diff --git a/submissions/arena-bounty/PROPOSAL.md b/submissions/arena-bounty/PROPOSAL.md
new file mode 100644
index 00000000..8651eb26
--- /dev/null
+++ b/submissions/arena-bounty/PROPOSAL.md
@@ -0,0 +1,123 @@
+# Proposal
+
+**Submission stage:** Proposal
+**Model id:** `arena-bounty`
+**Builder:** `@0xprogrammable`
+
+Canonical public source identities are `https://github.com/0xprogrammable/arena-bounty-canary` and
+`https://github.com/0xprogrammable/arena-result-service-canary`; exact repository and commit resolution still requires
+independent GitHub verification.
+
+Arena Bounty launches a standard token and a canonical native-ETH Uniswap v4 market with an immutable Programmable fee hook, then lets players opt into a separate two-player browser arena with exact deposits, bounded signed results and direct timeout refunds.
+
+## Design card
+
+| Item | Confirmed design |
+| --- | --- |
+| Outcome | A normally tradable fixed-supply token plus optional first-to-three arena rounds denominated in that token. |
+| Pool | Native ETH / launched token, static 3000 hundredths-of-bip LP fee, tick spacing 60, and the immutable `ArenaProgrammableFeeHook`. |
+| During a trade | PoolManager pricing plus a native-ETH hook fee in all four swap quadrants; the game, signer and escrow remain absent from the route. |
+| Value | Each player deposits the same exact token amount. A valid result pays both stakes to player A or B. Platform charge is zero. A missed deadline gives each player one direct refund. |
+| Creator choices | Standard launch parameters plus a separately deployed prize token, immutable result signer, per-round stake, rules hash, join deadline and resolution deadline. |
+| Fixed platform rules | Programmable owns exactly 10 basis points of gross canonical-pool quote volume; creator-selected hook fee below 10 basis points is raised to 10; LP fee stays separate; no transfer tax, hidden tag, upgrade, admin redirect or service custody. |
+| Authorities | One immutable result signer can choose only between the two recorded players before the round deadline. |
+| Dependencies | Model-specific pinned baseline; exact OpenZeppelin 5.6.1, OpenZeppelin Uniswap Hooks 1.1.1, Uniswap v4 Core 1.0.2, Three.js 0.185.1, Playwright Core 1.62.1 and Vite 8.2.0 package bindings; companion commit `24875f9325d6c055a04089cf2c1543dfa862fcad` binds viem 2.55.10 through the v2 static-closure profile. |
+| Failure | Launch and trading revert atomically. The game fails without producing a payable result. Signer failure leaves deposits refundable by each player after timeout. |
+| Project surfaces | Solidity escrow, JavaScript/Three.js game and JavaScript/viem companion service in two repositories. |
+| Product surfaces | Launch, discovery, quote and trade use the ordinary pool. Game, round status, payout and refund need dedicated UI/API/indexing review. |
+| Not used | `hookData`, dynamic LP fees, custom curves, async swaps, external liquidity, oracle, keeper, proof, cross-chain behavior and permissioned assets. |
+
+## Why Uniswap v4 and architecture choice
+
+`hook.used` is `true`. The same hook that defines the canonical v4 pool enforces the non-bypassable Programmable share. A match result is still neither price formation nor atomic pool settlement, so the game remains outside callbacks.
+
+- `ArenaPrizeEscrow` owns round custody, signature validation, payout and refunds.
+- The browser owns rendering, controls and unsigned practice state only.
+- The companion service owns one bounded signing key and never owns tokens or transaction submission.
+- The registrar binds each supported PoolKey before initialization. Quotes and trades are delegated to an external Uniswap interface/API client; this repository supplies no swap client.
+
+The factory mines the exact v4 permission address. `BaseHook` authenticates PoolManager callbacks. The permission mask is limited to `beforeInitialize`, `beforeSwap`, `afterSwap`, `beforeSwapReturnDelta` and `afterSwapReturnDelta`; no custom `hookData` is accepted.
+
+## Lifecycle
+
+| Phase | Actor and value | Custody and observable result | Failure or exit |
+| --- | --- | --- | --- |
+| Token creation | Creator uses the official fixed-supply launch profile. | Standard launch contracts emit the token identity; game surfaces receive nothing. | Any failure reverts the launch. |
+| Pool initialization | Registrar registers the exact native-ETH PoolKey and immutable project owner, then initializes through the fee hook. | `PoolRegistered` plus PoolManager `Initialize` bind PoolId, selected totals, LP fee and owners. | Wrong hook, currency order, registrar or duplicate registration reverts. |
+| Liquidity formation | Declared token allocation and creator-confirmed ETH enter the canonical position. | Standard PoolManager and position accounting only. | Atomic revert; no game custody exists. |
+| Initial transaction | Creator may separately confirm an ordinary routed trade. | Standard receipt and `Swap` event. | Router deadline and slippage rules apply. |
+| Trading | Traders use exact-input or exact-output routing in either direction. | Core pricing and LP fee remain authoritative; hook return deltas collect the pool-scoped native-ETH fee as ERC-6909 claims. | Dust that cannot pay 10 basis points and quote-specified partial fills revert; arena state is unaffected. |
+| Round creation | Player A deposits one exact stake and fixes rules plus deadlines. | Escrow stores the round and emits `RoundCreated`. | Non-exact transfer reverts; after join deadline player A refunds. |
+| Round join | Player B deposits the identical stake. | Liability becomes two stakes and `RoundJoined` is emitted. | Wrong state, same player, late join or non-exact transfer reverts. |
+| Game/service | Browser runs the match; service validates and signs the canonical result. | The signature binds both players, stake, token, rules, match digest, action, chain, escrow and deadlines. | No valid signature means no payout instruction. |
+| Settlement | Any caller submits the signed result before both deadlines. | Stored state closes before an exact `2 × stake` transfer and `RoundSettled`. | Forgery, replay, outsider, stale result or transfer drift reverts. |
+| Timeout | Either player calls directly after resolution deadline. | Each receives exactly one stake once; the second refund closes the round. | One player cannot block the other's claim. |
+| Dependency failure | Each affected actor sees the exact failed surface. | Ordinary pool remains independent; the escrow remains solvent by recorded liability. | Stop new paid rounds, retain settlement and refund paths. |
+| Retirement | Product stops offering new launches or matches. | Existing ordinary pools and already-created rounds retain immutable behavior. | Continue indexing until every open round closes. |
+
+Liquidity callbacks, donation callbacks and game callbacks are not used. Ordinary v4 liquidity changes and donations retain standard behavior and do not interact with the escrow.
+
+## Assets, pool behavior and integration
+
+- `eth`: native quote asset, 18 decimals, native supply.
+- `launched-token`: new fixed supply of `1000000000000000000000000000` base units, 18 decimals, standard transfer behavior, no issuer controls.
+- Canonical ordering follows Uniswap currency ordering; native ETH is address zero.
+- Routing mode is `uniswap-interface-api`. Router generation, router dependency ids, action profile, client source/test paths and local quote/execution-parity claims are intentionally inactive because this repository supplies no swap client.
+- Any later external quote or execution must independently prove the exact canonical PoolKey, coherent state, hook-inclusive user bounds and provider result. Neither may contain game state or a result signature.
