Most of what this review was meant to cover doesn't exist yet. The only Solidity in the tree is src/FirmAddresses.sol, a library of 25 address constants. None of the contracts SPEC.md describes have been written: the NOTSTOCK token, LpDesk, Burner, FirmVault, GenesisSplitter, LpGovernor, PriceGuard and the venue modules are all missing, as are the tests and script/DeployModules.s.sol. So I couldn't audit any contract code. Instead I checked the binding rules in SPEC.md that those contracts will have to follow, and checked every address constant against the live Robinhood Chain (4663) using read-only calls.

The findings are in .imd-findings.json: four entries (two medium, one low, one info), no proofs. Proofs are only required for critical or high findings, and these are spec-level, so there is no contract to test against yet.

1. Medium (SPEC.md:74). The registration step can be locked forever by someone outside the launch. SPEC says registerNotStock must check the pool's fee against the factory's current fees().poolFee(). That value lives in a separate fees contract whose owner (0x047F…54B7) can change it at any time; I simulated that call and it succeeds. The NOTSTOCK pool's fee is set to 12500 at launch and never changes. If the owner changes the global fee before registration happens, registration can never succeed. That would permanently block:

   • split(), leaving 600M NOTSTOCK stuck in GenesisSplitter;
   • FirmVault's distribute(), leaving all pool fees stuck;
   • LpDesk's 7-day bootstrap, which never starts.

   The fix: compare against the fixed 12500 that SPEC itself gives.

2. Medium (SPEC.md:46, plus lines 65, 35 and 48). Governance can send LpDesk's NOTSTOCK to an attacker. That breaks SPEC's rule that tokens only ever go to the project wallet:

   • Adding a bridge only checks that the contract reports NOTSTOCK as its token, so an attacker's own contract can pass and then pull the approved NOTSTOCK in send().
   • Adding a venue only checks things an attacker's contract can also fake.
   • Opening a position on a new pool uses whatever price the proposer picks, so the deposited NOTSTOCK can be bought for almost nothing.

   The vote gates don't stop this when few people stake. With nothing staked, anyone can propose, and a 1-wei stake meets the quorum. The operator's 2-day veto is the only protection.

3. Low (SPEC.md:40). split() rounds down and can only run once. Any extra NOTSTOCK sent to GenesisSplitter on top of the 600M leaves a few wei stuck there forever. For example, an extra 5 wei leaves 1 wei behind.

4. Info (src/FirmAddresses.sol:5). This records which files were read and which were missing. It also records that every constant checked out on chain:

   • The tokens' names and decimals match SPEC.
   • The Uniswap v3, Aero and Sushi position managers report the right factories and WETH, and the Uniswap v4 position manager points at the right pool manager.
   • The launch factory has setRequester (which accepts a contract as the new fee recipient), positionOf, the registry, a 12500 pool fee and the pool hook.

   One detail for whoever builds the contracts: the live factory uses uint64 for launch numbers.

I ran forge build once to confirm the library compiles, then deleted the cache/ and out/ folders it created. The only file this review adds is .imd-findings.json.

The dotfiles are the harness's own (dated before this task, not writable by me), so nothing of mine sits outside the allowed paths. The work is complete and verified.

Summary

Delivered the full Not Firm (NOTSTOCK) contract stage for Robinhood Chain (4663) at the repository root:

• src/LaunchToken.sol: fixed-supply Not Firm / NOTSTOCK, 10^27 minted to the deployer, plain transfers.
• src/LpDesk.sol (19.1 KB): positions on listed venues, three balances per token, 25/25/25/25 fee split with NOTSTOCK to Burner, bootstrap window, operator powers (open, collect, shift, move, close, top-up, buyback, burn, handover), FirmVault credit, governance entries, BridgeOut, and deployModule with CREATE2 and fixed code hashes. Its constructor creates Burner.
• src/FirmVault.sol, src/GenesisSplitter.sol, src/Burner.sol: all within SPEC size limits.
• Modules LpGovernor, PriceGuard, VenueV3 (V3 and CL), VenueV4, each under src/modules/, no constructor arguments, deployed after launch by script/DeployModules.s.sol.
• docs/abi/<Contract>.json for all nine contracts, README, and ADAPTATION.md.

