Fixed the bundle-size issue. Deliverable files now total 7.68 MiB, below the 8 MiB limit, preserving all 16 previews, full-detail SVGs, contracts, and offline dependencies.

Verified: forge build, 42 passing tests with the supplied fuzz seed, forge fmt --check, and artwork integrity checks.

Build succeeded and all 42 tests passed with the verifier's fuzz seed. The only file changed is launch.json.

What I delivered: a launch.json manifest describing the four accepted application contracts in constructor dependency order.

• FrogArt1 and FrogArt2 take no arguments. Each constructor creates its own SSTORE2 data child, which is internal and not a manifest entry.
• FrogRenderer takes the two art store addresses as backward contract references.
• NightFrogs takes the launch owner as $owner, the Chainlink VRF v2.5 coordinator address the brief states as a static word, and the renderer as a contract reference.

How I verified it: the argument order and count match each constructor in the source and the README deployment handoff table. The deployment test in the repository rehearses this exact sequence through a factory probe with the production coordinator and launch owner, and it passes. A scratch check confirmed the manifest has only the three schema keys, unique identifiers under 32 characters, string arguments, backward-only references, and notes under 4,000 characters. No token, pool, ETH funding or initialization call is included.

Checks run:

The review is complete. The findings file at .imd-findings.json holds four findings and coverage rows for all 13 entry points plus four invariants. Only that file and two scratch tests under test/scratch/ were written.

Findings

• High. The VRF reveal is single-shot with no recovery. reveal() latches revealRequested before the coordinator call, and both reveal() and configureVRF() revert on that flag forever. I pulled the verified source of the live coordinator at the brief's address. Its requestRandomWords explicitly does not validate the key hash, so a mistyped gas lane is accepted on chain and simply never fulfilled. A subscription drained before fulfilment or a reverted callback ends the same way. All 500 tokens then stay on the moon placeholder permanently, after 1,000 IMD has been paid, and the stuck pending request also blocks cancelSubscription on the coordinator, locking the owner's LINK. The proof test test/scratch/StaleRevealRequest.t.sol fails on this code with RevealAlreadyRequested.
• Medium. Reveal requires a 100% sellout with no close-sale path. The brief says the owner calls reveal once. The code adds a hard gate at line 160. If demand stops at 499, nothing can reveal. The documented workaround is the owner buying the remainder, at a measured net cost of 1 IMD per token because half flows back to treasury, spread across fresh wallets to pass the per-address cap.
• Low. mint() has no maximum-cost argument. A setPrice that lands before a pending mint charges the new price to any payer with an open allowance. Verified: alice with an unlimited approval pays 50 IMD for one NFT after a price raise lands first.
• Info. Trust assumptions. The wallet cap is per address and trivially spread over fresh wallets, the owner-as-treasury mints at an effective half price, and ids #1 and 1 to 77 go deterministically to the first transactions.

What held

The 50/50 split, burn accounting, supply cap, wallet cap, checks-effects-interactions with the reentrancy guard, exact-amount checks, royalty math, two-step ownership and all seven trait weight tables were traced and the existing invariant suite was rerun clean. The live IMD bytecode has no pause, blacklist, proxy or tax selectors, so the fee-on-transfer and blocked-recipient defenses are not exercised in production. The slither reentrancy lines are false positives given the guard and state ordering.

Open item outside my area

The local factory rehearsal measures about 13.3 million gas for the four applications. Whether that fits the launch policy's gas ceiling is for the deployer to confirm.

The review is complete. The findings file is written and validated: all three snippets match their cited lines exactly, and every one of the 13 listed entry points has a coverage row.

What I checked

• Traced mint, reveal, configureVRF, rawFulfillRandomWords, the owner setters and the inherited ERC-721 and Ownable2Step paths against the Execution Trace, Periphery and First Principles guides.
• Ran the project's 43 tests (all pass) and probed the renderer: all seven weight tables sum to 100, every draw lands on a stored record, worst-case tokenURI is about 2.8M gas.
• Forked chain 1 and did a real paid mint with the live IMD token (a LayerZero OFT with 18 decimals): exactly 10 IMD burned to 0xdEaD and 10 IMD to the treasury, nothing retained. IMD rejects transfers to the zero address.
• On the same fork, created and LINK-funded a real VRF v2.5 subscription, registered the consumer, and called reveal(). The request succeeded against the real coordinator, the callback fits the 120k budget, and the subscription cannot be cancelled while pending.
• The Slither and Aderyn reentrancy leads do not hold: effects precede interactions, mint is guarded, and the receiver hook can only move the caller's own fresh token.