+- Alternative pools can exist but do not inherit canonical-market fee enforcement, Programmable approval or arena support claims.
+
+The current Sepolia deployment reference is source-conflicted and runtime-unverified. This proposal therefore defines architecture only; execution remains blocked until maintainer-owned deployment evidence resolves that gate.
+
+## Product integration plan
+
+| Surface | Intended behavior | Source of truth | Failure or unsupported state | Planned paths and tests |
+| --- | --- | --- | --- | --- |
+| UI | Show launch identity, ordinary trade terms, separate arena terms, signer trust, deadlines and refund state. | Confirmed chain reads plus finalized indexed events. | Stale data is labeled and value actions stop. | Maintainers assign product paths after acceptance. |
+| App/game | First-to-three arena, keyboard/touch input and unsigned practice result. | Browser state for play; never for payout. | Renderer or client divergence creates no signature. | `src/*`, `tests/round-engine.test.mjs`, browser QA. |
+| API | Return chain, model, round identity, canonical match payload, freshness and explicit errors. | Confirmed escrow state and service validation. | Reject oversize, stale, mismatched or unauthenticated production requests. | Companion repository; maintainer path pending. |
+| Result service | Sign one fully bound result for player A or B. | Canonical server-side match record plus confirmed round terms. | Fail closed; players refund after timeout. | Companion commit and four local attestation tests. |
+| Indexer | Reconstruct pool identity and every round transition with reorg rollback. | Finalized logs reconciled to StateView and escrow reads. | Quarantine mismatches and expose lag. | Maintainer path pending. |
+| Quote | External Uniswap interface/API quote for exact PoolKey, direction, exactness, amount, LP fee and hook fee. | Named provider response plus confirmed pool and hook state. | No game data or custom hookData accepted; absence of a quote is an external-provider state. | External provider observation required after deployment. |
+| Trade | User-confirmed transaction prepared by the external Uniswap client. | Transaction receipt, `Swap`, `QuoteFeesAccrued` and confirmed pool-scoped liabilities. | External route failure leaves game and escrow state unaffected. | External provider and receipt evidence required after deployment. |
+| Claim | Submit signed settlement or player-controlled timeout refund. | Escrow round state and immutable EIP-712 domain. | Invalid signatures revert; timeout remains available. | Solidity lifecycle, replay and refund tests. |
+| Monitoring | Separate pool/indexer, service, open-round and escrow solvency signals. | Chain reads, finalized logs and service health. | Stop new paid rounds without disabling exits. | Release owner and runbook required later. |
+
+Third-party routing, discovery and listing remain separate external decisions. No provider support or product availability is claimed.
+
+## Fees, recipients and settlement
+
+The static LP fee remains separate in core and belongs to liquidity providers. For each canonical-pool swap, let the creator-selected total hook fee be `S`, the effective total be `E = max(S, 10 bps)`, and gross native quote volume be `G`:
+
+- `total hook fee = floor(G × E / 10,000)` for gross-specified accounting;
+- `Programmable fee = floor(G × 10 / 10,000)`;
+- `project fee = total hook fee − Programmable fee`.
+
+Exact-output quote amounts are grossed up with ceiling division, then split by the same fixed 10-basis-point calculation. A nonzero trade reverts if the Programmable share rounds to zero. Liabilities are keyed by PoolId; no cross-pool netting occurs. Only `0x4957f49620AFf3Adbbe8195a4f633E49cc93376c` can initiate a Programmable claim for one PoolId and select that claim's destination. The immutable project owner can claim only its own pool remainder.
+
+For one joined round:
+
+`escrow liability = player A stake + player B stake = 2 × stored stake`
+
+Valid settlement reduces the complete liability, then transfers exactly `2 × stake` to the signed winner. Timeout processing reduces one player liability before each exact `stake` transfer. A failed transfer reverts its complete state change. Direct token donations are excluded from liabilities and cannot be rescued.
+
+## Semantic examples
+
+- Player A deposits 100 ARENA and player B deposits 100 ARENA. A valid result naming player B pays 200 ARENA to player B, charges 0, and leaves 0 round liability.
+- If no result is accepted before the resolution deadline, A claims 100 and B claims 100 in either order. Total refunds equal 200 and leave 0 round liability.
+- A token that delivers 99 after a requested transfer of 100 reverts round creation or payout; it is not silently socialized.
+- A signed outsider address reverts even if the immutable signer produced the signature.
+- All four swap quadrants retain PoolManager pricing while the hook collects the exact pool-scoped native-ETH fee. Quote-specified partial fills revert rather than undercharge; quote-unspecified swaps use the final executed quote delta.
+
+## Fact provenance
+
+- **Builder-stated:** desired game concept, equal-stake winner payout, two-repository structure and intended Programmable handoff.
+- **Agent-derived:** same-hook fee boundary, signer capability limit, timeout design, canonical payload fields, threat model and test matrix.
+- **Evidence-backed locally:** source compilation, 28 Solidity tests including 19 real PoolManager fee-hook tests, 4 game tests, 4 companion tests, browser renders and interactions, static analysis, size output and primary/companion package locks. These checks do not prove deployment, external routing or acceptance.
+
+## Open decisions
+
+No builder product-intent choice is left open. The proposal still requires maintainer architecture and dependency review,
+compatible stateful invariant evidence, pinned-fork evidence, exact deployment identities, service
+authentication/operations, product paths and independent security review before it can become prototype-ready.
+
+This is a public, non-confidential proposal. Acceptance, deployment, verification, routing, listing and availability require separate evidence.
diff --git a/submissions/arena-bounty/TEST_PLAN.md b/submissions/arena-bounty/TEST_PLAN.md
new file mode 100644
index 00000000..0f591af7
--- /dev/null
+++ b/submissions/arena-bounty/TEST_PLAN.md
@@ -0,0 +1,73 @@
+# Test plan
+
+## Evidence already run for this local proposal
+
+| Surface | Command | Result | Scope |
+| --- | --- | --- | --- |
+| Game rules | `npm run test:app` | 4 passed, 0 failed | Determinism, bounds, first-to-three transition and no result while active. |
+| Contracts | `forge test -vv` | 28 passed, 0 failed; two fuzz properties ran 256 cases each | Nine escrow lifecycle tests plus 19 real PoolManager fee-hook tests covering formula, four quadrants, routing, dust, partial fills, ownership and cross-pool isolation. |
+| Solidity format | `forge fmt --check` | Passed | Declared Solidity files. |
+| Solidity size | `forge build --sizes` | Escrow 6,223/7,513 B; hook 7,164/7,987 B; factory 9,370/9,396 B runtime/initcode | Local compiler/settings only. |
+| Solidity gas snapshot | `forge snapshot --check` | Passed; 28 tests matched `.gas-snapshot` | Local test gas regression only; no deployment gas claim. |
+| Static analysis | `slither . --filter-paths 'node_modules|test'` | 45 contracts, 101 detectors; timestamp findings plus documented tool/parser dispositions | Local source analysis; dispositions below. |
+| Browser production build | `npm run build` | Passed; 537.01 kB JS, 135.82 kB gzip | Local Vite build, with one size advisory. |
+| Browser behavior | `npm run qa:browser` | Passed at 1440, 390, 320 and 720 CSS px at 2x device scale | Nonzero renderer metrics, input-driven movement, touch/keyboard behavior, no console error or horizontal overflow. |
+| Primary dependencies | `npm audit --omit=dev` | 0 vulnerabilities in fresh root rerun | Current npm advisory database and production dependency tree only. |
+| Companion | `npm run verify` | 4 passed, 0 failed | Exact EIP-712 sign/verify, tamper, outsider/deadline rejection and key non-exposure. |
+| Companion dependencies | `npm audit --omit=dev` | 0 vulnerabilities in fresh root rerun | Current npm advisory database and production dependency tree only. |
+
+The exact machine-readable ledger is `evidence/local-checks.json`.
