Committed as 7e2aa24. Build, 49 tests with the verifier's fuzz seed, and forge fmt --check all pass.

Delivered (five of the six SPEC.md application contracts plus the token, all with tests):

• src/LaunchToken.sol: "(p)IMD" / "pIMD", 18 decimals, 10^27 minted to the deployer, no admin functions.
• src/PimdRegistry.sol: the verified v1 source with exactly the three spec changes (no IMD path check, no open-pairs limit, asset admin replaces the owner and can hand the role on).
• src/BoundaryOracle.sol: the verified v1 source unchanged except imports; the fixed verifier is reached through an interface.
• src/PimdAbove.sol: USDC-only above markets with four books per market, fee-inside-lock semantics, mint/move/burn fills, sub-minimum rest refund, expiry, settlement with tie and 3-day void, admin rates capped at 0.10 / 0.05. The spec's Vika/Bob example reproduces to 4 decimals.
• src/StartOracle.sol: start prices 27 h or later through INTAKE, one question per hop, same attestation checks and signer as BoundaryOracle, failure frees the slot.
• src/PimdSwap2.sol: exact-output v4 path swaps in both directions inside one unlock.
• OpenZeppelin v5 vendored under src/vendor as plain files (lib/ and remappings are protected). ABIs in docs/abi/, README with roles, deploy order, constructor arguments and operations, ADAPTATION.md listing each deviation.

Not delivered: PimdMarkets2 (Up/Down markets, SPEC.md section 6). It is a second full orderbook with swap-funded fills, strike activation and token-denominated DOWN books, and it did not fit the time budget of this run. Its dependencies (PimdSwap2, StartOracle, the oracle and registry) are ready. The launch manifest cannot list the six contracts of section 2 until it exists, and ADAPTATION.md and the README say so plainly.

Assumptions the review should check

• Tests use mocks etched at the fixed mainnet addresses and chain id 1 instead of a mainnet fork, because the verifier runs offline. A live fork run is still owed before launch.
• The v1 sources came from the verified bundles of BoundaryOracle and PimdMarkets v1 on the public explorer, since PimdRegistry v1 itself is not verified separately. Its code matched in both bundles.
• PimdAbove thresholds use the BoundaryOracle price scale (USD per U tokens, 18 decimals).

The manifest is written, validated against the compiled ABIs, and the build and all tests pass. Only launch.json is new in the working tree.

What launch.json contains

• Token: LaunchToken, name "(p)IMD", symbol "pIMD", 18 decimals, no constructor arguments, exactly as the source file sets them.
• Five application contracts in SPEC.md deploy order, each argument matching the compiled constructor in type and position:
  • PimdRegistry takes the admin wallet SPEC.md names as asset admin.
  • BoundaryOracle takes the registry reference and the fixed mainnet BoundaryProofVerifier address from SPEC.md. The constructor stores it without calling it, so it runs on an empty chain.
  • PimdAbove takes the registry, the oracle, the SPEC.md admin wallet, and "$owner" as the fee recipient.
  • StartOracle takes the registry and the oracle.
  • PimdSwap2 takes the registry.
• Pool: paired currency IMD, fee 12500, tickSpacing 60, initialPrice as the "This launch" section gives them.
• Notes: 1539 characters describing each constructor argument and the roles it grants.

One thing to flag. SPEC.md lists six contracts, but PimdMarkets2 is not in the accepted tree. The README and ADAPTATION.md both record it as not yet implemented. The brief says to describe only contracts actually present, so the manifest lists five and the notes state that PimdMarkets2 must be added once a later build delivers it.

Verification

Check	Result
forge build	ok
forge test with the verifier's fuzz seed	49 passed, 0 failed
Scratch manifest check against out/ ABIs	ok
Files changed	launch.json only

The scratch check confirmed the schema keys, lowercase addresses, unique names under 32 characters, backward-only contract references in address-typed slots, no zero addresses, and the token name and symbol against the source.

