Redemption Backstop Changelog: v4 archive

Impact notes

• When observed output identity does not match the configured payout, only a separately sourced paused status survives as an adverse facility/input-token observation. Restricted or other cohort status cannot cross to a different output path.
• MetaMorpho V1 wallet donations no longer floor or replace validated executable-capacity API evidence. Unavailable API capacity stays unavailable. Liquity v1 gross ActivePool debt remains a backing diagnostic, not quantified executable eligible-Trove debt.
• GBPA and MXNT explicitly retain unquantified capacity rather than inherited full-supply assumptions. FILQ and Sygnum FIUSD cash-output classifications are separated from NAV input pricing. strUSD uses permissionless on-chain submission with issuer-discretionary holder eligibility, not an inferred address whitelist or unconditional access.
• The shared NAV label now reads NAV-priced output; this wording correction alone does not change scoring. Refreshed holder documents and source pins do not establish missing funded capacity, completed settlement or all-in costs.
• Changed admission and route-score inputs require a fixed-clock route comparison and fresh producer observations where applicable. No equivalence, score movement or production acceptance is claimed.
• Activation is provisionally 2026-10-16 00:00 UTC (1792108800); re-date effectiveAt at release.

Impact notes

• Avalon, Youves, hyUSD and wARS retain unquantified capacity instead of unsupported family-default or full-supply assumptions. Avalon preserves its actual USDT output; Youves preserves the documented haircut and does not promote its announcement period to completed settlement.
• Solayer's sUSD holder path is queued QLP fulfillment to USDC, not an atomic reserve-token redemption. Capacity and holder eligibility remain unquantified/unknown, geographic restrictions stay visible, and no completion maximum or complete all-in cost is invented.
• pathUSD's issuer processing target does not establish same-day completed payout. Its multi-day category and scoped capacity/settlement/cost gaps remain distinct from a guaranteed elapsed completion bound.
• The PKT-9 existing-route bound review establishes no new admissible config-only upgrades. Exact ERC-4626 certificates separately admit same-block NAV references for unpriced reviewed shares and actual smaller-probe receipts while retaining an unfunded canonical attempt; those Safety v10.18 execution rules do not promote static capacity or settle the canonical request.
• This domain bump is required because withdrawing configured capacity, settlement and eligibility assumptions changes route-score inputs, not merely explanatory prose. The final Safety accepted-pair current-redemption scenario shows zero movers, not standalone redemption equivalence; route-level comparison and fresh producer-dependent evidence remain separate release prerequisites.
• Activation: 2026-10-14 12:40 UTC (release cut; 1791981600).

Impact notes

• Observed fractional fees are not rounded before cost scoring or scenario evaluation. Fees just above 10, 50 or 100 basis points now receive the correct existing ladder score.
• Rejected payout identities cannot provide favorable live fees, open status, holder eligibility, settlement terms or their positive scoring projections. Independently reviewed static fees and separately sourced adverse observations remain usable.
• Unreadable sBOLD collateral-health evidence leaves route openness unknown rather than claiming executable access. Mento Broker capacity requires same-block execution predicates and a bounded successful quote, not virtual inventory alone.
• dEURO basket-output valuation requires complete bounded member-price and FX clocks and retains the oldest observation, preventing stale or undated quotes from establishing current output-haircut evidence.
• Physical commodity outputs and fiat payouts retain distinct identities. Physical valuation requires explicit source-timed USD evidence; XAU/XAG producer identities remain admitted without bypassing Safety Score's existing commodity valuation gates.
• Corrected fees and newly admitted or withheld evidence can move route scores. Fixed-clock route/scenario comparison and owner review are required before release; producer-dependent capacity and status require fresh admitted observations, not rewritten historical evidence.
• Activation is provisionally 2026-10-11 00:00 UTC (1791676800); re-date effectiveAt at release

Impact notes

• The executable-observer capacity model carries an exact observer ID, diagnostic-only/measured use and required payout keys, scheduled transport/signal/request guards and original block/time. Lido, Monetrix and Saturn retain null numeric capacity; USDfr's restricted par-state USDC measurement has separate all-in execution gaps. apyUSD measures funded apxUSD UnlockReceipts only with same-run valuation and remains eventual-only; no full-NAV, reserve idle cash or static fallback supplies missing proof.
• ONyc/NUSD baseline capacity is unquantified, not fixed-usd zero. Generic sfrxUSD and every async reserve-sync branch preserve settlementBoundUnproven and withhold immediate/scoring capacity; independently observed paused zero remains adverse. CapacityRejectionReason names exact reserve/route/source/output failures, and independent nested same-run on-chain capacity does not make timestamp-less composition verified.
• Stablecoins supply generation must be positive, no later than the run clock and within the cadence-derived producer-to-producer consumer window (twice the producer interval, currently 1800 seconds), distinct from public endpoint and executable-state freshness budgets. stablecoinsInput records updatedAt, assessedAt and maxAgeSec; invalid global input holds prior completed output. Missing per-asset supply stays null and independently measured absolute capacity can survive without a ratio.
• Accepted reserve cache/schema and consumed manifests advance together to v2, preserving original freshnessMode and sourceFreshnessInvalid with strict matching fingerprints. Malformed or missing required immutable details invalidate the whole run; only an earlier complete immutable generation may be served with its own clock/methodology, otherwise 503. Direct-only evidence never fabricates reserveInput.
• Reservoir rUSD, srUSD and wsrUSD retain one shared USDC PSM resource and independently pinned route evidence; wsrUSD is directly rUSD-backed and cannot import the separate srUSD SavingModule fee. Mento's branches bind all guards to one numbered source block, distinguish measured zero from unreadable guards and key shared inventory caches by that block.
• A percentage minimum or minimum-dollar charge cannot clear maximum-cost evidence. Request points retain their own costs; captured scalar reuse requires both matching notional and cost budget. Fixed issuer/fund zero remains separate from bank/network/partner costs, NAV impairment and different payout branches. RLUSD/TUSD/USDGO/YLDS and Circle/Gate provenance corrections retain those distinctions.
• Scalar SLAs require completed-endpoint settlement support; business-day targets, processing and cooldown terms retain explicit gaps. Spiko D+1 and the former USN five-Business-Day to seven-calendar-day conversion do not establish an unconditional elapsed completion maximum. This corrects the earlier v4.44 USN bound; the separately measured sUSN handler period never proves downstream USN fiat completion.
• BRSRV, CUMIU, chfSAFO, EURW, USDSM and USDU gain reviewed eventual entitlements with capacity/settlement/cost gaps retained. XGZ/ZARU/STBT, KGST, Ripio wFIAT and HLUSD do not infer full-USD proceeds from backing. EURR's selected issuer channel remains suspended; JUSD/BFUSD operational retirements preserve history. Shared scoring weights, ladders, stress/portfolio thresholds and grade gates are unchanged.

