The review is complete. The findings are in .imd-findings.json at the repository root, no source files were changed, and my scratch tests were removed.

Verdict: no defects in the contracts themselves. FrenRenderer and the chunks behave as the brief describes. I found one low-severity test problem and several informational notes.

What I verified

• The offline suite passes, 8 of 8 tests.
• Chunks 1 to 4 on Ethereum mainnet at the brief's addresses have exactly the code sizes and keccak256 hashes that FrenArtIndex stores. The mainnet fork test passes against a public RPC.
• A scratch test compared canvas and pendingURI against the vendored reference renderer across every one of the 69 layers, every trait value and 40 seeds. All output was byte for byte identical.
• FrenRenderer's runtime passes the protected forbidden-opcode scan. It has no owner, no storage writes, no state-changing functions, no proxy, initializer, DELEGATECALL, CALLCODE or SELFDESTRUCT.
• The constructor only stores addresses and deploys on a chain without the earlier chunks. Every read goes through the code-hash check, and the framed-read arithmetic for chunks 4 and 7 matches the generator.

Findings written

• Low: test_LaunchesFitTransactions is vacuous under forge 1.8.3. It logs about 1.3M gas for launch 3, while a local deployment costs about 14.2M and the two mainnet launches used 11.3M and 10.6M. Launch 3 still fits the 16.8M cap at roughly 85 to 87 percent, but the test cannot catch an overflow of it.
• Info: pendingURI costs about 25.5M gas per eth_call and tokenURI 9 to 10.3M, which some RPC endpoints cap below.
• Info: the renderer's NatSpec and the CHUNK_SIZES comment describe checks the code no longer performs, and the derive script regenerates the stale text.
• Info: the repo's admission-scan test skips FrenRenderer, which the protected harness does scan.
• Info: the README names the IMD6900Frens contract at an address with no code on mainnet, Base or Arbitrum, so the consumer interface could not be verified on chain.
• Info: a coverage statement listing what was read, what was verified, and what was unreachable: the frens contract, the launch policy gas ceiling, and compiler builds other than solc 0.8.26.

Implemented launch-3 preparation, preserving the art, index, argument order, and renderer behavior.

• forge build: passed.
• forge test: 9 passed; 2 optional fork suites skipped.
• Protected harness: passed.
• Local CREATE2 rehearsal: 14,179,144 gas, below the limit with a 5% reserve.

ADAPTATION.md documents every change, audit disposition, and remaining integration check.

The review is complete and the findings file holds an empty list. Nothing in the assigned area produced a substantiated defect.

What I checked and verified

• Permission surface. The three chunk contracts and the renderer have no owner, no role, no initializer, no receive or fallback, no payable function, no msg.sender read, and no DELEGATECALL or SELFDESTRUCT. Every renderer function is view or pure. The constructor only stores seven immutables and reads nothing, so the factory being msg.sender traps nothing. There is no writer of any storage slot after deployment, so the inconsistent-guard, escalation and unprotected-init checks from the Access Control guide have no target.
• Trust boundary on the constructor inputs. The only trust the renderer places is in the seven addresses, and _entry at src/FrenRenderer.sol:354 rejects any chunk whose full code hash is not the pinned one before copying a byte. A wrong, empty, swapped or copied-and-altered chunk reverts BadArt on every read. The local suite confirms this for swapped and stranger addresses and for a fresh chain where chunks 1–4 are absent.
• The four static mainnet addresses. I fetched the code at all four from a public Ethereum RPC and hashed it. All four hashes match FrenArtIndex.CHUNK_HASHES byte for byte, with code sizes 24001, 24139, 23479 and 21187. I also ran the fork test against mainnet and it passed, so the renderer deployed with these arguments draws the reference art.
• Asymmetry. The paired surfaces are revealed vs pending rendering, framed vs unframed chunk reads, and canvas vs _fren slot computation. Validation sits in canvas and _fren before any index read, and the unrevealed path generates only in-range combos. Both read branches bound their copy by the pinned hash and a length check. The byte-for-byte reference comparison tests pass for both URI paths.
• Static analysis leads. The uninitialized locals are intentional zero starts, and the divide-before-multiply is the 32-to-33 frame alignment, which I checked satisfies off % 32 + len <= frames * 32 for every offset and length. None is a defect.

Coverage rows

Notes that are not findings. The length checks reverting Missing inside _entry are unreachable once the hash matches, which is harmless redundancy. The roughly 25.5M gas cost of pendingURI is already documented by the earlier audit and the README and is outside my area. The protected harness was not re-run here. Launch 3 has no manifest in the tree yet, so the $contract references could only be checked against the README recipe, which matches the brief.

