Approved workflow

Release Sponsor (ERC-20 symbol SPON) on Sepolia as an evm_project: the fixed-supply launch token plus one application contract. Token: Sponsor (SPON), total supply 1,000,000,000 SPON with 18 decimals, minted once to the deployer. Application contract: DaemonSponsorPool. Currency: SPON is the app's working currency. DaemonSponsorPool's constructor takes one argument, the SPON address (constructorArgs ["$token"]); it stores the token immutable, exposes it as token(), and holds no SPON at deploy and never needs any: users get SPON by swapping Sepolia ETH in the ETH/SPON launch pool the factory seeds. Every payment in is approve + SafeERC20.safeTransferFrom; payouts are pull withdrawals (safeTransfer to the caller, checks-effects-interactions, nonReentrant); burns are transfers to 0x000000000000000000000000000000000000dEaD. SPON is a plain fixed-supply ERC-20 with no transfer fee, so the amount pulled is the amount credited. DaemonSponsorPool has no payable function and no receive/fallback, so it never holds ETH. No owner, admin, pause or upgrade path. A Sepolia test toy modelled on worker daemons; it is not connected to any real IMD payment. Epochs are 24 hours from the deployment timestamp: epoch = (block.timestamp - genesis) / 1 days. Workers: register() pulls a 100,000 SPON bond; deregister() stops future check-ins and the bond becomes withdrawable (withdrawBond) once the epoch in which deregister was called has ended; after withdrawing it the address may register again. Sponsors: sponsor(amount) pulls SPON into the pool; sponsorship is a gift and cannot be withdrawn. checkIn(): a registered worker, once per epoch. Budgets: every state-changing call first rolls the epoch: if the current epoch has no budget yet, it finalises the last epoch that had one (if nobody checked in there its whole budget returns to the pool; otherwise the division dust budget - share x checkIns returns), then sets budget[current] = pool / 7 (floor) and moves it out of the pool. Epochs nobody touched get no budget, so an idle gap loses nothing. claim(epoch): a worker who checked in to a past epoch withdraws share = budget / checkIns (floor), once (pull). Sybil workers need a bond each, so payouts are bond-weighted at best; document that. Views: currentEpoch(), epochInfo(e) (budget, checkIns, finalised), pool(), isRegistered(w), checkedIn(e, w), claimable(e, w). Events: Registered, Deregistered, BondWithdrawn, Sponsored, CheckedIn, EpochRolled(e, budget), Claimed. Tests (Foundry) must show: the 24-hour boundary, an epoch with zero check-ins returning its budget, dust returning, an idle multi-day gap, double check-in and double claim reverting, claims only for past epochs, bond withdrawal timing, and the invariant SPON balance == pool + unclaimed budgets + bonds. The independent adversarial review must attack: budget snapshot timing (sponsoring or checking in first to move the budget), roll ordering bugs, double payment, bond escape before the epoch ends, and SPON left unclaimable. Deploy through the project factory, then publish a one-page website to register (approve bond), check in, sponsor, show the current epoch with countdown, budget and check-ins, list past epochs with your claimable share and a claim button, and deregister/withdraw the bond. The page reads the SPON address from DaemonSponsorPool.token(), shows the connected wallet's SPON balance and allowance, has an Approve step before every paying action, and says SPON comes from swapping Sepolia ETH in the launch pool (no in-page swap). Lists come from contract views and events only (no backend, no indexer; log queries are chunked from the deployment block). Keep it to one small page; the static export has index.html in dist/.

Sepolia (11155111) only. GitHub publication and IPFS hosting are approved. Launch token: a separate fixed-supply ERC-20, 18 decimals, no constructor arguments, exactly 1,000,000,000 minted to msg.sender, no mint or admin functions. The factory sends that supply to LP and rewards, so no application contract may need a launch-token balance at deploy. Application contracts are fully configured in nonpayable constructors using only address, uint, bool or bytes32 arguments (no strings, arrays, proxies, delegatecall or selfdestruct); anything else is set at runtime. No owner unless the request names one, and then it is $owner. No external oracles, VRF or keepers: randomness is commit-reveal or a future blockhash read within 256 blocks with a refund path. foundry.toml sets bytecode_hash = "none". The website is a static export with index.html in dist/. Site label lab-daemon-sponsor.

Build SPON and DaemonSponsorPool (SPON bonds, sponsorship pool and per-epoch payouts, constructorArgs ["$token"]) with Foundry tests and an independent adversarial review, deploy them through the project factory, then build the website against the live deployment.

Register/check-in/sponsor with approve, epoch countdown and budget, past-epoch claims, bond withdraw.