_accept marks the stream's slot as taken and stores the answer before anything checks that execute() can run. execute(1) unconditionally reads registry.module(12), module(11) and module(4) (and module(10) when v[14] != 0); execute(0) reads module(7) and module(12). GameRegistry.module reverts NotConfigured for an unregistered role. Stream 1 answers need no module at accept time, and stream 0 answers only need module(1) (FarmRewards, job A).

So between Desk.bind (right after job A) and the registration of job B's modules, every attester-signed answer is accepted, consumes the slot (6 h for stream 0, 7 d for stream 1), and then every execute() call reverts; a second answer for the same slot is ignored.

The same shape applies in steady state to any deterministic revert in the non-try calls of _regulate (params.set, civic.announce, enhancement.announceCap -> registry.launchTime() while the market hook is uninitialized, packs.unpause): the week's regulation is lost rather than skipped. No funds move; the game falls back to its fixed event table.

Minimal fix: in _accept, refuse (revert, not ignore) when the modules the stream needs are unregistered (registry.registeredModule(role) == address(0)), or wrap each non-try action in _regulate/_event in try/catch like the optional duties already are, so one failing action does not void the slot.

submit() accepts any attestation signed by the attester for this Desk's domain with the pinned questionHash, from any caller, with no link to a request the Desk made.

The oracle-consumer reference states that anyone can pay 0.5 IMD, name the Desk as consumer/deliver target, and receive an answer signed for it; the question bodies are public (docs/oracle-v37/*.json) and questionHash does not depend on who asked. _accept then takes the first answer that passes and ignores every later one in the slot (acceptedSlotPlusOne).

A third party can therefore (a) buy several answers to the same question and relay the one whose panel noise favours them (event kind within 0..maxKind, severity within 5000-7000, district hint), and (b) choose the moment in the week at which the regulator panel reads state (which once-only actions fire: collapse goal, war pairing, lot), pre-empting the honest heartbeat relay.

Impact is bounded by the hard-coded clamps and once-per-slot rule, and the attester signature is still required, so this is a trust assumption on panel determinism rather than a fund-loss path; it is recorded because the comment on submit ("The relayer has no authority") is stronger than what the code guarantees.

Possible mitigations that preserve the design: prefer a direct (own-request) answer over a relayed one within a short grace window, or raise the hard-coded panel minimums for relayed answers.

The oracle-consumer reference requires every protocol-facing value (intake, delivery, action id, asset/price, signer) to be settable so that a new action version (oracle-2), a moved price or a signer rotation does not need a redeploy. SwarmDesk fixes all of them in the constructor and exposes no setter, by the brief's no-owner design.

Consequences, each permanent: if the attester key 0x5598... is rotated, every submit/onOracleResult reverts BadSignature; if Intake.priceOf exceeds 0.5 IMD, askBackup reverts InvalidValue; if oracle-1 is retired, askBackup pays nothing and gets nothing. The game then runs on GridOperator's fallback table with no regulator.

This is the accepted trade-off of a no-owner contract and is recorded as a trust assumption, not a bypass; if the requester wants resilience without an owner, the signer could be an ERC-1271 registry address (the reference's OracleSignerRegistry) rather than a bare key, which SignatureChecker already supports.

bind accepts the first candidate that passes the pinned-code and CREATE2 proofs; nothing ties the Desk to the requester's launch number. Anyone who knows the preimage of GAME_CONFIG_HASH (starterRoot, freeRoot, snapshotBlock, endowment) and launches Params+GameRegistry through the ProjectFactory before the keeper's bind-desk step captures the Desk; the honest registry can then never be bound.

The proof logic itself is sound: the candidate must be the pinned GameRegistry at the factory's predicted address, its Params must be the pinned Params constructed with (this Desk, 200, 1e18), and the config hash must match. Funds cannot be redirected (RewardPool/FeeRouter are pinned and owner-less).

This is recorded so the adapter keeps the mitigation (bind immediately after job A, roots private until then) and does not treat the verifier's launch-registry isRecorded as an additional check the Desk performs; it does not.