Created launch.json with the exact deployment order and constructor arguments.

Validation and forge build passed. forge test: 9 passed, 0 failed, 2 fork checks skipped.

Only launch.json changed outside scratch artifacts.

The review is complete. The findings file is written and valid, the scratch tests are removed, and the tree has no stray files (the findings file is ignored by a global rule, which is why plain status shows nothing).

Outcome: the math in the renderer holds. One info-level note was recorded, no defects of medium severity or above.

What I checked in my area (Math Precision, Boundary, Numerical Gap)

• Index decoding and framed reads. Decoded all 70 index entries. Every entry sits inside its chunk, and for the two framed chunks the computed frame bounds land exactly on the chunk code sizes. The divide-before-multiply slither flagged is correct block arithmetic.
• Drawing math. Clamping of runs to the canvas, signed offsets, and row bounds are safe. Every layer file is well-formed: rows sum exactly to their width, no zero-count runs, data consumed exactly. All ten backgrounds are 120x120 at the origin, so the 37-value window fully covers the 84-pixel canvas.
• Bitmap header and grey conversion. Header fields fit their byte widths. Luminance never exceeds 255 and the dimming cannot overflow.
• Byte-equality sweep. Every face of every character, every coat, hat, item and background, plus extreme seeds and token ids, matched the vendored reference renderer byte for byte.
• Out-of-art combos. Every out-of-range field value reverts with Missing as intended.
• Gas boundary. All 2222 token ids render pendingURI under 30M in isolated call frames. The worst is about 26.95M. An earlier 37M reading was my own harness's memory growth, not the renderer.
• External boundary. The four deployed mainnet chunks carry exactly the code hashes the index demands, and the repository's fork test passes against them.

Finding recorded (info): combo bit 23 is outside the trait layout and is silently ignored, so combos 0x3AAD91 and 0xBAAD91 render identically. The reference renderer behaves the same, so it is a shared property rather than a regression.

Coverage rows: constructor, tokenURI, pendingURI, unrevealed, attributes, bmp, canvas all holds; the chunk constructors holds (return the literal art, hashes match). The slither uninitialized-local and missing-zero-check leads are intentional and not defects. Nothing in my area was left unreached. The launch gas script needs python3, which this worker lacks, so I did not rerun it.

Added deployment, art-integrity, corruption, invalid-input, reference-rendering, and ETH invariant tests. All changes are under test/.

• forge build: passed; existing lint warnings remain.
• forge test: 22 passed, 0 failed, 2 optional fork suites skipped.
• Invariants: 6,144 calls, zero handler reverts.

No new defects reproduced.

The findings file is in place and excluded by the harness's own exclude list, which is why the tree reads clean. Scratch files are gone. Nothing else is needed.

Review result

I found no correctness or safety defect in the launch-3 control flow. The findings file holds one low and one info item, both with reproductions.

What I verified

• Chunk hashes on mainnet. All four static constructor addresses hold code whose keccak matches the index's hash table exactly (sizes 24001, 24139, 23479, 21187 bytes), fetched through a public RPC. The renderer's four static arguments are therefore correct for Ethereum.
• Read path. The index decoding in _entry, the framed-chunk unframing arithmetic, the exact end-of-code boundary for chunk 7's palette, and every index into the tables and face table are bounded by the combo checks in canvas and _fren. Outputs match the reference renderer byte for byte in the existing tests.
• Fresh-chain deploy. The constructor only stores addresses. With the earlier chunks absent, every read reverts BadArt, as the existing test shows.
• Compiler independence. The hash check, admission scan and reference equality pass under solc 0.8.26, 0.8.30 and 0.8.37. The renderer embeds its constants as PUSH32 data, so the forbidden-opcode walk cannot land on hash bytes regardless of layout.
• Slither leads. Divide-before-multiply is the intended frame arithmetic. The uninitialized locals are deliberate zeros. The missing zero checks are required by the fresh-chain deploy. None is a finding.

Findings

1. Low. pendingURI costs 23.9M to 26.95M gas across all 2222 ids, above the 2^24 per-transaction cap for every id and above 25M for 1990 ids. It can only be served by eth_call with a large allowance. The README documents the sample; this adds the full range and the transaction-cap consequence.
2. Info. The public attributes function returns empty trait names for combos outside the art while canvas reverts. The reference behaves the same.

Coverage

Not reached: the deployment service's real factory overhead against the gas ceiling, which only its simulation can confirm.

The review is complete. .imd-findings.json holds two informational findings and no defects of low severity or higher. No tracked file was changed, and the scratch tests were removed.

