The review is complete and the findings file is written. The working tree is otherwise untouched.

Result: no critical or high defects in the five launch contracts or the new Tribunal. One medium finding blocks the launch at the manifest step, plus three lows and two info entries, all in .imd-findings.json.

• Medium, launch.json: the notes string is 4,753 characters, above the manifest's 4,000-character cap, so the whole file would be refused. Nothing in the repo checks this. Every other manifest property holds: keys, names, argument counts, and both committed creation-code hashes match this build's bytecode exactly.
• Low, CabalGate text rules: the gate forbids only [PLEA markers, so a seller can write [/OBJECTION] and [OBJECTION] into the plea itself. The Tribunal quotes the plea verbatim to the second panel, so the seller controls a fake objection block. Reproduced with a scratch test on the project fixture: the gate accepts the text, the Tribunal refuses the same bytes as an objection, and the marker appears in the Tribunal's question.
• Low, Tribunal case cap: two sham objections from wallets the seller funds exhaust the two-ruling cap for 1.7 IMD and lock out genuine objectors. A consequence of the agreed design, flagged for the owner to weigh.
• Low, Tribunal settle: an overruled stake is booked to whichever season is running when someone calls settle, not the plea's season, and nobody is obliged to call it.
• Info: the full test tree does not compile inside this environment's 10-minute limit under via_ir. Source alone builds in 19 seconds, and the four Tribunal suites pass (79 tests) when the other test files are skipped.
• Info, coverage: read in full were Tribunal, Seasons, CabalGate, Letterbox, PleaLaunch, PLEA, PleaDistributor, the interfaces and the consumer half of OracleAttestation. PleaHook was checked only on the surfaces the other contracts rely on. The run-4 suites, the manifest test, fork tests and protected rehearsal could not be executed here.

Also confirmed along the way: the five gate definitions copied into the Tribunal are byte-identical and every value is under 512 characters, the share table sums to 10,000, the 82/6/12 mint sums to the supply, and the Tribunal's callback verifies under its own domain, consumes each request once and stores only.

Findings file is written and validated. Recap:

Outcome. The economics of the Objection! feature and the fix round hold up under static tracing. I found no reproducible loss-of-funds or broken-guarantee defect in my area, so .imd-findings.json carries two informational notes and a full coverage record.

What I checked (Economic Security, Invariant, Flow Gap guides):

• Stake conservation in the Tribunal: object is the only inflow, settle the only outflow, once per decided objection. Void and sustained return to the objector, overruled reaches Seasons and is labelled by checkpointObjection in the same call.
• Seasons accounting: accountedPot stays equal to open season fees plus rollover across checkpoint, objection credit, close and flush. Share table sums to 10,000 bps.
• Timing seam: window plus pending expiry (40 min) ends inside the 1-hour close grace, so a held plea of a closed season cannot exist and no points are stranded by the hold.
• Letterbox appeal floor raise: the raised amount still satisfies the gate's 50% and 1% bands on the lesser balance; the fee can equal the whole sale after a price halving, which the code documents.
• The fail-open reads of the Tribunal through PLEA's launcher, the dead-man never being reset by rulings, and the min-of-panels recording.

The two notes recorded:

• Min-of-panels plus two cheap objections is a positive-EV attack on any leader (about 1.7 IMD on mainnet against a rank's prize). This is the agreed design, flagged as an incentive risk with concrete numbers.
• The ownerless Tribunal hard-codes the Intake price and action id, so a price or version move disables objections for good. No funds are at risk, and the gate shares this from run 4.

Limitation. The sandbox caps memory at 1.5 GB and solc with via_ir was killed on every build that included a test file, so no Foundry test ran. All verdicts are from reading the code. Six PleaHook entry points and two PleaDistributor ones are marked unreached as outside my area.

The review is complete and the findings file is written. Final state:

Result: no reproducible defect found in the assigned area. The file .imd-findings.json holds an empty findings list and a 59-row coverage record covering all 57 listed entry points plus four invariants I checked.