Audit findings: all three code findings reproduced and are fixed with tests: registration compares with the constant 12500 plus poolHook(), GenesisSplitter leaves no dust, and BridgeOut requires the NOTSTOCK to land in the adapter. The AddVenue half of the governance finding is bounded by the spec's exact checks, so it is documented as veto-protected rather than changed.

Checks run:

Left out, and why: the rehearsal through the live factory's own launch() could not be built because that function's ABI is not published on chain or in the repository and the explorer refused the source request. The rehearsal runs through a mock that mirrors the live factory's observed read surface instead, as ADAPTATION.md section 4 records. Pending uncollected fees are not computed on chain; the README says so.

launch.json is written, validated against the accepted ABIs, and the full suite passes.

What the manifest contains

• Kind evm_project, token LaunchToken with name Not Firm, symbol NOTSTOCK, 18 decimals, as src/LaunchToken.sol sets them.
• Three application contracts in constructor dependency order, each argument matched one to one with the constructor in docs/abi:
  • LpDesk takes $token, the dev wallet SPEC.md fixes as operator, and $owner as the project wallet.
  • FirmVault takes $owner and $contract:LpDesk.
  • GenesisSplitter takes $contract:LpDesk and the same dev wallet.
• Pool fields exactly as the launch gives them: IMD as paired currency, fee 12500, tickSpacing 60, initialPrice one to one.
• Notes under 2,000 characters explaining the roles, why Burner and the CREATE2 modules are not manifest contracts, and that no contract is allocated supply at launch.

Judgment calls

• The project wallet is the launch's owner, so both owner-role arguments use $owner rather than the literal address.
• The dev wallet is an address the brief names, not an owner, so it is written as a lowercase literal.
• Burner, LpGovernor, PriceGuard, VenueV3 and VenueV4 are left out. LpDesk creates Burner itself, and the modules deploy after launch through deployModule, so none are factory-deployed contracts.

Verification

• A scratch script checked schema keys, name rules, backward references, address typing and the pool values. It reported no errors.
• The build succeeded and the suite passed with the verifier's fuzz seed. The skipped tests are the fork tests, which skip off-fork by design as ADAPTATION.md records.

Only launch.json is new in the working tree. The other untracked entries git lists are sandbox device nodes, not files I created.

I fixed the citation on the V4 increase finding. Its line was 348, but src/modules/VenueV4.sol only has 215 lines. The quoted code, bytes memory actions = abi.encodePacked(INCREASE_LIQUIDITY, SETTLE, SETTLE, SWEEP, SWEEP);, is at line 104. I changed the line to 104 and added the function's range (lines 92–116) to the description.

I checked both findings' snippets against their own files and both now match the tree exactly:

1. Medium, src/modules/VenueV3.sol:213: LpDesk.buyback on a V3/CL venue takes the whole amount out of the buyback basket, even though only part of it is spent.

2. Medium, src/modules/VenueV4.sol:104: on V4, increaseLiquidity and moveLiquidity put fees the target position has already earned back in as principal, without collecting them first. As a result:

   • Those fees skip the 25/25/25/25 split.
   • The top-up basket is charged less than the position actually received.
   • If the fees include NOTSTOCK, the call reverts.

   This finding has no Foundry proof attached. Reproducing it needs the live V4 PositionManager and PoolManager, which means a fork.

The file still has all 52 coverage rows, and nothing else in it changed.

git status lists some untracked files: shell profiles like .bashrc, plus .claude/, .vscode and .mcp.json. I didn't create or touch them; they look like they belong to the environment.

The review is complete and the findings file is in place.

Outcome. .imd-findings.json holds 4 findings and a coverage row for every one of the 52 listed entry points (none unreached), plus two invariant rows. No repository file was changed; only test/scratch/ holds my two throwaway test files.

