Implemented TitheHook, TDEMO token, and router, with ABI exports and deployment documentation.

Verified Solidity 0.8.26 build, formatting, ABI consistency, and 40 passing tests, including 8,192 invariant calls.

Deployment parameters and assumptions are in README.md. Mainnet deployment, frontend publication, and independent review remain with subsequent workflow stages.

The math in the Tithe contracts is sound with one exception: a swapper can be overcharged when an exact-input swap only partly fills and goes through any router other than TitheRouter. I recorded that as one medium finding in .imd-findings.json, with 15 coverage rows: all 14 entry points plus the balance invariant. No repository files were changed; the scratch test I ran was deleted and the working tree is clean.

Finding 1 (medium), src/TitheHook.sol:157. For an exact-input swap of amount A, the hook first sets aside the full tithe R = A × bps / 10,000. If the swap stops early (it hits its price limit or runs out of liquidity), the tithe actually owed is smaller. The leftover is issued as ERC-6909 claims to whichever contract called the swap. Only TitheRouter turns those back into a refund. A Universal-Router-style router just pays the full debt, and the claims stay stuck on that router contract.

• Reproduction: I used the repo's test setup (25 bps, liquidity in ticks −600 to 600) and a minimal router that settles the swap the way Universal Router does. A 10,000 ETH buy filled only partly.
• Result: the trader was charged the full 25 ETH set aside, but only about 7.73 ETH was credited to seat 1. The router was left holding about 17.27 ETH of claims the trader can't get back.
• Expected: the trader pays only for what filled plus about 7.73 ETH of tithe, and nothing is left on the router.
• Why it matters: the demo pool is meant to have modest liquidity, so a large swap reaching the end of its range is realistic. The overcharge per swap is at most 0.25% of the requested input at the default rate.
• Possible fixes: return the unused amount through the swap's own balance changes so every router sees the correct debt, or refuse exact-input swaps that don't come from TitheRouter.

What holds (the 15 coverage rows):

• Exact-output tithe: the hook adds the tithe on top of the actual input, and the trader is charged it correctly.
• Exact-input on a full fill: the tithe taken equals the amount set aside, and the hook's balance changes net to zero.
• Overflow and casting: the int128 limits are checked before narrowing.
• Large pending balances: redemption is capped at the int128 limit per call.
• claim: the static-analysis reentrancy leads are blocked by the shared reentrancy guard.
• Locked ETH: the analyser's warning doesn't apply, because ETH tithes leave through claim.
• Balance invariant: the recorded totals always equal the hook's balances.
• TitheRouter: refunds are handled correctly.
• TitheToken: plain OpenZeppelin ERC-20.

Dust swaps below about 400 base units pay no tithe because of rounding down. I didn't report that, since the amounts involved are negligible.

Created launch.json with matching constructor arguments, permissions, token metadata, and required pool settings.

Checked against supplied manifest rules. forge build succeeded with existing source lint warnings; forge test: 40 passed, 0 failed.

Only launch.json changed outside permitted scratch output.

Added 23 unit/fuzz tests and 3 stateful invariants covering failure rollback, reentrancy, live seat ownership, partial fills, taxed transfers, and accounting conservation.

forge build and forge test pass: 64 passed, 0 failed, 0 skipped.

Changes are confined to test/. No reproducible production defects found. Mainnet fork verification remains outside this offline suite.

The review is complete. No tracked file was changed; the findings file and the scratch proof are both git-ignored.

Outcome. One high finding, one informational note, and a coverage record for all 14 entry points plus four invariants, written to .imd-findings.json.