Impact notes

• The reviewed no-extra-fee statement does not establish full-value output. HBD uses disclosed-unquantified dynamic cost evidence until executable haircut-adjusted proceeds are established.
• The reviewed 302400-second settlement term and documented full-supply eventual capacity remain separate evidence; neither establishes a numeric cost or output-value bound.

Impact notes

• The exact Morpho Vault V2 liquidityAdapter() is read in the same run before protocol API liquidity can enter capacity. A zero or unreadable adapter restricts capacity to independently observed fresh idle underlying, with morpho-vault-v2-liquidity-adapter-zero or morpho-vault-v2-liquidity-adapter-unavailable; unreadable idle leaves capacity unavailable.
• Generic non-USD ERC-4626 underlying without same-path FX valuation emits no capacityUsd and names erc4626-capacity-non-usd-unvalued. wiTRY loses nominal TRY-as-USD capacity telemetry while retaining its reserve evidence, and the new EURCV vault cannot publish nominal euros as dollars.
• New reviewed routes no longer use fixed-usd zero for unmeasured liquidity. Exact-output reserve-sync routes have no static fallback and publish missing-capacity when telemetry is absent; routes without an honest capacity model remain source-reviewed unconfigured instead of resolving an invented zero.

Impact notes

• Live evidence uses a validated nested source timestamp, or the producing reserve snapshot fetch time for same-run onchain/API telemetry; publication updatedAt does not refresh evidence. Retained observations therefore expire under V9's existing eight-hour redemption evidence budget.
• Positive-supply capacity ratios are finalized capacity USD divided by that same supply, including daily scoring bounds. Issuer ratios remain source diagnostics and may infer USD only when the amount is absent; this changes the standalone capacity diagnostic, not V9 CDP-ratio scoring.
• Nested redemption timestamps are rejected beyond the existing stricter adapter/coin reserve source-age budget, with the existing reserve freshness fallback when neither declares a budget.

Impact notes

• `usn-noon` moves from atomic to days settlement with a 7-calendar-day bound taken from the five-Business-Day processing clause, rules-based-nav execution for the issuer-processed rail, and the issuer's discretion to gate redemptions; fees stay undisclosed-reviewed against the non-binding fees page, and capacity keeps its 15% supply-ratio heuristic with a majority-private-credit rationale.
• `susn-noon` no longer carries the registry `async-request` marker: a dedicated observer re-reads the vault's withdrawal-handler pointer from pinned namespaced storage first (failing closed on drift or an unreadable read), then publishes measured idle-USN capacity as `live-direct-bounded`, same-run route status, and the handler's live `withdrawPeriod()` (604,800 seconds today) as `settlementDelaySec`. The period sits behind the handler's 48-hour timelock and applies retroactively to in-flight requests; an unreadable period leaves the route unrated instead of substituting a fixed delay.
• A documented-bound route's exit-route observation now uses its same-run chain-read time as `observedAt` when the observation carries a direct freshness kind; the reviewed date is only the fallback for evidence that has no such timestamp.
• Detail-card copy for a route withheld without reviewed scoring terms now describes the request-and-claim (queued withdrawal) process instead of asserting an operator-batched queue. Producer-supplied route-status reasons still pass through verbatim.

Impact notes

• The shared reserve metadata builder requires an explicit non-persisted routeObserved proof before preserving onchain or protocol-api provenance, preventing capacity-only observations from becoming live openness claims.
• HoneyFactory pause and cap guards, Liquity branch mechanisms, Sky LitePSM halt fees, Reserve DTF basket and throttle guards, and reviewed M0 extension predicates now publish route status from their observed execution gates; Falcon, OpenEden, f(x), Superstate, collateral-position, and unsupported wrapper paths no longer overclaim live openness.
• GHO facilitator attribution is keyed by reviewed addresses rather than mutable labels, and unreviewed facilitators remain unknown exposure.
• Route-status freshness reaches 100 only for an open current onchain or protocol-api observation with positive executable capacity; open routes with zero or missing capacity are capped at the reviewed 70-point tier.

Impact notes

• An open live downside depeg row remains the incident gate, but peak_deviation_bps is historical context only: degraded / market-implied now requires a current signed deviation at or below -2500 bps whose price observation and peg reference pass the existing 1800-second freshness and authority rules.
• When an open downside incident has no trustworthy current deviation, the row publishes routeStatus unknown with routeStatusSource market-implied, remains resolutionState impaired, and keeps score = null; missing evidence cannot restore a static open-route claim.
• A fresh current deviation above the severe threshold releases only the market-implied overlay and falls back to live/static route status without closing or mutating the depeg event. Permanently collapsed assets remain degraded while fresh severe evidence persists and become unknown, not open, if the feed disappears.
• The same current-evidence rule applies to modeled output dependencies; the direct strong-live exception remains available only for current permissionless atomic/immediate capacity and never bypasses a severely impaired or uncertain output asset.
• At the 2026-09-01 production capture measurement, nine rows were degraded by market-implied impairment: one retained current severe evidence, three had current non-severe evidence, and five had no current peg observation. Scoring weights, ladders, route-family caps, and the 2500 bps threshold are unchanged.

Impact notes

• The six configured Liquity-style getRedemptionRateWithDecay probes now pin their contracts' 18-decimal return scale, including Liquity V1 LUSD
• Fresh successful reads can populate the formula route's numeric feeBps and same-notional execution cost; an unavailable or malformed read still leaves the fee unknown rather than substituting the documented 50 bps minimum
• The config schema now rejects future redemption-rate probes without an explicit positive decimal scale; component weights, score ladders, and fee formulas are unchanged

Impact notes

• An open route carrying `settlementBoundUnproven` now resolves as `missing-capacity` with null immediate and scoring capacity, so its standalone route score is null rather than zero and `eventualRedeemabilityScore` remains null.
• The marker is withheld for paused routes, which continue through the measured-zero impairment path so a paused route's observed impairment is not recast as an evidence gap.
• The public `capacityProfile` and exit route observations expose optional `settlementBoundUnproven`, allowing consumers to distinguish unestablished capacity from measured zero.
• Scoring component weights, formulas, ladders, caps, and the eventual-redeemability calculation are unchanged.