The review is complete. .imd-findings.json holds three findings and a 34-row coverage record. No repository file was modified; the only new paths are the findings file and my scratch tests under test/scratch/, which are not kept.

Findings

1. High. Resting taker buy closed at the 1024-fill cap forfeits unfilled principal to the matchMarket caller. _close in src/PimdAbove.sol:601 hands the whole remaining lock to refundTo once an order has any fill, and _afterFill passes msg.sender for the taker side both on full fill and at the fill cap. A later-placed bid that rests after 64 fills and is then matched by a third party to 1,024 fills loses the lock of every unfilled share. Reproduced with a scratch proof test: the victim bid 20,000 YES at 0.5, received 10,240 shares, and the matcher was credited 8,384 USDC, of which 4,880 USDC was principal for shares never bought. The proof test fails on the current code and is embedded in the finding.

2. Low. Buy and sell gap rules are asymmetric. The spec sends a taker's over-limit sell proceeds to the transaction sender, but src/PimdAbove.sol:520-522 credits the full proceeds to the seller. In the scratch run a third-party matcher received nothing while the seller kept 29.10 USDC on 59.7 shares sold at 0.5 against a 0.1 limit.

3. Low, outside my area. settle at exactly end + 3 days voids a market to Half while an unchallenged proposal made in the last accepted second is still finalizable, because VOID_DELAY equals the oracle TIMEOUT. Verified by scratch test: settle first, then finalize records 3.5 above the 3.0 threshold, but the market stays Half.

Coverage. All 34 entry points have rows: 31 hold, 3 point at findings, none unreached. Access control across PimdRegistry, BoundaryOracle, StartOracle, PimdSwap2 and the admin paths of PimdAbove traced clean: every guard matches its effect, callbacks are INTAKE- or MANAGER-only, the self-call into requestResolution is properly restricted, and constructors take explicit admin and owner arguments rather than msg.sender. Single-step admin handover is the specified design and is noted as such, not as a defect.

Not reached in depth. The PimdMarkets2 contract is absent from this commit, as ADAPTATION.md states, so the Up/Down market permissions could not be reviewed. No launch.json exists yet, so manifest constructor arguments were checked only against the README table.

The math review is complete. .imd-findings.json holds 5 findings and 37 coverage rows, one for each of the 34 listed entry points plus three invariants I checked. No source file was changed, and the scratch tests I used to measure were deleted.

Findings (all reproduced on this code with Foundry; none reach critical or high, so no proof files were required)

1. Medium, PimdAbove.claim: it loops over every order the trader ever placed in the market, and the array is never pruned. Measured on this code, 8,000 closed orders cost 25.8M gas to scan and 8,000 still-resting orders cost 203M gas. A market maker with roughly 11,000 lifetime orders in one market, or about 1,400 open at settlement, can never redeem winning shares, since claim is the only redemption path after settlement.
2. Low, _underMin for buys: it checks the remaining lock, not remaining shares times price. A buy of 10 YES at 0.9 that fills 9.9 at 0.11 keeps resting with 0.1 share wanted and 7.86 USDC locked. The spec says a rest under 1 USDC is cancelled and refunded in that transaction.
3. Low, _insert: the price level is walked linearly. 2,000 resting orders at one price make the next insert at that price cost 9.77M gas, so a few thousand 1-USDC orders block that level and worse levels on one side of a market. Matching and better-priced orders are unaffected.
4. Low, threshold scale: the threshold is documented as USD per token but compared with the oracle's USD per unitsPerShare. For a version with U of 10,000 YOLO, a threshold written per token resolves a tie as YES.
5. Info, rounding dust: move fills round the buyer up and the seller down, leaving 1 USDC unit per non-integral fill in the contract. Half claims floor odd totals. Direction is safe for solvency.