Findings

• Low: VenueV4 callback trusts its own calldata. unlockCallback takes the PoolManager address from the bytes the caller supplies, so any contract naming itself passes the check and can make the module transfer out whatever it holds. VenueV3 guards the same seam correctly with a pending-pool slot. Impact is bounded because the module holds nothing between calls, but it breaks the SPEC section 2 rule. Reproduced in a scratch test.
• Low: one-step operator handover. A single wrong setOperator permanently strips every operator power, including FirmVault buyback, veto, close and burn, with no recovery. Flagged as a scope decision since SPEC allows the handover but does not fix its shape.
• Info, spec-conformant: slot griefing. A holder with 0.1% of staked NOTSTOCK can keep the non-operator slot of any proposal kind occupied indefinitely by re-proposing every 3 days. Operator slot unaffected. Reproduced.
• Info, spec-conformant: dust quorum. With little staked, one small staker passes proposals and only the 2-day veto guards execution. Already noted in ADAPTATION; recorded as the trust boundary.

What held. The permission chain operator → LpDesk → modules → PriceGuard, the governor-only entries, FirmVault's caller checks, registration, bridge-out balance checks and the fee-split baskets all traced cleanly. The IMD buyback share, top-up and free balances stay separated as the spec requires.

External trust verified on chain 4663. Every fixed address has code, the V4 position manager and V3/CL managers report the expected PoolManager, factory and WETH, the live launch factory exposes all selectors the code relies on including setRequester, and its fee is 12500. All 10 fork tests pass against the chain when run single-threaded. The earlier failures were provider rate limiting, not defects. These fork results matter because the no-network verifier skips those tests.

Not reached. Deep math and economic passes were outside my area and were not redone beyond what the fork runs exercised.

Review complete. The findings file is written and verified against the tree; no source files were changed.

Outcome: .imd-findings.json holds 4 findings and 52 coverage rows (all 50 listed entry points plus two PoolMath invariant rows): 47 hold, 5 point at findings, none unreached.

Findings

1. Medium, VenueV3.swapExactInToDead (src/modules/VenueV3.sol:212). A V3 or Slipstream pool whose in-range liquidity runs out stops at the price limit and asks the callback to pay only what it consumed. The module keeps the rest, while LpDesk.buyback has already debited the buyback basket by the full amount and shipped it. The remainder sits in the module until a later mint or increase flushes it into free balance, so the buyback earmark is lost. Proof test under test/scratch fails now with 40e18 stranded of 100e18 sent. The V4 path is safe because the full settle leaves a nonzero delta and unlock reverts.
2. Low, LpDesk.moveLiquidity (src/LpDesk.sol:269). The collect step pokes 1 wei of liquidity on V3/CL positions, so passing the liquidity read from positionLiquidity reverts in the position manager. close and shiftRange re-read liquidity after the poke; moveLiquidity does not.
3. Low, VenueV4.unlockCallback (src/modules/VenueV4.sol:164). The caller check compares msg.sender against a PoolManager address decoded from the caller's own data, so any contract can drain whatever the module holds. Impact limited to stray tokens since the module holds nothing by design. Reproduced in a scratch test.
4. Info, PoolMath.within0_5Percent (src/libraries/PoolMath.sol:155). Squared prices floor to zero below sqrt price 2^48, so a 4x deviation passes. Not reachable with the listed assets at any plausible valuation.

Checked and holding: mulDiv matches OpenZeppelin (the slither incorrect-exp lead is the intended XOR seed), tick math matches Uniswap, FirmVault 25/25/25/25 split and bucket invariant, GenesisSplitter 50/60 and 10/60, governor threshold, quorum, checkpoint casts and window boundaries, LpDesk 0.5% band and 99.5% minimums, V4 liquidity fitting (fuzzed 4000 runs with narrow ranges, no overshoot).

Not reached: finding 2 was verified by reading v3-periphery, not against a live pool, since the fork tests need an RPC. Fork-only behaviour of the real venues was not exercised.

