The review is complete. The findings file is written and the tree is otherwise untouched.

Outcome. No critical, high or medium defect reproduced in the imported code. The findings file holds two low findings, two informational notes and a coverage statement.

Findings written to .imd-findings.json:

• Low, Tribunal stuck funds. The Tribunal only ever pays out exactly one stake per settled objection and has no sweep, so IMD or oracle-fee tokens that arrive any other way are locked forever. Stake accounting itself is sound.
• Low, held status for excluded sellers. The standing view does not consult the exclusion list, so an owner's approved plea reads as "objections open until …" in the Tribunal and Letterbox status lines for 20 minutes, while nobody can object to it and Seasons will never record it. A scratch test confirmed this. Display only.
• Info, spec drift. The functions table in the objections spec says a void stake goes to Seasons. The code, the decisions table and the brief return it to the objector.
• Info, event accuracy. The season record event reports zero points when a plea does not enter a wallet's best three. Run 4 behaviour, more visible now that scores can be lowered.

What was checked and found sound. The 40-minute hold always ends inside the 60-minute close grace, including the death-shortened last season. A ruling can never land on a plea Seasons already recorded because the callback and the stale check share one expiry boundary. Replay is blocked by consumption plus the Tribunal's own signing domain. The gas 63/64 rule prevents forcing Seasons' fail-open read to fail while the record still has gas. The Letterbox appeal raise never exceeds the gate's 50% ceiling or the original amount. The manifest's constructor arguments match the five constructors in order, both committed code hashes match this tree, and the notes fit the cap. No forbidden opcode, proxy, pause, blacklist or post-launch mint exists.

Coverage. Read in full: Tribunal, Seasons, PleaLaunch, PLEA, PleaDistributor, OracleAttestation, the interfaces, the spec, the manifest and both protected tests. Read as the diff since run 4 plus the touched functions: CabalGate and Letterbox. Not re-read within the budget: PleaHook, which is byte-identical to run 4's deployed code, and the unchanged sell and letter-parsing paths of CabalGate and Letterbox.

Checks run. The source build is clean and the runtime sizes match the stated figures. The four Tribunal test files pass with 79 tests, and the manifest tests pass with 11. The other test groups and the fork tests were not run.

The review is complete and .imd-findings.json is written and validated: the snippet matches the tree, all 54 listed entry points have a coverage row, and the working tree has no other changes (the scratch test was removed).

Scope covered. I read the Senior Auditor's Mindset and the Math Precision, Boundary and Numerical Gap guides, then traced all nine sources against them: every division and rounding direction, every downcast, every boundary comparison on windows and seasons, every external call's return handling, and the bytes decoding in the attestation path. I also recomputed the two creation-code hashes in launch.json from this build (both match) and the share table (25 entries, exact sum of 10,000, straight line 450 to 350). The build passes under via_ir.

One finding, medium. The fix-round floor raise in the Letterbox's appeal path breaks the share-band guarantee the code's own clamp exists to protect. The same-share amount is at most 20.00% of the shrunken balance, so raising it to the 0.70 IMD floor always pushes the appeal above 2,000 basis points, where the gate's fact score pays 11 instead of 18. The project's fixture confirms it: a floor-sized letter had fact 41 and need 29, and its appeal landed at 2,071 bps with fact 34 and need 36. When the original's need was 39 or more, the appeal's need exceeds 45 and the APPEAL letter reverts with CannotPass, which is the refusal the fix set out to remove. The existing test for this case checks only the amount, not the need. No funds are lost, so it is reported as a broken guarantee rather than higher.

What held. The Tribunal's timing boundaries are consistent on both sides (object and standing use <= and > on the same instant, expire and the oracle callback are exact complements), the 40-minute hold always ends inside the 1-hour close grace, the sustained rule is exactly newScore + 2 < need, an overruled score can never fall below 13 so no recorded score is zero, the Seasons pot accounting cannot underflow, the 82/6/12 mint is exact, and the hook's exact-input fee formula makes the before- and after-swap fees equal up to one wei with the surplus refunded.

Not reached. No fork tests were run and the full 16-minute suite was not executed; only the Letterbox group ran, to measure the finding. Static-analysis lines were checked as leads and none reproduced as defects in my area.

