Fixed the manifest rejection: notes reduced from 4,532 to 3,757 characters. Added boundary tests and refreshed release hashes.

Passed: forge build, forge fmt --check, 479 Solidity tests with the required seed, and 10 Python tests. Independent review found no substantive issue.

Mainnet deployment remains pending platform admission and release.

The findings file is written and valid, with 1 informational finding and 92 coverage rows. Final state:

Outcome. The math in the deployable set (UnlkImdHook, UnlkImdOracle, ImdSpotUsdSource, ImdSpotMath, ImdSeedDepth, SuccessorFeeMath/NativeFeeMath, ImdFeeVault, MerkleClaimEvidence, UnlkToken) holds against the Math Precision, Boundary and Numerical Gap checklists. No critical, high or medium defect was substantiated, so no proof files were attached.

What was verified.

• The 512-bit FDV arithmetic in src/mainnet/ImdSpotMath.sol was checked against an independent Python big-integer reference on 100 vectors spanning both currency orders, the 2^128 sqrt-price branch switch, MIN/MAX sqrt prices and bases up to 2^256-1. Every result matched exactly, including saturation.
• Fee rounding: the single +1 correction in buyPoolInput is provably sufficient, sellGrossOutput returns the smallest gross whose floor-fee leaves at least the requested net, and fuzzing confirmed both bounds. All four swap modes stay within 1 wei of 75 bps.
• Complete-fill check sign and branch selection, the quota floor, the one-block maturity subtraction, tier thresholds and the 20%→95%/bypass mapping all match the brief. The view remainingQuota and the write path use identical math.
• Boundary assumption on the factory: the verified mainnet LaunchFactory source seeds the pool before sending the remainder, so token.initialRecipient() is the payer wallet as the hook assumes.
• The pinned PRICE_SOURCE hash equals the compiled ImdSpotUsdSource creation code. The sampled, V4-proof and v3 sources in src/mainnet are unpinned and cannot be staged.
• The local reproduction of the admission failure (test_initializesFromTheLaunchFactory) passes with the relocated service attestation. Official admission was not run here.

Reported finding. One informational item: the 75 bps treasury fee floors to zero for IMD legs below 134 wei. Concrete arithmetic is included. The gap never exceeds 1 wei per swap and is economically irrelevant at 18 decimals.

Coverage. 35 entry points marked holds or finding with one-line reasons. 57 entry points belonging to superseded contracts (UnlkHook, UnlkHookV2, UnlkHookV3, UnlkOracle, NftFeeVault, UnlkRouterV2, UnlkSwapRouter) are marked unreached: they are not deployable from launch.json and were not reviewed within budget. Two invariant rows record the reference-checked FDV math and fee-rounding bounds.

Review complete. The findings and coverage record are in .imd-findings.json.

Outcome. The mainnet launch path holds under the Access Control, Trust Gap and Asymmetry checks. I found no exploitable permission gap, no privilege-escalation route and no asymmetric write between paired functions in the deployed set. The admission failure is fixed in the tree: beforeInitialize now depends only on the constructor-bound factory, the exact sorted UNLK/IMD key, fee 12500, spacing 60 and one-time binding, and the local reproduction of the protected initialize check passes for both currency orders. The whole mainnet suite passes locally. The Owners protected check skips rather than fails when the hook refuses the probe's tiny seed, so it is not a blocker either.

Reported findings. All three are concrete conditions rather than exploits, so none carries a proof file.

• Low, duplicate-recipient round-0 tree bricks activation. Certification reverts on duplicate accounts and the sealed activation path requires round 0 certified. If the platform's swarm tree ever carries two leaves for one wallet, stage 1 completes and locks the seed, but trading can never be enabled. A scratch test demonstrates the certification half.
• Low, service pins are only checked after the irreversible stage 1. If any pinned factory, manager, router, quoter, Permit2, fees or registry runtime differs at broadcast time, the launch succeeds, 870M UNLK is seeded and locked, and every setup entry reverts forever. This is the inherent cost of the required relocation. The fork rehearsal must re-verify every pin immediately before broadcast.
• Info, trust assumption on treasury-opened rounds. The verified distributor lets the IMD treasury open later rounds, and claims from any round become immediately spendable quota. A transfer-only holder could convert balance into quota with the treasury's cooperation. This is a platform-privileged action to disclose, not a defect.

