v3.16: fix L1 import-audit finding (job 10bfac6d, medium): SwarmDesk.bind accepts a registry on an attacker's own token. The attacker launches their own univ4_hook token with a V4Market naming this Desk and the public gameConfigHash, then Params + GameRegistry on that token after the roots become public at L3; every v3.15 proof passes because their LaunchFactory record is self-consistent, the Desk is captured forever and EndowmentEscrow can never forward the genuine remainder.

Fix: restrict bind to one pinned binder. Change ONLY src/SwarmDesk.sol plus docs/tests/keeper/tools. Do not touch any other contract in src/, foundry.toml or src/lib/Robinhood.sol. The creation code of EndowmentEscrow, V4Market, Params, GameRegistry and all 14 modules must stay byte-identical to 30e314b; only the SwarmDesk pin may change.

1. Add an eighth constructor word: address binder (nonzero, revert otherwise). Store it immutable.
2. bind reverts Unauthorized unless msg.sender == binder. Keep every existing v3.15 proof (registry/Params pins and coordinates, frozen config, hook echoes, LaunchFactory positionOf record with currency0 == 0, currency1 == token, hooks == market). Do not add a requester check.
3. binder for the launch is 0x6d51cBE774aeAe4dd40bCA2560E9bc2695A0d007 (the project wallet, not an IMD protocol address).
4. On the Robinhood fork, read LaunchFactory.positionOf for an existing ETH-paired univ4_hook launch (for example 832) and confirm it records currency0 == address(0); report the read. If ETH-paired records use another currency0, fix the check accordingly and say so.

Tests:

• Add the import-audit proof test/scratch/ForeignTokenTwin.t.sol as a permanent test (adapt setUp to the 8-word constructor): a registry on a foreign token with a self-consistent record must not bind, from the attacker and from any non-binder.
• Fix test/AuditV315.t.sol:118 so the attacker hook reports the attacker's token (the realistic shape).
• Binder binds the genuine registry, then AlreadyDone.
• Zero binder reverts at construction.
• All existing tests pass, fork rehearsal L1 to L4 passes with the binder signing bind, tools/check_deploy_gate.mjs passes.
• Rebuild, update the SwarmDesk creation hash and its 8 constructor words in launch-v39.md and docs/launch-v314-plan.json, and confirm the other 18 hashes are unchanged.

Docs:

• docs/m2-trust-assumption.md: twins (genuine or foreign token) can no longer bind; the remaining trust is the binder key, which can only choose among registries that pass every proof.
• Add to docs/accepted-v316.md: "Binder liveness: bind is a one-time call by the pinned binder 0x6d51…d007; if that key is lost before binding, the Desk can never bind and the endowment stays in the escrow; the binder cannot bypass any proof." Keep all v3.15 accepted items, with info 5 and info 6 written out in full from audit 031c93c4.
• keeper/README and keeper.mjs: bind-desk prints the calldata for the binder to sign and no longer sends it from the keeper key.
• Update the L1 objective in launch-v39.md. Remove every x.com link from the objectives; keep https://playblackout.xyz.