@agoric/inter-protocol 0.13.3 → 0.13.4-dev-d32a66a.0

package/src/vaultFactory/vaultManager.js

@@ -1,5 +1,4 @@
 /* eslint-disable consistent-return */
-// @ts-check
 /**
  * @file Vault Manager object manages vault-based debts for a collateral type.
  *
@@ -12,45 +11,63 @@
  * Once a vault is settled (liquidated or closed) it can still be used, traded,
  * etc. but is no longer the concern of the manager. It can't be liquidated,
  * have interest charged, or be counted in the metrics.
+ *
+ * Undercollateralized vaults can have their assets sent to the auctioneer to be
+ * liquidated. If the auction is unsuccessful, the liquidation may be reverted.
  */
 import '@agoric/zoe/exported.js';
 
-import { AmountMath } from '@agoric/ertp';
-import { makeStoredPublishKit, observeNotifier } from '@agoric/notifier';
 import {
-  defineDurableKindMulti,
-  makeKindHandle,
+  AmountMath,
+  AmountShape,
+  BrandShape,
+  NotifierShape,
+  RatioShape,
+} from '@agoric/ertp';
+import { makeTracer } from '@agoric/internal';
+import { makeStoredNotifier, observeNotifier } from '@agoric/notifier';
+import { appendToStoredArray } from '@agoric/store/src/stores/store-utils.js';
+import {
+  M,
   makeScalarBigMapStore,
   makeScalarBigSetStore,
-  pickFacet,
+  prepareExoClassKit,
+  provide,
 } from '@agoric/vat-data';
+import { TransferPartShape } from '@agoric/zoe/src/contractSupport/atomicTransfer.js';
 import {
-  assertProposalShape,
+  atomicRearrange,
   ceilDivideBy,
+  ceilMultiplyBy,
   floorDivideBy,
+  floorMultiplyBy,
   getAmountIn,
   getAmountOut,
+  makeEphemeraProvider,
   makeRatio,
   makeRatioFromAmounts,
+  makeRecorderTopic,
+  multiplyRatios,
+  offerTo,
+  SubscriberShape,
+  TopicsRecordShape,
 } from '@agoric/zoe/src/contractSupport/index.js';
+import { PriceQuoteShape, SeatShape } from '@agoric/zoe/src/typeGuards.js';
 import { E } from '@endo/eventual-send';
-import { unitAmount } from '@agoric/zoe/src/contractSupport/priceQuote.js';
-import {
-  checkDebtLimit,
-  makeEphemeraProvider,
-  makeMetricsPublisherKit,
-} from '../contractSupport.js';
+import { AuctionPFShape } from '../auction/auctioneer.js';
+import { checkDebtLimit, makeNatAmountShape } from '../contractSupport.js';
 import { chargeInterest } from '../interest.js';
-import { makeTracer } from '../makeTracer.js';
-import { liquidate, makeQuote, updateQuote } from './liquidation.js';
+import { getLiquidatableVaults, liquidationResults } from './liquidation.js';
+import { calculateMinimumCollateralization, minimumPrice } from './math.js';
 import { makePrioritizedVaults } from './prioritizedVaults.js';
-import { makeVault, Phase } from './vault.js';
+import { Phase, prepareVault } from './vault.js';
 
-const { details: X } = assert;
+const { details: X, Fail } = assert;
 
 const trace = makeTracer('VM');
 
 /** @typedef {import('./storeUtils.js').NormalizedDebt} NormalizedDebt */
+/** @typedef {import('@agoric/time/src/types').RelativeTime} RelativeTime */
 
 // Metrics naming scheme: nouns are present values; past-participles are accumulative.
 /**
@@ -61,13 +78,16 @@ const trace = makeTracer('VM');
  * @property {Amount<'nat'>}  totalCollateral    present sum of collateral across all vaults
  * @property {Amount<'nat'>}  totalDebt          present sum of debt across all vaults
  * @property {Amount<'nat'>}  retainedCollateral collateral held as a result of not returning excess refunds
- *                                                from AMM to owners of vaults liquidated with shortfalls
+ *                                                to owners of vaults liquidated with shortfalls
+ * @property {Amount<'nat'>}  liquidatingCollateral  present sum of collateral in vaults sent for liquidation
+ * @property {Amount<'nat'>}  liquidatingDebt        present sum of debt in vaults sent for liquidation
  *
  * @property {Amount<'nat'>}  totalCollateralSold       running sum of collateral sold in liquidation
  * @property {Amount<'nat'>}  totalOverageReceived      running sum of overages, central received greater than debt
- * @property {Amount<'nat'>}  totalProceedsReceived     running sum of central received from liquidation
- * @property {Amount<'nat'>}  totalShortfallReceived    running sum of shortfalls, central received less than debt
- * @property {number}         numLiquidationsCompleted  running count of liquidations
+ * @property {Amount<'nat'>}  totalProceedsReceived     running sum of minted received from liquidation
+ * @property {Amount<'nat'>}  totalShortfallReceived    running sum of shortfalls, minted received less than debt
+ * @property {number}         numLiquidationsCompleted  running count of liquidated vaults
+ * @property {number}         numLiquidationsAborted    running count of vault liquidations that were reverted.
  */
 
 /**
@@ -75,7 +95,6 @@ const trace = makeTracer('VM');
  *  compoundedInterest: Ratio,
  *  interestRate: Ratio,
  *  latestInterestUpdate: Timestamp,
- *  liquidatorInstance?: Instance,
  * }} AssetState
  *
  * @typedef {{
@@ -83,914 +102,1276 @@ const trace = makeTracer('VM');
  *  getRecordingPeriod: () => RelativeTime,
  *  getDebtLimit: () => Amount<'nat'>,
  *  getInterestRate: () => Ratio,
+ *  getLiquidationPadding: () => Ratio,
  *  getLiquidationMargin: () => Ratio,
  *  getLiquidationPenalty: () => Ratio,
- *  getLoanFee: () => Ratio,
+ *  getMintFee: () => Ratio,
+ *  getMinInitialDebt: () => Amount<'nat'>,
  * }} GovernedParamGetters
  */
 
 /**
  * @typedef {Readonly<{
- * collateralBrand: Brand<'nat'>,
- * debtBrand: Brand<'nat'>,
- * debtMint: ZCFMint<'nat'>,
- * poolIncrementSeat: ZCFSeat,
- * retainedCollateralSeat: ZCFSeat,
- * unsettledVaults: MapStore<string, Vault>,
- * liquidatingVaults: SetStore<Vault>,
- * }>} ImmutableState
+ *   debtMint: ZCFMint<'nat'>,
+ *   collateralBrand: Brand<'nat'>,
+ *   collateralUnit: Amount<'nat'>,
+ *   descriptionScope: string,
+ *   startTimeStamp: Timestamp,
+ *   storageNode: StorageNode,
+ * }>} HeldParams
  */
 
 /**
  * @typedef {{
- * compoundedInterest: Ratio,
- * latestInterestUpdate: Timestamp,
- * liquidator?: Liquidator
- * liquidatorInstance?: Instance
- * numLiquidationsCompleted: number,
- * totalCollateral: Amount<'nat'>,
- * totalCollateralSold: Amount<'nat'>,
- * totalDebt: Amount<'nat'>,
- * totalOverageReceived: Amount<'nat'>,
- * totalProceedsReceived: Amount<'nat'>,
- * totalShortfallReceived: Amount<'nat'>,
- * vaultCounter: number,
- * }} MutableState
+ *   assetTopicKit: import('@agoric/zoe/src/contractSupport/recorder.js').RecorderKit<AssetState>,
+ *   debtBrand: Brand<'nat'>,
+ *   liquidatingVaults: SetStore<Vault>,
+ *   metricsTopicKit: import('@agoric/zoe/src/contractSupport/recorder.js').RecorderKit<MetricsNotification>,
+ *   poolIncrementSeat: ZCFSeat,
+ *   retainedCollateralSeat: ZCFSeat,
+ *   unsettledVaults: MapStore<string, Vault>,
+ * }} ImmutableState
  */
 
 /**
- * @typedef {Readonly<{
- *   state: ImmutableState & MutableState,
- *   facets: {
- *     collateral: import('@agoric/vat-data/src/types').KindFacet<typeof collateralBehavior>,
- *     helper: import('@agoric/vat-data/src/types').KindFacet<typeof helperBehavior>,
- *     manager: import('@agoric/vat-data/src/types').KindFacet<typeof managerBehavior>,
- *     self: import('@agoric/vat-data/src/types').KindFacet<typeof selfBehavior>,
- *   }
- * }>} MethodContext
+ * @typedef {{
+ *   compoundedInterest: Ratio,
+ *   latestInterestUpdate: Timestamp,
+ *   numLiquidationsCompleted: number,
+ *   numLiquidationsAborted: number,
+ *   totalCollateral: Amount<'nat'>,
+ *   totalCollateralSold: Amount<'nat'>,
+ *   totalDebt: Amount<'nat'>,
+ *   liquidatingCollateral: Amount<'nat'>,
+ *   liquidatingDebt: Amount<'nat'>,
+ *   totalOverageReceived: Amount<'nat'>,
+ *   totalProceedsReceived: Amount<'nat'>,
+ *   totalShortfallReceived: Amount<'nat'>,
+ *   vaultCounter: number,
+ *   lockedQuote: PriceQuote | undefined,
+ * }} MutableState
  */
 
+/** @param {Pick<PriceDescription, 'amountIn' | 'amountOut'>} quoteAmount */
+const quoteAsRatio = quoteAmount =>
+  makeRatioFromAmounts(quoteAmount.amountIn, quoteAmount.amountOut);
+
 /**
- * Ephemera are the elements of state that cannot (or need not) be durable.
- * When there's a single instance it can be held in a closure, but there are
- * many vault manaager objects. So we hold their ephemera keyed by the durable
- * vault manager.
- *
- * XXX However since we don't have the vault manager object during
- * initState when we hold values that need to go into ephemera, we key for now
- * using a proxy for the manager object, collateralBrand.
- *
- * @type {(collateralBrand: Brand) => Partial<{
- * assetSubscriber: Subscriber<AssetState>,
- * assetPublisher: Publisher<AssetState>,
- * factoryPowers: import('./vaultDirector.js').FactoryPowersFacet?,
- * liquidationQueueing: boolean,
- * outstandingQuote: Promise<MutableQuote>?,
- * marshaller: ERef<Marshaller>,
- * periodNotifier: ERef<Notifier<Timestamp>>,
- * priceAuthority: ERef<PriceAuthority>,
+ * @type {(brand: Brand) => {
  * prioritizedVaults: ReturnType<typeof makePrioritizedVaults>,
- * metricsPublication: IterationObserver<MetricsNotification>,
- * metricsSubscription: StoredSubscription<MetricsNotification>,
- * storageNode: ERef<StorageNode>,
- * zcf: import('./vaultFactory.js').VaultFactoryZCF,
- * }>} */
-const provideEphemera = makeEphemeraProvider(() => ({
-  liquidationQueueing: false,
-}));
+ * storedQuotesNotifier: import('@agoric/notifier').StoredNotifier<PriceQuote>,
+ * storedCollateralQuote: PriceQuote,
+ * }}
+ */
+// any b/c will be filled after start()
+const collateralEphemera = makeEphemeraProvider(() => /** @type {any} */ ({}));
 
