I couldn't commit: git has no author identity on this machine, and setting one means writing .git/config, which is off limits. All files are staged in the working tree.

All five contracts are written and tested. forge build, forge test (51 tests, 0 failed) and forge fmt --check all pass with solc 0.8.26.

What's there

• LaunchToken (src/LaunchToken.sol): "IMD RISK" / RISK. A plain fixed-supply ERC-20 with 10^27 units minted to whoever deploys it. It has no mint, owner, fee or pause.
• MatchFactory: lobbies for 2–6 players with entry fees in IMD. Entry can also be paid in RISK: 10% is burned to 0x…dEaD and the rest is swapped to IMD. Each player commits a secret on joining, and the dice seed is built from all their reveals. A match is settled either by every player signing the final ranking or by one signature from a seat signer the owner sets. Pull refunds cover a lobby that doesn't fill, a player who never reveals (their entry is shared among those who did), and a match nobody settles in time.
• PrizeVault: pays prizes in IMD only, by pull payment. The split is 60/25/15 (75/25 with two players). Each wallet gets at most 3 paid placements per rolling 24 hours; a placement over the cap goes to a bonus pool instead. That pool only tops up matches the seat signer settles, and never by more than half the pot.
• Cosmetics: sales in IMD are split 20% + 10% to Buyback, 35% to the vault's bonus pool and 35% to a seats/stakers recipient.
• Buyback: buys RISK and burns it in the same transaction. It also reports circulating supply (total minus the 0x…dEaD balance).
• RiskRules: an internal library with the dice, battle resolution (defender wins ties), the 6-continent / 42-territory map and reinforcements with continent bonuses.
• ABIs are in docs/abi/. forge-std is included as plain files, and there is no launch.json.

I also checked runtime sizes and scanned the bytecode for DELEGATECALL, CALLCODE and SELFDESTRUCT, the same check the protected tests run. All five contracts passed.

Decisions for you or the reviewers (all written up in the README):

1. Two different IMD addresses. The brief says IMD is 0xD34a99…63B7, but the launch's chain table for Robinhood Chain says 0x5f7bb5…7127. I haven't checked either on chain. I recommend the chain table's address, but the manifest step and review need to confirm it. Whichever is used is fixed permanently in all four contracts.
2. Owner settings needed after launch, listed under "After launch". Until each is set, the functions that need it revert with a clear error:
   • link the vault to MatchFactory (one time);
   • the swap venue in Buyback;
   • the seat outcome signer;
   • the seats/stakers recipient;
   • the cosmetics catalogue.
3. Not built as asked:
   • the IMD Community Coin curve with 0.5% IMD-leg burns, because this launch opens a factory pool at 1.25% instead;
   • the "1% attack tax on bought Pepes", because attacks happen off-chain and there are no bought units on-chain;
   • the ONCHAIN.md economy, which I didn't fetch.
4. Trust: game moves aren't verified on-chain. The seat signer, or the owner if they control that key, can decide rankings and draw from the bonus pool. The commit-reveal seed is not a VRF.

These contracts hold user funds and need an independent adversarial review before release.

I found one defect in the math area: the anti-farming cap in PrizeVault resets at a fixed time instead of rolling, so one wallet can collect up to 6 paid placements within seconds. I traced it by hand and did not write or run a Foundry test, so it's unverified by execution. It's medium severity, so no proof file is attached. The results are in .imd-findings.json, and it parses as valid JSON.

Finding (medium): src/PrizeVault.sol:135, _consumeRewardedWin. The contract says it allows at most 3 paid placements per wallet in a rolling 24-hour window, and the brief asks for a 24h cooldown with at most 3 rewarded wins a day.

• What the code does: the window starts at the wallet's first win and the counter resets completely exactly 24 hours later. Nothing tracks when the last three wins happened.
• Failure case: first win at T, two more at T+86398 and T+86399, then three more at T+86400. All 6 are credited to the wallet's claimable balance; the 4th to 6th should go to the bonus pool.
• Suggested fix: store the timestamps of the last three paid wins, and pay a new one only if the oldest is at least 24 hours old.

