fix(harness): CollateralPosition PDA on both deposit paths + flow coverage (SOL-375/379/380)

[valthon]

Important

Part of a three-repo set — all must merge together:

• wire-solana https://github.com/Wire-Network/wire-solana/pull/409 — the program change (CollateralPosition PDA, asset-identity enforcement)
• wire-sysio feat(outpost_solana): declare collateral-settlement accounts on the terminal manifest (SOL-375/379/380) wire-sysio#553 — the relay's terminal account manifest
• wire-tools-ts this PR — harness + flow coverage

The harness deposit paths must pass the CollateralPosition PDA the program now
requires; without wire-solana#409 these calls have nowhere to send it, and without this
PR every harness collateral deposit fails against the new program.

Note

The port-lock changes were split out to #76 per review. This PR no longer touches
BindConfigProvider or fsUtils. It does still carry the jest testTimeout bump —
see "The timeout lives here" below for why that half came back. #76 now depends on this
PR, not the other way round.

Harness side of the SOL-375/379/380 collateral work. Three commits.

Track collateral position PDAs in SOL flows

• SolanaCollateralTool derives and passes the per-(operator, token_code)
CollateralPosition PDA on both deposit paths.
• TerminationScenario snapshots the position's rent, which is refunded on the
  full-drain close — so the SOL remit assertion is exact rather than off by the rent.
• The per-token little-endian seed encoder that three call sites had each re-spelled is
  consolidated into one helper in slugUtils.
• The outpost bootstrap pre-creates reserve_aggregate's ATA for every registered SPL
  collateral mint (new idempotent SolanaFundingTool.ensureAssociatedTokenAccount). An
  SPL SLASH settles into that ATA; the program never creates ATAs and a dropped seizure
  has no return attestation to re-drive it, so the destination must exist first (SOL-380).
  A real outpost deploy owes the same one-time step when it registers an SPL collateral
  token — the sole remaining production follow-up.

Log validator output; unblock commits on untrusted mise config

• solana-test-validator's RUST_LOG defaults to an additive filter (agave's own
  solana=info,agave=info plus the program-log target), so on-chain msg!() reaches
  validator.log WITHOUT silencing agave's startup diagnostics — a bare program-log
  directive would replace agave's default and hide the panic/bind lines
  validatorLogTail() surfaces.
• .husky/pre-commit falls through to a direct pnpm run when mise is present but cannot
  execute (a fresh clone whose mise config has not been trusted yet).

OMC style, lint, rules AND dedupe review

A four-reviewer pass (STYLE.md/eslint, manifest rules, duplication, plus two independent
second opinions); every finding was verified against the source before being applied.

start.sh no longer freezes build-host state. DaemonConfig carried
SolanaValidatorProcess.resolveEnv(), which reads the build host's RUST_LOG, and the
renderer emitted that frozen answer as an unconditional export. Both branches were
wrong: a build host with RUST_LOG set stripped the program-log target from the
published script entirely — the very defect the commit above exists to fix — and one
without it pinned a value the operator could not override. DaemonConfig now carries the
unconditional DefaultEnv, and the renderer emits
[ -n "${NAME:-}" ] || export NAME=<value> so the run-time environment still wins. (The
guarded form rather than ${NAME:-…}: bash re-parses quotes inside an expansion word, so
a value containing ' would break the script.) This restores the renderer's own
documented invariant — build-time conditionals render as SHELL, never frozen.

The ensureAssociatedTokenAccount test asserted nothing. It stubbed sendTransaction
while sendAndPoll submits via sendRawTransaction, so its write-count flag could never
flip — and the ATA-absent branch, the one SOL-380's argument rests on, had no coverage
at all. The stub now implements the methods the send path actually calls; both branches
are asserted.

Seeds and PDA derivation stop forking. reserve_aggregate was re-spelled in
SolanaCollateralTool while the same change consumed
SolanaOutpostBootstrapper.PdaSeed.ReserveAggregate two files over. CollateralPosition
and CollateralVault join that registry and the tool derives all three from it. The
findProgramAddressSync plumbing was triplicated behind three private one-liners across
two files — now one SolanaOutpostProgramTool.derivePda.

tokenCodeToLittleEndianBuffer → slugNameToLittleEndianBuffer, widened to
number | bigint. Five of its twelve call sites encode a reserve code, so the old
name misdescribed them, and the deleted predecessor already used the slugName stem. The
widening drops the BigInt(...) wrapper the bigint-only signature forced on callers
holding the number that SlugName.from returns.

Also: a dead Anchor Program load built solely to interpolate a failure message is gone,
along with the divergent program-id source it introduced; mintMockSplToUser and
ensureAssociatedTokenAccount share an instruction-returning helper so the former keeps
batching ATA creation with its mint in one transaction; the renderer walks
daemon.env once via the existing isNotEmpty predicate; tests added for the
DaemonConfig env wiring, both start.sh branches, and the number carrier; the
validator tests drop process.env mutation for resolveEnv's parameter; every touched
file passes prettier.

The timeout lives here

The jest ceiling (30s → 120s, root + cluster-tool) briefly moved to #76 and has come back,
because it is what a green suite actually needs and it is not part of the port-lock
change the reviewer asked to split out.

An earlier revision of this description claimed the ENOENT … wire-cluster-ports.lock.lock
failures were a second defect requiring #76. That was wrong. They are a consequence
of the undershot ceiling: a test killed at 30s dies inside withFileLock, jest tears the
suite down, the fixture removes its temp registry dir while proper-lockfile's refresh
timer still holds the lock, and onCompromised throws. One defect, two symptoms.
Measured on the same tree:

Tree	Result
this PR (timeout, lock files untouched)	220/220 suites, 1726/1726 tests — green
lock fix only, 30s ceiling	red (~86 Exceeded timeout of 30000 ms)

Verification

Rebased on latest origin/master (78285a80); each commit builds independently.

• pnpm build ✅
• pnpm lint ✅ (no suppressions added; every touched file prettier-clean)
• pnpm test ✅ — 220/220 suites, 1726/1726 tests, all 8 projects

The cross-repo verification run must override all three repos (BRANCH_WIRE_SYSIO,
BRANCH_WIRE_SOLANA, BRANCH_WIRE_TOOLS_TS = fix/SOL-375-379-380-opp-collateral) — the
program, the relay manifest, and the harness deposit paths move together.

Prior full-platform e2e evidence (pre-split, same harness surfaces):
14/14 flows green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VqAoaLdCBqgV2vXgDCGhgY

[valthon]

Clean e2e flow run: https://github.com/Wire-Network/wire-platform-build-system/actions/runs/31697782274

[valthon]

14/14 e2e flows ✅

Cross-repo E2E integration run with all three branches pinned to fix/SOL-375-379-380-opp-collateral (wire-sysio, wire-solana, wire-tools-ts; other repos on manifest defaults, Release build): 14/14 flows passed — full platform build + every discovered flow green, no epoch stalls, OPP circulation clean.

Directly exercising this branch's surfaces:

• operator-collateral-deposit ✅ / reserve-lifecycle ✅ — F1 per-position custody read + F3 SPL reserve-ATA provisioning
• underwriter-slashing ✅ / batch-operator-slashing ✅ — SPL slash prechecks-before-debit
• full swap suite ✅ (incl. swap-private-reserves, swap-non-native-tokens) — SPL terminal-settlement paths (SOL-380)

Run: https://github.com/Wire-Network/wire-platform-build-system/actions/runs/31853124095

[valthon]

✅ flow tests

[jglanz]

Split out the port lock changes into another PR, and just validate the timeout changes and should be good to go