+
+## Required prototype tests
+
+### Escrow lifecycle and properties
+
+- Add a compatible stateful handler covering create, join, settle, unjoined refund, joined refunds and hostile ordering. Record invariant calls, reverts and seed.
+- Assert `token balance >= totalEscrowed` after every reachable state transition and equality when no direct donation exists.
+- Fuzz round IDs, deadlines, stakes, player order, refund order and match digests at uint boundaries.
+- Add malicious ERC-20 cases for false return, empty return, callback reentrancy, balance manipulation, rebase and recipient-side deduction.
+- Test signature malleability, compact signatures if supported, wrong chain, wrong escrow, wrong action, wrong token/stake/players/rules/digest/deadlines and replay across every terminal state.
+- Keep ERC-1271 explicitly unsupported for this fixed-EOA design; if contract signers are later added, treat that as an architecture change and add valid, invalid, reverting and gas-griefing contract-wallet tests.
+- Measure gas for create, join, settle and each refund at realistic state sizes.
+
+### Canonical Programmable fee hook and trading
+
+- Resolve the committed Sepolia profile source conflict and bind exact deployments, runtime hashes, interfaces, immutables and observation block.
+- Run a pinned fork and current-head smoke for token creation, hook registration, pool initialization, liquidity, all four swap quadrants and both fee claim paths.
+- Re-run the existing real PoolManager tests for exact `max(selected, 10 bps)` behavior, fixed owner, owner-selected claim destination, LP-fee separation, dust reverts, partial-fill reverts, arbitrary routers and cross-pool isolation.
+- Add stateful invariants that keep aggregate native ERC-6909 claims equal to the sum of every PoolId project and Programmable liability through randomized accrual and claim ordering.
+- After deployment, record independent Uniswap interface/API quote, transaction-build and receipt evidence for the exact PoolKey, hook-inclusive amount, exactness, fees and user bounds. Routing review remains external.
+- Test alternative-pool presentation so it cannot inherit canonical fee enforcement, Programmable approval or arena-support labels.
+
+### Game and service
+
+- Test canonical serialization across browser, service and Solidity typed-data hash with shared fixtures.
+- Add production authentication, authorization, distributed rate limits, idempotency, request ordering, replay storage, log redaction and key rotation runbook. A rotation creates a new escrow; it cannot mutate an old one.
+- Run long-duration desktop/mobile playtests, WebGL context loss, tab blur, pointer cancellation, reload, reduced motion, keyboard-only flow, screen-reader labels, stale API and wallet rejection states.
+- Add server-authoritative match validation. The current service demonstrates bounded signing but does not prove game-result truth.
+- Test service outage through both player refunds without operator assistance.
+
+### Product and operations
+
+- Index from exact deployment blocks with finalized `(block, transactionIndex, logIndex)` cursors, forced reorg rollback, bounded backfill, restart and reconciliation to `rounds`, `totalEscrowed` and token balance.
+- Show stale/finality state and suppress settlement guidance on divergence.
+- Exercise stop-new-rounds behavior while settlement and refunds remain available.
+- Define thresholds, owner, escalation and drills for signer errors, signature latency, open rounds near timeout, escrow deficit, indexer lag, RPC/provider outage and route drift.
+- Test UI/API/claim status against the exact accepted model version and contract identity after maintainers assign product paths.
+
+## Static-analysis disposition
+
+Foundry lint identifies six `block.timestamp` comparison locations and Slither groups them across five functions. They enforce join, result and refund windows. Timestamps do not determine randomness, match score, swap price or payout amount. Small validator skew remains a disclosed timing risk; realistic windows and boundary tests are required. Foundry also reports safe test-only integer casts whose constants are far below `int256.max`.
+
+Slither's `too-many-digits` detector is locally suppressed on the factory expression because it expands compiler-generated hook creation bytecode and misclassifies embedded bytes as one source decimal literal. The source comment records this narrow disposition. The hook records liability state before its trusted PoolManager claim mint and emits the accrual event before that call; any revert rolls back both. Independent review remains required.
+
+The Vite build's bundle-size warning is accepted only for this local architecture canary. Production work must decide code splitting and budget using measured startup and frame behavior.
+
+## Evidence status
+
+- `passed`: local commands listed above.
+- `passed-with-disposition`: timestamp findings and browser bundle advisory.
+- `not-executed`: compatible stateful invariant runner, fork/current-head, production auth, deployment, source/runtime verification, live indexer, monitoring drills, independent review and provider decisions.
+- `passed`: current app, 28 contract tests, fee formulas and claims, companion, browser and dependency checks listed above.
+
+No local test proves audit, deployment, provider support, acceptance or product availability.
diff --git a/submissions/arena-bounty/THREAT_MODEL.md b/submissions/arena-bounty/THREAT_MODEL.md
new file mode 100644
index 00000000..71c14ca5
--- /dev/null
+++ b/submissions/arena-bounty/THREAT_MODEL.md
@@ -0,0 +1,95 @@
+# Threat model
+
+## Assets and value at risk
+
+- The canonical v4 pool holds standard launch liquidity under PoolManager and position semantics. `ArenaProgrammableFeeHook` owns only native-ETH ERC-6909 claims backing explicitly recorded fee liabilities; it owns no LP position.
+- `ArenaPrizeEscrow` holds only exact standard ERC-20 deposits for open or joined rounds. `totalEscrowed` is the aggregate recorded liability.
+- Each round stores player A, optional player B, equal stake, rules hash, join deadline, resolution deadline, match digest, status and refund mask.
+- The immutable result signer is a capability: it can authorize player A or B as winner before timeout. The private key is never committed, logged or returned by the service API.
+- Browser scores and movement are valuable game state but are not payout authority.
+- A direct token donation becomes visible surplus. It has no rescuer and cannot cover, reduce or redirect a player liability.
+
+Only the launched token with standard exact-transfer behavior is supported as the prize token. Fee-on-transfer, rebasing, callback-driven balance change, pausing, blacklisting and upgrade controls are outside this proposal.
