None` leaves
    /// the contract's own default in place; a value is reconciled
    /// compare-first, so a feed already on it costs no transaction.
    pub max_offchain_age_seconds: Option<u64>,
    /// Reuse an already-deployed margin pool instead of deriving its
    /// address. The derivation depends on the pool BYTECODE (through the
    /// bootstrap blob the proxy is seeded with), so a release that changes
    /// the pool derives a new address and forks the pool. Anyone who
    /// already knows their pool must pin it here to get an upgrade rather
    /// than a fork.
    pub existing_pool: Option<ContractId>,
}

impl PropDeployConfig {
    pub fn new(collateral_asset: AssetId) -> Self {
        Self {
            collateral_asset,
            collateral_decimals: 6,
            max_tier_books: 80,
            base_repay_fee_ppm: 100,
            owner: None,
            proxy_owner: None,
            cosigner: None,
            platform_payout: None,
            liquidator: None,
            salt: Salt::default(),
            max_words_per_blob: 10_000,
            existing_registry: None,
            existing_oracle: None,
            existing_price_feed: None,
            max_offchain_age_seconds: None,
            existing_pool: None,
        }
    }
}

/// Validated existing margin-account oracle and its immutable pool binding.
#[derive(Clone, Copy, Debug)]
pub struct ExistingPropOracle {
    pub oracle_id: ContractId,
    /// `None` while the oracle is still uninitialized after an interrupted deploy.
    pub pool_id: Option<ContractId>,
}

/// Resolve and validate the oracle before any deployment transactions.
///
/// A configured ID wins over the registry so a bad registry target can be
/// repaired. Missing contracts, read failures and conflicting pool bindings
/// are errors, never reasons to derive a replacement oracle.
pub async fn resolve_existing_oracle<W: Account + Clone>(
    wallet: &W,
    configured_oracle: Option<ContractId>,
    registry_id: Option<ContractId>,
    configured_pool: Option<ContractId>,
) -> Result<Option<ExistingPropOracle>> {
    let oracle_id = if let Some(oracle_id) = configured_oracle {
        ensure!(
            oracle_id != ContractId::zeroed(),
            "configured margin oracle cannot be zero"
        );
        oracle_id
    } else if let Some(registry_id) = registry_id {
        let oracle_id = TradeAccountRegistry::new(registry_id, wallet.clone())
            .methods()
            .get_prop_oracle_id()
            .simulate(Execution::state_read_only())
            .await
            .context("read the registry's margin oracle")?
            .value;
        if oracle_id == ContractId::zeroed() {
            return Ok(None);
        }
        oracle_id
    } else {
        return Ok(None);
    };
    ensure!(
        wallet.try_provider()?.contract_exists(&oracle_id).await?,
        "configured margin oracle {oracle_id} does not exist"
    );
    let target = PropAccountOracleProxyContract::new(oracle_id, wallet.clone())
        .methods()
        .proxy_target()
        .simulate(Execution::state_read_only())
        .await
        .context("read the existing margin oracle proxy target")?
        .value;
    let oracle = PropAccountOracleContract::new(oracle_id, wallet.clone());
    // A Create may have succeeded before either initialization transaction.
    // Do not call through a proxy whose target has not been initialized yet.
    let pool_id = if target.is_some()
        && oracle
            .methods()
            .owner()
            .simulate(Execution::state_read_only())
            .await
            .context("read the existing margin oracle owner")?
            .value
            != State::Uninitialized
    {
        let pool_id = oracle
            .methods()
            .get_prop_margin_pool()
            .simulate(Execution::state_read_only())
            .await
            .context("read the existing margin oracle's pool")?
            .value
            .context("initialized margin oracle has no pool")?;
        ensure!(
            pool_id != ContractId::zeroed(),
            "initialized margin oracle has a zero pool"
        );
        if let Some(configured_pool) = configured_pool {
            ensure!(
                configured_pool == pool_id,
                "margin oracle {oracle_id} is bound to pool {pool_id}, but configured pool is {configured_pool}; the oracle's pool cannot be changed"
            );
        }
        ensure!(
            wallet.try_provider()?.contract_exists(&pool_id).await?,
            "margin oracle's pool {pool_id} does not exist"
        );
        Some(pool_id)
    } else {
        None
    };
    Ok(Some(ExistingPropOracle { oracle_id, pool_id }))
}

/// Handles and implementation blob IDs produced by a complete deployment.
#[derive(Clone)]
pub struct PropDeployment<W> {
    /// Oracle implementation ABI bound to its stable SRC-14 proxy.
    pub oracle: PropAccountOracleContract<W>,
    pub oracle_proxy: PropAccountOracleProxyContract<W>,
    pub oracle_id: ContractId,
    pub oracle_blob_id: BlobId,
    /// The price feed the pool values against, bound through its proxy.
    pub price_feed: PriceFeedContract<W>,
    pub price_feed_id: ContractId,
    /// Shared trade-account registry implementation ABI bound to its SRC-14 proxy.
    pub registry: TradeAccountRegistry<W>,
    pub registry_proxy: TradeAccountRegistryProxy<W>,
    pub registry_id: ContractId,
    pub registry_blob_id: BlobId,
    /// Margin-pool implementation ABI bound to its SRC-14 proxy.
    pub pool: PropMarginPoolContract<W>,
    pub pool_proxy: PropMarginPoolProxyContract<W>,
    pub pool_id: ContractId,
    pub pool_blob_id: BlobId,
    /// Runtime account implementation selected through the oracle proxy.
    pub account_blob_id: BlobId,
    /// Raw configurable account-proxy bytecode consumed by the registry.
    pub account_proxy_blob_id: BlobId,
    /// Fixed salt used with parent/index configurables for deterministic children.
    pub account_salt: Salt,
    pub deployer_wallet: W,
}

impl<W> PropDeployment<W>
where
    W: Account + Clone,
{
    /// Deploy the full system in dependency order.
    ///
    /// The registry is deployed before the pool so its ID can be embedded in
    /// the pool implementation configurables. The pool ID is then stored in
    /// the account oracle through its stable proxy.
    pub async fn deploy(deployer_wallet: &W, config: &PropDeployConfig) -> Result<Self> {
        ensure!(
            config.collateral_asset != AssetId::zeroed(),
            "prop collateral asset cannot be zero"
        );
        ensure!(
            config.collateral_decimals <= 18,
            "prop collateral decimals cannot exceed 18"
        );
        ensure!(
            config.max_tier_books != 0,
            "prop max tier books cannot be zero"
        );
        ensure!(
            config.max_words_per_blob != 0,
            "prop loader blob size cannot be zero"
        );

