The full test suite now builds and passes under the IMD verifier settings. No contract source changed, so every contract is still byte-identical to the v3.9 pins. Nothing was deployed, broadcast or bought.

1. Verifier-settings tests

• v3.9 failed to build with FOUNDRY_VIA_IR=false FOUNDRY_BYTECODE_HASH=none because of four "stack too deep" errors:
  • one in test/EndowmentEscrowV38.t.sol;
  • one in the reference model in test/LazyAccounting.t.sol;
  • two in test/SwarmDeskV37.t.sol.
• I fixed them in the tests only, with helper functions, a struct and scoped blocks. The assertions are unchanged.

Check	Verifier settings	Repo foundry.toml (via-IR)
forge build	passes	passes (about a 10-minute compile)
forge test	262 passed, 0 failed, 1 skipped (optional live fork test), 45 suites	full run 259/0/1 before my new tests; the 4 changed or new suites re-run afterwards, 36/36 passed
forge fmt --check	passes	passes
Pin checks	all 14 modules plus Registry and Params match; every contract under the 24,576-byte limit	same

I did not repeat the full via-IR run after my last test edits because of its compile time; only the suites I changed were re-run on it. The flattened launch/V4Market.sol built with the verifier settings is byte-identical to src/V4Market.sol.

2. launch-v39.md gives the steps in order: Sepolia rehearsal, then Robinhood Chain. It runs from the SwarmDesk bootstrap through LaunchFactory claimFees, with a Desk.registry() check right after job A. Every paid step has its objective text (X link included), its inputs and an on-chain check. Inputs only you can supply are marked: snapshot block, both Merkle roots, keeper wallet and RPC, Ethereum IMD for the schedules, and the Sepolia platform addresses.

3. Review (docs/review-v39-independent.md)

• Fixed (medium): tools/make_oracle_bodies.mjs still built schedule bodies with a deliver field, which schedule.create rejects. It now pins the SwarmDesk as consumer instead, through the new tools/schedule_bodies.mjs. test/oracle-v310.test.mjs covers it, and the committed bodies are unchanged.
• Not fixed in code (medium): the Desk.bind twin front-run. Someone who knows the real token plus the starter root, free-pack root, snapshot block and endowment could launch a copy of the registry and bind the Desk first. The endowment would then go to their copy. Closing this in code needs an on-chain fact only the real launch has, which the current design lacks. The runbook mitigates it: keep the roots and lists unpublished until the bind check passes, bind immediately after job A, and never forward the endowment otherwise. A new test shows a copy with a different token cannot take the escrowed tokens.
• Low: the contracts accept both builds' pins, but the hook only recognises a registry from its own build. If artifacts from the two builds were mixed, the hook could never bind and its fees would be stuck. The runbook requires the verifier-build artifacts for every step, and test/V310.t.sol checks that the pins come from one build.
• The fee rework, severity floor, escrow, Desk constructor and keeper relay/wiring had no findings.

4. report.md is now the v3.9/v3.10 report: changes, test results on both builds, the simulation table against v3.6, the review result and open items. The v3.8 report is archived at docs/report-v38.md, and test logs are in artifacts/v310/.

Still open:

• The Sepolia rehearsal has not been run.
• Slither and Mythril were not run, and this review is not an external audit.
• Decision for you: should the Desk.bind twin front-run get a code fix? It would need an anchor such as a factory record of who paid for the launch, and it would change the Desk pin.

Nothing is committed yet.