Findings reported (none critical or high, so no proof tests attached)

1. Medium. reveal() requires a full sellout, which the brief does not ask for. With one unsold token the whole collection stays on the placeholder, and the owner's only escape is buying the remainder through many wallets with half burned. Reproduced at 499 minted.
2. Low. mint has no caller price bound. A buyer with a standing allowance pays whatever price an owner setPrice sets first, with half burned irreversibly. Reproduced: 20 IMD charged for an expected 10.
3. Low. After a successful request there is no re-request path, so a request Chainlink never delivers leaves the collection unrevealed forever. Documented by the builder as a trade-off; listed with the concrete locked state.

Not reached: art geometry and visual alignment of layers, which are outside the control-flow area. My scratch tests remain under test/scratch as the assignment permits.

Review complete. The findings file is written and validated.

Outcome: one low-severity finding, no critical or high defects in the math, boundary or numerical-gap areas. All 13 verifier entry points have a coverage row, plus five invariant rows.

What I verified in depth

• Payment math holds exactly. The even-price rule plus the price ceiling of max/500 means cost is always even, both halves are equal, and no intermediate can overflow over a full 500 sellout. I reproduced a full 500-token sellout on an Ethereum mainnet fork against the real IMD contract. The burn sink received exactly 500 IMD, the treasury exactly 500 IMD, and the collection retained zero.
• The real IMD token is safe for the exact-delta guards. It is a LayerZero OFT on an unmodified OpenZeppelin ERC-20 with 18 decimals and no tax, pause, blacklist or wallet cap, so the InexactPayment checks cannot brick minting.
• VRF callback budget has a wide margin. The minimum gas at which the fulfillment succeeds with cold slots is 32,624, against the declared 120,000 limit. A failed-callback lockout, the one permanent-breakage path in v2.5, is not reachable. Request parameters match the live coordinator config (minimum confirmations 3, max callback gas 2.5M).
• Trait rolls and the art record table are consistent. All seven weight tables sum to 100, the subtraction loop cannot underflow, the Genesis background is forced for ids 1 to 77 and unreachable above, and the 100 records split 19/81 across the two SSTORE2 stores with correct offsets at the boundary.
• Metadata stays readable. Worst-case tokenURI costs about 3.0M gas and 27 KB, well inside eth_call limits.

The finding

reveal() at src/NightFrogs.sol:160 hard-requires all 500 tokens minted. The brief only says the owner calls reveal once. If demand stops short, every token stays on the placeholder until the owner buys the remainder through many wallets at the public price, half of which burns. It is documented as a deliberate anti-sniping choice, so I rated it low and left the design call to the requester.

Leads I dropped: the slither reentrancy lines (guarded by nonReentrant and checks-effects ordering), the uninitialized-local lines (assigned on every branch), and the owner price-change race (admin action with no unprivileged amplifier).

The findings file is in place and valid JSON; git hides it only because the harness's own exclude list names it, which is expected. The work is complete.

Summary

Delivered three new Foundry test files under test/, adding 29 tests to the existing 42. The full suite of 71 tests passes with the verifier's fuzz seed and with an unpinned seed. Nothing outside test/ and the prescribed .imd-findings.json was touched.

• test/LifecycleInvariant.t.sol drives the whole collection life through a handler with 13 actions: paid mints with out-of-range quantities, selling out the remainder, VRF configuration including zero values, the reveal request, genuine and foreign fulfillment attempts, transfers, price and treasury changes, and two-step ownership handover with stranger acceptance. Three invariants check that the reveal state machine never reopens and the seed never changes, that the two-step owner is always the royalty recipient, and that exactly half of every payment is burned while held frogs equal supply. A scratch probe confirmed the random sequences really reach a fulfilled reveal and an ownership handover, so the invariants are not vacuous.
• test/Boundaries.t.sol covers failure paths the happy path misses: the maximum allowed price minting ten without overflow, the price bound by one unit, exact-allowance protection from a later price rise, lifetime wallet cap across split mints, the last batch at the supply boundary, a contract buyer with no receiver hook, probing for hidden admin functions, a coordinator address with no code, every wrong fulfillment shape, reveal waiting for the 500th frog, royalty rounding at the edges, and metadata at ids 1, 77, 78 and 500 before, during and after reveal.
• test/Rarity.t.sol checks that the onchain weighted draw realises the declared rarities across 6768 samples per layer, that legendaries are rarer than commons, that Genesis backgrounds appear exactly for ids 1 to 77 for any seed, that the captain's 1-of-1 set is what it claims, and that trait names match the brief.

