Implement BatchAuction (src/BatchAuction.sol): sealed-bid, commit-reveal auctions of a fixed ERC-20 lot for ETH that clear at one uniform price, with tests and an independent review. Local only: do not deploy. Workspace: the job starts from an empty tree (no foundry.toml, forge-std or OpenZeppelin) and each worker may write only the listed src files and their test/.t.sol files, so no dependency can be added. Write everything inline (pragma ^0.8.24, default forge layout, no imports beyond these files); mocks and helper contracts live inside the test files, which declare the cheatcodes they use in an inline Vm interface at the HEVM address and assert with require.

Units: token amounts in the lot token's base units; prices in wei per 10^18 token base units; cost(amount, price) = ceil(amount × price / 10^18).

• createAuction(address token, uint256 supply, uint256 reservePrice, uint256 minDeposit, uint64 commitEnd, uint64 revealEnd): anyone, who becomes the seller; supply > 0, reservePrice > 0, block.timestamp < commitEnd < revealEnd; pulls supply (balance-diff check, fee-on-transfer reverts). Returns a sequential id.
• commit(id, bytes32 commitment) payable, strictly before commitEnd, msg.value ≥ minDeposit, one commitment per address per auction, at most 64 per auction (AuctionFull). commitment = keccak256(abi.encode(id, msg.sender, price, amount, salt)). msg.value is the deposit; it caps the bid, so it hides the bid only as far as the bidder over-deposits.
• reveal(id, price, amount, salt) from commitEnd until revealEnd inclusive: the hash must match and each commitment reveals once. The bid is valid only if price ≥ reservePrice, 0 < amount ≤ supply and deposit ≥ cost(amount, price); an invalid revealed bid wins nothing and its deposit is fully refundable.
• finalize(id) by anyone after revealEnd, once: sort valid bids by price, highest first (insertion sort; the 64 cap bounds gas), and allocate the supply down the list. The clearing price is the price of the lowest bid that receives tokens. Bids above it fill in full; bids at it share what is left pro rata to their amounts, each rounded down, and the leftover tokens go back to the seller; bids below it get nothing. If total valid demand ≤ supply, every valid bid fills in full at the lowest valid price and unsold tokens go back to the seller. With no valid bid, everything goes back to the seller.
• Money: each winner pays cost(filled, clearingPrice) from its deposit; the seller gets all those payments plus every deposit whose commitment was never revealed (forfeited); everything else is refunded. Nothing is pushed: claim(id) pays a bidder's tokens and ETH remainder once; sellerClaim(id) pays proceeds and returned tokens once; both after finalize. Effects before transfers and a reentrancy guard.
• Views auction(id), bidOf(id, bidder), clearingPrice(id); an event for every action. No owner or fee.

Tests: a two-way tie at the clearing price splitting the remainder; a three-way tie with uneven amounts (floor and dust to the seller); a single bid; an undersubscribed auction; every bid below reserve; an unrevealed bidder forfeiting; wrong salt, reveal outside the window and a second reveal reverting; the 64-commit cap and minDeposit; claims taken twice revert; ETH conservation (Σ deposits == seller proceeds + Σ refunds) and token conservation (supply == Σ filled + tokens returned) fuzzed over random bid sets.

Review focus: sort and tie arithmetic, dust, deposit-size leakage, griefing by filling the 64 slots (bounded by minDeposit and forfeiture), and finalize gas at 64 bids.