Contract Architecture Diagram

Owner: withdrawReserves, capped by both reserves and cash, and any pause flag set or cleared
Guardian: setPauseFlags may only add flags; clearing one reverts GuardianCannotUnpause
renounceOwnership() always reverts, so a guardian pause can always be lifted
No parameter setters anywhere; the rate model and the oracle have no owner

Health-reducing calls are payable and carry a Pyth priceUpdate; the market forwards the unspent msg.value once for the base and once per collateral held
The oracle keeps the Pyth fee and refunds the rest; the market refunds the caller at the end
Any failed check reverts: zero price, stale price, wide confidence, stale anchor or Pyth to Chainlink deviation
Borrow capacity uses price − conf, absorb eligibility price + conf, and debt is valued at base price + conf

One signed int104 principal per account: positive is supply, negative is debt; withdrawing past zero is the only way to borrow
Every base balance change goes through _updateBasePrincipal; supply, withdraw, transfer, absorb, buyCollateral and withdrawReserves accrue first
Reserves = cash + total borrow − total supply, never stored; seized inventory = balanceOf − totalsCollateral

absorb: seizes all collateral and credits its mid-price value × liquidationFactor against the debt; a surplus is credited as supply, a shortfall is bad debt against reserves
buyCollateral: sells seized inventory only while reserves are below TARGET_RESERVES
Buyer discount = storeFrontPriceFactor × (1 − liquidationFactor), never above the absorb penalty