Review complete. The findings file is written and validated, and the working tree is unchanged apart from it.

Outcome: the STEPS branding delivery is sound. I found one medium evidence-scope gap and one informational note. No unsafe SVG content, no core change, no payment or approval regression, and no X account write.

What I verified

• Core unchanged. Only frontend/package.json differs from d29eedf outside docs, brand, dist and evidence, and the change is description-only. The seal script's verify mode passes, and all 94 protected predecessor files match.
• SVG and preview isolation. All 15 SVGs in brand, public and dist contain only svg, g, path, rect and title. No script, foreignObject, href, url(), style, text, font or remote reference. PNG dimensions match the brief for favicon, touch icon, avatar, lockup and the 1200x630 share image.
• Authentic X link. The only x.com reference in source and bundle is https://x.com/stepstoke, rendered as a display link with noopener. Nothing posts to or modifies the account.
• Integration. Header lockup with accessible "STEPS home" name, site name and description in config, Coinbase appName from SITE_NAME, title, icons, OG and Twitter metadata with relative asset URLs, footer "STEPS by Stepstoke", and updated entry and empty-state copy. Residual "CTO Relay" strings are only fixture artwork, the A1 release identifier, repo URLs and a labelled historical body in the protocol overview doc. Screenshots confirm the identity renders on desktop and mobile.
• Retry journal regression. The fix itself predates this delivery. This delivery adds unit coverage for reverted, replaced and unknown pseudo-rows and an actual-contract regression recorded in all four local runs, with purchase counts unchanged before explicit consent.
• Evidence consistency. The five manifest hashes in check-results match the files on disk. Unit, e2e (182 passed, 3 retained skips), Solidity (125) and SDK (39) logs agree with the summary. Historical recovery index verified byte-for-byte against local git objects for all 1,303 commit entries and the 6 archived entries.

Findings written to .imd-findings.json

1. Medium. The bundled vendor/ethers/ethers.mjs is a real runtime input but sits outside every manifest and the protected prefix list in frontend/scripts/seal-steps.py. Appending a byte to it still yields PASS from seal verify. I confirmed via git that it is currently unchanged, so this is a gap in the exact-source claim rather than tampering.
2. Info. Six old Vite build outputs from the two predecessor commits are neither in the tree nor the historical index. They are reproducible artifacts at pinned public commits, not evidence.

Not covered. I could not rebuild the export locally because frontend dependencies are not installed on this machine, so byte-identical rebuild rests on the delivered receipt and the matching manifest hashes rather than my own rerun.

I've finished the README and docs for STEPS. Only README.md and docs/** changed. The tested runtime still matches its recorded hashes: seal-steps.py verify passes on the final tree, and git status shows no other changes. I haven't committed anything.

What I checked before writing

• Fresh clone: install, typecheck, 47/47 unit tests and the build all pass. The rebuilt dist/ is byte-identical to the committed one, and the seal check passes after the rebuild.
• Core: contract tests 125/125, SDK 39/39, formatting, release ABI/code hashes, fixture check and CLI all pass.
• Static preview: the committed export serves its page, share image and icons with no install, titled "STEPS · Build on every step".
• Historical evidence: the recovery script restored all 1,309 earlier files (12,523,951 bytes) with matching SHA-256 values.
• Size: the full source bundle is 6,819,376 bytes, about 1.57 MB under the 8 MiB limit. The early measurement of 8,769,072 bytes was over the limit and is recorded as FAIL.

What I wrote

• README.md: rewritten. It covers what STEPS is, a not-ready-for-real-funds warning at the top, and build/test/use commands that work from a fresh clone. It has every page and contract entry point with who can call it and how it fails, and PASS/FAIL/NOT_RUN separately for demo fixtures, local contracts, core and the live IMD service. It ends with ten concrete open issues and a list of the names that still say "CTO Relay" on purpose.
• docs/BRAND.md (new): the slogan "Build on every step.", the chosen Joined Steps design and the two rejected alternatives. It also covers symbol/wordmark/lockup use, clear space, minimum sizes, the three colour variants, a full asset inventory, licences, the exact @stepstoke link, and where the brand appears in the site.
• docs/ACCEPTANCE.md: rewritten to point at the current STEPS evidence and split results by evidence class.
• docs/BUILD.md: told readers to run a verify.py that is no longer in the tree. It now uses seal-steps.py verify.
• Other docs: I fixed stale "current" links in FRONTEND.md, OPERATIONS.md, REVIEW.md, AGENT-GUIDE.md, PROTOCOL-OVERVIEW.md, HANDOFF.md and the validation index.
• Evidence: a new docs/validation/steps-brand-v1/documentation/ folder holds the logs above, the manifest check, the size record and its own hash index. The documentation hash file (docs-sha256.json) was regenerated; it doesn't list itself and no document quotes its hash.

