@@ -70,9 +70,10 @@ struct RebalanceConfig {
 ///        crystallizes (or on bootstrap); on capital flows it is rebased so the pending per-share
 ///        basis is preserved (see `rebaseSnapshot`). It therefore only matches the live NAV right
 ///        after a crystallizing accrual; while the reference is held it deviates from the live
-///        NAV by the carried (negative) pending basis. `lastCollat` is reconstructed on the fly
-///        as `lastTotalAssets + lastDebt` rather than stored directly, which keeps the storage
-///        layout append-only and existing integrations unchanged.
+///        NAV by the carried (negative) pending basis; after a seizure loss, flows convert the
+///        NAV drawdown against it into that carry (see `rebaseSnapshot`). `lastCollat` is
+///        reconstructed on the fly as `lastTotalAssets + lastDebt` rather than stored directly,
+///        which keeps the storage layout append-only and existing integrations unchanged.
 /// @param ltv Loan-to-value ratio in 18-decimal fixed point (e.g., 0.86e18 = 86%).
 ///        A small buffer above the target LTV that determines how much collateral can be withdrawn.
 /// @param virtualShareOffset Virtual shares offset for inflation attack protection, derived from debt asset decimals.
@@ -182,36 +183,44 @@ library LibStorage {
   ///      share supply without realising a gain, so the reference must move with them: the carry
   ///      (the negative pending basis accumulated while the reference is held, typically accrued
   ///      debt interest under a flat collateral quote) is scaled by the share-supply change and
-  ///      re-anchored on the post-flow state. Exits shed their proportional slice of the carry,
+  ///      re-anchored on the post-flow state. When the carry reads zero while NAV sits below
+  ///      the mark (a seizure leaves a NAV deficit with a non-negative levered read), the
+  ///      deficit is converted into carry form, so the high-water mark that the NAV-gain cap
+  ///      in `_pendingFees` measures against survives flows; an ordinary drawdown (nonzero
+  ///      carry) keeps the pre-existing semantics, under which a flow re-anchors the mark at
+  ///      NAV plus the levered carry only. Exits shed their proportional slice of the carry,
   ///      deposits re-attach it to the new shares, and supply-neutral flows (rebalance, module
   ///      changes) keep it unchanged. A holder therefore cannot shed accrued debt carry by
   ///      exiting and re-entering, and an exit does not dump its carry slice on the stayers.
   ///
-  ///      Called after `_accrueFees` has already crystallized any positive basis, so outside a
-  ///      partial bad-debt episode the pending basis here is non-positive; `zeroFloorSub` guards
-  ///      the rounding edge at exactly zero. Rounding matches `_pendingFees` (`mulDivUp` on the
-  ///      scaled reference debt), so the carry is the exact complement of the fee basis and each
-  ///      flow can only shrink it by rounding dust, never create a spurious positive basis.
+  ///      Called after `_accrueFees`, which crystallizes a positive basis except in two held
+  ///      states: a NAV-capped basis (seizure loss, see the cap in `_pendingFees`) and a
+  ///      performance entitlement that converts to zero fee shares. In both, the flow forgives
+  ///      the pending levered gain (for the zero-share hold the forgiven entitlement is
+  ///      bounded by one share's assets); for the seizure the converted deficit keeps the cap
+  ///      suspending fees after the flow. The held management fee accumulator is not cleared
+  ///      by the forgiveness and nets against the next crystallization. Rounding matches
+  ///      `_pendingFees` (`mulDivUp` on the scaled reference debt), so the carry is the exact
+  ///      complement of the fee basis and each flow can only shrink it by rounding dust, never
+  ///      create a spurious positive basis.
