Review complete. The findings file at the repository root holds 7 findings, all anchored to verified lines, with one Foundry proof.

Verdict. No loss-of-funds, reentrancy, accounting or access-control defect reproduced in the contracts as they arrived. Nothing in src/ needs to change for correctness. What I did find are conflicts with the launch recipe (proxies, post-deployment wiring) and three owner-misconfiguration hazards that one-shot setters make permanent. No source file was modified; my only writes are .imd-findings.json and the scratch test under test/scratch/, which is not kept.

Findings written

• Medium, proxies. Every plain collection and every ARTIFACTS edition is an EIP-1167 clone whose runtime byte 31 is DELEGATECALL (src/libs/Clones.sol:11). The protected opcode scan passes only because it inspects the eight launched runtimes, not what they create. Proof attached: two tests that run the floor's own scan over a created collection and a claimed edition, both failing now. The non-proxy alternative already exists in the repo (the byte copy used for THE SOURCE) at roughly 5M gas per claim. That is a scope decision for the requester.
• Medium, post-deployment wiring. Seven owner calls are needed before anything works, four of them irreversible (ArtStorage.setHouse, setBrokerPass, setBuybackBurner, setClaimsOpenAt). The brief acknowledges this, so it is reported as the policy conflict the reference asks for, with the circular dependencies that make some of it hard to move into constructors spelled out.
• Low. ArtifactsPiece.initialize is open on any fresh clone, so anyone can make a counterfeit "ARTIFACTS #001" reporting the real factory as controller. No fund path trusts it (the ledger checks isPiece, BrokerPass and SubmissionReviews resolve via the factory).
• Low. isEligibleBroker calls balanceOf on the once-set pass address with no try/catch. A wrong address makes every sale naming an unapproved broker revert forever, including THE SOURCE's settle.
• Low. HolderGate.isMember accepts any return of at least 32 bytes, so a selector returning a string admits every wallet into the holders window, and the gate is frozen once the sale opens.
• Info. ArtHouse's constructor deploys a ninth unlisted contract; owner powers to carry as trust assumptions (sale pausing, split changes at settlement time, module revocation).

Checked and clean. launch.json has exactly the three schema keys, 8 contracts in dependency order, argument counts matching each constructor, notes of 1,260 chars. The seats, IMD and member addresses all have code on mainnet (seats is an ERC-721 named "identity.md"). Two-step ownership with no renounce on every owned contract; $owner in each constructor; no SELFDESTRUCT or CALLCODE anywhere. All runtimes under EIP-170 (largest ArtifactsPiece, 236 bytes under). Self-brokering by pass holders is a documented perk, not a defect. Ledger conservation, escrow conservation, Fisher-Yates bounds, fallback-draw ordering and the VRF re-request path all traced correctly.

Coverage. Read in full: all 10 contracts in src/, the 4 base contracts, 4 libraries, interfaces, launch.json, the deploy script wiring, README. KeyProof's curve arithmetic was read but not independently re-derived; I relied on the repo's audit tests for it. Tests run: sources compile in 38 s; my scratch proof; the repo's test/audit (6 pass) and test/invariants (4 pass). I did not re-run the full 215-test suite: compiling the whole test tree under via_ir exceeded 6 GB and 10 minutes on this machine, and the fork tests need an RPC. ImdBuybackBurner is outside this launch and was not reviewed.

Implemented fixes for NFT proxies, initialization access, BrokerPass failures, membership validation, and opcode-scan compatibility. Every change and audit disposition is documented in ADAPTATION.md.

Validation with the required seed:

• forge build: passed.
• forge test: 245 passed, zero failed.
• Two fork suites skipped because FORK_URL was unset.

Full-copy editions now cost approximately 4.9M gas for code deposit alone.

I found two problems in the edition draw in ArtifactsFactory. No source or config file was changed. The results are in .imd-findings.json, and the one test I wrote is in test/scratch/ (git shows no changes).

Launch manifest. launch.json deploys the eight contracts in the stated order. Each constructor gets the right number of arguments, in the right order, and every owner argument is $owner. No finding there.

Findings

1. Medium: a buyer can choose between two random draws (src/ArtifactsFactory.sol:416). If Chainlink doesn't answer a purchase for about 3 days (for example because the VRF subscription ran dry), the buyer can do this in one block:

1. Call rerequestRandomness on the old request. This is allowed by then, and it creates a fresh request that Chainlink still holds.
2. Call startFallbackDraw on the new request. It only checks the original purchase block and Chainlink's last answer, not whether Chainlink still holds this request.