Manifest checks pass: the committed Letterbox and Tribunal hashes match this tree, the five constructors decode launch.json's arguments in order, and the notes fit the cap. The review is complete and .imd-findings.json holds the result.

Outcome. Two low-severity findings, both substantiated; no permission bypass found in the Tribunal, the gate, the Letterbox, the hook or the launch wiring.

• Seasons exclusion is evaluated at record time, not at verdict (src/Seasons.sol:175). A plea approved while its seller is the PLEA owner is refused with OwnerExcluded, then records and pays out once that owner hands PLEA to another wallet and the nominee accepts. The scratch test shows the ex-owner receiving the rank-1 IMD share and 450,000 PLEA of the bonus. The launch owner baked into the hook stays excluded, and a second wallet achieves the same, so the guarantee was nominal already. I rated it low and said so.
• PleaDistributor is one-step Ownable (src/PleaDistributor.sol:11) while PLEA is two-step. A renounce or a mistyped transfer before the single setMerkleRoot call strands the 12% allocation with no recovery path. Owner action, so a trust assumption, but the only one-transaction permanent freeze in the launch.

Coverage. All 55 listed entry points have a row, plus four invariant rows. Fifty-three hold after tracing their guards and state changes. The Tribunal's eligibility, window, pending-expiry, domain separation, stake accounting and the 40-minute bound inside the close grace all check out. Trust assumptions I documented in the rows rather than as findings: the owner's add-only allowlist, the hook owner's fee share, the Intake's unsigned failure callbacks, and the hook's trader rule.

What I did not reach. The full 63-file test run and the fork suites were not executed; I ran the build, the manifest suite and my scratch test only.

The review is complete and the findings file is written and validated.

Result: one low-severity defect, no critical or high findings. The file .imd-findings.json holds that finding plus a coverage record answering all 56 listed entry points, with three extra rows for invariants and the manifest.

The finding (low): the gate's text validator refuses only the [PLEA and [/PLEA markers, while the Tribunal refuses [OBJECTION markers only in objections. A seller can therefore write [/OBJECTION] ... [OBJECTION] inside their own plea text at submit time. When anyone objects, the Tribunal embeds the gate's question verbatim, so the second panel reads a forged closing marker and an inserted instruction before the real objection. I reproduced it on this tree with a scratch test and quoted the resulting question in the finding. The fix is a four-letter extension of the gate's marker check, but CabalGate sits 200 bytes under the size limit, so it must be measured.

What I verified as sound in the assigned area:

• Every Tribunal path: object, ruling, failure, expire, settle, and the void-by-object route, including the stake accounting and the reentrancy order.
• Seasons.record and closeSeason against the Tribunal's hold, the 40-minute bound inside the 1-hour close grace, and the non-reverting staticcall fallbacks.
• The Letterbox's deliver, settle, appeal floor raise and the try/catch around points.
• The Tribunal callback gas with worst-case 280-byte appeal, original and objection texts: 97k, under the Intake's 200k.
• launch.json: argument counts and order, the README's Sepolia addresses, and both committed code hashes. The LaunchManifest suite passes on this tree.

Not reached: the PleaHook's view and constant section (lines 1 to 355) and the full hook test suites were not run. The hook is run 4's deployed code, unchanged, and I traced beforeSwap, afterSwap, the fee and cashback paths, seed, rebalance and fundWall by reading only. No network table was present in the reads directory, so the manifest addresses were checked against the README rather than an authoritative chain table.

The review is complete and .imd-findings.json holds the result.

Outcome: one low-severity finding, no critical or high defects in the economics of this launch. The Tribunal, Seasons, Letterbox and hook value flows hold up under the Economic Security, Invariant and Flow Gap checks.

Finding (low), Tribunal.object: the "two rulings from different wallets" cap is checked on msg.sender only. Two colluding wallets can file harmless objections right after a verdict, take both overruled rulings, and close the case while the 20-minute window is still open. A genuine rival then gets CaseClosed, and the plea becomes recordable at its full score at once. The spec's known limit 1 says a sham costs "one of the two slots"; in practice it costs both. Cost to the seller's camp is two 0.35 IMD stakes to the pot plus two oracle fees, which are minted for free on Sepolia. I verified this with a scratch test under test/scratch, which passes on the current code and shows the sequence. It is a design acknowledgment rather than a code bug, so I reported it for the record without a proof file.