        let deployer = Identity::Address(deployer_wallet.address());
        let proxy_owner = config.proxy_owner.unwrap_or(deployer);
        let mut existing_oracle = resolve_existing_oracle(
            deployer_wallet,
            config.existing_oracle,
            config
                .existing_registry
                .as_ref()
                .map(|registry| registry.registry_id),
            config.existing_pool,
        )
        .await?;
        // Predict a fresh proxy without uploading anything. A deterministic
        // retry may find an existing oracle even without saved IDs, and its
        // immutable pool binding needs the same validation as a pinned oracle.
        let derived_oracle = if existing_oracle.is_none() {
            let (data_blobs, bootstrap) = blob_loader::build_loader_blobs(
                PROP_ACCOUNT_ORACLE_BYTECODE.to_vec(),
                config.salt,
                storage_slots(PROP_ACCOUNT_ORACLE_STORAGE)?,
                Configurables::default(),
                config.max_words_per_blob,
            )?;
            // The bootstrap breaks the oracle -> pool -> registry -> oracle
            // deployment cycle without making the proxy ID depend on the pool.
            let contract = regular_contract_with_implementation_storage(
                PROP_ACCOUNT_ORACLE_PROXY_BYTECODE,
                PROP_ACCOUNT_ORACLE_PROXY_STORAGE,
                PROP_ACCOUNT_ORACLE_STORAGE,
                config.salt,
            )?
            .with_configurables(
                PropAccountOracleProxyContractConfigurables::default()
                    .with_INITIAL_OWNER(State::Initialized(proxy_owner))?
                    .with_INITIAL_TARGET(bootstrap.id().into())?,
            );
            let oracle_id = contract.contract_id();
            if deployer_wallet
                .try_provider()?
                .contract_exists(&oracle_id)
                .await?
            {
                existing_oracle = resolve_existing_oracle(
                    deployer_wallet,
                    Some(oracle_id),
                    None,
                    config.existing_pool,
                )
                .await?;
            }
            Some((contract, data_blobs, bootstrap))
        } else {
            None
        };
        let mut resolved_config = config.clone();
        if let Some(existing) = existing_oracle {
            resolved_config.existing_oracle = Some(existing.oracle_id);
            resolved_config.existing_pool = config.existing_pool.or(existing.pool_id);
            // An initialized oracle already identifies its pool and feed.
            // Preserve both when omitted, including across salt/bytecode changes.
            if let Some(pool_id) = existing.pool_id
                && config.existing_price_feed.is_none()
            {
                let feed_id =
                    PropMarginPoolContract::new(pool_id, deployer_wallet.clone())
                        .methods()
                        .price_feed()
                        .simulate(Execution::state_read_only())
                        .await
                        .context("read the existing margin pool's price feed")?
                        .value;
                if feed_id != ContractId::zeroed() {
                    resolved_config.existing_price_feed = Some(feed_id);
                }
            }
        }
        let config = &resolved_config;

        let owner = config.owner.unwrap_or(deployer);
        // `initialize` refuses a zero cosigner or liquidator, so the blob this
        // run uploads has to name SOMETHING - the deployer is the only sensible
        // bootstrap. In production both arrive as explicit deploy parameters.
        //
        // The seed is only ever CONSUMED by `initialize`, which is guarded by
        // the initialization flag, so on an already-deployed pool or oracle it
        // is inert: storage keeps the live value and the reconciliation in
        // `o2-deploy` is what changes it, on request. That is why the warnings
        // are not raised here - the fallback is not news, USING it is. Warning
        // at the fallback made an ordinary upgrade announce that the deploy key
        // had become the residue payee, which was never true and is exactly the
        // sort of false alarm that gets real ones ignored.
        let cosigner_defaulted = config.cosigner.is_none();
        let cosigner = config.cosigner.unwrap_or_else(|| deployer_wallet.address());
        let platform_payout = config.platform_payout.unwrap_or(deployer);
        let liquidator_defaulted = config.liquidator.is_none();
        let liquidator = config.liquidator.unwrap_or(deployer);

        let account_blob_id = upload_implementation(
            deployer_wallet,
            PROP_ACCOUNT_BYTECODE,
            PROP_ACCOUNT_STORAGE,
            Configurables::default(),
            config,
        )
        .await
        .context("deploy prop-account implementation blob")?;

        // This must remain raw bytecode: the registry BLDd-loads it and patches
        // the account-specific configurables before checking the child root.
        let account_proxy_blob_id = blob_loader::upload_loader_blobs(
            deployer_wallet,
            vec![],
            Blob::new(PROP_ACCOUNT_PROXY_BYTECODE.to_vec()),
        )
        .await
        .context("deploy raw prop-account proxy blob")?;

        let oracle_id = match config.existing_oracle {
            Some(oracle_id) => oracle_id,
            None => {
                let (oracle_proxy_contract, data_blobs, bootstrap) = derived_oracle
                    .context("missing fresh oracle deployment artifacts")?;
                blob_loader::upload_loader_blobs(deployer_wallet, data_blobs, bootstrap)
                    .await
                    .context("deploy prop-account oracle bootstrap blobs")?;
                let (oracle_id, _) =
                    deploy_regular(deployer_wallet, oracle_proxy_contract)
                        .await
                        .context("deploy prop-account oracle proxy")?;
                oracle_id
            }
        };
        let oracle_proxy =
            PropAccountOracleProxyContract::new(oracle_id, deployer_wallet.clone());
        let oracle = PropAccountOracleContract::new(oracle_id, deployer_wallet.clone());
        // State-checked rather than is-new-gated: a run that crashed between
        // the Create and this call resumes here instead of stranding an
        // uninitialized proxy forever.
        let oracle_proxy_target = oracle_proxy
            .methods()
            .proxy_target()
            .simulate(Execution::state_read_only())
            .await
            .context("read prop-account oracle proxy target")?
            .value;
        if oracle_proxy_target.is_none() {
            oracle_proxy
                .methods()
                .initialize_proxy()
                .call()
                .await
                .context("initialize prop-account oracle proxy")?;
        }

        // The PRODUCTION price feed, behind its own SRC-14 proxy — not the
        // test mock, which has neither role administration nor a pause
        // switch and has no business backing a real pool.
        let (price_feed, price_feed_id) = match config.existing_price_feed {
            Some(price_feed_id) => (
                PriceFeedContract::new(price_feed_id, deployer_wallet.clone()),
                price_feed_id,
            ),
            None => {
                // Same bootstrap trick the pool and the oracle use: the
                // proxy's ADDRESS must not depend on the implementation's
                // configurables, or naming a different owner would derive a
                // different proxy and fork the feed instead of upgrading it.
                let feed_bootstrap_blob_id = upload_implementation(
                    deployer_wallet,
                    PRICE_FEED_BYTECODE,
                    PRICE_FEED_STORAGE,
                    Configurables::default(),
                    config,
                )
                .await
                .context("deploy price-feed bootstrap implementation blob")?;
                let feed_proxy_configurables =
                    PriceFeedProxyContractConfigurables::default()
                        .with_INITIAL_OWNER(State::Initialized(proxy_owner))?
                        .with_INITIAL_TARGET(ContractId::from(feed_bootstrap_blob_id))?;
                let feed_proxy_contract = regular_contract_with_implementation_storage(
                    PRICE_FEED_PROXY_BYTECODE,
                    PRICE_FEED_PROXY_STORAGE,
                    PRICE_FEED_STORAGE,
                    config.salt,
                )?
                .with_configurables(feed_proxy_configurables);
                let (price_feed_id, _) =
                    deploy_regular(deployer_wallet, feed_proxy_contract)
                        .await
                        .context("deploy price-feed proxy")?;
                let feed_proxy =
                    PriceFeedProxyContract::new(price_feed_id, deployer_wallet.clone());
                let feed_proxy_target = feed_proxy
                    .methods()
                    .proxy_target()
                    .simulate(Execution::state_read_only())
                    .await
                    .context("read price-feed proxy target")?
                    .value;
                if feed_proxy_target.is_none() {
                    feed_proxy
                        .methods()
                        .initialize_proxy()
                        .call()
                        .await
                        .context("initialize price-feed proxy")?;
                }
                upgrade_price_feed_implementation(
                    deployer_wallet,
                    price_feed_id,
                    owner,
                    config,
                )
                .await?;
                let price_feed =
                    PriceFeedContract::new(price_feed_id, deployer_wallet.clone());
                let feed_is_uninitialized = price_feed
                    .methods()
                    .owner()
                    .simulate(Execution::state_read_only())
                    .await
                    .context("read price-feed initialization state")?
                    .value
                    == State::Uninitialized;
                if feed_is_uninitialized {
                    price_feed
                        .methods()
                        .initialize()
                        .call()
                        .await
                        .context("initialize price-feed")?;
                }
                // `initialize` grants the owner the ADMIN role only —
                // publishing needs the submitter role named explicitly, and
                // the deploy seeds its prices as the owner. No widening: the
                // owner may grant it to itself at will, so withholding it
                // would only mean the first publish reverts.
                let owner_can_publish = price_feed
                    .methods()
                    .has_role(PRICE_SUBMITTER_ROLE, owner)
                    .simulate(Execution::state_read_only())
                    .await
                    .context("read the price feed's submitter role")?
                    .value;
                if !owner_can_publish {
                    price_feed
                        .methods()
                        .add_publisher(owner)
                        .call()
                        .await
                        .context("grant the price feed's owner the submitter role")?;
                }
                (price_feed, price_feed_id)
            }
        };

