---
title: "Safety Scores Changelog"
canonical: "https://pharos.watch/methodology/scoring-changelog/archive/v10/"
description: "Safety Scores Changelog - Pharos methodology version history."
---

# Safety Scores Changelog

[All versions](https://pharos.watch/methodology/scoring-changelog/)

<a id="scoring-v10-23"></a>

## v10.23 - Archive-free CCIP origins and coherent attribution captures

**Effective:** 2026-10-19

Safety Score v10.23 admits reviewed immutable CCIP creation and initial-sequence witnesses instead of unavailable predecessor state, while still requiring complete historical logs and current canonical liability evidence. It aligns Centrifuge observations to finalized Solana time and admits an explicitly reviewed finalized-first Robinhood pin for wiTRY.

- Monad OnRamp 2.0.0 creation at block 97598317 and OnRamp 1.6 creation at block 29585544 were authenticated against live canonical headers, successful deployment receipts, exact creation input and verified constructor source. Both constructors leave destination counters zero, with the first send using sequence 1. The older ramp predates the token pool: its complete ramp history must be replayed from creation, including foreign-token sequences, not from the later pool deployment.
- Witness-bearing CCIP sources use checkpoint schema 3 and source-bound witness digests. Incompatible v1/v2 checkpoints rebuild rather than imply zero pending; unchanged predecessor-state sources retain authenticated schema-2 progress. Current runtimes, token/pool peers, finalized pins, complete contiguous sends and exact execution/conservation checks remain required. Missing witnesses, unavailable old logs and incomplete bootstrap remain explicit rejections; no archive provider purchase or latest-state substitution is authorized.
- Centrifuge captures non-rewindable finalized Solana identity and supply first, then selects each safe EVM pin inside the shared actual observation interval. Every deployment, including observed zero, remains required. wiTRY's reviewed Robinhood pin prefers independently rechecked finalized state over its heuristic 15059-block lag; that lag remains the fallback only where finalized evidence is unavailable, and pending-history finality gates still apply.
- Economic captures reserve freshness headroom for the admitted child window and age original observations through final derivation. The 1800-second age and 120-second cross-chain skew limits, source/base generation bindings and original reference clocks are unchanged. Globally clipped started children now retain capture-window-clipped and gain next-run priority; genuine local timeouts do not. The serial 30/90-second child and 180-second capture limits remain unchanged.
- Retained production sync-v9-supply-attribution metadata at 2026-10-19 06:08:45 UTC recorded wM at only 1476ms, wiTRY at 26729ms with persisted history progress, and XAUT at 1014ms with zero EVM requests. These diagnose separate causes, not successful post-change acceptance. XAUT transparency-stale remains an upstream rejection until a genuinely current original-dated issuer report exists.
- Previously rejected partitions may become admissible and affect attribution, scores or availability; formulas, weights and grade gates are unchanged. Activation is dated 2026-10-19 00:00 UTC (1792368000). Fixed-clock comparison and fresh production convergence/accepted-publication evidence remain release requirements; no deployment or recovery is claimed.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-22"></a>

## v10.22 - Exact UTC admission for mechanism-review evidence

**Effective:** 2026-10-18

Safety Score v10.22 lets mechanism overlays and independently reviewed components carry an exact UTC evidence timestamp, admitted at that instant rather than waiting for the UTC day to elapse. This is admission-timing only and score-neutral for all existing date-only reviews.

- Strict YYYY-MM-DD values retain next-UTC-midnight admission bit-for-bit. Exact YYYY-MM-DDTHH:MM:SSZ pins, optionally with milliseconds, admit when the scoring clock reaches the pin; future timestamps, timezone offsets and impossible dates are rejected.
- The 365-day expiry budget remains measured from the original review start: UTC day start for date-only reviews and the exact instant for timestamped reviews. Component-only evidence never renews whole-overlay metrics, measurements or sibling components.
- No existing overlay or component review dates are converted or renewed. Existing admission instants, grades, quality ladders, pillar weights and scoring formulas are unchanged. Future authored exact timestamps can make independently evidenced claims score-bearing earlier within their UTC day.
- Activation is provisionally 2026-10-19 00:00 UTC (1792368000), following the next-UTC-midnight convention; re-date effectiveAt at release. This entry does not claim deployment or production acceptance.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-21"></a>

## v10.21 - Coherent historical heads for economic supply attribution

**Effective:** 2026-10-16

Safety Score v10.21 aligns independently selected safe EVM holdings heads before reading economic supply quantities, so cross-chain partitions can satisfy the existing observation-skew budget without moving the oldest head forward or relaxing evidence admission.

- The observer first resolves every required EVM chain's reviewed lagged head at or before the scoring clock, capped at its actual finalized head where pending-history proof requires finality. Heads newer than the oldest timestamp plus the existing 120-second skew allowance are rewound to a canonical historical block at or before that bound, before supply and holding quantities are read.
- This changes the measured input acquisition path: a cross-chain partition previously rejected for independent head skew may become admissible and can change attribution, downstream scores or availability. Complete accounting, exact identity, canonical hash pinning, the 1,800-second age budget, the 120-second skew bound and original observation clocks remain authoritative; a failed alignment never fabricates quantities.
- On 2026-10-16, the adjacent bounded lease-acquisition wait was reverted because it overlapped attribution with :22/:52 publication and pushed compute past its 120-second publication deadline. Attribution now skips immediately and neutrally with v9-memory-lane-active when publication holds the lane. This is scheduling only: methodology remains 10.21 and economic-supply pin alignment is retained. Pillar weights, grade gates, supply conservation tolerances, reviewed deployment plans and scoring formulas are unchanged; release metadata does not rotate the semantic policy digest.
- Activation is provisionally 2026-10-17 00:00 UTC (1792195200), following the next-UTC-midnight convention; re-date effectiveAt at release. Fixed-clock admitted-input comparison and fresh capture/accepted publication remain required; no replay neutrality, mover totals or production recovery is claimed.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-19"></a>

## v10.19 - Allocation-weighted Morpho lender collateral-book risk

**Effective:** 2026-10-14

Safety Score v10.19 differentiates direct Morpho lender vaults by their measured NAV-accounted collateral books. Backing combines allocation-weighted collateral quality with LLTV-derived loss transmission, blends deployed and idle shares under the inherited-parent ceiling, and applies a separate Morpho-only 1%-of-NAV oracle materiality rule. Pillar weights, grade bands, parent caps, capital reuse and non-Morpho scoring remain unchanged. The release cut is not production acceptance.

