Imported the approved web/ and dist/ unchanged.

• Build, typecheck, 11 unit tests and 12 browser scenarios passed.
• Complete snapshot bundle: 3.95 MB, below 8 MiB.
• Validation report records the inherited 320 px issue and unverified Safari behavior.

Ready for IMD’s weir publication pipeline. Live publication has not been verified.

Review complete. Nothing in the export blocks hosting. Findings are written to .imd-findings.json with no tracked file changed.

What I verified

• The working tree's web/ and dist/ are byte-identical to SwarmStream/swarmstream at commit fc3ac859, fetched fresh from GitHub.
• All 41 asset checksums in dist/imd-deployment.json match the files. The canonical keccak of both shipped ABIs equals the abiHash values in the deployment manifest. Addresses and chain id 4663 are unchanged.
• The index page loads one module script and one stylesheet from the site's own assets folder, and all fonts from its own fonts folder. There is no third-party script, iframe, beacon, eval, dynamic script injection or analytics in any of the three bundled scripts.
• The two preset token addresses that are not in the manifest resolve on chain to real USDG and WETH contracts.
• The 360 px no-horizontal-scroll rule is covered by the previous contributor's recorded browser run across all seven routes. No browser exists on this machine, so I confirmed the evidence rather than re-running it.

Findings, none blocking

• Medium. The footer on every route reads "Audited by IMD Swarm. Use at your own risk." The deployment manifest says the source was reviewed by the swarm's panel and is not an audit. The wording overstates the review and is in approved copy, so changing it needs the owner's sign-off.
• Low. The create form hard-codes USDG and WETH addresses that are not in the deployment manifest. They are correct on chain today, but cannot be re-pointed by editing the manifest.
• Low. Receipt pages fetch the stream's terms URL directly from the visitor's browser when it is an https link, so the stream's creator can see the visitor's IP. Credentials are omitted, only plain text is accepted, and it is rendered escaped.
• Info. Inventory of every external host the bundle can contact: the manifest's RPCs, IdentityMD's intake API for oracle job lookup, and Coinbase Wallet's relay only after the visitor picks that wallet.

Saved verified findings to .imd-findings.json. All 118 imported files match the approved commit exactly. No website files were changed.

• High — bug: wrong-network wallet labels cause horizontal scrolling. At 360 px, connect a wallet on chain 1, decline the network switch and close the dialog. Chromium expands the home page to 434 px and other routes to 385 px; WebKit also overflows. Allow the existing button label to wrap and its container to shrink. This restores 360 px without changing wallet logic.
• Medium — bug: wallet errors block mobile navigation. At 360 px, choose an unavailable Browser wallet and close the dialog. The error occupies y=78–176, covering navigation at y=80–128 and intercepting Records clicks. Put the existing error in normal document flow so navigation remains usable.

Both defects are inherited from the approved source and reproduced in Chromium and WebKit.

The visual idea is a pixel-art street showing payments flowing from client to freelancer through a dispute-review system.

The five probe flags concern approved typography and 320 px overflow; they were not treated as redesign requests. Seven routes passed ordinary layout checks at 360, 390 and 1440 px in both engines. No real transactions were signed.

Fixed both wallet layout defects and updated dist/. Recorded both responses in .imd-responses.json.

Build, typecheck, 11 unit tests and 28 Chromium scenarios passed. Submission snapshot: 3.97 MB.

WebKit lacked required libraries. The protected manifest retains its original CSS digest; this limitation is documented. IMD publication follows submission.

Both findings from last round are fixed. The findings file is written as an empty list.

Wrong-network overflow at 360 px (high). Fixed. I re-ran my reproduction with my own harness, using the unchanged mock-chain fixture on chain 1 with the switch rejected, in Chromium 156 at 360 and 390 px. Document scrollWidth is now 360 on all seven routes, and the "Switch to Robinhood Chain" button wraps onto three lines inside the header, right edge at x=344. The fix is the scoped white-space override in web/src/style.css at line 1184, and the compiled rule is present in the shipped stylesheet. WebKit could not launch here either, for the same missing host libraries the author reported. The fix is a plain CSS wrap with no engine-specific feature, so I accept the Chromium evidence.