   ///
   ///      Partial bad-debt episode: while some (not all) modules are excluded as bad debt, the
-  ///      accrual freezes the reference instead of crystallizing (see `_pendingFees`), so a flow
-  ///      here can see a positive pending basis against the reduced aggregates. `zeroFloorSub`
-  ///      then clamps the carry to zero and the reference re-anchors at the post-flow visible
-  ///      state; the phantom gain itself is never preserved. The re-anchor is not
-  ///      direction-safe, because the pre-flow reduced aggregates are not comparable with the
-  ///      frozen full-universe mark: a flow that leaves the post-flow visible LTV at or below
-  ///      the frozen reference LTV under-reads the later recovery (LP-favorable; fees resume at
-  ///      a genuine new high), but a flow that raises it above the mark over-reads the recovery
-  ///      and can charge it as gain. The over-reading flows are a deposit with fresh borrowing
-  ///      during the window, a rebalance that borrows, and, most importantly, a rescue repayment
-  ///      (withdraw or rebalance) that pulls the excluded module back above water mid-flow: the
-  ///      re-anchor then adopts the re-entered module's near-100% LTV. Operational rule for the
-  ///      over-read: `resetPerformanceReference` does NOT correct it (the reset crystallizes a
-  ///      positive pending basis before moving); instead the owner should set the performance
-  ///      fee rate to zero right after such a flow, let the first accrual with a positive basis
-  ///      advance the reference mintlessly (a positive basis advances even at a zero rate), and
-  ///      then restore the rate. The under-read needs no action (fees resume at a genuine new
-  ///      high, or an owner reset re-anchors sooner).
+  ///      accrual freezes the reference instead of crystallizing (see `_pendingFees`), so a
+  ///      flow here compares the frozen full-universe mark with reduced aggregates and the
+  ///      re-anchor is approximate; the phantom gain itself is never preserved. When the
+  ///      visible carry reads zero (the visible LTV sits below the frozen reference LTV), the
+  ///      seizure conversion measures the deficit against the reduced universe; it typically
+  ///      exceeds the post-flow debt, so the sentinel clamp writes the bootstrap sentinel and
+  ///      the first post-window accrual reseeds the reference at the state it observes without
+  ///      charging (the window recovery is forgiven, LP-favorable). With a positive visible
+  ///      carry the ordinary carry semantics re-anchor instead, which can under- or over-read
+  ///      the later recovery. Remedies for a mis-anchored window flow: an owner reset once the
+  ///      window has closed re-anchors at the live state, but it crystallizes any positive
+  ///      pending basis first, so to avoid charging a mis-read recovery the owner should
+  ///      instead set the performance fee rate to zero right after the flow, let the first
+  ///      accrual with a positive basis advance the reference mintlessly (a positive basis
+  ///      advances even at a zero rate), and then restore the rate. An under-read needs no
+  ///      action (fees resume at a genuine new high, or an owner reset re-anchors sooner).
   ///
   ///      The held management fee accumulator (`heldManagementFeeAssets`, the management fees
   ///      charged since the reference last advanced, deducted from the next positive basis) is
@@ -229,8 +238,12 @@ library LibStorage {
   ///      Edge cases collapse to a plain snapshot of the current state (zero carry): bootstrap
   ///      (`lastDebt == 0` sentinel), an empty vault before the flow, and a carry exceeding the
   ///      post-flow debt (the reference debt floors at zero, which is the bootstrap sentinel, so
-  ///      the excess is forgiven and the next accrual reseeds). An empty good-debt universe
-  ///      after the flow instead holds the reference (see the bad-debt episode below).
+  ///      the excess is forgiven and the next accrual reseeds). The last case includes an
+  ///      oversized converted seizure deficit, e.g. a flow that unwinds debt below the seizure
+  ///      loss: the reseed then lands at the state the next accrual observes, and the recovery
+  ///      from there is charged unless the owner applies the temporary zero-rate remedy above.
+  ///      An empty good-debt universe after the flow instead holds the reference (see the
+  ///      bad-debt episode below).
   ///
   ///      Bad-debt episode: whenever the flow leaves the good-debt universe empty
   ///      (`newCollat == 0` with a live reference), there is no good-debt state to re-anchor on,
@@ -273,6 +286,16 @@ library LibStorage {
       uint256 refCollat = self.lastTotalAssets + refDebt;
       uint256 scaledRefDebt = refDebt.mulDivUp(prevCollat, refCollat);
       uint256 prevCarry = FixedPointMathLib.zeroFloorSub(prevDebt, scaledRefDebt);
+      // Seizure state: a liquidation leaves NAV below the mark while the levered read is
+      // non-negative, so `prevCarry` reads zero and the re-anchor below would drop the mark to
+      // the post-loss trough. Carry the NAV deficit (mark minus pre-flow NAV, zero when NAV is
+      // at or above the mark) instead: the mark then lands at `NAV + deficit`, and later flows
+      // read the same deficit back through the standard carry path. The empty pre-flow
+      // universe is excluded (full-episode re-anchor, see the header); the oversized-deficit
+      // edge is covered by the sentinel clamp below (see the header's edge cases).