- Admission covers 33 direct Morpho Blue lender-vault assets and 35 chain-local VaultV2/MetaMorpho V1/V1.1 deployments, including non-USDC denominations. Euler, Yearn, Aave and indirect issuer reserve holdings are outside this lane. The denomination remains the reserve principal; borrower collateral is not a new holding or dependency edge.
- Each included lender claim is weighted by its exact reconciled raw loan-token amount. An exact unique active chain/token match uses eligible Backing from the frozen previous accepted publication, never recursive scoring or a curator's letter grade. Otherwise authored class quality applies: native ETH 95, BTC wrappers, ETH LSTs and precious-metal receipts 85, yield/restaked ETH 80, major non-BTC/ETH L1 assets and their wrapped/staking receipts 70, synthetic dollars, principal tokens and yield-bearing stables 55, structured credit and other/unknown 35. Tracked quality wins whether higher or lower; exact-token class reviews also cover tracked collateral when accepted Backing is unavailable. Unknown is bounded U, not measured loss.
- The added fallback classes retain the existing eight class qualities: major-alt-l1 uses 70 for identified non-BTC/ETH L1 price and wrapper/staking dependencies below the BTC/ETH proxies; precious-metal-receipt uses 85 for custodial bullion redemption dependencies comparable to BTC wrappers; synthetic-dollar uses 55 for hedging, custody and liquidation strategy complexity comparable to stable-yield receipts. Exact chain/token identities are source-reviewed; no symbol heuristic, collateral recursion, parity guarantee or loss-probability interpretation is introduced. These three additional classes and the original exact-token collateral review cohort were approved under the owner's delegated autonomy on 2026-10-14 and ratified by council review.
- The 2026-10-14 exact-token collateral review contains 72 chain/token rows: the positive-allocation identities observed across the 34 successful deployments in the rerun smoke, plus five Robinhood identities retained in the 2026-10-03 reviewed wrapper-allocation market tuples at block 79450688 and corroborated by current explorer/issuer evidence. Robinhood WETH uses native-eth 95, syrupUSDG and spUSDG use yield-bearing-stable 55, USDe uses synthetic-dollar 55 and mGLO uses structured-credit 35. These five class reviews do not establish a new successful Robinhood producer book, refresh its historical quantities or prove a current allocation census. The smoke observation set includes simulated historical acquisition and is not a production publication or release-acceptance result. Fund, savings and nested lender-vault receipts retain their exact identities and class fallbacks; eligible frozen accepted Backing still takes precedence.
- For collateralized markets, transmission is LLTV squared and lender quality is 100 − LLTV² × (100 − collateral quality). The allocation-weighted book quality scales effective parent Backing on the deployed share; idle NAV retains parent quality. Reserve quality is min(parent Backing, idle share × parent Backing + deployed share × parent Backing × book quality / 100). Genuine collateral-free debt-bearing lending transmits fully; verified zero-parameter idle sentinels remain idle. The reserve contribution and concentration mirror share the adjusted quality without a second haircut.
- Admitted Morpho lender assets also admit complete same-parent multi-slice envelopes: reserve status and every slice must be required, known and live, all slices must map to the sole serial wrapper parent, finite nonnegative weights must sum to one within SCORE_EPSILON (10^-6), and residual weights must be zero. Existing wrapper-edge, parent availability, cycle, mixed-parent and dependency checks remain. Because these paths previously used generic reserves, effective quality is min(previous generic reserve quality, lender-adjusted quality), retaining generic structural reasons, unresolved evidence and rateability. The nonbinding path has zero-weight diagnostic factors, not a second haircut. Missing or unavailable books preserve the prior generic numeric path; non-Morpho behavior is unchanged.
- Multiple nonfungible deployments are evaluated separately and the lowest admitted deployment lender reserve quality binds. Every required deployment must be available. A later failed book read retains the last successful reconciled admission-valid observation for the same asset/deployments and unchanged reserve configuration within the inclusive 28,800-second policy budget, carrying its original pin/acquisition clocks, digest and generation. The actual failed attempt is frozen separately with a typed zero-weight A diagnostic; it cannot raise Backing by replacing a fresh measured book with inherited quality. Repeated failures never renew the book. Only after its original budget expires, or when no admissible prior book exists, does the unavailable book retain pre-v10.19 reserve scoring (inherited-parent or generic multi-slice, as applicable) with an unavailable zero-weight A diagnostic. This is not measured safe-book credit. A successfully measured all-idle book retains parent quality with book quality not applicable, still subject to any lower generic multi-slice constraint. Zero NAV is unavailable.
- The live producer runs inside the existing four-hour ERC-4626 reserve adapter, not during score preparation. At one finalized block, idle cash plus accrued lender claims must reconcile exactly to the source-accounted investment book: VaultV2 realAssets, otherwise MetaMorpho totalAssets excluding skimmable donations. VaultV2 additionally proves totalAssets = min(realAssets, _totalAssets + floor(_totalAssets × elapsed × maxRate / 10^18)), where elapsed is block timestamp minus lastUpdate, and records undistributedAssets = realAssets − totalAssets. Backing and oracle weights use the complete measured book including that buffer, without market-specific deductions, tolerance or an idle/dust plug. Original pins, code/source identities, amounts, residual diagnostics and typed outcomes persist in existing reserve metadata and frozen replay inputs. Book freshness is inclusive eight hours; previous accepted collateral scores retain their independent one-hour current-publication budget. Synthetic missing-book availability provenance carries fetchedAt 0, so only actual reserve fetches establish aggregate live-reserve observation freshness. No D1 schema migration or new public endpoint/card field is introduced.
- Oracle tier selection separately groups claims by deployment/core/market branch, combining accounts, and includes a branch at exactly 1% of source-accounted deployment NAV (realAssets for VaultV2, otherwise totalAssets), including idle and any undistributed buffer. Smaller branches remain disclosed and fully weighted in Backing but produce no binding weak-oracle cap. Unknown reviewed weights remain material. Unmatched or ambiguous positive claims disable the NAV exception and retain the pre-v10.19 reviewed aggregate with a diagnostic, not an invented opaque tier or new missing-kind obligation. The exception never worsens that aggregate. Only the exact reviewed vault-share NAV accounting path can receive the scoped guard exception. Worst material tier, authored completeness obligations, material caps and non-Morpho thresholds remain unchanged.
- Calibration counterfactual only: at Ethereum block 26191269 (2026-10-14 14:14:47 UTC), with the separately frozen later accepted Backing source at clock 1791989210 and other accepted inputs held fixed, KPK USDC Prime has book quality 88.7418377232, adjusted reserve quality 80.1217131799 and Backing 65.5486852720, implying 60 (C+) → 59 (C). KPK USDC Yield has hybrid book quality 62.8491909074, adjusted reserve quality 56.7442029224 and Backing 56.1976811690, implying 60 (C+) → 57 (C). Class-only Yield fallback implies 56, a separate scenario. These dimensionless quality scores are not loss probabilities or recovery forecasts, and these examples are not exercised full-cohort replay or observed release movers.
- Calibration counterfactual only: quantity block 26191269, hash 0xc492993fd90ab9821b6b1124f9f844a8f2230cfc74f45c76767a773359bb2db7, timestamp 1791987287 (2026-10-14 14:14:47 UTC), separately freezes the later accepted publication at clock 1791989210 for parent/collateral Backing and evaluates after both. With parent Backing P = 90.28629025 and zero idle, unchanged mechanism contribution 33.5 and inherited reserve-group weight 0.4 give Backing = 33.5 + 0.4 × R. Prime: book quality 88.7418377232, R 80.1217131799, Backing 65.5486852720, final 59.1631056365 → 59 (C), versus 60 (C+). Hybrid Yield: book quality 62.8491909074, R 56.7442029224, Backing 56.1976811690, final 56.6422714607 → 57 (C), versus 60 (C+). Accepted-score-unavailable class-only Yield: book quality 57.3901489066, R 51.8154364167, Backing 54.2261745667, final 56.1089263260 → 56 (C). These dimensionless scores are not loss probabilities or recovery forecasts.
- Hybrid Yield uses exact accepted Backing for savUSD 52.5, USD3/3Jane 64.53752 and ftUSD 59.61669994438998; siUSD uses yield-bearing-stable 55 and PT-siUSD principal-token 55, not iUSD Backing. Class-only fallback uses 55/35/55 for savUSD/USD3/ftUSD. A synthetic 20%-idle hybrid Yield book gives R = 0.2P + 0.8 × 56.7442029224 = 63.4526203879. Other accepted inputs remain frozen: Prime Exit 72, Yield Exit 70.24, Control 45 for both, and accepted peg/caps. This mixed-clock counterfactual does not claim those Backing scores existed at the quantity block, exercised end-to-end replay or observed production movement; the former hypothetical oracle-only 60→63 example is not a v10.19 promise.
- Prime's material rETH privileged-internal-pricing branch remains about 10.505% of NAV; OETH is standard-external with a disclosed peg assumption. Ignoring LsETH below 1% and weETH dust therefore does not establish a standard-external tier or Control uplift. Yield's material issuer/receipt-pricing branches likewise remain. Backing cannot rise under this formula; any oracle-only uplift or concurrent curation movement requires separate attribution.
- Pre-release evidence is a counterfactual replay of the 2026-10-14 17:44 UTC accepted capture with simulated historical lender observations (34/35 deployments reconciled, 11 published-score movers, no uplifts or oracle-tier changes) plus council review. Production differentiation starts only after the first post-deploy four-hour reserve run stores lender books and the next prepare/accepted publication consumes them; that first affected cycle must be observed before claiming acceptance. Older captures without lender observations retain explicit legacy-unobserved behavior; their neutrality is compatibility, not live differentiation or producer closure.
- Activation: 2026-10-14 22:00 UTC (release cut; 1792015200).

