Follow-up tracker for the live-stack items deferred from #65 source closure on Monday 2026-04-27. ## Background #65 closed today on source + selective live verification: - forge test --match-contract TimeCurveBuyRouterTest: 3/3 passing (test_buyViaKumbaya_stable_creditsAlice, test_buyViaKumbaya_eth_creditsAlice, test_buyFor_revertsWhenRouterUnset) - forge: 191/191 full suite passing - Live cast confirmed AC2 default state and AC4 unauthorized-call revert on the default stack - AnvilKumbayaFixture.sol L109 documents walk-from-CL8Y-output direction for multi-hop exactOutput (AC3) - TimeCurve.sol L344 _buyForExternal gate: require(msg.sender == timeCurveBuyRouter && timeCurveBuyRouter != address(0), 'TimeCurve: not buy router') ## Scope (deferred) The default scripts/start-local-anvil-stack.sh and contracts/script/anvil_rich_state.sh do NOT call DeployKumbayaAnvilFixtures, so timeCurveBuyRouter remains 0 on a fresh stack. The router-set verification items need that fixtures script run separately. - [ ] Run DeployKumbayaAnvilFixtures: confirm console logs TimeCurveBuyRouter address (KUMBAYA_BUY_ROUTER per anvil_deploy_dev.sh L13/L59) - [ ] cast call timeCurveBuyRouter() on TimeCurve proxy returns the deployed router address (not zero) - [ ] Live USDM two-hop quoteExactOutput sanity: quote for CL8Y←WETH←USDM matches actual exactOutput execution within rounding - [ ] Live buyViaKumbaya tx via the deployed router: produces Buy event with correct buyer attribution (msg.sender=router, but Buy.buyer=participant) - [ ] Owner setTimeCurveBuyRouter(address(0)) live: subsequent buyFor reverts with 'TimeCurve: not buy router' even from previously-set router address (re-disable path) - [ ] Confirm Buy event flagPlanted field correctly mirrors plantWarBowFlag arg passed through buyFor → _buy ## Pre-conditions - Live Anvil stack on 1bdbda8+ - DeployKumbayaAnvilFixtures executed (manual until / unless folded into start-local-anvil-stack.sh) - Wallet for participant txs ## Acceptance All 6 rows produce evidence (cast output, tx hash, or event receipt screenshot) and either PASS or have a filed sub-issue. cc @PlasticDigits