Scope bad debt to collateral generations

[KillariDev]

Summary

• Scope aggregate and per-vault bad debt to a monotonic collateral generation so exhausted claims cannot subsidize later collateral.
• Tag truth-auction debt with its finalization generation so late claims settle raw counters, REP, capacity, and fees without assigning expired debt.
• Consolidate generation-aware fork read tuples, update every current bot, simulator, UI, ABI, manifest, deployment, and documentation consumer, and preserve production size limits.
• Keep direct BAL-03 and AUC-06 documentation links visible below the sticky invariant explorer.

Exploit and impact

An underfunded liquidation could leave 25.225167308134521096 ETH of nominal bad debt after correct users redeemed the entire share claim supply and drained tracked collateral. The stale debt and residual nominal capacity survived into a fresh collateral cycle, allowing new collateral to enter an underbacked system.

A second path existed through delayed truth-auction claims: debt finalized in the exhausted generation could be assigned to a vault after a later generation started. That understated current open interest and could make subsequent vault migration underflow and become unavailable.

Fix

• Add badDebtGeneration and generation-tagged vault debt while preserving the original mapping value slot.
• Clear aggregate debt and increment the generation exactly when remaining share claims reach zero.
• Capture auctionBadDebtGeneration at finalization and assign auction debt only when it still matches the pool generation.
• Keep raw auction settlement counters deterministic even after effective debt expires.
• Expose raw debt plus its generation through consolidated fork tuples and update all live consumers.
• Refresh deterministic deployment pins, manifests, contract reference, invariant reference, and generated search/runtime artifacts.

Regression coverage

• New failing-first stale-debt exploit reproduction.
• Failing-first late-auction claim regression covering unrelated current-generation debt, raw event counters, zero expired vault debt, and zero effective unassigned debt.
• Tuple decoder, storage layout, event replay, deployment hash, UI protocol, and documentation runtime coverage.
• Failing-first desktop fragment regression for direct BAL-03 and AUC-06 navigation.

Validation

• bun run tsc
• Full suite: 3288 pass, 16 network-dependent pinned-Uniswap skips, 0 fail, 13317 assertions across 331 files
• bun run format:check
• bun run check
• bun run knip with only 10 pre-existing configuration hints
• bun run check:generated-clean
• Production limits: SecurityPool runtime 24553 / 24576; SecurityPoolForker initcode 49122 / 49152; forker runtime 24014 / 24576
• Desktop/mobile documentation QA with no console errors or page overflow
• Text review: 100; visual review: 100; final review: 100
• Branch current with origin/main; final diff checks clean