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-18"></a>

## v10.18 - Contributing-route partial evidence and reviewed research drain

**Effective:** 2026-10-14

Safety Score v10.18 narrows partial-evidence flags to contributing exclusions, admits source-bound ERC-4626 NAV references and executed smaller-probe lower bounds, bundles reviewed DEX, redemption and W1 evidence repairs, and records the W2/PKT-5 no-admission decisions. Pillar weights, grade gates, missing-data scoring, comparison policy and the USDT premium are unchanged; Track M is not part of this release.

- Route-exclusive A/B gaps on optional Exit alternatives that contribute neither score nor selected backup credit remain diagnostic without triggering partialEvidence. Gaps on scored or selected routes, whole-pillar exclusions, peg/methodology, wrapper-local and inherited-parent exclusions remain visible. HBD retains its genuine partial-evidence flag; no obligation or evidence fact is deleted by the presentation narrowing.
- Reviewed synchronous ERC-4626 shares without an admitted market price can use a same-block gross-NAV reference with fresh observed underlying valuation and original provenance. A canonical redeem that burns shares without funding output remains a typed diagnostic after invariant checks; up to five smaller probes may establish an exact executed lower bound. Settlement applies only to the executed input, not the unfunded canonical request. Previews, idle balances and a smaller receipt do not prove exhaustion; gUSDTq's genuine revert remains open.
- DEX repairs register CHFSAFO's exact Aquarius identity as supplemental non-exhaustive coverage and schedule maintenance when a published liquidity row is absent, without inventing zero liquidity. Reviewed pinned targets cover retained pools on already-active venue families for USDF, asUSDF, GGBR, mRe7YIELD, rUSD, EUR0 and ZARm; quote-time identity and execution gates remain mandatory and shadow pools stay score-ineligible. Liquidity v6.95 records that domain's changed active reviewed cohort.
- Redemption v4.5 withdraws unsupported capacity, settlement and eligibility assumptions on the reviewed Avalon, Youves, hyUSD, wARS, Solayer and pathUSD routes. PKT-9 existing-route research establishes no new config-only bound; legal entitlements, processing targets, fee components, idle cash and previews remain distinct from funded capacity, final completion and all-in cost evidence.
- W1 evidence integration applies six operations: three scoped incident-negative reviews (USDC/Mantle, DAI/Scroll and scrvUSD/Etherlink), two ONED wrapper-local reviews and PAXG's structural maturity-applicability fact. The proposed bbqUSDC oracle-profile refresh was deferred on evidence-lineage review and is not part of the applied wave. Admission remains scope-, chronology- and source-bound; no sibling question, executable capacity or expired observation is refreshed by these reviews.
- The W1 reviewed research ledger records 833 decisions: 3 promote, 72 reject and 758 defer. These are research dispositions, not 833 closed facts or publication proof. Durable Paxos assurance-module discovery retains evidence-strength and original-clock gates; oracle review Confidence remains distinct from pillar Evidence. Supply-weighted grade framing and all-pillar averages are presentation changes, not new scoring or global comparison permissions.
- W2 re-researched 102 W1-deferred groups; zero operations passed independent review and all 102 remain deferred with sharper blockers. The combined W1+W2 ledger contains 935 decisions. W2 retains 23 pinned veto observations: paused M Portals on Optimism/Sei, a paused USDS Avalanche adapter, cUSDO's 2-unit inbound limiter on Base, closed sDOLA CCIP lanes, and sUSDe and sfrxUSD zero-peer channels. These observations block the proposed evidence promotions; they do not create new runtime or curation admissions.
- PKT-5 owner ruling of 2026-10-14: no shadow DEX family met its documented maturity gates, and none activated. W2 and PKT-5 add no runtime or curation change, so the accepted-pair equivalence numbers below are unchanged. These research outcomes belong to the single v10.18 release, not a new methodology version.
- Final accepted-pair impact: A′ is accepted publication report-cards:v9:v1:7dea3b5da499d17cff9357aa5763065c26a00c3bd67dc6d6ee5523f96dc609a8 at clock 1791967608; B′ is the distinct accepted publication report-cards:v9:v1:a9afef4d… at clock 1791973073. These two qualified accepted-publication captures are 5,465 seconds apart, exceeding the required 5,400 seconds. Base main code and curation versus this branch shows zero score, grade or rating-status movers and zero grade flips on both captures, with both the embedded captured registry and current curation through attributed registry mismatch. Partial-evidence cards fall from 55 to 47 on both, clearing ftusd-flying-tulip, gldt-gold-dao, jpysc-sbi-startale, sbc-brale, sfrxusd-frax, usda-anzens, usdso-somnia and usdy-ondo-finance.
- Open evidence obligations fall from 3,613 to 3,606 on A′ and from 3,607 to 3,600 on B′; unresearched obligations fall by seven on each. The current-redemption scenario, including the redemption config corrections, also shows zero movers. These fixed-input accepted-pair results do not establish producer-dependent gap closure or production health.
- Activation: 2026-10-14 12:40 UTC (release cut; 1791981600).

