refactor: drop operation.positionManager, key active on fund + bound PM

The operation always runs against the instance-bound position manager, which
cannot change while active, so storing it on the operation record was pure
duplication. Remove the field:
- fund becomes the operation-active flag (both start paths set it, only
  clearOperation clears it, and no fund can be the zero address since setFund
  contract-checks it). isActive, _checkStart and setPositionManager's
  active guard key on fund; checkActive keys on fund and returns the bound PM.
- consume/authorizeMinting/resolve read the bound PM from assets storage; the
  operation() view derives its positionManager (bound PM when active, else
  zero) instead of returning a stored field, keeping the same ABI and
  semantics.

RetargetterOperation repacks to 7 slots (request now shares slot 0, fund + the
order mode share slot 1); the storage-layout and stray-order tests are updated.
Full suite 2347 passing, 74 invariants passing; the fund active flag is
mutation-checked. Retargetter runtime 23,953 B on the ci profile, 623 B under
EIP-170.

Author: maxencerb

src/libs/manager/rebalancer/LibStorage.sol

@@ -41,13 +41,15 @@ struct RetargetterWhitelists {
 }
 
 /// @notice The one in-flight operation (namespace "retargetter.operation").
-/// @dev `positionManager != address(0)` is the operation-active flag. An ASYNC operation uses
-///      every field and is zeroed at resolve; a SYNC flash-loan window populates only the
-///      addresses the steps need (`positionManager`, `fund`) and zeroes them at window close,
-///      so `request == address(0)` inside a window is what gates the ASYNC-only steps. The
-///      stored order is partial: `owner` and `receiver` are always the Retargetter (enforced
-///      at create) so {LibStorage.order} rebuilds the full Order in memory.
-/// @param positionManager The operation's position manager
+/// @dev `fund != address(0)` is the operation-active flag: both start paths set it and only
+///      {clearOperation} clears it, and no fund can be the zero address (setFund contract-
+///      checks it). The position manager an operation runs against is the instance-bound one
+///      ({RetargetterAssets.positionManager}), which cannot change while active, so it is not
+///      duplicated here. An ASYNC operation uses every field and is zeroed at resolve; a SYNC
+///      flash-loan window populates only `fund` and zeroes it at window close, so
+///      `request == address(0)` inside a window is what gates the ASYNC-only steps. The stored
+///      order is partial: `owner` and `receiver` are always the Retargetter (enforced at
+///      create) so {LibStorage.order} rebuilds the full Order in memory.
 /// @param startedAt The loan clock origin, set at the first consume or nonzero mint
 ///        authorization (0 until then); rewound to 0 by a revocation that leaves the
 ///        operation with no PT, no YT and no pending authorization
@@ -74,7 +76,6 @@ struct RetargetterWhitelists {
 ///        eagerly, a completed mint is pruned lazily by the next write-path computation, and
 ///        resolve empties the set
 struct RetargetterOperation {
-  address positionManager;
   uint40 startedAt;
   uint16 operationMaxYieldBps;
   bool consumptionClosed;
@@ -135,12 +136,13 @@ library LibStorage {
   /*                      OPERATION GATES                       */
   /*.•°:°.´+˚.*°.˚:*.´•*.+°.•°:´*.´•*.•°.•°:°.´:•˚°.*°.˚:*.´+°.•*/
 
-  /// @dev Reverts unless an operation is active (ASYNC or SYNC window); returns its position
-  ///      manager.
+  /// @dev Reverts unless an operation is active (ASYNC or SYNC window), keyed on the fund flag;
+  ///      returns the instance-bound position manager the operation runs against (always set
+  ///      while active, since it was required at start and cannot be unbound mid-operation).
   /// @param self The storage pointer to the operation
   function checkActive(RetargetterOperation storage self) internal view returns (address positionManager) {
-    positionManager = self.positionManager;
-    if (positionManager == address(0)) revert LibRetargetterErrors.NoActiveOperation();
+    if (self.fund == address(0)) revert LibRetargetterErrors.NoActiveOperation();
+    positionManager = assetsStorage().positionManager;
   }
 