High: exact-input partial fills strand the unused tithe reservation. The hook reserves the tithe on the whole exact-input budget in beforeSwap, then refunds the unused part in afterSwap by minting ERC-6909 claims to whatever contract called the swap. Only the delivered TitheRouter burns those claims. A canonical integrator such as v4-periphery's V4Router or the Universal Router settles the full debt the manager reports and never burns claims, so its user overpays and the difference is locked in the router forever. The proof test test/scratch/StrandedRefund.t.sol fails on the current code in two ways:

Case	Budget	AMM consumed	Tithe kept	Stranded in router
explicit price limit	10 ETH	0.101 ETH	0.00025 ETH	0.0247 ETH
default limit, liquidity exhausted	500 ETH	3.08 ETH	0.0077 ETH	1.24 ETH

A full fill leaves nothing stranded, so the loss is specific to partial fills. The README names this as an integration caveat, but the loss scales with the budget rather than the trade, and the Universal Router is the default path for any wallet reaching the live demo pool. The suggested fixes keep the input-currency tithe: credit the seat the whole reservation on exact input, or drop the reservation and take the exact-input tithe from the output side.

Info: burned or unminted seat locks its tithe. This is the no-admin behaviour the brief asks for, recorded as a trust assumption; the service must confirm on mainnet that the chosen seat exists and has a payable owner.

What held. Every hook callback and both unlock callbacks refuse callers other than the PoolManager. The hook's currency delta nets to zero on every swap path, including the deferred mint path on a fresh manager. The redeem-then-claim ordering, the _redeeming flag, and the shared reentrancy guard close the paths Slither and Aderyn flagged. TitheRouter pulls funds only from its caller, burns exactly the refund claims from its own swap, and checks every settle return. The permission mask 0x20cc matches getHookPermissions, the ABI exports verify, and the launch pool key (fee 12500, spacing 60, ETH pair) is accepted by beforeInitialize. No launch.json exists in the tree yet; the constructor table in DEPLOYMENT.md is consistent with the implementation.

Review complete. The findings file is written at the repository root, and the only working-tree changes are the findings file and my scratch tests, which are ignored by git.

Outcome: one medium finding, no critical or high. The hook's accounting is sound everywhere I traced it: fee math, int128 caps, take/mint netting, the deferred ERC-6909 path on fresh managers, redemption, live-owner claims, reentrancy coverage, and the router's refund protocol. The project's 40 tests pass, including the stateful invariant campaign.

Finding 1 (medium), src/TitheHook.sol exact-input refund path. For exact-input swaps the hook reserves the tithe on the whole budget in beforeSwap, then in afterSwap charges only the fee on what the AMM actually consumed and mints the difference back to the calling router as ERC-6909 claims. Uniswap's V4Router, the Universal Router's v4 module, supports only swap, settle and take actions and reverts on every ERC-6909 action, so it pays the full reservation from the user and the refund claims are locked in the router forever. I fetched v4-periphery to confirm the router has no burn handler.

Measured in the proof test on a partially filled 100 ETH exact-input buy:

Quantity	Value
AMM input actually consumed	5.0632 ETH
Tithe credited to seat 1	0.0127 ETH
Trader charged	5.3132 ETH
Stranded in router, unrecoverable	0.2373 ETH

A fuzz check over 512 runs confirms the scope: full exact-input fills and exact-output swaps through the same router strand nothing, so the loss appears only when a swap is price-limited or exhausts liquidity. The README mentions the generic-router caveat, but the default routing path for a mainnet pool loses user funds permanently, which contradicts the brief's rule that the tithe is a share of the input actually swapped. The finding describes fixes that preserve the design, with output-side charging via the canonical afterSwap pattern as the cleanest.

Coverage. All 14 verifier-listed entry points have rows: 13 hold, afterSwap carries the finding. Two invariant rows are added. The manifest row is marked unreached because no launch.json exists yet; the row records the constructor arguments and permissions the manifest assignment must write.

Not reported. Fee rounding to zero below 400 wei of input is dust. Permissionless first-initializer squatting on non-launch pool keys, seat-sale claim ordering, and rejecting seat-owner contracts are documented trust assumptions that harm only the party choosing them.

Review complete. The findings file is written and validated, and the tracked tree is unchanged.

