Review complete. The findings file is written and the tree is otherwise untouched.

Outcome. No Critical, High, Medium or Low defect was found in the imported code. Three Info notes are in .imd-findings.json, each with a concrete reproduction.

What was read. All nine contracts in src/ plus the interfaces, the findings ledger, the threat model, launch.json and the two pinned protected checks. Every state-changing external function was traced for caller, value moved and trust, against the Pashov checklist. The launch forbids nothing present here: no DELEGATECALL, CALLCODE, SELFDESTRUCT, proxy, initializer, post-launch mint, pause or blacklist. PLEA and PleaDistributor are owned by the launch owner, the rest are ownerless.

What was checked by running. The default build compiles. The manifest suite passes on this tree, so launch.json's Letterbox and Tribunal hashes match this build and the launch fits the gas cap with headroom. The constructor argument counts and backward references in launch.json match the declared constructors.

Not reached. The live Ethereum IMD, Intake v2, Stacker, PoolManager and seat NFT were not read on chain. No fork rehearsal ran within the budget.

Findings written, all Info:

• Coverage statement, as the acceptance criteria require.
• Seasons.record is permissionless and reads the seat multiplier at the call. A rival can record a seller's plea at 1.0x the second the hold ends, before the seller acquires a seat. Reproduced in a scratch test: 45 points recorded where 54 would follow a second later. This matches README's "at record time" wording, so it is a design note for the adapter and the site.
• The hook's trader deny list omits the court's own contracts. A buy naming the Letterbox as trader parked 4.85M PLEA there with no escrow and no sweep. Self-harm only, like the accepted note for the gate, and a one-line deny-list extension would close it if the hook's spare bytes allow.

Next for the adapter. Nothing blocks the launch from this review. The two code notes are optional hardening. The scratch tests used to reproduce them were removed, as the task allows.

Added eight regression tests and updated ADAPTATION.md. No contract changes were warranted; launch settings and manifest remain unchanged.

Validation passed:

• forge build
• 30 default tests
• 803 full-profile test entries, using the required seed

Launch gas remains 319,567 below the cap with headroom. No live fork or broadcast was performed.

The manifest is complete and verified. No changes were needed.

Result: the existing launch.json in the working tree is the correct evm_contracts manifest for the accepted mainnet code, and every check against it passes. I left it as it is, so the tree is clean and no file other than the manifest is involved.

What I verified:

• Shape. Exactly the keys kind, contracts and notes. Five unique contracts in dependency order: PLEA, CabalGate, Seasons, PleaDistributor, PleaLaunch. Every argument is a string. Notes are under the cap.
• Arities. The argument lists match the constructors in source: 1, 7, 4, 2 and 13 words, in declaration order.
• Owners. PLEA and PleaDistributor take $owner. PleaLaunch reads its owner from PLEA, so the factory never owns anything. This satisfies the protected owner check.
• Mainnet settings. IMD is both the oracle fee asset and the pool currency with mint flag 0. PoolManager, Stacker, credit gas 400000, the seat NFT, season 1296000, dead-man 118800 and START 1795532400 all match the brief. Intake v2 and the oracle signer match the README's mainnet table. Both mixed-case addresses are valid EIP-55 checksums.
• Code hashes. The 12th and 13th PleaLaunch arguments equal the keccak256 of the current Letterbox and Tribunal creation bytecode in the build output. I recomputed both from the artifacts independently of the test.
• Retuned constants. Source has pass mark 69, quorum 17, holding points 3/2/1, no-buy-record profit 9, market cap 20,000 IMD, and the chain-1 seed floors of 14,000 IMD, 15 days and 33 hours.

Test runs. A bare build compiles. The default suite with the verifier's fuzz seed passes all 30 tests in 6 suites, including the manifest suite, which rehearses the five-contract launch through the factory on an empty chain and reports the gas as charged, the limit with headroom and the margin:

Notes field length: 3,982 characters, under the 4,000 limit.

The working tree is unchanged and clean, so the manifest is ready for the manifest step as committed.

Review complete. The findings file is written and holds an empty findings list with a 58-row coverage record (all 56 listed entry points plus two invariant rows).