Five blocks later the fallback block's hash is public, so the buyer knows which edition the fallback would give. If they don't like it, they leave the draw unfinished, and Chainlink's late answer still assigns an edition, because rawFulfillRandomWords doesn't check for a started fallback. It also works the other way: if the buyer sees a Chainlink answer they dislike coming in, they finish the fallback first. Either way they pick the better of two editions. The code comments say this cannot happen.

I proved it with test/scratch/FallbackChoice.t.sol. It fails on the current code: the fallback would have given edition 217, the buyer passed, and the late Chainlink answer assigned 218. Two possible fixes:

• refuse to start a fallback while Chainlink still holds the request; or
• reject a Chainlink answer once a fallback for that request has started.

2. Low: an abandoned fallback can delay a buyer's edition for a long time (src/ArtifactsFactory.sol:377). If a fallback draw is started but nobody finishes it within about 8,191 blocks (~27 hours), its block hash is no longer readable.

• Re-requesting is blocked for good. finishFallbackDraw is the only thing that clears the fallback marker, and it now reverts, so rerequestRandomness reverts forever even though the draw is dead.
• Restarting the fallback has to wait. startFallbackDraw waits until Chainlink has answered nothing for 3 days, and every answer to another buyer resets that clock.

So while the sale is live and Chainlink is working, this buyer's paid edition can stay unassigned indefinitely. The fix is to block re-requests only while a fallback is still live, and clear the marker when re-requesting. This one has no test; it is traced through the code only.

Leads I ruled out

• Buyers naming themselves as broker: the existing tests document it as an intended Broker Pass perk.
• Unsafe payment to an arbitrary address in ArtHouse._pay: it only pays the artist's payout address, the owner, or the burner, all of which are fixed by the contract's own rules.
• Weak randomness in _assign: the only real weakness is finding 1.
• Re-entering ArtifactsPiece.release: the escrow is cleared and the token moved to the buyer before the ledger is called.
• Key-proof maths in KeyProof: I traced it and it holds (a key that opens can't be proven fake).

Coverage

The coverage section has a row for each of the 114 listed entry points, plus two rows for invariants I checked. The four ImdBuybackBurner entry points are marked unreached: that contract isn't in this launch, and I spent the time on the eight that are. I read every other contract's source and traced its entry points.

Updated launch.json: corrected the notes to Sepolia and removed extra deployment/setup instructions. All eight contract entries match the compiled ABIs and remain unchanged.

forge build passed. Tests with the required fuzz seed: 232 passed, 0 failed, 2 fork suites skipped because no fork URL was configured.

Only launch.json changed.

The review is complete. No source file was changed. Git shows a clean tree apart from the ignored findings file and the scratch test.

What I audited. The Math Precision, Boundary and Numerical Gap guides, applied to all eight launch contracts plus ImdBuybackBurner. I traced every division and basis-point split in the ledger and the resale escrow, the 5% raise rounding in the auction, the lazy Fisher-Yates in the VRF callback and fallback draw, every narrowing cast, SSTORE2's creation-code layout, base64 encoding, the ecrecover-based Chaum-Pedersen and Schnorr checks in KeyProof, the Uniswap v4 BalanceDelta unpacking, and every payable function's msg.value relationship. The arithmetic is conservative and value is conserved on every path, including the catch branch of release().

Findings written to .imd-findings.json (two findings, 115 coverage rows covering all 112 listed entry points plus three invariants):

• Medium, with proof. HolderGate's try/catch around balanceOf and ownerOf does not catch calls to an address with no code: the empty return data fails ABI decoding in the caller and that revert is not caught. The contract's own NatSpec promises a gate contract that cannot answer "counts as not held". With a mistyped or code-less gate token, every buy and buyMany on ArtifactsFactory reverts for the whole holders window, even for legitimate members, and setGate is locked once the sale has opened so the curator cannot repair it. The same root cause blocks every bidder on ArtifactsSource if the seats address has no code, though that one is correctable before the first bid. The scratch test fails in all three cases on the current code and passes once the three gate views return false for a code-less target, which I confirmed in a throwaway copy.
• Info, no proof. sealCollection loops over a piece count the approved artist grows without bound, so a collection with more than roughly 14,000 registered pieces can never be sealed. Impact is confined to that artist's own collection.