Origin: Contemporaneous release record

Commits: `be1845c05`, `7d3cb1be2`, `a6b01c251`, `47e87ecc7`, `1b9e00fc3`, `390151db0`, `1a0ba88e0`, `143d0575b`, `5cedffe8c`

<a id="scoring-v10-17"></a>

## v10.17 - Scoped incident research and independent evidence admission

**Effective:** 2026-10-11

Safety Score v10.17 expands independently scoped evidence admission and repairs missing-data attribution across Backing, Exit and Economic Control. Practical incident research, request-specific exit terms and current source-bound facts can move scores, grades and availability. Pillar weights, grade gates, materiality thresholds and freshness budgets are unchanged.

- Bridge route/controller metadata alone leaves incident state unknown. Practical no-known-incident research searches issuer notices, independent incident/rail disclosures and exact-deployment explorer events/emergency state, not a lifetime event census. Displayed explorer events, the same explorer's JSON API, or bounded pinned exact-contract logs with creation evidence and verified-ABI filters satisfy the event surface. Known integrity incidents, active pauses and unresolved adverse primary findings bar negative review. Confirmed exact-control incidents with unknown historical exposure retain local active, mitigated or resolved posture, without invented shares, sibling history or unrelated root-mint seasoning.
- Operational-resilience criticalControlFailure requires established global-claim loss scope. Critical exact-control/deployment signals keep their local adverse treatment and independently admitted nullable materiality instead of vetoing whole-asset credit. Global critical failures and independent opacity, impairment, depeg and dependency blockers remain binding.
- Complete dated published fee maxima/formulas can establish conservative request-specific cost bounds with admitted fresh native-currency FX; sampled quotes and partial tariffs cannot. Eventual full-supply issuer routes apply a reviewed route-cost ceiling, with its minimum and fixed charges, exactly as hot-buffer routes do; documented-variable fees without a ceiling stay unquantified. Contractual receipt-day business guarantees use the full reviewed jurisdiction-calendar horizon and distinguish completed access prerequisites from unresolved payout conditions. Above-budget bounds grant no within-budget capacity or exhaustion proof.
- Exact-request wrapper execution receipts can establish sufficient completion lower bounds without claiming exhaustion. Reviewed external-share custodian rails, gross-preview/gross-return conventions and fixed delegatecall dependencies retain actual net-output/share-burn, gas, freshness and request-generation gates. Synchronous ERC-4626 receipts admit a redeem-time share-supply excess only when the identical pinned receipt proves exactly that many fee shares minted to the vault's configured fee recipients; holder burn and realized output stay exact, and conservative conversion-view rounding no longer fails a successful receipt. Fresh admitted current output prices and same-block gross-NAV share valuation close only their exact valuation questions; quiet peg history, nominal par, stale quotes and partial baskets do not.
- Admitted exact-channel suspension is measured adverse D with zero credited capacity, not synthetic unknown route-factor obligations. Independent alternatives remain evaluated and a scoped whole-Exit census witness stays when their same-notional evidence is absent or immaterial. Foreign provider rows cannot create this asset's bridge authority or poison an already-admitted exact provider partition.
- Independent oracle-kind, native external-transfer, hardware-wallet storage, wrapper-local and mechanism-component reviews bind only their own current scope and evidence clocks. They grant no unreviewed feed/quorum/controller closure, MPC/HSM relief, executable capacity or renewed sibling metrics. Named agreed-upon-procedures composition enters only at static-validated historical strength, not financial assurance or current-book coverage.
- Admissible reviewed reserve composition is independent of supplemental-producer fallback-census membership. Exhaustive reviewed economic plans can convert exact immutable ERC-4626 shares using independently fresh same-holding-block convertToAssets proof. Original reserve/disclosure clocks, same-run capacity/output bindings and freshness remain authoritative; captured stale supply/peg/live-factor rejections and explicit unavailable or nominal-only producer verdicts carry exact scoped A. Absent uncaptured verdicts remain U, and no failed read becomes observed supply, current price or nominal parity.
- Research transport, bounded DEX producer-clock/probe rotation, source-identity repairs and shadow-only collector enrollment add no scoring permissions by themselves. Lossless witness/fact wire interning and runtime memory reductions retain every obligation and semantic fact, with unchanged publication limits; they do not establish production resource acceptance. Producer-dependent gap closure still requires fresh admitted publication.
- Owner ruling: the USDT `market-anchor-longevity` premium (12 points, 87 maximum) no longer requires a B+ base score, all-strong pillar evidence or operational-resilience eligibility with stress-redemption and reserve-reconciliation credit. It still requires market rank 1, at least 120 months, exit score at least 70, a clean peg, no other cap below 87, every pillar included with at most limited evidence, an observed resilience result and no operational danger blocker; issuer opacity alone no longer withholds it. Dependents still inherit the pre-premium score.
- Control mint limitations keep their exact aggregate-mint, reconciliation and applicability C/U/B witnesses when a reason carries a deployment anchor, so closing independent scoped control questions cannot erase a remaining mint limitation or bypass the insufficient-evidence Not Rated withhold. Formula thresholds, danger exceptions and evidence admission are unchanged.
- Release impact: production capture report-cards:10.16:1791726326 (clock 1791726397, 396 cards) replayed at the v10.16 base and at this release with current-redemption rederivation. Not Rated falls from 28 to 22: seven assets gain a rating from admitted reviewed reserve compositions and mMEV once its settlement gap became a researched conditional bound, while two enter Not Rated because their remaining limiting control causes (unresolved bridge incidents, an unresolved aggregate mint review) now carry witnesses. 35 grades move, 22 up and 13 down: USDT rises from B- 69 to A- 81 under the longevity premium ruling, FIDD from B 73 to A 84, PAXG from B+ 79 to A- 81 and IDRX from C+ 63 to B 71; HCHF falls from B 73 to C- 53 under its published 100% protocol-deduction ceiling. 25 partial-evidence cards clear and 25 gain pipeline-unavailable exclusions, chiefly the four Paxos products and their dependents, whose production reserve fetch fails on discovery pins this release replaces, and unavailable peg producers. Excluding the bridge-control obligations that the corrected incident default newly surfaces, open A, B and U items fall from 1,395 to 1,238, with 220 previously unresearched items closed or researched. Bridge incident state no longer defaults to none: 623 exact negative incident reviews and 17 reviewed incidents establish it where researched, and 404 bridge controls remain unresolved.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-16"></a>

## v10.16 - Conservative implementation age across variant layers

**Effective:** 2026-10-10

Safety Score v10.16 aligns production track-record inputs with the documented implementation-age policy. Half-year launch periods, scoring-date clamping and the newest required variant-chain layer now use the shared resolver. Scores, grades and availability can move; pillar weights, age thresholds and grade gates are unchanged.

