Both findings were real and are now fixed. The report and the files the README pointed to now exist and are staged, but not committed.

Why the report was missing: .git/info/exclude on this machine ignores artifacts/. That is the likely reason the report never reached the last commit. I did not edit .git/; I force-staged the files with git add -f. If whatever commits this run uses git add -A instead of keeping my staged files, the folder could be dropped again.

Recommendation: split the supply 10% swarm, 65% locked pool, 25% compensation.

• Migration victims (12% of supply): about 60% of what they sent back, token for token. A quarter unlocks at launch and the rest over 30 days. They also get all of the anti-sniper tax.
• Other snapshot holders (13%): about one new token per five old, unlocking over 30 days. Duplicate credit for the migrators is removed first.
• Robinhood buyers: nothing at launch, because nobody has published a record of their buys.

The 1:1 option would leave a 10% pool, and if 25% of the airdrop were sold the price would fall about 89%.

What I added:

• artifacts/report.md: all five stages, the score tables, the price math, the abuse rules, the recommended plan, the top three risks, who was right where the analysts disagreed, and the five-line community summary. Each claim is labelled as fact, calculation, inference, judgment or open question.
• artifacts/model.py: runs offline and recomputes every number in the report; all 22 checks pass. I also recomputed every score total in the tables, and they all match.
• artifacts/checks.md and artifacts/evidence/: what was and wasn't checked, plus text copies of the team's two public pages (the incident notice and the migration page), saved today with fetch time and file hash.
• README.md: it claimed Ethereum balances had been checked. I didn't read any chain data, so the README now says so. Holder counts, balances and amounts come from the brief and the team's notice.
• .imd-responses.json: answers both findings as "fixed". The same exclude rule ignores it too, so it stays in the working tree for the harness to read rather than in the commit.

Questions that change the numbers:

• 62 or 63 wallets? The brief says 62; the team's own pages say both 62 and 63.
• When was the snapshot taken? If block 26213125 is after the migration transfers, the snapshot holders get about 15.7%, not 20.7%.
• Can the factory do 65/25? The published design is fixed at 80% pool and 10% compensation. If that can't change, the recommended plan can't be deployed as written.

Both prior findings are fixed. The findings file holds one new low-severity note and nothing blocking.

Prior high finding, missing report: fixed. The tree at HEAD 3a65eb2 now has artifacts/report.md with all five stages. It contains the stage 1 score table with totals, constant-product 72h math for options 1 through 5, an abuse-vector table with a blocking contract rule per vector, both adversarial reviews, the stage 3 two-lens rescoring with explicit disagreements, and the stage 5 verdict with a final score table, an exact 10/65/25 hybrid plan, top 3 risks, a who-was-right table and a 5-line summary. I recomputed every row total in both score tables and all 15 match.

Prior medium finding, missing check script and evidence: fixed. Running the model script with Python 3 prints 22 passing checks and exits 0. I re-derived the key numbers by hand and they hold: option 2 at 25% sold gives 11.1% of launch price, the hybrid's 52M liquid by 72h gives 85.7%, option 7 needs about 1,133 ETH of volume. The evidence directory has text snapshots of the notice and migration pages with a source manifest. The snapshots support every fact the report attributes to them, including the 62 versus 63 wallet discrepancy, which appears in the team's own notice. The README no longer claims chain balances were checked, and checks.md states what was not verified.

One new finding, low severity. Risk 2's optional mitigation offers tranche B holders a 10% bonus for a 90-day vest, funded from tranche B's unclaimed pool. Tranche B is fully allocated pro-rata and unclaimed tokens are only swept after 180 days, so if every wallet opts in the bonus owed is 13M tokens against a reserve of zero. It is marked optional and does not affect the verdict, so it is not worth a revision on its own.

The findings file is written at .imd-findings.json with that one entry. No files in the tree were changed.

Completed the five-stage review in artifacts/report.md. I preserved the existing report and made targeted corrections to its v4 liquidity caveat and buyback caps.

The arithmetic check passed: 22/22 checks. git diff --check also passed. The report distinguishes supplied facts from independently verified evidence and flags the unresolved 62/63-wallet discrepancy and missing Robinhood buyer ledger.

The review is complete. The findings file is valid JSON and every quoted snippet matches its cited line. No repository files were changed beyond creating .imd-findings.json.

What I checked. The tree holds no Solidity, so the audit covered the report, the Python model, and the evidence. I recomputed every price-impact cell, coverage ratio, score total, and fee figure by hand and by running the model with isolated Python. All 22 checks pass and all 15 score rows sum correctly. The arithmetic is sound. The defects are in the rules the report calls "ready to write into a contract".

Findings, ranked by severity.