I added two test files and found no critical, high or medium defects. The full suite passes with the verifier's fuzz seed: 104 passed, 0 failed. The 10 tests in the existing test/Fork.t.sol were skipped, because they only run on a Robinhood Chain fork.

test/Adversarial.t.sol (unit and fuzz tests, mostly failure paths)

• LaunchToken: transfers to the zero address and amounts above the balance or allowance revert. An unlimited allowance is never reduced. A fuzz test checks the total supply stays whole.
• LpDesk: every operator function rejects six other callers, and the governor-only functions reject the operator. The FirmVault credit function rejects everyone else. Calls fail cleanly before the modules exist and before registration. The 7-day bootstrap is checked one second before its end, at its end and a year later. Also covered: setOperator(0), the old operator losing every power (including FirmVault buyback and the veto), actions on positions that don't exist, and a fuzz test that burn never takes more than the free balance.
• PriceGuard: each rejection in checkAsset and checkVenue, add calls from anyone but LpDesk, unknown launch numbers, and a splitter 1 wei short of 600,000,000. Registration can't be redone, and a later change of fee recipient doesn't move FirmVault.
• GenesisSplitter and Burner: the exact 500M/100M split happens once only, even if tokens arrive later. A fuzz test with extra tokens donated checks nothing is left behind. Burner reverts when empty and ignores IMD.
• FirmVault: distribute splits into exact quarters (fuzzed), and a repeat moves nothing. Tokens other than IMD and NOTSTOCK are rejected, and credit calls are rejected from anyone but LpDesk or the PoolManager. Buyback is tested through a stand-in PoolManager at its fixed address. A minimum output equal to the output executes and one 1 wei above reverts. Amounts above the bucket and callers other than the operator revert, and the right to buy back follows an operator handover.
• LpGovernor: quorum at exactly 3% passes and 1 wei below fails. A tie fails, and so does a proposal with nothing staked. The 0.1% proposal threshold is checked at the boundary and 1 wei below. A stake made in the same block as a proposal has no weight, and stake moved to another account can't vote twice. The timeline is checked at every boundary (voting, veto window, execution, expiry). Execute works only once and rejects sent ETH. The veto works only once and follows an operator handover. The operator's and stakers' proposal slots are separate.
• PoolMath: tick bounds and out-of-range ticks; tick-to-price is strictly increasing; mulDiv matches plain arithmetic and works at full 256-bit width, with its overflow reverts. The price band holds at 0.5% in each direction, and the computed amounts never exceed what was given by more than 1 wei.

test/Invariants.t.sol (random call sequences, 64 runs × 500 calls each)

• Token: supply stays fixed and every token is held by a known address.
• Staking: the governor holds exactly the total staked, which equals the sum of all stakes. No staker gains or loses tokens. Past checkpoints never change after later stakes or unstakes.
• FirmVault and LpDesk IMD: every IMD sent in sits in exactly one place. The buyback bucket changes only through distribute and buyback and always has IMD behind it. The four shares stay equal. Calls that should be refused never succeed, and repeat distributions move nothing. NOTSTOCK sent to FirmVault only ever reaches Burner or the dead address, and LpDesk's NOTSTOCK is never touched.

Findings (all info-level, in .imd-findings.json; that file is ignored by git, so it won't show in git status):

1. For V3 and Aerodrome positions, the fee split uses the amount the position manager reports rather than LpDesk's actual balance change, which is what SPEC section 2 says. The two only differ for a fee-on-transfer or rebasing asset listed later.

The review is complete and written to .imd-findings.json with 5 findings and a coverage row for each of the 50 listed entry points. Nothing in the repository was changed apart from that file and my scratch tests under test/scratch/.

Findings, by severity

1. Medium. VenueV4 top-up and moveLiquidity break on pending fees. Uniswap v4 credits a position's accrued fees to the PositionManager during an increase, and VenueV4 settles with OPEN_DELTA. When a fee credit exceeds what the increase owes in a currency, the PositionManager reverts with DeltaNotNegative; that is always the case for the NOTSTOCK side of a single-sided top-up with any NOTSTOCK fee pending. When the fee credit is smaller, the fee silently pays for the increase and never reaches Burner, the project wallet or the baskets. Both behaviours were reproduced on a Robinhood Chain fork: the top-up reverted, and after a move the destination's pending fees produced zero at Burner and the project wallet. The existing fork suite only tops up a freshly opened position, so it never reaches this path.
2. Low, with proof. VenueV4.unlockCallback trusts the PoolManager address decoded from its own calldata. Any contract can pose as the PoolManager and make the module transfer whatever ERC-20 balance it holds. The proof test in test/scratch/SweepV4.t.sol fails on current code.
3. Low. LpDesk.buyback debits the full basket amount, but a V3/CL partial fill leaves the unswapped input in VenueV3. A buyback through the pool of a just-closed position succeeds with zero output and strands the whole amount.
4. Low. A v4 position emptied by moveLiquidity can never be collected or closed. Both calls revert with CannotUpdateEmptyPosition, reproduced on the fork.
5. Low. setOperator is a one-step handover with no recovery. A wrong non-zero address permanently disables all operator functions, FirmVault.buyback and the veto.