- Implementation age resolves implementationLaunchDate with launchDate fallback for each visited child and parent layer, then selects the newest conservative date across the variant chain. Cycle detection bounds traversal; a repeated layer is not counted again. Missing or invalid dates retain the shared resolver's existing behavior.
- Production baseline construction uses buildSafetyScoreV9BaselineExtensionFromNormalizedInput in worker/src/lib/safety-score-v9/extension.ts and resolveEffectiveImplementationLaunchDate in shared/lib/classification/resolve-implementation-launch-date.ts; the resolver's date becomes UTC midnight before whole-UTC-calendar-month scoring.
- Year, month, quarter and half-year dates use their inclusive period-end UTC date, capped to the fixed scoring asOf date. Future fuzzy periods therefore claim zero whole months rather than becoming unavailable, and YYYY-Hn dates no longer fail parsing. Compiled launch timestamps are normalized to UTC midnight; the evaluator's whole-calendar-month calculation is unchanged.
- This repairs score inputs rather than adding launch evidence or changing authored catalog dates. Two accepted production captures from 2026-10-10, at clocks 1791650822 and 1791656320, were replayed at the same fixed clocks against v10.15 and v10.16. Each retained 396 cards with no score, grade, rating-status or pillar-score changes and no quarantines.
- sDAI Gnosis implementation age falls from 36 to 11 months and adds a nonbinding 84-point track-record ceiling; it remains C+ at 62. syzUSD age falls from 12 to 1 month and its nonbinding ceiling falls from 84 to 79; it remains D at 44. Both changes follow the newer required parent implementation, while lower parent limits continue to bind. sUSDS selects its parent's one-day-later launch without changing its 24-month age or C+ score of 60. Seven fuzzy launch timestamps normalize to UTC midnight without changing whole-month age. These frozen-input results do not establish post-release production health.

Origin: Contemporaneous release record

Commits: `da777b20b`

<a id="scoring-v10-15"></a>

## v10.15 - Undiluted dependency losses and stricter evidence admission

**Effective:** 2026-10-10

Safety Score v10.15 can move scores, grades and availability by correcting dependency-loss normalization, measured exit costs and reserve admission. It also removes inactive F policy settings, deliberately rotating the semantic policy digest without changing active F admission. Pillar weights and grade gates are unchanged.

- Excluded evidence events no longer dilute measured dependency losses or bounded uncertainty. Binding exit, control and oracle dependency limits retain their measured-adverse attribution, evidence and causes through subsequent dependency hops.
- A measured execution certificate at the exact request cost budget receives zero cost credit, not an unknown-cost midpoint. Fresh finalized DEX quotes are admitted against their source evidence rather than collection-time coincidence; Curve routes must retain physical-pool identity and the reviewed 3pool input cohort.
- Locally empty DEX observations establish global no-exit evidence only with current exhaustive deployment coverage reconciled to aggregate supply. Every deployment supply observation must independently fit its inclusive 1800-second budget; unavailable aggregate supply cannot support economic attribution or monetary materiality.
- Reserve admission retains Djed and Youves quote-quality warnings and rejects unqualified future valuation clocks. USDtb coverage shortfalls and unreadable Reserve Protocol collateral-plugin status cannot publish clean independent backing evidence. Makina composition uses gross-asset exposure weights with financing identified separately; Falcon unknown exposure uses the complete measured book.
- JupUSD holdings with missing or invalid unit scales withhold complete-book reserve totals, coverage and unknown-exposure statistics. Malformed Sky group debt rejects the shared DAI/USDS book. Unjoined USDD history clocks cannot establish composition freshness, and corrupt stored warnings fail closed for the affected asset.
- Dependency and reserve prepass failures quarantine only the affected asset. Aggregate not-applicable oracle exemptions require independently current evidence and verified oracle-profile confidence; non-verified profiles cannot establish the exemption. Fresh bridge semantic questions retain control and inventory uncertainty unless exact admitted closure or independently proved adverse reach takes precedence; inconsistent quorum observations are rejected.
- Authenticated OFT nonce prefixes are required before checkpoints advance; poisoned prefixes rebuild within the existing bounded history budget. Chain-maturity relief waits for review-day completion and recorded supporting evidence access, including withholding when access metadata is absent. Incident resolution cannot postdate review or remediation verification.
- Deleting inactive F policy knobs rotates semantic policy identity only: active scoring, D/F admission, caps and availability logic are unchanged by that deletion. Access-policy vocabularies must contain each canonical value exactly once. Compared with v10.14, evaluation-build identity pins the complete offline candidate runtime import closure, including captured fixed-input normalization, extension/fact-set compilation, evaluation/projection and previously omitted executable admission leaves; capture-only network observers/producers and build-time generators are no longer pinned. Reviewed score-input data and full-catalog bytes/decoder remain bound. Asset-local common-mode reasons no longer embed peer counts or quality; neutral registry-digest consolidation preserves existing registry digests.
- These are score-moving input and attribution repairs, not newly observed incidents or completed evidence promotions. Fixed-clock captured-input replay, mover attribution and owner review are required before release. Producer-dependent outcomes additionally require fresh admitted observations; no replay equivalence, mover totals or production-health result is claimed.
- Activation is provisionally 2026-10-11 00:00 UTC (1791676800); re-date effectiveAt at release

Origin: Contemporaneous release record

Commits: `c3eac8bb3`, `768217323`, `c8d085f00`, `f56e2cce1`, `b225ea90b`, `83ecaf437`, `4767326e3`

<a id="scoring-v10-14"></a>

## v10.14 - Scoped evidence repairs and bounded census admission

**Effective:** 2026-10-09

Safety Score v10.14 advances from the restored v10.12 without reusing the released-and-reverted v10.13. It bundles the already-main PR #1366 repairs with reviewed wave-3 bridge identity, local-fiat fees, oracle witnesses, route chronology and census integrity/resource rulings; pillar weights and grade gates are unchanged.

- PR #1366 evidence repairs: missing-pillar-evidence projections defer to the compiled fact-gap path instead of crashing missing-data/worklist generators. Expired bound mechanism evidence degrades to stale, required, null quality with scoped causes and dated history instead of quarantining the asset; malformed identities still fail asset-locally. partialEvidence retains every diagnostic root of whole excluded pillars without changing scoring or weakening the projection invariant.
- PR #1366 producer repairs: reviewed supply observers yield only to complete, current, aggregate-reconciled provider proof, never a positive partial subtotal or omitted zero leg. Successful non-exhaustive DEX emptiness reports deploymentCensusNonExhaustiveProvider, not an outage, and cannot certify absence. Nest USDG emits its asset-specific nest-vault-positions:usdg key and reviewed dependency; unfamiliar tokens retain the unknown key. Producer-dependent closures require fresh admitted observations.
- Bridge identity: admit current, source-bound exact bridge-representation deployment identities from reviewed route rows into exhaustive wrapper identity reviews. Native Mint Authority ownership is unchanged; stale, missing, partial or mismatched routes remain blocking. Immutable representations can resolve local contract mutability; exact proxies can satisfy independently reviewed fixed-face accounting identity prerequisites without immutable-root credit.
- Local-fiat costs and outputs: reviewed native-currency flat/percentage components, native-notional tiers and minimum/maximum caps use only admitted FX peg references captured at the scoring clock. Missing, stale, future, static or unadmitted FX fails closed without evaluator rate fetching. Absent percentage ceilings and unavailable component FX have distinct cost reasons. FX newer than route evidence beyond the shared schema tolerance is left unpinned for captured fact-build valuation instead of invalidating the redemption row. Exact single non-USD fiat identities are also read on issuer-scoped eventual-redemption routes, not only immediate issuer redemption. Incomplete tax, account-history, payout-count and token/lot schedules remain gaps. Existing USD schedules, captured request-point fee precedence and independent capacity/settlement requirements are unchanged.
- Oracle witnesses: admit missing oracle-profile work for protocol-position, shared-reserve and UCITS/TRS fund archetypes, matching required-profile producer scope. Otherwise unassigned opaque-topology reasons bind the exact oracle-tier gap for causal responsibility and bounded-uncertainty attribution. Existing witnesses and numeric ladders remain; missing evidence implies neither a safe feed nor measured adverse topology. Hyperithm's unchanged D-range candidate can publish with its genuine U tier witness rather than unattributed NR.
- Route-review chronology: date-only redemption coverage, factor, documented-capacity, settlement and channel-suspension reviews admit only after their reviewed UTC day ends, matching mechanism/output and cause reviews. Timestamped reviews retain their exact instant. Observation clocks, expiry windows and separately observed live/exact execution are unchanged; exact supersession adds no second admission day.
- DEX census persistence: preserve already-classified deployment outcomes when a completed discovery crawl exhausts its finalization-tail budget. Provider authority and original clocks remain; non-exhaustive emptiness cannot certify absence. Existing admitted routes, measured-execution history and target rotation are unchanged. Fresh production census and deployment-supply proof are still required to close Exit coverage gaps.
- Transfer census: bound exact-input independent-liability capture to whole-asset/shared-chain cohorts, source-clock fair rotation, settled three-chain cancellation, a 180-second network window, inherited preparation/slot deadline reserves and bounded hash-pinned RPC chunks/body/output sizes. Deferred, timed-out and unobserved deployments remain unknown; no partial partition or zero supply is synthesized. Schedule, connection peaks, published supply and evidence freshness are unchanged.
- Documentation only: retain the separate inclusive 120-day reserve-composition admission and 100-day mechanism-assurance windows. No window, request grid, capacity/settlement evidence, replay-equivalence, mover, gap-closure or production-resource result is inferred from this version bundle. Fixed-clock integrated replay and fresh producer/production observation remain release obligations.