+
+## Trust boundaries
+
+| Boundary | Can do | Cannot do |
+| --- | --- | --- |
+| Official launch profile | Create token, pool and launch liquidity through its declared contracts. | Prove current runtime or availability merely because a profile is committed. |
+| Registrar/factory | Deploy a permission-valid hook and register exact PoolKeys before initialization. | Replace the fixed Programmable owner, register twice, redirect claims or mutate a registered fee configuration. |
+| PoolManager/external Uniswap client | Authenticate callbacks, price/settle v4 actions or prepare a user-confirmed quote/transaction. | Bypass the canonical hook, read game state or accept a match signature in this design. |
+| Fee hook | Enforce the canonical native-ETH fee, record liabilities by PoolId and redeem claims to authorized destinations. | Change its fixed owner/share, net liabilities across pools, divert LP fees, accept arbitrary quote assets or call game/service logic. |
+| Browser/game | Render, accept input and show an unsigned practice result. | Move assets, sign results or determine an onchain winner. |
+| Wallet | Approve and submit user-confirmed transactions. | Make stale or forged service data valid. |
+| Result service/operator | Validate one canonical payload and sign A or B. | Hold tokens, submit settlement, name an outsider, alter stake/token/rules, extend deadlines or block refunds. |
+| Escrow | Hold exact deposits, authenticate the immutable signer, pay a recorded winner and refund players. | Change signer, token, fee, rules or deadlines after round creation; call arbitrary targets. |
+| Indexer/API | Present finalized and reconciled state. | Replace confirmed contract state or turn a browser score into entitlement. |
+| Routing/discovery provider | Discover or route the ordinary pool if independently supported. | Prove source identity, escrow solvency, game correctness or Programmable acceptance. |
+
+## Canonical fee-hook boundary
+
+The canonical pool embeds `ArenaProgrammableFeeHook` in its PoolKey. Its mined address enables only initialization and swap callbacks plus the two swap return-delta flags. `BaseHook` rejects callers other than PoolManager. The game result occurs after a match and does not need atomic PoolManager execution, so prize custody and signatures remain a separate boundary. No custom `hookData`, nested swap, liquidity callback or donation callback is supported.
+
+## Value flows and accounting
+
+1. The registrar binds a canonical native-ETH PoolKey and its immutable project fee owner before initialization.
+2. Every canonical-pool swap calculates the effective total as `max(selected total, 10 bps)`. Programmable receives `floor(gross quote × 10 / 10,000)`; the project receives the remaining hook fee. LP fees remain separate in core.
+3. PoolManager mints native-ETH ERC-6909 claims to the hook. Project and Programmable liabilities are recorded separately by PoolId before claims can be redeemed. Cross-pool netting is impossible through either claim entry point.
+4. Player A creates a round and transfers exactly one stake. State and liability revert if observed balance increase differs.
+5. Player B joins and transfers exactly the same stake under the same check.
+6. Valid settlement sets the round to settled and reduces liability before transferring exactly two stakes to A or B. Any transfer anomaly reverts the whole transaction.
+7. An unjoined player A recovers one stake after the join deadline.
+8. After resolution timeout, A and B each reduce one liability and recover one stake once. Either claim can occur first.
+
+For every PoolId, `hook ERC-6909 quote claims = project liability + Programmable liability` after each fee accrual or claim. For every joined arena round, `recorded deposits = 2 × stake`; a successful payout or two timeout refunds reduce its liability to zero. These accounting domains never net against one another.
+
+## Attack and failure scenarios
+
+- **Dishonest signer:** can select the wrong recorded player before timeout. This is disclosed trust, not solved by timeout. It cannot redirect value outside A/B.
+- **Signer outage or censorship:** no settlement occurs. Both players recover independently after the fixed deadline.
+- **Signature replay:** round state leaves `Joined`; the same signature fails. Domain binds chain, escrow, action and every material round/result field.
+- **Cross-chain or cross-contract replay:** EIP-712 domain includes chain ID and verifying escrow address.
+- **Parameter substitution:** token, stake, both players, rules hash, match digest, signature deadline and resolution deadline are signed.
+- **Outsider payout:** rejected before signature recovery.
+- **Malicious browser:** may fake visuals or an unsigned result but cannot create a valid signer authorization.
+- **API abuse:** companion input is bounded to 16 KiB, validates exact fields and applies a local request limit; production authentication and distributed rate limiting remain required.
+- **Reentrancy or hostile token:** every value-moving entry is guarded, state updates precede outbound transfers, SafeERC20 is used and both sender/recipient balance deltas must be exact.
+- **Fee-on-transfer/rebase:** non-exact deposit or payout reverts; these assets are unsupported.
+- **Deadline manipulation:** validators can slightly skew timestamps. Time is used only for windows, never for randomness, score, price or payout amount. Product windows must include operational margin.
+- **Insolvency:** `totalEscrowed` is reconciled to token balance. Donated surplus is excluded; a deficit stops new paid rounds and requires incident escalation.
+- **No rescue:** accidental surplus cannot be withdrawn. This removes rescue authority but permanently strands donations.
+- **Round identifier collision:** a nonzero existing `roundId` cannot be recreated.
+- **Denial of service:** no unbounded loop exists on deposits, payout or refunds. Service outage cannot block timeout exit.
+- **Reorg/indexer drift:** roll back orphaned events, replay from a confirmed ancestor and reconcile round state plus balances before displaying entitlement.
+- **Wrong PoolKey/external route:** any later provider quote and transaction must bind the canonical PoolKey and user bounds. Arena code never prepares or changes route data.
+- **Router bypass:** any router entering the canonical PoolKey reaches the same PoolManager-authenticated hook. A different pool is explicitly outside canonical fee enforcement and cannot be labeled as the approved market.
+- **Cross-pool withdrawal:** both liability ledgers and both claim functions require PoolId. Claiming one pool cannot decrease or redeem another pool's balance.
+- **Rounding bypass:** a nonzero quote amount reverts whenever the fixed 10-basis-point share would round to zero. Programmable is calculated directly at 10 basis points; it does not receive creator-fee rounding dust.
+- **Partial fills:** quote-specified partial fills revert when actual pool quote differs from the fee-adjusted expectation. Quote-unspecified swaps charge from the final executed quote delta.
+- **Unauthorized fee claim:** the fixed Programmable wallet alone initiates a pool-specific platform claim and selects its per-claim destination. The project owner can claim only its own pool remainder. Zero recipients revert.
+- **Same-hook callback bypass:** the hook exposes no nested swap or direct PoolManager action that could suppress its own callbacks.
+
+## Dependency identity
+
+- `openzeppelin-contracts-5-6-1`: source revision `5fd1781b1454fd1ef8e722282f86f9293cacf256`, package version 5.6.1, locked in the primary repository.
+- `openzeppelin-uniswap-hooks-1-1-1` and `uniswap-v4-core-1-0-2`: exact npm versions locked in the primary repository; they provide `BaseHook`, currency settlement and PoolManager/core accounting used by the fee path.
+- `three-js-0-185-1`: source revision `2431a09f46f34c560bc8e44b33be0e567723d5b9`, package version 0.185.1. Renderer failure has no onchain authority.
+- `playwright-core-1-62-1` and `vite-8-2-0` are exact version, integrity and source-commit tooling bindings; they do not become runtime authorities.
+- `arena-result-service`: companion commit `24875f9325d6c055a04089cf2c1543dfa862fcad`, tree `bde2f6668ccdf9d8777112282cefcec31ea4b60f`, locked v2 manifest and successful closure run `30710249231`. The closed receipt reconstructs its static source and test graph, package manifest, lockfile, optional peer targets and registry integrity records, then binds the exact build and test workflow. This is dependency closure, not a semantic audit. Operator failure falls back to timeout refunds.
+- Official Sepolia launch dependencies remain bound by the selected profile, whose source conflict and runtime-verification gates remain open.