Not reached or outside my lenses. Access control, economic incentives such as a buyer naming themselves as broker, and the randomness trust model were noted but belong to other specialists. I did not run the full 215-test suite or the fork tests, only the scratch proof.

Review complete. The findings file is written and validated, and every one of the 112 listed entry points has a coverage row.

Outcome. No permission bypass, escalation path, broken initializer or asymmetric guard was found in the assigned area. The ownership model is sound: two-step everywhere, no renounce, implementations locked in their constructors, clones created and initialised atomically, callbacks bound to the coordinator and pool manager, and the owner can never reduce or redirect artist, broker or buyback balances. Self-brokering by pass holders is a documented perk, not a defect. The launch manifest matches every constructor in order and argument count. All 232 non-fork tests pass on this tree.

One finding, severity low. THE SOURCE's settlement re-reads the sale-module flag at settle time, while only the opening check is fenced by auction state. The curator can call setSaleModule(source,false) after bids, which makes every call to settle revert, locks the winner's bid until the 7-day grace ends, and then forces a void so the artist's sale is lost. This is an owner power rather than a bypass, but it is not listed in the README's trust assumptions, and the comment on setAuction promises the winning bid can always settle. A scratch test under test/scratch/ reproduces the blocked state. Nothing was changed in the repository.

Coverage. All Access Control, Trust Gap and Asymmetry checks were applied across every contract, including the escrow state machine, HolderGate, BrokerPass claims, VRF retry and fallback paths, and the buyback burner. Fork tests were not run. KeyProof's elliptic-curve arithmetic and the SVG and base64 encoders were read only for access relevance, not for mathematical correctness, which belongs to another specialist.

Added three invariant suites plus failure-path, boundary, and fuzz tests for buybacks, pass claims, and reviews.

Only test/ changed; contracts and configuration remain untouched.

Validation: forge build passed. Full tests with the required seed: 244 passed, 0 failed, 2 RPC-dependent fork suites skipped.

The review is complete. The findings file is written and validated, the scratch test directory is removed, and the working tree has no stray files.

Outcome. No critical, high or medium economic defect was found in the launch set. The ledger split, the resale escrow, the auction and the VRF assignment conserve value on every path I traced. The findings file holds four entries: two low, two informational.

Findings written to .imd-findings.json

• Low, holders-first gate is a bare balanceOf. The token path of the holders window in both ArtifactsFactory and ArtifactsSource admits whoever holds the minimum IMD at call time. One balance handed between wallets, or borrowed inside a single transaction, lets non-holders buy during the window and lets one actor exceed the phase caps. Reproduced with a scratch Foundry test on this tree: six editions bought in the two-per-wallet phase with one 10 IMD balance, and a contract that borrows IMD, buys two, and returns it in one call. No ETH is lost; the allocation fairness the window exists for is what breaks.
• Low, public buyback swap minimum is the caller's own. After 60 idle days anyone swaps 0.05 ETH with any nonzero minimum, so each daily public swap is a sandwich opportunity worth up to about 0.05 ETH to the sandwicher. The README accepts the bound. I recorded the economics because the leak repeats daily until the balance is gone, and the burner is outside the eight launched contracts, so it can be fixed before setBuybackBurner.
• Info, allowanceOf diverges from the buy path. The view reports an allowance for non-holders during the window and for paused sales.
• Info, an unfinished fallback draw can be restarted. If nobody finishes a fallback draw within about 8,191 blocks its hash expires and the buyer may restart it to re-roll. Only reachable after three days of Chainlink silence, and the README relies on the house keeper.

Coverage. All 117 listed entry points have a row, 113 marked holds with a one-line reason, 4 marked finding. Five extra rows record the invariants I checked: ETH and IMD conservation in ArtHouse, escrow conservation in ArtifactsPiece, auction conservation in ArtifactsSource, the assigned-at-most-sold-at-most-255 bound, and the launch.json manifest, whose constructor arguments match each constructor in order.

Not reached in depth. The KeyProof cryptography behind proveFakeKey and knowsWrap, and the renderer and seal encoding, are outside the economics area and were only checked for how their outcomes move funds.