 /**
- * Create state for the Vault Manager kind
- *
- * @param {import('./vaultFactory.js').VaultFactoryZCF} zcf
- * @param {ZCFMint<'nat'>} debtMint
- * @param {Brand} collateralBrand
- * @param {ERef<PriceAuthority>} priceAuthority
- * @param {import('./vaultDirector.js').FactoryPowersFacet} factoryPowers
- * @param {ERef<TimerService>} timerService
- * @param {Timestamp} startTimeStamp
- * @param {ERef<StorageNode>} storageNode
- * @param {ERef<Marshaller>} marshaller
+ * @param {import('@agoric/ertp').Baggage} baggage
+ * @param {{
+ *   zcf: import('./vaultFactory.js').VaultFactoryZCF,
+ *   marshaller: ERef<Marshaller>,
+ *   makeRecorderKit: import('@agoric/zoe/src/contractSupport/recorder.js').MakeRecorderKit,
+ *   makeERecorderKit: import('@agoric/zoe/src/contractSupport/recorder.js').MakeERecorderKit,
+ *   factoryPowers: import('./vaultDirector.js').FactoryPowersFacet,
+ * }} powers
  */
-const initState = (
-  zcf,
-  debtMint,
-  collateralBrand,
-  priceAuthority,
-  factoryPowers,
-  timerService,
-  startTimeStamp,
-  storageNode,
-  marshaller,
+export const prepareVaultManagerKit = (
+  baggage,
+  { zcf, marshaller, makeRecorderKit, factoryPowers },
 ) => {
-  assert(
-    storageNode && marshaller,
-    'VaultManager missing storageNode or marshaller',
-  );
+  const { priceAuthority, timerService, reservePublicFacet } = zcf.getTerms();
 
-  const periodNotifier = E(timerService).makeNotifier(
-    0n,
-    factoryPowers.getGovernedParams().getChargingPeriod(),
-  );
-
-  const debtBrand = debtMint.getIssuerRecord().brand;
-  const zeroCollateral = AmountMath.makeEmpty(collateralBrand, 'nat');
-  const zeroDebt = AmountMath.makeEmpty(debtBrand, 'nat');
-
-  const { metricsPublication, metricsSubscription } = makeMetricsPublisherKit(
-    storageNode,
-    marshaller,
-  );
-
-  /** @type {MapStore<string, Vault>} */
-  const unsettledVaults = makeScalarBigMapStore('orderedVaultStore', {
-    durable: true,
-  });
+  const makeVault = prepareVault(baggage, makeRecorderKit, zcf);
 
   /**
-   * If things are going well, the set will contain at most one Vault. Otherwise
-   * failures remain and are available to be repaired via contract upgrade.
-   *
-   * @type {SetStore<Vault>}
+   * @param {HeldParams & { metricsStorageNode: StorageNode }} params
+   * @returns {HeldParams & ImmutableState & MutableState}
    */
-  const liquidatingVaults = makeScalarBigSetStore('liquidatingVaults', {
-    durable: true,
-  });
-
-  /** @type {ImmutableState} */
-  const fixed = {
-    collateralBrand,
-    debtBrand,
-    debtMint,
-    poolIncrementSeat: zcf.makeEmptySeatKit().zcfSeat,
-    retainedCollateralSeat: zcf.makeEmptySeatKit().zcfSeat,
-    unsettledVaults,
-    liquidatingVaults,
-  };
+  const initState = params => {
+    const {
+      debtMint,
+      collateralBrand,
+      metricsStorageNode,
+      startTimeStamp,
+      storageNode,
+    } = params;
+    const debtBrand = debtMint.getIssuerRecord().brand;
+
+    /** @type {ImmutableState} */
+    const immutable = {
+      debtBrand,
+      poolIncrementSeat: zcf.makeEmptySeatKit().zcfSeat,
+
+      /**
+       * Vaults that have been sent for liquidation. When we get proceeds (or lack
+       * thereof) back from the liquidator, we will allocate them among the vaults.
+       *
+       * @type {SetStore<Vault>}
+       */
+      liquidatingVaults: makeScalarBigSetStore('liquidatingVaults', {
+        durable: true,
+      }),
 
-  const compoundedInterest = makeRatio(100n, fixed.debtBrand); // starts at 1.0, no interest
-  // timestamp of most recent update to interest
-  const latestInterestUpdate = startTimeStamp;
+      assetTopicKit: makeRecorderKit(storageNode),
 
-  /** @type {PublishKit<AssetState>} */
-  const { publisher: assetPublisher, subscriber: assetSubscriber } =
-    makeStoredPublishKit(storageNode, marshaller);
+      metricsTopicKit: makeRecorderKit(metricsStorageNode),
 
-  assetPublisher.publish(
-    harden({
-      compoundedInterest,
-      interestRate: factoryPowers.getGovernedParams().getInterestRate(),
-      latestInterestUpdate,
-    }),
-  );
+      // TODO(#7074) not used while liquidation is disabled. Reinstate with #7074
+      retainedCollateralSeat: zcf.makeEmptySeatKit().zcfSeat,
 
-  const ephemera = provideEphemera(collateralBrand);
-  Object.assign(ephemera, {
-    assetSubscriber,
-    assetPublisher,
-    factoryPowers,
-    marshaller,
-    metricsPublication,
-    metricsSubscription,
-    periodNotifier,
-    priceAuthority,
-    prioritizedVaults: makePrioritizedVaults(unsettledVaults),
-    storageNode,
-    zcf,
-  });
-
-  /** @type {MutableState & ImmutableState} */
-  const state = {
-    ...fixed,
-    compoundedInterest,
-    debtBrand: fixed.debtBrand,
-    latestInterestUpdate,
-    liquidator: undefined,
-    liquidatorInstance: undefined,
-    numLiquidationsCompleted: 0,
-    totalCollateral: zeroCollateral,
-    totalDebt: zeroDebt,
-    totalOverageReceived: zeroDebt,
-    totalProceedsReceived: zeroDebt,
-    totalCollateralSold: zeroCollateral,
-    totalShortfallReceived: zeroDebt,
-    vaultCounter: 0,
+      unsettledVaults: makeScalarBigMapStore('orderedVaultStore', {
+        durable: true,
+      }),
+    };
+
+    const zeroCollateral = AmountMath.makeEmpty(collateralBrand, 'nat');
+    const zeroDebt = AmountMath.makeEmpty(debtBrand, 'nat');
+
+    return harden({
+      ...params,
+      ...immutable,
+      compoundedInterest: makeRatio(100n, debtBrand), // starts at 1.0, no interest
+      latestInterestUpdate: startTimeStamp,
+      numLiquidationsCompleted: 0,
+      numLiquidationsAborted: 0,
+      totalCollateral: zeroCollateral,
+      totalCollateralSold: zeroCollateral,
+      totalDebt: zeroDebt,
+      liquidatingCollateral: zeroCollateral,
+      liquidatingDebt: zeroDebt,
+      totalOverageReceived: zeroDebt,
+      totalProceedsReceived: zeroDebt,
+      totalShortfallReceived: zeroDebt,
+      vaultCounter: 0,
+      lockedQuote: undefined,
+    });
   };
 
-  return state;
-};
-
-// Some of these could go in closures but are kept on a facet anticipating future durability options.
-const helperBehavior = {
-  /**
-   * @param {MethodContext} context
-   * @param {Timestamp} updateTime
-   * @param {ZCFSeat} poolIncrementSeat
-   */
-  chargeAllVaults: async ({ state, facets }, updateTime, poolIncrementSeat) => {
-    trace('chargeAllVaults', state.collateralBrand, {
-      updateTime,
-    });
-    const { factoryPowers } = provideEphemera(state.collateralBrand);
-    assert(factoryPowers);
+  const makeVaultManagerKitInternal = prepareExoClassKit(
+    baggage,
+    'VaultManagerKit',
+    {
+      collateral: M.interface('collateral', {
+        makeVaultInvitation: M.call().returns(M.promise()),
+        getSubscriber: M.call().returns(SubscriberShape),
+        getMetrics: M.call().returns(SubscriberShape),
+        getPublicTopics: M.call().returns(TopicsRecordShape),
+        getQuotes: M.call().returns(NotifierShape),
+        getCompoundedInterest: M.call().returns(RatioShape),
+      }),
+      helper: M.interface(
+        'helper',
+        // not exposed so sloppy okay
+        {},
+        { sloppy: true },
+      ),
+      manager: M.interface('manager', {
+        getGovernedParams: M.call().returns(M.remotable('governedParams')),
+        maxDebtFor: M.call(AmountShape).returns(AmountShape),
+        mintAndTransfer: M.call(
+          SeatShape,
+          AmountShape,
+          AmountShape,
+          M.arrayOf(TransferPartShape),
+        ).returns(),
+        burn: M.call(AmountShape, SeatShape).returns(),
+        getAssetSubscriber: M.call().returns(SubscriberShape),
+        getCollateralBrand: M.call().returns(BrandShape),
+        getDebtBrand: M.call().returns(BrandShape),
+        getCompoundedInterest: M.call().returns(RatioShape),
+        scopeDescription: M.call(M.string()).returns(M.string()),
+        handleBalanceChange: M.call(
+          AmountShape,
+          AmountShape,
+          M.string(),
+          M.string(),
+          M.remotable('vault'),
+        ).returns(),
+      }),
+      self: M.interface('self', {
+        getGovernedParams: M.call().returns(M.remotable('governedParams')),
+        makeVaultKit: M.call(SeatShape).returns(M.promise()),
+        getCollateralQuote: M.call().returns(PriceQuoteShape),
+        getPublicFacet: M.call().returns(M.remotable('publicFacet')),
+        lockOraclePrices: M.call().returns(PriceQuoteShape),
+        liquidateVaults: M.call(AuctionPFShape).returns(M.promise()),
+      }),
+    },
+    initState,
+    {
+      collateral: {
+        makeVaultInvitation() {
+          const { facets } = this;
+          const { collateralBrand, debtBrand } = this.state;
+          return zcf.makeInvitation(
+            seat => this.facets.self.makeVaultKit(seat),
+            facets.manager.scopeDescription('MakeVault'),
+            undefined,
+            M.splitRecord({
+              give: {
+                Collateral: makeNatAmountShape(collateralBrand),
+              },
+              want: {
+                Minted: makeNatAmountShape(debtBrand),
+              },
+            }),
+          );
+        },
+        /** @deprecated use getPublicTopics */
+        getSubscriber() {
+          return this.state.assetTopicKit.subscriber;
+        },
+        /** @deprecated use getPublicTopics */
+        getMetrics() {
+          return this.state.metricsTopicKit.subscriber;
+        },
+        getQuotes() {
+          const ephemera = collateralEphemera(this.state.collateralBrand);
+          return ephemera.storedQuotesNotifier;
+        },
+        getCompoundedInterest() {
+          return this.state.compoundedInterest;
+        },
+        getPublicTopics() {
+          const { assetTopicKit, metricsTopicKit } = this.state;
+          return harden({
+            asset: makeRecorderTopic(
+              'State of the assets managed',
+              assetTopicKit,
+            ),
+            metrics: makeRecorderTopic(
+              'Vault Factory metrics',
+              metricsTopicKit,
+            ),
+          });
+        },
+      },
 