        // The submission-age bound, reconciled compare-first against
        // whatever the feed currently enforces. Opt-in: with nothing
        // configured the contract's own default stands, so a feed this
        // deploy does not own is never written to.
        if let Some(seconds) = config.max_offchain_age_seconds {
            let current = price_feed
                .methods()
                .get_max_offchain_age()
                .simulate(Execution::state_read_only())
                .await
                .context("read the price feed's submission-age bound")?
                .value;
            if current != seconds {
                price_feed
                    .methods()
                    .set_max_offchain_age(seconds)
                    .call()
                    .await
                    .context("set the price feed's submission-age bound")?;
            }
        }

        let [oracle_offset, parent_offset, index_offset] = prop_account_proxy_offsets()?;
        let prop_registry_configurables = |base: TradeAccountRegistryConfigurables| {
            Ok::<_, anyhow::Error>(
                base.with_PROP_ACCOUNT_ORACLE_CONTRACT_ID(oracle_id)?
                    .with_DEFAULT_PROP_ACCOUNT_PROXY(ContractId::from(
                        account_proxy_blob_id,
                    ))?
                    .with_PROP_ORACLE_CONFIG_OFFSET(oracle_offset)?
                    .with_PROP_PARENT_CONFIG_OFFSET(parent_offset)?
                    .with_PROP_INDEX_CONFIG_OFFSET(index_offset)?,
            )
        };
        let (registry_id, registry_blob_id) = match &config.existing_registry {
            Some(existing) => {
                // Upgrade the shared registry's implementation in place:
                // same proxy, a fresh blob repeating the oracle ids it was
                // deployed with plus the prop configurables above. Storage
                // (registered accounts, ownership) rides through untouched.
                let manager = TradeAccountRegistryManager::new(
                    deployer_wallet.clone(),
                    existing.registry_id,
                );
                let deploy_config = TradeAccountRegistryDeployConfig {
                    registry_config: prop_registry_configurables(
                        TradeAccountRegistryConfigurables::default(),
                    )?,
                    ..Default::default()
                };
                // Blob uploads are exists-checked; the retarget only fires
                // when the proxy does not already point at the upgraded
                // implementation, so a re-run is a no-op.
                let registry_blob_id = TradeAccountRegistryManager::deploy_register_blob(
                    deployer_wallet,
                    existing.trade_account_oracle_id,
                    existing.trial_trade_account_oracle_id,
                    &deploy_config,
                )
                .await
                .context("build upgraded shared trade-account registry blob")?;
                let current_target = manager
                    .registry_proxy
                    .methods()
                    .proxy_target()
                    .simulate(Execution::state_read_only())
                    .await
                    .context("read shared trade-account registry proxy target")?
                    .value;
                if current_target != Some(ContractId::from(registry_blob_id)) {
                    manager
                        .registry_proxy
                        .methods()
                        .set_proxy_target(ContractId::from(registry_blob_id))
                        .call()
                        .await
                        .context("upgrade shared trade-account registry for prop")?;
                }
                (existing.registry_id, registry_blob_id)
            }
            None => {
                let registry_configurables = prop_registry_configurables(
                    TradeAccountRegistryConfigurables::default()
                        .with_INITIAL_OWNER(TradeAccountRegistryState::Initialized(
                            owner,
                        ))?
                        .with_INITIAL_TRIAL_TRADE_ACCOUNT_CREATOR(owner)?,
                )?;
                let registry_blob_id = upload_implementation(
                    deployer_wallet,
                    TRADE_ACCOUNT_REGISTER_BYTECODE,
                    TRADE_ACCOUNT_REGISTER_STORAGE,
                    registry_configurables,
                    config,
                )
                .await
                .context("deploy shared trade-account registry implementation blob")?;

                let registry_proxy_configurables =
                    TradeAccountRegistryProxyConfigurables::default()
                        .with_INITIAL_OWNER(TradeAccountRegistryState::Initialized(
                            proxy_owner,
                        ))?
                        .with_INITIAL_TARGET(ContractId::from(registry_blob_id))?;
                let registry_proxy_contract = regular_contract(
                    TRADE_ACCOUNT_REGISTER_PROXY_BYTECODE,
                    TRADE_ACCOUNT_REGISTER_PROXY_STORAGE,
                    config.salt,
                )?
                .with_configurables(registry_proxy_configurables);
                let (registry_id, registry_proxy_is_new) =
                    deploy_regular(deployer_wallet, registry_proxy_contract)
                        .await
                        .context("deploy shared trade-account registry proxy")?;
                let registry_proxy =
                    TradeAccountRegistryProxy::new(registry_id, deployer_wallet.clone());
                let registry =
                    TradeAccountRegistry::new(registry_id, deployer_wallet.clone());
                if registry_proxy_is_new {
                    registry_proxy
                        .methods()
                        .initialize_proxy()
                        .call()
                        .await
                        .context("initialize shared trade-account registry proxy")?;
                    registry
                        .methods()
                        .initialize()
                        .call()
                        .await
                        .context("initialize shared trade-account registry")?;
                }
                (registry_id, registry_blob_id)
            }
        };
        let registry_proxy =
            TradeAccountRegistryProxy::new(registry_id, deployer_wallet.clone());
        let registry = TradeAccountRegistry::new(registry_id, deployer_wallet.clone());

        let pool_configurables = PropMarginPoolContractConfigurables::default()
            .with_INITIAL_ADMIN(owner)?
            .with_INITIAL_REGISTRY(registry_id)?
            .with_INITIAL_PRICE_FEED(price_feed_id)?
            .with_INITIAL_PLATFORM_PAYOUT(platform_payout)?
            .with_INITIAL_LIQUIDATOR(liquidator)?
            .with_COLLATERAL_ASSET(config.collateral_asset)?
            .with_COLLATERAL_DECIMALS(config.collateral_decimals)?
            .with_MAX_TIER_BOOKS(config.max_tier_books)?
            .with_BASE_REPAY_FEE_PPM(config.base_repay_fee_ppm)?;
        let pool_blob_id = upload_implementation(
            deployer_wallet,
            PROP_MARGIN_POOL_BYTECODE,
            PROP_MARGIN_POOL_STORAGE,
            pool_configurables,
            config,
        )
        .await
        .context("deploy prop margin-pool implementation blob")?;

