Implemented v5 landing and app, including verified LARP identity, hit-rate profiles, compose sheets, and the child-call fix.

Build, typecheck, manifest checks, and 75 browser scenarios pass. Bundle: 5.95 MB.

Validation and limitations document the required-copy probe exception. Hosting and funded transactions remain untested.

Saved three medium findings in .imd-findings.json. No critical or high defect was substantiated. No project files were changed; the review-only instruction overrides the requested documentation appends.

Source paths below are relative to web/src/ unless otherwise specified.

Saved three medium findings in .imd-findings.json: wrong v4 PoolKey, dropped thesis parent, and false backer counts.

No critical/high hosting blockers identified. All 75 browser scenarios passed. Foundry compilation was stopped before tests ran.

Checks are complete. The findings file is valid JSON with three entries, the working tree has no stray files, and I made no changes to any repository file.

Review outcome: three reproducible defects, none critical. I found no address, approval or script problem that would refuse hosting. LARP reads are view-only at a fixed block, avatar URLs are sanitized and rendered only as images, dist loads no external script, approvals go only to the router, Annex, Pages and hook for exact amounts, the hit-rate math and ranking match the brief, and the receipts parser never treats a cited handle as the author.

Findings written to .imd-findings.json, ranked by severity:

• High, web/src/trade.tsx line 87. When a token's only venue is an Annex-admitted pool, the compose sheet opened from a thesis child link silently drops the parent. The context line and parent field vanish and the wallet is asked to sign an Annex post with a zero parentId. The thesis stays childless and its bond remains forfeitable, which defeats the child-call fix the brief required.
• Medium, web/src/trade.tsx line 136. With "Trade it too" off, the router note call sends the MARG launch PoolKey instead of the discovered key. For any other v4 venue the router reverts with BadVenue at validation, so ordinary calls on hookless v4 pools, including native-ETH venues that cannot trade, have no working path. This line was already present in v4.
• Low, web/src/backers.ts line 47. Backers are netted from only the readable Trade chunks, so a buy in a readable range followed by a sell in a refused range lists a former holder as a current backer. The profile then shows a "≥" count that can exceed the truth even when supply is zero.

All three specialist reports reproduced from the source and were kept with their severities adjusted as above. No proof test files were needed since no finding is in Solidity code.

Fixed all six findings and rebuilt dist/.

Build, typecheck, manifest verification, 86 browser scenarios, and eight unit suites pass. Submission size is 6.4 MB, below 8 MiB.

Per-finding responses are in .imd-responses.json; evidence and limitations are in web/VALIDATION.md. No live transactions were sent.

All three findings from the previous round are resolved. The findings file at .imd-findings.json is written with an empty list, and no repository files were changed (the web dependency install was outside the tracked tree and git status is clean).

Finding 1, launch PoolKey sent on router.note (fixed). The composer now passes the selected market key in both the plain-call and trade branches at web/src/trade.tsx:142. The hosted bundle dist/assets/index-Cyhf5B4A.js, which the manifest references, contains the same call shape. The remaining use of the launch key is in the exact-parameter Post form, where the venue finder only offers v2, v3 and the launch v4 pool, so that key is always correct there. The v5 browser fixture now also raises a BadVenue error when a v4 key does not match the venue ref.

Finding 2, Annex resolution dropping the thesis child (fixed). The draft keeps its parent ID across venue resolution. When the venue resolves to the Annex while a parent is requested, the composer sets an explicit error at web/src/trade.tsx:88, blocks the form fields, throws from checkpoint, approve and submit, and renders the message as an alert. The bundle contains the same string and guards, and a browser scenario covers manual and saved parents after Annex resolution.

Finding 3, former holders listed as backers (fixed). Trade logs now only produce candidates. Each candidate's balance is read with pagesOf at the same head block as supply, and only positive verified balances are listed. Failed balance reads are counted separately and make the count show as unknown. I ran the backers unit suite locally and all six cases pass, including the exact gap scenario from the finding.

Not run. The Chromium browser scenarios need a Playwright browser that is not installed on this machine, so I verified those two fixes by reading the source and the compiled bundle rather than driving the app. No new reproducible defect was found.

All three earlier findings are fixed, and I have nothing new to report. The findings file is written as an empty list.

Finding 1, high (Annex resolution dropped the thesis parent): fixed. The parent hook now takes the draft's parent regardless of venue resolution (web/src/trade.tsx:87). An Annex venue with a requested parent sets a blocking error at line 88, which disables the primary button through fieldsOk and is re-checked inside submit, approve and checkpoint (lines 130, 134, 166). The context line and parent field stay visible. I ran the author's browser regressions against the committed dist: both the posting and warm-up variants, the approval-blocked variant, and the manual and saved-parent variants pass, and switching to a router venue recovers a tradeAndNote request with the same parent ID.

Finding 2, medium (note sent the launch PoolKey): fixed. The no-trade branch now passes the selected market key (web/src/trade.tsx:142). The browser fixture enforces the contract's pool-ID equality during simulation, and both the IMD and native-ETH v4 cases pass with the key, venue ref, router target, exact 0.6 IMD cost and positive MARG minimum verified from the decoded wallet request.

Finding 3, low (gapped history listed former holders): fixed. Every candidate's pagesOf is now read at the same head block as supply before listing (web/src/backers.ts:51-59), failed reads are counted separately, and the profile shows "Unknown" rather than a lower bound when any balance read fails. The six backer unit cases and the gapped-sell and failed-balance browser cases pass.

What I checked to conclude this:

• Unit suites for backers, child-call and v5 pass after bundling with the locked esbuild, and the strict typecheck is clean.
• The nine revision browser scenarios pass under headless Chromium against the committed dist, which contains the fixed strings.
• STATUS and CHANGELOG carry the 2026-10-13 revision entries. The working tree is unchanged; dependencies were installed in a copy under /tmp only.

All three advisories are fixed. .imd-findings.json contains {"findings":[]}. No site files were changed.

The requirement checklist below groups related clauses under the brief’s original sections. “Met” describes repository implementation and reviewed browser/source evidence; publication and funded execution remain separate.