What I verified and found sound:

• Seasons' pot accounting conservation across checkpoint, close and flush, and the 450-to-350 bps share table summing to 10,000.
• The 40-minute hold bound sits inside the 1-hour close grace, so no plea of a closing season can still be held at close time.
• Tribunal stake conservation, the sustain rule, min-of-panels scoring, and the fail-open Tribunal reads from Seasons. The 63/64 gas trick cannot force a fail-open record.
• Letterbox fee, tip and auto-sell flows, and the appeal floor raise from the fix round never exceed the writer's balance or the gate's bands.
• Hook fee split and prize delivery to Seasons, including the claims fallback.
• The committed Letterbox and Tribunal creation-code hashes in launch.json match the built bytecode. All four Tribunal test suites pass.

Coverage: all 54 listed entry points have a row, plus four invariant and manifest rows. One row is marked finding; the rest holds. Nothing is unreached, though PleaHook's rebalance and wall placement were traced at the accounting level rather than exhaustively.

The revision is complete. Both reopened findings reproduced and are fixed in CabalGate, one advisory finding is fixed alongside them, and the rest are answered in the responses file.

What reproduced and what changed

• High, constructor reads the chain id. Deploying the exact manifest from a factory address with a foreign origin succeeded on chain ids 11155111 and 31337 but reverted with BelowAgreedTiming on chain id 1, because the mainnet-only minimum refused the manifest's 18,000-second seasons. The guard and its error are removed from the constructor in src/CabalGate.sol. It now refuses only a zero timing.
• Medium, floor-raised appeal leaves the 20% band. The reviewer's fixture gave an original need of 29 and an appeal need of 36. The gate now scores an appeal's share band on the lesser of its own share and the original plea's share. A smaller appeal keeps its own better band as in run 4. The raise, the 50% ceiling and the original-amount cap are untouched.
• Low, forged objection markers. The marker check now refuses [objection and [/objection in any case, using a packed nine-byte compare that is smaller than the old unrolled one. CabalGate ends at 24,540 bytes, 36 under the limit.

Left as designed, with reasons in .imd-responses.json: the owner exclusion read at record time, two colluding wallets exhausting both rulings, and the distributor's one-step Ownable. Each is a trust assumption the brief's fixed rules or run 4's accepted code set, so changing it would be a scope decision for the requester.

Tests added or changed

• test/LaunchManifest.t.sol: the manifest deployed from the factory with IMD's wallet as origin on chain ids 1, 31337 and 11155111, every owner checked.
• test/Seasons.t.sol: the old mainnet-guard test replaced by one asserting the timings are accepted on any chain.
• test/Letterbox.t.sol and test/Gate.t.sol: the floor-appeal need, a shrunken-balance appeal, a smaller appeal, and the objection-marker rule.

Verification

Docs are updated in ADAPTATION.md, README.md, OBJECTIONS.md, and the gas figures in the launch.json notes. The Letterbox and Tribunal are byte-identical, so their committed hashes stand. One honest caveat: I did not run a single monolithic forge build of the whole tree because it would exceed the foreground command limit, but every source, script-free build and every test file compiled and ran in the groups above.

The revision is complete and verified.

What failed before. The full tree compiles as one single-threaded solc job under via_ir, so forge build takes about 5.5 minutes wall clock regardless of core count. The rejected attempt's additions pushed that past the verifier's time limit and it was killed mid-compile (exit 143). Nothing in the accepted tree was at fault: with the merged CabalGate change from the other contributor, all 570 existing tests still pass with the verifier's seed, and the suite itself runs in 7 seconds.

What I changed. One compile-cheap addition inside the existing test/Tribunal.t.sol suite, covering a corner no test named: a void is not a ruling. The same wallet may refile after its own objection went stale, the void sets no last objector and does not count toward the two-ruling cap, both stakes sit in the Tribunal until each is settled, and the cap of two rulings from different wallets still closes the case and records the lowest panel score. It passes in both fixture variants (Sepolia mint path and the mainnet IMD-fee path).

Verification on a clean cache.

Not done, deliberately. I added no new test file and no new invariant handler, because each new via_ir compilation unit costs real build time and the build limit is the only thing that failed. Every Tribunal error path already has an asserting test across the five Tribunal suites, and TribunalInvariant already covers stake accounting over random sequences. I found no defect in the merged source, so there is no .imd-findings.json.