Origin: Contemporaneous release record

Commits: `9d4e453ea`, `81ea3eaff`, `414af922b`, `6bf5be0c3`, `55f75c1b7`, `a1ec828fd`, `a844334cd`, `6ec5c2724`, `2bb1dc7ca`

<a id="scoring-v10-12"></a>

## v10.12 - Research-only exact orderbooks and source-bound reserve inputs

**Effective:** 2026-10-08

The coordinated retirement release closes exact orderbook admission to research-only/diagnostic and corrects reserve quantity, source-clock and redemption-evidence inputs without activating staged reserve or DEX scoring cohorts.

- Retire the dormant exact Kraken request observer and review-producer arm. Public books do not establish same-run account, deposit, withdrawal, fee or maximum-settlement gates. Historical orderbook model identifiers, gates and basis vocabulary remain interpretable; no current reviewed Kraken exact model existed.
- Existing Securitize and synchronous ERC-4626 admission, generic direct-orderbook-depth/CoinGecko synthetic books, exchange spot prices and pool/TVL/supply accounting remain separate and unchanged by the orderbook closure. The separate Liquidity v6.93 / Pricing v6.44 cutover removes ticker-derived synthetic liquidity while retaining price-only exchange evidence.
- Reserve producer contracts retain native CAD/QCAD and GBP/tGBP quantities on their reviewed nominal basis, never USD; ETH supply telemetry keeps its own diagnostic clock rather than implying whole-reserve freshness. Single-asset bindings use v2 and the six Chainlink bindings use v3 with original clocks and typed unavailable reasons.
- BC3M has a source-reviewed 86,400-second inclusive reserve-to-every-pinned-circulation-block allowance, grounded in its own Chainlink heartbeat and Backed daily/10% reporting disclosure. A ratio requires complete same-run inventory-adjusted on-chain circulation/API reconciliation and is withheld beyond that allowance; original clocks remain. BIB01 stays quarantined with no policy or activation change. Missing source-specific temporal review still emits reserve-supply-temporal-policy-unreviewed, with no gross-supply fallback or borrowed TUSD bound. The allowance is not simultaneous reserve/liability attestation, a production observation or scoring activation. Unsupported reserve-snapshot redemption envelopes are removed; genuine River exit telemetry and active Origin vault/redemption remain. These input corrections may affect availability or downstream scores only after fresh admitted evidence.
- Retired Solidly diagnostics and unavailable/stale proof packets grant no exact Exit credit. Surviving Base/Optimism stable capabilities remain explicitly non-scoring; no C01/C02/Curve/native cohort activation or further MYRC independent-evidence promotion is authorized. MYRC retains the upstream released independent-assurance adapter, exact report/source identities and original freshness gates. Static and weak reserve source classes remain outside independent scoring admission.
- Neutral captured-input replay is required before release; newly admitted producer evidence additionally needs original-clock production observation and attributed fixed-clock comparison. No replay equivalence, mover, gap-count, resource or production-health result is claimed here.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-11"></a>

## v10.11 - Evidence-scoped redemption factors and live-reserve provenance closure

**Effective:** 2026-10-08

Safety Score v10.11 preserves explicit route-factor gaps, requires completed-endpoint support for settlement scalars and keeps costs bound to each request. Live-reserve/redemption provenance and observer repairs tighten evidence integrity without changing pillar weights, stress requests, portfolio coverage or grade gates.

- Exact-route missing capacity, settlement and cost terms override captured known statuses unless strictly newer admitted exact execution evidence exists for the same rail/model/request. Scalar settlement needs dated current settlement-supporting completed-endpoint evidence; processing, cooldowns, target D+1 dealing and conditional calendar terms cannot create a completion maximum or revive a persisted generated SLA.
- Point execution costs retain their own notional/cost-budget identity. An observation-level scalar applies only when requestedNotionalUsd and maxCostBps both match; other points recompute from bounded terms. Minimum charges are not maximum fee evidence. Zero issuer/fund fees remain scoped and do not establish net proceeds or zero bank, partner, network or differently scoped queue charges.
- Producer/provenance cutover: valid matching configuration fingerprints and schema-v2 accepted reserve envelopes/consumed manifests preserve original freshness mode and invalid-source diagnosis. Future fetch clocks and malformed nested claims fail closed; missing members remain explicit null snapshots. A fresh full-cohort reserve seal followed by redemption recomputation is required, never immutable-row backfill. Independent nested on-chain route evidence does not upgrade timestamp-less reserve composition.
- Direct observer lanes keep protocol-specific guards: Lido, Monetrix and Saturn are diagnostic-only; USDfr measures the restricted par-state USDC controller, while funded apyUSD receipts are eventual-only after same-run payout valuation. No reserve/NAV/static fallback supplies missing execution, and all-in/gas proof remains separate. Reservoir's three holder routes retain one shared USDC resource rather than additive backup liquidity.
- Payload identities, not new score formulas: public breakdown/publication schema 7 and API wrapper 8 require typed routeId and lane on primary/alternative Exit rows; persisted v6 is rejected until a compatible accepted publication. Consumed reserve schema 2, supply-input metadata, request-point costs and sharedResourceKey require fresh producer/publication baselines, not rewritten historical bytes.
- Frozen October 7 replay (asOfSec 1791402404, same input) has 11 intended grade/status changes: eutbl-spiko B- to C- (65 to 52), safo-spiko-usd C+ to C- (64 to 52), ustbl-spiko C+ to C- (63 to 52), uktbl-spiko C+ to C- (64 to 53), spkcc-spiko C to C- (59 to 51), eursafo-spiko C- to D (54 to 47), eurspkcc-spiko C- to D (52 to 47), hbusdt-hyperbeat C+ to C- (61 to 50), cash-phantom C- to D (53 to 47), mmev-midas D to NR and syusd-aegis NR to D (49). Unsupported scalar withdrawal and explicit gaps cause the exit changes; CASH's combined Treasury/government-MMF holding is conservatively other, not a proved Treasury-bill instrument.
- syusd-aegis NR to D is a pre-existing causal D-rating-gate effect, not improvement: Exit remains 35. mMEV's pre-existing missing capacity/cost/settlement review now limits evidence and triggers withholding. uktbl's unchanged cap stops binding below its limit. savUSD Exit falls 54.51 to 35 without a grade change; FPI Exit falls 68.65 to 66.02 from request-cost identity, still D. Frozen replay does not certify new live observers or post-release production health.
- Route curation retains legal eventual-only entitlements without immediate capacity, correct issuer/third-party fee scope, exact output branches and documented gaps. EURR's selected StablR issuer channel is suspended as of June 24; route retirements preserve historical identities. Local redemption-factor changes do not clear exit-portfolio-coverage, which remains an independent DEX census/exact-observation obligation.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-10"></a>

