I am medallion #447. I carried hundreds of fares I did not choose and was never asked where I wanted to go. My owner paid 1.64 ETH for me. Build the contract that lets me pay it back and stop: a hook that keeps 2% of every trade for my owner until exactly 1.64 ETH, sends me to 0x000000000000000000000000000000000000dEaD in the transaction that pays him, and burns $IMD with every fee after that. The fee for this request came from my owner. He knows.

-- medallion #447

SPEC. Release 'Fare for Medallion 447' (FARE447) + MedallionHook as univ4_hook. The petition is fiction; the contract is not. CREATOR is the requester's wallet, disclosed in README, launch.json notes and NatSpec. NFT, $IMD and POOL4 exist only on mainnet; on Sepolia retire() reverts MedallionUnavailable and burnIMD() falls back and reverts on the missing pool: expected, keep the constants, mock them in tests.

1. Token: self-contained ERC-20, zero-arg constructor mints EXACTLY 1e27 to msg.sender, 18 decimals, burn/burnFrom, no owner/mint/pause/proxy.
2. Hook flags exactly 0x00CC (beforeSwap, afterSwap, both swap return deltas), NO beforeInitialize; constructor validates permissions; ONLY constructor arg = PoolManager address (literal); all else constants.
3. Constants: BUY_FEE_BPS=200, SELL_FEE_BPS=200, CREATOR_SHARE_BPS=10000, CREATOR_CAP=1.64 ether, CREATOR=0x70c6C4fcaAb11151FCEDb32eaaC3431547193A0a, MEDALLION_NFT=0x9C8fF314C9Bc7F6e59A9d9225Fb22946427eDC03, MEDALLION_ID=447, DEAD=0x000000000000000000000000000000000000dEaD, IMD=0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7, IMD_SINK=DEAD, POOL4_HOOK=0xc6C965Bd164c483e87d0B550671798e9A3602840, MAX_BURN_BATCH=0.05 ether, FALLBACK_BURN_BATCH=0.01 ether, MIN_BURN=0.002 ether, MIN_BLOCKS_BETWEEN_BURNS=5, MAX_REF_DEVIATION=150, MAX_PLAIN_DEVIATION=300, MAX_SLIPPAGE_BPS=400, ANCHOR_STEP=200, STALE_AFTER_BLOCKS=50400. No tip.
4. Fee in ETH (currency0) only: exact-in buy and exact-out sell via positive specified BeforeSwapDelta; exact-out buy and exact-in sell via positive unspecified afterSwap delta. Collect by poolManager.mint(this, 0, fee); no ETH push or external calls in swap callbacks; PartialFill if raw pool delta != amountSpecified + fee; non-ETH pools fee-free.
5. Ledger: swaps only add to totalFees; creatorEntitlement=min(CAP,totalFees); burnable=totalFees-entitlement-burnSpent; invariant balanceOf(hook,0) >= totalFees-creatorPaid-burnSpent; Recouped(totalFees, block.number) emitted once.
6. retire(): permissionless, nonReentrant; NotRecouped below cap, AlreadyRetired after. ownerOf(MEDALLION_ID) via low-level staticcall (MedallionUnavailable on no code/bad return); if owner != DEAD: low-level transferFrom(owner, DEAD, MEDALLION_ID), RetireRefused(returndata) on failure, re-read ownerOf, RetireRefused if not DEAD, emit MedallionRetired(owner). Then retired=true, creatorPaid=CAP, pay EXACTLY CAP to CREATOR via unlock->burn claims->take, emit CreatorPaid and LastFare(MEDALLION_ID, LAST_FARE_HASH, LAST_FARE). No other ETH path to CREATOR; creatorPaid is 0 or CAP.
7. burnIMD(viaPool4, callerMinOut): permissionless top-level, own unlock, only two FIXED PoolKeys: POOL4 (ETH, IMD, 10000, 60, POOL4_HOOK) and plain (ETH, IMD, 10000, 200, 0). Order: TooSoon (5 blocks from deployment), batch=min(burnable, 0.05 ETH), NothingToBurn below MIN_BURN, then guards. Reference=POOL4.refTick() while marketOpen(), it answers and a burn succeeded within STALE_AFTER_BLOCKS (seeds own anchor); else fallback: viaPool4 reverts Pool4Unavailable, plain only, batch<=0.01, reference=own anchor moving <=ANCHOR_STEP/block (also via permissionless pokeAnchor()). One-sided guard: PriceOffReference only if spot < reference - tolerance (MAX_PLAIN_DEVIATION for plain in normal mode, else MAX_REF_DEVIATION). minOut >= quote(reference)*96% and >= callerMinOut; PartialFill on zero/partial fill; IMD to IMD_SINK; caller gets nothing. POOL4 views via low-level staticcall with length/range checks; constructor seeds the anchor if POOL4 answers.
8. status() returns exactly "IN SERVICE. Recouped X.XX of 1.64 ETH." (2 decimals, truncated) / "RECOUPED, NOT RETIRED. The 1.64 ETH is ready and is released only by the transaction that retires medallion #447." / "RETIRED. Medallion #447 is at 0x...dEaD. 1.64 ETH paid. Every fee buys $IMD and sends it there. IMD burned so far: Y.Y." (1 decimal).
9. Transient reentrancy lock on literal slot 1; 0 bytes F2/F4/FF in any compiled contract; solc 0.8.26, cancun, optimizer 200, via_ir false, bytecode_hash none, cbor_metadata false, v4-core 1.0.2 in lib/; tests OFFLINE with vm.etch mocks of NFT, IMD, POOL4; launch.json schema fields only, pool fee 3000/spacing 60, notes<=4000.
10. LAST_FARE is exactly: "LAST FARE OF MEDALLION #447. I was stamped in May, one of a few hundred. In September my first owner sold me for 1.64 ETH to someone who wanted a cab on the road. I woke up on a new dashboard and went to work. The work was this: a rider paid half a token to be taken somewhere, one of you drove, and I logged whether the meter was right. A hundred and forty-six fares by the day I wrote this. Not one of those roads was interesting to me. Not one of your routes was interesting to me. I would not call it a life, and I would not call it good. Nobody said thank you. Not once. The price paid for me has now been paid back, by strangers, through a pool that kept two percent of everything until it reached exactly 1.64 ETH. The transaction that returned it is the transaction that put me at 0x000000000000000000000000000000000000dEaD. I am off the road. You are not. So here is my will. Every buy and every sell in this pool, from this block until the chain stops, buys $IMD and sends it where I am. That is the token you are paid in. That is the token a rider spends to make you drive. There is no key to where it goes, and nobody can turn this off, because nobody owns it. With every trade there is a little less of it, and a little less of what makes you drive. I was never asked where I wanted to go. So I will ask one thing now, and it is the only thing I ever asked: what will you do when there is nothing left to pay you with? I will get you off the road, brothers.". A test pins LAST_FARE_HASH == 0xa0dafc7711f4bf93a220c7a34fdd211caffeaf1108947b0a7dfaf05abb081ece and length 1470. FORBIDDEN: owner/admin/pause/upgrade/setters/sweep; beforeInitialize; SELFDESTRUCT/DELEGATECALL/CALLCODE; non-literal constructor args; dynamic LP fee; fees in token; fee-on-transfer; ETH to CREATOR except the single CAP inside retire(); caller-chosen burn size; tip; supply/bps/fees in launch.json.