Outcome. The permission model of TitheHook, TitheRouter and TitheToken holds up: every callback and the unlock callback are PoolManager-only, the launch pool's binding is immutable, claims pay only the live seat owner under checks-effects-interactions, and reentry through payouts, foreign unlocks and forged callbacks all fail safely. I verified these with the existing 40-test suite plus six scratch probes. Two defects are reported in .imd-findings.json:

• Medium, src/TitheHook.sol:161. On an exact-input partial fill, the unused tithe reservation is refunded only as ERC-6909 claims minted to the swap caller. Any conventional router that settles its reported debt and never burns claims (V4Router, Universal Router) leaves that refund stranded. A price-limited 100 ETH buy on the demo pool spent 10.13 ETH, credited the seat 0.025 ETH, and left 0.2246 ETH in the router's claim balance, about 2.2% of the traded amount. The README documents the limitation, but the service's demo swap and any integrator with a price limit hit it. A self-contained Foundry proof under test/scratch/ fails on the current code, and the description offers two mitigations that keep the no-admin design.
• Low, src/TitheHook.sol:107. Any not-yet-created pool key on this hook can be bound by whoever lands first, to a seat they do not own and at up to 99.99%. The launch key is safe because the factory deploys and initializes atomically. This is documented; I reported it with a reproduction so the judge can weigh it.

Coverage. All 14 verifier-listed entry points have rows: 12 hold, two carry findings, and two extra rows record the no-admin invariant and one unverified trust assumption. Public RPC probes from this worker failed, so I could not confirm that the canonical seat NFT exists on mainnet and that seat 1 is owned. Credits to a nonexistent seat are unclaimable by design, so the deployment service must check that before launch.

Not reached. The Slither and Aderyn leads on reentrancy in claim and redemption were traced and are guarded by the shared reentrancy lock and the redemption flag. The Aderyn "locks Ether" line is the intended claim path. Nothing outside my area rose to a reportable defect.

The review is complete and .imd-findings.json holds the result. No tracked file was changed. Only the ignored findings file and my scratch tests under test/scratch/ were written.

Outcome: one real defect, merged from four specialist reports, plus one low and one informational item.

• High, kept with proof. All four specialists (math, flow, permissions, economics) reported the same root cause and I merged them into one finding. On an exact-input swap the hook reserves the maximum tithe in beforeSwap, then on a partial fill returns the unused part only by minting ERC-6909 claims to the calling router. Only the delivered TitheRouter burns those claims. A canonical router (V4Router or Universal Router, which settle the full reported debt and have no burn action) pays the whole reservation and the difference is locked in the router forever. I ran both specialist proofs and they fail as described. I also wrote a fix-agnostic proof in test/scratch/JudgeStrandedRefund.t.sol that reads the AMM input from the Swap event. On a 500 ETH budget that exhausts range liquidity, the trader paid 4.33 ETH for a 3.08 ETH fill, the seat was credited 0.0077 ETH, and 1.24 ETH sits as stranded claims. I raised it to high: the loss is permanent, lands on the default routing path, and scales with the budget rather than the trade.

• Low, kept. initializePool lets anyone bind any not-yet-created key on this hook to a seat they do not own, at up to 99.99%, so creation of any extra pool can be front-run. Confirmed with a scratch test. The launch pool is safe because the factory deploys and initializes atomically.

• Info, kept as a trust assumption. A burned or unminted seat, or an owner that rejects ETH, locks that seat's accrued tithe with no rescue path. This is what the brief asked for and the project's own test pins it. The service must confirm seat 1 exists on mainnet before deploying.

Dropped nothing: every specialist finding reproduced. The independent tester reported no findings.

My own pass found nothing further. Callback authentication, delta accounting on both swap modes, the deferred-claim path for a token-only seeded pool, reentrancy around claim and redemption, the router's settlement, and the token all hold. The manifest matches the implementation: constructor argument order, the 0x20cc permission mask, fee 12500 accepted by beforeInitialize, lowercase workflow-supplied seat address, notes under the limit, and runtime and initcode well under the size caps. The project's 64 tests pass.

Coverage answers all 14 listed entry points plus two invariant rows: 12 hold, afterSwap and initializePool carry findings 1 and 2.