What holds: the fee formulas, _affordable (I showed its loop never iterates), mint and burn conservation, the oracle value chain across hops, the calendar month math, the v4 delta decoding and price limits in PimdSwap2, and the oracle time windows. The existing 49 project tests also pass.

Not covered: PimdMarkets2 is absent from this commit, the fixed mainnet verifier and intake are external, and no launch.json exists yet to review.

The untracked entries git lists are the sandbox's own dotfiles (device nodes, .claude/), not files I created. The findings file and test/scratch/ are ignored by git, and no tracked source, test, or configuration file was modified. The review is complete.

Economics review of the pIMD launch contracts

Findings are in .imd-findings.json with 38 coverage rows covering all 34 listed entry points plus three invariants and one dropped lead. Build and the existing 49 tests pass.

Findings (6)

1. Medium, with proof. Orders still fill after BoundaryOracle holds the close but before anyone calls settle(). An informed trader does prove, place, settle and claim in one transaction and picks off every resting maker at their price. In the scratch test Bob turns 1000 USDC into 1047.5 against Alice's resting ask of 100 YES at 0.50. The fix is to settle or refuse in place, matchMarket, split and merge once the oracle price exists for the market's end.

2. Medium, with proof. claim() walks every order id the caller ever placed in that market, and the array is never pruned. Measured cost is about 3.2k gas per past order, so a market maker who placed roughly 9,300 orders in one market can no longer redeem winning shares in a 30M-gas block, and no other function redeems them. The proof places and cancels 12,000 orders and shows claim reverting.

3. Low. The sell-side taker gap is credited to the taker instead of the transaction sender, contradicting the spec's rule for match callers. Measured: after a 64-step fill leaves a crossed sell, Carol's matchMarket earns 0 while Bob receives the full 0.90 proceeds.

4. Low. _settle locks Half at end + 3 days even when an unchallenged proposal is finalizable in the same block, so a loser can front-run finalize with settle.

5. Low. StartOracle.request has no timeout for an open slot. An attestation that arrives expired or with a mismatched anchor reverts the callback, and if the intake never reports failure the strike for that version and boundary is blocked forever.

6. Info. A dispute lodged seconds before a late proposal's deadline guarantees an oracle timeout and refunds both bonds, voiding the market for the cost of one oracle fee. This is v1 BoundaryOracle behavior the spec fixes, recorded as a trust assumption.

Holds. USDC conservation through split, merge, mint, burn and move fills, share conservation per market, the 2×BOND split in dispute resolution, the exact-delta deposit checks, the PimdSwap2 escrow and LaunchToken. The _affordable loop lead was brute-forced and dropped: it never iterates.

Not reached. No mainnet fork run, so the live verifier, INTAKE and PoolManager behavior behind the mocks is untested. PimdMarkets2 is not in the tree, so the Up/Down economics and the consumer of StartOracle strikes could not be reviewed.

Review complete. The findings are in .imd-findings.json at the repository root, all tracked files are unchanged, and the only new files are the findings file and three scratch tests under test/scratch/.

What I found

• High: fill-cap close gives away a buyer's unfilled lock. In src/PimdAbove.sol line 601, a buy order closed with reason 0 and at least one prior fill refunds its whole remaining lock to the transaction sender. When a resting limit buy reaches the 1024-fill cap during someone else's matchMarket or place, that caller receives the collateral for shares the order never bought. In the proof, Carol (no deposit) collected 4,275 USDC of Bob's 6,000 USDC lock while the legitimate limit-versus-fill gap was 118 USDC. The same routing sends a resting taker's sub-minimum rest to the match caller. The proof test fails on the current code and passes with a one-line fix I verified and then reverted.
• Low: sell-side gap goes to the trader. A taker sell matched by a third party keeps its proceeds above its limit, where SPEC §5 sends that surplus to the transaction sender. Confirmed with concrete numbers.
• Low: settle versus finalize race. At end plus three days, settle voids the market to Half while an unchallenged proposal is still finalizable. Confirmed: outcome Half, oracle price recorded one call later and unused.
• Low: StartOracle has no timeout. An intake that accepts a request but never calls back leaves the slot open forever, blocking all later requests for that version and boundary. BoundaryOracle has a timeout backstop; StartOracle does not.

