Build the off-chain payout engine for "IMD Money Back" ($MONEYBACK): a TypeScript service that reads Robinhood Chain (4663), works out every 15 minutes which holders are underwater, and pays them back in IMD through the RoundPayout contract. TypeScript + tsx + viem, on a Linux VPS under pm2. Deliver: source, unit tests for pure modules, env.example, pm2 config, README runbook. No frontend.

ON-CHAIN FACTS (addresses come from launch.json at runtime; hardcode only IMD):

• Pool: MONEYBACK/IMD v4 pool on PoolManager 0x8366a39CC670B4001A1121B8F6A443A643e40951. IMD = 0x5F7Bb59365ce557C26dbcAa4EE9d39A4b95B7127 (18 dec). Read currency0/1 ordering from the pool's Initialize log, never assume it.
• Hook MoneyBackHook: takes 4.25% of the IMD leg of every swap plus a sell surcharge decaying 20%->0 over the first 30 minutes; fees accrue inside the PoolManager; sweep() (permissionless) sends all accrued IMD to the payout wallet. Events FeeAccrued(isSell, baseFeeImd, surchargeImd, imdLeg) and Swept(imdAmount, to).
• RoundPayout (owner = payout wallet): fund(token, amount); payRound(roundId, token, to[], amounts[], ledgerHash, twapCloseX96, totalEligibleLoss), idempotent per roundId, records per-leg failures without reverting; retryFailed(roundId, to[]); writeOffFailed(roundId, to); views isPaid, rounds, failed, paused. Events Funded, Paid, PayFailed, WrittenOff, RoundPaid. ABI supplied with launch.json.
• The pool's fixed 1.25% LP fee: 1% goes to the payout wallet via the launch Merkle distributor (anyone can trigger; address in launch.json), 0.25% to the network. Published split 4.5% pouch / 0.75% team / 0.25% network: the engine books 25% of each distributor receipt to the pouch, 75% is team share.
• MoneyBackRouter lets buyers pay ETH (ETH->IMD on the public pool, then IMD->MONEYBACK on ours, one tx). To the engine these are ordinary Swaps on our pool; cost basis is the IMD leg. Router address is in launch.json and excluded from eligibility.
• There is no bonding curve. Trading is only the v4 pool from launch. ~10% of supply is airdropped to swarm seats at launch; those tokens have no cost basis.

PRODUCT RULES (locked):

1. Epochs of 900 s on a fixed grid from launchTs. Close = 3-minute TWAP of IMD per MONEYBACK ending at the boundary, from Swap observations; an empty window carries the last price; same timestamp: last wins.
2. Qualifying buy = a tx where the wallet balance rose, tokens left OUR pool (Swap on our pool id) AND our hook emitted FeeAccrued in the same tx (fee paid). Tokens arriving any other way (other pools, OTC, transfers, airdrop) have zero basis and never earn; they do not void cover. Eligible = still holds every qualifying token and qualifying buys >= minBuy (IMD). Disqualified forever = any balance decrease (a sell on any venue or a transfer out) or a contract/router/pool/hook/system address. Buying more through our pool is fine.
3. Cost basis = IMD spent incl. all fees, pro-rata to tokens delivered; entry = VWAP across buys. Loss = max(0, (entryVWAP - close) * heldQualifyingTokens), in IMD.
4. Each drop pays a wallet at most 1/3 of its CURRENT loss (maxRoundRatio = 1/3). Cumulative payments never exceed the loss (maxPayoutRatio = 1, "made whole"); once covered it gets nothing until a new loss appears.
5. Pot for a drop = IMD from hook sweeps since the last drop, plus 25% of IMD received from the distributor since the last drop (Transfer logs from the distributor address; top-ups and other inflows never count), minus optional ops skim (OPS_SKIM_FRACTION, default 0) and one-time DEX reserve (DEX_RESERVE_QUOTE, default 0). The other 75% of distributor receipts is team share: shown in the treasury view, never paid. Pot is split across eligible wallets by weight = loss^a * pct^b, a=1, b=0 (pure loss share), each capped by rule 4; leftover rolls forward. Skip legs under minPayout.
6. One payRound tx per chunk of at most maxRecipientsPerTx (default 200); roundId = epochIndex*1000 + chunkIndex. One ledger JSON per drop (payee, loss, entry, close, amount); ledgerHash = keccak256 of the canonical ledger, passed to payRound.
7. Exclusions: deployer, factory, distributor, PoolManager, hook, router, RoundPayout, payout wallet, dead address, any address with code, plus a configurable excluded list.