Outcome. Within the Economic Security, Invariant and Flow Gap guides, launch 3 as specified is sound. The renderer holds no funds, has no owner, makes no external calls other than code reads, and fails closed on any chunk whose code hash differs. The main economic risk for this kind of contract is a permanently broken dependency, and I verified that it does not exist here.

What I verified

• Live mainnet chunks 1 to 4. Over a public RPC, the four static addresses in the brief have exactly the code hashes and sizes in FrenArtIndex.CHUNK_HASHES. The mainnet fork test also passed against them.
• Art integrity. I regenerated the index, framing flags, size and hash tables, and all seven chunk byte strings from the art data independently. All match the committed sources byte for byte. Every one of the 69 layers has well-formed run-length data, and every index entry lies inside its chunk.
• Exhaustive rendering. Every character, face, eye, coat, shirt, hat and item value draws. All 10 backgrounds draw at all 1,369 window offsets. All 2,222 token ids render pendingURI. No valid input reverts.
• Launch 3 itself. The protected admission test passed with the exact four initcodes and predicted CREATE2 addresses. The local Anvil receipt check used 14.18M gas against the 16.78M cap. A one-byte-different chunk is refused on every palette-bearing read.
• Slither leads. All eleven were checked and rejected. The divide-before-multiply is intentional frame arithmetic verified by the reference tests. The uninitialized locals are intentional zeros. Missing zero-checks only make a misdeployed renderer fail closed with BadArt.

The two informational findings

• pendingURI gas ceiling. The collection-wide maximum is 26.93M gas at token 1985, so it fails under a 26M eth_call cap while the README's sample id 1 passes. 1,965 of 2,222 ids exceed 25M. None exceed 30M. This refines the README's documented integration limit rather than changing code.
• Combo bit 23 is ignored. Combos 1779030 and 10167638 render identically with identical attributes, while other out-of-range trait values revert. The reference renderer behaves the same and byte equivalence is required, so this is a note for the consumer to mask bit 23 before storing combos.

Coverage. All entry points traced and holding: constructor, tokenURI, pendingURI, unrevealed, attributes, bmp, canvas, and the chunk constructors. Nothing in my area was left unreached. Not verifiable here: the deployer's real factory overhead and policy gas ceiling, and the not-yet-deployed consumer contract.

The findings file is in place and excluded from git by the harness, the scratch test is removed, and the working tree has no other changes. The review is complete.

Outcome. Three findings, none above low, written to .imd-findings.json. No critical or high finding exists, so no proof test was attached. The launch is sound as specified.

Specialist findings, settled.

• pendingURI gas (low, merged from audit_flow and audit_economics). Reproduced with a fresh-frame meter over all 2222 ids on forge 1.8.3 / solc 0.8.26. Worst case is token 1985 at 26,929,208 gas, minimum 23,900,005, 1965 ids above 25M, none above 27M, and every id above the 2^24 transaction cap. The README's 25.5M sample is therefore not the ceiling. The only actionable item is the README's RPC guidance, since the output must stay byte-identical to the reference.
• Combo bit 23 ignored (info, merged from audit_math and audit_economics). Reproduced: tokenURI, canvas and attributes are identical for a combo with and without bit 23, while background 10 reverts. Shared with the reference renderer, so the consumer must mask it, not this launch.
• attributes() returns empty names (info, audit_flow). Reproduced: face index 13 yields an empty Face value while canvas reverts Missing. Same in the reference.

Static-analysis leads. The divide-before-multiply in the framed read is exact frame arithmetic. The uninitialized locals are intentional zero defaults. The missing zero checks are by design and covered by the all-zero-addresses test.

My own pass, with evidence.

• The four static addresses in the manifest resolve on Ethereum to code hashes matching FrenArtIndex exactly. I checked them with cast against a public RPC, and the mainnet fork test drew every reference bitmap through them.
• The local Anvil launch rehearsal reproduced 14,179,144 gas for the whole launch, under the 2^24 cap with a 2.6M margin. The deployer's own factory overhead and policy ceiling remain its check.
• The manifest matches the brief in contract order, argument order and checksummed addresses. All 22 offline tests pass.
• Entry points: constructor, tokenURI, pendingURI, unrevealed, bmp, canvas, attributes and the immutable getters all hold. The renderer has no storage, owner, payable path, external call or forbidden opcode, and every art read authenticates the full chunk code hash before copying. The framed read of chunk 7 is bounds-exact by construction and verified by the palette test at an unaligned offset.

Not verified. The deployment service's exact gas ceiling and the intended consumer contract, which the README already marks as unverified.