No source files were changed. The code can be deployed as it is from this commit; the two low findings are design tradeoffs the author should confirm rather than blockers.

Review complete. The findings file holds 10 findings and a full 112-row coverage record, with every snippet verified byte-for-byte against the tree and both attached proofs confirmed to fail on this code.

What I kept from the specialists, after reproducing each

• Medium, fallback vs. VRF race (src/ArtifactsFactory.sol:430). After 21,600 blocks of Chainlink silence a buyer can re-request and start a fallback draw on the fresh id in one block. The coordinator still holds that id, so a VRF answer can land after the fallback hash is public, and the buyer picks whichever edition they prefer. The specialist's proof fails on this tree, so it carries that proof.
• Medium, code-less gate address (src/base/HolderGate.sol:81). A gate token or seats address with no code makes every gated buy or bid revert instead of counting as not held, because try/catch does not catch the return-data decoding failure. The factory's gate is locked once the sale opens, so only endSale gets out. The specialist's three proof tests fail on this tree.
• Low, dead fallback blocks re-request forever (src/ArtifactsFactory.sol:377). I wrote my own scratch test and confirmed the stuck state: once a started draw's hash expires, the buyer and curator cannot re-request, and restarting waits until Chainlink has been silent for 3 days.
• Low, owner can strand THE SOURCE auction by revoking the module after bids. Reproduced by trace and recorded as a trust gap.
• Low, public burnEth sandwich repeats daily while the curator is idle. Kept, noting the burner is outside this launch's 8 contracts.
• Four info items: fallback restart re-roll after the hash expires, point-in-time balance gate, allowanceOf mismatch, and the unbounded sealCollection loop. I downgraded the balance-passing item to info because it is the documented semantics.

New finding of my own, low. The manifest passes the mainnet IMD address and the mainnet seats address while its notes, the README and the deploy script describe a Sepolia deployment. On Sepolia both addresses have no code and the README's own Sepolia IMD address does. If the pinned policy chain is Sepolia, mintWithIMD, claimWithSeat and reviewAsSeat are dead and the holders-gate misconfiguration above becomes the default. The pinned chain is not in front of me, so I named the evidence needed rather than asserting which side is wrong.

Coverage. All 112 entry points answered: 95 hold, 17 point at a finding, none unreached. The burner entry points the first specialist could not verify were traced and hold. No source files were changed. The protected launch tests could not run here because they import a floor/ helper absent from the tree, so deployability rests on the size check I ran (ArtifactsPiece is 191 bytes under the runtime limit) rather than on those tests.

The responses file is at the repository root and is excluded from git by the harness's own .git/info/exclude entry, which is the intended place for it. Nothing remains to request.

Recap

Both reopened findings reproduced on the starting tree (their proofs failed) and are fixed. Both proofs now pass, the full suite passes with the verifier's fuzz seed, and only the two contracts that needed to change have different runtime code.

Changes made

• src/ArtifactsFactory.sol: a fallback draw can no longer start on a request the coordinator still holds and that is younger than the retry window, so a buyer cannot hold a known fallback result against a later Chainlink answer. Once a started draw's block is behind us, the VRF callback refuses that request and only the fallback finish assigns it. The re-request path now refuses only a live draw and clears a dead one, which closes the advisory liveness gap where a buyer was stranded until Chainlink had been silent for three days.
• src/base/HolderGate.sol: the three holder checks read balanceOf and ownerOf through a bounded raw static call that accepts exactly one return word. A gate address with no code, a revert, or a malformed answer counts as not held, so members still buy and everyone else gets the documented NotEligible error.
• test/NothingStuck.t.sol: one test asserted the reported defect (a fallback on a request under a day old that Chainlink still held) and now expects the refusal. A new test covers the case where the coordinator answered with a failed callback.
• test/ReviewRound4.t.sol: eleven regression tests. Nine fail on the previous source and the two that assert unchanged behaviour pass there.
• README.md and ADAPTATION.md: fallback rules, the gate's code-less behaviour, the module-revocation trust assumption, and a round-4 record with verification details.
• .imd-responses.json: answers for all nine findings. Three are marked fixed. Six advisory ones are disputed with reasons, mainly that they describe documented owner powers or design semantics the brief does not ask to change, or a contract this launch does not deploy.

