Review complete. The findings file is written at the repository root with two informational findings; no defect of low severity or above reproduced in the two contracts this launch deploys.

Verification against the task statement (all matched)

• Build with the unchanged foundry.toml succeeds. SwarmDesk creation hash is 0x1d8e1afa…5879, EndowmentEscrow is 0xe7a48446…6368, runtime 22226 and 5008 bytes, no DELEGATECALL, CALLCODE or SELFDESTRUCT in either runtime.
• The policy word decodes to question chain 1, context blocks 26122900 to 26122901, max price 0.5 IMD, heartbeat 200 bps, top bits zero, matching docs/oracle-v37/oracle-config.json. The action word is the string "oracle.request@oracle-1".
• Neither constructor reads external code, so both deploy on an empty chain. Neither contract has an owner, setter, upgrade path, payable constructor or protocol address among its words. The binder word is the project wallet, which FeeRouter also pins as the team address.
• All fourteen module pins and the two Desk pins match the current build once out-launch/ exists. The full suite passes: 315 tests, 0 failures, 6 fork tests skipped for lack of an RPC.

Findings (both informational, in .imd-findings.json)

• Stream-0 answers before role 1 revert, not store. The accepted-finding text says such answers "stay stored"; in fact _accept reverts through GameRegistry.module(1). A relayed answer can be re-presented later, but a paid backup's callback is lost and the slot's single backup is consumed. Confirmed by a scratch test under test/scratch/.
• README pin checks crash on a clean clone. Both pin tools read out-launch/, which the default build never writes. Running forge build --out out-launch first makes them pass.

Checked and found sound in the L1 contracts: the bind proofs (factory, config hash, Params and registry CREATE2 predictions, hook echo plus LaunchFactory record), attestation replay keys, slot and issuedAt freshness, exact answer length checks, the regulator clamps against Params.set's own step and bound rules, every Desk-driven module call that is not wrapped in try/catch (announce, announceCap, unpause, submitPlan all have matching pre-checks), escrow forward proofs and its interplay with RewardPool.fundEndowment.

Coverage. Read in full: SwarmDesk, EndowmentEscrow, OracleAttestation, SignatureCheckerCompat, GameRegistry, Params, RewardPool, FeeRouter, Billboards, V4Market, the lib and interface files. Read partially via entry-point inventories: Civic, Season, PackSale, StarterClaim, Enhancement, GridOperator. Not reached within budget: FarmCore, FarmEngine, FarmItems, FarmRewards, Economy, MarketFactory, StandardMarket, StandardAdapter. Not verifiable offline: the live ABI of ProjectFactory.predictContract, ProjectRegistry.isRecorded and LaunchFactory.positionOf on chain 4663, the oracle attester key type, and the IMD floor's OwnerChecks harness, which is not in the tree. The token launch's remainder must equal at least the 200,000,000-token endowment or the reward pool stays unfunded until a plain transfer tops it up, which is an already accepted item.

Completed with production source and build configuration unchanged.

• Reproduced both audit findings and corrected documentation.
• Added five regression tests; both creation hashes match.
• forge build passes; forge test: 320 passed, 0 failed, 6 skipped.
• Recorded changes and launch handoff in ADAPTATION.md.

SwarmDesk remains index 0, escrow index 1. Their addresses and shared launch number come from IMD’s subsequent deployment step; no transaction was broadcast.

Review complete. The findings file is in place and only the review output and a scratch test were written.

Outcome

The L1 launch pair (SwarmDesk and EndowmentEscrow) holds under the Execution Trace, Periphery and First Principles checks. I found one low-severity defect elsewhere in the game, in pack resolution.

What I verified for the L1 launch

• The eight SwarmDesk constructor words decode as intended: question chain 1, context blocks 26122900 to 26122901, max price 0.5 IMD, heartbeat 200 bps, zero top bits, action word oracle.request@oracle-1, nonzero binder. No literal IMD protocol address appears.
• Building with the unchanged foundry.toml reproduces both expected creation hashes exactly.
• bind is binder-only, one-shot, and writes state only after every proof, including the LaunchFactory positionOf record check that an echoing market cannot pass.
• execute cannot be bricked by a reverting module. Every call outside a try/catch (Params.set, Civic.announce, Enhancement.announceCap, PackSale.unpause, GridOperator.submitPlan) is pre-guarded by the Desk's clamps and checks, so a stored answer is always executable or cleanly ignored.
• askBackup, submit, both oracle callbacks and clearExpired match the accepted-findings text. Slot, UUID and delivery-key replay guards all consume before storing.
• EndowmentEscrow.forward proves the bound registry and pinned RewardPool before the single transfer, with the flag set first.
• ChainClock's 256-block window matches ArbSys's arbBlockHash validity range, so every lapse handler is reached only when the hash is truly gone.

Finding (low)

PackSale.resolve sets the Mythic flag from the player's level at resolve time, although the design states eligibility is fixed at commitment. The seed is fixed and public after the first capture, and receipts never expire. A player below level 10 can inspect the draws, resolve the ordinary packs now, and hold any pack whose roll lands in the Mythic band until level 10, turning a Common into a Mythic. I reproduced this in a scratch test: the same receipt and seed mints rarity 0 when resolved immediately and rarity 4 after the farm is backdated to level 10. Fix is to freeze the flag in _commit or at seed capture.