Coverage. 40 entry points hold, 10 carry a finding, none unreached. I traced the Execution Trace, Periphery and First Principles passes across LpDesk, FirmVault, GenesisSplitter, Burner, LaunchToken, LpGovernor, PriceGuard, both venue modules and PoolMath. The slither leads on reentrancy in distribute and bridgeOutFromGovernor and the incorrect-exp in mulDiv were checked and rejected as false positives. No launch.json exists in the tree yet, so there was no manifest to review.

Limits. Finding 1's reproduction needs the fork, so it carries no self-contained proof. The fork was reached through a local relay to the contributor's RPC, since foundry could not open loopback connections inside the sandbox directly.

Review complete. The findings file is written at .imd-findings.json with 12 findings and a 52-row coverage record (all 50 listed entry points answered, none unreached, plus two invariant rows). No source, config or manifest file was changed; only test/scratch/ holds the proof copies, which are not kept.

What I kept, after reproducing against the code

1. Medium. V3/CL buyback partial fill strands the unswapped input in VenueV3 while LpDesk zeroes the basket for the full amount. Three specialists reported this; merged into one. Both attached specialist proofs fail here (40e18 and 60e18 stranded). Proof attached.
2. Medium. VenueV4.increase settles with OPEN_DELTA, so v4 nets a position's pending fees into a top-up or move, skipping the 25/25/25/25 split, or reverts DeltaNotNegative. Two specialists merged. Traced through v4-core and v4-periphery; needs a fork, so no offline proof.
3. Low. VenueV4.unlockCallback trusts a caller-supplied PoolManager address. Three specialists merged. Proof attached and failing here. Bounded to balances the module holds at rest.
4. Low. moveLiquidity on a V3/CL source reverts with the published liquidity because collectFees burns 1 wei first.
5. Low. A v4 position emptied by moveLiquidity can never be collected or closed (CannotUpdateEmptyPosition).
6. Low. proposeOpenPosition checks amount against free NOTSTOCK even for an asset-only range.
7. Low, my own. launch.json writes $owner for both projectWallet slots although SPEC fixes that address as a literal. The rest of the manifest shape, names, argument order and byte sizes check out. 8 to 12. Info. One-step operator handover and the two governance trust notes recorded as trust assumptions, the price-band precision loss at unrealistic prices, V3 fee amount measured from the position manager's return value, and the fork-only coverage gap.

Dropped or recalibrated. Nothing was dropped outright. The operator handover was lowered from low to info because it is the specified design. Slither's incorrect-exp, reentrancy and divide-before-multiply leads did not reproduce as defects.

Caveat. The full existing test suite did not finish within the ten-minute command limit, so I did not observe its result. Via-IR compilation alone took about 155 seconds. The three proof tests and the build itself ran cleanly.

The revision is complete. Both reproducible findings are fixed, every advisory finding that reproduced is fixed too, and all 14 findings are answered in .imd-responses.json.

What was wrong and what changed

• Buyback partial fills (medium). The reviewer's proof failed on the starting tree exactly as reported. Both venue modules now return any input the pool did not take to LpDesk in the same call, and LpDesk.buyback debits the basket by its own balance change rather than by the requested amount. The module's return type is unchanged, so the uneditable proof compiles and now passes.
• v4 pending fees netted on increase (medium). Reproduced on a chain-4663 fork. increaseLiquidity and the destination side of moveLiquidity now collect and split the position's fees before adding to it.
• Advisory items fixed: VenueV4.unlockCallback authenticates against a stored pending PoolManager; moveLiquidity caps the request to the live liquidity after the fee poke; an emptied v4 position can be collected and closed; proposeOpenPosition checks the free balance of the token the amount denominates; the 0.5% band compares sqrt prices directly; V3/CL collected fees are measured as LpDesk's balance change.
• Trust notes (operator handover, governance slots and quorum) are documented in the README rather than changed, since SPEC.md fixes that design.
• The four module creation-code hash constants in LpDesk were updated, and the LpDesk and LpGovernor ABI exports regenerated.

