[Audit M-01] A stale exit-queue head permanently exhausts the 64-tranche cap

[hmzakhalid]

Finding

Severity: Medium

Confirmed against baseline commit d4277510d. Fully drained tranches remained counted behind a stale queue head, so repeated bond/exit cycles could permanently hit the 64-tranche limit.

Full audit report

Required remediation

Advance and compact drained exit tranches so completed entries release capacity while preserving withdrawal accounting.

The dedicated fixing commit and remediation PR will be linked in a follow-up comment.

[hmzakhalid]

Fixed by commit d959729f79dfea3ae596158514e5ff8ca85853c5 in PR #1727.

[hmzakhalid]

Supersedes the earlier remediation reference after the cleanup of PR #1727. Fixed by commit 429be93 (M-01): drained exit tranches release live capacity.

[hmzakhalid]

Confirmed fixed by 79ba4e8 and hardened in 9954584. Drained tails are pruned, per-asset heads remain safe, live-tranche counts cannot be bypassed by reviving an empty tail, and repeated drain/reuse no longer grows scanned history without bound.

[hmzakhalid]

Final remediation in PR #1727: 79ba4e8 releases drained queue capacity, 9954584 counts revived tails, 9021c9f bounds the physical scan span and restores asset heads safely, and 66e3f49 keeps that fix lint-clean without changing behavior.