Approved workflow

Implemented THRW, FeeSplitHook, ABI exports, vendored dependencies, and factory-style launch tests.

Validation passed with Solidity 0.8.26:

• forge build
• forge test: 27 passed, including 8,192 invariant actions
• forge fmt --check

README documents deployment responsibilities, the assumed rehearsal price, JIT donation behavior, and unsolicited-claim surplus limitations.

Done. The suite now runs 41 tests across 8 suites, all passing, with forge fmt --check clean and only three new files under test/.

What I added

• test/helpers/RehearsalTestBase.sol: a shared factory-style rehearsal. It mines the 0x00CC salt, launches through the existing factory harness at the proposed manifest price with the one-sided THRW seed, and opens a second native-ETH pool with an unrelated token on the same hook so cross-pool accounting is observable. It also carries an independent re-implementation of the split and identity rules used as the oracle.
• test/LaunchRehearsalFuzz.t.sol, 12 tests, each verifying against the real PoolManager:
  • Shares sum to the fee for fuzzed sizes in all four modes on both pools, with per-bucket, per-pool, lifetime and event deltas checked, plus a direct-callback fuzz that covers the whole int128 domain for both the specified and unspecified fee paths and confirms off-by-one fills revert with PartialFill.
  • A missing or malformed interface identity (empty, 31 or 33 bytes, zero address, dirty high bits, packed, too long) moves exactly the interface share to the burn, and never credits the zero address, router, or swapper.
  • donateAccrued raises ETH fee growth by exactly amount * 2^128 / liquidity, only in-range positions see it, the in-range LP collects it to within one wei of rounding, and the out-of-range LP collects nothing.
  • Zero liquidity: the donation reverts with the pool's error, every bucket and claim survives, the payout lock is released so burn and claim still work, and the same bucket pays once liquidity returns. An empty bucket on the ETH-less pool is a silent no-op.
  • A realistic launch scenario: holders selling everything back park the price on the seed's upper tick with no active liquidity, stranding the LP bucket until the next buy re-enters the range, after which the whole bucket pays at once.
  • Burn and claim empty exactly their own buckets across both pools and touch nothing else, including the no-event path for zero balances.
  • Adversarial: an interface recipient that swaps directly against the unlocked manager while its claim is being paid. Accounting stays exact and the nested credit lands in the new epoch.
• test/LaunchRehearsalInvariant.t.sol: a second campaign over the launch pool and the other pool. The handler can also remove all liquidity from the second pool, open and close a JIT position in the launch pool, and request fills the pool cannot give. Reverts are classified: a swap may only fail as a complete PartialFill rollback and a donation only for lack of liquidity with its bucket intact. Invariants check that ETH claims equal every outstanding bucket, the manager holds the ETH behind them, and the hook custodies nothing else. A scratch run confirmed partial fills and blocked donations actually occur inside campaigns.

Defects found: none. Everything I probed, including rounding closure, epoch handling after payouts, cross-pool isolation, nested trading during a payout, and the stranded-bucket case, behaved as the workflow specifies, so I wrote no findings file.

One assumption to know about: the sell-back test uses deal for about 0.3% extra THRW, standing in for a later holder, because a single buyer is always short by the pool's own LP fee when returning the price to the seed's upper tick.

Done. I wrote launch.json for the Threeway (THRW) FeeSplitHook launch, and it is the only file changed outside the scratch directory.

What the manifest declares

• The first field is "kind": "univ4_hook".
• Hook contract FeeSplitHook with one constructor argument, the Sepolia PoolManager address from the workflow and LaunchParameters.
• Permissions beforeSwap, afterSwap, beforeSwapReturnDelta and afterSwapReturnDelta, exactly the four that getHookPermissions returns true.
• Token contract THRW, name Threeway, symbol THRW, 18 decimals, matching the source constructor.
• Pool paired with native ETH (zero address), LP fee 3000, tick spacing 60, initialPrice 2505414483750479311864138015696063 as decimal sqrtPriceX96. That equals floor(sqrt(1e9) × 2^96) and is the value the rehearsal factory initializes with.
• Notes of 3777 characters describing the fee mechanics, split, payouts, pool and toolchain. They contain no supply, allocation or ownership fields.

Verification

• A scratch script validated the file against the canonical schema with jsonschema, confirmed the refinements, and confirmed the notes length is under the cap.
• A scratch Foundry test deployed the hook at a mined address and asserted the four declared permissions, the ten undeclared ones, the 0x00CC flag bits, the price and pool constants, and the token name, symbol and decimals. It passed.
• forge build succeeded and forge test passed all 41 tests in the existing suite.

Git status shows only launch.json as new. The scratch files live in test/scratch and are discarded before submission.

Review complete. No exploitable defect found in the accepted implementation. Findings are written to .imd-findings.json, no other file touched.

Result: one low, two info, nothing blocking.

• Low, documented design property. Just-in-time liquidity captures the LP bucket. A scratch test on the accepted tree measured it on the rehearsal launch pool after a 1 ETH first buy. A 60-tick position with nine times the seed's liquidity costs about 0.045 ETH plus 2.15M THRW and takes 89.99% of the 0.003 ETH bucket in one transaction of add, donateAccrued, remove. Ninety-nine times the seed liquidity costs 0.5 ETH and takes 98.99%. The same shape sandwiches any donateAccrued seen in the mempool. README, launch.json notes, PayoutSafety and the rehearsal invariant all already state and exercise it, and any mitigation would change the approved permission bits or mechanism, so this is recorded with the cost figures rather than requested as a change.
• Info. An identity that can never be msg.sender of claim, such as the hook itself or the PoolManager, leaves its 20% share as ERC-6909 claims forever. Only the nominating swapper's own share is affected and the claims invariant still holds.
• Info. Exact-out sells are charged on the net ETH received and exact-in sells on the gross ETH moved, so the same gross leg pays about 1% less fee in exact-out. This is exactly the workflow's formula and the README table documents it.

What I attacked and found correct. Split closure: burn share is the remainder, so the three shares sum to the fee in every mode, including dust and the full int128 domain, and a missing identity routes its share to burn. Settlement order: fees are minted as claims inside the swap and offset by the return delta, so the hook's delta nets to zero; each payout burns claims first and then takes or donates inside the hook's own unlock, and a no-liquidity donate reverts atomically with the bucket intact. Claim reentrancy: balances are zeroed and the epoch bumped before unlock, the payout lock blocks nested claim, burn and donate, a nested unlock hits AlreadyUnlocked, and a recipient trading against the manager during its own payout leaves claims equal to liabilities. Cross-pool: LP and burn buckets are keyed by the full PoolId, donateAccrued rejects foreign hooks and non-ETH keys, and a same-currency key with a different fee sees an empty bucket. Partial fills in all four modes roll back the whole swap including minted claims.

Also verified. Build, all 41 tests, and forge fmt pass offline. The exported ABIs match the compiled artifacts byte for byte. The manifest constructor argument, permissions and initial price equal floor(sqrt(1e9)·2^96) match the source and rehearsal parameters, and the seed range upper tick sits below the launch tick so the seed is truly one-sided.

Implemented frontend, static export, and deployment manifest.

Build/typecheck, 6 unit tests, 32 browser checks, and live reads passed. No transactions broadcast. Bundle rehearsal: 1.78 MB.

Validation and limitations

Commit blocked by read-only Git metadata. Design documentation is at docs/DESIGN.md to respect the allowed paths.