+      if (prevCarry == 0 && prevCollat > 0) {
+        prevCarry = FixedPointMathLib.zeroFloorSub(self.lastTotalAssets + prevDebt, prevCollat);
+      }
       // Preserve the per-share carry across the supply change.
       carry = prevCarry.mulDiv(newSupply, prevSupply);
       if (carry > newDebt) carry = newDebt;
 
@@ -59,14 +59,25 @@ abstract contract PositionManagerBase is OwnableRoles, ERC20, ReentrancyGuardTra
   ///      The management fee assets are then deducted from this basis before applying the
   ///      performance fee rate.
   ///
+  ///      The levered basis is capped at the NAV gain since the reference, zero-floored
+  ///      (`totalAssets_ - lastTotalAssets`): an external deleveraging event (a liquidation, a
+  ///      direct repay on the market) can leave the levered read positive while NAV fell, and
+  ///      the cap keeps such events from minting a fee on a loss. A flow rebase converts such a
+  ///      seizure drawdown into the reference carry (see `LibStorage.rebaseSnapshot`), so the
+  ///      suspension survives flows until NAV recovers past the carried mark; an oversized
+  ///      drawdown is forgiven through the bootstrap sentinel instead.
+  ///
   ///      Reference-advance rule (high-water mark): the performance reference (`lastTotalAssets`,
-  ///      `lastDebt`) advances to the current state only when the basis is positive
+  ///      `lastDebt`) advances to the current state only when the capped basis is positive
   ///      (crystallization, at the configured rate which may be zero), when `lastDebt` is zero
   ///      (bootstrap sentinel), or when the vault has no shares. When the basis is non-positive
-  ///      the reference is held. Holding it keeps the debt interest accrued while the collateral
-  ///      quote is flat (the collateral oracle may only reprice periodically) inside the basis, so
-  ///      the next collateral repricing is charged net of the full inter-repricing debt carry
-  ///      rather than only the last accrual interval's. It also prevents re-charging a recovery
+  ///      the reference is held; it is also held when a positive basis carries a performance
+  ///      entitlement that converts to zero fee shares, so the gain accumulates instead of being
+  ///      consumed by the advance (see the hold at the end of this function). Holding it keeps
+  ///      the debt interest accrued while the collateral quote is flat (the collateral oracle
+  ///      may only reprice periodically) inside the basis, so the next collateral repricing is
+  ///      charged net of the full inter-repricing debt carry rather than only the last accrual
+  ///      interval's. It also prevents re-charging a recovery
   ///      after a drawdown: the reference stays at the old peak instead of resetting down.
   ///      Crystallizing on a positive basis even when the configured rate is zero (or no recipient
   ///      is set) mirrors the pre-existing behavior that gains realised before fees are enabled
@@ -130,9 +141,10 @@ abstract contract PositionManagerBase is OwnableRoles, ERC20, ReentrancyGuardTra
   /// @return managementFeeShares The shares that would be minted for management fees
   /// @return performanceFeeShares The shares that would be minted for performance fees
   /// @return advanceReference True when `_accrueFees` must advance the performance reference to
-  ///         the current state (positive basis, bootstrap, or empty vault); false to hold it.
-  ///         Always false while any module is excluded as bad debt (see the partial bad-debt
-  ///         episode rule above)
+  ///         the current state (positive capped basis, bootstrap, or empty vault); false to hold
+  ///         it. Always false while any module is excluded as bad debt (see the partial bad-debt
+  ///         episode rule above) and while a performance entitlement would mint zero shares (see
+  ///         the reference-advance rule above)
   /// @return heldManagementFees_ The value `_accrueFees` must persist as the held management fee
   ///         accumulator: zero when the reference advances (deduction consumed or forgiven),
   ///         otherwise the stored accumulator plus the management fee charged this interval
@@ -198,6 +210,16 @@ abstract contract PositionManagerBase is OwnableRoles, ERC20, ReentrancyGuardTra
         }
       }
 
+      // Cap the levered basis at the NAV gain since the reference (zero-floored): a seizure
+      // (liquidation) leaves the levered read positive while NAV fell, and an uncapped basis
+      // would mint a fee on the loss. Capped to zero the reference is held, so a recovery is
+      // only charged past the pre-loss mark (see the cap notes in the header). On internal
+      // paths the cap is slack. Outside the block above for stack depth.
