Done. The delivered suite builds and passes: 52 tests across 6 suites, with the pre-existing 25 untouched and 27 new ones added in three new files under test/. No defect in PSSToken rose above low severity, so nothing was tested around; six observations are recorded in .imd-findings.json.

What I added

• test/PSSTokenEdges.t.sol (20 tests). Failure paths and edges the original suite skipped: ether and unknown calldata rejected, a second disjoint list of privileged selectors that must not move or freeze a holder, approve to zero spender, buy allowance that covers only the net 97% reverts, fuzzed gross-allowance rule, fuzzed wallet-to-wallet and sell transfers over arbitrary addresses never taxed, buy of the whole manager balance, the exact 34-wei fee boundary, the distribution event's post-transfer eligible supply, a buy routed to the token contract (fee distributed, net donated), queued fees surviving an untaxed buy and flushing on a taxed buy to an excluded recipient, 40 uneven holders all claiming with dust bounded, claimed tokens sold untaxed and rebought taxed, exit and return, a forwarding router keeping the dividend, a contract holder claiming without callbacks, and two property tests: pro rata within one unit for random balances, and a random 40-step sequence where rounding loss is bounded by distributions plus holders.
• test/PSSLedgerInvariant.t.sol (3 invariants, 256 runs × depth 64). A ghost ledger with six actors mirrors every operation (buy, sell, move with and without allowance, claim, same-transaction round trip, manager self-transfer) and asserts each balance account by account, fees equal exactly 3% of manager outflows, no overpayment, rounding loss within bound, index monotonic, and excluded addresses never owed.
• test/UniswapV4Edges.t.sol (6 tests) against the vendored PoolManager at the mainnet address: exact-output buys in both currency orders, output taken to a router, liquidity withdrawal by the factory, ERC-6909 claim redemption paying the fee, and interleaved traders claiming then exiting with settlement balanced.

Findings reported (none critical or high)

• Low: a trader who keeps swap output as ERC-6909 claims and sells by burning them pays no fee, since no PSS leaves the manager. Matches the brief's literal definition, inherent to v4, proof included and verified failing in scratch.
• Low: the Merkle distributor is an eligible holder and dominates early distributions, and it never calls claim, so those dividends are stranded.
• Info: liquidity withdrawals by the position holder are taxed 3%; pool fee 1.25% in the brief conflicts with the mandatory 3000 and tests assert 3000; the 1% creator fee to $SIMD lives on the launchpad and cannot be verified here; a dominant buyer recovers most of its own fee.

Still owed outside this environment: a fork run against the real pair token, factory, distributor and initialization hook on mainnet. No RPC is available here, so those are covered only by the local PoolManager stand-in.

Updated only launch.json, preserving the exact supply, economics and pool settings while clarifying implementation notes.

Validation passed:

• Manifest constraints and compiled constructor ABI match.
• forge build succeeded.
• forge test: 52 passed, 0 failed.

The review is complete. The findings file is written and validated, and the scratch tests that reproduce both findings pass against the current code.

Outcome. The permission model is clean: PSSToken has exactly four state-changing entry points (approve, transfer, transferFrom, claim), no owner, no initializer, no proxy, no receive or fallback, and every parameter is a constant. The existing 52-test suite passes. I found no access-control bypass. The two defects I substantiated sit at the trust-gap seams of economics and asymmetry.

Finding 1, medium. Buy fees credited to the launch's MerkleDistributor can never be claimed. After the launch flow, the PoolManager and 0xdEaD are excluded and the distributor holds the entire eligible supply, so the first buys' fees are credited almost entirely to it. The distributor has no path to call claim(), and when it pays a contributor the earned credit stays behind. With a 1,000,000 PSS first buy, the fee is 30,000 PSS and 29,711 PSS of it is locked forever. No existing test reaches this state because every test moves the distributor's share to a claimant before the first buy. The fix needs a scope decision: exclude the distributor via factory.distributorOf(launchNumber) with $factory and $launchNumber constructor args, or document that launch-window fees are effectively burned.

Finding 2, low. A buy whose output is minted as ERC-6909 claims and then sold back by burning those claims never moves PSS out of the PoolManager, so the 3% fee is never charged and holders earn nothing on that volume. An earlier contributor already noted this in a test comment. It is inherent to the "transfer FROM PoolManager" design the spec mandates, so I reported it for awareness rather than as an implementation slip.

Coverage. All four entry points have rows (three hold, transfer carries finding 1), plus four invariant rows covering no-admin surface, exclusions, untaxed sells and seed, and launch.json matching the mandatory spec. The 1% SIMD creator fee and the 1.25% pool fee from the brief are superseded by the mandatory build requirements and belong to the launchpad, not this contract.

Not reached. Deep numerical rounding analysis and economic sandwich modeling are outside my three guides and were only sanity-checked; the fuzz and invariant suites cover them to 1000 and 256 runs respectively.

