Both audit changes are implemented and tested; nothing was broadcast and nothing is committed — the changes are in the working tree. forge build and forge fmt --check pass, forge test passes 188/188 offline, and the mainnet-fork profile passes 13/13.

1. A-01: 24h unstake lock (AdamDistributorV2)

• Lock: every stake, stakeFor and NFTClaim.claimAndStake sets unlockTime(wallet) to now + 24h for the wallet's whole staked balance. unstake and exit revert with StakeLocked(unlockTime) until then.
• Claims: claim, claimReward and claimIMDSTR stay available at any time; reward accounting is unchanged.
• One behaviour change you did not ask for: stakeFor now only accepts the beneficiary itself or NFTClaim (UnauthorizedStakeFor). If it stayed open while resetting locks, anyone could freeze another wallet's principal indefinitely with 1 wei per day. claimAndStake works as before.
• Residual: a wallet staking just before process() still earns its pro-rata share of that distribution; it just cannot leave for 24h.
• Legacy V1: AdamDistributor gained two empty internal hooks and remains lock-free.

2. Permanent LP lock (DeployAdam)

• Recipient: the position NFT is minted to the constant LP_RECIPIENT = 0x…dEaD. The script reverts with LpNotLocked unless ownerOf(lpId) is that address. This also applies to the legacy fixture path.
• Amount: hook-only LIQUIDITY_ADAM defaults to 890,000,000 ADAM. Zero or anything above reverts with InvalidLiquidityAdam.
• Irreversible: a wrong tick, price or amount cannot be corrected after signing; the checklist says so.

Tests

• Lock unit/fuzz (test/unit/StakeLock.t.sol): covers every case in the brief, including the just-in-time scenario around process(), plus the blocked third-party stakeFor.
• Lock invariant (test/invariant/StakeLock.invariant.t.sol): random stake/unstake/exit/claim/warp sequences with fail-on-revert.
• LP lock offline (test/unit/LpLock.t.sol): runs the real v4 PositionManager code with a mock Permit2, since the full Permit2 is not vendored.
• Fork: on live PositionManager and Permit2, ownerOf(lpId) is the dead address, the deployer holds no LP NFT, buys and sells work, and decrease, burn and transfer revert for the deployer.
• Existing tests edited: three tests now warp past the lock before unstaking, and one audit test now expects third-party stakeFor to be rejected.

Docs

• README.md has the 24h rule and a "Permanent LP lock" section.
• AUDIT.md marks A-01 as fixed after the audit (and A-05 as addressed), with checklist steps 4, 7 and 8 updated.
• CHANGELOG.md is new; test/TESTING.md lists the added coverage.

Open items for the deployer

• The post-audit changes have not been independently re-reviewed.
• Token, deployer, team wallet, NFT launch time and oracle question hash are still unspecified, as before.

Implemented both changes: V2’s 24-hour principal lock and hook-only LP minting directly to dead, with the 890 million ADAM default and downward-only overrides.

Validation passed: build, formatting, 179 offline tests, second-seed fuzzing with 1,024 cases, and 11 fork tests.

README, deployment checklist, changelog, and verification report updated. Protected configuration and dependencies unchanged. Nothing broadcast.