-    const interestRate = factoryPowers.getGovernedParams().getInterestRate();
+      // Some of these could go in closures but are kept on a facet anticipating future durability options.
+      helper: {
+        /**
+         * Start non-durable processes (or restart if needed after vat restart)
+         */
+        start() {
+          const { state, facets } = this;
+          trace(state.collateralBrand, 'helper.start()', state.vaultCounter);
+          const {
+            collateralBrand,
+            collateralUnit,
+            debtBrand,
+            storageNode,
+            unsettledVaults,
+          } = state;
+
+          const ephemera = collateralEphemera(collateralBrand);
+          ephemera.prioritizedVaults = makePrioritizedVaults(unsettledVaults);
+
+          trace('helper.start() making periodNotifier');
+          const periodNotifier = E(timerService).makeNotifier(
+            0n,
+            factoryPowers
+              .getGovernedParams(collateralBrand)
+              .getChargingPeriod(),
+          );
 
-    // Update state with the results of charging interest
+          trace('helper.start() starting observe periodNotifier');
+          void observeNotifier(periodNotifier, {
+            updateState: updateTime =>
+              facets.helper
+                .chargeAllVaults(updateTime)
+                .catch(e =>
+                  console.error('🚨 vaultManager failed to charge interest', e),
+                ),
+            fail: reason => {
+              zcf.shutdownWithFailure(
+                assert.error(X`Unable to continue without a timer: ${reason}`),
+              );
+            },
+            finish: done => {
+              zcf.shutdownWithFailure(
+                assert.error(X`Unable to continue without a timer: ${done}`),
+              );
+            },
+          });
+
+          trace('helper.start() making quoteNotifier from', priceAuthority);
+          const quoteNotifier = E(priceAuthority).makeQuoteNotifier(
+            collateralUnit,
+            debtBrand,
+          );
+          ephemera.storedQuotesNotifier = makeStoredNotifier(
+            quoteNotifier,
+            E(storageNode).makeChildNode('quotes'),
+            marshaller,
+          );
+          trace('helper.start() awaiting observe storedQuotesNotifier');
+          // NB: upon restart, there may not be a price for a while. If manager
+          // operations are permitted, ones the depend on price information will
+          // throw. See https://github.com/Agoric/agoric-sdk/issues/4317
+          void observeNotifier(quoteNotifier, {
+            updateState(value) {
+              trace('vaultManager got new collateral quote', value);
+              ephemera.storedCollateralQuote = value;
+            },
+            fail(reason) {
+              console.error('quoteNotifier failed to iterate', reason);
+            },
+          });
+          trace('helper.start() done');
+        },
+        /**
+         * @param {Timestamp} updateTime
+         */
+        async chargeAllVaults(updateTime) {
+          const { state, facets } = this;
+          const { collateralBrand, debtMint, poolIncrementSeat } = state;
+          trace(collateralBrand, 'chargeAllVaults', {
+            updateTime,
+          });
+
+          const interestRate = factoryPowers
+            .getGovernedParams(collateralBrand)
+            .getInterestRate();
+
+          // Update state with the results of charging interest
+
+          const changes = chargeInterest(
+            {
+              mint: debtMint,
+              mintAndTransferWithFee: factoryPowers.mintAndTransfer,
+              poolIncrementSeat,
+              seatAllocationKeyword: 'Minted',
+            },
+            {
+              interestRate,
+              chargingPeriod: factoryPowers
+                .getGovernedParams(collateralBrand)
+                .getChargingPeriod(),
+              recordingPeriod: factoryPowers
+                .getGovernedParams(collateralBrand)
+                .getRecordingPeriod(),
+            },
+            {
+              latestInterestUpdate: state.latestInterestUpdate,
+              compoundedInterest: state.compoundedInterest,
+              totalDebt: state.totalDebt,
+            },
+            updateTime,
+          );
 
-    const changes = chargeInterest(
-      {
-        mint: state.debtMint,
-        mintAndReallocateWithFee: factoryPowers.mintAndReallocate,
-        poolIncrementSeat,
-        seatAllocationKeyword: 'Minted',
-      },
-      {
-        interestRate,
-        chargingPeriod: factoryPowers.getGovernedParams().getChargingPeriod(),
-        recordingPeriod: factoryPowers.getGovernedParams().getRecordingPeriod(),
-      },
-      {
-        latestInterestUpdate: state.latestInterestUpdate,
-        compoundedInterest: state.compoundedInterest,
-        totalDebt: state.totalDebt,
-      },
-      updateTime,
-    );
-
-    state.compoundedInterest = changes.compoundedInterest;
-    state.latestInterestUpdate = changes.latestInterestUpdate;
-    state.totalDebt = changes.totalDebt;
-
-    facets.helper.assetNotify();
-    trace('chargeAllVaults complete', state.collateralBrand);
-    // price to check against has changed
-    return facets.helper.reschedulePriceCheck();
-  },
-
-  /** @param {MethodContext} context */
-  assetNotify: ({ state }) => {
-    const ephemera = provideEphemera(state.collateralBrand);
-    assert(ephemera.factoryPowers && ephemera.assetPublisher);
-    const interestRate = ephemera.factoryPowers
-      .getGovernedParams()
-      .getInterestRate();
-    /** @type {AssetState} */
-    const payload = harden({
-      compoundedInterest: state.compoundedInterest,
-      interestRate,
-      latestInterestUpdate: state.latestInterestUpdate,
-      // NB: the liquidator is determined by governance but the resulting
-      // instance is a concern of the manager. The param manager knows only
-      // about the installation and terms of the liqudation contract. We could
-      // have another notifier for state downstream of governance changes, but
-      // that doesn't seem to be cost-effective.
-      liquidatorInstance: state.liquidatorInstance,
-    });
-    ephemera.assetPublisher.publish(payload);
-  },
-
-  /** @param {MethodContext} context */
-  updateMetrics: ({ state }) => {
-    const { metricsPublication, prioritizedVaults } = provideEphemera(
-      state.collateralBrand,
-    );
-    assert(metricsPublication && prioritizedVaults);
-
-    const retainedCollateral =
-      state.retainedCollateralSeat.getCurrentAllocation()?.Collateral ??
-      AmountMath.makeEmpty(state.collateralBrand, 'nat');
-    /** @type {MetricsNotification} */
-    const payload = harden({
-      numActiveVaults: prioritizedVaults.getCount(),
-      numLiquidatingVaults: state.liquidatingVaults.getSize(),
-      totalCollateral: state.totalCollateral,
-      totalDebt: state.totalDebt,
-      retainedCollateral,
-
-      numLiquidationsCompleted: state.numLiquidationsCompleted,
-      totalCollateralSold: state.totalCollateralSold,
-      totalOverageReceived: state.totalOverageReceived,
-      totalProceedsReceived: state.totalProceedsReceived,
-      totalShortfallReceived: state.totalShortfallReceived,
-    });
-    metricsPublication.updateState(payload);
-  },
+          state.compoundedInterest = changes.compoundedInterest;
+          state.latestInterestUpdate = changes.latestInterestUpdate;
+          state.totalDebt = changes.totalDebt;
+
+          return facets.helper.assetNotify();
+        },
+        assetNotify() {
+          const { state } = this;
+          const { collateralBrand, assetTopicKit } = state;
+          const interestRate = factoryPowers
+            .getGovernedParams(collateralBrand)
+            .getInterestRate();
+          /** @type {AssetState} */
+          const payload = harden({
+            compoundedInterest: state.compoundedInterest,
+            interestRate,
+            latestInterestUpdate: state.latestInterestUpdate,
+          });
+          return assetTopicKit.recorder.write(payload);
+        },
+        burnToCoverDebt(debt, proceeds, seat) {
+          const { state } = this;
+
+          if (AmountMath.isGTE(proceeds, debt)) {
+            factoryPowers.burnDebt(debt, seat);
+            state.totalDebt = AmountMath.subtract(state.totalDebt, debt);
+          } else {
+            factoryPowers.burnDebt(proceeds, seat);
+            state.totalDebt = AmountMath.subtract(state.totalDebt, proceeds);
+          }
+
+          state.totalProceedsReceived = AmountMath.add(
+            state.totalProceedsReceived,
+            proceeds,
+          );
+        },
+        sendToReserve(penalty, seat, seatKeyword = 'Collateral') {
+          const invitation =
+            E(reservePublicFacet).makeAddCollateralInvitation();
+
+          // don't wait for response
+          void E.when(invitation, invite => {
+            const proposal = { give: { Collateral: penalty } };
+            void offerTo(
+              zcf,
+              invite,
+              { [seatKeyword]: 'Collateral' },
+              proposal,
+              seat,
+            );
+          });
+        },
+        /** @type {(collatSold: Amount<'nat'>, completed: number, aborted?: number) => void} */
+        markCollateralLiquidated(collatSold, completed, aborted = 0) {
+          const { state } = this;
+
+          state.totalCollateral = AmountMath.subtract(
+            state.totalCollateral,
+            collatSold,
+          );
+          state.numLiquidationsCompleted += completed;
+          state.numLiquidationsAborted += aborted;
+        },
+        markLiquidating(debt, collateral) {
+          const { state } = this;
+
+          state.liquidatingCollateral = AmountMath.add(
+            state.liquidatingCollateral,
+            collateral,
+          );
 