        // The proxy's ADDRESS must not depend on the implementation's
        // configurables, or changing a runtime value - the liquidator, the
        // payout party, the feed - would derive a DIFFERENT proxy and fork the
        // pool instead of upgrading it. Point it at a default-config bootstrap
        // blob (the same trick the oracle below uses to break its own cycle),
        // then retarget to the configured implementation.
        // ...but that only covers CONFIGURABLE changes. The bootstrap blob
        // id is a hash of the pool BYTECODE, so any release that touches
        // the pool derives a different `INITIAL_TARGET`, a different proxy
        // address, and forks the pool instead of upgrading it — silently,
        // leaving the funded one orphaned. A caller that already knows its
        // pool pins the id, and derivation is only for the first deploy.
        let pool_id = match config.existing_pool {
            Some(pool_id) => pool_id,
            None => {
                let pool_bootstrap_blob_id = upload_implementation(
                    deployer_wallet,
                    PROP_MARGIN_POOL_BYTECODE,
                    PROP_MARGIN_POOL_STORAGE,
                    Configurables::default(),
                    config,
                )
                .await
                .context("deploy prop margin-pool bootstrap implementation blob")?;
                let pool_proxy_configurables =
                    PropMarginPoolProxyContractConfigurables::default()
                        .with_INITIAL_OWNER(State::Initialized(proxy_owner))?
                        .with_INITIAL_TARGET(ContractId::from(pool_bootstrap_blob_id))?;
                let pool_proxy_contract = regular_contract_with_implementation_storage(
                    PROP_MARGIN_POOL_PROXY_BYTECODE,
                    PROP_MARGIN_POOL_PROXY_STORAGE,
                    PROP_MARGIN_POOL_STORAGE,
                    config.salt,
                )?
                .with_configurables(pool_proxy_configurables);
                let (pool_id, _) = deploy_regular(deployer_wallet, pool_proxy_contract)
                    .await
                    .context("deploy prop margin-pool proxy")?;
                pool_id
            }
        };
        let pool_proxy =
            PropMarginPoolProxyContract::new(pool_id, deployer_wallet.clone());
        let pool = PropMarginPoolContract::new(pool_id, deployer_wallet.clone());
        let pool_proxy_target = pool_proxy
            .methods()
            .proxy_target()
            .simulate(Execution::state_read_only())
            .await
            .context("read prop margin-pool proxy target")?
            .value;
        if pool_proxy_target.is_none() {
            pool_proxy
                .methods()
                .initialize_proxy()
                .call()
                .await
                .context("initialize prop margin-pool proxy")?;
        }
        // The upgrade itself: new configurables mean a new blob, and the
        // stable proxy is pointed at it. A run that changes nothing computes
        // the same blob id and retargets nothing.
        let pool_target = pool_proxy
            .methods()
            .proxy_target()
            .simulate(Execution::state_read_only())
            .await
            .context("read configured prop margin-pool proxy target")?
            .value;
        if pool_target != Some(ContractId::from(pool_blob_id)) {
            pool_proxy
                .methods()
                .set_proxy_target(ContractId::from(pool_blob_id))
                .call()
                .await
                .context("activate configured prop margin-pool implementation")?;
        }

        let oracle_configurables = PropAccountOracleContractConfigurables::default()
            .with_INITIAL_OWNER(owner)?
            .with_INITIAL_PROP_ACCOUNT_IMPL(ContractId::from(account_blob_id))?
            .with_INITIAL_COSIGNER(cosigner)?
            .with_INITIAL_PROP_MARGIN_POOL(pool_id)?;
        let oracle_blob_id = upload_implementation(
            deployer_wallet,
            PROP_ACCOUNT_ORACLE_BYTECODE,
            PROP_ACCOUNT_ORACLE_STORAGE,
            oracle_configurables,
            config,
        )
        .await
        .context("deploy configured prop-account oracle implementation blob")?;
        let oracle_target = oracle_proxy
            .methods()
            .proxy_target()
            .simulate(Execution::state_read_only())
            .await
            .context("read prop-account oracle proxy target")?
            .value;
        if oracle_target != Some(ContractId::from(oracle_blob_id)) {
            oracle_proxy
                .methods()
                .set_proxy_target(ContractId::from(oracle_blob_id))
                .call()
                .await
                .context("activate configured prop-account oracle implementation")?;
        }

        let oracle_is_uninitialized = oracle
            .methods()
            .owner()
            .simulate(Execution::state_read_only())
            .await
            .context("read prop-account oracle initialization state")?
            .value
            == State::Uninitialized;
        if oracle_is_uninitialized {
            // NOW the seed becomes the live cosigner, so now it is worth
            // saying. An oracle that was already initialized keeps whatever
            // its storage holds and never reaches this branch.
            if cosigner_defaulted {
                tracing::warn!(
                    "prop deploy: no cosigner given and this oracle is being \
                     initialized - the deployer becomes the cosigner. The \
                     backend must run MARGIN_COSIGNER_KEY for this address or \
                     margin stays inert."
                );
            }
            oracle
                .methods()
                .initialize()
                .call()
                .await
                .context("initialize prop-account oracle")?;
        }

        // The account implementation EVERY margin account resolves through,
        // reconciled explicitly — the same defect the cosigner already had,
        // and the price feed had on the pool.
        //
        // `INITIAL_PROP_ACCOUNT_IMPL` reaches storage only through the
        // one-time `initialize` above. On an already-initialized oracle that
        // branch is skipped, so baking a fresh `account_blob_id` into the
        // oracle's configurables and retargeting its proxy — both of which
        // this run does, and both of which succeed — still leaves
        // `get_prop_account_impl` answering with the PREVIOUS blob. Every
        // account keeps running the old bytecode while the deploy reports a
        // clean upgrade, which is the worst shape a bug can take.
        //
        // Compare-first, like every other reconcile here: an oracle already
        // on this implementation costs one read and no transaction.
        let stored_impl = oracle
            .methods()
            .get_prop_account_impl()
            .simulate(Execution::state_read_only())
            .await
            .context("read the prop-account oracle's account implementation")?
            .value;
        let account_impl = ContractId::from(account_blob_id);
        if stored_impl != Some(account_impl) {
            tracing::info!(
                "Prop: account implementation {stored_impl:?} -> {account_impl:?}"
            );
            oracle
                .methods()
                .set_prop_account_impl(account_impl)
                .call()
                .await
                .context("activate the prop-account implementation on the oracle")?;
        }

        // The account implementation EVERY margin account resolves through,
        // reconciled explicitly — the same defect the cosigner already had,
        // and the price feed had on the pool.
        //
        // `INITIAL_PROP_ACCOUNT_IMPL` reaches storage only through the
        // one-time `initialize` above. On an already-initialized oracle that
        // branch is skipped, so baking a fresh `account_blob_id` into the
        // oracle's configurables and retargeting its proxy — both of which
        // this run does, and both of which succeed — still leaves
        // `get_prop_account_impl` answering with the PREVIOUS blob. Every
        // account keeps running the old bytecode while the deploy reports a
        // clean upgrade, which is the worst shape a bug can take.
        //
        // Compare-first, like every other reconcile here: an oracle already
        // on this implementation costs one read and no transaction.

        // State-checked: a resumed run initializes iff the pool has not
        // been initialized yet, whether or not this run created the proxy.
        let deployed_collateral = pool
            .methods()
            .collateral_asset()
            .simulate(Execution::state_read_only())
            .await
            .context("read deployed prop margin-pool collateral")?
            .value;
        ensure!(
            deployed_collateral == config.collateral_asset,
            "prop margin-pool collateral configurable mismatch"
        );
        ensure!(
            pool.methods()
                .collateral_decimals()
                .simulate(Execution::state_read_only())
                .await
                .context("read deployed prop margin-pool collateral decimals")?
                .value
                == config.collateral_decimals,
            "prop margin-pool decimals configurable mismatch"
        );
        ensure!(
            pool.methods()
                .max_tier_books()
                .simulate(Execution::state_read_only())
                .await
                .context("read deployed prop margin-pool book limit")?
                .value
                == config.max_tier_books,
            "prop margin-pool book-limit configurable mismatch"
        );
        let pool_is_initialized = pool
            .methods()
            .is_initialized()
            .simulate(Execution::state_read_only())
            .await
            .context("read deployed prop margin-pool initialization state")?
            .value;
        if !pool_is_initialized {
            // Same rule as the oracle's cosigner above: the seed only becomes
            // the payee here, on a pool that has never been initialized.
            if liquidator_defaulted {
                tracing::warn!(
                    "prop deploy: no liquidator given and this pool is being \
                     initialized - the deployer becomes the liquidator, and \
                     will receive the residue of every forced exit."
                );
            }
            pool.methods()
                .initialize()
                .call()
                .await
                .context("initialize prop margin pool")?;
        }