+
+## Authorities and recovery
+
+The model-specific authorities are the immutable result signer, registrar, immutable per-pool project fee owner and fixed Programmable fee owner. The registrar can admit a PoolKey only once and cannot change its configuration. The Programmable owner can claim only its recorded pool-specific share and choose a per-claim destination. There is no upgrade administrator, pauser, rescuer, keeper, oracle, transaction submitter or arbitrary executor. Replacing any immutable authority requires a new deployment and does not change rights in old pools or rounds.
+
+Users recover through standard pool/position behavior, unjoined refund, signed payout or joined timeout refund. Historical entitlements cannot be redirected after state transition.
+
+## Known limitations
+
+- A signer can lie between the two players; independent game-result verification is not yet provided.
+- ERC-1271 contract signers are not supported by this fixed-EOA proposal; signer provenance, custody, rotation, revocation, recovery and incident response remain a candidate review gate.
+- A compatible stateful invariant run, pinned-fork test, deployment receipt, source/runtime verification, product integration, service operations, monitoring drills and independent review are still required before real value.
+- The fee canary currently supports native ETH as quote asset only. Fee-on-transfer or rebasing quote assets are not silently accepted.
+- The static analyzer reports the intentional timestamp windows; these have a written disposition but are not erased.
+- The browser bundle has a 500 kB advisory warning and has not completed a long-duration playtest.
+- No official routing, listing, acceptance, deployment or availability statement is made.
diff --git a/submissions/arena-bounty/application.json b/submissions/arena-bounty/application.json
new file mode 100644
index 00000000..8f1d118c
--- /dev/null
+++ b/submissions/arena-bounty/application.json
@@ -0,0 +1 @@
+{"applicationId":"arena-bounty","applicationRevision":1,"builder":{"contact":"https://github.com/0xprogrammable","githubLogin":"0xprogrammable","githubUserId":"309941960"},"companionClosure":[{"closureHash":"sha256:6ccc7669c5db293afe75573e182672dde52603825948f15825826ad814bda15f","closureMethod":"npm-package-lock-v3-static-module-closure-v1","dependencyEdgeCount":31,"fileCount":6,"manifestPath":".programmable/companions/arena-result-service.json","moduleResolutionCount":2,"numericRepositoryId":"1319380496","packageCount":18,"repositoryUri":"https://github.com/0xprogrammable/arena-result-service-canary","revisionObjectId":"24875f9325d6c055a04089cf2c1543dfa862fcad","schemaVersion":"2.0.0","status":"verified","successfulGitHubActionsRunIds":["30710249231"],"treeObjectId":"bde2f6668ccdf9d8777112282cefcec31ea4b60f","workflowReceipts":[{"buildScript":"build","runId":"30710249231","testScript":"test","workflowObjectId":"fd0106919db17e59823b6ce6c3fb69cfe90078b5","workflowPath":".github/workflows/programmable-companion-closure.yml"}]}],"declarations":{"noApprovalClaim":true,"noSecretsDeclared":true,"noUniswapEndorsementClaim":true,"publicInformationAcknowledged":true},"programmableFee":{"accounting":{"accrualMode":"claimable-liability","claimEvent":"ProgrammableFeesClaimed(bytes32,address,address,uint256)","collectionEvent":"QuoteFeesAccrued(bytes32,address,bool,uint16,uint16,uint256,uint256,uint256)","crossPoolNetting":false,"liabilityKeyDimensions":["poolId","currency","owner"],"valueFlowId":"programmable-swap-fee-accrual"},"basis":{"quoteAsset":"canonical-pool-quote-asset","volume":"gross-quote-side-swap-volume"},"collection":{"enforcement":"non-bypassable","hookFeeMechanismBinding":"hook.feeMechanism","integration":"canonical-pool-hook","selfCallPolicy":"same-pool-swap-forbidden","status":"implemented","supportedSwapModes":["zeroForOne-exactInput","zeroForOne-exactOutput","oneForZero-exactInput","oneForZero-exactOutput"],"swapModePaths":{"oneForZeroExactInput":"after-swap-return-delta","oneForZeroExactOutput":"before-swap-return-delta","zeroForOneExactInput":"before-swap-return-delta","zeroForOneExactOutput":"after-swap-return-delta"}},"evidence":{"sourcePaths":["contracts/ArenaProgrammableFeeHook.sol","contracts/ArenaProgrammableFeeHookFactory.sol"],"testPaths":["test/ArenaProgrammableFeeHook.t.sol"]},"ownership":{"administratorCanMutate":false,"builderCanMutate":false,"claimAuthority":"owner-only","claimAvailability":"anytime","claimDestinationPolicy":"owner-or-owner-selected-per-claim","immutable":true,"owner":"0x4957f49620AFf3Adbbe8195a4f633E49cc93376c","projectCanMutate":false,"storedMutableRecipient":false},"policyId":"programmable-volume-fee-v1","policyVersion":"1.0.0","poolScope":"canonical-launch-pool-key","rates":{"effectiveHundredthsOfBip":1000,"formula":"effective=max(selected,1000);platform=1000;project=effective-1000","lpFeeExcluded":true,"minimumEffectiveHundredthsOfBip":1000,"platformHundredthsOfBip":1000,"projectHundredthsOfBip":0,"selectedHundredthsOfBip":0,"unit":"hundredths-of-bip"},"submissionBinding":{"path":"submissions/arena-bounty/submission.json","sha256":"sha256:2755185118dd48985fdc6f69c947b80680b83c41ad9bf04ba228340815277ff2"}},"reviewPackage":[{"byteLength":13775,"path":"PROPOSAL.md","sha256":"sha256:1e26583115a5bc8c3262aaff45810e52794efb67f422072e301593cd1c4c142b"},{"byteLength":7376,"path":"TEST_PLAN.md","sha256":"sha256:9f77e0781d8cfc21718e8ba2f96fa8e586a93a8c671ded4f4c482849174731cd"},{"byteLength":11694,"path":"THREAT_MODEL.md","sha256":"sha256:20eb08eb78d2b4ffac2d8bba2e1c4898779e412738e9d392d04b307ab55566f4"},{"byteLength":31568,"path":"compatibility-report.json","sha256":"sha256:224382ed8646166966c5e1de14d4d19c5e7f200e3348f9faacd570491a32a94a"},{"byteLength":1160,"path":"evidence-index.json","sha256":"sha256:b4730a55946f9af57ac909bc401b3c380d869534cb9f83350e4e8d91e1ff3133"}],"schemaVersion":2,"source":{"companions":[{"contractPaths":["package-lock.json","package.json"],"githubActionsRunIds":["30710249231"],"numericRepositoryId":"1319380496","repositoryUri":"https://github.com/0xprogrammable/arena-result-service-canary","revisionObjectId":"24875f9325d6c055a04089cf2c1543dfa862fcad","sourcePaths":["src/attestation.mjs","src/server.mjs","test/attestation.test.mjs"],"treeObjectId":"bde2f6668ccdf9d8777112282cefcec31ea4b60f"}],"primary":{"contractPaths":["contracts/ArenaPrizeEscrow.sol","contracts/ArenaProgrammableFeeHook.sol","contracts/ArenaProgrammableFeeHookFactory.sol","test/ArenaPrizeEscrow.t.sol","test/ArenaProgrammableFeeHook.t.sol","test/MockTokens.sol","test/TestBase.sol"],"githubActionsRunIds":[],"numericRepositoryId":"1319381306","repositoryUri":"https://github.com/0xprogrammable/arena-bounty-canary","revisionObjectId":"88732035e0834541686873952f2e26333c00e353","sourcePaths":[".gas-snapshot",".programmable/companions/arena-result-service.json","evidence/local-checks.json","foundry.toml","index.html","package-lock.json","package.json","remappings.txt","scripts/browser-qa.mjs","spec/arena-bounty.json","src/arena-scene.js","src/main.js","src/round-engine.js","src/styles.css","submissions/arena-bounty/EVIDENCE.md","submissions/arena-bounty/PROPOSAL.md","submissions/arena-bounty/TEST_PLAN.md","submissions/arena-bounty/THREAT_MODEL.md","submissions/arena-bounty/compatibility-report.json","submissions/arena-bounty/submission.json","tests/round-engine.test.mjs"],"treeObjectId":"682478be7d6079289c9b046ff89716c4d54cad89"},"schemaVersion":"1.0.0"},"stage":"proposal","summary":"Launch a standard token and use it in a browser arena whose separate escrow pays a bounded signed match result or returns both player deposits after timeout.","title":"Arena Bounty"}
diff --git a/submissions/arena-bounty/compatibility-report.json b/submissions/arena-bounty/compatibility-report.json
new file mode 100644
index 00000000..026cd22c
--- /dev/null
+++ b/submissions/arena-bounty/compatibility-report.json
@@ -0,0 +1 @@