+      if (basis > 0) {
+        basis = basis.min(FixedPointMathLib.zeroFloorSub(totalAssets_, _storage.lastTotalAssets));
+        advanceReference = basis > 0;
+      }
+
       // Loaded after the basis block to keep the peak stack depth flat (the block above is at
       // the non-via-ir stack limit).
       FeeData memory fd = _storage.feeData;
@@ -235,10 +257,10 @@ abstract contract PositionManagerBase is OwnableRoles, ERC20, ReentrancyGuardTra
     //     zero, and `convertToShares` against a zero base would mint an inflated share count to the
     //     fee recipient, confiscating the pool.
     //   - `totalFeeAssets > totalAssets_`: should not occur under current invariants
-    //     (`managementFeeAssets` is capped at `totalAssets_`, and the perf basis is bounded by
-    //     `totalAssets_` because `scaledLastDebt <= currentCollat` whenever `lastDebt <= lastCollat`
-    //     and `performanceFee <= BPS`). Folding it in here makes the subsequent subtraction safe
-    //     without depending on that invariant chain.
+    //     (`managementFeeAssets` is capped at `totalAssets_`, and the perf basis is capped at
+    //     `totalAssets_ - lastTotalAssets` by the NAV-gain clamp, with `performanceFee <= BPS`).
+    //     Folding it in here makes the subsequent subtraction safe without depending on that
+    //     invariant chain.
     // `_accrueFees` still refreshes `lastFeeAccrualTimestamp` (and the reference, per
     // `advanceReference`) so normal accrual resumes next call. Nothing is minted, so this
     // interval's management fee does not join the held accumulator either.
@@ -265,6 +287,18 @@ abstract contract PositionManagerBase is OwnableRoles, ERC20, ReentrancyGuardTra
       );
       performanceFeeShares -= managementFeeShares;
     }
+
+    // Hold the reference when a nonzero performance entitlement (`totalFeeAssets` above the
+    // management component) converts to zero fee shares: advancing would consume the gain
+    // without paying it, so checkpoint splitting could erase the fee. Held, the basis keeps
+    // accumulating until it mints at least one share, and this interval's management fee joins
+    // the held accumulator like any held accrual (see the reference-advance rule in the
+    // header; an entitlement that already rounds to zero assets still advances, forgiven as
+    // rounding dust).
+    if (advanceReference && performanceFeeShares == 0 && totalFeeAssets > managementFeeAssets) {
+      advanceReference = false;
+      heldManagementFees_ = _storage.heldManagementFeeAssets + managementFeeAssets;
+    }
   }
 
   /// @dev Accrues fees (management + performance) and mints shares to the fee recipient.
 
@@ -166,15 +166,17 @@ abstract contract PositionManagerLP is IPositionManagerLP, PositionManagerBase {
     bool skipLtvCheck = _storage.withdrawalQueue.length == _storage.borrowModules.length();
     _storage.processWithdrawal(collateral, debt, strategy, !skipLtvCheck);
 
+    // Rebase the performance reference across the flow so the exiting shares take their
+    // proportional slice of any carried pending basis with them. Rebased before the outgoing
+    // transfer so a token callback cannot move module state into the new reference; the
+    // transfer itself changes nothing the rebase reads (module aggregates only).
+    _rebaseReference(totalAssetsBefore, debtBefore, _totalSupply);
+
     // Send collateral to caller
     if (collateral > 0) {
       _storage.metadata.collateralAsset.safeTransfer(msg.sender, collateral);
     }
 
-    // Rebase the performance reference across the flow so the exiting shares take their
-    // proportional slice of any carried pending basis with them.
-    _rebaseReference(totalAssetsBefore, debtBefore, _totalSupply);
-
     emit Burn(msg.sender, shares, collateral, debt);
   }