The review is complete. The findings file is written and no source, test or configuration file was touched (the lib/ entries in that listing are checkout timestamps, not edits; only .imd-findings.json was created, plus the untracked out/ build output).

Result: no reproducible defect found in the run-8 code. .imd-findings.json holds one info entry stating coverage, as the acceptance criteria require.

What was read in full: all nine contracts under src/ plus the interfaces: PLEA, CabalGate, Seasons, PleaDistributor, PleaLaunch, PleaHook, Letterbox, Tribunal and OracleAttestation. Not reached: the live Sepolia Intake, TestIMD, pool IMD, Stacker, PoolManager and seat NFT (no fork was run).

What was checked against the brief and held:

• The run-8 fact table, the need formula and the PLEA-weighted nearest-point mean in CabalGate._factScoreAt match the stated numbers and band edges exactly.
• The Tribunal's two pending slots from different wallets, stale voiding, the sustain and lowest-score bookkeeping, and the shared time boundaries between filing, standing, the ruling callback and staleness are mutually consistent, so Seasons can never record a plea a live objection could still lower.
• The 40-minute worst case of objections ends inside Seasons' one-hour close grace. The read-never-trust staticcalls to the Tribunal and the seat NFT cannot be starved of gas to skip a hold, because the callee always gets 63 times the caller's remainder.
• The Letterbox's delivery floor is 95 percent of the snapshot value after the hook's 2 percent, matching the gate's net output. The hook's refund-after-payouts order, the pleaClaims burn at rebalance, the Stacker-without-code fallback and the seed dust count behave as described.
• launch.json has the right kind, five contracts in dependency order with 1, 7, 4, 2 and 13 arguments matching the constructors, even-length hex everywhere, and the 12th and 13th PleaLaunch arguments equal the keccak256 of the Letterbox and Tribunal creation code from a fresh offline build. Runtime sizes match the stated 24,402 / 24,038 / 23,255 / 21,654 / 12,473 bytes.

What was run: the offline source build (60 seconds) and the Tribunal, TribunalSeasons, TribunalStanding, Run7ObjectionPoints and AppealRounding suites, 106 tests passed and 0 failed.

Items the audit ledger already accepts (the min-of-panels re-roll, record-time owner exclusion, the gift-buy nudge of holding time, PLEA minting its supply in deployHook, and the Cabal transfer rule as the product's design) were not re-reported.

The run-8 adaptation is complete. The tree as it arrived already met every launch requirement, so the only file this step changed is ADAPTATION.md, committed as 21209b1 on branch adapt-run8.

What I verified

• The import audit's single finding is a coverage note, not a defect. My own review of the round-8 source diff and the brief's rules reproduced no defect either, so no contract was changed and launch.json keeps its hashes.
• The Letterbox and Tribunal creation-code hashes from a fresh offline build equal PleaLaunch's 12th and 13th arguments in launch.json.
• Runtime sizes match the brief exactly: PleaHook 24,402, CabalGate 24,038, Letterbox 23,255, Tribunal 21,654, Seasons 12,473.
• Every agreed number is in the source as stated: letters 20%, hook sale fee 200 bps, the 0-45 fact table with exact band edges, need 71 minus fact, panel 30, quorum 17, the 20-minute window, the 0.35 IMD stake, margin 2, two objections from different wallets, the 1.2 seat multiplier, START 1792335600, credit gas 1,300,000.
• The gate's and the Tribunal's refused character set was checked differentially against Python's Unicode 15.0 database. It refuses exactly the C1 controls, every format, line and paragraph separator and every default-ignorable code point, 4,240 in all, and nothing else.
• PLEA.setLauncher still accepts the deploy-transaction flag or the deployment block. foundry.toml is untouched. lib/ holds ordinary files with no submodule.

Test results, offline, with the verifier's fuzz seed

One figure differs from the brief. The manifest test measured the launch at 12,291,475 gas here, 14,995,599 with the 22% headroom, 1,781,617 under the cap. The brief's 13,494,931 came from a newer forge whose per-call transaction semantics charge more. The fit assertion holds under both, and the brief's figure is noted in ADAPTATION.md.