• High. Tranche A has no cutoff block. Eligibility is "sent SIMD to the migration wallet after the migration opened" with no end. The wallet still accepts transfers and SIMD is near worthless, so any snapshot holder can send today and move from the 20.7% tranche to the 59.7% tranche. A 50M holder would get about 23.9M new tokens instead of 10.3M, and real victims' coverage drops to 47.8%. This contradicts the report's own claim that moving the dead token "changes nothing".
• Medium. Tranche B double-subtracts migrated tokens. Because the B2 balance already excludes what a wallet sent to the migration wallet, subtracting the credited migration amount again under-credits every partial migrator. A holder with 100 at snapshot who migrated 40 and kept 60 is credited 20, not 60.
• Medium. The "sold after snapshot" rule also zeroes honest holders. Anyone who moved tokens to a new wallet, or panic-sold after the dump at a 90% loss, gets credit zero. The report never discloses this tradeoff to the non-technical reader it addresses.
• Low. Option 7 math uses the thief's proceeds as the loss. Under the report's own pool model the pre-dump value of the stolen tokens was about 7.4 ETH, not 3.4, so the volume needed is about 2,474 ETH. The conclusion holds but the quoted number is 2.2 times too small.
• Low. The 15.7% alternative coverage cannot occur. Every snapshot timing consistent with the stated facts gives a tranche B base of about 629M, so 20.7% is the only figure. The open question is resolvable from the report's own facts.
• Low. The optional 90-day vest bonus is unfunded if all tranche B wallets claim, and it contradicts the plan's no-bonus rule.
• Low. The model docstring still says concentrated liquidity makes impact worse, a claim the report retracted in its last commit.
• Info. Stage 3's option 1 holder score of 5 is not derivable from its stated sub-scores under headcount or balance weighting, carrying forward the bias Stage 2 flagged.

Not found. No wrong figures in the stress tables, no hard-limit violations in any option or the hybrid, and the double-counting fix for migrators is correctly reasoned apart from the formula defect above.

I didn't commit anything. A .gitignore covers artifacts/ and .imd-responses.json, and earlier commits here were made by the submission pipeline ("imd …"), so I left the changes in the working tree for it to pick up. Several environment dotfiles also showed up as untracked; they aren't mine and I didn't touch them.

I reproduced all eight findings. Each one held, and each is now fixed in artifacts/report.md, artifacts/model.py and artifacts/checks.md. model.py runs offline and its 30 checks pass, up from 22. All 15 score-table rows still add up to their totals, and the recommended plan (10% swarm / 65% pool / 25% compensation, split 12% to migration victims and 13% to other snapshot holders) is unchanged.

• High: no cutoff for migration-victim claims. The reviewer was right. Anyone could send worthless old SIMD to the migration wallet now and be paid as a theft victim, which would cut real victims' coverage from 59.7% to 47.8%. Now only transfers up to block E count, where E is the block of the wallet's last sale (Oct 17, 19:18 UTC). The script that builds the recipient list must publish E and must refuse to publish if total victim credit exceeds 201,151,260. I also corrected the abuse table, which wrongly said buying dead tokens "changes nothing".
• Medium: migrated tokens subtracted twice for holders. Confirmed: a holder with 100 tokens who migrated 40 and kept 60 got 20 instead of 60. The new formula is max(0, min(balance@snapshot, balance@B2 + sentToMigrationBy@B2) − migrationCredit). It is checked with worked examples.
• Medium: holders who moved or panic-sold lost their claim. B2 is now the last block before the dump started (just before 18:31 UTC). Selling, moving or being drained after that point keeps the claim. The remaining cost is now stated plainly: tokens that left a wallet between the snapshot and B2 aren't credited. A two-wallet signature during the 48h challenge window can fix genuine self-moves. The community summary now says this too.
• Low: option 7 loss figure. The 3.4 ETH was the thief's proceeds after slippage, not the holders' loss. At the pre-dump price the migrated tokens were worth about 7.4 ETH, so repaying that would take about 2,474 ETH of trading volume (about 3,008 ETH including the IMD sold), not 1,133 ETH. The 3.4 ETH figure stays only as a lower bound.
• Low: the 15.7% coverage figure. That case can't happen given the report's own facts, so the plan now states about 20.7%. The reviewer's original Stage 4 point is kept but marked as rejected in the final verdict.
• Low: the +10% bonus for a 90-day vest. Removed. Nothing funded it, and it broke the fixed 25% cap and the no-bonus rule.
• Low: model.py description. It now matches the report: concentrated liquidity could make price impact better or worse.
• Info: option 1 score. The lost-holder score dropped from 5 to 3, consistent with its own sub-scores. Option 1's final total goes from 41 to 40.

The answers to all eight are in .imd-responses.json.

Still not done: the exact block numbers for E and B2. The plan defines them by the on-chain sales but I didn't look them up, and the report lists this as an open question.

All eight prior findings are confirmed fixed, and the findings file holds one info-level residual.

What I re-ran

• The revised model.py passes all 30 checks and all 15 score-table rows sum correctly.
• Each earlier reproduction replayed against the revised rules gives the expected result:
  • Late sender after block E gets tranche B only, about 10.34M new tokens, and nothing from tranche A.
  • Partial migrator 100/40/60 gets tranche B credit 60, not 20.
  • A holder who moved wallets after the dump started keeps full credit, because B2 is now pinned before the first sale.
  • Option 7 now uses 7.42 ETH of loss and about 2,474 ETH of volume.
  • The unfunded 90-day bonus is gone, the model docstring matches the report, and option 1's lost-holder score is 3 with a total of 40.
  • The 15.7% alternative is removed from the plan, checks.md and open questions.

One residual, info level

In the disagreement table at artifacts/report.md line 227, the "Double counting migrators" row still says the tranche B base is "still unverified (review 4 #5)". The row directly above it rejects review 4 #5 as impossible. The two cells contradict each other, and a community reader would see the doubt reopened right after it was closed. This is a leftover sentence, not a numbers error.

No new high or medium defects. No files outside .imd-findings.json were changed.