        // The expiry cosigner is NOT reconciled here: `o2-deploy` owns that
        // (it also covers `--margin-tier-only`, which never reaches this
        // function), and the fixture arms it per test.
        Ok(Self {
            oracle,
            oracle_proxy,
            oracle_id,
            oracle_blob_id,
            price_feed,
            price_feed_id,
            registry,
            registry_proxy,
            registry_id,
            registry_blob_id,
            pool,
            pool_proxy,
            pool_id,
            pool_blob_id,
            account_blob_id,
            account_proxy_blob_id,
            account_salt: config.salt,
            deployer_wallet: deployer_wallet.clone(),
        })
    }

    /// Deploy and register one deterministic prop-account child.
    ///
    /// `parent_caller` submits the registration transaction and must resolve
    /// to `parent`; the registry enforces this relationship on chain.
    pub async fn deploy_account(
        &self,
        parent_caller: &W,
        parent: Identity,
        index: u64,
    ) -> Result<PropAccountProxyContract<W>> {
        ensure!(
            parent != Identity::Address(Address::zeroed()),
            "prop-account parent cannot be zero"
        );

        let configurables = PropAccountProxyContractConfigurables::default()
            .with_ORACLE_CONTRACT_ID(self.oracle_id)?
            .with_PARENT(parent)?
            .with_INDEX(index)?;
        let child_contract = regular_contract(
            PROP_ACCOUNT_PROXY_BYTECODE,
            PROP_ACCOUNT_PROXY_STORAGE,
            self.account_salt,
        )?
        .with_configurables(configurables);
        let (child_id, _) = deploy_regular(&self.deployer_wallet, child_contract)
            .await
            .context("deploy prop-account child")?;

        let child = PropAccountProxyContract::new(child_id, self.deployer_wallet.clone());
        if !self
            .registry
            .methods()
            .prop_is_valid(child_id)
            .simulate(Execution::state_read_only())
            .await?
            .value
        {
            TradeAccountRegistry::new(self.registry_id, parent_caller.clone())
                .methods()
                .prop_register_contract(child_id, parent, index)
                .with_contract_ids(&[self.oracle_id, child_id, self.pool_id])
                .call()
                .await
                .context("register prop-account child")?;
        }

        Ok(child)
    }

    /// Bind the implementation ABI to a deployed child proxy.
    pub fn account(&self, account_id: ContractId) -> PropAccountContract<W> {
        PropAccountContract::new(account_id, self.deployer_wallet.clone())
    }
}

/// Byte offsets of the margin-account proxy's `ORACLE_CONTRACT_ID`,
/// `PARENT` and `INDEX` configurables, in that order.
///
/// A build-time property of the bundled artifact — nothing touches the
/// chain. Public because the PLAIN registry upgrade has to repeat these
/// values verbatim or it resets them to zero; see
/// `live_prop_registry_config` in `o2-deploy`.
pub fn prop_account_proxy_offsets() -> Result<[u64; 3]> {
    fn only_offset(configurables: Configurables, name: &str) -> Result<u64> {
        let offsets: Vec<Configurable> = configurables.offsets_with_data;
        ensure!(
            offsets.len() == 1,
            "expected one {name} configurable, got {}",
            offsets.len()
        );
        Ok(offsets[0].offset)
    }

    let oracle: Configurables = PropAccountProxyContractConfigurables::default()
        .with_ORACLE_CONTRACT_ID(ContractId::zeroed())?
        .into();
    let parent: Configurables = PropAccountProxyContractConfigurables::default()
        .with_PARENT(Identity::Address(Address::zeroed()))?
        .into();
    let index: Configurables = PropAccountProxyContractConfigurables::default()
        .with_INDEX(0)?
        .into();

    Ok([
        only_offset(oracle, "oracle")?,
        only_offset(parent, "parent")?,
        only_offset(index, "index")?,
    ])
}

fn storage_slots(bytes: &[u8]) -> Result<Vec<StorageSlot>> {
    serde_json::from_slice(bytes).context("decode contract storage slots")
}

fn regular_contract(
    bytecode: &[u8],
    storage: &[u8],
    salt: Salt,
) -> Result<Contract<Regular>> {
    Ok(Contract::regular(
        bytecode.to_vec(),
        salt,
        storage_slots(storage)?,
    ))
}

fn regular_contract_with_implementation_storage(
    bytecode: &[u8],
    proxy_storage: &[u8],
    implementation_storage: &[u8],
    salt: Salt,
) -> Result<Contract<Regular>> {
    let mut slots = storage_slots(proxy_storage)?;
    for implementation_slot in storage_slots(implementation_storage)? {
        ensure!(
            !slots
                .iter()
                .any(|proxy_slot| proxy_slot.key() == implementation_slot.key()),
            "proxy and implementation storage slots collide"
        );
        slots.push(implementation_slot);
    }
    Ok(Contract::regular(bytecode.to_vec(), salt, slots))
}

/// Points a price-feed PROXY at the implementation this build carries,
/// exactly as the order books are upgraded: read the live target, rebuild
/// the configured blob, and retarget only when the two differ. A feed
/// already on this bytecode costs no transaction.
///
/// Returns the active implementation id.
///
/// `set_proxy_target` is owner-only, so this works on a feed this deployer
/// owns; a feed owned elsewhere must be upgraded by its own owner.
pub async fn upgrade_price_feed_implementation<W>(
    deployer_wallet: &W,
    price_feed_id: ContractId,
    owner: Identity,
    config: &PropDeployConfig,
) -> Result<ContractId>
where
    W: Account + Clone,
{
    let feed_proxy = PriceFeedProxyContract::new(price_feed_id, deployer_wallet.clone());
    let current = feed_proxy
        .methods()
        .proxy_target()
        .simulate(Execution::state_read_only())
        .await
        .context(
            "read the price feed's proxy target - an unproxied feed cannot be \
             upgraded in place",
        )?
        .value;
    let feed_blob_id = upload_implementation(
        deployer_wallet,
        PRICE_FEED_BYTECODE,
        PRICE_FEED_STORAGE,
        PriceFeedContractConfigurables::default()
            .with_INITIAL_OWNER(State::Initialized(owner))?,
        config,
    )
    .await
    .context("deploy configured price-feed implementation blob")?;
    let feed_blob_id = ContractId::from(feed_blob_id);
    if current != Some(feed_blob_id) {
        tracing::info!(
            "Upgrade price feed implementation from {current:?} to {feed_blob_id:?}"
        );
        feed_proxy
            .methods()
            .set_proxy_target(feed_blob_id)
            .call()
            .await
            .context("activate configured price-feed implementation")?;
    }
    Ok(feed_blob_id)
}

/// `PRICE_SUBMITTER_ROLE` on the price feed — the role `add_publisher`
/// grants and `publish_prices` demands. Mirrors the contract's constant.
pub const PRICE_SUBMITTER_ROLE: u64 = 2;

async fn upload_implementation<W>(
    deployer_wallet: &W,
    bytecode: &[u8],
    storage: &[u8],
    configurables: impl Into<Configurables>,
    config: &PropDeployConfig,
) -> Result<BlobId>
where
    W: Account,
{
    let (data_blobs, loader_blob) = blob_loader::build_loader_blobs(
        bytecode.to_vec(),
        config.salt,
        storage_slots(storage)?,
        configurables,
        config.max_words_per_blob,
    )?;
    blob_loader::upload_loader_blobs(deployer_wallet, data_blobs, loader_blob).await
}

async fn deploy_regular<W>(
    deployer_wallet: &W,
    contract: Contract<Regular>,
) -> Result<(ContractId, bool)>
where
    W: Account,
{
    let contract_id = contract.contract_id();
    let is_new = !deployer_wallet
        .try_provider()?
        .contract_exists(&contract_id)
        .await?;
    if is_new {
        contract
            .deploy(deployer_wallet, TxPolicies::default())
            .await?;
    }
    Ok((contract_id, is_new))
}