-  /**
-   * When any Vault's debt ratio is higher than the current high-water level,
-   * call `reschedulePriceCheck()` to request a fresh notification from the
-   * priceAuthority. There will be extra outstanding requests since we can't
-   * cancel them. (https://github.com/Agoric/agoric-sdk/issues/2713).
-   *
-   * When the vault with the current highest debt ratio is removed or reduces
-   * its ratio, we won't reschedule the priceAuthority requests to reduce churn.
-   * Instead, when a priceQuote is received, we'll only reschedule if the
-   * high-water level when the request was made matches the current high-water
-   * level.
-   *
-   * @param {MethodContext} context
-   * @param {Ratio} [highestRatio]
-   * @returns {Promise<void>}
-   */
-  reschedulePriceCheck: async ({ state, facets }, highestRatio) => {
-    const { prioritizedVaults, ...ephemera } = provideEphemera(
-      state.collateralBrand,
-    );
-    assert(ephemera.factoryPowers && prioritizedVaults);
-    trace('reschedulePriceCheck', state.collateralBrand, ephemera);
-    // INTERLOCK: the first time through, start the activity to wait for
-    // and process liquidations over time.
-    if (!ephemera.liquidationQueueing) {
-      ephemera.liquidationQueueing = true;
-      // eslint-disable-next-line consistent-return
-      return facets.helper
-        .processLiquidations()
-        .catch(e => console.error('Liquidator failed', e))
-        .finally(() => {
-          ephemera.liquidationQueueing = false;
-        });
-    }
-
-    if (!ephemera.outstandingQuote) {
-      // the new threshold will be picked up by the next quote request
-      return;
-    }
-
-    const highestDebtRatio = highestRatio || prioritizedVaults.highestRatio();
-    if (!highestDebtRatio) {
-      // if there aren't any open vaults, we don't need an outstanding RFQ.
-      trace('no open vaults');
-      return;
-    }
-
-    // There is already an activity processing liquidations. It may be
-    // waiting for the oracle price to cross a threshold.
-    // Update the current in-progress quote.
-    const govParams = ephemera.factoryPowers.getGovernedParams();
-    const liquidationMargin = govParams.getLiquidationMargin();
-    // Safe to call extraneously (lightweight and idempotent)
-    updateQuote(ephemera.outstandingQuote, highestDebtRatio, liquidationMargin);
-    trace('update quote', state.collateralBrand, highestDebtRatio);
-  },
+          state.liquidatingDebt = AmountMath.add(state.liquidatingDebt, debt);
+        },
+        /**
+         *
+         * @param {Amount<'nat'>} debt
+         * @param {Amount<'nat'>} collateral
+         * @param {{ overage: Amount<'nat'>, shortfall: Amount<'nat'> }} accounting
+         */
+        markDoneLiquidating(debt, collateral, accounting) {
+          const { state } = this;
+
+          // update liquidation state
+
+          state.liquidatingCollateral = AmountMath.subtract(
+            state.liquidatingCollateral,
+            collateral,
+          );
+          state.liquidatingDebt = AmountMath.subtract(
+            state.liquidatingDebt,
+            debt,
+          );
 
-  /**
-   * @param {MethodContext} context
-   */
-  processLiquidations: async ({ state, facets }) => {
-    const { prioritizedVaults, ...ephemera } = provideEphemera(
-      state.collateralBrand,
-    );
-    assert(ephemera.factoryPowers && ephemera.priceAuthority);
-    const { priceAuthority } = ephemera;
-    const govParams = ephemera.factoryPowers.getGovernedParams();
-
-    async function* eventualLiquidations() {
-      assert(prioritizedVaults);
-      while (true) {
-        const highestDebtRatio = prioritizedVaults.highestRatio();
-        if (!highestDebtRatio) {
-          return;
-        }
-        const liquidationMargin = govParams.getLiquidationMargin();
-
-        // ask to be alerted when the price level falls enough that the vault
-        // with the highest debt to collateral ratio will no longer be valued at the
-        // liquidationMargin above its debt.
-        ephemera.outstandingQuote = makeQuote(
-          priceAuthority,
-          highestDebtRatio,
-          liquidationMargin,
-        );
-        trace('posted quote request', state.collateralBrand, highestDebtRatio);
-
-        // The rest of this method will not happen until after a quote is received.
-        // This may not happen until much later, when the market changes.
-        // eslint-disable-next-line no-await-in-loop
-        const quote = await E(ephemera.outstandingQuote).getPromise();
-        ephemera.outstandingQuote = null;
-        // When we receive a quote, we check whether the vault with the highest
-        // ratio of debt to collateral is below the liquidationMargin, and if so,
-        // we liquidate it. We use ceilDivide to round up because ratios above
-        // this will be liquidated.
-        const quoteRatioPlusMargin = makeRatioFromAmounts(
-          ceilDivideBy(getAmountOut(quote), liquidationMargin),
-          getAmountIn(quote),
-        );
-        trace('quote', state.collateralBrand, quote, quoteRatioPlusMargin);
-
-        // Liquidate the head of the queue
-        const [next] =
-          prioritizedVaults.entriesPrioritizedGTE(quoteRatioPlusMargin);
-        if (next) {
-          yield next;
-        }
-      }
-    }
-    for await (const next of eventualLiquidations()) {
-      await facets.helper.liquidateAndRemove(next);
-      trace('price check liq', state.collateralBrand, next && next[0]);
-    }
-  },
+          // record shortfall and proceeds
 
-  /**
-   * @param {MethodContext} context
-   * @param {[key: string, vaultKit: Vault]} record
-   */
-  liquidateAndRemove: ({ state, facets }, [key, vault]) => {
-    const { factoryPowers, prioritizedVaults, zcf } = provideEphemera(
-      state.collateralBrand,
-    );
-    assert(factoryPowers && prioritizedVaults && zcf);
-    const vaultSeat = vault.getVaultSeat();
-    trace('liquidating', state.collateralBrand, vaultSeat.getProposal());
-
-    const collateralPre = vault.getCollateralAmount();
-
-    // Start liquidation (vaultState: LIQUIDATING)
-    const liquidator = state.liquidator;
-    assert(liquidator);
-    state.liquidatingVaults.add(vault);
-    prioritizedVaults.removeVault(key);
-
-    return liquidate(
-      zcf,
-      vault,
-      liquidator,
-      state.collateralBrand,
-      factoryPowers.getGovernedParams().getLiquidationPenalty(),
-    )
-      .then(accounting => {
-        facets.manager.burnAndRecord(accounting.toBurn, vaultSeat);
-
-        // current values
-
-        // Sometimes, the AMM will sell less than all the collateral. If there
-        // was a shortfall, the investor doesn't keep the change, so we get it.
-        // If there was no shortfall, the collateral is returned.
-        const collateralPost = vault.getCollateralAmount();
-        if (
-          !AmountMath.isEmpty(collateralPost) &&
-          !AmountMath.isEmpty(accounting.shortfall)
-        ) {
-          // The borrower doesn't get the excess collateral remaining when
-          // liquidation results in a shortfall. We currently do nothing with
-          // it. We could hold it until it crosses some threshold, then sell it
-          // to the AMM, or we could transfer it to the reserve. At least it's
-          // visible in the accounting.
-          vaultSeat.decrementBy(
-            state.retainedCollateralSeat.incrementBy({
-              Collateral: collateralPost,
-            }),
+          const { overage, shortfall } = accounting;
+          // cumulative values
+          state.totalOverageReceived = AmountMath.add(
+            state.totalOverageReceived,
+            overage,
           );
-          zcf.reallocate(vaultSeat, state.retainedCollateralSeat);
-        }
-
-        // Reduce totalCollateral by collateralPre, since all the collateral was
-        // sold, returned to the vault owner, or held by the VaultManager.
-        state.totalCollateral = AmountMath.subtract(
-          state.totalCollateral,
-          collateralPre,
-        );
-        state.totalDebt = AmountMath.subtract(
-          state.totalDebt,
-          accounting.shortfall,
-        );
+          state.totalShortfallReceived = AmountMath.add(
+            state.totalShortfallReceived,
+            shortfall,
+          );
+          state.totalDebt = AmountMath.subtract(state.totalDebt, shortfall);
 