Coverage

All 160 listed entry points have a row. 159 hold, one carries the finding, none unreached. The deepest traces were the Desk, the escrow, the registry and Params periphery, FeeRouter and V4Market value paths, and the FarmCore/FarmRewards settlement ordering. The bucket arithmetic inside FarmRewards commitments was traced for control flow only. It belongs to the invariant pass, and I noted that in its rows.

The review is complete. The findings file is written and valid, no source file was touched, and no scratch tests were left behind.

Result: no reproducible defect found in the economics. The file .imd-findings.json holds an empty findings list and a coverage record answering 163 of the 164 listed entry points plus seven invariant rows.

What I traced in depth (Economic Security, Invariant, Flow Gap guides):

• RewardPool: balance never drops below reserved plus the locked drip. Reserve is bounded by available, pay decrements reserved before transferring, and the endowment gate only opens once the forwarded principal exceeds ordinary inflows.
• FarmRewards: the per-epoch budget is at most 2.4% of available, so the reserve call cannot fail. The sum of per-farm allocations stays under budget plus redistributed tax, so the dust subtraction cannot underflow. Reserved always equals outstanding pending plus undistributed tax plus unsettled allocations across claim, spend, spendTo, scrap, award and recycle. The committed weight sum equals the epoch's raw hash, so the dust path is reachable.
• Settlement envelope: productive hash is capped by the set-bonus ceiling, and Festival plus district boost reaches at most 1.15 × 1.25, so spent never exceeds allocation and a farm's cursor cannot lock. Lock boost at commit time matches the boost the engine applies.
• FeeRouter: ETH conservation holds across every deposit, route, sell, buy, bounty and withdraw path. The receive hook ignores market ETH during a sell so sale proceeds are not counted twice. Heartbeat cap is pinned at 1 ether by Params bounds, so the cap subtraction cannot underflow.
• Season: pot liability moves with every deposit, payment and rollover. Best, district and lottery shares sum to exactly 100% of a week's pot, and eligibility is frozen at completion.
• Civic, Billboards, Economy: escrow counters match pulled balances on every path, refunds are pull-only, and war payouts never exceed the chests.
• V4Market and EndowmentEscrow: fees are taken from the pool manager with exact delta checks, system buys and sells are bounded by TWAP slippage and batch caps, and the escrow's single exit is gated by the Desk binding and CREATE2 proofs.

Not reached: the Desk's bind proof chain itself, which is outside the assigned area. It is marked unreached in the coverage record.

One lead, not reported as a finding: the average daily yield that prices packs, lots, wars and billboards is mining divided by active farm count, so many one-item farms dilute it toward the 3000-token floor. The cost of each extra farm is a pack priced off the same average, so I could not show a profitable input within budget. Baseline economic test suites pass with 32 tests.

I wrote launch.json, and it's the only file changed. It is one evm_contracts launch on Robinhood Chain (4663) with two contracts:

• Index 0: SwarmDesk, with the eight constructor words exactly as the brief lists them. The last one is the binder wallet 0x6d51cBE774aeAe4dd40bCA2560E9bc2695A0d007.
• Index 1: EndowmentEscrow, with its one argument set to $contract:SwarmDesk, so it points at the Desk deployed in this same launch.

No IMD protocol address is used as a constructor word.

Checks:

• forge build succeeded with the repo's unchanged foundry.toml.
• The compiled creation bytecode hashes match the brief: 0x1d8e1afa…5879 for SwarmDesk and 0xe7a48446…6368 for EndowmentEscrow. These are hashes of the creation code without constructor arguments, which is how the brief's values line up.
• forge test: 320 passed, 0 failed, 6 skipped.

For the keeper: the notes field records the L1 deployment, the later bind call by the binder wallet with N_TOKEN as its last argument, and the reminder to keep the L2 launch number alongside the L1/L3 outputs as wiring.tokenLaunch. The two addresses and this launch number don't exist until the launch is deployed, so they aren't in the file.

The review is complete and .imd-findings.json is written at the repository root. No tracked file was changed.

Outcome: the L1 pair's permission model holds. SwarmDesk.bind is restricted to the pinned binder and every CREATE2, commitment, Params-back-pointer and LaunchFactory record proof applies to the binder too. EndowmentEscrow.forward can only pay the pinned RewardPool of the registry the Desk bound, and it cannot run before the L2 remainder has landed, because binding requires L3. The constructor words decode consistently with the brief, and the existing L1, Desk, escrow and hook-binding suites pass.