+{"applicationId":"arena-bounty","disclaimer":"Builder-declared compatibility evidence; not an audit, approval, deployment, Uniswap endorsement, or launch.","findings":[{"code":"BEFORE_SWAP_RETURN_DELTA_CRITICAL","evidenceIds":["compatibility-report"],"path":"$.hook.permissions.beforeSwapReturnDelta","remediation":"Prove all four swap quadrants, backing, partial fills, slippage and zero-sum settlement with specialist review.","severity":"warning","summary":"beforeSwapReturnDelta can bypass concentrated-liquidity swap math and create a no-op swap."},{"code":"CAPABILITY_EXTENSION_REQUIRES_ARCHITECTURE_REVIEW","evidenceIds":["compatibility-report"],"path":"$.capabilityExtensions[0]","remediation":"Review its declared interactions, trust boundary, failure mode, schema and exact source/evidence bytes before defining adapters or approval requirements.","severity":"warning","summary":"Novel capability browser-arena-game is preserved for architecture review rather than forced into the current catalog."},{"code":"CAPABILITY_EXTENSION_REQUIRES_ARCHITECTURE_REVIEW","evidenceIds":["compatibility-report"],"path":"$.capabilityExtensions[1]","remediation":"Review its declared interactions, trust boundary, failure mode, schema and exact source/evidence bytes before defining adapters or approval requirements.","severity":"warning","summary":"Novel capability signed-match-result-service is preserved for architecture review rather than forced into the current catalog."},{"code":"DECLARED_FILE_SEMANTIC_CLOSURE_UNAVAILABLE","evidenceIds":["compatibility-report"],"path":"$.closure.DECLARED_FILE_SEMANTIC_CLOSURE_UNAVAILABLE","remediation":"Retain the exact bytes and add a pinned language-specific scanner or attributable architecture review for this exact revision.","severity":"warning","summary":"Declared project files are byte-bound, but their language or asset graph has no deterministic semantic closure rule in this beta. 4 diagnostics recorded; first path: .gas-snapshot."},{"code":"DECLARED_FILE_TOOLING_REVIEW_REQUIRED","evidenceIds":["compatibility-report"],"path":"$.capabilityExtensions[0].sourcePaths[0]","remediation":"Keep the file in the exact review target and add a language-specific scanner or an attributable manual review before candidate approval.","severity":"warning","summary":"index.html is bound as exact bytes, but the current deterministic validator has no semantic dependency-closure scanner for this capability extension source file type."},{"code":"DECLARED_FILE_TOOLING_REVIEW_REQUIRED","evidenceIds":["compatibility-report"],"path":"$.capabilityExtensions[0].sourcePaths[4]","remediation":"Keep the file in the exact review target and add a language-specific scanner or an attributable manual review before candidate approval.","severity":"warning","summary":"src/styles.css is bound as exact bytes, but the current deterministic validator has no semantic dependency-closure scanner for this capability extension source file type."},{"code":"DECLARED_FILE_TOOLING_REVIEW_REQUIRED","evidenceIds":["compatibility-report"],"path":"$.projectSurfaces[2].sourcePaths[0]","remediation":"Keep the file in the exact review target and add a language-specific scanner or an attributable manual review before candidate approval.","severity":"warning","summary":"index.html is bound as exact bytes, but the current deterministic validator has no semantic dependency-closure scanner for this project surface source file type."},{"code":"DECLARED_FILE_TOOLING_REVIEW_REQUIRED","evidenceIds":["compatibility-report"],"path":"$.projectSurfaces[2].sourcePaths[4]","remediation":"Keep the file in the exact review target and add a language-specific scanner or an attributable manual review before candidate approval.","severity":"warning","summary":"src/styles.css is bound as exact bytes, but the current deterministic validator has no semantic dependency-closure scanner for this project surface source file type."},{"code":"EOA_SIGNER_KEY_OPERATIONS_REVIEW_REQUIRED","evidenceIds":["compatibility-report"],"path":"$.security.signatureScheme.erc1271","remediation":"Review signer provenance, custody, environment isolation, rotation and revocation, key-loss recovery, low-s enforcement and incident response before candidate approval.","severity":"warning","summary":"The declared signature model intentionally accepts only a fixed EOA signer and does not support ERC-1271 contract-wallet validation."},{"code":"NOVEL_PROJECT_CATEGORY_REQUIRES_ARCHITECTURE_REVIEW","evidenceIds":["compatibility-report"],"path":"$.model.category","remediation":"Keep the category and describe the actors, value flows, authorities, failures and integration surfaces; do not force the project into an unrelated known profile.","severity":"warning","summary":"Project category browser-game-prize-market is not a closed launch-type decision and requires architecture review of its declared behavior."},{"code":"PROGRAMMABLE_PLATFORM_CHAIN_NOT_CURRENTLY_INTEGRATED","evidenceIds":["compatibility-report"],"path":"$.target.chainId","remediation":"Continue the application and architecture review without making a launch claim; a separate maintainer-owned chain integration and release must pass before Programmable can launch this project on the target chain.","severity":"warning","summary":"Chain 11155111 is eligible for public application review, but the current Programmable launch runtime is integrated only with Ethereum Mainnet (chain 1)."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.declared-file-tooling-or-manual-review","remediation":"Complete the attributable candidate gate declared-file-tooling-or-manual-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate declared-file-tooling-or-manual-review: At least one declared project file is byte-bound but needs a language-specific scanner or attributable manual review."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.eoa-signer-key-operations-review","remediation":"Complete the attributable candidate gate eoa-signer-key-operations-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate eoa-signer-key-operations-review: The declared signature model uses a fixed EOA signer, so key provenance, custody, rotation, revocation, recovery and incident response require review."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.human-economic-and-security-review","remediation":"Complete the attributable candidate gate human-economic-and-security-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate human-economic-and-security-review: Automation cannot accept its own output."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.independent-project-custody-and-solvency-review","remediation":"Complete the attributable candidate gate independent-project-custody-and-solvency-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate independent-project-custody-and-solvency-review: Custody ownership, solvency, loss allocation and user exits need independent review."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.independent-project-value-flow-review","remediation":"Complete the attributable candidate gate independent-project-value-flow-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate independent-project-value-flow-review: A value-moving project surface needs independent accounting, authorization and economic review."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.independent-security-review-one","remediation":"Complete the attributable candidate gate independent-security-review-one for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate independent-security-review-one: Every model needs an independent review scaled to its capability and value risk before selection."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.independent-specialist-review","remediation":"Complete the attributable candidate gate independent-specialist-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate independent-specialist-review: beforeSwapReturnDelta is enabled."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.model-specific-architecture-review","remediation":"Complete the attributable candidate gate model-specific-architecture-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate model-specific-architecture-review: A model-specific baseline changes the architecture and trust assumptions outside the Programmable-tested acceleration path."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.model-specific-dependency-review","remediation":"Complete the attributable candidate gate model-specific-dependency-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate model-specific-dependency-review: A builder-pinned compiler and dependency closure remains unreviewed until maintainers verify the exact lock and source graph."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.novel-capability-architecture-review","remediation":"Complete the attributable candidate gate novel-capability-architecture-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate novel-capability-architecture-review: At least one capability extension is outside the current acceleration catalog."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.novel-project-architecture-review","remediation":"Complete the attributable candidate gate novel-project-architecture-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate novel-project-architecture-review: The project uses a novel category that must be reviewed by behavior rather than rejected by label."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.pinned-fork-and-current-head-smoke","remediation":"Complete the attributable candidate gate pinned-fork-and-current-head-smoke for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate pinned-fork-and-current-head-smoke: Every candidate must prove compatibility with exact deployments and current chain state."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.programmable-indexer-integration-review","remediation":"Complete the attributable candidate gate programmable-indexer-integration-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate programmable-indexer-integration-review: Only Programmable maintainers can accept the proposed indexer integration."