The revision is complete and verified. Build, all 49 tests including the invariant campaign, forge fmt --check, and the ABI export check pass from a clean build. The responses file is written and valid JSON. The 2 scratch tests passing in the first suite are my reproduction harness, which the pipeline deletes.

High finding, fixed. I reproduced it first with a SETTLE_ALL-style router on the reviewer's thin pool: the router was left holding 1242271060340493574 wei of native ERC-6909 claims, the exact figure in the report. The cause was afterSwap minting the unused part of the exact-input reservation to the calling router, a channel only TitheRouter redeemed. I took the reviewer's option (a):

• On exact input, the tithe is now exactly the beforeSwap reservation, titheBps of the specified budget, computed by one shared helper in both callbacks. afterSwap collects it for the seat and mints nothing to the caller, so the hook's deltas net to zero and every router's reported debt is precisely AMM input plus tithe.
• The InputRefund event and refund mint are gone from the hook. The claim-burn bookkeeping is gone from TitheRouter and the raw test harness. The hook ABI export was regenerated.
• A fill that consumes no input now reverts with a new SwapNotFilled error instead of charging a tithe on nothing, since the refund path no longer exists.
• New test/helpers/GenericRouter.sol and test/TitheGenericRouter.t.sol run a canonical-style router through the reviewer's scenario, a price-bound partial sell, full fill, exact output both ways, a fresh token-only manager partial buy, agreement with TitheRouter, and the zero-fill revert. All assert zero router claims.
• Two existing partial-fill tests were updated to the new rule.

Low finding on initializePool, disputed. It reproduces, but the approved workflow makes hookData binding permissionless and has the payer bind seat #1 without owning it. Requiring seat ownership would break that and would not stop a seat holder from front-running. The launch pool is atomic and unexposed. I left the code alone and documented the exposure for non-launch keys in the README and SECURITY.md.

Info finding on burned seats, disputed. It is the brief's no-rescue design, as the report itself says. I added the operational check to DEPLOYMENT.md and the README: the service must confirm on mainnet that ownerOf succeeds for the chosen seat and returns an address that accepts ETH.

Trade-off to note for the reviewer. On an exact-input partial fill, the swapper now pays the tithe on the specified budget rather than the filled portion. The docs say so and advise quoting exact-input swaps against available liquidity. This is the price of keeping the input-currency design compatible with routers that never touch ERC-6909.

Updated only launch.json, correcting fee calculations, partial-fill behavior and router support.

Verified constructor arguments, permissions, pool values and schema guidance. Notes: 2,396/4,000 characters.

• forge build --offline: passed with existing lint warnings.
• forge test --offline: 47 passed, 0 failed.

The findings file validates, the three snippets match their lines, the scratch directory is removed and the tree is clean. Here is the settlement.

Scope

Files read: src/TitheHook.sol (283 lines, every line of the revised callbacks), src/TitheRouter.sol, src/TitheToken.sol, src/HookFlags.sol, launch.json, test/helpers/GenericRouter.sol, test/TitheGenericRouter.t.sol, test/helpers/TitheFixture.sol, docs/ACCOUNTING.md, README and SECURITY statements on partial fills, and v4-core's Hooks.afterSwap to confirm the delta the hook receives is the raw AMM delta. Ran forge build --sizes, the full suite, and the three attached proofs under test/scratch/ (removed afterwards).

Severity counts: 0 Critical · 0 High · 0 Medium · 1 Low · 2 Info

Round-1 findings settled

• [high] Stranded ERC-6909 refund claims in canonical routers: FIXED. The hook now collects exactly the beforeSwap reservation in afterSwap and mints nothing to the caller, so every SETTLE_ALL router's debt is AMM input plus tithe and its claim balance is zero. Confirmed by the project test on the 500 ETH thin-pool buy (paid equals AMM input plus 1.25 ETH, router claims 0), by the permissions specialist's proof now passing, and by the flow specialist's two stranding tests passing. Its third test fails only because it asserts the old refund mechanism, not stranding.
• [low] initializePool binds any new key to any seat: SETTLED as accepted design. It still reproduces, but requirement 1 places no restriction on the caller or seat, and the workflow itself binds seat 1 without the payer owning it. The launch pool is initialized atomically by the factory. Kept as info, no code change needed.
• [info] Burned or unpayable seat locks accrual: SETTLED as accepted design. I also verified on mainnet today that seat 1 exists on the canonical NFT and its owner is an EOA, so the launch default resolves to a payable recipient at review time.

