Implemented both contracts, vendored dependencies, ABI exports, and the factory-style launch rehearsal.

Verified:

• forge build
• forge test: 28 passed, including 2,048 invariant calls
• forge fmt --check
• ABI consistency

Deployment assumptions and responsibilities are documented in README.md. Final manifest price and factory parameters remain to be aligned with the documented rehearsal fixtures.

Created launch.json matching the constructor, five permissions, token metadata, and rehearsal pool price.

Schema validation and forge build passed. All 37 tests passed, including protected checks. Notes are 1,541 characters. Only launch.json is submitted.

The findings file is in place at the repository root and is excluded from git by the workspace's own exclude rule, so no tracked file changed. The scratch tests I used were under the gitignored test/scratch/ directory and have been deleted.

Verdict: no high or critical finding. The core math the assignment asked me to attack holds.

What I verified and how

• Rate formula and rounding. The rate at elapsed 0, 1, 500, 999 and 1000 is 5000, 4996, 2515, 35 and 30, matching the brief. The fuzz over all offsets confirms monotone decay and the floor. The block-zero edge is handled by the initialized flag.
• Exact-out formula. I proved algebraically that floor(poolInput × rate / (10000 − rate)) always equals floor(total × rate / 10000), so exact-out pays exactly the same effective share as exact-in. A fuzz over outputs from 1 wei to 100M SNIP at the 50% rate confirmed fee equals pool input and total equals twice the fee with no revert.
• Delta limits at 50%. Exact-in returns at most floor(amount / 2), so the amount left for the pool stays strictly negative and the vendored v4-core check for a hook delta exceeding the swap amount cannot fire. An exact-in buy of 2^127 − 1 wei succeeded with the fee exactly half and no int128 overflow. The exact-out path has no such check in v4-core, and the hook's own int128 guard covers the subtraction.
• afterInitialize. It is two storage writes behind the PoolManager check, has no gate, and cannot revert the factory. The beforeInitialize revert is unreachable because bit 13 is not in the mined address.
• Splitting. Loses at most one input unit of fee per swap in either mode. Not a practical dodge at 18 decimals.
• Semantics the hook relies on. I read the vendored Hooks.sol to confirm afterSwap receives the raw pool delta, the specified and unspecified deltas map to the currencies the hook assumes, and the hook-as-sender skip is unreachable since the hook never calls swap.
• ABI exports match the compiled ABIs for both contracts. The manifest's constructor argument, permissions, pool parameters and initial price match the source and the rehearsal fixture.

Findings written to .imd-findings.json, ranked

1. Low, design scope. The fee is dodged by providing liquidity next to spot. A SNIP holder placing a SNIP-only range just below spot was converted to 1.31 ETH by a taxed buyer while paying zero fee. A sniper placing an ETH-only range just above spot received about 1000 SNIP from a taxed seller for zero fee. Both reproduced in the launch block with exact call sequences. This cannot be fixed inside the approved permission mask, so it is a scope decision for the launch owner rather than a code change.
2. Info. Anyone can pre-initialise the exact pool key once the hook exists, if the token address is predictable, which makes the factory's initialise revert with PoolAlreadyInitialized. Reproduced against the rehearsal fixture. The mitigation belongs to deployment ordering, not the hook.
3. Info. Only the factory pool is protected. Other ETH/SNIP fee tiers on this hook get their own windows, hookless or non-ETH pools are untaxed. This matches the brief and is recorded because the assignment asked about it.

What I did not do. I did not inspect the real Sepolia factory's token-address derivation, so the precondition for finding 2 is stated as something the deployer must check. I did not edit any source, test or manifest file.

Implemented web/, dist/, deployment manifest, and documentation. Build, typecheck, unit tests, browser interactions, and hash checks passed. Complete snapshot bundle: 1.52 MB, below 8 MiB.

Validation report records the Universal Router substitution, scoped docs/DESIGN.md, and live sell-quote revert. No transactions were broadcast.

Commit blocked: .git is read-only. Deliverable files are ready for publisher capture.