   /// @dev Reverts unless an ASYNC operation is active (SYNC windows carry no Request);
@@ -305,7 +307,6 @@ library LibStorage {
   ///      each removal a plain pop); the order fields are cleared separately as orders end.
   /// @param self The storage pointer to the operation
   function clearOperation(RetargetterOperation storage self) internal {
-    self.positionManager = address(0);
     self.startedAt = 0;
     self.operationMaxYieldBps = 0;
     self.consumptionClosed = false;

src/manager/rebalancer/Retargetter.sol

@@ -234,7 +234,8 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
         0
       );
 
-    operation_.positionManager = positionManager;
+    // fund is the operation-active flag (see {RetargetterOperation}); the position manager it
+    // runs against is the instance-bound one, not duplicated here
     operation_.operationMaxYieldBps = effectiveYieldCap;
     operation_.request = request;
     operation_.repaymentDeadline = repaymentDeadline;
@@ -275,7 +276,9 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
     operation_.checkYield(offer.amount, offer.expectedReturn);
     operation_.checkConsumptionWindow();
     ytAmount = IRequest(request).consume(offer, signature, ptAmount);
-    operation_.checkPrincipalCap(request, 0, _maxPrincipal(operation_.positionManager, operation_.operationMaxYieldBps));
+    operation_.checkPrincipalCap(
+      request, 0, _maxPrincipal(LibStorage.assetsStorage().positionManager, operation_.operationMaxYieldBps)
+    );
     emit OfferConsumed(request, offer.maker, ptAmount, ytAmount);
   }
 
@@ -306,7 +309,7 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
         ptAmount,
         ytAmount,
         ptAmount,
-        _maxPrincipal(operation_.positionManager, operation_.operationMaxYieldBps)
+        _maxPrincipal(LibStorage.assetsStorage().positionManager, operation_.operationMaxYieldBps)
       );
       // The capacity bound keeps every loop over the set within gas reach; see the constant
       accounts.add(to, MAX_AUTHORIZED_ACCOUNTS);
@@ -388,7 +391,7 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
   function resolve() external onlyOwnerOrRebalancer nonReentrant {
     RetargetterOperation storage operation_ = LibStorage.operationStorage();
     address request = operation_.checkRequest();
-    address positionManager = operation_.positionManager;
+    address positionManager = LibStorage.assetsStorage().positionManager;
     if (!IRequest(request).syncRepaidStatus()) revert LibRetargetterErrors.RequestNotRepaid();
     operation_.checkNoPendingOrder(operation_.fund);
     _checkResidual();
@@ -595,15 +598,15 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
       revert LibRetargetterErrors.ModuleNotWhitelisted();
     }
 
-    // Open the window: the operation storage carries the addresses the steps read (and locks
-    // out nested starts); the module slot authenticates the callback and is zeroed on its
-    // entry (single-shot). The payload digest and the pre-loan debt balance bind the callback
-    // to this exact payload and to the full delivery of the principal, so a whitelisted
-    // module can neither substitute its own step calls nor collect the repayment approval
-    // for funds it never delivered. Step authority is not handed out here: the window slot
-    // is set inside the callback around the payload alone, so the module holds no authority
-    // in its own frame and cannot source the delivery from the position manager itself
-    operation_.positionManager = positionManager;
+    // Open the window: the operation's fund both records the venue the steps read and flags
+    // the operation active (locking out nested starts). The module slot authenticates the
+    // callback and is zeroed on its entry (single-shot). The payload digest and the pre-loan
+    // debt balance bind the callback to this exact payload and to the full delivery of the
+    // principal, so a whitelisted module can neither substitute its own step calls nor collect
+    // the repayment approval for funds it never delivered. Step authority is not handed out
+    // here: the window slot is set inside the callback around the payload alone, so the module
+    // holds no authority in its own frame and cannot source the delivery from the position
+    // manager itself
     operation_.fund = fund;
     address debtAsset = LibStorage.assetsStorage().debtAsset;
     bytes memory payload = abi.encode(data);
@@ -730,7 +733,7 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
   ///      PositionManagerNotBound meanwhile). Every start-gate and principal-cap read trusts
   ///      the bound address, which is why the binding is owner-curated, not caller-supplied.
   function setPositionManager(address positionManager) external onlyOwner nonReentrant {
-    if (LibStorage.operationStorage().positionManager != address(0)) revert LibRetargetterErrors.OperationActive();
+    if (LibStorage.operationStorage().fund != address(0)) revert LibRetargetterErrors.OperationActive();
     _bindPositionManager(positionManager);
   }
 
