[umpireboulianne-design]

Summary

Implements per-feed and per-policyholder-per-feed underwriting exposure tracking and concentration caps in RefractBackstop, wired into RefractPool's policy sale, settlement, and expiry flows.

Closes #240

---

Changes

• Per-Feed & Per-Holder Exposure Ledger (backstop/src/lib.rs):
  • feed_exposure(env, feed): tracks active underwritten coverage per feed symbol.
  • holder_feed_exposure(env, holder, feed): tracks active underwritten coverage per (holder, feed) pair.
  • aggregate_feed_exposure(env) and tracked_feeds(env): maintain the aggregate exposure invariant across all tracked feeds.
• Governance/Admin Concentration Caps (backstop/src/lib.rs):
  • set_feed_cap(env, caller, feed, max_feed_coverage, max_feed_coverage_bps, max_holder_feed_coverage) and feed_cap(env, feed): configure absolute feed caps, relative caps in basis points of total_capital, and per-holder-per-feed caps.
  • Lowering a cap below active exposure preserves existing in-force policies while blocking new policy sales on that feed until exposure decays below the new cap.
• Policy Sale Enforcement & Idempotent Release (backstop/src/lib.rs, pool/src/lib.rs):
  • check_exposure_caps and record_policy_exposure: enforce configured caps prior to underwriting and record PolicyExposureRecord per policy_id.
  • release_policy_exposure: idempotent per policy_id so that concurrent or sequential settlement + expiry paths can never double-decrement feed or aggregate exposure.
  • Wired optional DataKey::Backstop in pool/src/lib.rs (set_backstop, backstop, PoolError::FeedCapExceeded) into buy_policy, process_claim, and expire_policy.
• Specification & Unit Tests (SPEC.md, backstop/src/test.rs):
  • Documented concentration-cap semantics and invariants in SPEC.md.
  • Added unit tests for cap boundary rejection/acceptance, relative bps and per-holder caps, idempotent double-release guard, cap-lowering below active exposure, and multi-feed sum invariant.

Checklist

• Zero unwrap(), expect(), or panic!() calls in non-test contract code
• Idempotent exposure release per policy_id
• SPEC.md updated and unit tests added