-        // cumulative values
-        state.totalProceedsReceived = AmountMath.add(
-          state.totalProceedsReceived,
-          accounting.proceeds,
-        );
-        state.totalOverageReceived = AmountMath.add(
-          state.totalOverageReceived,
-          accounting.overage,
-        );
-        state.totalShortfallReceived = AmountMath.add(
-          state.totalShortfallReceived,
-          accounting.shortfall,
-        );
-        state.liquidatingVaults.delete(vault);
-        trace('liquidated', state.collateralBrand);
-        state.numLiquidationsCompleted += 1;
-        facets.helper.updateMetrics();
-
-        if (!AmountMath.isEmpty(accounting.shortfall)) {
-          E(factoryPowers.getShortfallReporter())
-            .increaseLiquidationShortfall(accounting.shortfall)
-            .catch(reason =>
+          E.when(
+            factoryPowers.getShortfallReporter(),
+            reporter => E(reporter).increaseLiquidationShortfall(shortfall),
+            err =>
               console.error(
-                'liquidateAndRemove failed to increaseLiquidationShortfall',
-                reason,
+                '🛠️ getShortfallReporter() failed during liquidation; repair by updating governance',
+                err,
               ),
+          ).catch(err => {
+            console.error('🚨 failed to report liquidation shortfall', err);
+          });
+        },
+        /**
+         * If interest was charged between liquidating and liquidated, erase it.
+         *
+         * @param {Amount<'nat'>} priorDebtAmount
+         * @param {Amount<'nat'>} currentDebt
+         */
+        subtractPhantomInterest(priorDebtAmount, currentDebt) {
+          const { state } = this;
+          const difference = AmountMath.subtract(currentDebt, priorDebtAmount);
+
+          if (!AmountMath.isEmpty(difference)) {
+            state.totalDebt = AmountMath.subtract(state.totalDebt, difference);
+          }
+        },
+        markRestoreDebt(debt) {
+          const { state } = this;
+
+          state.totalDebt = AmountMath.add(state.totalDebt, debt);
+        },
+        writeMetrics() {
+          const { state } = this;
+          const { collateralBrand, retainedCollateralSeat, metricsTopicKit } =
+            state;
+          const { prioritizedVaults } = collateralEphemera(collateralBrand);
+
+          const retainedCollateral =
+            retainedCollateralSeat.getCurrentAllocation()?.Collateral ??
+            AmountMath.makeEmpty(collateralBrand, 'nat');
+
+          /** @type {MetricsNotification} */
+          const payload = harden({
+            numActiveVaults: prioritizedVaults.getCount(),
+            numLiquidatingVaults: state.liquidatingVaults.getSize(),
+            totalCollateral: state.totalCollateral,
+            totalDebt: state.totalDebt,
+            retainedCollateral,
+
+            numLiquidationsCompleted: state.numLiquidationsCompleted,
+            numLiquidationsAborted: state.numLiquidationsAborted,
+            totalCollateralSold: state.totalCollateralSold,
+            liquidatingCollateral: state.liquidatingCollateral,
+            liquidatingDebt: state.liquidatingDebt,
+            totalOverageReceived: state.totalOverageReceived,
+            totalProceedsReceived: state.totalProceedsReceived,
+            totalShortfallReceived: state.totalShortfallReceived,
+          });
+
+          return E(metricsTopicKit.recorder).write(payload);
+        },
+
+        distributeProceeds(
+          proceeds,
+          totalDebt,
+          oraclePriceAtStart,
+          liqSeat,
+          vaultData,
+          totalCollateral,
+        ) {
+          const { state, facets } = this;
+          const { collateralBrand, debtBrand, liquidatingVaults } = this.state;
+
+          const { Collateral: collateralProceeds } = proceeds;
+          /** @type {Amount<'nat'>} */
+          const collateralSold = AmountMath.subtract(
+            totalCollateral,
+            collateralProceeds,
+          );
+          state.totalCollateralSold = AmountMath.add(
+            state.totalCollateralSold,
+            collateralSold,
+          );
+
+          const mintedProceeds =
+            proceeds.Minted || AmountMath.makeEmpty(debtBrand);
+          const accounting = liquidationResults(totalDebt, mintedProceeds);
+
+          /** @type {Array<Vault>} */
+          const vaultsToLiquidate = [];
+          const liquidateAll = () => {
+            for (const vault of vaultsToLiquidate) {
+              vault.liquidated();
+              liquidatingVaults.delete(vault);
+            }
+          };
+
+          const penaltyRate = facets.self
+            .getGovernedParams()
+            .getLiquidationPenalty();
+          // charged in collateral
+          const totalPenalty = ceilMultiplyBy(
+            totalDebt,
+            multiplyRatios(
+              penaltyRate,
+              quoteAsRatio(oraclePriceAtStart.quoteAmount.value[0]),
+            ),
+          );
+
+          const price = makeRatioFromAmounts(mintedProceeds, collateralSold);
+          // Liquidation.md describes how to process liquidation proceeds
+          const bestToWorst = [...vaultData.entries()].reverse();
+          if (AmountMath.isEmpty(accounting.shortfall)) {
+            // Flow #1: no shortfall
+
+            const collateralToDistribute = AmountMath.isGTE(
+              collateralProceeds,
+              totalPenalty,
             );
-        }
-      })
-      .catch(e => {
-        // XXX should notify interested parties
-        console.error('liquidateAndRemove failed with', e);
-        throw e;
-      });
-  },
-};
 
-const managerBehavior = {
-  /** @param {MethodContext} context */
-  getGovernedParams: ({ state }) => {
-    const ephemera = provideEphemera(state.collateralBrand);
-    assert(ephemera.factoryPowers);
-    return ephemera.factoryPowers.getGovernedParams();
-  },
+            const distributableCollateral = collateralToDistribute
+              ? AmountMath.subtract(collateralProceeds, totalPenalty)
+              : AmountMath.makeEmptyFromAmount(collateralProceeds);
+
+            facets.helper.burnToCoverDebt(totalDebt, mintedProceeds, liqSeat);
+            facets.helper.sendToReserve(accounting.overage, liqSeat, 'Minted');
+
+            // return remaining funds to vaults before closing
+
+            /** @type {import('@agoric/zoe/src/contractSupport/atomicTransfer.js').TransferPart[]} */
+            const transfers = [];
+            let leftToStage = distributableCollateral;
+
+            // iterate from best to worst, returning collateral until it has
+            // been exhausted. Vaults after that get nothing.
+            for (const [vault, amounts] of bestToWorst) {
+              const { collateralAmount: vCollat, debtAmount } = amounts;
+              facets.helper.subtractPhantomInterest(
+                debtAmount,
+                vault.getCurrentDebt(),
+              );
+              const debtInCollateral = ceilDivideBy(debtAmount, price);
+              const collatPostDebt = AmountMath.isGTE(vCollat, debtInCollateral)
+                ? AmountMath.subtract(vCollat, debtInCollateral)
+                : AmountMath.makeEmptyFromAmount(vCollat);
+              if (!AmountMath.isEmpty(leftToStage)) {
+                const collat = AmountMath.min(leftToStage, collatPostDebt);
+                leftToStage = AmountMath.subtract(leftToStage, collat);
+                transfers.push([
+                  liqSeat,
+                  vault.getVaultSeat(),
+                  { Collateral: collat },
+                ]);
+              }
+              vaultsToLiquidate.push(vault);
+            }
+            if (transfers.length > 0) {
+              atomicRearrange(zcf, harden(transfers));
+            }
+
+            const forReserve = collateralToDistribute
+              ? AmountMath.add(leftToStage, totalPenalty)
+              : collateralProceeds;
+            facets.helper.sendToReserve(forReserve, liqSeat);
+
+            facets.helper.markCollateralLiquidated(
+              totalCollateral,
+              vaultData.getSize(),
+            );
 