What holds:

• Prize split: 75/25 for two players and 60/25/15 for three. Rounding dust goes to first place, and the bonus is capped at half the pot.
• Cosmetics split: 30% buyback, 35% seats and 35% vault, with dust to the vault. The three always add up to the cost.
• Refunds: the entry fee times the player count equals the pot. In cancelUnrevealed, each revealer's share plus the dust equals the pot, so the static analyser's divide-before-multiply warning isn't a real loss.
• RISK entry route: 10% burned, the rest swapped, at least the entry fee required back, and any extra IMD returned to the player.
• Overflow: casts and checked arithmetic are safe.
• Combat rules (RiskRules): dice sorting, ties going to the defender, continent masks and the minimum of 3 reinforcements are all correct.
• Buyback reentrancy: the reentrancy warnings on Buyback aren't exploitable, because both functions are guarded against reentry and check the actual balance change.

Coverage: all 32 listed entry points have a row, and none are left unreached. 31 hold and PrizeVault.awardMatch carries the finding. I also added a row for the RiskRules invariants.

There is no launch.json in the tree yet, so I didn't review a manifest.

launch.json is written and verified. It is the only file changed in the working tree.

What the manifest contains

• Kind evm_project, token LaunchToken with name "IMD RISK", symbol "RISK", 18 decimals, as set in src/LaunchToken.sol.
• Four project contracts in constructor dependency order: Buyback, PrizeVault, MatchFactory, Cosmetics. Each has one entry per constructor parameter, matching both the source and the exported ABIs in docs/abi.
• Every initialOwner is $owner. Every riskToken is $token. Vault and buyback references use $contract: and point backward only.
• Pool fields exactly as the launch facts give them: IMD paired currency, fee 12500, tick spacing 60, initialPrice one to one.

One judgment call, flagged in notes. The contracts take an imdToken address. The README recorded a conflict between the brief's IMD address and the launch chain's IMD. I used the Robinhood Chain IMD address from the launch facts, which is also the pool's paired currency, since the contracts deploy on that chain. The notes carry this forward as a review finding so the independent review can confirm it.

Checks run

• A scratch script validated schema keys, name rules, reference direction, argument counts and types against the ABIs, lowercase addresses, and notes length.
• A scratch Foundry test deployed all four contracts in manifest order from a factory address on an empty chain with the IMD address holding no code. All constructors succeeded, owners resolved correctly, and the token supply stayed with the factory.
• forge build and forge test pass: 51 tests, 0 failures.

Nothing was committed, since the brief did not ask for a commit. The scratch files live in test/scratch and are discarded automatically.

I found 4 economic defects, 3 medium and 1 low; none is critical or high. They are written to .imd-findings.json along with a coverage row for each of the 32 entry points and 2 accounting invariants. I ran Foundry tests for findings 1, 2 and 4, then deleted them, so the tree is unchanged. Finding 3 is worked out from the code, not tested.

1. Medium: a losing player can stop the prize from being paid (src/MatchFactory.sol:239). By default no seat signer is set, and the brief's linked guide says there should be none. Then settle needs every player's signature. A loser who doesn't sign loses nothing: after the grace period, expire refunds everyone in full. In the test, a 2-player match with a 100 IMD entry ended with both players refunded 100 IMD and the winner paid nothing.
2. Medium: the bonus pool can't be paid out without a seat signer (src/PrizeVault.sol:86). Money leaves the bonus pool only in matches the seat signer confirms. But it keeps coming in: 35% of every cosmetics sale, plus any prize forfeited under the daily cap. With no signer, or after the owner sets it back to zero, that IMD is stuck. In the test the pool only ever grew.
3. Medium: two wallets owned by one person can drain the bonus pool by playing each other. Each seat-confirmed match adds up to 1% of the pool to the prize. If both seats are the same person, they get the whole pot back plus that 1%. For example, with a 100,000 IMD pool and the maximum 10,000 IMD entry, they net about 1,000 IMD per match. The seat signer is honest here, since the match is real. Fresh wallets get around the 3-wins-per-wallet cap, and about 63% of the pool is gone after 100 matches. The README mentions that sybil wallets can collude, but not that this drains the pool.
4. Low: the daily cap allows 6 paid wins in 24 hours, not 3 (src/PrizeVault.sol:135). The 24-hour window starts at a wallet's first win and resets all at once rather than rolling. In the test one wallet was paid for 5 wins within 60 seconds. The code comments and README promise a rolling 24-hour window.