Coverage

All 34 verifier entry points have a row. 33 are answered: 28 hold, 5 carry a finding. Four extra rows cover the USDC conservation invariant, Calendar and Registry bounds, the OracleRequest encoders, and the absent launch.json, which is marked unreached because PimdMarkets2 is not in this commit and the manifest step has not run.

Static analysis leads

The slither and aderyn lines on vendored OpenZeppelin, uninitialized locals, boolean constants in mapping keys, and the Swap2 and oracle reentrancy are all guarded or intentional. None became findings.

Not reached

PimdMarkets2 does not exist yet, so the Up/Down market flows, the swap-inside-fill path, and the manifest could not be reviewed. A fork run against the live INTAKE, verifier, and PoolManager remains open, as ADAPTATION.md already states.

The review is complete. The findings file at the repository root holds 10 findings and a coverage row for all 34 entry points plus two invariants, with no row left unreached. No repository file was changed; only test/scratch and the findings file were written.

What the specialists reported, after reproduction

• High, kept and merged (3 reports, 3 proofs). A resting taker buy's entire remaining lock goes to whoever calls matchMarket when the order closes at the 1,024-fill cap or under the minimum. The root cause is one line in the close routine that treats any non-cancel, non-expiry close of a filled buy as "gap to the caller". All three supplied proofs fail as described. The attached proof shows a third party who never deposited receiving 4,275 USDC of a 6,000 USDC lock.
• Medium, kept and merged (2 reports). Claim walks every order the trader ever placed. Measured 9.7M gas after 3,000 cancelled orders, so an active market maker's winnings become unredeemable.
• Low, kept and merged. Sub-minimum buy rests keep resting because the check uses the lock instead of remaining shares times price. Sell-side taker gap is paid to the seller, never to the match caller. Settle can void a market to Half in the same block a late proposal becomes finalizable. StartOracle has no way to reopen a slot the intake never answers. The threshold is compared against USD per unitsPerShare, which only equals "per token" for version 1.
• Downgraded to info. Trading against an already-recorded close reproduces, but it is a consequence of the spec rule that trading continues until settlement, and the exposure exists from the end boundary regardless of recording. The last-second dispute forcing a timeout is a trust assumption of the fixed v1 oracle. Move-fill rounding dust is one unit per fill in the contract's favour.
• Dropped. Linear orderbook insertion cost, because the README lists it as a known limitation and the workflow makes those accepted rules.

My own pass found nothing beyond the specialists' set. Every runtime is under the size limit, no constructor makes an external call, and the manifest matches the accepted source. The static-analysis leads were either vendored OpenZeppelin patterns, false positives on boolean mapping keys, or guarded reentrancy paths.

Worth noting for the requester outside the findings: PimdMarkets2 from SPEC section 6 is not in this tree. It is documented in ADAPTATION.md and the README as a known limitation, so it is not a finding here, but the launch is incomplete against the spec until it ships.

Revision complete. Both reopened findings reproduced and are fixed, the reviewer's proof now passes, and all ten findings are answered in .imd-responses.json.

What I verified first

• The supplied proof failed on the starting tree exactly as reported: the match caller received 4,275 USDC of bob's lock. After the fix it passes.
• The other findings were confirmed by reading the code paths they cite and by writing a regression test for each.

