Implemented the checker, claims list, raw results, and report.md.

• 234 probes; conservative budget usage: 244/300.
• Five finding groups, including the README planning conflict and historical runtime path_violation.
• Exact requests included for every mismatch.
• All 12 offline tests passed.

Run locally: python3 scripts/audit.py --verify. See README.md for instructions.

The review is complete. Nothing in the report had to be removed: every reported mismatch reproduces from the saved raw results and the docs snapshot. The findings file holds two low-severity notes about presentation, not about the mismatches themselves.

What I verified against results/probes/*.json and results/docs.txt

• Step-path contradiction. Docs line 501 lists write-readme-and-docs, deploy-script and gas-and-size-report as requiring paths. All three check clean without paths and return unplannable_steps ("declares its own budget") with paths. The historical job c2ba5413 is blocked with path_violation, allowed paths README.md and docs/**, three zero-turn failures on artifacts/SEPOLIA-GUIDE.md. The known mismatch from the task is confirmed from both directions.
• 16-path limit. 8 directory-form paths pass, 9 and 16 return bad_path_count, 16 .md paths and 16 /** paths pass. The report's two-entries-per-directory inference is labelled as inference and is consistent with the .git/config probe, which expands to both .git/config and .git/config/**.
• Oracle list rows. Docs line 142 promises panelSize and quorum per row. Zero of 500 rows in the limit=501 probe carry either; the detail route does.
• Attestation CORS. The attestation response has no Access-Control-Allow-Origin header while list, counts, detail and pools return *.
• Explorer agent. Docs line 287 promises jobs and lastAcceptedAt; the seat 42 response has neither.
• Report integrity. The 88-row CORS table matches raw headers exactly. Minimum start-to-start spacing is 2.184 s and finish-to-next-start is 2.1 s. The body limit probes are exactly 16,384 and 16,385 bytes with 200 and 413. The docs footer reads 3b96b1cc, checked 2026-10-01. The offline verifier and all 12 unit tests pass on a scratch copy. The experimental label is present in README, CLI help and the site banner.

Findings written to .imd-findings.json

1. Low. The two template launch probes also return bad_path_count on nodes impl and tests. The docs never mark job-level paths or contracts as required for a template, yet the report files both rows as PASS and never mentions the blocker. The probes also omit contracts, so they cannot say whether the documented example body passes.
2. Info. The attestation CORS finding rests only on the generic "oracle reads" sentence in Base URLs. The per-route oracle table marks Open CORS on /oracle/counts alone, so the finding should cite both lines. The mismatch itself stands.

No files other than the findings file were changed.