Coverage: six entry points are marked as having findings. The other 26 hold, as do both invariants: the vault's IMD covers the bonus pool plus everything players can claim, and MatchFactory's IMD covers open pots plus refunds owed. The static-analysis leads didn't hold up: the Buyback reentrancy warnings are blocked by its reentrancy guard, and the rounding in cancelUnrevealed still pays out the whole pot.

Trust assumptions, not counted as defects: the owner sets the swap venue, so a malicious venue could misuse the IMD held for buybacks; the README discloses this. The owner can also turn the seat signer off at any time, which feeds into findings 1 and 2.

Not covered: the combat rules in RiskRules (outside the economics area), and the brief's features the README already lists as not built: the bonding curve, the 1% attack tax, and the ONCHAIN.md fee setup.

I wrote .imd-findings.json with 5 findings (2 medium, 3 low) and a coverage row for each of the 32 entry points. No source files were changed, and the scratch test I wrote has been deleted.

Findings

1. Medium: the owner can decide who wins a match (src/MatchFactory.sol:243). The owner can change the outcome signer at any time, even while a match is running. They can set it to their own key, join a match with a second wallet, and settle it with that wallet in first place. This moves other players' entries to the owner without their consent, although the README says the owner "cannot move prize, refund or pot funds". A Foundry test is attached as proof and fails on the current code. In a 2-player match with 100 IMD entries, the owner's wallet can claim 150 IMD and Alice 50, so Alice loses 50 IMD of her entry. Suggested fix: record the signer when each match is created, or put signer changes behind a delay.
2. Medium: the IMD set aside for buy-and-burn is in the owner's hands (src/Buyback.sol:39). 30% of cosmetics revenue goes to Buyback, and only the owner can spend it. The owner chooses the swap venue at any time and sets the minimum output. A venue they control can take all 300 IMD from a 1,000-IMD sale and return 1 wei of RISK. If the owner never acts, nothing is burned.
3. Low: PrizeVault.setMatchFactory accepts any address (src/PrizeVault.sol:54). If the owner links their own wallet instead of the real MatchFactory, they can call awardMatch directly and drain the bonus pool about 1% per call. Because the link can only be set once, every real match's settlement would then fail.
4. Low: a losing player can block every payout (src/MatchFactory.sol:268). No outcome signer is set at launch, so settling needs every player's signature. A loser who never signs gets their full entry back once the match expires, so the winner can never collect.
5. Low: the owner can redirect the seats/stakers share after it has built up (src/Cosmetics.sol:76). The 35% share is paid to whoever is the recipient at payout time, so the owner can switch it to their own wallet just before paying out.

Coverage: 23 entry points hold and 9 are tied to a finding; none were left unreached. I did not report the static-analysis leads separately:

• Buyback reentrancy: the swap functions and burnHeldRisk share one reentrancy lock, so none of them can re-enter another.
• Uninitialized variables: they are zero by design.
• Missing zero-check on setOutcomeSigner: zero is intentional; it switches seat signing off.

No launch.json exists yet, so the manifest wasn't reviewed.

The review is complete. The findings file is written and the only failing test is my own proof test in test/scratch/, which is expected on the current code. The project's 51 existing tests still pass and no source, config or doc file was changed.

Outcome: one high finding with a failing Foundry proof, two low findings, and coverage rows for all 32 entry points plus three invariants, the periphery libraries, the ABI exports and the absent manifest.