#[cfg(test)]
#[path = "prop_legacy_fixtures.rs"]
mod legacy_fixtures;

#[cfg(test)]
mod tests {
    use super::*;
    use crate::{
        order_book_deploy::{
            OrderArgs,
            OrderBookConfigurables,
            OrderBookDeploy,
            OrderBookDeployConfig,
            OrderType,
        },
        prop::{
            MarginPoolPauseChanged,
            MarginPoolPlatformPayoutChanged,
            MarginPoolPriceFeedChanged,
            MarginPoolRegistryChanged,
            MarginTradeAccountWithdrawn,
            PriceInput,
            PropOrderBookCleanup,
            SessionClosed,
            SessionSeized,
            SettlementReason,
            TierParams,
        },
    };
    use fuels::test_helpers::{
        AssetConfig,
        WalletsConfig,
        launch_custom_provider_and_get_wallets,
    };
    use std::time::{
        SystemTime,
        UNIX_EPOCH,
    };

    fn assert_recent_timestamp(timestamp: u64) {
        let now = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .expect("system time predates the Unix epoch")
            .as_secs();
        // A generous window on purpose: this catches a garbage stamp - epoch
        // zero, a wildly wrong clock - not sub-second precision. A tight
        // bound made the whole prop suite serialise behind one mutex just so
        // no test was ever starved long enough to blow it; the tests each run
        // their own node, so the mutex only ever bought this tolerance. With
        // the window widened the tests parallelise and the mutex is gone.
        assert!(
            timestamp.abs_diff(now) <= 120,
            "event timestamp {timestamp} is not close to {now}"
        );
    }

    #[tokio::test]
    async fn deploys_independent_prop_system_and_registers_child() {
        let collateral_asset = AssetId::new([1; 32]);
        let base_asset = AssetId::new([2; 32]);
        let initial_balance = 10_000_000_000u64;
        let mut wallets = launch_custom_provider_and_get_wallets(
            WalletsConfig::new_multiple_assets(
                2,
                vec![
                    AssetConfig {
                        id: AssetId::default(),
                        num_coins: 2,
                        coin_amount: initial_balance,
                    },
                    AssetConfig {
                        id: collateral_asset,
                        num_coins: 2,
                        coin_amount: initial_balance,
                    },
                    AssetConfig {
                        id: base_asset,
                        num_coins: 2,
                        coin_amount: initial_balance,
                    },
                ],
            ),
            None,
            Some(::fuels::test_helpers::ChainConfig::local_testnet()),
        )
        .await
        .unwrap();
        let user = wallets.pop().unwrap();
        let deployer = wallets.pop().unwrap();

        let deployment = PropDeployment::deploy(&deployer, &{
            // The production feed bounds a submission's age against the
            // block clock; this test publishes at a fixed timestamp.
            let mut config = PropDeployConfig::new(collateral_asset);
            config.max_offchain_age_seconds = Some(10_000_000_000);
            config
        })
        .await
        .unwrap();

        let oracle_target = deployment
            .oracle
            .methods()
            .get_prop_account_impl()
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value;
        assert_eq!(
            oracle_target,
            Some(ContractId::from(deployment.account_blob_id))
        );
        assert_eq!(
            deployment
                .oracle
                .methods()
                .get_prop_margin_pool()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            Some(deployment.pool_id)
        );
        assert_eq!(
            deployment
                .registry
                .methods()
                .get_prop_oracle_id()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            deployment.oracle_id
        );
        assert_eq!(
            deployment
                .registry
                .methods()
                .get_prop_pool_id()
                .with_contract_ids(&[deployment.oracle_id])
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            deployment.pool_id
        );
        assert_eq!(
            deployment
                .pool
                .methods()
                .registry()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            deployment.registry_id
        );
        assert_eq!(
            deployment
                .pool
                .methods()
                .price_feed()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            deployment.price_feed_id
        );
        let deployer_identity = Identity::Address(deployer.address());

        // The float is simply what the pool holds: outside money arrives as a
        // plain transfer, with no pool entry point to call.
        let inventory_amount = 1_234;
        deployer
            .force_transfer_to_contract(
                deployment.pool.contract_id(),
                inventory_amount,
                collateral_asset,
                TxPolicies::default(),
            )
            .await
            .unwrap();
        assert_eq!(
            deployment
                .pool
                .get_balances()
                .await
                .unwrap()
                .get(&collateral_asset)
                .copied()
                .unwrap_or_default(),
            inventory_amount,
        );

        let registry_update = deployment
            .pool
            .methods()
            .set_registry(deployment.oracle_id)
            .call()
            .await
            .unwrap();
        let registry_events = registry_update
            .decode_logs_with_type::<MarginPoolRegistryChanged>()
            .unwrap();
        assert_recent_timestamp(registry_events[0].timestamp.unix);
        assert_eq!(
            registry_events,
            vec![MarginPoolRegistryChanged {
                old_registry: deployment.registry_id,
                new_registry: deployment.oracle_id,
                timestamp: registry_events[0].timestamp.clone(),
            }]
        );
        assert_eq!(
            deployment
                .pool
                .methods()
                .registry()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            deployment.oracle_id
        );
        deployment
            .pool
            .methods()
            .set_registry(deployment.registry_id)
            .call()
            .await
            .unwrap();

        let price_feed_update = deployment
            .pool
            .methods()
            .set_price_feed(deployment.oracle_id)
            .call()
            .await
            .unwrap();
        let price_feed_events = price_feed_update
            .decode_logs_with_type::<MarginPoolPriceFeedChanged>()
            .unwrap();
        assert_recent_timestamp(price_feed_events[0].timestamp.unix);
        assert_eq!(
            price_feed_events,
            vec![MarginPoolPriceFeedChanged {
                old_price_feed: deployment.price_feed_id,
                new_price_feed: deployment.oracle_id,
                timestamp: price_feed_events[0].timestamp.clone(),
            }]
        );
        assert_eq!(
            deployment
                .pool
                .methods()
                .price_feed()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            deployment.oracle_id
        );
        deployment
            .pool
            .methods()
            .set_price_feed(deployment.price_feed_id)
            .call()
            .await
            .unwrap();

        let platform_payout = Identity::Address(user.address());
        let payout_update = deployment
            .pool
            .methods()
            .set_platform_payout(platform_payout)
            .call()
            .await
            .unwrap();
        let payout_events = payout_update
            .decode_logs_with_type::<MarginPoolPlatformPayoutChanged>()
            .unwrap();
        assert_recent_timestamp(payout_events[0].timestamp.unix);
        assert_eq!(
            payout_events,
            vec![MarginPoolPlatformPayoutChanged {
                old_platform_payout: deployer_identity,
                new_platform_payout: platform_payout,
                timestamp: payout_events[0].timestamp.clone(),
            }]
        );
        deployment
            .pool
            .methods()
            .set_platform_payout(deployer_identity)
            .call()
            .await
            .unwrap();

        let pause_response = deployment.pool.methods().pause().call().await.unwrap();
        let pause_events = pause_response
            .decode_logs_with_type::<MarginPoolPauseChanged>()
            .unwrap();
        assert_recent_timestamp(pause_events[0].timestamp.unix);
        assert_eq!(pause_events.len(), 1);
        assert!(pause_events[0].paused);

        let unpause_response = deployment.pool.methods().unpause().call().await.unwrap();
        let unpause_events = unpause_response
            .decode_logs_with_type::<MarginPoolPauseChanged>()
            .unwrap();
        assert_recent_timestamp(unpause_events[0].timestamp.unix);
        assert_eq!(unpause_events.len(), 1);
        assert!(!unpause_events[0].paused);

        let user_pool = PropMarginPoolContract::new(deployment.pool_id, user.clone());
        assert!(
            user_pool
                .methods()
                .set_registry(deployment.oracle_id)
                .call()
                .await
                .is_err()
        );

