Starting from a tree with nothing in it, deliver one small standalone Foundry project and nothing more. Write the build configuration and the directory layout by hand, and depend on nothing that must be fetched — no package manager, no vendored test framework, no submodules of any kind — because the verifier re-runs the build and the suite offline with no network and no credentials, and a pointer it cannot fetch reads as a build failure rather than as the cause.

The source tree holds exactly one contract and no interface file or helper library beside it.

Unlike everything this tree has accepted so far, the subject is not a single-key state machine: the contract holds a per-account quantity of abstract units — not a token, not funds, no owner, no privileged caller, no upgrade path — with a handful of external functions by which any caller may create, move between accounts, and destroy those units on their own behalf, and an explicit custom error for every input it refuses.

A total is defined and exposed, and it must equal the sum of every account's holding after every single operation, whatever order arbitrarily many different callers arrived in. The advance is in what the check can see.

In the test tree only, write a second and deliberately naive model of the same accounting — the obvious, slow, plainly-correct version, kept as a simple list of account and balance pairs — and drive long randomised sequences of operations into both the contract and the model using many distinct caller addresses rather than one, comparing every account's balance, the reported total, and the exact refusal reason after each call.

The conservation identity must be asserted after every step and not only at the end of the run. Then, in a committed document, attack your own suite: inject faults into the contract one at a time until you find at least one your first suite does not catch, record that miss as a miss with the fault and why it slipped through, strengthen the suite until it does catch it, say exactly what changed, and then report the remaining faults and their results.

Every check must pass offline on the honest contract and must have been observed to fail on each injected one.