Findings written (3, none above low):

• Low, SwarmDesk.execute at line 489. Anyone may execute a stored regulator answer, and the one-shot pending flag is cleared before the Params cooldown check. A key still inside its 1-day cooldown is skipped with continue, so a bystander who executes early drops that week's parameter step, which the keeper could have applied later inside the answer's validity window. Bounded to one 10% step per key per week. The existing cooldown test shows the silent skip.
• Info, SwarmDesk.askBackup at line 309. Permissionless paid backup lets any caller spend up to the 0.5 IMD max price per stream/slot from the Desk's donated balance. Documented design, bounded, recorded as a trust-gap note.
• Info, Season.recordSpend at line 153. GridOperator is an allowed caller but never calls it. Same class as the accepted unused-permission item.

Coverage: all 157 listed entry points have a row, plus three invariant rows. Each is holds except the three marked finding. No row is unreached.

Not done: no scratch proof test was written, since no finding reached high severity and proofs are only required there.

The review is complete and the findings file is written. No source files were changed.

Outcome. The math in the assigned area holds. I found no reproducible precision, boundary or numerical-gap defect that moves value or bricks state. The file .imd-findings.json holds one info-level finding and a coverage row for all 157 listed entry points.

What I traced and confirmed (Math Precision, Boundary, Numerical Gap guides):

• Reward envelope. The per-epoch reservation of 159% of mining covers the summed allocations of 157.5% plus redistribution. Gross, referral and redistribution are each monotone in a productive hash that cannot exceed 1.4375 times committed weight (Festival 15% times Civic 25%), so the spent > allocation revert in FarmRewards._reward is unreachable. Lock boosts cancel because the active loadout is rolled inside the first syncFor before the lock exists.
• Vintage ring. The 32-slot ring spans at least 8 days while tax matures at 7, so a young vintage can never be evicted to matured early, including out-of-order referral credits.
• Pool accounting. Reserved always equals credited pending plus prizes plus scrap allowance. Dust is recycled only when every farm has settled.
• AMM math. The spot price cap of 1e40 keeps the inverse accumulator at or above 1e20, so the TWAP division cannot hit zero. The 32-minute observation ring covers the 30-minute lookback. Sell fee is capped at 1500 bps. Router splits cannot underflow.
• Season, Civic, Grid, PackSale. Pot shares sum to 100% with floor rounding. District claims always have at least one eligible payer. War cap subtraction is bounded. Grid stability guards both divisors. The pack price curve clamps the exponent before wadExp.
• Repair pricing. The formula matches the tests, which define RepairHours as 6 hours of item yield per 10% restored.

Reported finding. One info item: the comment above the budget reservation in FarmRewards still describes an older 116.5% envelope. The code and the allocation are consistent with each other; only the comment is stale.

Not reached. Fourteen entry points outside the math area are marked unreached: the CREATE2 proof paths in GameRegistry.register, MarketFactory.deploy and SwarmDesk.bind, and the reference StandardMarket and StandardAdapter variants.

Added binding failure tests and randomized custody invariants for SwarmDesk and EndowmentEscrow, including transfer failures, reentrancy, expiry, and retries.

forge build and tests with the required seed pass. Six opt-in fork tests skipped. All changes are under test/; source and configuration remain unchanged.

The findings file is valid, all five snippets match the tree line for line, and the coverage record answers all 157 listed entry points plus two invariant rows.

Outcome: the review of BLACKOUT v3.17 L1 is written to .imd-findings.json. It keeps five findings, none above low, and nothing blocks the launch.

What I verified for the L1 pair itself

• The compiled creation hashes for SwarmDesk and EndowmentEscrow equal the two the task expects, and both runtimes are under the EIP-170 limit.
• The pinned GameRegistry, Params and RewardPool creation-code hashes inside SwarmCode and ModuleCode equal the current build, so bind and forward can succeed against this tree.
• Neither constructor calls another contract, so the empty-chain rehearsal passes. The L1 launch, binding-failure, custody, escrow and desk test suites all pass.
• The policy word decodes to Ethereum as the question chain with a context window at blocks 26122900 to 26122901, which exist on chain 1, a 0.5 IMD backup price cap and a 200 bps heartbeat.
• launch.json has only the three schema keys, two unique contracts, the eight static Desk words in order, the backward escrow reference, and no IMD protocol address literal.

Specialist findings, all reproduced by tracing the code and kept at their severity

1. Low. PackSale.resolve sets Mythic eligibility from the player's level at resolve time instead of at commitment, so a sub-level-10 player can read the fixed public seed and defer a Mythic-eligible roll until level 10.
2. Low. SwarmDesk.execute is permissionless and clears the stored answer before the Params cooldown check, so an early third-party call silently drops that week's parameter step.
3. Info. askBackup lets anyone spend the Desk's donated IMD once per slot. Documented design, recorded as a trust assumption.
4. Info. Season.recordSpend allows GridOperator as a caller that never calls it.
5. Info. The FarmRewards budget comment describes a stale 116.5% envelope. The code's 159% reservation covers the actual 157.5% plus redistribution allocation, which I traced end to end.

No duplicates existed across specialists, and my own pass over every module found nothing further. The verdict rows for the four entry points the specialists could not verify, SwarmDesk.bind, GameRegistry.register, MarketFactory.deploy and the StandardMarket and StandardAdapter paths, are answered as holds with the checks I traced. No files other than the findings file were changed.