        assert!(
            deployment
                .pool
                .methods()
                .has_role(0, deployer_identity)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        );
        let order_book_configurables = OrderBookConfigurables::default()
            .with_MAKER_FEE(0u64.into())
            .unwrap()
            .with_TAKER_FEE(0u64.into())
            .unwrap()
            .with_MIN_ORDER(1)
            .unwrap()
            .with_DUST(0)
            .unwrap();
        let order_book_config =
            OrderBookDeployConfig::with_configurables(order_book_configurables);
        let order_book = OrderBookDeploy::deploy(
            &deployer,
            base_asset,
            collateral_asset,
            &order_book_config,
        )
        .await
        .unwrap();
        let mut second_order_book_config = order_book_config.clone();
        second_order_book_config.salt = Salt::from([1u8; 32]);
        let second_order_book = OrderBookDeploy::deploy(
            &deployer,
            base_asset,
            collateral_asset,
            &second_order_book_config,
        )
        .await
        .unwrap();

        deployment
            .price_feed
            .methods()
            .set_asset_decimals(collateral_asset, 6)
            .call()
            .await
            .unwrap();
        deployment
            .price_feed
            .methods()
            .set_asset_decimals(base_asset, 9)
            .call()
            .await
            .unwrap();
        deployment
            .price_feed
            .methods()
            .publish_prices(vec![
                PriceInput {
                    asset: collateral_asset,
                    bid: 1_000_000_000_000_000_000u64.into(),
                    ask: 1_000_000_000_000_000_000u64.into(),
                    // Strictly above the replay floor of 0, and in the past.
                    timestamp: 1,
                },
                PriceInput {
                    asset: base_asset,
                    bid: 2_000_000_000_000_000_000u64.into(),
                    ask: 2_000_000_000_000_000_000u64.into(),
                    timestamp: 1,
                },
            ])
            .call()
            .await
            .unwrap();
        assert!(
            deployment
                .price_feed
                .methods()
                .has_price(collateral_asset)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        );

        let tier_params = TierParams {
            line: 10_000_000,
            leverage: 5,
            duration: 86_400,
            maintenance_bps: 250,
            open_buffer_bps: 375,
            liq_price_factor: 9_900,
            // The amounts the old bps rates derived from this line: 6, 21,
            // 76 and 738 bps of 10_000_000.
            prolong_fee: [0, 21_000, 76_000, 738_000],
            max_credit_line_bps: 20_000,
            max_price_age: 60,
            open_fee: 0,
            profit_share_bps: 1_000,
            price_band_bps: 1_000,
        };
        // Historical refundable tiers remain serviceable, but cannot be published.
        let error = deployment
            .pool
            .methods()
            .publish_tier_version(1, tier_params.clone(), vec![order_book.contract_id])
            .call()
            .await
            .unwrap_err();
        assert!(error.to_string().contains("Disabled"), "{error:#}");
        legacy_fixtures::seed_legacy_tier(
            &deployment,
            1,
            tier_params,
            vec![order_book.contract_id, second_order_book.contract_id],
        )
        .await
        .unwrap();

        let tier = deployment
            .pool
            .methods()
            .get_tier(1, 1)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
            .expect("seeded historical tier version");
        assert_eq!(tier.line, 10_000_000);
        assert_eq!(
            deployment
                .pool
                .methods()
                .current_tier_version(1)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            Some(1)
        );
        assert_eq!(
            deployment
                .pool
                .methods()
                .tier_books(1, 1)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            vec![order_book.contract_id, second_order_book.contract_id]
        );
        let tier_assets = deployment
            .pool
            .methods()
            .tier_assets(1, 1)
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value;
        assert_eq!(tier_assets.len(), 2);
        assert!(tier_assets.contains(&base_asset));
        assert!(tier_assets.contains(&collateral_asset));
        assert!(
            deployment
                .pool
                .methods()
                .get_tier(1, 2)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
                .is_none()
        );
        assert!(
            deployment
                .pool
                .methods()
                .tier_books(1, 2)
                .simulate(Execution::state_read_only())
                .await
                .is_err()
        );
        assert!(
            deployment
                .pool
                .methods()
                .tier_assets(1, 2)
                .simulate(Execution::state_read_only())
                .await
                .is_err()
        );

        deployment
            .price_feed
            .methods()
            .set_asset_decimals(base_asset, 8)
            .call()
            .await
            .unwrap();
        deployment
            .price_feed
            .methods()
            .publish_prices(vec![PriceInput {
                // Above this asset's replay floor, which the publish above
                // already moved to 1.
                asset: base_asset,
                bid: 2_000_000_000_000_000_000u64.into(),
                ask: 2_000_000_000_000_000_000u64.into(),
                timestamp: 2,
            }])
            .call()
            .await
            .unwrap();
        assert!(
            deployment
                .pool
                .methods()
                .set_price_feed(deployment.price_feed_id)
                .with_contracts(&[&deployment.price_feed])
                .call()
                .await
                .is_err()
        );
        deployment
            .price_feed
            .methods()
            .set_asset_decimals(base_asset, 9)
            .call()
            .await
            .unwrap();
        deployment
            .price_feed
            .methods()
            .publish_prices(vec![PriceInput {
                asset: base_asset,
                bid: 2_000_000_000_000_000_000u64.into(),
                ask: 2_000_000_000_000_000_000u64.into(),
                timestamp: 3,
            }])
            .call()
            .await
            .unwrap();

        let parent = Identity::Address(user.address());
        let registration_error = deployment
            .deploy_account(&deployer, parent, 7)
            .await
            .expect_err("a caller other than the configured parent must be rejected");
        assert!(
            format!("{registration_error:?}").contains("NotParent"),
            "unexpected registration error: {registration_error:?}"
        );
        let child = deployment.deploy_account(&user, parent, 7).await.unwrap();
        assert!(
            deployment
                .registry
                .methods()
                .prop_is_valid(child.contract_id())
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        );
        assert_eq!(
            child
                .methods()
                .parent()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            parent
        );
        assert_eq!(
            child
                .methods()
                .index()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            7
        );
        assert_eq!(
            child
                .methods()
                .pool()
                .with_contract_ids(&[deployment.oracle_id])
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            deployment.pool_id
        );
        assert_eq!(
            child
                .methods()
                .oracle()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            deployment.oracle_id
        );

        let collateral = 2_000_000;
        let account = PropAccountContract::new(child.contract_id(), user.clone());
        let missing_payment_error = account
            .methods()
            .start_session(1, collateral, ProlongPeriod::SixHours)
            .with_contract_ids(&[
                deployment.oracle_id,
                deployment.pool_id,
                deployment.registry_id,
            ])
            .call()
            .await
            .unwrap_err();
        assert!(
            missing_payment_error
                .to_string()
                .contains("PaymentAmountMismatch"),
            "unexpected missing-payment error: {missing_payment_error:#}"
        );
        let mismatched_payment_error = account
            .methods()
            .start_session(1, collateral, ProlongPeriod::SixHours)
            .call_params(CallParameters::new(
                collateral - 1,
                collateral_asset,
                u64::MAX,
            ))
            .unwrap()
            .with_contract_ids(&[
                deployment.oracle_id,
                deployment.pool_id,
                deployment.registry_id,
            ])
            .call()
            .await
            .unwrap_err();
        assert!(
            mismatched_payment_error
                .to_string()
                .contains("PaymentAmountMismatch"),
            "unexpected mismatched-payment error: {mismatched_payment_error:#}"
        );
        let wrong_asset_error = account
            .methods()
            .start_session(1, collateral, ProlongPeriod::SixHours)
            .call_params(CallParameters::new(collateral, base_asset, u64::MAX))
            .unwrap()
            .with_contract_ids(&[
                deployment.oracle_id,
                deployment.pool_id,
                deployment.registry_id,
            ])
            .call()
            .await
            .unwrap_err();
        assert!(
            wrong_asset_error.to_string().contains("WrongAsset"),
            "unexpected wrong-asset error: {wrong_asset_error:#}"
        );