Outcome: no permission defect substantiated. I traced every state-changing entry point for the Access Control, Trust Gap and Asymmetry failure modes and found each guard matches its effect:

• Write-once wiring holds. PLEA's launcher, Letterbox and hook are set only by the launch path, once, and the manifest rehearsal tests confirm no later block or transaction can register a launcher.
• Custody paths are seller-bound. The Letterbox moves PLEA only through courtTake on its own caller, sells only via the gate's Letterbox-only entry, and every settle or deliver pays the recorded writer. The gate's sell path uses the caller's own pending plea.
• Oracle callbacks are bound. Both the gate and the Tribunal accept answers only from the immutable Intake, for a request they paid for, signed by the immutable signer under separate EIP-712 domains, consumed once. The accepted L85-I-1 writer trust assumption stands.
• Owner powers stay within the listed set. Allowlist is add-only and never opens the PoolManager or the gate. Early seed follows PLEA's current owner. The distributor root is set once and renounce is refused before it. Exclusion from prizes covers PLEA's owner and the hook's immutable owner.
• Paired surfaces are symmetric. Hand plea versus Letterbox plea, appeal versus appealFor, executeSell versus executeSellFor, record versus the close's list, and the Tribunal's object/standing checks all share the same bounds.

Verification run here. The manifest suite passed 12 of 12, so launch.json commits to this tree's Letterbox and Tribunal code. On Ethereum, every dependency address in launch.json has code, IMD answers its symbol, and the Intake's runtime contains the exact selectors the gate and Tribunal call. The signer address is an EOA, which the ECDSA path handles.

Not reached. I did not run the full-profile adversarial suites or the mainnet fork rehearsal within the budget, and the hook's economics beyond its access and beneficiary paths were outside this area.

The review is complete. The findings file is written and no repository file was changed.

Outcome: no reproducible economic defect found. The file .imd-findings.json holds an empty findings list and a coverage record of 59 rows: one for each of the 56 listed entry points, all holds, plus three invariant rows I checked directly.

What I covered, against the Economic Security, Invariant and Flow Gap guides:

• Value flows. The 2.25% fee split in the hook, the launch extra fee, the opening-buy exception keyed on the pool's own IMD, cashback claims fallback, the cap ratchet and trim, and the wall reserve. The wall's IMD never leaves the pool and the Stacker allowance is per credit.
• Conservation laws. Seasons' accounted pot stays equal to open season fees plus rollover across every writer, including a repeat flush after a late overruled stake. The Letterbox holds exactly one 0.25 IMD tip per open escrow because the fee sale delivers exactly the IMD the gate then pulls. Each Tribunal stake leaves once, to the objector or to the plea's season.
• Flow seams. Letter fee sale before the oracle request, escrow close before the gate sale, lapsed approvals recorded on settle, objection hold versus the one-hour close grace, and the dead-man reset only by plea verdicts.
• Arithmetic I re-derived. The prize share table sums to 10,000 basis points. A letter's fee sale needs about 0.77 of the snapshot value against the 1.1 cap. The mainnet fact table gives a maximum of 41 and a lowest need of 28, matching the documented numbers.

Not reached in depth: the Uniswap v4 tick and liquidity arithmetic inside the hook's seed and rebalance was traced at the flow level only, not re-derived numerically. Everything I examined that looked unusual is already an accepted entry in the findings ledger, such as the min-of-panels objection economics, the hourly checkpoint timing and share-band padding by buying first.

The review is complete and the record is written.

Outcome: no reproducible defect found in the control-flow area. .imd-findings.json holds an empty findings list and a 59-row coverage record: one holds row for each of the 56 listed entry points plus three invariant rows, each with a one-line reason.

What I covered, following the Senior Auditor's Mindset and the Execution Trace, Periphery and First Principles guides:

• Periphery first: PleaLaunch, PLEA, PleaDistributor and the OracleAttestation library and consumer. The launch wiring is once-only and committed by hash, PLEA's transfer rule admits only the gate's pull, the court's courtTake and exempt senders, and the attestation consumer binds answers to each contract's own EIP-712 domain and consumes each request id once.
• Execution traces through every value-moving path: letter and site pleas (escrow, fee swap, oracle fee, tip), hand and Letterbox sales, appeals, objections and stake settlement, prize and bonus closes, the flush to the wall, and the hook's swap callbacks. Every allowance is consumed in the call that grants it, every callback is gated on the PoolManager or the Intake plus an expected-flag, and the partial-state cases (expiry, failure callbacks, stale pendings, lapsed approvals) all leave consistent storage.
• First-principles checks on the cross-contract timing: the 40-minute objection hold always ends inside the one-hour close grace, verdicts delivered after a season's end are booked to the verdict's season, and a stake settled after the final flush lands in recoverable rollover that a second flushToWall sweeps to the wall.
• Manifest: launch.json has only the three schema keys, notes of 3,982 characters, constructor words in declaration order with IMD in all three places and the mint flag 0. I ran the committed launch-manifest suite in the default profile, and all 12 tests passed, including the Letterbox and Tribunal hash ties and the gas-cap assertion.

