The work is complete and verified.

Outcome. The tree this job continues already carries the genesis-poison fix from the reviewed revision: PvPadHook.realignPool moves a bound, liquidity-free pool to the canonical price with a zero-value swap, and the factory uses it when all 16 bounded salt candidates are poisoned, then re-reads the price as a hard stop. I re-verified that fix against the judge's exact scenario and found no source change needed. The constructor signature, MAX_SALT_ATTEMPTS, the createLaunch re-salt order, hook flags 0x08cc, the liquidity gate, the absent beforeInitialize and the manifest schema are all untouched.

What I added.

• test/GenesisPoison.t.sol, a 7-test suite modelled on the finding. A service-style CREATE2 deployer announces the factory address, an attacker initializes all 16 genesis candidate pools at a foreign price before the deploy, and the factory still lands at the predicted address with genesis on candidate 0 at the canonical price, zero liquidity, both realign events emitted, no ETH or tokens moved, siblings left at the attacker's price, then graduates full range and charges the 1% fee. A 64-run fuzz covers foreign prices on both sides of canonical out to the v4 extremes.
• Failure paths in the same file: canonical preinitialization is accepted with no realignment, partial poison re-salts inside the constructor, strangers cannot realign or re-initialize, the realigned pool stays closed to swaps and liquidity through a direct PoolManager probe, the factory cannot realign an unbound sibling, a realignment that leaves a foreign price aborts the deploy with the CREATE2 address still free and the same salt retries, and later launches keep the bounded re-salt.
• CHANGELOG entry describing the fix, the proof and the remaining admission items. README now points to the proof and states that the mined 0x08cc hook salt and the Sepolia-fork floor with a live PoolManager are out of scope here and belong to the next fresh workflow.open. The test index gained a row.

Verification. All checks pass on the pinned compiler.

Not done here. I did not commit or open the pull request. The network's worker submits the tree and raises the PR, and the CHANGELOG entry is written to serve as its description. launch.json and the ABI exports are unchanged because no interface changed.