-  /**
-   * @param {MethodContext} context
-   * @param {Amount<'nat'>} collateralAmount
-   */
-  maxDebtFor: async ({ state }, collateralAmount) => {
-    const { debtBrand } = state;
-    const { priceAuthority, ...ephemera } = provideEphemera(
-      state.collateralBrand,
-    );
-    assert(ephemera.factoryPowers && priceAuthority);
-    const quoteAmount = await E(priceAuthority).quoteGiven(
-      collateralAmount,
-      debtBrand,
-    );
-    // floorDivide because we want the debt ceiling lower
-    return floorDivideBy(
-      getAmountOut(quoteAmount),
-      ephemera.factoryPowers.getGovernedParams().getLiquidationMargin(),
-    );
-  },
-  /**
-   * TODO utility method to turn a callback into non-actual one
-   * was type {MintAndReallocate}
-   *
-   * @param {MethodContext} context
-   * @param {Amount} toMint
-   * @param {Amount} fee
-   * @param {ZCFSeat} seat
-   * @param {...ZCFSeat} otherSeats
-   * @returns {void}
-   */
-  mintAndReallocate: ({ state }, toMint, fee, seat, ...otherSeats) => {
-    const { totalDebt } = state;
-    const { factoryPowers } = provideEphemera(state.collateralBrand);
-    assert(factoryPowers);
-
-    checkDebtLimit(
-      factoryPowers.getGovernedParams().getDebtLimit(),
-      totalDebt,
-      toMint,
-    );
-    factoryPowers.mintAndReallocate(toMint, fee, seat, ...otherSeats);
-    state.totalDebt = AmountMath.add(state.totalDebt, toMint);
-  },
-  /**
-   * @param {MethodContext} context
-   * @param {Amount<'nat'>} toBurn
-   * @param {ZCFSeat} seat
-   */
-  burnAndRecord: ({ state }, toBurn, seat) => {
-    const { factoryPowers } = provideEphemera(state.collateralBrand);
-    assert(factoryPowers);
-    trace('burnAndRecord', state.collateralBrand, {
-      toBurn,
-      totalDebt: state.totalDebt,
-    });
-    const { burnDebt } = factoryPowers;
-    burnDebt(toBurn, seat);
-    state.totalDebt = AmountMath.subtract(state.totalDebt, toBurn);
-  },
-  /** @param {MethodContext} context */
-  getAssetSubscriber: ({ state }) => {
-    const { assetSubscriber } = provideEphemera(state.collateralBrand);
-    assert(assetSubscriber);
-    return assetSubscriber;
-  },
-  /** @param {MethodContext} context */
-  getCollateralBrand: ({ state }) => state.collateralBrand,
-  /** @param {MethodContext} context */
-  getDebtBrand: ({ state }) => state.debtBrand,
-  /**
-   * coefficient on existing debt to calculate new debt
-   *
-   * @param {MethodContext} context
-   */
-  getCompoundedInterest: ({ state }) => state.compoundedInterest,
-  /**
-   * Called by a vault when its balances change.
-   *
-   * @param {MethodContext} context
-   * @param {NormalizedDebt} oldDebtNormalized
-   * @param {Amount<'nat'>} oldCollateral
-   * @param {VaultId} vaultId
-   * @param {import('./vault.js').VaultPhase} vaultPhase at the end of whatever change updated balances
-   * @param {Vault} vault
-   */
-  handleBalanceChange: (
-    { state, facets },
-    oldDebtNormalized,
-    oldCollateral,
-    vaultId,
-    vaultPhase,
-    vault,
-  ) => {
-    const { prioritizedVaults } = provideEphemera(state.collateralBrand);
-    assert(prioritizedVaults);
-
-    // the manager holds only vaults that can accrue interest or be liquidated;
-    // i.e. vaults that have debt. The one exception is at the outset when
-    // a vault has been added to the manager but not yet accounted for.
-    const settled =
-      AmountMath.isEmpty(oldDebtNormalized) && vaultPhase !== Phase.ACTIVE;
-
-    if (settled) {
-      assert(
-        !prioritizedVaults.hasVaultByAttributes(
-          oldDebtNormalized,
-          oldCollateral,
-          vaultId,
-        ),
-        'Settled vaults must not be retained in storage',
-      );
-    } else {
-      const isNew = AmountMath.isEmpty(oldDebtNormalized);
-      if (!isNew) {
-        // its position in the queue is no longer valid
-
-        const vaultInStore = prioritizedVaults.removeVaultByAttributes(
+            facets.helper.markDoneLiquidating(
+              totalDebt,
+              totalCollateral,
+              accounting,
+            );
+          } else if (AmountMath.isEmpty(collateralProceeds)) {
+            // Flow #2a
+
+            // charge penalty if proceeds are sufficient
+            const penaltyInMinted = ceilMultiplyBy(totalDebt, penaltyRate);
+            const recoveredDebt = AmountMath.min(
+              AmountMath.add(totalDebt, penaltyInMinted),
+              mintedProceeds,
+            );
+
+            facets.helper.burnToCoverDebt(
+              recoveredDebt,
+              mintedProceeds,
+              liqSeat,
+            );
+
+            const coverDebt = AmountMath.isGTE(mintedProceeds, recoveredDebt);
+            const distributable = coverDebt
+              ? AmountMath.subtract(mintedProceeds, recoveredDebt)
+              : AmountMath.makeEmptyFromAmount(mintedProceeds);
+            let mintedRemaining = distributable;
+
+            const vaultPortion = makeRatioFromAmounts(
+              distributable,
+              totalCollateral,
+            );
+            /** @type {import('@agoric/zoe/src/contractSupport/atomicTransfer.js').TransferPart[]} */
+            const transfers = [];
+
+            // iterate from best to worst returning remaining funds to vaults
+            /** @type {Array<[Vault, { collateralAmount: Amount<'nat'>, debtAmount:  Amount<'nat'>}]>} */
+            for (const [vault, balance] of bestToWorst) {
+              // from best to worst, return minted above penalty if any remains
+              const { collateralAmount: vCollat, debtAmount } = balance;
+              const vaultShare = floorMultiplyBy(vCollat, vaultPortion);
+              facets.helper.subtractPhantomInterest(
+                debtAmount,
+                vault.getCurrentDebt(),
+              );
+
+              if (!AmountMath.isEmpty(mintedRemaining)) {
+                const mintedToReturn = AmountMath.isGTE(
+                  mintedRemaining,
+                  vaultShare,
+                )
+                  ? vaultShare
+                  : mintedRemaining;
+                mintedRemaining = AmountMath.subtract(
+                  mintedRemaining,
+                  mintedToReturn,
+                );
+                const seat = vault.getVaultSeat();
+                transfers.push([liqSeat, seat, { Minted: mintedToReturn }]);
+              }
+              vaultsToLiquidate.push(vault);
+            }
+
+            if (transfers.length > 0) {
+              atomicRearrange(zcf, harden(transfers));
+            }
+
+            facets.helper.markCollateralLiquidated(
+              totalCollateral,
+              vaultData.getSize(),
+            );
+
+            facets.helper.markDoneLiquidating(
+              totalDebt,
+              totalCollateral,
+              accounting,
+            );
+          } else {
+            // Flow #2b: There's unsold collateral; some vaults may be revived.
+
+            facets.helper.burnToCoverDebt(totalDebt, mintedProceeds, liqSeat);
+            facets.helper.sendToReserve(accounting.overage, liqSeat, 'Minted');
+
+            // reconstitute vaults until collateral is insufficient
+            let reconstituteVaults = AmountMath.isGTE(
+              collateralProceeds,
+              totalPenalty,
+            );
+
+            // charge penalty if proceeds are sufficient
+            const distributableCollateral = reconstituteVaults
+              ? AmountMath.subtract(collateralProceeds, totalPenalty)
+              : AmountMath.makeEmptyFromAmount(collateralProceeds);
+
+            let collatRemaining = distributableCollateral;
+            /** @type {import('@agoric/zoe/src/contractSupport/atomicTransfer.js').TransferPart[]} */
+            const transfers = [];
+            let liquidated = 0;
+            /** @type {Array<Vault>} */
+            const vaultsToReinstate = [];
+            const reinstateAll = () => {
+              const { prioritizedVaults } = collateralEphemera(collateralBrand);
+              for (const vault of vaultsToReinstate) {
+                const vaultId = vault.abortLiquidation();
+                prioritizedVaults.addVault(vaultId, vault);
+                liquidatingVaults.delete(vault);
+              }
+            };
+
+            let collateralReduction = AmountMath.makeEmpty(collateralBrand);
+            let shortfallToReserve = accounting.shortfall;
+            const debtPortion = makeRatioFromAmounts(totalPenalty, totalDebt);
+            const reduceCollateral = amount =>
+              (collateralReduction = AmountMath.add(
+                collateralReduction,
+                amount,
+              ));
+
+            // iterate from best to worst attempting to reconstitute, by
+            // returning remaining funds to vaults
+            /** @type {Array<[Vault, { collateralAmount: Amount<'nat'>, debtAmount:  Amount<'nat'>}]>} */
+            for (const [vault, balance] of bestToWorst) {
+              const { collateralAmount: vCollat, debtAmount } = balance;
+              const vaultPenalty = ceilMultiplyBy(debtAmount, penaltyRate);
+              const collatPostPenalty = AmountMath.subtract(
+                vCollat,
+                ceilMultiplyBy(vaultPenalty, debtPortion),
+              );
+              const vaultDebt = floorMultiplyBy(debtAmount, debtPortion);
+              if (
+                reconstituteVaults &&
+                !AmountMath.isEmpty(collatPostPenalty) &&
+                AmountMath.isGTE(collatRemaining, collatPostPenalty) &&
+                AmountMath.isGTE(totalDebt, debtAmount)
+              ) {
+                collatRemaining = AmountMath.subtract(
+                  collatRemaining,
+                  collatPostPenalty,
+                );
+                shortfallToReserve = AmountMath.isGTE(
+                  shortfallToReserve,
+                  debtAmount,
+                )
+                  ? AmountMath.subtract(shortfallToReserve, debtAmount)
+                  : AmountMath.makeEmptyFromAmount(shortfallToReserve);
+                const seat = vault.getVaultSeat();
+                // must reinstate after atomicRearrange(), so we record them.
+                vaultsToReinstate.push(vault);
+                reduceCollateral(vaultDebt);
+                transfers.push([
+                  liqSeat,
+                  seat,
+                  { Collateral: collatPostPenalty },
+                ]);
+              } else {
+                reconstituteVaults = false;
+                liquidated += 1;
+                facets.helper.subtractPhantomInterest(
+                  debtAmount,
+                  vault.getCurrentDebt(),
+                );
+
+                reduceCollateral(vCollat);
+                vaultsToLiquidate.push(vault);
+              }
+            }
+
+            // Putting all the rearrangements after the loop ensures that errors
+            // in the calculations don't result in paying pack some vaults and
+            // leaving others hanging.
+            if (transfers.length > 0) {
+              atomicRearrange(zcf, harden(transfers));
+            }
+            reinstateAll();
+
+            facets.helper.markCollateralLiquidated(
+              collateralReduction,
+              liquidated,
+              transfers.length,
+            );
+
+            facets.helper.sendToReserve(collatRemaining, liqSeat);
+            facets.helper.markDoneLiquidating(totalDebt, totalCollateral, {
+              ...accounting,
+              shortfall: shortfallToReserve,
+            });
+          }
+          liquidateAll();
+          return facets.helper.writeMetrics();
+        },
+      },
+
+      manager: {
+        getGovernedParams() {
+          const { collateralBrand } = this.state;
+          return factoryPowers.getGovernedParams(collateralBrand);
+        },
+
+        /**
+         * Look up the most recent price authority price to determine the max
+         * debt this manager config will allow for the collateral.
+         *
+         * @param {Amount<'nat'>} collateralAmount
+         */
+        maxDebtFor(collateralAmount) {
+          const { collateralBrand } = this.state;
+          const { storedCollateralQuote } = collateralEphemera(collateralBrand);
+          if (!storedCollateralQuote)
+            throw Fail`maxDebtFor called before a collateral quote was available`;
+          // use the lower price to prevent vault adjustments that put them imminently underwater
+          const collateralPrice = minimumPrice(
+            storedCollateralQuote,
+            this.state.lockedQuote,
+          );
+          const collatlVal = ceilMultiplyBy(collateralAmount, collateralPrice);
+          const minimumCollateralization = calculateMinimumCollateralization(
+            factoryPowers
+              .getGovernedParams(collateralBrand)
+              .getLiquidationMargin(),
+            factoryPowers
+              .getGovernedParams(collateralBrand)
+              .getLiquidationPadding(),
+          );
+          // floorDivide because we want the debt ceiling lower
+          return floorDivideBy(collatlVal, minimumCollateralization);
+        },
+        /** @type {MintAndTransfer} */
+        mintAndTransfer(mintReceiver, toMint, fee, transfers) {
+          const { state } = this;
+          const { collateralBrand, totalDebt } = state;
+
+          checkDebtLimit(
+            factoryPowers.getGovernedParams(collateralBrand).getDebtLimit(),
+            totalDebt,
+            toMint,
+          );
+          factoryPowers.mintAndTransfer(mintReceiver, toMint, fee, transfers);
+        },
+        /**
+         * @param {Amount<'nat'>} toBurn
+         * @param {ZCFSeat} seat
+         */
+        burn(toBurn, seat) {
+          const { state } = this;
+          const { collateralBrand } = this.state;
+
+          trace(collateralBrand, 'burn', {
+            toBurn,
+            totalDebt: state.totalDebt,
+          });
+          factoryPowers.burnDebt(toBurn, seat);
+        },
+        getAssetSubscriber() {
+          return this.state.assetTopicKit.subscriber;
+        },
+        getCollateralBrand() {
+          const { collateralBrand } = this.state;
+          return collateralBrand;
+        },
+        getDebtBrand() {
+          const { debtBrand } = this.state;
+          return debtBrand;
+        },
+        /**
+         * Prepend with an identifier of this vault manager
+         *
+         * @param {string} base
+         */
+        scopeDescription(base) {
+          const { descriptionScope } = this.state;
+          return `${descriptionScope}: ${base}`;
+        },
+        /**
+         * coefficient on existing debt to calculate new debt
+         */
+        getCompoundedInterest() {
+          return this.state.compoundedInterest;
+        },
+        /**
+         * Called by a vault when its balances change.
+         *
+         * @param {NormalizedDebt} oldDebtNormalized
+         * @param {Amount<'nat'>} oldCollateral
+         * @param {VaultId} vaultId
+         * @param {import('./vault.js').VaultPhase} vaultPhase at the end of whatever change updated balances
+         * @param {Vault} vault
+         * @returns {void}
+         */
+        handleBalanceChange(
           oldDebtNormalized,
           oldCollateral,
           vaultId,
-        );
-        assert(
-          vault === vaultInStore,
-          'handleBalanceChange for two different vaults',
-        );
-      }
-
-      // replace in queue, but only if it can accrue interest or be liquidated (i.e. has debt).
-      // getCurrentDebt() would also work (0x = 0) but require more computation.
-      if (!AmountMath.isEmpty(vault.getNormalizedDebt())) {
-        prioritizedVaults.addVault(vaultId, vault);
-      }
-
-      // totalCollateral += vault's collateral delta (post — pre)
-      state.totalCollateral = AmountMath.subtract(
-        AmountMath.add(state.totalCollateral, vault.getCollateralAmount()),
-        oldCollateral,
-      );
-      // debt accounting managed through minting and burning
-      facets.helper.updateMetrics();
-    }
-  },
-};
+          vaultPhase,
+          vault,
+        ) {
+          const { state, facets } = this;
+
+          // the manager holds only vaults that can accrue interest or be liquidated;
+          // i.e. vaults that have debt. The one exception is at the outset when
+          // a vault has been added to the manager but not yet accounted for.
+          const settled =
+            AmountMath.isEmpty(oldDebtNormalized) &&
+            vaultPhase !== Phase.ACTIVE;
+
+          trace('handleBalanceChange', {
+            oldDebtNormalized,
+            oldCollateral,
+            vaultId,
+            vaultPhase,
+            vault,
+            settled,
+          });
+
+          const { prioritizedVaults } = collateralEphemera(
+            state.collateralBrand,
+          );
+          if (settled) {
+            assert(
+              !prioritizedVaults.hasVaultByAttributes(
+                oldDebtNormalized,
+                oldCollateral,
+                vaultId,
+              ),
+              'Settled vaults must not be retained in storage',
+            );
+            return;
+          }
+
+          const isNew = AmountMath.isEmpty(oldDebtNormalized);
+          trace(state.collateralBrand, { isNew });
+          if (!isNew) {
+            // its position in the queue is no longer valid
+
+            const vaultInStore = prioritizedVaults.removeVaultByAttributes(
+              oldDebtNormalized,
+              oldCollateral,
+              vaultId,
+            );
+            assert(
+              vault === vaultInStore,
+              'handleBalanceChange for two different vaults',
+            );
+            trace('removed', vault, vaultId);
+          }
+
+          // replace in queue, but only if it can accrue interest or be liquidated (i.e. has debt).
+          // getCurrentDebt() would also work (0x = 0) but require more computation.
+          if (!AmountMath.isEmpty(vault.getNormalizedDebt())) {
+            prioritizedVaults.addVault(vaultId, vault);
+          }
+
+          // total += vault's delta (post — pre)
+          state.totalCollateral = AmountMath.subtract(
+            AmountMath.add(state.totalCollateral, vault.getCollateralAmount()),
+            oldCollateral,
+          );
+          state.totalDebt = AmountMath.subtract(
+            AmountMath.add(state.totalDebt, vault.getCurrentDebt()),
+            oldDebtNormalized,
+          );
+          void facets.helper.writeMetrics();
+        },
+      },
+      self: {
+        getGovernedParams() {
+          const { collateralBrand } = this.state;
+          return factoryPowers.getGovernedParams(collateralBrand);
+        },
+
+        /**
+         * @param {ZCFSeat} seat
+         */
+        async makeVaultKit(seat) {
+          const {
+            state,
+            facets: { manager },
+          } = this;
+          trace(state.collateralBrand, 'makeVaultKit');
+          const { storageNode } = this.state;
+          assert(marshaller, 'makeVaultKit missing marshaller');
+          assert(storageNode, 'makeVaultKit missing storageNode');
+          assert(zcf, 'makeVaultKit missing zcf');
+
+          const vaultId = String(state.vaultCounter);
+
+          // must be a presence to be stored in vault state
+          const vaultStorageNode = await E(
+            E(storageNode).makeChildNode(`vaults`),
+          ).makeChildNode(`vault${vaultId}`);
+
+          const { self: vault } = makeVault(manager, vaultId, vaultStorageNode);
+          trace(state.collateralBrand, 'makeVaultKit made vault', vault);
+
+          try {
+            // TODO `await` is allowed until the above ordering is fixed
+            // eslint-disable-next-line @jessie.js/no-nested-await
+            const vaultKit = await vault.initVaultKit(seat, vaultStorageNode);
+            // initVaultKit calls back to handleBalanceChange() which will add the
+            // vault to prioritizedVaults
+
+            // initVaultKit doesn't write to the storage node until it's returning
+            // so if it returned then we know the node key was consumed
+            state.vaultCounter += 1;
+
+            return vaultKit;
+          } catch (err) {
+            console.error(
+              'attempting recovery after initVaultKit failure',
+              err,
+            );
+            // ??? do we still need this cleanup? it won't get into the store unless it has collateral,
+            // which should qualify it to be in the store. If we drop this catch then the nested await
+            // for `vault.initVaultKit()` goes away.
+
+            // remove it from the store if it got in
+            /** @type {NormalizedDebt} */
+            // @ts-expect-error cast
+            const normalizedDebt = AmountMath.makeEmpty(state.debtBrand);
+            const collateralPre = seat.getCurrentAllocation().Collateral;
+            const { prioritizedVaults } = collateralEphemera(
+              state.collateralBrand,
+            );
+            try {
+              prioritizedVaults.removeVaultByAttributes(
+                normalizedDebt,
+                collateralPre,
+                vaultId,
+              );
+              console.warn(
+                'removed vault',
+                vaultId,
+                'after initVaultKit failure',
+              );
+            } catch {
+              console.info(
+                'vault',
+                vaultId,
+                'never stored during initVaultKit failure',
+              );
+            }
+            throw err;
+          } finally {
+            if (!seat.hasExited()) {
+              seat.exit();
+            }
+          }
+        },
+
+        getCollateralQuote() {
+          const { storedCollateralQuote } = collateralEphemera(
+            this.state.collateralBrand,
+          );
+          if (!storedCollateralQuote)
+            throw Fail`getCollateralQuote called before a collateral quote was available`;
+          return storedCollateralQuote;
+        },
+
+        getPublicFacet() {
+          return this.facets.collateral;
+        },
+
+        lockOraclePrices() {
+          const { state } = this;
+          const { storedCollateralQuote } = collateralEphemera(
+            state.collateralBrand,
+          );
+          if (!storedCollateralQuote)
+            throw Fail`lockOraclePrices called before a collateral quote was available`;
+          trace(
+            `lockPrice`,
+            getAmountIn(storedCollateralQuote),
+            getAmountOut(storedCollateralQuote),
+          );
 