The findings file is in place and excluded from git by the harness's own exclude rule, the scratch tests are removed, and no tracked file changed. The review is complete.

Outcome. The token's control flow is sound in my area. Three findings are recorded in .imd-findings.json, one medium, one low, one informational, with an 8-row coverage record answering all four entry points.

Findings

• Medium: fees stranded on the Merkle distributor. The distributor holds 10% of supply at launch and is the only eligible holder, since the pool's 90% sits in the excluded PoolManager and the remainder goes to the burn address. The first buy of 1M PSS allocates 99.03% of its 30,000 PSS fee to the distributor, which has no path to call claim(). That PSS stays in the token contract forever. Forwarding the swarm tokens to claimants does not forward the entitlement. The fix the launch reference sanctions is taking $factory and $launchNumber as constructor arguments and excluding distributorOf(launchNumber), which changes the manifest and is the requester's call.
• Low: ERC-6909 claims round trip pays no buy fee. A swapper who settles PSS output as v4 claims and later burns them to sell never moves PSS out of the manager, so a complete buy-and-sell costs only the pool's 0.3%. The token cannot see this. Only a pool hook could, which is outside this token's scope.
• Info: manifest pool fee is 3000 while the brief narrative says 1.25%, and the 1% creator fee to $SIMD is not implemented anywhere in this repository. The mandatory build block is declared authoritative, so this is a confirmation item, not a defect.

What held. The fee branch, dividend index math, overflow bounds, reserve solvency, claim checkpointing, allowance handling on taxed transfers, untaxed sells and seed, the fixed supply, absence of admin surface and forbidden opcodes, the vendored OpenZeppelin base, and the build configuration all traced clean. All 52 existing tests pass, including the two invariant suites.

Not reached. Live factory, distributor and router behaviour on mainnet, and the launchpad's creator-fee routing, which no offline test here can exercise.

Review complete. The findings file .imd-findings.json is written with two medium findings and a 12-row coverage record. No source or test files were changed. The scratch directory was removed after use.

What I checked

I traced every arithmetic path in src/PSSToken.sol against the Math Precision, Boundary and Numerical Gap guides: fee truncation, index scaling by 2^128, accrual products, claim rounding, eligible-supply underflow, overflow at extreme eligible supply, view-versus-write parity, and the launch manifest's price-to-market-cap arithmetic. The pure integer math holds. Every division rounds in the contract-favoring direction, remainders are preserved across claims, and reserves always cover liabilities. I confirmed by test that an eligible supply of 1 wei receiving a 3e25 fee does not overflow any later accrual.

Findings

• Medium: buyer rebates its own fee. The fee is distributed after the buyer's net receipt is credited, so the buyer's new balance takes a pro-rata share of the fee it just paid. With a 1M PSS float and a 100M PSS buy, the buyer gets back 98.98% of the fee and pays an effective 3 bps instead of 300 bps. Existing holders receive 1.02%. A proof test is attached that fails on the current code and passes with a small reorder in _update that I verified on a scratch copy.
• Medium: distributor dividend sink. The MerkleDistributor holds 10% of supply at launch and is not excluded, but it has no way to call claim(). On the first buy after launch it absorbs 99.03% of the fee permanently, and keeps absorbing fees until contributors claim. The burn address is already excluded for exactly this reason. The fix needs a constructor argument, so no proof test is attached.

Not reported

Fee truncation to zero for buys under 34 minor units is dust-level, documented, and already tested, so it is recorded in coverage only. Same-transaction dividend capture is documented as intentional in the README. The 1.25% versus 3000 pool fee and the 1% creator fee are outside the token and marked unreached.

The findings file is written and verified. The review is complete; here is the recap.

Outcome. The Economic Security, Invariant and Flow Gap passes found no fund-loss bug in the dividend arithmetic. The accounting conserves supply, the reserve always covers claimable plus queued dividends, excluded addresses never accrue, and sells and the pool seed settle exactly against the vendored v4 PoolManager. The existing 52-test suite passes. Four findings are recorded in .imd-findings.json, all with reproductions and exact snippets. Two are medium, one low, one info.

Findings

1. Medium. Dividends stranded on the launch distributor. The Merkle distributor holds 100M PSS at launch and is the only eligible holder, but it has no way to call claim, and claim pays msg.sender only. My scratch test shows the first 1M PSS buy credits 99.03% of its 30,000 PSS fee to the distributor, where it stays locked forever. Moving the tokens out later does not move the credit. The reference describes a fix within the accepted design (constructor takes factory and launch number, token consults distributorOf), but that changes the constructor, so it is the requester's call.

2. Medium. ERC-6909 claim settlement bypasses the buy fee. A trader who settles swap output with PoolManager.mint and sells with PoolManager.burn never triggers a transfer from the manager. My scratch test round-trips 1 IMD for 59 bps total cost with zero fee collected and zero dividends. An earlier reviewer already flagged this, so the judge may treat it as accepted. Only a pool hook could close it.