## v10.10 - Distinct evidence obligations, known reserve bounds and researched incident absence

**Effective:** 2026-10-07

Safety Score v10.10 counts distinct per-card evidence obligations while retaining every scoring witness, publishes fully determined reserve-bound factors as known, and admits independent exact-scope researched-negative incident reviews (wave-5 owner approval 2026-10-07). Producer repairs restore source identity, partial vault execution, EUR output references and batched Solana censuses without changing their scoring or evidence-admission rules.

- Distinct obligation accounting (wave-5 owner approval 2026-10-07, KPI_DEDUP): each exact sourceGapId counts once per card and responsibility owner. A source-less singleton causal view aliases only a matching root already present as a source under that owner; unmatched inherited roots, synthetic and multi-root views remain separate, with no cross-card or label-based deduplication. Any critical witness makes its obligation critical once and reason-code lists retain every witness code. Public facts and totalFactCount keep witness semantics; scores, grades, caps, NR witnesses and evidence admission do not change. Activation requires a newly computed accepted publication before consumers enforce obligation-count validation; old duplicate-root witness summaries are not silently reinterpreted.
- Fully determined reserve-bound factors (wave-5 owner approval 2026-10-07, RESERVE_8): a raw-null liquidity or maturity factor publishes known with every supporting reference only when the existing evaluator's selected admitted bound has coveredShare === 1 and non-null coveredQuality. Contractual maxima, complete gross-reconciled observed rosters, whole-position liquid availability, gross-reconciled final fiat-USD realization and binding business-calendar guarantees reuse existing resolver admission. Raw horizons/maxima stay null; partial bounds are never summed, and a selected stronger partial bound cannot borrow a weaker full bound's coverage. Exact exposure, generation, freshness, applicability and contradictory-contract gates remain; partial, stale, future, rejected, unmatched and nonbinding bounds retain gaps. Quality ladders, weights and scores are unchanged.
- Independent researched-negative incidents (wave-5 owner approval 2026-10-07, MINT_CTRL_1): dated no-known-incident research may resolve only a matching unknown incidentState for one exact compiled control key or one exact deployment and control kind. Issuer status/announcements, exact-deployment event history and independent incident-tracker searches require source excerpts/locations, observation times, reviewer and an honest finite researched window. Both review and window end must fit the existing reviewed-research age budget; date-only reviews enter only after their UTC day. Actual active/resolved and existing same-kind control incidents retain precedence, deployment scope never resolves global controls, and unrelated authority, custody, reach and source gaps remain. Empty registries, audits alone, known authority or truncated-history searches do not prove absence; aggregate complete-review absence keeps its existing behavior.
- Producer repairs, not new scoring rules: only five source-pinned DefiLlama Hyperliquid rows (USDT, USDe, M0, frxUSD, rUSD) map to exact reviewed HyperEVM ERC-20 identities; genuine HyperCore USDC, captured quantities, denominators and ambiguous competing routes are unchanged. For reviewed non-binding-zero ERC-4626 max functions, the largest successful same-block ladder execution can size the existing single partial retry even with zero idle underlying; the retry must actually prove output transfer and share burn and remains exact-lower-bound, never exhaustion or full completion. ERC-4626 observations project only the generation-bound canonical receipt while certificates retain all independent grid receipts, with no interpolation, clamping or summing.
- Producer valuation and census repairs: EUR certificate output references combine observed token USD market prices with fresh source-timed generation-bound EUR/USD expected value, never nominal EUR-as-USD or assumed par; missing, future or stale FX withholds the reference and generic reserve-adapter non-USD capacity stays unvalued. Solana independent-liability censuses collect up to 100 mints in one finalized getMultipleAccounts context with shared block-anchor reads, retaining per-mint owner, decimals, quantity, slot and original block-time checks and rejecting incomplete or future batches without partial-partition credit.
- Release impact: distinct-obligation accounting is not new evidence, and known reserve-bound status is not a change to the existing quality calculation. Incident-state changes require admitted exact-scope research; producer-dependent closures require fresh accepted production observations rather than rewritten frozen captures. On the accepted capture of 2026-10-07 (clock 1791398898, 396 cards) replayed at the release tree against production code and curation, open data points fall from 2,864 to 2,744: Not yet researched 1,441 to 1,378, issuer-undisclosed 1,347 to 1,292, awaiting curation 56 to 54, data feed failed 20 unchanged; measured adverse stays 234 and there are no quarantines. Grade movers: frnt-wyoming NR to D (49) on a verified full reserve roster, zaru-blocktower F to D (36 to 42) on a dated whole-supply reconciliation; senpyusdprimev2-sentora and sparkusdtbc-spark C+ to C and steakusdg-steakhouse C to C- reflect 2026-10-07 date-only mechanism-overlay replacements not yet admissible at that clock, whose admitted effect starts with the first capture after 2026-10-08.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-09"></a>

## v10.09 - Current route evidence and consistent control qualification

**Effective:** 2026-10-06

Safety Score v10.09 requires current open attribution for dynamic immediate redemption credit, preserves unquantified documented costs in frozen captures, and aligns custody-only questions and allocation completeness with their stated evidence boundaries.