Not reached: I did not run the full-profile suites in test/full/ or the forks, and I did not independently re-derive the hook's tick and liquidity arithmetic beyond reading it, since those belong to the math and economics areas. Nothing in the files was changed.

The review is complete and .imd-findings.json is written at the repository root with an empty findings list and a coverage record for every listed entry point. The working tree is unchanged apart from that file and build output, and the scratch test was removed.

Outcome: no reproducible math defect found. The math area (Math Precision, Boundary, Numerical Gap) of the mainnet tree at commit 149343a is clean against every failure mode in the three guides that I could reach with concrete numbers.

What I checked, with numbers

• Fee arithmetic on all four swap shapes. Exact-input fee is A·r/(B+r) and exact-output A·r/(B−r), with r up to 7,200 bps in the launch window. The settled fee is floor((A−fee)·r/B), which is always at least the reserved fee, so a full fill refunds zero. The three payouts are floored from one basis, so their sum never exceeds the IMD fee and the pool share never underflows.
• The fact table and need. Share in ceiling basis points, hold 3/2/1, loss 13 and the exact gain bands, received PLEA at 9, trend 9/5/0, and the PLEA-weighted mean rounded to nearest. Every need figure in the README re-derives from the code: 35/34/33/32 for a fresh buyer at a loss, 39/38/37/36 for received PLEA, 45 and 46 at the over-35% edges, 36/35/39 at 3x and 11x.
• Seasons payouts. The 25 share constants sum to exactly 10,000 bps. Prizes and the 10,000,000 PLEA bonus floor per rank, so paid never exceeds the pot, and the accounted pot and rollover stay consistent through close, stake bookings and the final flush.
• Hook pool math. Seed price for 20,000 IMD in both token orderings, liquidity around 3.65e24 within uint128, the cap ratchet's remainder bookkeeping, and tick alignment with negative ticks.
• Single-sided liquidity rounding. A scratch sweep replayed the hook's liquidity formula against Uniswap's rounded-up amounts for dust reserves of 1 to 3,000 wei across the tick range in both orientations. The add never asks for more than the reserve, so a dust wall cannot make rebalance revert.
• Boundaries. Every narrowing cast has a proven bound, every external read with no code at the receiver fails open or reverts only the caller's own call, and every decoded byte input is length-checked or self-encoded.

Build and tests. The default-profile build succeeded. The manifest suite passed its 12 tests, confirming both committed hashes match this Letterbox and Tribunal and that the launch fits the gas cap with headroom.

Not reached. The full-profile suites and the mainnet fork were not re-run. Live IMD, Stacker and Intake behaviour is taken from the threat model, not re-verified on chain.

Review complete. The findings file is written and validated.

Result: no reproducible defect. .imd-findings.json holds an empty findings list and 58 coverage rows, one per listed entry point plus two invariants, all holds. No other file was changed.

Specialist findings. All four areas and the test writer reported nothing, so there was nothing to reproduce, merge or drop. I treated their coverage as leads and traced every entry point myself.

What I checked, in brief:

• Read all nine files under src/ in full and traced each entry point's guards, state writes and failure paths.
• The default build passes. The manifest suite in test/LaunchManifest.t.sol passes, including both committed code hashes and the gas cap.
• Runtime sizes match the brief exactly for the hook, gate, Letterbox, Tribunal and Seasons. Cancun is pinned, which the transient-storage deploy flag and reentrancy guard need.
• Every constructor argument in launch.json matches its constructor's count and order. The on-chain seed checks for chain 1 accept the configured 15-day season and 33-hour dead-man exactly.
• The agreed numbers are the constants in the code: pass mark 69, hold points 3/2/1, uncovered profit 9, the fact bands, fee split 2.25%, letters 20%, objection window, stake, margin, two objections, cap decay, wall guard and the 25-rank share table summing to 10,000.

Observations, not defects:

• The gate and Tribunal bind a signed answer to its request only through the Intake, not by comparing the attestation's request id or question hash. The owner accepted this in writing in round 8.5 as finding L85-I-1, and the threat model records it as trust in the Intake writer.
• The owner powers are the documented ones: the add-only PLEA allowlist, the one-time Merkle root, early seeding, and the 1% fee. The owner is excluded from points, prizes and the bonus.
• The Letterbox's auto-sell fee and the hook's prize fee are credited to the season running at the time of the sale, not the plea's verdict season. A sale happens within seven minutes of the verdict, so this only differs at a season boundary and is the documented accounting rule.

Nothing is outstanding from this review.