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.programmable-integration-test-review","remediation":"Complete the attributable candidate gate programmable-integration-test-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate programmable-integration-test-review: Programmable maintainers must review the bound cross-surface tests before integration."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.programmable-registry-integration-review","remediation":"Complete the attributable candidate gate programmable-registry-integration-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate programmable-registry-integration-review: Only Programmable maintainers can add a model to the website registry."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.project-external-dependency-trust-review","remediation":"Complete the attributable candidate gate project-external-dependency-trust-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate project-external-dependency-trust-review: External target identity, upgradeability, failure and return-value assumptions need independent review."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.project-secret-boundary-operations-review","remediation":"Complete the attributable candidate gate project-secret-boundary-operations-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate project-secret-boundary-operations-review: A project surface depends on signing keys, API keys or another confidential operations boundary."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.project-signer-governance-review","remediation":"Complete the attributable candidate gate project-signer-governance-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate project-signer-governance-review: Signer scope, domain binding, revocation and compromise handling need independent review."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.repository-closure-architecture-review","remediation":"Complete the attributable candidate gate repository-closure-architecture-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate repository-closure-architecture-review: The exact proposal is source-bound, but unsupported closure mechanics require architecture and tooling review before prototype readiness."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.candidate.specialist-accounting-review","remediation":"Complete the attributable candidate gate specialist-accounting-review for this exact revision before advancing.","severity":"warning","summary":"Required candidate gate specialist-accounting-review: The hook uses custom accounting."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.external.independent-routing-provider-approval","remediation":"Complete the attributable external gate independent-routing-provider-approval for this exact revision before advancing.","severity":"informational","summary":"Required external gate independent-routing-provider-approval: Routing or listing is controlled by each external provider."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.external.uniswap-hook-routing-review","remediation":"Complete the attributable external gate uniswap-hook-routing-review for this exact revision before advancing.","severity":"informational","summary":"Required external gate uniswap-hook-routing-review: Published Uniswap routing-review criteria apply; only the provider can approve the hook or pool."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.after-swap-return-delta-invariants","remediation":"Complete the attributable prototype gate after-swap-return-delta-invariants for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate after-swap-return-delta-invariants: afterSwapReturnDelta is enabled."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.before-swap-delta-four-quadrant-proof","remediation":"Complete the attributable prototype gate before-swap-delta-four-quadrant-proof for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate before-swap-delta-four-quadrant-proof: beforeSwapReturnDelta is enabled."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.callback-authentication-and-permission-mask","remediation":"Complete the attributable prototype gate callback-authentication-and-permission-mask for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate callback-authentication-and-permission-mask: Every hook must authenticate PoolManager and match its mined address permissions."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.callback-selector-return-length-and-self-call-tests","remediation":"Complete the attributable prototype gate callback-selector-return-length-and-self-call-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate callback-selector-return-length-and-self-call-tests: Every enabled callback must return the exact selector and ABI length and account for noSelfCall suppression."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.cross-pool-solvency-invariants","remediation":"Complete the attributable prototype gate cross-pool-solvency-invariants for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate cross-pool-solvency-invariants: Custom accounting is shared across pools."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.delta-conservation-invariants","remediation":"Complete the attributable prototype gate delta-conservation-invariants for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate delta-conservation-invariants: The hook uses custom accounting."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.dependency-failure-tests","remediation":"Complete the attributable prototype gate dependency-failure-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate dependency-failure-tests: The model has external dependencies."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.erc6909-liability-solvency-invariants","remediation":"Complete the attributable prototype gate erc6909-liability-solvency-invariants for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate erc6909-liability-solvency-invariants: The model uses PoolManager ERC-6909 claims."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.event-reorg-backfill-freshness-tests","remediation":"Complete the attributable prototype gate event-reorg-backfill-freshness-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate event-reorg-backfill-freshness-tests: Public model state must be reproducible from events and confirmed reads."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.external-call-reentrancy-and-failure-tests","remediation":"Complete the attributable prototype gate external-call-reentrancy-and-failure-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate external-call-reentrancy-and-failure-tests: The declared model makes external calls."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.fee-four-quadrant-tests","remediation":"Complete the attributable prototype gate fee-four-quadrant-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate fee-four-quadrant-tests: The model charges or changes fees during swaps."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.format-build-size-warnings","remediation":"Complete the attributable prototype gate format-build-size-warnings for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate format-build-size-warnings: Every prototype must pass its declared language build and size checks without unexplained warnings."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.project-custody-solvency-and-exit-tests","remediation":"Complete the attributable prototype gate project-custody-solvency-and-exit-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate project-custody-solvency-and-exit-tests: A project surface holds assets, positions, claims, keys or withdrawal authority."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.project-external-call-authentication-and-failure-tests","remediation":"Complete the attributable prototype gate project-external-call-authentication-and-failure-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate project-external-call-authentication-and-failure-tests: A project surface calls another contract, API, provider or service."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.project-signature-domain-replay-and-expiry-tests","remediation":"Complete the attributable prototype gate project-signature-domain-replay-and-expiry-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate project-signature-domain-replay-and-expiry-tests: A project surface consumes signatures or signed data."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.project-value-flow-conservation-and-claim-tests","remediation":"Complete the attributable prototype gate project-value-flow-conservation-and-claim-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate project-value-flow-conservation-and-claim-tests: A project surface can move, award, claim, fee or settle value."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.reserve-reconstruction-and-solvency-tests","remediation":"Complete the attributable prototype gate reserve-reconstruction-and-solvency-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate reserve-reconstruction-and-solvency-tests: The hook holds balances, claims or custom-accounting liabilities."