Verification

Check	Result
Supplied proofs (run from test/scratch)	4 of 4 pass
forge build	passes
forge test with the verifier's seed	244 passed, 0 failed, 2 skipped (fork suites needing an RPC URL)
Runtime hashes vs previous source	only ArtifactsFactory and ArtifactsSource differ

No build configuration, dependency, manifest or constructor changed. Nothing was committed, matching the previous round where the harness made the commit.

The finding reproduced and is fixed in launch.json. Only that file changed, and the responses file answers the reviewer.

What I verified

• The pinned launch chain is Sepolia. On Sepolia the mainnet IMD address and the seats address both return no code; the address the README and deploy script name as Sepolia IMD has code and reports name "Identity.md (test)", symbol IMD, 18 decimals.
• The earlier accepted Sepolia launch manifest in git history (commit e865714) already used that Sepolia IMD address, so this is the source's own value, not one I chose.

What changed in launch.json

• ArtHouse's third constructor argument is now the Sepolia IMD, 0x44a1cd38474fb1748400e7deb5f8d786cce3f89a. With the mainnet address, the immutable imd would have made mintWithIMD revert forever on this chain.
• The notes now state which IMD is used and why, and explain the seats situation.

What I left alone, and why

• The seats address stays at the mainnet identity.md seat collection. No Sepolia seat contract is named by the brief, the source, ADAPTATION.md, the manifest's git history, or anything public, and inventing one is forbidden. On Sepolia the seat-only paths in BrokerPass and SubmissionReviews are inert, every piece-holder path works, and the owner-set holders gate tolerates a code-less seats address. The notes say so.
• No source file, README, or deploy script changed, so every deployed runtime is byte-for-byte the accepted build.

Checks

• Manifest schema validated locally: exactly kind, contracts, notes; 8 unique names in dependency order; every argument a static word, $owner, or a backward contract reference; notes under 2,000 characters.
• forge build passes. forge test with the verifier's fuzz seed: 244 passed, 0 failed, 2 skipped. The two skipped are the fork tests, which need a FORK_URL.

The response to the finding is recorded in .imd-responses.json with verdict "fixed" and the evidence above. If identity.md later publishes a Sepolia seat collection, that address belongs in the BrokerPass and SubmissionReviews arguments.

I added a stateful test suite for the edition draw's recovery paths and found one low-severity defect, which I reported instead of writing a test that passes over it. No application code, configuration or launch.json was changed, so every contract's runtime code is the same as at this commit.

Checks: forge build passes. Full forge test with the verifier's seed: 259 passed, 0 failed, 2 skipped. The two skipped are the mainnet fork suites, which need an RPC URL. Those runs against the real pool and the real Chainlink coordinator are still owed.

Why this suite: after my last round, another contributor changed how ArtifactsFactory handles the fallback draw (the backup draw used when Chainlink never answers). The existing factory invariant test never exercised that path.

New file: test/invariants/FallbackDrawInvariant.t.sol

• What it does at random: buys; Chainlink answers, including ones whose callback runs out of gas and late answers to replaced request ids; re-requests by the buyer, the curator and strangers; fallback draws started and finished by anyone; and large block jumps (past 256, 7,500, 8,191 and 21,600 blocks). A stand-in at the block-hash history address keeps each draw's hash for 8,191 blocks.
• Invariants:
  • every paid purchase ends up with exactly one edition, for its buyer, or is still waiting on one known request;
  • replaced request ids stay dead;
  • at most one fallback draw is live at a time;
  • retries and fallbacks never move ETH.
• Checks on each call:
  • a Chainlink answer is refused only once its own draw's block has passed;
  • a live draw can't be re-requested away or restarted;
  • a fallback can't start while Chainlink could still answer;
  • a draw only finishes from a readable hash;
  • each refusal gives the expected error.
• Fixed cases: two sequences pin the main routes.
• Not vacuous: I checked that the random runs actually reach finished draws, refused answers and re-requests with the verifier's seed.

The run settings (96 runs × 64 calls) are set inside the file, and test/invariants/ADDED_COVERAGE.md has a paragraph describing the suite.

Finding (low), in .imd-findings.json: once a fallback draw's block hash is public, which edition it gives can still change. finishFallbackDraw (src/ArtifactsFactory.sol:463) picks the edition from the hash and from how many editions are left at the moment it is finished. Chainlink's answers to other requests are still accepted during that window. So the buyer can work out both outcomes, then either finish at once or buy one more edition and let Chainlink answer it first, and keep whichever edition they prefer.