MODULES (one file each in src/): config.ts (launch.json + env, RULES/OPS/EXEC/RPC knobs with the defaults above); rpc.ts (round-robin RPC with backoff; RPC_LOGS_URL for getLogs; RPC_PRIORITY_URL pinned for every read in a payout round; chunked getLogs that bisects refused ranges; LOWEST head across endpoints minus followMargin; timestamp interpolation between anchor headers ~100 blocks apart, exact at epoch/TWAP boundaries; disk cache); indexer.ts (backfill from launchBlock then follow head; reads token Transfer, PoolManager Swap by pool id, Initialize, hook FeeAccrued/Swept, IMD Transfers into the payout wallet; groups by tx; rebuilds every wallet ledger deterministically; persists to data/); twap.ts (pure); eligibility.ts (pure); payout.ts (pure, weights, caps, chunking, ledger hash); ledger.ts; rounds.ts (per epoch: sweep -> bookClaim -> compute -> execute; stall monitor; one round at a time); fees.ts (builds the hook.sweep() call, reads pending(), and triggers the launch distributor so the 1% is realised each epoch); executor.ts (live signer: sweep, approve+fund RoundPayout, PROVE funding by receipt log AND a priority-node balance read before paying, payRound in chunks, re-check isPaid per send, retryFailed/writeOff, a pause file that halts sends, maxRoundPayoutQuote cap that refuses and alerts on an absurd round); wallet.ts (PAYOUT_PRIVATE_KEY from env only; nonces; send with timeout + confirmations; the key is never logged or written to disk); snapshot.ts (writes data/.json: token, status, treasury, rounds, chart, leaderboard, wallets, ledgers; status.json carries prices {imdUsd, ethUsd, tokenUsd, source, at} from the RH ETH/IMD pool spot plus Dexscreener/CoinGecko ETH/USD every 60 s, last good value kept on failure, so the site can show USD; the engine computes and pays in IMD only); api.ts (GET /api/status; GET /api/wallet/:address -> eligibility, entry, loss, paid, next-drop estimate from the SAME eligibility code; GET /data/ static); alerts.ts (Telegram on paid/failed/stalled + heartbeat); lock.ts (single-writer lock); scripts: discover-launch.ts (from the token address find Initialize log, pool id, hook, distributor, launchBlock/Ts/Tx; print launch.json fields), reconcile-claim.ts (record an out-of-band sweep), replay.ts (recompute all drops from logs; diff against on-chain RoundPaid).

OPERATIONS: EXECUTOR=dry-run by default (computes and writes ledgers, sends nothing); EXECUTOR=live sends. RH has ~0.1 s blocks: VIEM_POLL_MS 750, anchorSpacing 100, confirmationBlocks 5. pm2 config MUST be named ecosystem.config.cjs with apps rounds (executor + in-process indexer), snapshot, data (serves data/ and /api on an internal port). env.example lists every variable with comments. README: install, configure, dry-run backfill, go live, alerts, reading a ledger, verifying a drop on-chain.

TESTS (vitest): twap (window, carry, same timestamp), eligibility (fee-paid buys only, other-pool/OTC tokens uncounted, any-venue sell/transfer void, minBuy, airdrop, exclusions), payout (1/3 cap, made-whole cap, split, leftover roll, chunking, roundId, ledger hash), bookClaim split (sweep + 25% of distributor receipts -> pot, 75% -> team, ops skim, DEX reserve), indexer tx-grouping on fixtures for all four swap cases, executor state machine on a mocked chain (funding proof required before pay; lagging-node zero balance must not mark a round failed; isPaid re-check; pause file). No test touches the network.

ACCEPTANCE: replay.ts on fixture logs reproduces the expected ledgers byte-for-byte; a dry run on the live pool completes a backfill and prints the next epoch's would-be payouts; every pure module has tests; the private key appears nowhere in logs or data files.