@@ -763,8 +766,10 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
     )
   {
     RetargetterOperation storage operation_ = LibStorage.operationStorage();
+    // The operation runs against the instance-bound position manager while active (fund set),
+    // and zero when idle: derived rather than stored on the operation
     return (
-      operation_.positionManager,
+      operation_.fund != address(0) ? LibStorage.assetsStorage().positionManager : address(0),
       operation_.request,
       operation_.fund,
       operation_.startedAt,
@@ -780,7 +785,7 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
 
   /// @inheritdoc IRetargetter
   function isActive() external view returns (bool) {
-    return LibStorage.operationStorage().positionManager != address(0);
+    return LibStorage.operationStorage().fund != address(0);
   }
 
   /// @inheritdoc IRetargetter
@@ -882,7 +887,7 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
     view
     returns (address positionManager)
   {
-    if (operation_.positionManager != address(0)) revert LibRetargetterErrors.OperationActive();
+    if (operation_.fund != address(0)) revert LibRetargetterErrors.OperationActive();
     if (operation_.orderLive) revert LibRetargetterErrors.OrderActive();
     positionManager = LibStorage.assetsStorage().positionManager;
     if (positionManager == address(0)) revert LibRetargetterErrors.PositionManagerNotBound();

test/manager/rebalancer/Retargetter.t.sol

@@ -1062,30 +1062,29 @@ contract RetargetterTest is RetargetterBaseTest {
     assertEq(accounts.length, 1, "one registered account");
     assertEq(accounts[0], broker, "broker registered");
 
-    // Slot A: positionManager (bits 0..159) | startedAt (160..199) | operationMaxYieldBps
-    // (200..215) | consumptionClosed (216..223) | horizon (224..255): full, no wasted bits
+    // Slot A: startedAt (bits 0..39) | operationMaxYieldBps (40..55) | consumptionClosed
+    // (56..63) | horizon (64..95) | request (96..255): full, no wasted bits (no stored
+    // position manager: it is the instance-bound one, and fund is the active flag)
     uint256 slotA = uint256(vm.load(address(retargetter), OPERATION_STORAGE_SLOT));
-    assertEq(address(uint160(slotA)), address(positionManager), "position manager bits");
-    assertEq(uint40(slotA >> 160), uint40(startTime + 1 days), "startedAt bits");
-    assertEq(uint16(slotA >> 200), 100, "operation max yield bits");
-    assertEq(uint8(slotA >> 216), 0, "consumption closed bit clear");
-    assertEq(slotA >> 224, DEFAULT_HORIZON, "horizon bits");
-
-    // Slot B: request (bits 0..159) | repaymentDeadline (160..199) | tickDuration (200..223)
-    // | tickThreshold (224..247)
+    assertEq(uint40(slotA), uint40(startTime + 1 days), "startedAt bits");
+    assertEq(uint16(slotA >> 40), 100, "operation max yield bits");
+    assertEq(uint8(slotA >> 56), 0, "consumption closed bit clear");
+    assertEq(uint32(slotA >> 64), DEFAULT_HORIZON, "horizon bits");
+    assertEq(address(uint160(slotA >> 96)), request, "request bits");
+
+    // Slot B: repaymentDeadline (bits 0..39) | tickDuration (40..63) | tickThreshold (64..87)
+    // | fund (88..247) | orderMode (248..255): full
     uint256 slotB = uint256(vm.load(address(retargetter), bytes32(uint256(OPERATION_STORAGE_SLOT) + 1)));
-    assertEq(address(uint160(slotB)), request, "request bits");
-    assertEq(uint40(slotB >> 160), uint40(startTime + 90 days), "repayment deadline bits");
-    assertEq(uint24(slotB >> 200), DEFAULT_TICK_DURATION, "tick duration bits");
-    assertEq(uint24(slotB >> 224), DEFAULT_TICK_THRESHOLD, "tick threshold bits");
-    assertEq(slotB >> 248, 0, "slot B upper bits clean");
+    assertEq(uint40(slotB), uint40(startTime + 90 days), "repayment deadline bits");
+    assertEq(uint24(slotB >> 40), DEFAULT_TICK_DURATION, "tick duration bits");
+    assertEq(uint24(slotB >> 64), DEFAULT_TICK_THRESHOLD, "tick threshold bits");
+    assertEq(address(uint160(slotB >> 88)), address(fund), "fund bits");
+    assertEq(uint8(slotB >> 248), uint8(Mode.REDEEM), "order mode bits");
 