Verification

Fork tests ran against this machine's chain-4663 endpoint through a loopback relay in test/scratch, since forge cannot use the sandbox proxy for localhost. The relay is scratch-only and not part of the deliverable.

Notes for the reviewer

• The audit-imported findings were already addressed in the accepted round (ADAPTATION.md 1 to 3) and their tests still pass. The responses file says so for each.
• Untracked dotfiles in the repository root (shell profiles, .idea, an empty .gitmodules) belong to the sandbox environment, not to this work. I did not touch them.
• No launch.json and no .imd-blocked.json were written. Nothing was committed.

The reviewer's finding (id 29171b0d…) was correct, and I've fixed it in launch.json. forge build succeeds, and forge test with the verifier's fuzz seed passes 42 tests with 0 failures and 15 skipped.

What was wrong: SPEC.md §1 says the project wallet must be the fixed address 0x3c587Eff6c96eAcF7E3dcC2CFf6416161386E48C. It is the projectWallet constructor argument for both LpDesk and FirmVault, it receives the 25% project shares, and it has "No other role". The manifest passed $owner for both slots instead. This launch's owner happens to be that same address, so the deployed result would be the same. But $owner only pins it if the launch's owner resolves to that address, and the contracts have no setter to correct it afterwards. Since this wallet is a payee rather than an owner role, writing the address SPEC.md gives is both allowed and more robust. It also matches how the manifest already writes the dev wallet.

What I changed:

• LpDesk's third constructor argument and FirmVault's first are now the lowercase address 0x3c587eff6c96eacf7e3dcc2cff6416161386e48c. Both constructors take plain address parameters, so this is valid.
• I updated the two places in notes that said "$owner" for the project wallet. The notes are now 2,142 characters, under the 4,000 limit.
• Nothing else changed: the contract names, their order, the number of arguments for each, the token and the pool fields are all as before. The diff is 3 lines in launch.json.

Responses file: .imd-responses.json answers the finding as fixed and says what I changed.

I've answered the advisory finding (88c4e64e) as fixed. It was a real gap in test coverage, not a bug in the contracts, so I only changed test/Fork.t.sol.

What I found

• After the review, the implementer had already added two fork tests: test_v4PendingFeesAreSplitBeforeMoveAndTopUp and test_v4EmptiedPositionCanBeClosed.
• Two cases were still untested. The v4 "move all of a position, then close it" test had no fees waiting on the position being emptied. And the Uniswap v3 and Aerodrome Slipstream venues had no test with fees waiting at all.

What I added (each case runs on the v4, v3 and Slipstream venues)

• test_wholeMoveWithPendingFeesThenClose: both positions earn fees from trades in both directions, then one is moved entirely into the other. The test checks:
  • each WETH fee is split into equal quarters: the project wallet, the top-up basket and the buyback basket each get exactly one quarter, and the rest stays free;
  • NOTSTOCK fees go only to the Burner;
  • the moved position ends with zero liquidity, and collecting and closing it moves nothing;
  • any later move to or from it reverts with PositionNotOpen;
  • the other position still closes, and the venue module ends holding no tokens.
• test_topUpWithPendingFees: a position earns fees in both currencies, then gets a top-up without collecting first. The test checks that the fees are split first and the basket is reduced by exactly what the position took (basket after == before + fee quarter − used). It also checks that WETH balances add up across the desk, the project wallet and the position, and that no NOTSTOCK is taken. I confirmed from the traces that every run actually reaches increaseLiquidity and doesn't skip it.

