Lesson: repurposed-padding-byte bit-vector expansion is a Rule-38 hot-spot (Compound Comet, 2026-06-11)

Context

Rule-38 regression hunt on Compound Comet HEAD d5a30b0 (2026-05-29). Core absorb/buyCollateral, getPrice, CometRewards, and Market Admin all reflected remediated states. The single highest-EV candidate was the extended-asset-list feature (#904, 2025-03) that grew MAX_ASSETS from 15 to 24 by repurposing the previously-unused UserBasic._reserved padding byte as the bit-vector for asset offsets 16-23.

The pattern to flag (new heuristic)

When a protocol expands a packed bitmap / participation flag set beyond the width of its original storage word by RECRUITING a previously-unused padding field, the regression risk is NOT in the new arithmetic - it is in coverage + write-ordering consistency:

1. Coverage: does EVERY consumer loop read and pass the new word? A single loop left on the old N-bit-only accessor silently ignores high-offset entries. In a lending protocol that means under-counted collateral -> false-solvent borrows or skipped collateral in liquidation. Grep every call site of the accessor and confirm arity.
2. Write-ordering / memory-copy clobber: if any function does a full storageStruct = memoryCopy writeback (common in gas-optimized accounting), check it never runs AFTER a sibling function that wrote the new field directly to storage from the SAME load. The stale memory copy silently zeroes the freshly-set high bits. Map which paths write the bitmap directly vs which do full-struct writeback, and confirm they never interleave in clobbering order.
3. Reset symmetry: any place that zeroes the old word (e.g. liquidation assetsIn = 0) must also zero the new word. A missed reset leaves stale high-offset bits across the state transition.

Comet outcome

All three held: 3/3 loops pass _reserved; collateral paths (which call updateAssetsIn direct-write) never call updateBasePrincipal (the full-struct writeback) afterward; absorb resets both assetsIn and _reserved. WALK CLEAN.

Why this matters for the lane

This is a reusable Rule-38 trigger: "grep the repo for newly-recruited padding/_reserved/_gap fields that now carry semantic load." It is a precise, fast filter for the class of bug that audits of the ORIGINAL design could not have caught (the field was inert when they reviewed it) - exactly the post-audit-drift window Rule 38 targets. Add to the standard Comet-class / packed-storage-protocol checklist.

38.4-A application note

The routing-correctness question here is a pure-logic tautology, not a conserved-quantity behavioral test - so 38.4-A correctly says DO NOT write a Foundry pure-math test (it would just restate the source). The honest behavioral test would need a deployed market with >16 collateral assets (none exists), so the correct verdict is inspection-WALK-CLEAN, not a fabricated PASS.