Impact notes

• A resolved capacity observation at zero receives a zero route score with zero-executable-capacity; a positive observation below both the 1% completion and $100,000 absolute breakpoints receives zero with immaterial-executable-capacity. Missing capacity remains unrated rather than being converted to zero.
• The public settlement model and score now use conservative reviewed corrections durably and favorable corrections only while their cited review remains current under the 365-day evidence window. eEARN therefore publishes its operator-batched queued settlement and queue posture instead of the stale atomic default that inflated its standalone component mix.
• Fresh live fee telemetry can replace a static fee description, so the displayed explanation identifies the measured current fee rather than repeating obsolete reviewed copy.
• Reserve-sync routes no longer inherit full-supply eventual capacity automatically. A config may opt into eventualCapacityModel: supply-full only with a review date and supporting route sources; no existing route is grandfathered into that assertion.
• The same material-capacity gate applies to the secondary eventual-redeemability score, so zero eventual capacity cannot retain a positive component-mix headline. Before the correction, nine positive redemption headlines had a zero capacity component, thirteen routes exposed a standalone settlement model different from their reviewed V9 term, and ninety-six reserve-sync rows automatically asserted eventual full-supply capacity. All three classes now share fail-closed semantics.

Impact notes

• BD adds permissionless atomic collateral redemption across its WETH, wstETH, rETH, wrapped cbBTC, and cbETH launch branches, with current capacity and the CollateralRegistry fee supplied by the four-hourly live-reserve snapshot.
• For BOLD and BD, a branch whose TroveManager tuple reports `redeemable = false` is excluded from immediate capacity and degrades route status instead of leaving aggregate ActivePool debt credited as executable.
• An unreadable required branch tuple leaves the nested redemption route unrated; optional solvency-metric failure after all branch redeemability facts are known can still preserve the bounded capacity observation.
• Liquity V2 configs without mechanism-redeemability packets retain their prior aggregate ActivePool debt behavior.
• Coverage rises to 328 configured routes, with family totals of 151 offchain-issuer, 71 stablecoin-redeem, 41 collateral-redeem, 40 queue-redeem, 16 psm-swap, and 9 basket-redeem. Scoring weights and ladders are unchanged.

Impact notes

• EURO3 (3A DAO) adds a permissionless Polygon/Linea collateral-redemption route into the documented vault collateral set, using a 0.40290081 eligible-debt heuristic and a current 0 bps observation that remains governance-adjustable.
• iUSD (Indigo) adds a permissionless funded PSM route into USDM, USDA, and USDCx at 1%; USDM and USDA are verified tracked identities while the complete basket remains unresolved because Cardano USDCx is untracked, with a 0.15577082 PSM-share heuristic.
• JPYSC (SBI Shinsei Trust / Startale) adds a verified-customer same-day direct issuer route at 1:1 JPY, retaining unresolved fiat:JPY output and the documented 3,000 JPY plus consumption-tax issuer fee with holder-borne bank-transfer charges.
• Coverage rises to 327 configured routes, with family totals of 151 offchain-issuer, 71 stablecoin-redeem, 40 collateral-redeem, 40 queue-redeem, 16 psm-swap, and 9 basket-redeem.

Impact notes

• MAI (QiDao) adds a permissionless PSM route with a three-day withdrawal queue, heuristic eventual capacity, same-protocol correlation, and an issuer-undisclosed stablecoin collateral set; the route is distinct from borrower-only CDP repayment.
• trUSD (Tori), JUSD (JuiceDollar), JPYT (DePhaser), and suiUSDe (Sui/Ethena) add stablecoin-redeem routes: Tori is whitelisted with a fixed 10 bps fee and a conservative 10% strategy-buffer heuristic, JUSD preserves all three Citrea bridge outputs as an unresolved basket, JPYT uses rules-based NAV at the average Lock-In Exchange Rate rather than spot JPY/USD par, and suiUSDe is a role-gated atomic USDC redemption with the same conservative heuristic plus documented limits and pause controls.
• USDM (Monetrix) adds a permissionless three-day request/claim queue into USDC; its conservative 10% strategy-buffer heuristic avoids treating delta-neutral positions as immediately redeemable full supply while pause, deposit limits, and TVL caps constrain execution.
• HCHF (HLiquity) adds a permissionless collateral redemption into HBAR with a documented dynamic fee model and eventual full-system capacity rather than a same-block hot-buffer claim.
• eMXN (Telcoin) adds a verified-customer issuer rail with 1-3 business-day processing, a 0.15% documented fee plus pass-through charges, and unresolved fiat:MXN output; HLUSD (HeLa) is modeled per review adjustment as a manual, opaque, days-settled StableHodl OTC rail into USDC or USDT with a fixed 100 bps fee and heuristic eventual capacity.
• Coverage rises to 324 configured routes, with family totals of 150 offchain-issuer, 71 stablecoin-redeem, 39 collateral-redeem, 40 queue-redeem, 15 psm-swap, and 9 basket-redeem.

Impact notes

• dEURO replaces its false collateral-redemption model with live-only, fee-free StablecoinBridge basket telemetry across nine identity-pinned Ethereum bridges (EURT, EURS, VEUR, EURC, EURR, EUROP, EURI, EURE, EURA, each verified to burn dEURO 1:1 into its underlying with no fee). Capacity sums the idle EUR inventory (456,293 EUR at Ethereum block 25737329, almost entirely on the EURC bridge), converts it to USD through the protocol price feed rather than a false EUR=USD assumption, fails closed with no fallback, and leaves the output basket honestly unresolved because only five of the nine underlyings are tracked
• USDp (Parallel) gains live capacity from the Parallelizer diamond's per-collateral getIssuedByCollateral reads, summed across the frxUSD, sfrxUSD, USDe, and sUSDe branches ($845,693 at block 25737340). The verified source redeems a proportional basket rather than holder-selected collateral, so the sum is the honest executable bound; the escrow-balance adapter gains a bounded multi-read mode for it and the documented full-supply model is dropped with no fallback
• USD3 and eUSD redemption outputs are now valued at same-run on-chain NAV bound into the reserve snapshot, following the cUSD (Cap) precedent: ERC-4626 legs through convertToAssets and verified Compound wrappers through exchangeRate, with per-leg weights and a unit value published only when the live basket exactly matches the configured outputs ($1.1037 per USD3 and $1.0000 per eUSD at the review reads). An unreadable leg or a rotated basket suppresses the valuation while capacity telemetry stays intact, so the routes no longer wait on external peg rows for legs like steakUSDC
• FDUSD's transparency source remains fail-closed after a first-party-only investigation: every firstdigitallabs.com path serves a Cloudflare JavaScript challenge to automated clients, the app subdomain exposes no transparency API, and the reachable copy is a Webflow mirror serving a scanned unparseable PDF, recorded so the staleness is a documented condition rather than a silent gap
• Route-family totals are unchanged at 148 offchain-issuer, 67 stablecoin-redeem, 38 collateral-redeem, 39 queue-redeem, 14 psm-swap, and 9 basket-redeem

