ERC4626AdapterLib

Reverts ProtocolAdapterUnauthorized unless the caller is the wired operator. Placed at the very top of deploy/withdraw/harvest — BEFORE the reentrancy guard — so an unauthorized call never leaves the guard latched. Zero operator ⇒ always reverts.

Idle leg (NAV-gap fix): adds the adapter's idle underlying balance to the share-priced position. IVaultCore.allocateToStrategy pushes funds here with a bare transfer that does NOT deposit into the target vault, so undeployed funds sit idle until deploy() (and shares can be 0 while idle is non-zero — exactly the allocate-before- deploy state). Counting that idle keeps the vault's share price flat across the allocate→deploy window. No double-count: the idle is in neither the vault's idle nor the target shares, and after deploy() idle→~0 while shares grow by the same value, so the sum is invariant across deploy.

Rejects the asset and the target vault's share token: harvest forwards the side token's whole balance raw, so either would move the position itself to the reward recipient.

Idle first: totalAssetsManaged counts idle, so a recall that only unwound the position would under-deliver whenever funds sit undeployed. The remainder is withdrawn by assets through withdraw, which rounds shares up and delivers the exact amount at any price per share (a convertToShares + redeem pair floors twice). Above maxWithdraw every redeemable share is redeemed instead, and the return value reports what was actually sent.