docs(quoter-bot): add loan-as-collateral markets tib

[julien-devatom]

Why

Loan-as-collateral markets (loan asset in the market's collateral list — e.g. a USDC / cbBTC+USDC market) are the protocol-intended maker pattern for quoting both sides from zero inventory: instead of bootstrapping credit at negative carry, the maker posts the loan asset as collateral and lets sells create debt. TIB-2026-07-27 §3 explicitly reserved the position-health check as mandatory "before any strategy revision can increase collateralized debt" — this TIB is that revision, deciding the design before any code lands.

What

• TIB-2026-08-27-quoter-loan-as-collateral-markets.md (new): the decision. Core points, each grounded in the pinned vendored Midnight source (336b924a):
  • a maturity-safe collateral-coverage invariant — debt is static face units and isHealthy has no time term, so collateral sized per publication for the worst case (current debt + every live sell cap converted at its tick price) makes pre-maturity liquidation impossible even if the bot halts; monitoring becomes a tripwire, not a control loop;
  • opt-in per-market debt config block; absent block = byte-for-byte today's behavior;
  • single non-reduce-only sell side (protocol take-netting consumes credit before minting debt; buys repay debt first — the built-in deleveraging channel), with the debt mode carried in quote identity so a config flip forces replace;
  • fail-closed qualification: loan asset in collateralParams, constant-oracle bytecode pinning (price() == 1e36), per-cycle enterGate.canIncreaseDebt recheck, disclosed maxLif settlement-penalty bound; the market ID content-addresses all params, so allowlisting is the acceptance boundary;
  • manual-first collateral management (bot never moves collateral in phases 1–2; auto-supply in phase 3 behind policy assertions and middleware intents; withdrawal automation excluded — the protocol health-checks withdrawCollateral against current debt only, never resting sells);
  • penalty-free LLTV = 1 maturity settlement (post-maturity liquidation at LIF = 1 is the settlement mechanism; repay + withdrawCollateral is the voluntary runbook);
  • breach posture (freeze sells, keep quoting buys), bootstrap obsolescence (start must accept an empty bootstrap list), five considered alternatives, phased delivery, and open questions (Morpho API takeability for collateral-backed sells; quoter-signer intent schedule).
• TIB-2026-07-27: second partial-supersession note + header row, scoped to debt-enabled markets only (§7 no-unintended-debt invariant, Security "No negative credit", position-health not-required).
• docs/INDEX.md: new entry in the bot-scoped TIB list.

Reviewer notes

Docs-only; no code changes. Every L… reference cites docs/context/repos/midnight-contracts.txt and was verified against it, including the 336b924a delta note (deployed supplyCollateral reverts on oracle revert). pnpm format has been run.

🤖 Generated with Claude Code

---

Review round 1 (codex)

All five inline findings were incorporated into the TIB: §3 sums sell-side units (credit + debt headroom) and converts once to seller assets at the worst-case tick; §5 pins every coverage input (debt, collateral, on-chain consumed) to one block and bans the eventually consistent API as a coverage input; §2/§6 fail readiness when the debt block is removed while on-chain debt is outstanding; §10 requires the signing middleware to mirror its buy-side aggregate-reservation model for debt capacity; §9 makes maturity settlement an actionable operator runbook, since LIF = 1 gives third parties no incentive to settle. The branch also merged main (TIB-2026-08-25's parallel partial supersession of TIB-2026-07-27, kept alongside this one in date order).

Review round 2 (haydenshively)

All four findings incorporated: a durable debt-market registry makes the obligation survive whole-market removal (readiness fails until a pinned-block debt == 0 read clears it, groups still cancellable, maturity alerts keyed off the registry); the breach transition is now a dedicated make-port operation — one native multicall cancelling all owned lower-side groups, buys untouched, stay-in-breach retry on an unconfirmed batch; over-cap debt (debt > maximumDebtUnits after a cap reduction or out-of-band activity) is an explicit breach state reported distinctly by position-health, never silent zero headroom — with one noted deviation: a coherent over-cap config starts into breach posture instead of hard-failing readiness, preserving the deleveraging channel; and the cap is renamed maximumDebtUnits with the §1 requirement expressed as an explicit mulDivUp chain plus tiny-value/uint128 test vectors.

Review round 3 (haydenshively)

Registry lifecycle made atomic with sell ownership — entry written in the same durable ownership-state write as any debt-capable reservation, GC gated on both no-remaining-debt-capable-reservation and a pinned-block debt == 0 read ordered after confirmed cancellations — and breach redefined as a side-scoped reconciliation mode: sell-freeze retried to confirmation, then higher-side-only generation/recenter/resize replenishing filled or stale buys every breached cycle, never publishing a lower-side group and never invoking the generic hard-halt path.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 126bffeb2c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[linear-code]

MKT-2150