Impact notes

• ZSD (Zephyr) replaces its dynamic-fee marker with a fixed 10 bps bound: the pinned RingCT source deducts `exchange_128 / 1000` from the ZSD/ZEPH rate on every REDEEM_STABLE, and because Zephyr mainnet has run hard fork 11 since block 536000 the pre-fork 200 bps path is unreachable. This is the same consensus source that bounded ZYS in v4.33, read on the sibling conversion
• USDPT (Western Union) gains an offchain-issuer route, so coverage rises to 315 configured coins and the offchain-issuer family grows from 147 to 148. Anchorage Digital Bank N.A. is the federally regulated issuer and its Covered Stablecoin Terms redeem presented tokens at Par Value, but the route is client-gated (the terms redeem 'exclusively from Clients') and settlement is modeled as days rather than the issuer default of same-day because the terms promise only 'commercially reasonable efforts' with no published timeframe and reserve the discretion to refuse, suspend, or limit any request
• USSD (Sonic) consumes live escrow telemetry as its executable exit bound and drops the documented-bound full-supply model with no fallback, so an unavailable read leaves the route unrated instead of assuming immediacy. At Sonic block 77432523 the BrandedCustodian's totalAssets() and the custodian's frxUSD balance both read 2,081,316.47, confirming the escrow measured is the asset the redemption pays out; its redeemFee() is still 0 and paused() reverts, so the verified source exposes no pause surface
• satUSD (River) takes no static fee bound (`maxRedemptionFee` is a per-branch governance parameter capped only at 100%, two orders of magnitude above the admissible ceiling), but its cost model is corrected from undisclosed to the documented `min(redemptionFeeFloor + baseRate, maxRedemptionFee)` formula, and its live adapter now reads each branch's getRedemptionRateWithDecay() so the current cost comes from telemetry instead. Capacity moves onto per-chain trove debt read through the Satoshi app's getGlobalSystemBalances(), gated on debtToken() still round-tripping to this coin's own satUSD deployment and on the global TCR clearing each branch MCR. The documented-bound full-supply model is dropped with no fallback: satUSD is largely bridged or Smart-Vault-minted rather than trove-backed, so total supply never described what the redemption engine could honor
• USDai moves onto its live PYUSD float with no fallback, gated on baseToken() still resolving to that same PYUSD deployment. For a KYC-gated burn-and-withdraw route the float is the only honest bound, and the point is not academic: at the 2026-08-12 read the contract held 174,318,300.42 PYUSD against a USDai supply near 172.6M, so the float currently exceeds supply and no fixed fraction of supply could stand in for it
• DOC (Money On Chain) consumes MoCState.freeDoc(), the DOC currently redeemable through redeemFreeDoc, identity-bound to the tracked DOC token through the MoC connector, with a 95% documented ratio retained as fallback because DOC is also deployed on Arbitrum and Ethereum while only the Rootstock-local balance is redeemable, and Rootstock exposes a single public RPC. At the 2026-08-12 read freeDoc() returned 2,874,833.75 with the connector identity resolving and the pause target false
• USDz (Anzen) is corrected from whitelisted to permissionless access, read from the deployed source rather than the docs: redeem() gates only on pause, collateral rate, sufficient SPCT reserve, and a caller blacklist, with no holder whitelist. The SPCT whitelist sits one level down and covers the USDz contract itself, which is what calls spct.redeem(). On-chain, SPCT isWhitelist() reads true for the USDz contract and false for an ordinary address. Anzen's Qualified-Market-Maker framing describes the primary mint rail, not a restriction on who may redeem
• USDz also moves onto live telemetry with no fallback. `redeem()` pays USDC out of the USDz contract after pulling it from the SPCT pool, so the pool's own USDC is the depth rather than full supply, and the whole surface is withheld when USDz's pinned usdc(), spct(), or oracle() identities stop resolving or paused() reads true. Its fee is also read live: the route charges USDz's redeemFeeRate() first and SPCT's rate on the remainder, so the two compose rather than add
• USDz's first live capacity read is an honest negative of the kind the DOLA correction established. At Ethereum mainnet on 2026-08-12 the SPCT pool held 6,695 raw USDC units (0.006695 USDC, under a cent) against a USDz supply of 806,422.80, and the source makes that ceiling exact rather than approximate: redeem() requires spct.reserveUSD() * 1e12 >= _amount, capping any single redemption at 0.006695 USDz. The route is open and unpaused but drained to a rounding error, so the earlier full-supply model was crediting a reserve it could not pay
• eUSD (Electronic Dollar) migrates to the Reserve DTF adapter and becomes live-only with no fallback, the same treatment USD3 took in v4.33: the route reads the RToken's own redemptionAvailable() throttle, which refills over time and shrinks as it is drawn, so no static supply figure represents it. At Ethereum block 25737172 the throttle returned exactly 5,000,000.00 against a supply of 22,834,920.56 with the basket handler reporting SOUND, binding at roughly 22% of supply, which is what the full-supply model had been overstating
• HONEY (Berachain) moves from documented full supply to live-direct vault telemetry: the gated probe enumerates the HoneyFactory's registered assets and their collateral vaults, verifying the factory's own honey() resolves to the tracked token first, and bounds the route by what those vaults hold. Its documented asset-specific fee schedule is now bounded by live redeemRates() as well. At Berachain block 24750999 basket mode was off for both mint and redeem, all four registered assets read isPegged() true, the vaults held 7,831,557.70 against a supply of 7,831,365.98, and live rates were 0 bps on three assets and exactly 5 bps on the fourth
• Two routes are deliberately left unmodeled after live investigation. USBD (BIMA) stays documented-bound because immediate capacity is trove-set-dependent: a pinned system-debt view would overstate the executable exit as troves churn. xUSD (BabelFish) stays as-is because the deployed v5 aggregator manager departs from its documented interface, so executable capacity cannot be bounded safely from either source
• dEURO keeps no fee bound and is flagged for a route remodel. Re-reading the primary docs found no holder-exercisable redemption into position collateral at all (the positions page documents owner minting plus a permissionless challenge auction, which liquidates rather than redeems), so the modeled route has no documented fee to bound. The one exit dEURO does document is a different rail: StablecoinBridge burns dEURO 1:1 into a single source Euro stablecoin at no fee, but bounded by that bridge's idle inventory rather than by supply, which at Ethereum block 25737044 was 456,236.35 EURC on the EURC bridge
• ZeUSD (Zoth) stays unconfigured: the documented route belongs to the ZeDP position NFT holder burning that position's own debt for the exact collateral deposited, not to a secondary ZeUSD holder, and the shared V1 router is recorded paused. bnUSD (Balanced) stays unconfigured: the tracked asset is the v1 ICON token whose maintained documentation has narrowed to wind-down tasks, and the 1:1 Stability Fund swap runs through SODAX on token identities distinct from the tracked contract
• CJPY (Yamato) moves onto live telemetry with no fallback: the priority registry's own getRedeemablesCap(), identity-gated on the registry round-tripping to the pinned Yamato core, is converted JPY to ETH through the protocol oracle and ETH to USD through the shared reference price, retiring both the documented full-supply model and the now-stale policy that recorded the adapter as capacity-less
• AID (GAIB) moves onto live telemetry with no fallback: the redeemer's USDC payout float capped by the remaining daily redemption allowance, identity-gated on stablecoin()/aid() and the pinned beacon implementation, read at $239,938.89 against the whitelisted burn-and-withdraw rail on 2026-08-12; its 10 bps fee is confirmed by the deployed redemptionFeeBps()
• iUSD (InfiniFi) gains live queue telemetry: the Gateway's RedeemController is identity-chained and read for queue length and total enqueued redemptions (both zero with gates open on 2026-08-12), lifting the route's evidence above the blind 15% heuristic that previously carried it alone; the direct controller buffer stays unscored because hook-driven liquidity is not statically readable
• Route-family totals are now 148 offchain-issuer, 67 stablecoin-redeem, 38 collateral-redeem, 39 queue-redeem, 14 psm-swap, and 9 basket-redeem