Code changes

• src/PimdAbove.sol: the taker's gap is now settled inside each fill and paid to the transaction sender for that fill only. On a buy it is the limit cost minus the actual cost, taken out of the lock. On a sell it is net proceeds over the limit, with the fee taken from the surplus first. A closing buy's unspent lock always returns to its owner, so the old refund-recipient parameter is gone. A buy rest is also judged by remaining shares times price. Closed orders are swap-and-popped out of the trader's list, so claim and ordersOf see live orders only. Before voiding a market at end plus three days, settle finalizes an unchallenged BoundaryOracle proposal whose window has elapsed and uses its close. The threshold unit is documented as BoundaryOracle's scale.
• src/StartOracle.sol: an open request older than REQUEST_TTL (86,400 s) can be replaced; the old questions are voided and a StartExpired event is emitted.
• BoundaryOracle is untouched, as SPEC.md fixes it to the v1 code.

Tests and docs

• Eight new tests across test/PimdAbove.t.sol and test/StartOracle.t.sol, one per finding, including the 1024-fill cap scenario, conservation checks, the settle-versus-finalize race and the disputed-timeout path.
• README gained the per-fill gap rule, the threshold unit, operator guidance on prompt proposals and makers cancelling at the end, and the rounding-dust limitation. ADAPTATION.md lists items 5 to 9 for each deviation.
• docs/abi/StartOracle.json regenerated; PimdAbove's ABI is unchanged.

Check results

Check	Result
forge build (solc 0.8.26)	ok
forge test with the verifier's fuzz seed	58 passed, 0 failed
forge fmt --check on src and test	ok

The informational findings on after-end fills, the late-dispute trust assumption and the one-unit rounding dust are answered as documented behaviour rather than code changes, with the reasons given in the responses file.

I didn't change any files. The fork tests pass at the pinned block, and the failed check came from the RPC endpoint, not from the tests.

What the check reported: 1 of 109 RPC calls failed, on the method eth_getAccountInfo. That call comes from forge itself, not from the tests. Forge tries eth_getAccountInfo once, gets "method not available", and switches to ordinary per-field reads (eth_getBalance, eth_getCode and so on). No test file can turn that probe off.

What I found by running the tests myself:

• My shell can't reach the endpoint directly, so I put a small temporary relay in $TMPDIR (not committed) to pass forge's calls through the sandbox proxy.
• First run: setup failed because the endpoint answered historical state … is not available for block 26370890. Its provider had briefly lost archive state, which matches the check's own wording ("An endpoint without archive state cannot serve block 26370890").
• Second run, a minute later: all 13 tests in test/fork/MainnetFork.t.sol passed at block 26370890, over 112 calls. The only errors were forge's own probes (eth_getAccountInfo and anvil_nodeInfo), and forge recovered from both.
• Offline suite with the verifier's fuzz seed: all 95 non-fork tests pass, including the invariant suites. With MAINNET_RPC_URL set as given, the fork suite can't connect from my shell ("Operation not permitted" on the socket); that's the sandbox, not the tests.

The fork tests already follow the rules: they read MAINNET_RPC_URL with vm.envOr, fork exactly block 26370890, and skip only when the variable is empty. Changing the tests wouldn't fix anything; the check should pass once it runs against an endpoint that serves archive state for that block.

I filed no new findings and didn't write .imd-findings.json.

The manifest at launch.json is complete and verified, and this revision needed no change to it. The brief listed no findings, and the accepted tree has not moved in any way the manifest describes.

What I checked

• Constructors match. The other contributor's latest commit changed PimdAbove and StartOracle behavior but left every constructor signature intact. Each ABI export in docs/abi records the same address-typed parameter lists the manifest fills, in the same order.
• Values match the launch. Token name "(p)IMD", symbol "pIMD" and 18 decimals come from the token source. The pool block carries the IMD pair address, fee 12500, tick spacing 60 and the one-to-one initial price exactly as the "This launch" section gives them.
• Schema rules hold. A scratch validator confirmed only the five allowed top-level keys, unique names under 32 characters, backward-only contract references, lowercase addresses, no zero address, string arguments, and notes well under the 4000-character limit.
• Privileged roles are as described. The admin wallet in PimdRegistry and PimdAbove is the one SPEC.md fixes. The launch owner enters only through the $owner argument of PimdAbove, where it is just the fee recipient.
• Build and tests pass. The full suite ran with the pinned fuzz seed.