        let collateral_dust = 17;
        let base_dust = 23;
        user.force_transfer_to_contract(
            child.contract_id(),
            collateral_dust,
            collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
        user.force_transfer_to_contract(
            child.contract_id(),
            base_dust,
            base_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
        account
            .methods()
            .start_session(1, collateral, ProlongPeriod::SixHours)
            .call_params(CallParameters::new(collateral, collateral_asset, u64::MAX))
            .unwrap()
            .with_contract_ids(&[
                deployment.oracle_id,
                deployment.pool_id,
                deployment.registry_id,
            ])
            .with_variable_output_policy(VariableOutputPolicy::Exactly(2))
            .call()
            .await
            .unwrap();
        let provider = user.provider();
        assert_eq!(
            provider
                .get_contract_asset_balance(&child.contract_id(), &collateral_asset)
                .await
                .unwrap(),
            0
        );
        assert_eq!(
            provider
                .get_contract_asset_balance(&child.contract_id(), &base_asset)
                .await
                .unwrap(),
            0
        );

        assert!(
            deployment
                .pool
                .methods()
                .is_call_allowed(child.contract_id(), order_book.contract_id)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        );
        assert!(
            deployment
                .pool
                .methods()
                .is_call_allowed(child.contract_id(), second_order_book.contract_id)
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        );
        assert!(
            !deployment
                .pool
                .methods()
                .is_call_allowed(child.contract_id(), ContractId::new([0x99; 32]))
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        );

        let session = deployment
            .pool
            .methods()
            .get_session(child.contract_id())
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
            .expect("prop session opened");
        assert_eq!(session.session_id, 1);
        assert_eq!(session.credit_line, 10_000_000);
        assert_eq!(session.collateral, collateral);

        assert!(
            deployment
                .pool
                .methods()
                .min_sellable(child.contract_id(), base_asset)
                .with_contracts(&[&order_book.order_book, &second_order_book.order_book,])
                .simulate(Execution::state_read_only())
                .await
                .is_err()
        );

        let best_bid = 2_000_000;
        let bid_quantity = 1_000_000_000;
        order_book
            .order_book
            .methods()
            .create_order(OrderArgs {
                price: best_bid,
                quantity: bid_quantity,
                order_type: OrderType::Spot,
            })
            .call_params(CallParameters::new(
                bid_quantity * best_bid / 1_000_000_000,
                collateral_asset,
                u64::MAX,
            ))
            .unwrap()
            .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
            .call()
            .await
            .unwrap();
        assert_eq!(
            order_book
                .order_book
                .methods()
                .get_base_decimals()
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            1_000_000_000
        );
        assert_eq!(
            deployment
                .pool
                .methods()
                .min_sellable(child.contract_id(), base_asset)
                .with_contracts(&[&order_book.order_book, &second_order_book.order_book,])
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value,
            Some(500)
        );

        let close = account
            .methods()
            .close_session(Vec::<PropOrderBookCleanup>::new())
            .with_contracts(&[
                &deployment.oracle,
                &deployment.pool,
                &order_book.order_book,
                &second_order_book.order_book,
            ])
            .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
            .call()
            .await
            .unwrap();
        let close_events = close.decode_logs_with_type::<SessionClosed>().unwrap();
        assert!(
            close
                .decode_logs_with_type::<SessionSeized>()
                .unwrap()
                .is_empty()
        );
        assert_recent_timestamp(close_events[0].timestamp.unix);
        assert_eq!(
            close_events,
            vec![SessionClosed {
                account: child.contract_id(),
                session_id: 1,
                reason: SettlementReason::UserClose,
                v: 10_000_000,
                v_is_negative: false,
                v_liq: 10_000_000,
                v_liq_is_negative: false,
                profit_abs: 0,
                profit_is_negative: false,
                fees_accrued: 0,
                platform_total: 0,
                user_net: collateral,
                bad_debt: 0,
                cancelled_debt: vec![],
                payout_parent: vec![(collateral_asset, collateral)],
                payout_platform: vec![],
                timestamp: close_events[0].timestamp.clone(),
            }]
        );
        assert!(
            !deployment
                .pool
                .methods()
                .has_session(child.contract_id())
                .simulate(Execution::state_read_only())
                .await
                .unwrap()
                .value
        );

        let excess_collateral = 25_000_000;
        account
            .methods()
            .start_session(1, excess_collateral, ProlongPeriod::SixHours)
            .call_params(CallParameters::new(
                excess_collateral,
                collateral_asset,
                u64::MAX,
            ))
            .unwrap()
            .with_contract_ids(&[
                deployment.oracle_id,
                deployment.pool_id,
                deployment.registry_id,
            ])
            .call()
            .await
            .unwrap();
        let excess_session = deployment
            .pool
            .methods()
            .get_session(child.contract_id())
            .simulate(Execution::state_read_only())
            .await
            .unwrap()
            .value
            .expect("excess-collateral session opened");
        assert_eq!(excess_session.session_id, 2);
        assert_eq!(excess_session.collateral, excess_collateral);
        assert_eq!(excess_session.credit_line, 20_000_000);

        let excess_close = account
            .methods()
            .close_session(Vec::<PropOrderBookCleanup>::new())
            .with_contracts(&[
                &deployment.oracle,
                &deployment.pool,
                &order_book.order_book,
                &second_order_book.order_book,
            ])
            .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
            .call()
            .await
            .unwrap();
        let excess_close_events = excess_close
            .decode_logs_with_type::<SessionClosed>()
            .unwrap();
        assert_recent_timestamp(excess_close_events[0].timestamp.unix);
        assert_eq!(
            excess_close_events,
            vec![SessionClosed {
                account: child.contract_id(),
                session_id: 2,
                reason: SettlementReason::UserClose,
                v: 33_000_000,
                v_is_negative: false,
                v_liq: 33_000_000,
                v_liq_is_negative: false,
                profit_abs: 0,
                profit_is_negative: false,
                fees_accrued: 0,
                platform_total: 0,
                user_net: excess_collateral,
                bad_debt: 0,
                cancelled_debt: vec![],
                payout_parent: vec![(collateral_asset, excess_collateral)],
                payout_platform: vec![],
                timestamp: excess_close_events[0].timestamp.clone(),
            }]
        );

        let withdrawal = 1_000;
        user.force_transfer_to_contract(
            child.contract_id(),
            withdrawal,
            collateral_asset,
            TxPolicies::default(),
        )
        .await
        .unwrap();
        let balance_before = user.get_asset_balance(&collateral_asset).await.unwrap();
        let withdraw_response = account
            .methods()
            .withdraw(collateral_asset, withdrawal)
            .with_contract_ids(&[deployment.oracle_id, deployment.pool_id])
            .with_variable_output_policy(VariableOutputPolicy::Exactly(1))
            .call()
            .await
            .unwrap();
        let withdraw_events = withdraw_response
            .decode_logs_with_type::<MarginTradeAccountWithdrawn>()
            .unwrap();
        assert_recent_timestamp(withdraw_events[0].timestamp.unix);
        assert_eq!(
            withdraw_events,
            vec![MarginTradeAccountWithdrawn {
                account: child.contract_id(),
                parent,
                asset_id: collateral_asset,
                amount: withdrawal,
                timestamp: withdraw_events[0].timestamp.clone(),
            }]
        );
        assert_eq!(
            user.get_asset_balance(&collateral_asset).await.unwrap(),
            balance_before + withdrawal as u128
        );
    }
}

#[cfg(test)]
#[path = "prop_deploy_tests.rs"]
mod integration_tests;