Impact notes

• DOLA is corrected downward: its reviewed 8% PSM-share capacity was a phantom. At Ethereum block 25736814 the deployed Inverse PSM reads supply() and getTotalReserves() of zero with zero token balances and a hard-reverting sell(), the contract having been drained on 2025-12-10 and stripped of its 200k DOLA Fed float on 2025-12-11. Capacity is now live-only with no fallback, so an unavailable read leaves the route unrated instead of resurrecting the static bound; the 20 bps fee is unchanged and now confirmed by the contract's own sellFeeBps()
• OUSG consumes live InstantManager router capacity as its immediate redeemable bound, replacing the full-supply model; Ondo's published $50M global instant-redemption limit across all investors in a rolling 24-hour window becomes the fallback when the router read is unavailable
• USD3 (Reserve) consumes the RToken's own redemptionAvailable() throttle read and drops its documented-bound full-supply model entirely: the throttle refills over time, so no static figure represents it. Capacity is withheld when the collateral basket is not SOUND and the route is left unrated when the throttle cannot be read
• USDD consumes the live Tron PSM GemJoin USDT balance, keeping the reviewed 16% PSM-share bound as fallback; its 0 bps fee is now confirmed by the module's on-chain tout()
• FXD (Fathom), HOLLAR (Hydration), and USDH (Hubble) gain psm-swap routes, so coverage rises to 314 configured coins and the psm-swap family grows from 11 to 14
• USDai's route is bounded at the 10 bps redemption fee its issuer notice publishes, and access is corrected from permissionless to whitelisted because the same notice restricts contract-level mint and redeem to KYC'd market makers and approved institutional depositors
• ZYS (Zephyr) replaces its undisclosed-fee marker with a fixed 10 bps bound taken from the consensus RingCT source, which deducts a 0.1% conversion fee on every REDEEM_YIELD
• USDnr (Nerona) is bounded at 0 bps for the modeled USDnr -> M leg: Nerona documents no protocol mint or redeem fee on USDnr itself, and the 0.01% figure belongs to the downstream wM/USDC pool rather than to the modeled route
• FXD carries a 25 bps whitepaper fee with whitelisted access and an unresolved xUSDT output; USDH carries its documented 50 bps PSM fee but routeStatus unknown, because no current Hubble source proves the module still executes; HOLLAR deliberately keeps no fee bound, since its buy-back fee is a per-collateral on-chain Permill with no documented ceiling and no adapter to read it
• MAI (QiDao) stays unconfigured: its Peg Stability Module, fee, and contract-address pages now return HTTP 404, so the queue route cannot be read from a live primary source. iUSD (Initia) stays unconfigured: the maintained bridge documentation does not mention iUSD at all
• Route-family totals are now 147 offchain-issuer, 67 stablecoin-redeem, 38 collateral-redeem, 39 queue-redeem, 14 psm-swap, and 9 basket-redeem

Impact notes

• ERC-4626 wrapper adapters emit routeStatus open/paused from same-run evidence: positive redemption liquidity plus an opportunistic paused()/isShutdown() probe, so ~20 wrapper routes previously stuck at routeStatus unknown now carry current-open attribution and their producer observations become score-eligible
• Mento V3 FPMM pools (JPYm, CHFm) read the pool's lpFee()+protocolFee() live (30 bps today, contract-capped at 200 bps combined), replacing the undisclosed-fee marker that ceilinged their exit credit
• USDe gains live-direct redemption capacity from the EthenaMinting contract's own USDT/USDC balances, capped by per-asset and global max-redeem-per-block config read in the same pass; the prior 0.5% reviewed heuristic remains only as fallback
• Reservoir routes read the USDC PSM on-chain (underlying identity, balance, pause state) instead of trusting API telemetry with unknown route status; base rUSD gains its own PSM redemption route (coverage rises to 311 configured), while srUSD/wsrUSD deliberately keep no fee bound because the deployed SavingModule exit fee is governance-settable with no ceiling under the 200 bps policy limit
• USTB is remodeled from the same-day fiat issuer rail to the atomic on-chain RedemptionIdle USDC rail its live adapter already measures (whitelisted access, 0 bps documented fee)
• IST's PSM route status is set to unknown following Inter Protocol's governance-approved sunset; eUSD and USD3 (Reserve) gain documented 0 bps redemption-fee ceilings from Reserve's closed fee schedule
• Route-family totals are now 147 offchain-issuer, 67 stablecoin-redeem, 38 collateral-redeem, 39 queue-redeem, 11 psm-swap, and 9 basket-redeem

Impact notes

• A reviewed minimum redemption of exactly $1,000,000 now applies the 0.75 capacity multiplier instead of 0.9; exactly $10,000 applies 0.9 instead of no penalty
• Only routes whose reviewed minimum sits exactly on a ladder threshold can move; all other route scores are unchanged
• The queue-backlog ladder is unchanged; it already matched at-or-above
• Band thresholds and multipliers, component subscores, capacity semantics, model confidence, route status, and the exit-route observation envelope are unchanged