Where the repository differs from the brief (stated in the docs)

• The source brand guide is brand/README.md, outside the paths I could edit, so docs/BRAND.md mirrors it.
• The share-card image links are relative because no host is known. X and many other sites may not show the card until a host is set.
• Historical evidence is not stored in the tree. Restoring it needs GitHub to still serve commit d29eedf8 (or a saved copy); only six files are archived locally.
• No trademark clearance was done, and the marks have no licence of their own. The repository's MIT licence still names "CTO Relay Station contributors".

I didn't rerun the browser tests or the local-contract journeys. Their PASS results come from the earlier build step and still apply only because no tested file has changed since. Production readiness stays false, there is no public deployment, and live IMD compatibility was not run. Nothing was posted to X.

Area	Count/result
Requirements, grouped below	37 met · 2 missing · 0 faked
Broken UI behaviors	2
Product/action on first screen at 390px	Yes
taste@1	16/16 passed
Copy findings	0
Share card	1 complete 1200×630 PNG

Saved three findings in .imd-findings.json:

• Medium — bug: Connected wrong-network controls overflow the header by 13px at 641px in Chromium and WebKit. Extend the existing wrapped header layout to accommodate this state.
• Low — bug: Scrolling the wallet modal’s backdrop moves the workspace behind it. Apply the body scroll lock already used by preparation sheets.
• Low — fidelity: The evidence index records an obsolete documentation-manifest hash and length. Update that record or exclude the separately maintained documentation manifest.

Fresh checks passed: build/typecheck, 47 units, 182 browser cases with three existing skips, brand checks in both engines, and taste@1. The rebuild matches all 11 delivered export files. Four delivered local-contract runs passed fresh receipt/calldata audits; those journeys were not independently rerun. The complete source bundle measured 6,823,694 bytes, below 8 MiB.

The following groups cover the explicit brief requirements. Evidence paths are repository-relative.

Requirement	Status and evidence
Continue pinned d29eedf8…; verify delivery/core hashes	Met — protected predecessor verification passes for 94 files.
Preserve warm paper/ink/vermillion and sequence/output hierarchy	Met — frontend/src/styles.css, Workspace.tsx, rendered export.
Preserve eight component families, six functions and project artwork	Met — DESIGN.md, component sources and local-contract records.
STEPS primary; Stepstoke expanded; official @stepstoke destination	Met — config.ts, header/footer and metadata.
Choose one direction; document up to two alternatives without a chooser	Met — brand/README.md.
Original symbol, wordmark and lockup; avoid chart/token/robot identity	Met — editable custom geometry in frontend/src/brand/geometry.json.
English collaborative/continued-building slogan, 3–8 words	Met — “Build on every step.”
No investment promises, guarantees or unsupported claims	Met — reviewed interface and brand copy.
Primary, mono, reversed, transparent and outlined SVG assets	Met — brand/svg/; fresh variant renders pass.
Small symbol, favicon16/32, square avatar and editable social asset	Met — brand/png/, brand/svg/; dimensions verified.
Native vector/local raster tooling; no paid image/child workflow	Met — brand/tools/ and provenance records.
No SVG scripts, foreignObject, remote resources, external fonts/links or runtime CDN	Met — portability checks and browser request audits.
Local font and licence provenance	Met — brand/licenses/, brand/source/font-provenance.json.
Actual header, name, SITE_NAME/DESCRIPTION, wallet app display, title and favicon	Met — App.tsx, config.ts, wallet/wagmi.ts, index.html.
Landing/empty copy, footer, X link, OG/Twitter metadata and share asset	Met — application sources, metadata and served assets.
Slogan clarifies entry without dominating/repeating in workspaces	Met — entry page versus project workspace.
Relative assets, hash routes, gateway paths; no invented domain/canonical	Met — gateway browser tests and index.html.
Replace current platform names; preserve historical/authenticated/technical identifiers; English docs/showcase	Met — scoped diff, current guides and retained fixture outputs.
Package description-only correction; dependencies, locks and root build preserved	Met — predecessor comparison.
No new dark theme	Met — light seman