Committed as 74a0b6e on main, working tree clean. The deliverable is complete.

What was built

• src/TollToken.sol: self-contained ERC-20, zero-argument constructor, mints exactly 1e27 to msg.sender, 18 decimals, burn/burnFrom, no owner, mint, pause or proxy, no imports.
• src/TollgateHook.sol: flags 0x00CC only, PoolManager address as the sole constructor argument, constants exactly as specified. Fee is always ETH: exact-in buy and exact-out sell take it in beforeSwap as a positive specified delta, the other two directions in afterSwap as a positive unspecified delta. Collection is poolManager.mint(hook, 0, fee) inside the swap, so the first buy into an ETH-less pool works. PartialFill guards the raw delta. Non-ETH pools trade fee-free. Lazy ledger, CapReached once, permissionless payCreator() and burnEth() each in their own unlock, reentrancy lock on transient slot 1.
• src/HookFlags.sol and test/mocks/MockERC20.sol at the paths the protected suite imports.
• lib/: v4-core 1.0.2 (from the npm tarball, src/test excluded), forge-std v1.9.7, solmate Owned, all plain files, no submodules.
• Docs: README.md, docs/DISCLOSURE.md, docs/deployment.md, docs/dependencies.md, and launch.json whose notes disclose CREATOR, the 1 ETH cap, the 2%/2% fee and the burn sink in 3,981 characters.

Verification results

Two judgment calls to be aware of

• The constructor rejects only the zero address, not a code-less manager. The protected suite may deploy the hook before any code exists at the literal, and a code check there would have failed the entire floor in setUp. The fork rehearsal is where a wrong literal gets caught, and docs/deployment.md says so.
• launch.json names the Ethereum mainnet PoolManager since no chain was specified. The notes and deployment doc explain that retargeting only requires substituting the canonical PoolManager and re-mining the salt.

Fees under 50 wei of ETH round to zero and trade fee-free. This is documented in the disclosure rather than reverted, since it charges nothing extra and keeps dust swaps working.

The manifest is rewritten, validated, and committed. Only launch.json changed.

What was wrong. The previous launch.json carried fields the schema rejects at every level: name, chainId, hook.source, hook.flags and token.source. Because the schema sets additionalProperties: false, the whole manifest would have failed to parse. Its notes were also within 19 characters of the cap.

What the new manifest says. It keeps "kind": "univ4_hook" as the first field and uses only schema fields.

• Hook TollgateHook, one constructor argument, the literal canonical mainnet PoolManager address, and the four permissions beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta.
• Token TollToken, name TOLLGATE, symbol TOLL, 18 decimals.
• Pool paired with native ETH at the zero address, static LP fee 3000, tick spacing 60, initialPrice 79228162514264337593543950336000, which is sqrt(1e6) times 2^96, so 1 ETH opens at 1,000,000 TOLL as in test/LaunchRehearsal.t.sol.
• Notes disclose the 2% ETH fee, the fixed creator wallet, the 1 ETH lifetime cap, the permissionless payout and burn, the burn sink, immutability, the mechanics, the ledger invariant, and the review points. They give no supply figure and no basis-point figure, and they now state that supply, allocations, chain and policy are not manifest fields.

Checks run.

The commit is cc1d807 on top of the accepted work. Scratch files under test/scratch were left in place, since they are discarded before submission.

Wrote .imd-findings.json containing {"findings":[]}.

No substantiated defects found:

• No path pays CREATOR over 1 ETH or changes fees, recipients, or sink. Required disclosures are present.
• No third-party payout griefing, successful reentrancy, or unauthorized extraction found. CREATOR rejecting ETH blocks its own payout; burns remain available.
• All four swap modes match the documented 2% calculation and rounding. Exact-output price limits cannot bypass fees; partial fills revert without changing the ledger.

Seven temporary adversarial checks passed offline, including 1,000 fuzz cases. The opcode scan passed. Implementation and repository tests remain unchanged.