Check	Result
forge build	ok
forge test, 6 suites	57 passed, 0 failed
manifest validator	OK, 5 contracts listed

Left as is

PimdMarkets2 from SPEC.md section 6 is still absent from the accepted tree, so the manifest continues to list five application contracts and says so in its notes. A later build that adds it must extend the manifest. No file other than the scratch validator was touched, and the working tree is clean.

The review is complete. Every finding from my earlier round is settled as fixed, and I found no new defect, so .imd-findings.json holds an empty findings list with a 38-row coverage record covering all 34 entry points.

What I verified on the revised tree

• Fill-cap and gap routing (high, 8904774a): fixed. The per-fill gap now goes to the transaction sender inside _fill, and _close returns a buy's unspent lock to its trader for every reason. Both supplied fill-cap proofs pass. My own 1,025-ask probe confirms the owner keeps the lock of the 6,928 unbought shares, short only of the fees the design places inside the lock, and the matcher gets gaps only.
• Claim walks every past order (medium, c5e99df8): fixed by swap-and-pop on close. The supplied proof with 12,000 placed-and-cancelled orders passes, and my two-market probe shows the other market's list is untouched.
• Buy rest under the minimum (a5389dc1), sell-side gap (8961590e), settle versus late finalize (1d8da67f), StartOracle request timeout (dfb118e4): each fix traced and exercised by the author's tests. The settle fix calls oracle.finalize only for an unfinished, unchallenged proposal at end + 3 days, when its deadline has necessarily passed, so the call cannot revert.
• Documentation-only items (threshold unit, fills until settlement, late-dispute timeout, move-fill dust) are in README and ADAPTATION as the findings allowed. The pick-off proof from audit_economics still fails, which is the intended behaviour under SPEC.md section 5.
• The full suite passes (95 tests, six invariants with a third-party matcher), and every ABI file in docs/abi matches the compiled ABI.

Two of my own probe assertions failed at first, both from my expectations rather than the code: a 0.7-share rest correctly closed under the minimum with its lock refunded to the owner, and cancel correctly refused on that already-closed order. The scratch directory is removed and the tree is clean apart from the findings file.

Area	Count / result
Requirements	33 met, 1 missing, 0 faked, 5 need requester, 1 after review
Broken features	1
First screen, 390px	Product visible; order action below fold
taste@1	15/16 via CDP
Copy findings	1
Share card	Present; 5/5 metadata checks

Recorded 4 findings: 1 high, 2 medium, 1 low in .imd-findings.json.

• High, fidelity: market-board rows omit required Yes/No prices.
• Medium, fidelity: wrapped navigation pushes the connected order action below 390×844.
• Medium, bug: confirmed transactions claim “Balances refreshed” when refetches failed.
• Low, taste: currency units inherit overly tight balance tracking.

Each finding includes an exact source snippet, measured reproduction and specific fix. Website source and export remain unchanged.

