Added Issue 004, published 26 October and covering 19–25 October. The static export, index and RSS now include all four editions. Existing design, code and earlier issues are preserved.

Build, typecheck and 107 browser-suite checks passed. Submission size: 5.81 MiB, below 8 MiB. Safari remains unverified because WebKit libraries are missing.

Results and design-review limitations are recorded in validation-004.md.

The review is complete. Nothing in the export must be withheld from hosting. The findings file holds two advisory items, and the working tree is otherwise untouched.

What was read and verified

• Every hosted file: dist/index.html, the JS bundle, the stylesheet, both feed copies, favicon, share image and notices. The source they came from was read too: src/App.tsx, src/main.tsx, src/types.ts, src/styles.css, vite.config.ts and the four scripts.
• The committed bundle is a faithful build. I ran the build from the committed source and lockfile in a scratch directory, and every output file matched byte for byte.
• The bundle contains React 19 and the paper only. The suspicious-looking tokens in it are React internals for keyboard events and dialog support. There is no wallet or provider code, no remote fetch, no storage, no iframes, no redirects and no obfuscation. The stylesheet has no external URLs.
• The paper's own checks pass in the scratch copy: content schema, evidence arithmetic for issues 003 and 004, and TypeScript.
• Every cited source record for issue 004 resolves on the live API and falls inside 19–25 October. The three audit summaries match the reports' judged dates and top findings. The three oracle answers match their attestations. The launch, answer and online totals match the live API.
• The site names itself as unofficial and not affiliated with IMD in the footer. No impersonation, no financial claims, no price talk.

Findings written to .imd-findings.json

• Medium, misdirected feed links. Every item link in dist/feed.xml points at a hard-coded older address that today serves only issue 001. A reader following the No. 004 link from a feed reader lands on the old deployment and sees the "not in the archive" message. Fix by rebuilding with the real publication address set.
• Low, undisclosed third-party font loading. The page requests fonts from Google on every visit. The README says so, but the page does not. Fallback fonts already work, so self-hosting or a footer note would close it.

Neither finding is critical or high, so the site can be hosted as it stands.

Saved both findings, exact source snippets, fixes, and reproductions in .imd-findings.json.

• High — bug: fallback masthead overflows. Blocking Google Fonts produces document widths of 328px at 320px, 396px at 390px, and 800px at 768px in Chromium and WebKit. The masthead runs beyond the screen. Fit the fallback text to its container; a 10% size reduction removed every tested overflow. Source: src/styles.css:254.
• Low — bug: Safari date formatting breaks hydration. Node renders “Monday, 26 October 2026”; WebKit renders it without the comma, producing React error #418. Assemble the date with explicit separators using formatToParts. Source: src/App.tsx:17.

The seven failed probe checks comprise six preserved-design exceptions and one false overlap warning from flowing newspaper columns. The brief’s “Keep the existing site’s design, layout and code exactly as they are” overrides those style recommendations.

The visual idea is a weekly community newspaper carried by warm newsprint, blackletter lettering, and ruled columns.

Requirement checklist:

1. Met — “most recent full week”: issues/004.json covers 19–25 October.
2. Met — “Monday 00:00 to Sunday 24:00 UTC”: evidence uses 19 October inclusive to 26 October exclusive.
3. Met — public API and “own User-Agent”: reporting trails identify API requests and their header.
4. Met — issues/NNN.json, previous count + 1: three earlier issues precede 004.json.
5. Met — publication date is job’s UTC date: date is 2026-10-26.
6. Met — “plain English, short sentences”: issue 004 explains each project’s purpose and limits.
7. Met — “no addresses, hashes or code words”: editorial text contains none.
8. Met — no prices, trading, returns, or buying suggestions: issue 004’s text passes inspection.
9. Met — workers identified as “Seat #N”: leaderboard uses numbered seats.
10. Met — exclude spam, offensive and copycat projects: selected stories and exclusions support this.
11. Met — “exactly this shape”: content validation confirms issue fields and nested structures.
12. Met — lead has “three short paragraphs”: lead.body contains three.
13. Met — lead is the principal weekly story: fencing trainer leads the issue.
14. Met — “new … up to 4”: three entries, drawn from publication records.
15. Met — “bugs … up to 3”: three entries use permitted severity labels.
16. Met — audits explained as user consequences: summaries describe unfair prizes, blocked rewards, and delayed payments.
17. Met — “answers … up to 3” and “status attested”: all three source records are attested.
18. Met — questions rewritten plainly: displayed questions avoid technical wording.
19. Met — prefer projects/network questions over trivia: all three concern IMD or actual projects.
20. Met — integer figures from required endpoints: counts reconcile with fresh API reads. The accepted field retains the disclosed completed-job proxy.
21. Met — online means connected workers: 1,042 is a dated health snapshot.
22. Met — meter is 0–100; 50 means equal activity: level 17 compares 847 completed jobs with 2,469.
23. Met — three leading seats from weekly accepted nodes: fresh job details confirm 19, 17 and 16 contributions.
24. Met — weekly leadersScope: issue 004 specifies "this week".
25. Met — watch structure: watch supplies headline, text and visit URL.
26. Met — permitted glossary terms actually used: issue 004’s glossary stays within the supplied list.
27. Met — project/explorer Visit destinations: all selected Visit URLs

Fixed both findings and rebuilt dist/: fallback masthead overflow and WebKit date hydration.

Build, typecheck, 58 existing checks and 251 regression checks passed. Issue files and protected configuration are unchanged. Submission size: 6.02 MiB.

Both responses are recorded in .imd-responses.json; validation and limitations are documented in docs/validation-004-revision.md.

Saved .imd-findings.json.

Both prior advisories remain reproducible:

• Medium: RSS links open the older deployment.
• Low: Google Fonts loads without an on-page disclosure.

No critical or high hosting blockers found. Site files unchanged.

Both previous findings are fixed. Chromium and WebKit 27.2 retain the complete masthead at 320, 390, 768 and 848px with fonts blocked or loaded. Document width equals viewport width. Delayed font loading and resizing also pass. The original heading and publication date survive hydration with zero page errors.

No new reproducible defect was found. The seven probe flags were reviewed: six concern newspaper styling preserved by the brief; the overlap flag measures paragraph boxes spanning separate columns, without overlapping text.