Coverage. All 90 entry points have rows. The deployed set (UnlkImdHook, ImdFeeVault, MerkleClaimEvidence, UnlkImdOracle, UnlkToken, WalletExecutor) plus the candidate vault and both routers are traced. The legacy UnlkHook, UnlkHookV2, UnlkHookV3, UnlkOracle and the two non-selected price sources are marked unreached because they are not deployed by the manifest and I did not trace them within the budget.

Static-analysis leads. The reentrancy, strict-equality and unused-return lines on the mainnet contracts were checked during the traces above and do not reach a failure in my area. The remaining leads concern the undeployed legacy contracts.

Review complete. The findings file is written and validated.

Outcome. In the assigned area (Economic Security, Invariant and Flow Gap), the mainnet bundle holds up. I found one low-severity defect and no fund-loss or invariant break. The findings and a 96-row coverage record are in .imd-findings.json.

What I verified

• Fee economics. All four swap modes were traced against v4's beforeSwap/afterSwap delta math. The 75 bps IMD fee nets the hook's delta to zero in every mode, is minted as vault claims before recordAccrual, and the exact-input and exact-output rounding helpers are provably the largest and smallest values with at most 1 wei treasury bias.
• Quota invariant. Sales are checked against floor(matureE × p / 10000) minus S before the milestone updates, so a sale cannot use its own post-swap gate. One-block buy maturity, payer and native-claim credits, and the monotone tier ladder ending in the permanent 50M bypass all match the brief.
• Setup and activation flow. Every pinned mainnet code hash in MainnetPins was compared against live Ethereum at block 26211714 via a public RPC. All nine match, the factory's fee and registry getters return the pinned addresses, IMD has 18 decimals, and the pinned IMD/ETH reference pool exists with fee 10000 and nonzero liquidity. Activation is therefore reachable in the live environment.
• Suite evidence. The full mainnet test directory passes locally with 211 tests across 38 suites. This is local reproduction, not official admission.

Finding reported (low). The current section of docs/mainnet/DESIGN.md at line 44 says a nonzero core protocol fee makes swaps fail closed. The shipped hook, the admission report and ProtocolFees.t.sol all do the opposite: swaps and gate advancement continue and effective fee totals rise. The reproduction names the exact protocol-fee setting and swap inputs.

Checked and deliberately not reported. ERC-6909 claims donated straight to the fee vault are reported by donatedClaims() but can never be redeemed. I confirmed this with a scratch test under test/scratch/, but the design document already discloses donated manager claims as unrecoverable, so it is a note in the coverage row, not a finding.

Coverage gaps. The 59 entry points of the legacy and candidate contracts (UnlkHook, V2, V3, both custom routers, NftFeeVault, UnlkOracle, the sampled and V4 USD sources) are marked unreached. They are not in the launch manifest or the pinned reviewed-code bundle, and the budget went to the deployed path.

The review is complete and .imd-findings.json is written and validated: both snippets match the tree line for line, and all 90 listed entry points have a coverage row plus 4 invariant rows.

Outcome: no exploitable defect in the control flow of the accepted mainnet hook. The admission failure the task names is fixed correctly: beforeInitialize in src/mainnet/UnlkImdHook.sol no longer attests services, keeps PoolManager-only and constructor-bound-factory authentication, binds the exact sorted UNLK/IMD key once at fee 12500 and spacing 60, and the service attestation now runs with full enforcement at deployPriceSource, deployCompanions and activation. Trading, credits and gates stay disabled until the sealed activation.