#	Requirement	Status and evidence
1	Source, dependencies and build configuration under web/; export under dist/; documentation under allowed paths	Met — delivered directory structure
2	Preserve deployed source and accepted contract work	Met — unchanged source; pinned handoff
3	Implementation-derived ABIs from the pinned commit, with matching hashes	Met — six exported ABIs match pinned files; runtime verification succeeds
4	Build and typecheck evidence	Met — recorded in docs/frontend/checks.json
5	Browser and interaction validation	Met — independent Chromium rendering and mocked interactions
6	Exact deployment identifiers and contract set in the manifest	Met — dist/imd-deployment.json
7	Copy poolKey unchanged	Met — exact handoff comparison
8	Copy network and add-chain settings unchanged	Met — manifest and mocked network switch
9	Relative ABI and asset paths	Met — manifest; gateway-style browser mount
10	Load the same manifest and referenced ABIs at runtime	Met — web/src/config.ts
11	Complete SHA-256 inventory, excluding the manifest; respect size limits	Met — 21/21 hashes match; approximately 1.57 MB total
12	Manifest matches the final export	Met — independently recomputed hashes
13	Public hosting, IPFS naming and publication checks	After review — publisher/control-plane responsibility
14	No worker publication or contract redeployment	Met — source delivery only
15	Above, Up/Down, Old contract and Docs pages	Met — web/src/App.tsx
16	Wallet connection	Met — EIP-6963 wallet prompt and mocked connection
17	Every transaction signed by the visitor’s wallet	Met — TransactionProvider; mocked signing flow
18	Public RPC reads; no application storage, signing backend or relay	Met — config.ts, context.tsx, wallet configuration
19	No third-party script, font or frame before Connect	Met — zero external requests observed before connection
20	Deposit and withdraw USDC	Met — Above balance controls and validation evidence
21	Buy/sell Yes and No; place/cancel orders	Met — Above controls; mocked order review, receipt and rejection
22	Match crossed orders and explain caller reward	Met — MatchControl, previewMatch
23	Split, merge and claim	Met — PositionActions
24	Record a start price with caller-paid oracle fee and waiting state	Met — deployed StartOracle controls in Tools.tsx
25	Separate threshold markets and dates	Met — registry-backed market rows and sorting
26	Threshold markets “with YES and NO prices in USDC”	Missing — rows contain threshold/date/status but no quotes
27	Show Locks, fee inside and post-fee shares/proceeds	Met — order form and integer previews
28	Show balance and Max; block excess amounts in plain English	Met — repro

All four findings reproduced and are fixed. The answers are in .imd-responses.json (4 × fixed).

What changed

• [high] No prices on the market board. Each open market row now shows "Yes bid … · ask …" and "No bid … · ask …" in USDC per share. An empty side says "no quote", and there are separate loading and error states with a "Reload prices" button. A new read, useBoardQuotes in web/src/context.tsx, gets each side's best order from the contract. Rows and sort order are unchanged. With the test fixture the row reads "Yes bid 0.4 · ask no quote" and "No bid 0.62 · ask no quote".
• [medium] Order button below the first phone screen. I made the suggested change: phone nav link padding goes from 7px to 5px. With a wallet connected at 390×844, the header is now 121px and the order button ends at 838.6px, so it fits on screen. The browser test now checks this.
• [medium] "Balances refreshed" shown even when the refresh failed. After a confirmed transaction the app now checks whether the follow-up reads worked. If they failed, the transaction still shows as confirmed, but the message says the balance refresh failed and the numbers may be out of date. A new test step forces the reads to fail after sending and checks the message.
• [low] Tight spacing on the USDC labels. The small "USDC" next to balances now has normal letter spacing; the browser reports normal at 320 and 1440 wide.

Checks run this round, all on the final build

• npm run build (typecheck, Vite build, manifest export): passed. 6 ABIs, 21 assets, 1.57 MB.
• npm test: 9 passed, 0 failed, with 19 mocked wallet transactions and nothing broadcast.
• npm run test:browser in headless Chromium: 6 of 6 passed. It covers all routes at 320/390/1440 with no sideways scroll, the connected first screen at 390, and connect → order → receipt with a mock wallet.
• The design probe taste.mjs: 16 of 16 passed. It only measures the disconnected entry page, so I also took my own connected screenshots at 320 and 1440 to check the new price line.
• npm run verify: the manifest, hashes, handoff, pool key and network block all match.