-    // Slot C: fund (bits 0..159) | orderMode (160..167) | orderLive (168..175)
+    // Slot C: orderLive (bits 0..7)
     uint256 slotC = uint256(vm.load(address(retargetter), bytes32(uint256(OPERATION_STORAGE_SLOT) + 2)));
-    assertEq(address(uint160(slotC)), address(fund), "fund bits");
-    assertEq(uint8(slotC >> 160), uint8(Mode.REDEEM), "order mode bits");
-    assertEq(uint8(slotC >> 168), 1, "order live bits");
-    assertEq(slotC >> 176, 0, "slot C upper bits clean");
+    assertEq(uint8(slotC), 1, "order live bits");
+    assertEq(slotC >> 8, 0, "slot C upper bits clean");
 
     // Slots D to F: the stored order's input, output and salt
     assertEq(
@@ -1098,15 +1097,15 @@ contract RetargetterTest is RetargetterBaseTest {
       vm.load(address(retargetter), bytes32(uint256(OPERATION_STORAGE_SLOT) + 5)), bytes32(uint256(42)), "order salt"
     );
 
-    // Pulling funds flips the consumption-closed bit (216..223) and nothing else in slot A
+    // Pulling funds flips the consumption-closed bit (56..63) and nothing else in slot A
     vm.prank(rebalancer);
     retargetter.pullRequestFunds(1);
     slotA = uint256(vm.load(address(retargetter), OPERATION_STORAGE_SLOT));
-    assertEq(address(uint160(slotA)), address(positionManager), "position manager bits unchanged");
-    assertEq(uint40(slotA >> 160), uint40(startTime + 1 days), "startedAt bits unchanged");
-    assertEq(uint16(slotA >> 200), 100, "operation max yield bits unchanged");
-    assertEq(uint8(slotA >> 216), 1, "consumption closed bit set");
-    assertEq(slotA >> 224, DEFAULT_HORIZON, "horizon bits unchanged by the pull");
+    assertEq(uint40(slotA), uint40(startTime + 1 days), "startedAt bits unchanged");
+    assertEq(uint16(slotA >> 40), 100, "operation max yield bits unchanged");
+    assertEq(uint8(slotA >> 56), 1, "consumption closed bit set");
+    assertEq(uint32(slotA >> 64), DEFAULT_HORIZON, "horizon bits unchanged by the pull");
+    assertEq(address(uint160(slotA >> 96)), request, "request bits unchanged by the pull");
   }
 
   function test_storageLayout_assetsPacking() public view {

test/manager/rebalancer/RetargetterSmoke.t.sol

@@ -85,13 +85,13 @@ contract RetargetterSmokeTest is RetargetterBaseTest {
     assertApproxEqAbs(_currentLtv(), 6875e14, 1e14, "post LTV (11000/16000)");
   }
 
-  /// @dev Plants a stray live order directly in storage. The orderLive flag packs into the
-  ///      operation namespace's third slot at bit 168 (after the fund address and the mode);
-  ///      no reachable flow leaves it set without an active operation, so the defensive
-  ///      OrderActive guards at both start entry points need this to be exercised.
+  /// @dev Plants a stray live order directly in storage. The orderLive flag sits alone at bit
+  ///      0 of the operation namespace's third slot (the fund address and the order mode moved
+  ///      into the second slot); no reachable flow leaves it set without an active operation,
+  ///      so the defensive OrderActive guards at both start entry points need this exercised.
   function _plantStrayOrder() internal {
     bytes32 slot = bytes32(uint256(OPERATION_STORAGE_SLOT) + 2);
-    vm.store(address(retargetter), slot, bytes32(uint256(1) << 168));
+    vm.store(address(retargetter), slot, bytes32(uint256(1)));
   }
 
   function test_startRetargetting_revertsOrderActiveOnStrayOrder() public {