`pokeRiskWindow()` cannot persist scope lock during `ATTACK_REQUESTED`, allowing scope mutation after a transient non-staging state

PM borrow liabilities are omitted from backing, allowing phantom surplus settlement

BuilderWallet `init()` is unprotected/re-initializable, enabling takeover and theft of builder fees

The unregistering of vaults can be DoSed by a malicious user.