Release Tranche (ERC-20 symbol TRNC) on Sepolia as an evm_project: the fixed-supply launch token plus one application contract.

Token: Tranche (TRNC), total supply 1,000,000,000 TRNC with 18 decimals, minted once to the deployer.

Application contract: MilestoneFund.

Currency: TRNC is the app's working currency. MilestoneFund's constructor takes one argument, the TRNC address (constructorArgs ["$token"]); it stores the token immutable, exposes it as token(), and holds no TRNC at deploy and never needs any: users get TRNC by swapping Sepolia ETH in the ETH/TRNC launch pool the factory seeds.

Every payment in is approve + SafeERC20.safeTransferFrom; payouts are pull withdrawals (safeTransfer to the caller, checks-effects-interactions, nonReentrant). TRNC is a plain fixed-supply ERC-20 with no transfer fee, so the amount pulled is the amount credited. MilestoneFund has no payable function and no receive/fallback, so it never holds ETH.

No owner, admin, pause or upgrade path. Raises are denominated in TRNC. open(bps1, bps2, bps3, fundingDuration): three milestone shares in basis points, each >= 1 and summing to exactly 10,000; fundingDuration 1 to 90 days; the caller is the creator. deposit(raiseId, amount): amount > 0, only before the funding deadline, never by the creator; the backer gets shares equal to amount.

Tranches start after the deadline and release strictly in order. approveTranche(raiseId) (named so it is never confused with the ERC-20 approve): a backer approves the next unreleased tranche with weight = their shares (once per backer per tranche; approvals never carry to the next tranche).

Each tranche's vote opens at the funding deadline (tranche 1) or at the previous release. release(raiseId): anyone, once approval weight x 2 > total shares and at least 3 days after that tranche's vote opened (a grace period in which dissenting backers can rage-quit before any release); amount = unreleased x bps_i / remainingBps (floor), where remainingBps is the sum of the unreleased tranches' bps, and the last tranche takes all that is left, so no dust stays; it is credited to the creator, who withdraws it (pull). rageQuit(raiseId): before the deadline returns the full deposit; after it pays shares x unreleased / totalShares (floor), and the last backer out takes the whole remainder; the backer's shares and any approval on the current tranche are removed.

A raise with no deposits, or whose backers all quit, simply ends; nothing is stranded. Known limit to document: an actor holding more than 50% of shares through other wallets (including the creator) can release tranches, but never faster than one tranche per 3 days, so other backers can always rage-quit with their pro-rata share first.

Views: raiseCount(), raise(id), sharesOf(id, backer), approvalWeight(id), unreleased(id), creatorBalance(creator).

Events: Opened, Deposited, TrancheApproved, Released, RageQuit, Withdrawn. Tests (Foundry) must cover: the invariants TRNC balance == sum of unreleased over all raises + sum of creator balances and released + rage-quit payouts <= deposits, and unreleased == 0 after the last release or last quit (fuzz bps splits, deposit sizes and quit order); the 50% boundary (exactly half does not release); and the 3-day grace boundary (release at vote-open + 3 days - 1 s reverts).

The independent adversarial review must attack: approval weight double counting across rage-quit, release ordering and rounding, the last-tranche and last-quitter remainders, creator self-dealing (a sybil majority releasing tranches back to back), and any path that pays out more TRNC than was deposited.

Deploy through the project factory, then publish a one-page website to open a raise, back it (ERC-20 approve, then deposit), approveTranche and release, rage-quit, and let the creator withdraw, listing raises with progress. The page reads the TRNC address from MilestoneFund.token(), shows the connected wallet's TRNC balance and allowance, has an Approve step before every paying action, and says TRNC comes from swapping Sepolia ETH in the launch pool (no in-page swap).

Lists come from contract views and events only (no backend, no indexer; log queries are chunked from the deployment block). Keep it to one small page; the static export has index.html in dist/.