Final pre-launch adversarial review of src/, script/DeployMainnet.s.sol and deploy/mainnet/ at this commit. Two audit rounds and their fixes are already in (docs/AUDIT-FIX-PLAN-2026-10-05.md, docs/AUDIT-INTERNAL-2026-10-06.md); weight your time to what changed since 03e8d0c9ed18204a041e48141bbff44b48da226b (git diff 03e8d0c..HEAD -- src script/DeployMainnet.s.sol) and to the deployment, which no audit has seen.

imdUSD is a dollar-denominated CDP stablecoin borrowed against sIMD (IdentityMD's staked IMD, an ERC-4626 share with 24 decimals, about 7.95 IMD each). Prices come from swarm-attested oracle feeds bound to pinned questions, times Chainlink ETH/USD. Everything about the deployment is in src/DeploymentConfig.sol and docs/MAINNET-RUNBOOK.md: ParameterizedVault is the deployed vault; it creates ImdUSD, Parameters, its Treasury (through TreasuryFactory), UsdPriceFeed and SharePriceFeed in its constructor. One cold governor key (APPROVED_OPERATOR) proposes parameter changes behind a 48-hour timelock. Collateral pricing is per 1e18 raw units throughout. IMD's only market is a full-range Uniswap v4 pool, about $2.3M a side with a 1% fee; docs/PARAMETERS-2026-10-05.md has the numbers every economic parameter was chosen from.

Answer each numbered question, including the ones where nothing is wrong:

1. SwarmFeed deviation bound (ce39fc6): 20% from the last accepted value, 40% once that value is older than maxAge, never lifted. Show the largest move N attestations bought within one hour can produce when relayed together, given the window rules (span bounds, toBlock advancing, toBlock within maxAge/12 blocks of head). docs/PARAMETERS-2026-10-05.md section 'No rolling bound' argues this is uneconomic at line $1M: check its arithmetic against the constants as committed and the 13-sample median in PriceFeed's question, and state the line at which it stops holding.
2. OracleAsker (84182f0, 73c1163): ask pays only on a FALL of DRIFT_FALL_TRIGGER_OF_CAP_BPS of the cap, armed ARM_DELAY_BLOCKS earlier and still present, or for NHI keep-alive at STALE_AT_BPS; askPaid and askPaidMany charge the caller per request, skip in-flight or duplicate feeds uncharged, and back off ASK_TIMEOUT after an undelivered result. Can anyone make the Treasury pay when the chain does not justify it, exceed oracleBudget in a UTC day, get a request paid without a delivery being possible, leave IMD stranded in the asker, or block updates for everyone? Can a caller of askPaidMany pay for a feed it did not name or be refunded less than it is owed?
3. Parameters.proposeWorkOracle (84182f0): applies only while wage is 0; the successor must answer vault(), mintingRights() and, once anything was ever minted, predecessor() == the current oracle. Can a hostile or broken oracle be installed, can the order of oracle and wage proposals bypass the wage==0 rule, and can the sentinel/factory path (WORK_ORACLE_SENTINEL, WorkOracleFactory) be made to hand a vault an oracle it did not create?
4. The phase-2 fixes (9dd2149): redemption cap = min(live, lagged backing) with same-transaction and fresh capital removed from both sides; cover's fee remint reaching totalReceived; the USD reserve result capped at 1e36; the lock(1) freeze. Find a sequence across adjacent blocks or transactions that still pays a redeemer above backing, or desynchronises totalReceived or totalBadDebt.
5. DeployMainnet.s.sol and deploy/mainnet/plan.py: CREATE2 through the canonical deployer in layers, refusing to broadcast unless every source constant equals its planned address. What happens if a constructor reverts mid-broadcast (which contracts exist, which trust an address that does not), whether any contract reads another's state in its constructor before that contract is deployed, whether salts collide or can be front-run, whether the 0.05 ETH gas ceiling can leave a half-deployed stack, and what the readback after the broadcast fails to check. The Intake (INTAKE) is deployed by a third party before us: list every assumption the stack makes about it.
6. deploy/mainnet/bodies/: each oracle body is hash-pinned forever in OracleAsker. Confirm every window is relative, no body carries a number that moves, and the question text each feed pins (expectedQuestionHash) matches its body.
7. Constants: every value in src/DeploymentConfig.sol and the deploy script against the Decisions and Final confirmation sections of docs/PARAMETERS-2026-10-05.md. Report any mismatch, any constant the script does not verify after deploy, and any Sepolia-only address that plan.py does not replace.
8. Known open items from the reference docs: work rights ignore the work feed's age; SharePriceFeed's asset-leg reads are typed calls (what a reverting or non-standard asset does); line may be proposed below current debt (what each action does then). Say whether each is exploitable with the constants as committed.
9. The seams: vault and Treasury (fees, cover, payStream, reserve protection, fundOracle's share unwrap), vault and feeds (1-hour lifetimes, SKEW_BPS, 24-decimal collateral), and the relay bundles (relayAndBark, relayAndBite). Anything that one audit panel's scope ended at and another's did not begin.

Not findings: addresses in DeploymentConfig that are placeholders until deployment (INTAKE, ORACLE_ASKER, TREASURY_FACTORY, WORK_ORACLE_FACTORY); the mocks (MockIMD, MockWorkOracle, LaunchToken); script/checks/ (a separate, partly stale tree); web/ and points/; anything docs/COMPUTE-BACKING-DESIGN.md describes as future work; and findings of the earlier audits in docs/AUDIT-*.md and docs/INTERNAL-AUDIT-2026-10-04.md, unless the fix regressed. A constant set to a deliberate economic value is not a finding; an arithmetic or ordering error in how it is used is.

For every finding: severity; file and function; the call sequence from an external caller; a concrete failing input or state with expected against actual; whether it is reachable with the constants as committed; and the smallest fix. Also report every place a comment or NatSpec claims a property the code does not have, and say which contracts you read in full and which you could not reach.