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.return-delta-execution-event","remediation":"Complete the attributable prototype gate return-delta-execution-event for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate return-delta-execution-event: Core Swap events do not fully describe the custom leg."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.signature-replay-and-wallet-tests","remediation":"Complete the attributable prototype gate signature-replay-and-wallet-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate signature-replay-and-wallet-tests: The model uses signatures."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.static-analysis","remediation":"Complete the attributable prototype gate static-analysis for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate static-analysis: Declared Solidity source needs static findings with dispositions."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.prototype.unit-integration-fuzz-invariant-tests","remediation":"Complete the attributable prototype gate unit-integration-fuzz-invariant-tests for this exact revision before advancing.","severity":"blocker","summary":"Required prototype gate unit-integration-fuzz-invariant-tests: Declared Solidity behavior needs lifecycle and property evidence."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.independent-security-review-two","remediation":"Complete the attributable release gate independent-security-review-two for this exact revision before advancing.","severity":"informational","summary":"Required release gate independent-security-review-two: High-risk models need a second independent review before a production release decision."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.monitoring-and-lifecycle-evidence","remediation":"Complete the attributable release gate monitoring-and-lifecycle-evidence for this exact revision before advancing.","severity":"informational","summary":"Required release gate monitoring-and-lifecycle-evidence: Availability requires operational evidence after deployment."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.official-launch-profile-runtime-and-interface-verification","remediation":"Complete the attributable release gate official-launch-profile-runtime-and-interface-verification for this exact revision before advancing.","severity":"informational","summary":"Required release gate official-launch-profile-runtime-and-interface-verification: An official launch profile reference is not proof that its current runtime, interfaces, immutables or source configuration were verified."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.official-launch-profile-source-conflict-resolution","remediation":"Complete the attributable release gate official-launch-profile-source-conflict-resolution for this exact revision before advancing.","severity":"informational","summary":"Required release gate official-launch-profile-source-conflict-resolution: The committed official sources disagree on at least one selected deployment record and execution remains blocked until the conflict is resolved."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.production-anomaly-monitoring","remediation":"Complete the attributable release gate production-anomaly-monitoring for this exact revision before advancing.","severity":"informational","summary":"Required release gate production-anomaly-monitoring: High-risk models need live accounting, callback and authority anomaly monitoring."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.programmable-platform-target-chain-integration","remediation":"Complete the attributable release gate programmable-platform-target-chain-integration for this exact revision before advancing.","severity":"informational","summary":"Required release gate programmable-platform-target-chain-integration: The project may be reviewed, but Programmable launch availability remains blocked until maintainers integrate and release the exact target chain."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.project-custody-solvency-and-withdrawal-monitoring","remediation":"Complete the attributable release gate project-custody-solvency-and-withdrawal-monitoring for this exact revision before advancing.","severity":"informational","summary":"Required release gate project-custody-solvency-and-withdrawal-monitoring: A released custodial surface needs live solvency, withdrawal and authority monitoring."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.project-external-dependency-release-monitoring","remediation":"Complete the attributable release gate project-external-dependency-release-monitoring for this exact revision before advancing.","severity":"informational","summary":"Required release gate project-external-dependency-release-monitoring: A released external dependency needs availability, drift and failure monitoring."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.project-secret-rotation-and-compromise-readiness","remediation":"Complete the attributable release gate project-secret-rotation-and-compromise-readiness for this exact revision before advancing.","severity":"informational","summary":"Required release gate project-secret-rotation-and-compromise-readiness: A released secret-bearing surface needs rotation, revocation and compromise response evidence."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.project-signer-rotation-and-replay-monitoring","remediation":"Complete the attributable release gate project-signer-rotation-and-replay-monitoring for this exact revision before advancing.","severity":"informational","summary":"Required release gate project-signer-rotation-and-replay-monitoring: A released signed-data path needs signer health, rotation and replay monitoring."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.project-value-flow-production-monitoring","remediation":"Complete the attributable release gate project-value-flow-production-monitoring for this exact revision before advancing.","severity":"informational","summary":"Required release gate project-value-flow-production-monitoring: A released value-moving surface needs live conservation, payout and failed-settlement monitoring."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.public-bug-bounty","remediation":"Complete the attributable release gate public-bug-bounty for this exact revision before advancing.","severity":"informational","summary":"Required release gate public-bug-bounty: High-risk models need a funded public vulnerability disclosure path before availability."},{"code":"REQUIRED_REVIEW_GATE","evidenceIds":["compatibility-report"],"path":"$.requiredGates.release.runtime-source-config-verification","remediation":"Complete the attributable release gate runtime-source-config-verification for this exact revision before advancing.","severity":"informational","summary":"Required release gate runtime-source-config-verification: Deployment claims require runtime, source and configuration evidence."},{"code":"SHARED_CUSTOM_ACCOUNTING","evidenceIds":["compatibility-report"],"path":"$.hook.sharedAcrossPools","remediation":"Prefer one hook instance per pool and retain cross-pool solvency invariants if sharing is required.","severity":"warning","summary":"Shared custom accounting carries correlated exposure even with PoolId-scoped liabilities."}],"result":"architecture-review-required","schemaVersion":1,"source":{"numericRepositoryId":"1319381306","revisionObjectId":"88732035e0834541686873952f2e26333c00e353","treeObjectId":"682478be7d6079289c9b046ff89716c4d54cad89"}}
diff --git a/submissions/arena-bounty/evidence-index.json b/submissions/arena-bounty/evidence-index.json
new file mode 100644
index 00000000..2523668f
--- /dev/null
+++ b/submissions/arena-bounty/evidence-index.json
@@ -0,0 +1 @@
+{"applicationId":"arena-bounty","attestation":"builder-declared-untrusted","evidence":[{"id":"compatibility-report","kind":"static-analysis","scope":"Deterministic builder compatibility preflight for the exact committed source revision; central result architecture-review-required.","sha256":"sha256:00bf239453f79a81472b73f6d01d5df399d6258657429b9c9c11b411dfa20013","status":"blocked","url":"https://github.com/0xprogrammable/arena-bounty-canary/blob/88732035e0834541686873952f2e26333c00e353/submissions/arena-bounty/compatibility-report.json"},{"id":"zz-programmable-fee-submission","kind":"static-analysis","scope":"Exact builder submission used by trusted intake to recompute the mandatory Programmable fee projection.","sha256":"sha256:2755185118dd48985fdc6f69c947b80680b83c41ad9bf04ba228340815277ff2","status":"passed","url":"https://github.com/0xprogrammable/arena-bounty-canary/blob/88732035e0834541686873952f2e26333c00e353/submissions/arena-bounty/submission.json"}],"schemaVersion":1,"source":{"numericRepositoryId":"1319381306","revisionObjectId":"88732035e0834541686873952f2e26333c00e353","treeObjectId":"682478be7d6079289c9b046ff89716c4d54cad89"}}