-const collateralBehavior = {
-  /** @param {MethodContext} context */
-  makeVaultInvitation: ({ state, facets: { self } }) => {
-    const { zcf } = provideEphemera(state.collateralBrand);
-    assert(zcf);
-    return zcf.makeInvitation(seat => self.makeVaultKit(seat), 'MakeVault');
-  },
-  /** @param {MethodContext} context */
-  getSubscriber: ({ state }) => {
-    const { assetSubscriber } = provideEphemera(state.collateralBrand);
-    assert(assetSubscriber);
-    return assetSubscriber;
-  },
-  /** @param {MethodContext} context */
-  getMetrics: ({ state }) => {
-    const { metricsSubscription } = provideEphemera(state.collateralBrand);
-    assert(metricsSubscription);
-    return metricsSubscription;
-  },
-  /** @param {MethodContext} context */
-  getCompoundedInterest: ({ state }) => state.compoundedInterest,
-};
+          state.lockedQuote = storedCollateralQuote;
+          return storedCollateralQuote;
+        },
+        /**
+         * @param {AuctioneerPublicFacet} auctionPF
+         */
+        async liquidateVaults(auctionPF) {
+          const { state, facets } = this;
+          const { self, helper } = facets;
+          const {
+            collateralBrand,
+            compoundedInterest,
+            debtBrand,
+            liquidatingVaults,
+            lockedQuote,
+          } = state;
+          trace(collateralBrand, 'considering liquidation');
+
+          const { prioritizedVaults } = collateralEphemera(collateralBrand);
+          assert(factoryPowers && prioritizedVaults && zcf);
+          lockedQuote ||
+            Fail`Must have locked a quote before liquidating vaults.`;
+          assert(lockedQuote); // redundant with previous line
+
+          const liqMargin = self.getGovernedParams().getLiquidationMargin();
+
+          const { totalDebt, totalCollateral, vaultData, liqSeat } =
+            getLiquidatableVaults(
+              zcf,
+              {
+                quote: lockedQuote,
+                interest: compoundedInterest,
+                margin: liqMargin,
+              },
+              prioritizedVaults,
+              liquidatingVaults,
+              debtBrand,
+              collateralBrand,
+            );
+          // reset lockedQuote after we've used it for the liquidation decision
+          state.lockedQuote = undefined;
+
+          if (vaultData.getSize() === 0) {
+            return;
+          }
+          trace(
+            ' Found vaults to liquidate',
+            liquidatingVaults.getSize(),
+            totalCollateral,
+          );
 
-const selfBehavior = {
-  /** @param {MethodContext} context */
-  getGovernedParams: ({ state }) => {
-    const { factoryPowers } = provideEphemera(state.collateralBrand);
-    assert(factoryPowers);
-    return factoryPowers.getGovernedParams();
-  },
+          helper.markLiquidating(totalDebt, totalCollateral);
+          void helper.writeMetrics();
+
+          const { userSeatPromise, deposited } = await E.when(
+            E(auctionPF).makeDepositInvitation(),
+            depositInvitation =>
+              offerTo(
+                zcf,
+                depositInvitation,
+                harden({ Minted: 'Bid' }),
+                harden({ give: { Collateral: totalCollateral } }),
+                liqSeat,
+                liqSeat,
+                { goal: totalDebt },
+              ),
+          );
 
