refactor: read the Request through syncRepaidStatus and store the payload digest as a uint

The value gate derived the effective repaid state from the mirrored deadline
plus the stale repaid flag; syncRepaidStatus returns exactly that disjunction
and folds a past-deadline Request into the flag, the same idiom resolve uses.

The payload digest now goes through the existing tStoreUint/tLoadUint, so
LibTransientSlot is untouched by this PR.

Author: maxencerb

src/interfaces/manager/rebalancer/IRetargetter.sol

@@ -251,10 +251,11 @@ interface IRetargetter {
   ///      one balance snapshot taken before any leg executes and do not compose: every leg
   ///      resolves against the same pre-call balances, never the state left by earlier legs,
   ///      so REPAY sentinels across several modules can together commit more than the shared
-  ///      balance and revert. While the operation's Request is unrepaid and short of its
-  ///      deadline, the position manager's totalAssets must not grow across the call (every
-  ///      caller, owner included): Request capital may enter the position only against
-  ///      equivalent value flowing back out in the same call.
+  ///      balance and revert. While the operation's Request is unrepaid, the position's net
+  ///      value (quoted collateral minus debt over every module, underwater ones included)
+  ///      must not grow across the call, for every caller including the owner: Request
+  ///      capital may enter the position only against equivalent value flowing back out in
+  ///      the same call.
   /// @param data The rebalancing data forwarded to the position manager
   function rebalance(RebalancingData calldata data) external;
 

src/libs/common/LibTransientSlot.sol

@@ -21,13 +21,6 @@ library LibTransientSlot {
     }
   }
 
-  /// @dev Reads a bytes32 from a transient slot.
-  function tLoadBytes32(bytes32 slot) internal view returns (bytes32 value) {
-    assembly ("memory-safe") {
-      value := tload(slot)
-    }
-  }
-
   /// @dev Writes an address to a transient slot.
   function tStoreAddress(bytes32 slot, address value) internal {
     assembly ("memory-safe") {
@@ -41,11 +34,4 @@ library LibTransientSlot {
       tstore(slot, value)
     }
   }
-
-  /// @dev Writes a bytes32 to a transient slot.
-  function tStoreBytes32(bytes32 slot, bytes32 value) internal {
-    assembly ("memory-safe") {
-      tstore(slot, value)
-    }
-  }
 }

src/manager/rebalancer/Retargetter.sol

@@ -567,15 +567,15 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
     bytes memory payload = abi.encode(data);
     MODULE_TSLOT.tStoreAddress(flashLoanModule);
     AMOUNT_TSLOT.tStoreUint(flashLoanAmount);
-    PAYLOAD_TSLOT.tStoreBytes32(keccak256(payload));
+    PAYLOAD_TSLOT.tStoreUint(uint256(keccak256(payload)));
     BALANCE_TSLOT.tStoreUint(debtAsset.balanceOf(address(this)));
 
     IFlashLoanModule(flashLoanModule).flashLoan(debtAsset, flashLoanAmount, payload);
 
     // The module has pulled its repayment; close the window and scrub any leftover approval
     MODULE_TSLOT.tStoreAddress(address(0));
     AMOUNT_TSLOT.tStoreUint(0);
-    PAYLOAD_TSLOT.tStoreBytes32(bytes32(0));
+    PAYLOAD_TSLOT.tStoreUint(0);
     BALANCE_TSLOT.tStoreUint(0);
     debtAsset.safeApprove(flashLoanModule, 0);
 
@@ -605,12 +605,12 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
     address module = MODULE_TSLOT.tLoadAddress();
     if (
       module == address(0) || msg.sender != module || amount != AMOUNT_TSLOT.tLoadUint()
-        || keccak256(data) != PAYLOAD_TSLOT.tLoadBytes32()
+        || uint256(keccak256(data)) != PAYLOAD_TSLOT.tLoadUint()
     ) {
       revert LibRetargetterErrors.UnauthorizedFlashLoanCallback();
     }
     MODULE_TSLOT.tStoreAddress(address(0));
-    PAYLOAD_TSLOT.tStoreBytes32(bytes32(0));
+    PAYLOAD_TSLOT.tStoreUint(0);
     address debtAsset = LibStorage.assetsStorage().debtAsset;
     if (debtAsset.balanceOf(address(this)) < BALANCE_TSLOT.tLoadUint() + amount) {
       revert LibRetargetterErrors.PrincipalNotDelivered();
@@ -910,20 +910,17 @@ contract Retargetter is IRetargetter, IFlashLoanReceiver, OwnableRoles, Initiali
   }
 
   /// @dev Arms the rebalance value-conservation gate: returns the position manager's current
-  ///      net value while the operation's Request is unrepaid and short of its deadline, and
-  ///      the max sentinel (gate disarmed) otherwise. Once the Request is repaid, or
-  ///      auto-expired past its deadline with holders redeeming its remaining balance,
-  ///      folding residual value back into the position must reopen, which is why the gate
-  ///      keys on the effective repaid state rather than the operation being active.
-  function _bridgeValueSnapshot(address positionManager) internal view returns (int256) {
-    RetargetterOperation storage operation_ = LibStorage.operationStorage();
-    address request = operation_.request;
-    if (
-      request == address(0) || block.timestamp >= operation_.repaymentDeadline
-        || IRequestInteractions(request).isRepaid()
-    ) {
-      return type(int256).max;
-    }
+  ///      net value while the operation's Request is unrepaid, and the max sentinel (gate
+  ///      disarmed) otherwise. Once the Request is repaid, or auto-expired past its deadline
+  ///      with holders redeeming its remaining balance, folding residual value back into the
+  ///      position must reopen, which is why the gate keys on the effective repaid state
+  ///      rather than the operation being active. Read through the state-mutating sync (the
+  ///      same one resolve gates on) so a past-deadline Request reads repaid here instead of
+  ///      wedging the gate on a stale flag; that makes this the only non-view step of the
+  ///      rebalance guardrails.
+  function _bridgeValueSnapshot(address positionManager) internal returns (int256) {
+    address request = LibStorage.operationStorage().request;
+    if (request == address(0) || IRequest(request).syncRepaidStatus()) return type(int256).max;
     return _positionValue(positionManager);
   }
 

test/manager/rebalancer/RetargetterAsync.t.sol

@@ -1045,10 +1045,14 @@ contract RetargetterAsyncTest is RetargetterBaseTest {
     vm.expectRevert(LibRequestErrors.AlreadyRepaid.selector);
     retargetter.repay();
 
-    // Fold the pulled funds back into the position debt (below target is always allowed),
-    // then resolve through the state-mutating repaid sync
+    // The fold grows the position's net value, so it only lands because the value gate reads
+    // the Request through the same state-mutating sync resolve uses: past the deadline the
+    // Request reads repaid (and its stale flag is synced here) and the gate disarms
+    assertFalse(IRequest(request).isRepaid(), "repaid flag still stale before the rebalance");
     vm.prank(rebalancer);
     retargetter.rebalance(_rebalancingData(0, MAX_SENTINEL, RebalancingOperationType.REPAY, MAX_SENTINEL));
+    assertTrue(IRequest(request).isRepaid(), "rebalance synced the auto-expired Request");
+
     vm.prank(rebalancer);
     retargetter.resolve();
     assertFalse(retargetter.isActive(), "resolved");