test(pm): margin/leverage safety — bad-debt transfer, profit close, Sybil settlement throttle (PR #124)

[chiliec]

Summary

Margin/leverage safety coverage for the HF14 prediction markets, following the review of PR #124. Adds three CI-wired consensus_sim cases to tests/consensus_sim/scenarios/test_pm_lifecycle.cpp, all driven through the real evaluators + database + settlement cron (not the standalone replay math). Purely additive (+365 lines, no existing code touched); auto-registered by Boost, run under ctest/CI like the other cases.

leverage_bad_debt_is_transfer_not_mint

Forces genuine pool bad debt (pool_received < loan) via the cancel-bet cascade and asserts the loss is a zero-sum transfer, not a mint: current_supply moves by block inflation alone and pool free_balance stays ≥ 0. The pool is not always made whole — a fast adverse move sticks LPs with the loss — but the chain never emits tokens to cover a leveraged bettor.

leverage_profit_close_never_mints

Open → same-side whale → profitable voluntary close → resolve → settle. Asserts the #141 pot_retained clamp keeps forfeit_pool ≥ 0 and current_supply moves by block inflation alone (no mint on the profit path either).

leverage_sybil_settlement_is_cap_throttled

Documents a margin-abuse probe and its (working) defense. There is no per-market / per-account leverage-position count cap and no minimum loan (validate only requires loan>0, collateral>0), so a Sybil can open many cheap positions on one market — the test opens 12. The hoped-for exploit was that resolving such a market would liquidate all positions in one block via the uncapped settle_market → force_close_positions backstop (block-time DoS). It does not: process_pm_markets §2d force-closes open positions once betting is over, and that sweep shares the single per-block done < cap budget, so ≤ cap positions close per block (test observed max 5 == cap) before the uncapped backstop is ever reached. Not a single-block DoS. This is a regression guard — if the §2d throttle is removed, closures would exceed cap and the test fails.

Verification

Built the full chain + consensus_sim_tests target locally and ran all three:

Running 3 test cases...
bad-debt-transfer: pos.status=1 cv=272727 loan=1000000 pool_received=272727 pool_free=9272727 supply_delta=3000 inflation=3000
profit-close: forfeit_pool=0 supply_delta=14427000 inflation=14427000 pool_free=10100000
sybil-settle: opened 12 positions; max closed in a single block = 5 (cap=5); all closed=true
*** No errors detected

Note (defense-in-depth suggestion, not blocking)

The Sybil surface is throttled for safety (no single-block DoS, no mint), but a large position flood still creates a liquidation backlog: N positions take ~N/cap blocks to drain, during which their collateral/loans sit in limbo. A per-account position cap or a minimum loan size would bound that backlog as defense-in-depth. Filed as a review comment on #124.