-  /**
-   * In extreme situations, system health may require liquidating all vaults.
-   * This starts the liquidations all in parallel.
-   *
-   * @param {MethodContext} context
-   */
-  liquidateAll: async ({ state, facets: { helper } }) => {
-    const { prioritizedVaults } = provideEphemera(state.collateralBrand);
-    assert(prioritizedVaults);
-    const toLiquidate = Array.from(prioritizedVaults.entries()).map(entry =>
-      helper.liquidateAndRemove(entry),
-    );
-    await Promise.all(toLiquidate);
-  },
+          // This is expected to wait for the duration of the auction, which
+          // is controlled by the auction parameters startFrequency, clockStep,
+          // and the difference between startingRate and lowestRate.
+          const [proceeds] = await Promise.all([deposited, userSeatPromise]);
 
-  /**
-   * @param {MethodContext} context
-   * @param {ZCFSeat} seat
-   */
-  makeVaultKit: async ({ state, facets: { manager } }, seat) => {
-    const { marshaller, prioritizedVaults, storageNode, zcf } = provideEphemera(
-      state.collateralBrand,
-    );
-    assert(marshaller, 'makeVaultKit missing marshaller');
-    assert(prioritizedVaults, 'makeVaultKit missing prioritizedVaults');
-    assert(storageNode, 'makeVaultKit missing storageNode');
-    assert(zcf, 'makeVaultKit missing zcf');
-    assertProposalShape(seat, {
-      give: { Collateral: null },
-      want: { Minted: null },
-    });
+          const { storedCollateralQuote } = collateralEphemera(
+            this.state.collateralBrand,
+          );
 
-    state.vaultCounter += 1;
-    const vaultId = String(state.vaultCounter);
-
-    const vaultStorageNode = E(
-      E(storageNode).makeChildNode(`vaults`),
-    ).makeChildNode(`vault${vaultId}`);
-
-    const vault = makeVault(
-      zcf,
-      manager,
-      vaultId,
-      vaultStorageNode,
-      marshaller,
-    );
-
-    try {
-      // TODO `await` is allowed until the above ordering is fixed
-      // eslint-disable-next-line @jessie.js/no-nested-await
-      const vaultKit = await vault.initVaultKit(
-        seat,
-        vaultStorageNode,
-        marshaller,
-      );
-      // initVaultKit calls back to handleBalanceChange() which will add the
-      // vault to prioritizedVaults
-      seat.exit();
-      return vaultKit;
-    } catch (err) {
-      // ??? do we still need this cleanup? it won't get into the store unless it has collateral,
-      // which should qualify it to be in the store. If we drop this catch then the nested await
-      // for `vault.initVaultKit()` goes away.
-
-      // remove it from the store if it got in
-      /** @type {NormalizedDebt} */
-      // @ts-expect-error cast
-      const normalizedDebt = AmountMath.makeEmpty(state.debtBrand);
-      const collateralPre = seat.getCurrentAllocation().Collateral;
-      try {
-        prioritizedVaults.removeVaultByAttributes(
-          normalizedDebt,
-          collateralPre,
-          vaultId,
-        );
-        console.error('removed vault', vaultId, 'after initVaultKit failure');
-      } catch {
-        console.error(
-          'vault',
-          vaultId,
-          'never stored during initVaultKit failure',
-        );
-      }
-      throw err;
-    }
-  },
+          trace(`LiqV after long wait`, proceeds);
+          return helper.distributeProceeds(
+            proceeds,
+            totalDebt,
+            storedCollateralQuote,
+            liqSeat,
+            vaultData,
+            totalCollateral,
+          );
+        },
+      },
+    },
 
-  /**
-   *
-   * @param {MethodContext} param
-   * @param {Installation} liquidationInstall
-   * @param {object} liquidationTerms
-   */
-  setupLiquidator: async (
-    { state, facets },
-    liquidationInstall,
-    liquidationTerms,
-  ) => {
-    const { zcf } = provideEphemera(state.collateralBrand);
-    assert(zcf);
-    const { debtBrand, collateralBrand } = state;
-    const { ammPublicFacet, priceAuthority, reservePublicFacet, timerService } =
-      zcf.getTerms();
-    const zoe = zcf.getZoeService();
-    const collateralIssuer = zcf.getIssuerForBrand(collateralBrand);
-    const debtIssuer = zcf.getIssuerForBrand(debtBrand);
-    trace('setup liquidator', state.collateralBrand, {
-      debtBrand,
-      debtIssuer,
-      collateralBrand,
-      liquidationTerms,
-    });
-    const { creatorFacet, instance } = await E(zoe).startInstance(
-      liquidationInstall,
-      harden({ Minted: debtIssuer, Collateral: collateralIssuer }),
-      harden({
-        ...liquidationTerms,
-        amm: ammPublicFacet,
-        debtBrand,
-        reservePublicFacet,
-        priceAuthority,
-        timerService,
-      }),
-    );
-    trace('setup liquidator complete', state.collateralBrand, {
-      instance,
-      old: state.liquidatorInstance,
-      equal: state.liquidatorInstance === instance,
-    });
-    state.liquidatorInstance = instance;
-    state.liquidator = creatorFacet;
-    facets.helper.assetNotify();
-  },
-
-  /** @param {MethodContext} context */
-  getCollateralQuote: async ({ state }) => {
-    const { priceAuthority } = provideEphemera(state.collateralBrand);
-    assert(priceAuthority);
-
-    const { debtBrand } = state;
-    // get a quote for one unit of the collateral
-    const collateralUnit = await unitAmount(state.collateralBrand);
-    return E(priceAuthority).quoteGiven(collateralUnit, debtBrand);
-  },
-
-  /** @param {MethodContext} context */
-  getPublicFacet: ({ facets }) => facets.collateral,
-};
+    {
+      finish: ({ state, facets: { helper } }) => {
+        helper.start();
+        void state.assetTopicKit.recorder.write(
+          harden({
+            compoundedInterest: state.compoundedInterest,
+            interestRate: factoryPowers
+              .getGovernedParams(state.collateralBrand)
+              .getInterestRate(),
+            latestInterestUpdate: state.latestInterestUpdate,
+          }),
+        );
 
-/** @param {MethodContext} context */
-const finish = ({ state, facets: { helper } }) => {
-  const { periodNotifier, prioritizedVaults, zcf } = provideEphemera(
-    state.collateralBrand,
-  );
-  assert(periodNotifier && prioritizedVaults && zcf);
-
-  prioritizedVaults.onHigherHighest(() => helper.reschedulePriceCheck());
-
-  // push initial state of metrics
-  helper.updateMetrics();
-
-  void observeNotifier(periodNotifier, {
-    updateState: updateTime =>
-      helper
-        .chargeAllVaults(updateTime, state.poolIncrementSeat)
-        .catch(e =>
-          console.error('🚨 vaultManager failed to charge interest', e),
-        ),
-    fail: reason => {
-      zcf.shutdownWithFailure(
-        assert.error(X`Unable to continue without a timer: ${reason}`),
-      );
-    },
-    finish: done => {
-      zcf.shutdownWithFailure(
-        assert.error(X`Unable to continue without a timer: ${done}`),
-      );
+        // push initial state of metrics
+        void helper.writeMetrics();
+      },
     },
-  });
-};
+  );
 
-const behavior = {
-  collateral: collateralBehavior,
-  helper: helperBehavior,
-  manager: managerBehavior,
-  self: selfBehavior,
+  /** @param {Omit<Parameters<typeof makeVaultManagerKitInternal>[0], 'metricsStorageNode'>} externalParams */
+  const makeVaultManagerKit = async externalParams => {
+    const metricsStorageNode = await E(
+      externalParams.storageNode,
+    ).makeChildNode('metrics');
+    return makeVaultManagerKitInternal({
+      ...externalParams,
+      metricsStorageNode,
+    });
+  };
+  return makeVaultManagerKit;
 };
 
-const makeVaultManagerKit = defineDurableKindMulti(
-  makeKindHandle('VaultManagerKit'),
-  initState,
-  behavior,
-  {
-    finish,
-  },
-);
-
 /**
+ * @typedef {Awaited<ReturnType<ReturnType<typeof prepareVaultManagerKit>>>} VaultManagerKit
+ */
+/**
+ * @typedef {VaultManagerKit['self']} VaultManager
  * Each VaultManager manages a single collateral type.
  *
- * It manages some number of outstanding loans, each called a Vault, for which
- * the collateral is provided in exchange for borrowed Minted.
+ * It manages some number of outstanding debt positions, each called a Vault,
+ * for which the collateral is provided in exchange for borrowed Minted.
+ */
+/** @typedef {VaultManagerKit['collateral']} CollateralManager */
+
+/**
+ * Support restarting kits from baggage and mutating the array holding them
  *
- * @param {ZCF} zcf
- * @param {ZCFMint<'nat'>} debtMint
- * @param {Brand} collateralBrand
- * @param {ERef<PriceAuthority>} priceAuthority
- * @param {import('./vaultDirector.js').FactoryPowersFacet} factoryPowers
- * @param {ERef<TimerService>} timerService
- * @param {Timestamp} startTimeStamp
+ * @param {import('@agoric/vat-data').Baggage} baggage
  */
-export const makeVaultManager = pickFacet(makeVaultManagerKit, 'self');
+export const provideAndStartVaultManagerKits = baggage => {
+  trace('provideAndStartVaultManagerKits start');
+  const key = 'vaultManagerKits';
+
+  const noKits = /** @type {VaultManagerKit[]} */ (harden([]));
 
-/** @typedef {ReturnType<typeof makeVaultManagerKit>['manager']} VaultKitManager */
-/** @typedef {ReturnType<typeof makeVaultManager>} VaultManager */
-/** @typedef {ReturnType<VaultManager['getPublicFacet']>} CollateralManager */
+  for (const kit of provide(baggage, key, () => noKits)) {
+    kit.helper.start();
+  }
+
+  trace('provideAndStartVaultManagerKits returning');
+  return {
+    /** @type {(kit: VaultManagerKit) => void} */
+    add: kit => {
+      appendToStoredArray(baggage, key, kit);
+    },
+    /** @type {(index: number) => VaultManagerKit} */
+    get: index => {
+      const kits = baggage.get(key);
+      index < kits.length || Fail`no VaultManagerKit at index ${index}`;
+      return kits[index];
+    },
+    length: () => baggage.get(key).length,
+  };
+};
+harden(provideAndStartVaultManagerKits);