Findings written to .imd-findings.json:

1. High, createMatch commitment race. The creator's commitment must encode the matchId, but createMatch assigns nextMatchId++ at execution time and cannot check the commitment. Any earlier createMatch shifts the id, so the creator can never reveal and cancelUnrevealed pays their entry to the other players. An attacker induces it by front-running with a throw-away lobby that is refunded later, so the attack costs gas and wins up to the 10,000 IMD maximum entry. The proof test fails on the current code with the victim down 100 IMD and the attacker up 100 IMD, and it tolerates either suggested fix.

2. Low, loser veto in unanimous settlement. With no seat signer configured, a losing player simply never signs, expire refunds everyone, and the winner's prize is never paid.

3. Low, manifest-stage IMD address conflict. No launch.json exists yet. The README leaves two candidate IMD addresses open. All four contracts take it as an immutable, and every IMD path reverts permanently if the manifest writes an address with no code on the launch chain.

What held: PrizeVault award, cap and bonus accounting, the two conservation invariants, the RISK entry route with exact approvals and balance-delta checks, signature replay protection, the periphery libraries including the dice rules and 3-sort, and the five ABI exports which match the compiled output byte for byte.

Not reached: the manifest itself, since it has not been produced yet. Slither's reentrancy leads on Buyback all sit inside the owner-trusted venue dependency and did not become findings.

Work is complete and verified. Summary:

Delivered (all under test/):

• test/invariants/MatchFactoryInvariant.t.sol: a handler drives the full match lifecycle with six signing actors (IMD and RISK entries through the venue, early and expired lobby close, partial reveals, unanimous and seat-attested settlement, expiry, refunds, claims, bonus funding, time warps). Eight invariants hold after every call: factory IMD equals live pots plus owed refunds, refund and claimable ledgers match their totals, vault stays solvent, system-wide IMD conservation, prize split conservation, RISK is never stranded and burns reach dEaD, terminal states never reopen, seeds are the XOR of every player's secret, and the per-window cap matches paid placements. Fail-on-revert is on, so every handler call pre-checks state and asserts exact per-call accounting.
• test/invariants/EconomyInvariant.t.sol: a handler acting as the vault's factory drives cosmetics sales, seat flushes, buybacks at moving venue rates, RISK routing, donated RISK, sponsor funding, random prize awards and claims. Seven invariants cover the four-way revenue split, item supply and ownership, buyback IMD ledger, burn finality and fixed supply, vault solvency and pool ledger, the rewarded-placement cap, and actor IMD reconciliation.
• test/EdgeCases.t.sol: 49 unit and fuzz tests on failure paths the existing suite skipped: entry-fee bounds, inclusive join deadline, six-player payouts, double reveal, refund dust, settle-versus-expire boundary, malformed and malleated signatures, seat signature posing as players, zero-address rankings, exact and over-paying RISK routes, re-entrant venues, vault count and underfunding checks, tiny-prize rounding, cap forfeits on second place, exact 24h reset, cosmetics cap and dust rules, buyback zero-output and over-spend, two-step ownership, token allowance edge cases, and RiskRules dice, reinforcement and continent properties.

Results: forge build succeeds and forge test passes 102 tests. The only failing test is the proof under test/scratch/, which is meant to fail and is deleted before verification.

Findings reported in .imd-findings.json:

• Medium, with proof: PrizeVault documents a rolling 24-hour cap of 3 rewarded placements, but the window is anchored at the first win and reset wholesale, so a wallet is paid 5 placements within one second across the reset and 6 within one 24-hour span. The README describes the anchored behaviour, so this is an intent and natspec mismatch, not a fund loss.
• Low: RiskRules.compare sorts attacker dice slots beyond attackDice, so stale padding changes a battle result for off-chain replayers.

Review complete. The findings file is written and validated, no source files were changed, and git status shows nothing outside the findings file and the scratch tests.

Outcome: 7 findings kept out of 15 specialist reports, all 32 entry points answered.