Impact notes

• The exit scoring tables (component weights, coverage and absolute-capacity breakpoints, settlement-delay, queue-backlog and minimum-redeem bands, holder-eligibility multipliers, confidence factors, route-family caps, and the stress-request policy) live once in `shared/lib/exit-route-scoring.ts`; the V9 policy JSON is asserted against that source rather than pinned to a second authored copy
• Both published views now compose the same engine primitives and differ only in their request: the redemption score measures a route against the supply-denominator notional, the V9 Exit pillar against the same notional snapped to the reviewed stress grid
• `effectiveExitScore` is removed from `GET /api/redemption-backstops` rows, from the snapshot and history writes, and from the detail-page and coverage surfaces; `methodology.effectiveExitModel` is removed from the endpoint and from `v4ScoringParametersHash`
• `score`, `dexLiquidityScore`, `eventualRedeemabilityScore`, every component subscore, capacity semantics, model confidence, route status, and the exit-route observation envelope are unchanged; no redemption route score moves
• Consumers of the retired blend read the published V9 Exit pillar instead: the Selector now sources its exit input from `pillars.exit` only, and no longer fetches the redemption payload at all
• The unshipped `sameNotionalScoringMode: "active"` shadow engine (its observation eligibility, capacity-point resolution, pairwise request matching, and correlation classification) is deleted; the V9 Exit pillar performs that work in production
• The `redemption_backstop*` `effective_exit_score` columns remain in D1 and simply stop being written; the entry schema keeps the key declared but inert so Safety Score V9 compiler inputs captured before this version stay replayable
• Discovery's Curve provider check is scoped to the eight chains that credit Curve as a registered discovery provider and honors Curve's chain-path mapping, so deployment-census outcomes are always attributable to a named provider and the guaranteed-failing Gnosis request is gone

Impact notes

• `dusd-dialectic` moves from a static $0 queue placeholder to reserve-sync live-queue capacity backed by the Machine's idle Ethereum USDC minus `convertToAssets(DUSD.balanceOf(AsyncRedeemer))`
• The Makina strategy adapter validates the AsyncRedeemer beacon implementation, Machine `accountingToken()`/`shareToken()` values, and redeemer `machine()` binding at one pinned Ethereum block before publishing capacity
• DUSD no longer publishes the AsyncRedeemer minimum finalization delay as score-bearing `settlementDelaySec`; the 12-hour floor remains visible in `redemptionQueue.minimumFinalizationDelaySec`
• Whitelist-enabled DUSD redemption remains `routeStatus: "open"` with `holderEligibility: "issuer-discretionary"`; `cohort-limited` remains reserved for explicit current route impairment beyond the modeled eligible cohort
• No fallback ratio, full-supply, AUM, deployed-position, or reserve-weight capacity is used when the live queue proof is unavailable

Impact notes

• `sbold-k3-capital` reads the BOLD amount returned by the vault's `calcFragments()` liquidity view and caps live capacity at the amount the vault can withdraw from its Stability Pool positions
• sBOLD's live capacity uses documented-bound confidence and a strategy-buffer basis because collateral gains are excluded and K3 can temporarily restrict withdrawals when collateral exposure breaches its operational threshold
• A failed sBOLD liquidity read fails closed instead of falling back to full NAV or the vault's total assets
• Reviewed `undisclosed-reviewed` supply-model routes retain modeled capacity in `exitRouteObservations` with `feeEvidence: "undisclosed-reviewed"`, but the producer keeps them non-score-eligible until a fixed fee or reviewed numeric ceiling bounds same-notional cost
• Current opaque-fee redemption scores and effective-exit blending remain unchanged; downstream candidate models may consume the tagged capacity only under their own explicit opaque-fee ceiling

Impact notes

• `usde-ethena` no longer promotes Ethena's mixed Liquid Cash aggregate into live-proxy executable capacity
• USDe continues to use the reviewed 0.5% hot-buffer fallback and documented fixed 10 bps fee; its reserve composition remains visible as backing evidence
• The generic reserve-sync contract is unchanged for adapters that isolate route-executable assets; aggregate accounting categories must now remain contextual rather than scoring capacity

Impact notes

• Open, resolved `supply-full` routes with documented-bound capacity confidence and a reviewed docs timestamp emit one `exitRouteObservations` row where they previously emitted none
• Only atomic-settlement routes with a documented fixed-bps fee at or under the 200 bps same-notional cost bound are score-eligible; immediate, same-day, days, and queued settlement models publish `eventual-redemption` diagnostic observations with conservative settlement-horizon ceilings (1h/1d/14d/30d)
• Routes with formula, variable, or undisclosed fee models carry a zero executable bound because the published row states no defensible cost bound
• Redemption scores, capacity scores, effective-exit blending, and eventual redeemability are unchanged; this adds observation evidence only

Impact notes

• All 13 Mento stablecoins (cUSD, cEUR, and the FX m-stables) move from documented-bound full-supply heuristics to live-direct on-chain capacity: broker coins score counter-asset bucket depth with the pool's on-chain spread as a live formula fee, `gbpm-mento` scores its fork's ActivePool debt with the Liquity-style `getRedemptionRateWithDecay()` fee, and `jpym-mento`/`chfm-mento` score FPMM pool depth (capacity only; the FPMM fee getter is unverified)
• `ustb-superstate` capacity of record is now the USDC balance of Superstate's RedemptionIdle contract read in the same run (the liquidity API remains context), and its fee model moves from undisclosed to the documented current 0 bps protocol redemption fee
• `pusd-polymarket` moves from documented full-supply to reserve-sync live-direct capacity: unwrap pulls USDC from the verified immutable backing vault, so the vault balance (~101% of supply) is current executable capacity with a documented 0 bps fee
• `cusd-cap` fee evidence moves from undisclosed to a live on-chain formula: the vault's inherited Minter exposes `getRedeemFee()` (currently 0 bps), emitted as current-fee telemetry each run
• `usde-ethena` fee evidence moves to the documented fixed 10 bps from Ethena's public fees API and terms; capacity remains live-proxy because no public redeemable-buffer endpoint exists
• `susdd-tron-dao-reserve` and `sdola-inverse-finance` join the atomic-full-backing cohort after contract-source review plus state-override redemption simulations (sUSDD is an sDAI-fork pot/join exit; sDOLA unstakes from a fully liquid DolaSavings module); `sbold-k3-capital` was reviewed and deliberately excluded because its collateral-health gate and BOLD-only withdrawal cap make exits constrainable, and `eearn-ember`'s operator-batched request/settle exits keep the near-zero idle probe honest
• Scoring formulas, weights, and confidence gates are unchanged; this tranche changes capacity and fee evidence sources only