No defect was found that needed a proof. .imd-findings.json reports three observations instead of asserting them as correct:

• Low: mint has no price ceiling argument, so a pending buyer with an unlimited IMD allowance pays whatever price the owner sets first. A scratch test confirmed the reproduction.
• Info: reveal requires a full sellout, which the brief does not state. The art stays as the moon placeholder until the last frog is bought.
• Info: there is no re-request path if Chainlink drops the single fulfillment callback. The existing gas test shows this is residual risk only.

Fork runs against the live IMD token and VRF coordinator remain owed, since this machine and the verifier have no network.

The findings file is written and every quoted snippet matches its source line. Scratch tests live only under test/scratch/, which is gitignored, so no tracked file changed.

Outcome: four findings, all reproduced, written to .imd-findings.json with a 19-row coverage record answering all 13 entry points.

Findings kept, merged across specialists:

1. High: the VRF reveal latches on one request forever. The live coordinator's verified source does not validate the key hash, so a mistyped lane yields an accepted request that no node will ever fulfil. After that, neither reveal nor configureVRF can run again and the collection stays on the placeholder permanently. The economics specialist's proof fails on this code with RevealAlreadyRequested(), and I attached it.
2. Medium: reveal requires a full sellout. The brief says the owner calls reveal once with no sellout condition. At 499 minted the call reverts, and the only escape is the owner buying the remainder through many wallets. Reproduced in a scratch test.
3. Low: mint has no caller price ceiling. A setPrice mined ahead of a pending mint charges a buyer with an open allowance the new price, half of it burned. Reproduced with a 1,000 IMD drain.
4. Info: economic trust assumptions. The 2-wei price floor, the owner's effective half-price via treasury, the per-address cap, and first-come assignment of token 1 and the Genesis ids.

What I verified beyond the specialists: the live IMD token is a LayerZero OFT with stock OpenZeppelin transfers and no fee or blocklist, so the exact-balance checks in mint will not brick payments. The live coordinator's config accepts 3 confirmations and a 120k callback. All four contracts fit the factory's initcode and runtime limits, and the manifest is schema-clean. The slither and aderyn leads did not reproduce as defects. The existing 71-test suite passes.

Next for the author: a time-boxed owner retry for a stale unfulfilled request that still accepts only the latest request id, and a scope decision on replacing the sellout gate with a mint freeze at request time.

The harness's own exclude rule hides the responses file from git, which is expected. The file exists in the repository root as required.

Outcome: all four findings are answered in .imd-responses.json, the reviewer's proof passes, and the full suite passes offline with an empty environment.

Suite results on the final tree:

What changed in src/NightFrogs.sol

• Stale request replacement (high, fixed). A request records its timestamp. Once it has been unfulfilled for REVEAL_RETRY_DELAY, a 3-day named constant, the owner can call configureVRF again to correct the key hash or subscription and reveal() again. The replacement emits an abandonment event for the old id, and only the newest request id can fulfill. After fulfillment the reveal is final and both functions revert forever, so there is still no owner-chosen seed.
• No sellout gate (medium, fixed). The reveal request needs only a nonzero supply and permanently closes minting at that count with a SaleClosed event. The max supply is never raised and unminted ids never exist. This keeps the anti-selection guarantee through the mint freeze instead of a sellout.
• Cost ceiling (low, fixed). A new overload takes a maximum total cost and reverts with CostAboveLimit when a price raise lands first. The one-argument form keeps its signature, since the proof and existing callers use it, and the README now recommends the two-argument form.
• Trust assumptions (info, documented). The price floor, owner-as-treasury net cost, per-address cap and sequential id ordering are recorded in a new README section and referenced from the review notes.

Tests added cover the delay boundary to the second, the abandoned id being rejected while the replacement fulfills once, a late fulfillment of a stale request, a reverting replacement request, a fuzz over elapsed time, reveal at 307 minted with minting refused for buyers and the owner afterwards, the cost ceiling against an unlimited allowance, and a new invariant that supply freezes at the closing count. Test helpers now encode the mint selector by signature because the function is overloaded.

One design note for the requester: the owner's reveal request is now the sale's single close point, so a reveal at fewer than 500 permanently caps the collection there. The README states this under "After launch".

The existing launch.json already describes the accepted implementation exactly, so no edit was needed.

