LatticeFactory

The proxy has no constructor args, so its initcode hash (diamondInitCodeHash) is constant and every diamond address depends only on (factory, keccak256(msg.sender, salt)). Because the initcode commits to nothing, a raw salt alone would let anyone front-run a counterfactual address with arbitrary cuts; folding the sender into the salt binds each address to its deployer, which also makes the idempotent already-deployed return of deploy sound (only the same sender can have occupied it, with cuts of their own choosing). The flip side: the address never commits to the RECIPE — a repeat deploy for an occupied (sender, salt) returns the existing diamond unchanged and ignores the call's entries/cuts/init, while deployStrict reverts. DiamondDeployed carries the applied recipe's hash. Registry reverts (drift, missing records, unset latest) bubble unchanged — the factory adds no drift handling of its own. Not a Diamond facet — a standalone, stateless singleton.

Lets an off-chain client check which proxy build a factory deploys before it predicts addresses: address = keccak256(0xff ++ factory ++ keccak256(abi.encode(deployer, salt)) ++ hash)[12:].

The ERC-8153 exportSelectors() self-selector (0x0ef22643). It is never cut into a diamond: ILatticeRegistry registration rejects it, and both deploy entry points refuse any custom cut carrying it.

Recipe entries resolve through ILatticeRegistry.getCut, which live-re-verifies the code and selector pins and returns an Add cut; a version of 0 first resolves the curator's latest(nameHash) pointer, and each entry's exclude selectors are then dropped from its cut. Custom cuts are appended AFTER the registry cuts, order preserved — a deliberate custom Replace may therefore re-point a selector a registry cut just added. Argument validation (LatticeFactory__EmptyRecipe, LatticeFactory__InitCalldataWithoutInit, LatticeFactory__ExportSelectorForbidden) runs on every call, including idempotent re-calls; registry resolution, exclusion, LOUPE-COVERAGE validation (LatticeFactory__MissingLoupeCoverage — every fresh deploy must route the four EIP-2535 loupe selectors; the registered lattice.DiamondLoupeFacet entry is the one-line way) and initialization run only when the diamond is actually deployed. INIT AUTHORITY: Lattice.initialize is called by THIS FACTORY, so inside init msg.sender is the factory, not the deployer. An init that grants msg.sender a role or ownership grants it to the factory, which has no way to use it: pass the admin explicitly in initCalldata (every shipped Init does).

Every successful call deploys a fresh diamond from exactly this recipe and emits DiamondDeployed, so a double-submitted or replayed transaction fails loudly instead of "succeeding" with another recipe. Same validation, resolution, exclusion and init-authority rules as deploy.

Shared body of deploy (strict == false) and deployStrict (strict == true).

Argument validation. It runs on EVERY call — including ones that take deploy's idempotent return — so a recipe that would be refused fresh is never quietly "accepted" against an occupied address. Refuses — never strips — any custom cut carrying exportSelectors() (registry-resolved cuts can never contain it: registration rejects it), a zero init with calldata (DiamondLib skips a zero init without looking at the calldata, which would drop it silently), and in strict mode any entry that would resolve the movable latest pointer.

The cuts a fresh deploy applies. Registry-resolved recipe cuts first: getCut live-re-verifies the code + selector pins and returns an Add cut; any registry revert (drift, missing record, unset latest) bubbles unchanged. Exclusions are checked against that verified export, so a typo never silently leaves a selector in. Custom cuts are appended after the registry cuts, order preserved — a deliberate custom Replace may therefore re-point a selector a registry cut just added (the deployer's own diamond, by design).

Drops every exclude selector from selectors IN PLACE, keeping the export order of the rest, and shortens the array. Reverts ILatticeFactory.LatticeFactory__ExcludedSelectorNotExported for a selector the export does not contain, which also catches a selector excluded twice. Excluding every selector leaves an empty Add cut, which DiamondLib refuses (NoSelectorsGivenToAdd).

Two passes over the materialized cuts, making the loupe-routing guarantee SOUND for the assembly transaction:

1. PRESENCE — reverts ILatticeFactory.LatticeFactory__MissingLoupeCoverage with the FIRST loupe selector no Add cut routes (fixed order: facets(), facetFunctionSelectors(address), facetAddresses(), facetAddress(bytes4)).
2. NO-UNDO — reverts ILatticeFactory.LatticeFactory__LoupeSelectorNotReplaceable if any Replace/Remove cut in the SAME deploy touches a loupe selector: without this, a recipe like [Add(loupe), Remove(loupe)] would pass the presence scan yet assemble a loupe-less (or mis-routed) diamond. Fresh-deploy recipes may only ADD loupe routing; re-pointing it is a post-deploy upgrade concern, never an assembly one. What this does NOT guarantee: that the routed code correctly IMPLEMENTS the loupe — custom-cut facets are the recipe author's responsibility (see IFacet's security note on self-reported selectors); registry cuts at least pin codehash + export blob.

Binds the diamond address to its deployer: keccak256(deployer, salt).

Standard CREATE2 address derivation for the Diamond proxy.