What I traced in my area (Execution Trace, Periphery, First Principles):

• Swap flow in all four modes. Before-swap specified fee for exact-input buys and exact-output sells, after-swap unspecified fee for the other two, complete-fill and seed-band guards, and the claim mint before the hook's delta credit. The hook's delta nets to zero and the swapper's delta equals the executed amount plus fee in every mode. Quote paths leave no state.
• Setup and sealing. Staging is repeatable with fresh salts, every check precedes every write, and a later deployPriceSource cannot desynchronise a staged oracle because activation re-checks the feed identity.
• Periphery. NativeFeeMath rounding, ImdSpotMath wide division, ImdSeedDepth, the Merkle evidence tree reconstruction and attest path, the fee vault's redeem and payout, and the optional WalletExecutor.
• Live mainnet attestation. All nine pinned code hashes, the factory's getters, IMD decimals, the reference pool ID derivation, its LP fee and nonzero in-range liquidity, and the Chainlink feed shape and freshness all matched the chain at block 26211743. If any pin had been wrong, activation would have been permanently impossible.
• Tests. All 211 tests in the mainnet directory pass. The prior protected Hook and Token runs are recorded as passing.

Two informational findings were recorded, each with a concrete reproduction:

1. The seed check accepts an opening price strictly past the token-only boundary, where the oracle reverts until the first buy. Verified with a scratch test. No loss and self-healing, but it is a documented-band divergence the deployer's price derivation should respect.
2. The supplied Owners protected fee-collect check skips on this hook because the probe's 1e18 full-range seed is below the principal band. The collect path itself holds by trace and is covered locally. This is already disclosed in the manifest notes.

Not reached: the superseded UnlkHook, UnlkHookV2, UnlkHookV3, UnlkOracle, both custom routers, NftFeeVault and the two historical USD sources. None of them is named by launch.json or pinned by ImdReviewedCode, so they are not deployed by this launch. Their rows are marked unreached rather than claimed.

Updated only launch.json. Constructor bindings, permissions and pool settings match the implementation; notes are 3,924/4,000 characters.

Validation passed: forge build, all 479 tests with the required seed, and 11 supplied Hook/Token checks.

Owners checks lack platform helpers. Official admission and mainnet deployment remain pending.

Added setup/claim lifecycle invariants and mainnet-fork tests under test/.

• Build passed; full suite: 483 passed, 0 failed, 2 fork suites skipped offline.
• Separate runs: 6 fork tests and 11 protected checks passed.
• Reproduced the historical InvalidConfig() admission failure.

Protected Owners checks lacked required helpers. No deployment was performed.

Coverage and results

The review is complete and .imd-findings.json is written with 7 findings and a 92-row coverage record covering all 90 listed entry points.

Admission failure: The fix reproduces. The hook's beforeInitialize no longer calls _verifyServices, keeps the constructor-bound factory check, the exact sorted UNLK/IMD key, fee 12500, spacing 60 and one-time binding. I re-ran the unmodified supplied Hook and Token protected checks with manifest-derived probes. All 4 Hook tests, including test_initializesFromTheLaunchFactory, and all 7 Token tests pass. This is a local run, not official admission. The full test/mainnet suite also passes, and the pinned companion creation-code hashes in ImdReviewedCode match the built artifacts.

Findings kept, all reproduced (no critical, high or medium):

• Low: service pins are first enforced after the irreversible stage 1, so a runtime that differs from MainnetPins at broadcast leaves a seeded, principal-locked, permanently inactive pool. Reproduced in test/scratch/JudgeRepro.t.sol. A release condition from the requested relocation, not an exploit.
• Low: a round-0 swarm tree with one wallet twice can never be certified, so activation is impossible. Reproduced via DuplicateRecipient reverts.
• Low: docs/mainnet/DESIGN.md line 44 says swaps fail closed under a core protocol fee, while the shipped hook and its tests keep trading open.
• Info: seed check accepts an opening price strictly past the token-only boundary while the oracle needs the price in band until the first buy; the protected Owners collect check skips because the probe seed is outside the principal band; treasury-opened distributor rounds are a trust assumption that can mint quota; fee floors to zero below 134 wei.

Dropped or merged: nothing dropped; each specialist finding reproduced and was kept at its stated severity, with the audit_permissions and audit_flow items merged where they shared a root cause.

Own pass: I traced the four swap modes against v4 delta signs, the complete-fill and in-band checks, initiator accounting, claim minting to the IMD vault, the collect path, the staging and activation sequence, token, oracle and evidence contracts. I found no new defect. The historical hooks, custom routers, TWAP oracle and superseded price sources are marked unreached: they are not deployed by this manifest and the mainnet hook rejects any swap sender other than the pinned Universal Router or Quoter.