What I verified

• The manifest has only the keys kind, contracts and notes. All four contract names are unique identifiers under 32 characters, and the notes are 1,699 characters.
• Constructor arguments match the source in declaration order. FrogArt1 and FrogArt2 take none. FrogRenderer takes the two art store addresses as backward $contract references. NightFrogs takes $owner, the Chainlink VRF v2.5 coordinator address from the brief, and the renderer reference.
• The owner argument resolves to the launch owner, not the factory. NightFrogs uses Ownable2Step with the owner also set as the initial treasury, as the notes state.
• Constructors make no external calls and only reject zero or burn addresses, so they survive the protected deployment rehearsal on an empty chain. The runtime-size and opcode checks are exercised by the existing Deployment test.
• Burn constant, IMD token, supply cap, per-wallet cap, 5% royalty, two-step ownership and single reveal in the notes all match the contract.

Checks run

forge build succeeds, and forge test with the verifier's fuzz seed passes all 48 tests across 6 suites, including the accounting invariants. The working tree is clean, so no file other than launch.json has ever been touched by this task.

All four reachability probes failed as intended, which proves the handler drives the stale replacement, the abandoned-id fulfillment, the exact boundary second and the fulfilled state during the real invariant runs. The working tree touches only my two test files.

Recap

The revised implementation replaced the sellout precondition with a sale-closing reveal, added a cost-ceiling mint overload, and added a 3-day stale-request replacement window. My previous-round tests referenced the removed error and no longer compiled, so this revision updates only what those changes require.

Changes in test/Boundaries.t.sol:

• Replaced the "reveal waits for the last frog" test with one that requests at 499, asserts the sale freezes there, and shows the 500th frog is never sold by any path, before or after the word lands.
• Added edge tests: reveal with exactly one frog versus none, error ordering when the sale is closed, an inclusive cost-ceiling fuzz that checks atomic rollback and the exact error arguments, a cheaper-execution ceiling case, stale replacement chains that keep the sale closed and kill every abandoned id, and configuration validation inside the stale window.

Changes in test/LifecycleInvariant.t.sol:

• The ghost model now tracks the closed supply, request time, request count and replacements, and the handler gained a time-warp action that also lands on the exact stale boundary.
• Buyers alternate between both mint overloads. Fulfillment attempts now target the live id, the abandoned id, zero and an unissued id.
• New invariant: the first request freezes supply forever. The state-machine invariant now checks staleness, request time and the request count against the model.

Verification: the full suite passes with the verifier's fuzz seed. Results were 83 tests passed across 9 suites, including both invariant suites. test/Rarity.t.sol needed no change.

No defects were found in the revised code that cannot be tested, so no findings file was written. The owner's ability to end the sale early at any nonzero supply is an intentional documented power, not a bypass. Fork runs against the live IMD token and coordinator remain owed, as no network is available to the verifier.

The review is complete. All four findings from my previous round are settled as fixed, and I found no new reproducible defect. The record is in .imd-findings.json with an empty findings list and 21 coverage rows (all 14 entry points marked holds, plus rows for each settled finding, the static-analysis leads, the manifest and the full suite). The tree is otherwise untouched: scratch tests were removed and git status is clean apart from the findings file.

Settled findings

• Stale VRF request latched forever (high). Fixed. Both attached proofs, copied under test/scratch and run against the revised code, now pass. A request unfulfilled for 3 days makes revealRequestStale() true, which reopens configureVRF and reveal(); the replacement emits the abandoned id, moves the accepted request id, and the old id is rejected. Once a word is delivered, no further request is possible.
• Reveal required a 100% sellout (medium). Fixed. At 499 minted, reveal() returns request id 1 and emits SaleClosed. Every later mint, including the owner's, reverts MintClosed before and after fulfillment, so the anti-selection property survives without a sellout.
• No cost ceiling on mint (low). Fixed by the two-argument overload. With an unlimited allowance and a price raise mined first, the capped call reverts CostAboveLimit and the buyer's balance is unchanged. The plain overload still charges the execution price, which the README documents.
• Economic trust assumptions (info). Recorded in the README section on economic trust assumptions and in the review notes, as agreed.

Things I checked and did not report

• The stale window lets the owner abandon a request just before a very late fulfillment lands, but only after 3 days, beyond Chainlink's 24-hour request timeout. The author already documents this as a trust assumption, and I could not make it a practical seed re-roll.
• The slither and aderyn leads do not reproduce: effects precede transfers in the purchase path, both mint entry points and reveal are reentrancy guarded, the renderer locals are assigned on every path, and the Yul return is the standard SSTORE2 creation pattern.
• The full suite passes with 85 tests and 0 failures, including the supply-frozen-once-requested invariant and the exact burn and treasury conservation invariant.