What ADAPTATION.md now contains: the 17 changes since run 7's code, each tied to its brief rule or audit finding and its guard test, the audit finding's disposition, the launch requirements checked, the verification above, and the deployer's post-launch steps. The stale run-5 record it replaces remains in git history.

The review is complete and the findings file is written.

Outcome: no reproducible defect in the assigned area. The file .imd-findings.json holds an empty findings list and 58 coverage rows, one for each of the 56 listed entry points plus two invariants, all marked holds with a one-line reason.

What I covered (Execution Trace, Periphery, First Principles):

• Traced every state-changing entry point in PLEA, CabalGate, Letterbox, Seasons, Tribunal, PleaHook, PleaLaunch and PleaDistributor from caller to final state, including the Intake callbacks and the three PoolManager unlock callbacks.
• Checked the cross-contract timing edges between Tribunal and Seasons. The objection window and the pending expiry use the same comparisons in object, onOracleResult, _stale and standing, so a plea cannot be recorded while an objection is still rulable, and a sustain cannot land after a record.
• Checked the two-objection, distinct-wallet rule across void, re-file and out-of-order rulings. The lastObjector plus both pending slots cover every reachable ordering.
• Checked approval residuals on every forceApprove in the Letterbox, gate and hook. Each is consumed in full in the same call.
• Checked the PLEA transfer gate against every in-system move: courtTake escrow, the gate's pull, the hook's deliveries, Seasons' bonus and burns, and the distributor's claims.
• Checked the stake and pot accounting. Tribunal stakes in equal stakes out, and checkpointObjection cannot see an unfunded stake because the transfer precedes it and accountedPot never exceeds the pot.
• Read launch.json against the four constructors. Argument counts, order and the Sepolia addresses are consistent with the Letterbox and Tribunal constructor refusals.

Checks run: the source tree compiles under via_ir. LaunchManifest, TribunalStanding, Tribunal, TribunalAdversarial and Letterbox suites all pass on this tree.

Not reached: the fork, invariant and adversarial suites under the full profile were not run, and I did not probe the live Sepolia Intake, Stacker or seat NFT. The attestation binding relies on the Intake pairing each result with its own request id. That is an existing documented trust assumption, not a new finding.

The review is complete and the findings file is written and validated.

Outcome: no permission bypass, escalation path, confused-deputy route, or paired-function asymmetry that loses funds or breaks a guarantee was found in the nine contracts. The findings file holds two information-level items and a 59-row coverage record.

What I checked

• Every role and guard: PLEA owner (allowlist, early seed, two-step handover), launcher-only calls, Letterbox-only gate calls, Intake-only callbacks, PoolManager-only callbacks with their expected flags, Tribunal-only checkpointObjection.
• The PLEA transfer rule for every sender class, including the hook's take recipients named through hookData and the ERC-6909 claim paths.
• Paired surfaces: submitSell against submitFor, appeal against appealFor, executeSell against executeSellFor, record against _tryRecord, object against standing, the Letterbox's deliver against settle, and the Tribunal's ruling, void and settle paths.
• The 1/64 gas trick against the fail-open static calls in Seasons: not feasible, since the continuation always costs far more than the callee.
• launch.json: argument counts, order and cross-contract consistency of the oracle asset, pool IMD, mint flag and code hashes.

Findings written (both informational, neither needs a proof test)

1. Seasons._standing and Letterbox._standing fail open: with an objection pending, a reverting Intake.requests view makes Tribunal.standing revert, so anyone can record the plea at full score inside the window and later objections hit AlreadyRecorded. This matches the code's documented availability choice and depends on an external dependency failing, so I rated it info.
2. PleaLaunch.opened is written and never read; the once-only guard of seed lives in the hook and gate.

Already covered elsewhere, not re-reported: the owner-handover record path (R6-P-1, accepted), the owner allowlist as a Cabal exemption (THREAT-MODEL lists it as a power), and the seat multiplier read at record time (spec).

Not reached in depth: the Sepolia Intake's requests tuple shape and the seat NFT's balanceOf cost were not verified against the live chain. No tests were run beyond the source build.

The review is complete. The findings file is valid JSON, all 56 listed entry points have a coverage row, and the working tree is unchanged apart from the findings file itself.

Outcome: no reproducible math defect found. The findings list is empty, which I state plainly rather than padding it.