What I traced (Execution Trace, Periphery, First Principles):

• Tribunal end to end. Object, ruling, failure, expire and settle paths. Eligibility, the one-pending rule, the two-ruling cap with distinct wallets, sustain closing the case, the score-only-falls rule, stake conservation, and the late or replayed callback paths. Each check I expected from the brief is present and ordered correctly.
• Seasons and Tribunal coupling. Record and closeSeason read standing through the launcher with fail-open staticcalls. The Held and ObjectionSustained refusals, the min(original, lowest) score, and checkpointObjection's attribution to the plea's season or rollover all behave as specified. The 40-minute bound sits inside the 1-hour close grace because a second objection cannot be filed after the window.
• Fix round. The Letterbox appeal floor raise stays inside the gate's min and max checks and never pulls more PLEA than the writer holds. The hook-owner exclusion skips the pending owner. The appeal question states the real score and need. All six definition values are under 512 characters, and the Tribunal's copy is a byte-prefix match of the gate's.
• Launch manifest. Constructor arity and order match all five contracts. Both committed creation-code hashes in launch.json reproduce from this build.
• Hook. Traced control flow of beforeSwap, afterSwap, seed, rebalance, fundWall and unlockCallback at the level of trader resolution, transient-slot pairing and fee ordering. I did not re-derive the v4 delta arithmetic, and the coverage row says so.

Checks run: the Tribunal suites, the Standing and Seasons suites, and the run-5 audit suite all pass on this tree. The full test suite would not build under the sandbox's 1.5 GB memory limit, so I built the sources alone and ran the relevant suites with the others skipped. No files other than .imd-findings.json were touched, and nothing was written under test/scratch.

Static-analysis leads in my area were checked and not promoted: the encodePacked hash in PleaLaunch is of fixed-shape data and is only compared to the exact bytes deployed, and the uint128 cast in the gate is bounded by the 2.5M cap.

The review is complete and the findings file is written and validated.

Outcome: no substantiated access-control, trust-gap or asymmetry defect in the run-5 code. The file .imd-findings.json holds two info-level entries and a coverage row for all 55 listed entry points plus four invariants.

What I checked, in depth

• Tribunal: every guard on object (approval, window, unrecorded, seller and excluded wallets, one pending, two rulings from distinct wallets), the callback and failure paths (intake-only, own request, own EIP-712 domain with the gate's signer, replay consumption, panel and score checks), expire, and settle. The stake accounting holds, including a settle after the Cabal died, the last season closed and the pot was flushed. Rulings never touch the gate or the dead-man.
• Seasons: record, _tryRecord, closeSeason, checkpointObjection and the exclusion set. The exclusion reads are identical everywhere, the hook owner is immutable, and the pending PLEA owner is deliberately not excluded. The 40-minute hold bound stays inside the 1-hour close grace at the last-second edge.
• Gate, Letterbox, PLEA, PleaLaunch, PleaDistributor, hook: caller checks on every state-changing entry point, the Letterbox-only variants against their user-side twins, the courtTake and _update rules, the one-time deploy and launcher paths, and the hookData trader rule. The manifest hashes in launch.json match this build.

Reported items (both info)

1. With a Tribunal, a delivered or settled letter plea's points are no longer recorded in the same transaction. The Letterbox swallows the Held revert and no contract-side actor retries, so a season closed with an empty list drops those points. This matches the design document but is a run-4 behaviour change worth a keeper or site call.
2. A trust-assumption record for the privileged roles (PLEA owner's add-only allowlist and seed-any-time, distributor owner's one-time root, immutable launch-owner fee share, the oracle signer key), with concrete state showing none of them bypasses a user-side guard.

Not covered in my area: the economics of wall placement in rebalance and the fee arithmetic in the Letterbox's floor raise belong to the other specialists. The scratch test I used for the probes was removed and no repository file was changed.

The review is complete. .imd-findings.json is written and valid, with an empty findings list and 59 coverage rows (all 58 entry points plus four checked invariants). The working tree is clean apart from that file; the scratch tests were removed.