Impact notes

• `ybold-yearn` and `yvusdc-yearn` no longer score near-zero direct exit capacity solely because the vault contracts hold little or no idle BOLD/USDC; the adapter measures `totalIdle()` plus each funded default-queue strategy's `min(currentDebt, convertToAssets(maxRedeem(vault)))`
• The new `redemptionLiquidity: { source: "yearn-v3-withdrawable", settlementDelaySec: 0 }` mode is reviewer-configured and re-probes Yearn V3 strategy liquidity every reserve sync, so it is narrower than treating generic ERC-4626 `convertToAssets(totalSupply)` as executable capacity
• Unconfigured ERC-4626 wrappers remain conservative: idle underlying, reviewed Morpho vault liquidity, or explicit atomic-full-backing modes are still the only scoring capacity sources
• If a funded Yearn strategy's debt, maxRedeem, or conversion probe is unavailable, the live reserve snapshot degrades and the route fails closed instead of falling back to full NAV

Impact notes

• `sdai-sky` no longer scores ~$0 instant-exit capacity: the legacy Sky DSR routes redeemed DAI through the Maker pot, so `DAI.balanceOf(sDAI)` is ~0 even though sDAI→DAI redemption is atomic and unconstrained against the full ~$175M backing
• A reviewer-asserted `redemptionLiquidity: { source: "atomic-full-backing" }` adapter flag treats the supply-equivalent convertible backing (ratio 1.0) as live-direct same-run on-chain capacity; it is set only where the unconstrained-redemption property is verified, since the default idle-balance telemetry understates such vaults to ~0
• sDAI's redemption backstop score rises 69→93 and its effective-exit liquidity dimension 62→93 as the capacity component moves from 0 to 97
• Sky's modern `susds-sky`/`stusds-sky` savings vaults are unaffected: they hold their underlying in-contract, so the existing idle-balance probe already measured full backing. Only the legacy pot-routed sDAI needed the flag
• The scoring formula and confidence gates are unchanged; this only corrects capacity measurement for vaults whose backing is verifiably redeemable in full but invisible to an idle-balance read

Impact notes

• `steakusdt-steakhouse`, `steakusdc-steakhouse`, `gtusdcp-gauntlet`, `bbqusdc-steakhouse`, and `gtusdc-gauntlet` no longer score their instant-exit paths from idle underlying alone when the vault has withdrawable Morpho liquidity available
• Morpho V2 `liquidity` and Morpho V1 `liquidity.underlying` are treated as live-direct same-run API capacity and capped by the ERC-4626 asset base before entering the effective-exit blend
• Morpho V2 `forceDeallocatableLiquidity` is retained as context only; it does not inflate scoring capacity
• The standalone DEX liquidity score remains a DEX-market measure and does not count Morpho lending-vault liquidity directly

Impact notes

• `cdp-enosys` now binds the Flare Liquity V2 branch telemetry path, measuring FXRP, WFLR, stXRP, and sFLR branch collateral plus branch debt and current redemption-fee evidence from the 4-hourly live reserve snapshot
• `meusd-mezo` now uses a dedicated Mezo native ActivePool adapter that reads live collateral balance, protocol debt, TCR/MCR route health, and current redemption-rate telemetry directly from Mezo contracts
• `wm-m0` and `usdsc-startale` now use an M0 wrapper-underlying adapter for current M balance capacity; USDSC additionally verifies the Soneium SwapFacility route and approved swapper before emitting whitelisted-primary direct capacity
• `reusd-re-protocol` now parses Re Protocol's official metrics payload for instant redemption vault capacity instead of relying only on reviewed fallback ratios, while retaining the queued-route fallback because excess redemptions can still spill to the queue
• Review-time adapter dry run at 2026-06-15 10:09 UTC measured $120.9M of current live-direct capacity across the upgraded routes: $84.2M wM, $25.4M Re Protocol reUSD, $4.8M USDSC, $3.5M Mezo meUSD, and $3.0M Enosys CDP
• Aster asUSDF, Hyperbeat hbUSDT, Inverse DOLA, and Piku USP remain unpromoted because the verified live route is unavailable, paused/zero-capacity, or queue-only; DUSD Alto and Lista lisUSD have verified PSM candidates but need a clean reserve-composition plus live-capacity side-channel before promotion

Impact notes

• Twenty-six live-direct wrapper, queue, and collateral routes now use fixed or formula fee evidence instead of `undisclosed-reviewed`, including Frax sfrxUSD, Spark sUSDC/sUSDT, Yearn yvUSDC/yBOLD, Aave sGHO/stkGHO, Jupiter JupUSD, Maple syrupUSDC, GAIB sAID, f(x) fxSAVE, and selected Gauntlet, Steakhouse, Curve, Noon, OpenEden, Ethena, dTRINITY, and Ebisu routes
• Additional reviewed fee evidence was added for YieldFi yUSD, Hyperbeat hbUSDT, and Re Protocol reUSD, but those rows still depend on their existing capacity evidence and do not imply new live-direct buffer telemetry
• Admin-configurable or still-undisclosed fee routes such as Ember eEarn, Maple syrupUSDT, Asymmetry asUSDF, Avant/Rings/Reservoir candidates, and several buffer-locator candidates remain unpromoted until public numeric fee or direct-capacity evidence exists
• The `sky-makercore` adapter now validates Sky LitePSM `gem()` and `pocket()` on Ethereum and reads `USDC.balanceOf(pocket)` as same-run live-direct redemption capacity; if the on-chain probe is unavailable, DAI/USDS retain their existing reviewed fallback rather than failing open
• The scoring formula and confidence gates are unchanged; the update only improves route evidence quality where the required fee and capacity proof was verified