What I checked, with the Math Precision, Boundary and Numerical Gap guides:

• Hook fee arithmetic. Exact-input fee A*r/(BPS+r) and exact-output fee A*r/(BPS-r) both charge the same share of the realised fill. I brute-forced every input from 1 to 200,000 wei at the three launch rates. The settled fee is never below the cashback, owner and prize floors, so the pool share subtraction cannot underflow, and no refund is ever due on a full fill.
• Cap decay bookkeeping. The per-day allowance, the carried remainder and the advance of the decay clock reproduce "allowance minus used" exactly, and the clock never passes the block time.
• Fact score. Share, hold, profit and trend bands land in 7 to 45. The PLEA-weighted mean rounds to the nearest point and cannot overflow. A record cannot end with zero IMD spent but PLEA held, so the profit branch is never skipped wrongly. The existing regression suite for this area passes on the tree in both pool orientations.
• Letterbox limits. The 0.70 IMD floor, the 10% fee cap and the 1,000 PLEA minimum match the README. The appeal's floor raise uses rounding-up division, which satisfies the floor check's rounding-down comparison. The delivery floor and the capped auto-sell fee cannot underflow. The uint88 escrow holds the 2.5M cap.
• Seasons. The packed share table decodes to 450 down to 350 and sums to exactly 10,000, so prize payouts never exceed the pot and the rollover cannot underflow. Points fit uint8 and uint16. The accounted pot never exceeds the real pot.
• Time boundaries. Every paired comparison across contracts agrees: pending expiry, the 7-minute window, the objection window, stale objections and the dead-man versus the season index.

One design interaction I noted but did not report as a defect. A letter's fee sale, about 48,000 PLEA at the seed price, zeroes a buy record smaller than itself, so an APPEAL is scored with received-PLEA hold and profit points. That shifts the need by one to three points in either direction. The record reduction is documented behaviour of the fee swap, so it sits in the coverage record as a note for the judge.

Limits of this pass. I did not run the fork, invariant or adversarial suites. A four-file test compile was killed for memory, so I confirmed only the single most relevant suite. The wall-placement liquidity math was traced by reading, not by a numeric test.

The review is complete. The findings file is written and valid, and no source file was touched.

Result: no reproducible economic defect found. .imd-findings.json holds an empty findings list and 60 coverage rows: one holds row for each of the 56 listed entry points, plus four invariant rows (hook fee split and delta balance, the Letterbox delivery floor, the run-8 fact table, and launch.json against the constructors and committed hashes).

What I checked, against the Economic Security, Invariant and Flow Gap guides:

• Hook value flows: the 2.0% split on every path, the reserved-fee refund ordering, the opening payout exception, ERC-6909 claims for IMD and PLEA the PoolManager cannot pay yet, the cap ratchet and trim, the wall guard, and cashback fallbacks. The hook's deltas balance on exact-in and exact-out, buy and sell.
• Letterbox conservation: Letterbox PLEA equals open escrows, Letterbox IMD equals open tips plus in-flight sale proceeds. The 95% floor after the hook's fees uses 98% where the real net is 98.005%, so the 5% room is real.
• Seasons accounting: accountedPot never exceeds pot, so checkpoint and checkpointObjection cannot underflow or revert a Tribunal settle; the 1-hour close grace covers the 40-minute maximum objection hold; rollover and flushToWall leave nothing stranded.
• Tribunal: stake conservation, slot logic for two pending objections, stale handling consistent between object, standing and the Intake callback, season booking of overruled stakes.
• Fact score: every run-8 band and edge, the nearest-point weighted mean for pleas larger than the buy record, and the no-record case.
• launch.json: argument count and order match all five constructors; the manifest suite passes on this tree.

Lead I did not promote. If the live Stacker's credit ever pulled less IMD than approved, the remainder would sit in the hook untracked by retainedImd. The interface and threat model specify it pulls exactly the amount, and I could not read the Sepolia contract, so this stays a note rather than a finding.

Test runs on this machine. LaunchManifest, Tribunal, Letterbox and SeasonFunds suites pass (115 tests). Hook test files could not be compiled here even one at a time: solc was killed for memory, so the hook paths are verified by reading only.