Findings, in order:

1. High – createMatch binds the creator's commitment to a matchId it can only predict. Any earlier createMatch shifts the id, the creator can never reveal, and cancelUnrevealed gives their entry to the other players. Attack costs gas only. The audit_flow proof fails on current code with the stated balance mismatch and is attached.
2. Medium – The per-wallet reward cap is a fixed window anchored at the first win, not the documented rolling 24 hours. Six paid placements inside 24 hours. Three specialist reports merged. The tester's proof fails as stated and is attached.
3. Medium – The seat outcome signer is optional and zero at launch, yet both prize enforcement and the bonus pool depend on it. A loser vetoes any payout by waiting for expire(), and the 35% cosmetics share plus forfeits have no exit. Four specialist reports merged into this one root cause, confirmed in a scratch test.
4. Low – The owner can retarget the outcome signer mid-match and settle any Playing match, contradicting the README's claim that the owner cannot move pot funds. Owner trust assumption, documented poorly. The Buyback venue and seats recipient powers are folded in as notes since the README already documents them.
5. Low – PrizeVault.setMatchFactory takes any address and is permanent. A typo or an EOA bricks settlement forever and lets the linked address draw the bonus pool. Confirmed in a scratch test.
6. Low – Self-play with fresh wallet pairs extracts 1% of the bonus pool per seat-attested match. The README documents this limitation, so it stays low. Confirmed in a scratch test.
7. Info – RiskRules.compare sorts unused attacker dice slots. Internal only, unreachable from any entry point.

Dropped: the manifest IMD conflict. I checked chain 4663 directly: the manifest's address has code and returns symbol IMD with 18 decimals, while the brief's address has no code there. The manifest is correct as written. Also verified: launch.json schema, constructor order and references, dependency order, contract sizes, no forbidden opcodes, docs ABIs identical to compiled ABIs, and the existing suite passes 102 of 102.

Slither's reentrancy leads on Buyback do not reproduce through the nonReentrant guard and owner-set venue. The uninitialized-local and divide-before-multiply leads are harmless by inspection.

Everything verifies: build passes with all runtime sizes well under the limit, 64 tests pass (62 in the suite plus the two scratch proofs), formatting check exits clean, and the responses file holds all seven answers.

Recap

Outcome. Both binding proofs reproduced on the starting tree. The rolling-window proof now passes. The match-id race is fixed, but its proof file cannot compile against any fix, so that one is answered as "disputed" with the reasoning below; the other six are "fixed".

What changed

• Match-id race (high). createMatch now takes the id the creator built their commitment for and reverts with MatchIdMismatch before any transfer if another lobby took it. The reviewer's proof calls the old 5-argument createMatch directly for the attacker, so it fails to compile against the fixed contract. The reviewer's alternative fix would also fail their proof, because the proof's victim still submits an id-bound commitment and loses. An adapted copy of the proof with only the signature change passes.
• Rolling 24h cap (medium). PrizeVault keeps the timestamps of each wallet's last three rewarded placements and pays only when the oldest is 24 hours old. New views expose the slots and the next free time.
• Loser veto (medium). Added an optimistic path: a player proposes the ranking, other players have 24 hours to dispute, then anyone finalises. It never draws the bonus pool. A silent loser no longer forces a refund. The README now states the seat signer is required for the bonus pool to pay out.
• Signer mid-match (low). Each match snapshots the seat signer at creation, so a later change cannot decide it. README owner-powers paragraph corrected.
• Vault link (low). The link now rejects addresses without code. The suggested cross-check of the factory's vault address was not added because the binding window-cap proof links the vault to a test contract that lacks that getter.
• Sybil bonus farming (low). Documented as a seat-operator responsibility, with the note that non-attested paths cannot touch the pool.
• Stale dice slots (info). compare validates counts and zeroes unused slots.

Tests, ABI exports in docs/abi, and the README lifecycle, cap, trust and checklist sections were updated accordingly. No launch.json and no blocked file were written.