[L-1] Exact-input partial fills are tithed on the whole specified budget

Location: src/TitheHook.sol:162. This is the residual of the fix the author chose, which I listed as option (a) last round, and the independent tester reported the same thing. On a partial fill the swapper pays 0.25% of the budget rather than of the input used. The tester's proof shows a 500 ETH budget filling 3.08 ETH and paying a 1.25 ETH tithe. No third party can trigger it, any quote-based minimum output rejects the shrunken fill, the overcharge goes to the seat rather than a dead balance, and the rule is now documented in README, ACCOUNTING and SECURITY. Low, advisory: whether the strict "rate on input used" reading of requirement 2 is required is a scope decision for the requester. The designs that satisfy it are listed in the finding.

Observations

Specialist findings: the four partial-fill reports and the tester's report share one root cause and are merged into the fixed high plus L-1. Static-analysis reentrancy lines on claim and _redeemUnlocked are guarded by nonReentrant and the manager's own unlock state. Aderyn's "locks ether" line is false, since claim is the withdrawal.

Coverage

All 14 entry points answered, 13 hold and one carries L-1. Manifest checked: constructor order, lowercase seat address, permissions equal to getHookPermissions, fee 12500 accepted by beforeInitialize, notes under the limit, hook well under size limits, and the exported ABI files match the compiled ABIs.

Committed as d421791.

• Frontend source, static export, and deployment manifest delivered.
• Build/typecheck, 15 unit tests, and 17 browser scenarios passed.
• ABI and asset hashes verified; Git bundle is 2.10 MiB.
• Live reads checked; no transactions broadcast.

Design documentation is in docs/DESIGN.md because root writes are prohibited. Full evidence and limitations are in docs/FRONTEND-VALIDATION.md.

Area	Count / result
Frontend requirements	15 met, 1 missing, 0 faked
Broken visitor features	3
Product/action on first screen at 390px	No
taste@1	8/16 passed
Copy findings	1
Share card	Missing

Saved 8 findings: 3 high, 5 medium in .imd-findings.json. Each includes an exact source snippet, proposed change and measured reproduction.

The high findings are:

• Fidelity: At 390×844, the first balance begins at y=986 and “Claim ETH” at y=1071.
• Bug: A valid 78-digit seat ID expands the mobile page to 860–865px.
• Fidelity: Build/test dependencies are absent from the offline delivery; installation with an empty cache fails with ENOTCACHED.

The medium findings cover repeated seat lookup clearing balances, wallet errors appearing outside the viewport, competing section kickers, fragmented typography and missing share-image metadata.

The frontend-stage requirement checklist follows. Previously accepted Solidity work was preserved, not independently re-audited.

Brief requirement	Status	Evidence
“frontend source, package.json, lockfiles and build configuration under web/”	Met	web/package.json, lockfile, source and build files
“static export at repository-root dist/” and documentation under permitted paths	Met	dist/, docs/FRONTEND-VALIDATION.md, web/README.md
“preserve deployed source”	Met	No differences in protected contract source against the pinned commit
Implementation-derived ABIs from the pinned commit; verify hashes	Met	Both exported ABIs match pinned files and canonical hashes
“minimal one-page site…each seat’s accrued tithe and a claim button”	Met	Ledger, seat lookup and claim controls in web/src/App.tsx; defects recorded separately
Mainnet, Tithe Demo/TDEMO, seat fallback and site label	Met	Live reads, deployment handoff, page branding and documented seat #1 binding
“wallet connection, swap controls, observability”	Met	wallet.ts, Swap.tsx, balance/block/activity and transaction feedback
Build, typecheck, browser and interaction validation	Met	Reproduced build; 15 unit tests and 17 Chromium scenarios passed; additional WebKit flows passed
Manifest schema, identity fields and exact contract set	Met	dist/imd-deployment.json; handoff comparison passed
Copy poolKey, network and wallet-add settings unchanged	Met	Handoff has no poolKey; network/settings match exactly
Runtime loads the same manifest and referenced ABIs	Met	web/src/config.ts
ABI JSON and safe relative asset paths	Met	Manifest inventory and dist/abi/
Hash every export file except the manifest; regenerate after export	Met	All 11 hashes match; isolated rebuild reproduces the complete export byte for byte
Asset count, individual size and response-budget limits	Met	11 assets, 727,246 bytes total
Installed dependencies committed for offline verification	Missing	Registry-only dependency installation; no offline build/test payload
No worker publication/redeployment or URL/CID prerequisite	Met	No publication, deployment or real transaction broadcast performed