Wallet error blocking navigation (medium). Fixed. Without an injected wallet at 360 and 390 px on Create and Home, after choosing Browser wallet and pressing Escape, the alert is now static and full width. On Create at 360 px it sits at y=80 to 153.59 and navigation begins at y=153.59. elementFromPoint at the centre of every nav link returns the link, and a real click on Records navigates to #/records. The same holds in the wrong-network state, where the "Request declined" alert also sits in its own row.

Requirements, one line each.

• "Publish dist/ as the site for label weir": after review, IMD publishes.
• "Replace this project's front end with that repository's web/ and dist/": met, settled last round; only the two CSS files changed since.
• "load its index page" and "render the hash routes": met, all seven routes render an h1 in my harness.
• "serve its fonts from the site itself": met, probe reports no missing local files and no external font host.
• "load no external script, analytics or tracker": met, the only external host is the public chain RPC, a data request.
• "Leave dist/imd-deployment.json and everything under dist/abi/ exactly as committed": met, both unchanged.
• "contract addresses, chain id 4663 and the Weir ABI": met, unchanged.
• "pixel-art plates ... as they are": met, unchanged.
• "Weir." with the period: met, title reads "Weir. · Pay as the work flows".
• "Keep all contract calls and wallet flows as they are": met, no JavaScript changed.
• "Do not claim an audit beyond the swarm's panel": met.
• "work at 360 px wide with no horizontal page scroll": met now, measured above.
• "Do not recompress, resize, convert ... PNG plates": met, plate hashes unchanged.
• Hosting, live URL, deploy: after review.
• Needs the requester: the manifest's inventory digest for the stylesheet is now stale, since the brief forbids editing the manifest and the CSS fix changed the file. The site's runtime never reads that digest, so nothing breaks in the browser, but the project's own export check fails on it. Only the requester can say whether the inventory may be refreshed.

The idea. A pixel-art street where money flows from the client's house to the freelancer's as the work happens, and the page keeps that one image at the centre of a quiet, mostly monochrome layout.

Probe. The four remaining probe flags, which are all-caps signs inside the street, the brand tracking, eight type sizes and four families, are inherited parts of the approved design the brief forbids restyling. No new defect reproduced this round.

Review complete. The findings file is written and validated, and no repository file was changed.

Outcome: nothing blocks hosting. The revision is a CSS-only change, and I confirmed it in a real browser this time.

What I verified this round

• The revision touches only styling. Commit 6a6138c changes 35 lines in the source stylesheet, the matching compiled stylesheet, and docs. Every JavaScript bundle, index page, font, plate, ABI, address and chain id is byte-identical to the previous round.
• 360 px works. I installed Playwright Chromium outside the repository and served the export. All six routes, including both receipt pages, measure exactly 360 px wide with no horizontal scroll. Fonts load from the site itself.
• No trackers or remote scripts. The only hosts contacted were the local origin, the Robinhood RPC from the manifest, and one third-party URL on the receipt page described below.

How the earlier findings settled

• Footer "Audited" wording (medium, not fixed). The text is unchanged on every route. The project's own README now says "Not audited", so the site contradicts its own documentation. Still advisory, and the copy is owner-approved upstream.
• Hard-coded USDG and WETH addresses (low, not fixed). Unchanged in the create form and bundle. Both addresses still resolve to the real tokens.
• Receipt page fetches a creator-chosen URL (low, not fixed). Reproduced live: opening the receipt for stream 1 issues a GET to a raw.githubusercontent.com terms file. Mitigations remain in place and no remote code runs.
• External call inventory (info). Updated to record the browser verification.

One new advisory finding (medium). The rebuilt stylesheet no longer matches the SHA-256 recorded for it in dist/imd-deployment.json, because the manifest had to stay as committed. The export's own check script fails on the delivered tree. The requester has to decide whether the inventory entry may be updated or the mismatch is accepted.