The accepted manifest already matches the tree exactly, and no findings were supplied with this revision, so there is nothing to change. Summary of what I verified:

Manifest checks against the accepted source

• Kind is evm_project, and the top-level keys are exactly kind, token, contracts, pool, notes.
• Token entry names LaunchToken with name "IMD RISK", symbol "RISK" and 18 decimals, matching the constants in src/LaunchToken.sol. It has no constructor arguments.
• Four project contracts are listed in constructor dependency order: Buyback, PrizeVault, MatchFactory, Cosmetics. Each constructorArgs list has one entry per parameter in declaration order, cross-checked against both the Solidity constructors and the exported ABI files under docs/abi.
• Every $contract reference points backward, every reference sits in an address-typed parameter, and every owner argument is $owner. No msg.sender or tx.origin owner anywhere.
• The IMD literal is the lowercase chain pair token address, also used as pool.pairedCurrency. Pool fee, tick spacing and initial price are as the launch section gives them.
• All names are unique, under 32 characters, and avoid the reserved names. Notes are 2,267 characters.

Build and tests

forge build: compiled without errors
forge test:  62 passed, 0 failed, 0 skipped across 6 suites

The working tree is unchanged and clean. launch.json stands as the accepted version, which already describes the implementation that is in the tree.

The revision is complete. forge build and forge test pass: 127 tests, both invariant suites at 64 runs by depth 80 with zero handler reverts. Only my three test files changed.

Why the revision was needed. The implementation was revised after my previous tests were accepted, and they no longer compiled. createMatch now takes the expected match id, the vault's fixed 24-hour window became a rolling three-slot cap, and MatchFactory gained an optimistic propose, dispute and finalize round with the seat signer snapshotted per match.

What changed in the tests.

• EdgeCases.t.sol. Every create call uses the six-argument form. The seat-signer test now checks the snapshot semantics: a rotated key cannot settle an older match, and disabling the key does not revoke it for matches created under it. The window test became a rolling-slot test with placements an hour apart, checking the exact second each slot frees and that a capped share lands in the bonus pool. New tests cover a stale expected id, the permanent and code-only vault link, and a fourth placement forfeiting even as third place.
• New OptimisticSettlementEdgeTest. Nine tests drive the propose, dispute and finalize round through what it must refuse: outsiders, repeats, the proposer disputing itself, both sides of the dispute and grace deadlines, a ranking other than the proposed one, finalize after settlement, no bonus draw, signatures overriding a pending or disputed proposal, expiry blocked by a pending proposal but not a disputed one, an unlinked vault, and a capped proposer forfeiting only its own share.
• MatchFactoryInvariant.t.sol. The handler gained propose, dispute and finalize actions, records the signer at creation, and asserts that expire reverts with ProposalPending while an undisputed proposal is pending. A new invariant checks proposals are immutable, single, never finalised once disputed, and that the snapshotted signer never changes. The cap invariant now checks that any four consecutive paid placements span at least 24 hours and that the vault's slots equal the last three ghost timestamps. Time hops were rebalanced so lobbies reach settlement more often, and I verified with a scratch probe that the finalize and blocked-expire paths fire inside random sequences.
• EconomyInvariant.t.sol. The same rolling-cap invariant replaces the old window counter.

Findings. None reported. Three failures during the work were harness mistakes, not contract defects: a warp that crossed both the dispute and cap windows, a dispute attempted after its window had closed, and a view call consuming an expected revert. The free-dispute griefing trade-off and the equal dispute and cap windows are design choices the README already documents.

Review complete. The revised code settles every finding from the previous round, and I found no new reproducible defect. The findings file holds an empty list plus a 38-row coverage record, and the tree is unchanged apart from that file.