• Reproduction: finishing straight away gives edition 22; buying again, having that answered, then finishing gives 212.
• Contradicts the code's own comments, which say the draw's result stands and no answer can land in between (lines 96–98 and 418–419). That only holds while Chainlink stays silent.
• Impact: only on the fallback path, after three days without a Chainlink answer. No ETH is at risk and the edition count stays exact.
• Possible fixes that keep the design are in the report.
• Proof caveat: the proof I attached imports the project's shared test/Fixture.sol, so it isn't fully self-contained as the rules ask. A proof is optional for a low finding.

I re-ran the proofs on the revised code: both medium findings from last round are fixed. One new low-severity finding is left, raised by the independent tester. I changed no project files; my scratch copies under test/scratch/ have been deleted. .imd-findings.json holds the one finding and a coverage row for all 112 entry points (110 holds, 2 pointing at the finding).

Settling last round's findings

• Fallback draw on a request Chainlink still holds (07f1616a, medium): fixed. The proof, and the duplicate proof 1f4cb786, now pass. startFallbackDraw refuses a request the coordinator may still answer, and rawFulfillRandomWords (src/ArtifactsFactory.sol:424) refuses a late answer to the draw's own request once its block hash is public.
• Gate address with no code reverts every gated buy (20ca2ef1, medium): fixed. All 3 tests in both proof files (20ca2ef1 and 7f29b6fb) pass. src/base/HolderGate.sol now reads balances and owners through a raw _readWord call that takes exactly one 32-byte word. An address with no code, a revert, or a malformed answer now counts as not held.
• A dead fallback draw blocking re-requests (07bde389, low): fixed. rerequestRandomness now refuses only a draw that is still live (_fallbackLive), and clears fallbackBlock and fallbackInFlight when it re-requests.
• Mainnet addresses in a Sepolia launch (aef6e0a1, low): fixed for IMD. launch.json now passes 0x44a1cd38474fb1748400e7deb5f8d786cce3f89a as ArtHouse's IMD. I checked it on Sepolia: it has code and symbol() returns "IMD". The brief names the mainnet address, but that one has no code on Sepolia and the IMD address can't be changed after deployment, so the change is justified. The seats address still has no code on Sepolia. That leaves BrokerPass.claimWithSeat and SubmissionReviews.reviewAsSeat unusable there, and the notes now say so.
• Disputed findings: accepted, no change needed.
  • Revoking THE SOURCE's sale module blocks settlement (ec83ecd2): an owner power, now documented in the README.
  • The burner's public swap can be sandwiched (6cc4015d): documented and bounded, and the burner isn't one of the 8 contracts in this launch.
  • Three informational notes (03cc5b5b, 313dd464, edce6803) are documented design behaviour.
  • Sealing a collection with ~14,000 or more pieces fails (6c384346): informational only, confined to that collection.

New finding (low): a fallback draw's edition can still change after its block hash is public This is the tester's finding 159f867e, and it reproduces: the tester's proof fails on this tree with "22 != 212".

• Cause: finishFallbackDraw picks the edition from the hash and from how many editions are left at the moment it finishes (uint16 idx = uint16(word % left), line 487). The new check at line 424 only refuses late answers to the draw's own request.
• Effect: a Chainlink answer to any other purchase can land first and shift the result. Once Chainlink answers again, the buyer can compute both outcomes and pick one, either by finishing at once or by buying another edition and letting its answer land first.
• Why low: it needs three days of Chainlink silence first, and a keeper that finishes the draw as soon as its block exists turns it into a race against a pending fulfilment. No funds are lost and the edition count stays exact.
• Suggested fix: in rawFulfillRandomWords, also refuse while another started draw is past its block and still live. That callback is consumed, and its buyer can re-request at once after the draw finishes.

Deployability: constructor arguments in launch.json match every constructor. All 8 contracts are within size limits. The tightest is ArtifactsPiece at 24,385 bytes deployed, 191 bytes under the 24,576 limit.

Coverage caveat: the ArtifactsPiece, BrokerPass, SubmissionReviews and ImdBuybackBurner rows are marked holds from my earlier round. Those files didn't change in the last three commits, so