What I checked, in the math, boundary and numerical-gap area

• Seasons' new share table. The packed SHARES bytes decode to 450, 446, … 350 basis points over 25 ranks, match round(450 - 100·i/24) exactly, and sum to 10,000. Prize and bonus payouts floor per rank, so at most 24 wei of IMD rolls over and the 10,000,000 PLEA bonus splits exactly.
• Tribunal rulings. The sustain rule is score + 2 < need in uint256 arithmetic with no wrap. The lowest score only ever falls, the recorded score is min(lowest, original) with 255 as the no-ruling sentinel, and the ruling count is capped at two. The window check in object and the hold check in standing use matching comparators.
• Two boundaries measured, not just read. The worst-case Tribunal callback (280-byte plea, 280-byte original appeal text, 280-byte objection, cold storage) uses about 97k gas against the Intake's 200k stipend. The worst-case decoded question is 1,731 bytes against the 2,000-character limit.
• Letterbox appeal floor (fix round a). I traced the clamp chain with numbers: the result is always at most the original amount and half the balance, at least 1% of the lesser balance, and the fee allowance never lets the escrow pull exceed the balance. The worth-the-fee check is not re-applied to appeals, as specified.
• Seasons accounting. The pot never falls below the accounted pot, so checkpoint cannot underflow and brick swaps. Overruled stakes are credited to the verdict's season through the guarded checkpointObjection. The 40-minute objection-plus-expiry span fits inside the 1-hour close grace.
• Hook fee reconciliation. Specified-side fees are capped at the fill, and the floor-summed cashback, owner and prize shares never exceed the IMD fee, including on exact-output fee swaps, so the pool share cannot underflow.

Verification limits. The container's 1.5 GB memory cap kills a full forge build, so I could not run the existing suite. Sparse compilation of single test files did work, which is how the gas measurement and the share-table check were executed. The hook's rebalance and wall-guard arithmetic were traced by reading only.

Result. No defect in the assigned area was substantiated, so the findings list is empty. Every entry point has a coverage row with a one-line reason.

The review is complete and .imd-findings.json holds the result. Nothing else in the tree was changed.

Outcome: no reproducible defect above info level. The four specialist notes reproduce against the code but describe agreed design or documented trust, so I kept them merged as four info entries, none with a proof. No finding blocks the launch.

What I verified myself

• Tribunal, Seasons, PLEA, PleaLaunch and PleaDistributor read in full. CabalGate and Letterbox read in the changed regions: the appeal question and definitions, text rules with the new objection markers, submit/appeal/sell paths, the appeal floor raise, deliver, settle, record and the status views.
• The five definitions members in the Tribunal are byte-identical to the gate's, and every member is under 512 characters. The worst-case Tribunal question for an appeal is 1,729 characters, under the 2,000 cap.
• The two creation-code hashes in launch.json equal keccak256 of the built Letterbox and Tribunal creation code. All runtime sizes are under the 24,576-byte limit, the Tribunal at 19,686.
• The 25-rank share table sums to 10,000 and falls from 450 to 350. The 82/6/12 mint and the six 10,000,000 PLEA bonuses add up to the supply.
• Timing: the 20-minute window plus 20-minute expiry fits inside the 1-hour close grace, and the hold, sustain and lowest-score rules line up between Tribunal.standing, Seasons.record and closeSeason. A reverting or absent Tribunal falls back to run-4 recording, and the 63/64 gas rule prevents starving that staticcall.
• Tests: the 188 tests in the Tribunal, Seasons, Letterbox, AppealRounding, AuditRun5 and OwnershipTransitionInvariant suites pass. The full suite did not finish within the time I could give it after a slow via-IR compile, so the remaining run-4 suites were not re-run here.

Kept as info, merged from the specialists

• Lowest-of-panels scoring makes two overruled objections a cheap lever against a leader. This is the brief's rule, reported as an incentive note.
• The ownerless Tribunal hard-codes the 0.5 IMD price and action id, like the gate accepted in run 4.
• With a Tribunal, a letter plea's points need a later permissionless Seasons.record call, since deliver and settle swallow the Held revert. Documented in OBJECTIONS.md and the status line.
• Trust assumptions of the owner roles and the single oracle signer, with no bypass found.

Coverage: 57 rows, 49 holds, 2 invariants, 6 PleaHook entry points marked unreached because that run-4 code was not re-traced in this round's budget.