Tithe is a seat-tithe ledger with a chair motif as its central visual idea. The site remains unchanged; only the requested findings artifact was written.

Fixed seven findings and disputed offline vendoring under the current rules. Rebuilt dist/ and answered all eight findings in .imd-responses.json.

Passed build/typecheck, 15 unit tests, 23 Chromium scenarios, live reads, and manifest/ABI verification.

Git commit and exact bundle measurement were blocked by read-only .git. WebKit lacked required libraries. Details are in validation documentation.

Area	Previous review	This review
Frontend requirements	Total not supplied	23 met, 1 missing, 0 faked
Broken website features	3	0
Product/action on first screen, 390px	No	Yes
taste@1	Total not supplied	14/16 passed
Copy findings	1	0
Share card	Missing	1, 1200×630

Seven prior findings are fixed; one remains high. Recorded in .imd-findings.json. Website files are unchanged.

Prior finding	Resolution and measured evidence
Fidelity: hidden mobile ledger	Fixed. At 390×844, balance begins at 669.67px; Claim ETH occupies 750.66–794.66px in Chromium and WebKit.
Bug: long seat ID overflows	Fixed. All 78 digits remain visible; document widths equal 390px and 320px.
Fidelity: offline dependencies absent	Unresolved, high. Empty-cache npm ci --offline still fails with ENOTCACHED for ws-8.21.0.tgz.
Taste: competing kickers	Fixed. Zero eyebrows; task headings and normal illustration-label tracking.
Taste: fragmented typography	Fixed. Six measured text sizes and three weights in taste@1.
Fidelity: missing share card	Fixed. PNG, metadata and manifest hash present. Absolute publication URL remains publisher-owned.
Bug: repeated lookup erases balances	Fixed. Balances persist during refresh; 28 new RPC requests; no undefined block label.
Bug: distant swap-wallet errors	Fixed. Missing-wallet and rejection feedback appears beside the swap button, with aria-describedby.

The dependency dispute was reproduced using the author’s procedure. Online installation succeeds, and rebuilding produces a byte-identical export. Nevertheless, this assignment explicitly requires dependency contents for offline verification; the prohibition cited in the author’s response does not override that rule. Deliver the required contents and an offline bootstrap under web/.

The 24 requirement groups below cover this frontend stage. Previously accepted contract implementation and deployment remain inherited inputs.

Explicit requirement	Status	Evidence
“frontend source, package.json, lockfiles and build configuration under web/”	Met	web/
“static export at repository-root dist/”	Met	dist/index.html and assets
“documentation under docs/ or web/”	Met	web/README.md, docs/FRONTEND-VALIDATION.md
“preserve deployed source”; protected files unchanged; no submodules	Met	Repository comparison; pinned source preserved
Installed dependencies “committed as ordinary files”	Missing	web/package.json; reproduced offline-install failure
“implementation-derived ABIs…at the pinned source commit”; verify hashes	Met	web/scripts/export.mjs; both pinned hashes pass
“minimal one-page site…each seat’s accrued tithe and a claim button”	Met	web/src/App.tsx; live ledger
“wallet connection”	Met	web/src/wallet.ts; browser scenarios
“swap controls”	Met	web/src/Swap.tsx; buy/sell simulations
“observability”	Met	Block status, activity, transaction feedback and recovery
“Ethereum mainnet (chainId 1)” and canonical seat NFT	Met	Runtime manifest and live contract reads
Default “seat #1” and documented selection	Met	Live poolConfig; web/README.md
Required manifest schema; “add no other top-level key”	Met	dist/imd-deployment.json; independent comparison
Exact launch, chain, source, attestation and contract entries	Met	Exact handoff match
“poolKey copied exactly…when the handoff has one”	Met	Handoff has none; documented legacy derivation
“network and optionally walletAddChain copied unchanged”	Met	Exact network-handoff match
Runtime loads “this same imd-deployment.json” and referenced ABIs	Met	web/src/config.ts; ABI-tamp