Impact notes

• An offchain issuer route qualifies only when both criteria hold: issuer terms document routine T+0/T+1 (or intraday) par redemption for verified customers, and the latest attestation or transparency disclosure quantifies a highly liquid reserve share (cash, overnight reverse repos, US Treasury bills of three months or less, or government money market funds)
• Uniform haircut rule: the documented immediate ratio is the attested highly liquid share multiplied by 0.25 (a 75% haircut), rounded down to the nearest 0.05, reflecting banking-rail, wire-cutoff, and compliance-processing throughput rather than asset liquidity; issuer-specific stricter reserve-slice bounds (USDC's 7% cash slice, USDtb's 10% USDC buffer) keep precedence over the generic rule
• PYUSD, USDP, USDG, and GUSD now use `supply-ratio` 0.25 with `documented-bound` confidence on a hot-buffer basis, with dual sources reviewed 2026-06-10: redemption terms (Paxos USD stablecoin terms and conditions; Gemini Dollar redemption commitments) plus the issuer attestation hubs (Paxos PYUSD/USDP/USDG transparency, Gemini GUSD attestations)
• USDT stays eventual-only because Tether's terms commit to no routine settlement timeframe and retain broad discretionary delay and suspension rights; RLUSD and FDUSD stay eventual-only because their public terms document par redemption but no routine T+0/T+1 settlement window; USD1 stays eventual-only because no public issuer redemption terms with a documented settlement window exist
• Offchain-issuer route-family caps (65) and severe-depeg unscoreability for non-live documented-bound routes are unchanged

Impact notes

• A v4 effective-exit blend invoked without model confidence now applies the low (0.35) confidence factor instead of full redemption weight
• Live-proxy capacity with unknown route status always rolls up low model confidence; only live-direct telemetry or source-reviewed documented bounds keep unknown route status above low
• The strong live-direct severe-depeg exemption is asserted against the final resolved capacity state, so live routes downgraded to fallback or heuristic capacity are impaired during severe active depegs
• Output-asset impairment rows now flag over-leveraged dependency compositions whose reserve-derived weights sum above 100% of supply while keeping the impaired share clamped at 100%

Impact notes

• `fxsave-f-x-protocol` moves from a static 20% heuristic capacity model to `reserve-sync-metadata`
• Fresh clean snapshots resolve as live-direct current capacity and can produce medium model confidence despite the reviewed variable-fee route
• The route fails closed as unrated when live ERC-4626 telemetry is stale, missing, or degraded, avoiding heuristic Safety Score uplift

Impact notes

• `zchf-frankencoin` now probes the CHFAU bridge at `0x3e445ff4dddf0ff8ae7458c9746ed80bd664f6c1` and CHFAU token `0xbd4dfc058eb95b8de5ceaf39966a1a70f5556f78`
• The old VCHF bridge remains documented historically but no longer supplies current capacity because its inventory is zero and its horizon expired on April 15, 2026
• Until Frankencoin's price API publishes CHFAU directly, bridge telemetry values CHFAU at the existing VCHF CHF-price proxy and keeps a conservative 0.85% fallback buffer

Impact notes

• Resolved routes with `routeStatus: unknown` and `capacityConfidence: documented-bound` now keep medium model confidence when the rest of the evidence gates pass
• `routeStatus: unknown` remains a low-confidence signal for live-proxy, dynamic, heuristic, and unresolved capacity evidence
• This lets source-reviewed bounded routes avoid being downgraded solely because explicit route-status telemetry is unavailable, without treating proxy liquidity as current direct redemption evidence
• ERC-4626 single-asset wrappers can now score fresh idle underlying ERC-20 balances as direct redemption capacity; the Spark, Sky, Curve, Frax, and Cap wrapper configs use that live path instead of full-supply immediate capacity
• Source-reviewed coverage adds active Spiko, Anemoy, Securitize, Hamilton Lane, MXNe, Ripio wFIAT, and EUR0 routes while keeping pre-launch USDPT, USDB Bridge, USDF Flipcash, and FIUSD deferred until runtime eligibility is clearer
• Coverage rises to 304 configured redemption routes, with route-family totals now at 148 offchain-issuer, 60 stablecoin-redeem, 41 collateral-redeem, 36 queue-redeem, 10 psm-swap, and 9 basket-redeem

Impact notes

• JAAA, ACRDX, STAC, HLSCOPE, SAFO, EURSAFO, GBPSAFO, UKTBL, SPKCC, EURSPKCC, mF-ONE, mGLOBAL, mHYPER, mMEV, and mAPOLLO now carry documented-bound offchain issuer redemption routes at NAV
• asUSDF now carries a queued wrapper exit back into USDF, XNK now carries a commodity issuer exchange route for physical gold, and USDF's Aster redemption config reflects the reviewed fee and settlement terms
• Tradable private-credit direct-deal tokens remain intentionally unmodeled until a public issuer redemption route can be verified
• Coverage rises to 297 configured redemption routes, with route-family totals now at 142 offchain-issuer, 60 stablecoin-redeem, 41 collateral-redeem, 36 queue-redeem, 10 psm-swap, and 8 basket-redeem

Impact notes

• AUDm, BRLm, CADm, COPm, GHSm, KESm, PHPm, and ZARm now carry documented-bound Mento CDP collateral-redeem routes with explicit notes that current per-symbol CDP telemetry is not modeled yet
• CDP Enosys now carries a Liquity-style collateral-redeem route, while USDB and USDv add stablecoin-redeem coverage and XMD adds whitelisted basket-redeem coverage
• MoveUSD now carries a source-reviewed offchain issuer redemption route through CFX designated channels for verified customers
• Coverage rises to 280 configured redemption routes, with route-family totals now at 126 offchain-issuer, 60 stablecoin-redeem, 41 collateral-redeem, 35 queue-redeem, 10 psm-swap, and 8 basket-redeem

Impact notes

• `ybold-yearn` now carries a source-reviewed stablecoin-redeem route using documented-bound supply-full capacity semantics
• Coverage rises to 267 configured redemption routes, with route-family totals now at 125 offchain-issuer, 58 stablecoin-redeem, 32 collateral-redeem, 35 queue-redeem, 10 psm-swap, and 7 basket-redeem
• The route notes clarify that yBOLD exits into BOLD at the Yearn vault exchange rate, while final par exit quality still inherits BOLD's Liquity collateral-redemption path

Impact notes

• Standalone route scoring now uses current executable capacity while `eventualRedeemabilityScore` preserves long-tail legal or protocol route quality as separate context
• Capacity profiles expose immediate, daily-limited, queued, eventual, and scoring capacity fields; fixed public USD buffers can be modeled without encoding arbitrary supply ratios
• Effective-exit blending now scales redemption uplift by modeled exit size, current capacity, confidence, and DEX/redemption correlation, with diversification bonus reserved for plausibly independent issuer rails
• Route-status evidence remains a four-hour snapshot from live-reserve metadata, reviewed static policy, and market-implied depeg overlays; no new outbound route-status fetches are added to the redemption sync
• Registry validation now runs through a shared manifest/validator, emits deterministic audit reports, and is paired with v4 active-gap and heuristic-route coverage audit tooling