3. Low. Non-buy outflows are taxed. Liquidity removal and LP-fee collection by the launch position owner arrive 3% short. Documented in the README and asserted by an existing test, but it contradicts the brief's "buys only".

4. Info. Brief items not in the token. No 1% creator fee to $SIMD exists anywhere in the code, and the pool fee is 0.30% per the mandatory requirements rather than the brief's 1.25%.

Coverage. All four entry points have rows (approve and transferFrom hold; claim and transfer carry findings 1 and 2). Eight invariant and economics rows also hold, including overflow bounds on the index, the sandwich-on-fee economics, and the provenance price against the 2500 IMD cap.

Not reached. Live-state checks against mainnet (real factory, real distributor code, Universal Router take behaviour) are owed and cannot run here. The two scratch tests under test/scratch/ pass on current code as demonstrations and are not kept.

The review is complete. The findings file is in place at the repository root, the working tree is otherwise unchanged (the findings file and test/scratch/ are excluded by the harness's git exclude rules, which is why git shows a clean tree), and no source, config or manifest file was modified.

Outcome: 5 findings, none critical or high. The token conforms to the authoritative mechanics M1 on every settlement-critical path. Sells, the pool seed and distributor claims are exact, settlement balances, there is no owner, no mint path, no reentrancy, no delegatecall or selfdestruct, and I confirmed by a worst-case test that the magnified dividend index cannot overflow a checkpoint. The two medium findings are economic guarantees that fail rather than loss of held funds.

Findings reported

1. Medium, distributor stranding (merged from all four specialists). The launch MerkleDistributor is the only eligible holder right after launch and cannot call claim(). On a 1,000,000 PSS first buy, 99.04% of the 30,000 PSS fee is credited to it and is locked in the token forever. Reproduced with exact values. Fix needs a requester scope decision because excluding the distributor requires the $factory and $launchNumber constructor arguments.

2. Medium, buyer self-rebate (from audit_math). Because the fee is distributed after the buyer's net is credited, a buyer takes net/(float+net) of its own fee back. The attached proof fails on current code with the buyer owed 97/98 of its own fee. I confirmed a five-line reorder in _update makes the proof pass and keeps the existing ledger and dividend invariants, once the ghost ledger counts distributions by pre-buy eligibility.

3. Low, ERC-6909 claims round trip (merged from three specialists, recalibrated down from one medium). A buy minted as claims and sold back by burning them never triggers a PSS transfer, so no 3% is collected. Reproduced against the vendored PoolManager. It is a limit of the requested design, not an implementation slip.

4. Info, all manager outflows taxed. Liquidity removal and fee collection in PSS arrive 3% short. Spec-conformant and documented, asserted by an existing test.

5. Info, brief items resolved only in prose. Pool fee is 3000 per the mandatory block, not the narrative's 1.25%, and no 1% $SIMD creator fee exists in this repository.

Coverage: all four ABI entry points answered. approve and claim hold. transfer and transferFrom carry findings 1 and 2. Three invariant rows added for supply, launch flows and reserve coverage.

Still owed outside this review: live confirmation that the launchpad routes the 1% creator fee, and the requester's decision on whether to exclude the distributor and reorder the fee distribution.

Implemented both fixes: dividends use pre-buy balances, and claimFor(account) pays directly to the holder.

Answered all 10 findings in .imd-responses.json. Documented the remaining v4 and external distributor limitations.

Validation passed: forge build, all 31 tests, forge fmt --check, manifest checks, and the supplied reviewer proof.

Both previously reported defects are fixed, and the review is written to .imd-findings.json with no new blocking findings.

Settlement of the two findings to be fixed

• Buyer self-rebate (medium, eeeb46e3): fixed. The taxed branch at src/PSSToken.sol:81-85 now moves the fee into the token, distributes against the eligible supply before the net arrives, re-checkpoints the recipient on its pre-buy balance, and only then delivers the net. The attached proof, copied to test/scratch, passes on the revised code. I also traced a buyer with a prior balance, a buy into an empty float that queues and later flushes, buys into the token itself and into the burn address, and the transferFrom path. All behave as intended.
• Distributor-stranded fees (medium, e887f98c): fixed by the permissionless claimFor path, which was one of the remedies the finding offered. It pays only the named account, returns zero for excluded addresses and on repeat, and cannot redirect funds. My scratch reproduction shows the distributor's full fee entitlement released by a third party after its allocation left. The residual is recorded as info only: the PSS lands in the external distributor's balance, and whether that contract can forward surplus is outside this repository, as README line 46 and the manifest notes already disclose.

Advisory items (ERC-6909 claims round trip, taxed non-buy outflows, 0.30% pool fee and no $SIMD routing) are unchanged, documented design limits. The author's disputed answers hold and I did not re-raise them.

Verification

forge test: 66 passed, 0 failed (includes the attached proof and my scratch tests)

Coverage answers all five entry points plus two invariants. Only test/scratch and .imd-findings.json were touched. Nothing blocks the launch from this review.