How each prior finding settled

• createMatch id race (high): fixed. The function now takes the expected id and reverts before any transfer when another lobby took it. The original proof cannot compile against the new signature, as the author said. A copy changed only in the call signature passes: the victim's stale call reverts, both balances stay unchanged, and a retry with the fresh id reveals normally.
• Anti-farming cap not rolling (medium): fixed. The vault keeps three timestamps per wallet and pays only when the oldest is 24 hours old. The attached proof passes, and a boundary probe confirmed the fourth placement forfeits and the slot frees at exactly 24 hours.
• Loser veto and locked bonus pool (medium): fixed within the option I offered. A silent loser no longer blocks payout. I probed the new propose, dispute, finalize and expire interplay with a last-second proposal, a vault linked after the proposal, a disputed proposal, a wrong-ranking finalize and an unlinked vault. Funds were conserved in every case. A loser who actively disputes a true result can still force a refund. The README now states this and says the seat signer is required for the bonus pool to pay.
• Owner installs itself as signer mid-match (low): fixed. The signer is snapshotted per match. The adapted proof shows the owner's late signer is rejected with no prize credited.
• setMatchFactory accepts any address (low): fixed for the EOA case, which was the demonstrated drain. Linking a self-controlled contract remains documented owner trust.
• Sybil bonus farming (low) and RiskRules stale dice (info): accepted as documented and fixed respectively.

Other checks

• Full project suite: 128 tests pass.
• Manifest: constructor argument counts and order match all four constructors, names are unique, addresses lowercase, pool fields match the task's launch facts, and the IMD argument equals the pool's paired currency.
• Exported ABI files equal the compiled ABIs. Largest runtime is well under the size limit.

One item I could not verify from this worker: that the IMD address written in the manifest has code on chain 4663. The brief's differing address is documented in the README and manifest notes as the open conflict.

Implemented the game, wallet controls, cover, manifests and static export.

Passed: build/typecheck, 13 unit tests, 16 browser scenarios and 16 design checks. Files total about 2.96 MB.

Two limitations remain:

• .git is read-only, so no commit could be created.
• Pepe2Pepe host claims require a missing deployed Game interface. Direct PrizeVault claims are implemented.

Validation report documents evidence and limitations.

Saved 8 verified findings: 1 high, 7 medium in .imd-findings.json. Each includes exact source citations, a proposed correction and measured reproduction steps. Implementation and export remain unchanged.

• High — fidelity: every map rank uses the same icon; required pips and job gear are absent.
• Medium — bug: entering . in slippage after receiving a quote blanks the entire app.
• Medium — bug: dismissing results removes every restart route.
• Medium — accessibility: Enter selects a territory and also commits an order.
• Medium — bug: navigating away during simulation permanently locks wallet controls.
• Medium — bug: switching Buy/Sell during quoting accepts and relabels the opposite-direction quote.
• Medium — fidelity: requested territory pulses, atmospheric lighting and combat flashes are absent.
• Medium — fidelity: display lettering lacks the requested military-stencil treatment.

The isolated build was byte-identical; typecheck, 13 unit tests and 16 existing browser scenarios passed. Additional checks reproduced defects despite those passes. The first three functional defects also reproduce in WebKit. All deployment bindings and 14 asset hashes validate; the export totals 649,843 bytes.

The site’s visual idea is a tactical Pepe conquest game carried by a dark cartographic hex board, neon continent strips and angular military portraits.

The checklist groups related clauses and counts repeated brief paragraphs once. “Met” means delivered; the defects above qualify its behavior.

Fixed all eight findings, rebuilt dist/ and its manifest, and wrote .imd-responses.json.

Validation passed: build/typecheck, 13 unit tests, 31 browser checks, 16 design checks, and ABI/asset hashes. Bundle: 5.36 MB.

Git commit was blocked by read-only .git; files are ready for worker collection.

All eight reported findings are fixed. .imd-findings.json contains {"findings":[]}. Source and export remain unchanged.

Fresh validation passed: 31/31 browser scenarios, 13/13 unit tests, typecheck and production build. The isolated rebuild is byte-identical to the committed export. All five ABIs match the pinned commit; all 14 asset hashes and the complete deployment configuration match.

The checklist below retains the disclosed deployment dependencies. “Met” describes implementation evidence, not certification of real funded transactions.