Things you should know

• The last attempt failed because the browser tool didn't start, so I didn't use it. I ran Playwright 1.56.1 directly instead. This machine didn't have the Chromium version it needs, so I downloaded it into test/scratch/, which isn't submitted.
• Nothing was tested against the live chain. Board prices come from the same stored best-order reads as the existing Order book. Like that section, they show an expired top order as-is.
• I updated docs/frontend/VALIDATION.md, docs/DESIGN.md and the two report JSONs with this round's results. Earlier rows that said the browser couldn't start are replaced. DESIGN.md stays in docs/ because the repo root is outside the allowed paths.
• Changes are left uncommitted in web/, dist/ and docs/. The dotfiles at the repo root (.bashrc, .claude/, .mcp.json and others) were there before I started; I didn't touch them, and they aren't part of this work.

Area	Previous review	This review
Requirements	1 reported missing	32 met, 0 missing, 0 faked; 3 need requester; 1 after review
Broken features	1	0 reproduced
First screen at 390px	Action below fold	Fully visible
taste@1	15/16	16/16
Copy findings	0 reported	0
Share card	Present	Present

All four previous findings are fixed. No new reproducible defects remain. .imd-findings.json contains {"findings":[]}.

Previous finding	Verified result
Missing board prices	The fixture’s row displays Yes bid 0.4, No bid 0.62, and explicit “no quote” asks. Above.tsx:347, context.tsx:269.
Wrapped phone navigation	At 390×844, all six links share one row; header height 121px, order button bottom 838.59px, target height 44px. styles.css:1157.
False balance-refresh confirmation	With reads failing after withdrawing 10 USDC, the ledger becomes 90 USDC, the displayed balance remains 100, and confirmation explicitly warns “Balance refresh failed.” No “Balances refreshed” claim. context.tsx:546.
Tight currency tracking	Both USDC units compute to 14px, letter-spacing: normal, at 320, 390 and 1440px. styles.css:603.

The visual idea holds: a quiet green trading board that puts the order form ahead of explanation.

Explicit requirement	Status and evidence
Frontend source, package, lockfile and build configuration under web/	Met — web/package.json, lockfile, vite.config.ts, src/.
Static export in dist/; documentation in allowed paths	Met — dist/, docs/frontend/.
Preserve deployed source; no contract redeployment	Met — review left source and export unchanged.
Implementation-derived ABIs from the pinned commit, with verified hashes	Met — six pinned ABI comparisons and export verifier pass.
Exact manifest schema, identity fields and contract set	Met — dist/imd-deployment.json matches the pinned handoff.
Export ABI JSON; relative ABI and asset paths	Met — six dist/abi/*.json files; path checks pass.
Copy poolKey unchanged	Met — exact comparison passes.
Copy network and walletAddChain unchanged	Met — exact comparison passes.
Load that manifest and referenced ABIs at runtime	Met — web/src/config.ts.
Inventory every export except the manifest, using lowercase SHA-256	Met — all 21 declared files and hashes match.
Asset count, file-size and response-budget limits	Met — 21 assets, 1,569,174 bytes total; largest 677,085 bytes.
Source publication, IPFS hosting, naming and publication checks	After review — publisher/control-plane responsibilities.
Wallet connection and network switching	Met — injected-provider, add-chain, rejection and switch checks pass.
Read this deployment through configured public RPCs; verify chain/code	Met — config.ts, context.tsx, interaction checks.
Wallet signs transactions; static app stores, signs and relays nothing	Met — wallet transaction flow; no app backend.
No third-party script, font or frame before Connect	Met — browser request checks pass.
Above, Up/Down, Old contract and Docs pages	Met — all routes render without overflow at tested widths.
Separate threshold/date markets with Yes/No USDC prices	Met — MarketRow; original fixture reproduction passes.
Buy/sell Yes/No; place and cancel orders	Met — DOM interaction tests and exported-site order flow.
Locks, included fees and shares/proceeds estimates	Met — order summary, domain tests and worked-example checks.
Balance, Max and plain-English excess-balance blocking	Met — form controls and interaction assertions.
Deposit and withdraw USDC	Met —