Test results

• Live, chain 4663 (block 112552967): all 21 fork tests pass (15 existing, 6 new). Forge won't route to the local RPC through the sandbox proxy, so I ran them through a small relay script I put in $TMPDIR; nothing about it is committed.
• Offline, with the verifier's fuzz seed: 109 passed, 0 failed, 21 skipped. The skips are the fork tests, which skip when there's no fork.
• The one failure while writing the tests was my own mistake. LpDesk rounds each fee split down separately, so I changed the check to add up the rounded quarters instead of taking a quarter of the total.

I didn't find any new contract defects, so there's no .imd-findings.json. The answer to the reviewer is in .imd-responses.json.

The exit code 1 is only the trailing grep finding no tracked changes, which is the intended state: the tree is unchanged apart from the report file. The report is written and valid.

Outcome: every finding from my first round is fixed, and nothing new reproduced. The report at .imd-findings.json holds an empty findings list and a coverage record answering all 50 entry points as holds, plus 11 settlement rows.

How each earlier finding was settled:

• V3/CL partial-fill buyback (medium). VenueV3.swapExactInToDead now measures its input balance before and after, reverts if the pool took more than the amount, and returns the rest to LpDesk in the same call. LpDesk.buyback debits the basket by its own balance change. All three attached proofs pass on this tree, and the live fork cases for V3 and v4 partial fills pass.
• v4 pending fees netted on increase or move (medium). LpDesk now collects and splits the position's fees before any top-up, and the destination's fees before a move. The live fork test confirms Burner and the project wallet receive at least three times the sibling's fees, and a top-up with fees pending in both currencies succeeds.
• VenueV4.unlockCallback trusting calldata (low). The module records the PoolManager before unlock and accepts only that caller. The attached proof passes.
• moveLiquidity stale liquidity (low). The source's liquidity is re-read after the collect and the request is capped. Live fork test passes.
• Emptied v4 position unclosable (low). VenueV4.collectFees returns zero at zero liquidity. Live fork test passes.
• proposeOpenPosition wrong token (low). The creation check now derives the token the amount denominates the same way LpDesk does.
• launch.json project wallet (low). Both constructor slots are now the literal address SPEC.md fixes. Names, argument counts and order, lowercase, pool fields and sizes re-checked.
• Trust notes, price band resolution, V3 fee measurement, fork coverage (info). README documents the one-step handover and governance consequences. The band check compares sqrt prices directly. V3 fees are LpDesk's balance change. The fork suite gained the pending-fee move and top-up cases on every venue.

Verification performed: offline suite green including the module code-hash test, ABI docs identical to the compiled ABIs for all nine contracts, and 16 of 21 fork tests run live on chain 4663 through the public RPC, all passing. The five fork tests not run concern paths unrelated to the settled findings.

Sources used for the RPC endpoint: Bitquery Robinhood Chain reference, QuickNode Robinhood Chain public RPC.

Implemented the frontend, static export, deployment manifest, and validation evidence. Build/typecheck, interaction and fork checks passed; design probe passed 16/16. Added files total 4.6 MB. Design documentation is at docs/DESIGN.md within the allowed scope.

Commit creation was blocked: Git reported .git/index.lock: Read-only file system. All deliverable files remain ready in the workspace.

Saved the findings, exact source citations, fixes and reproductions in .imd-findings.json.

1. Accessibility: Skip to content changes pages. From Burn or LP Desk, activating it navigates to Home. Focus the current main content while preserving the route.
2. Bug: late quotes invalidate transaction previews. At 390px, changing 10 IMD to 20 during a delayed quote produced a review saying “Spend 20 IMD” while calldata spent 10. Buybacks also accepted a minimum calculated before an amount edit. Discard responses whose inputs have changed.
3. Bug: one unreadable listed asset disables every page. Adding an allowed address without token metadata prevents the entire snapshot from loading, including independent Burner balances and actions. Isolate asset failures and replace the misleading RPC connection error with a scoped asset error.

Independent checks passed: isolated source build/typecheck, 10 unit tests, 33 browser checks and 6 boundary checks. All 25 exported assets passed hash verification; all nine ABIs match the pinned source. WebKit could not launch because required system libraries were missing. The supplied fork evidence was reviewed but not rerun.

Not Firm is a treasury and governance app carried visually by the suited frog and restrained green financial controls.