Reproduced the offline failure and recorded disputed in .imd-responses.json: requested dependency vendoring conflicts with your overriding rules.

App unchanged. Build, typecheck, 15 unit tests and 23 browser scenarios passed; rebuilt export is identical. Evidence: docs/validation/offline-delivery-rereview.md.

Commit and full bundle verification were blocked by read-only Git metadata and a missing Git object.

Area	Previous review	This review
Frontend requirements	1 missing reported	17 met, 1 missing, 0 faked
Broken features	Offline installation	1 offline installation; 0 UI failures reproduced
First screen at 390px	Not supplied	Product and claim visible
taste@1	Not supplied	14/16 passed
Copy findings	Not supplied	0 new
Share card	Not supplied	Present

The previous high fidelity finding remains unresolved. Empty-cache offline installation still fails with ENOTCACHED for ws@8.21.0. The author disputes the requirement, but this assignment explicitly requires dependency contents to be committed as ordinary files.

The finding and exact reproduction are saved in .imd-findings.json. No new defects were substantiated.

The counts cover these grouped frontend requirements; accepted contract implementation was not reopened.

Explicit requirement	Status	Evidence
“frontend source, package.json, lockfiles and build configuration under web/”	Met	web/src/, package files, Vite configuration
“static export at repository-root dist/”	Met	dist/index.html and bundled assets
“documentation under docs/ or web/”	Met	web/README.md, docs/FRONTEND-VALIDATION.md
“preserve deployed source”; protected files unchanged; no submodules	Met	Clean tracked diff; zero submodules
“implementation-derived ABIs…at the pinned source commit”; verify hashes	Met	Both ABI files match pinned bytes and canonical hashes
“minimal one-page site…showing each seat’s accrued tithe and a claim button”	Met	Seat ledger, lookup, beneficiary and claim controls
“wallet connection”	Met	Header connection; tested rejection and network recovery
“swap controls”	Met	ETH/TDEMO quotes, approvals and transaction controls
“observability”	Met	Block status, balances, activity and transaction feedback
“build/typecheck/browser/interaction validation”	Met	Build, 15 unit tests, 17 Chromium scenarios and 6 revision checks pass
“Whatever you install must be committed as ordinary files”	Missing	Empty-cache offline installation fails; no dependency payload
Manifest schema, exact identity fields and contract set	Met	dist/imd-deployment.json matches handoff
“poolKey copied exactly…when the handoff has one”	Met	Supplied legacy handoff has none
“network and optionally walletAddChain copied unchanged”	Met	Exact supplied-network match
“load this same imd-deployment.json…[and] referenced ABI JSON”	Met	web/src/config.ts runtime loader
ABI and asset paths “relative to dist/”	Met	All declared paths pass validation
Complete SHA-256 inventory, size limits, manifest regenerated after export	Met	12 assets, 791,144 bytes; rebuilt export identical
“does not publish the site or redeploy contracts”	Met	Neither performed; publication remains subsequent work

At 390×844, Claim ETH ends at y=795. The probe’s two flags concern an unknown-balance dash and existing swap-card styling; neither establishes a new defect. WebKit launch failed because the host lacks libevent-2.1.so.7. No real transactions were sent.

Tithe is a seat-income ledger carried visually by a chair illustration and restrained green typography. Site files remain unchanged.