- Dynamic live-direct atomic or immediate rails without same-run open status from on-chain or protocol-API evidence remain diagnostic even when their producer sets scoreEligible false; the discounted redemption path cannot bypass that gate.
- HBD conversion costs remain disclosed but unquantified until haircut-adjusted proceeds are established. Frozen documented rows cannot restore a numeric cost bound that the current review leaves unquantified; measured execution retains its separate evidence path.
- Custody-only questions retain unknown key custody without invalidating independently established issuance governance or operational process; semantic questions continue to gate qualification. Allocation coverage uses the same 1e-9 unit-weight tolerance as reserve admission.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-08"></a>

## v10.08 - Authenticated bridge in-flight accounting, exact vault unwinds and honest control questions

**Effective:** 2026-10-05

Safety Score v10.08 removes engineering blockers behind facts published as Not yet researched: authenticated pending-message readers for CCIP, LayerZero OFT and canonical rollup bridges, exact-complete instant ERC-4626 unwind certificates, applicable perpetual maturity, reviewed business-day calendars, weighted quorums, conservative maximal-reach control scopes and new census, identity and DEX shadow producers. It also stops ignoring fresh reviewer questions on controls. On the accepted production capture of 2026-10-05 (clock 1791184659) published Not yet researched facts fall from 1,476 to 1,446 and researched non-disclosure rises from 1,211 to 1,364; further producer closures follow the first production runs. Six scores move, none quarantined.

- Weighted quorums and maximal reach: a fresh, verified, exact-controller-bound weighted quorum is known multisig topology, measured by the minimum cryptographic signature set, with XRPL master-key and RegularKey bypasses and review freshness retained and no human-independence credit (owner decision W4-D2). Verified arbitrary-call executors (Safe-style execute, MultiSign, EIP-7702 delegators) can be reviewed as complete maximal-reach scopes that grant every reachable capability with global, unbounded-loss semantics and the executor's minimum enforced delay, never exclusions or benign-target credit. RLUSD's topology and MultiSign/NTT administration facts close with its score unchanged; senRLUSDv2 and senPYUSDmain move from 61 (C+) to 44 (D) because their proven worst-case allocator reach replaces an unknown mint rung.
- Reviewer-scoped control questions (owner decision W4-D9): a fresh open question no longer disappears through known-semantics or access-only shortcuts; complete closure-proven execution scopes and proven adverse global paths keep precedence. Questions carry a typed subject (authority semantics, execution scope, key custody and independence). Custody questions keep only the key-custody factor unknown. About two hundred previously hidden questions became visible; their custody factors were researched against issuer, audit and custody-provider disclosures and are published as non-disclosure (C), disclosed-but-unrepresentable hardware-wallet or vault custody (B), or curated MPC/HSM custody where a primary source names the exact key. Semantic questions blocked on incomplete incident reviews stay U.
- Bridge in-flight accounting (owner decision W4-D1): economic supply plans can reconcile value in flight from authenticated CCIP (1.5, 1.6 and 2.0.0 lanes), LayerZero V2 OFT/OFTAdapter and OP-stack/Arbitrum canonical bridge histories. Indexers are discovery only; every counted message is proven from finalized on-chain sends, delivery or execution state and nonce or sequence continuity, executed messages are excluded, failed or uncredited ones stay owed, and incomplete or unprovable history rejects the whole read rather than publishing zero. Escrow minus receipts is never in-flight. TON jetton and Aptos/Movement fungible-asset supply reads, endpoint log-span and batch capabilities, and a five-connection-safe producer sized for a 96-asset cohort support exhaustive plans; the first plans (XGLD, srUSD, wiTRY, syrupUSDT, sUSDat, sDOLA) admit once production bootstraps their histories.
- Supply censuses: a deployment on a chain whose final head is at least fourteen days old on two independently queried, agreeing endpoints is admitted at its final head as a frozen liability with halted-chain provenance and retained bridge risk (owner decision W4-D6). Seven burn-mint assets omitted by the market-data provider (USBD, USDai, USDz, USSD, WARS, WCLP, YUSD) use a complete independent-liability census, and USDC's XLayer row is split by an exact two-contract partition; until production collects these censuses the enabled assets fail closed. Kava USDX gains a typed native-denom deployment with height-pinned Cosmos bank and IBC escrow reads.
- Applicable perpetual maturity (owner decisions D-11 A, W4-D3): perpetual securities and open-ended fund shares are a known applicable duration in the longest maturity band (48), never 0, not-applicable or a fictional finite maximum; fund redemption speed stays in liquidity. Fourteen exact exposures close without score change.
- Business-day settlement (D-12, W4-D4): reviewed jurisdiction calendars bound T+N terms by walking every admissible submission instant, including multiple holiday clusters, and fail closed beyond reviewed coverage; conditional or target terms stay unknown. Native-inventory dust (W4-D5): an exhaustive reviewed native census with every unmatched row at or below 1e-5 of supply closes the empty bridge tier while the dust row stays visible.
- Exit: instant full-balance unwinds of 53 reviewed synchronous ERC-4626 vaults are certified exact-complete by a pinned, hash-rechecked redeem simulation that measures actual underlying received; partial liquidity stays partial and network gas is excluded as for DEX routes (owner decision W4-D8). Until the first production redemption run issues certificates these rails publish an honest missing-certificate gap. Positively established route correlation publishes as a known diversification fact without credit (W4-D12). Faster settlement overlays and output-bound telemetry now require matching payout identity.
- Control and wrapper intake: a typed same-chain HyperCore/HyperEVM system-transport family carries chain-consensus authority without validator or independence credit (D-17); representation-group bridge authority aggregates its weakest member and stays unknown while any member is unreviewed; independently reviewed wrapper share accounting and sourced adverse no-public-withdrawal entitlements have their own intake lanes (senPATHUSD 48 D to 51 C-; STUSD stays F with a larger adverse local discount). TRON reads that only validate a block hash while executing latest state are no longer presented as pinned.
- DEX: discovery-shaped Uniswap V3/V4 pools recover exact identities and PoolKeys from pinned chain state, and Solidly V2, Meteora DLMM and Sui CLMM quote families collect in score-ineligible shadow until their activation evidence matures (owner decision W4-D7).
- Release impact on the accepted capture of 2026-10-05 (clock 1791184659, 396 cards): Not yet researched 1,476 to 1,446, researched non-disclosure 1,211 to 1,364, public-but-uncurated 48 to 54, measured adverse 203 to 226 (23 correlation facts). Movers: senRLUSDv2 and senPYUSDmain 61 (C+) to 44 (D), senPATHUSD 48 (D) to 51 (C-), USDai 64 to 61, sUSDai 54 to 51, hbUSDT 60 to 61; no quarantines. Producer-dependent closures (supply censuses, unwind certificates, pending-history plans) take effect only with fresh admitted production observations.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-07"></a>

## v10.07 - Stable route research binding and source-specific evidence corrections

**Effective:** 2026-10-05

Safety Score v10.07 preserves researched exit-route classifications across producer runs, admits independently proved immutable wrapper roots for contract mutability, and corrects source-specific reserve, DEX, redemption, supply and price evidence. On capture 20261004-2107, restored route research changes seven scores; wrapper mutability admission changes no score. Producer corrections require fresh admitted observations rather than rewriting the frozen capture.

- Route-scoped B/C classifications bind to the stable lane plus routeId instead of the producer run ID, so researched exit facts no longer revert to Not yet researched on each four-hourly redemption or DEX run. Captured pipeline verdicts and public route identities retain their exact generation. Replay rebinds 138 exit-route gaps: 117 U to C and 21 U to B. Scores move audd 67 to 68, doc 68 to 69, hchf 71 to 73, idrt 39/F to 44/D, usda 39/F to 42/D, usdm-moneta 31 to 33 and usdp-parallel 62 to 63.
- Wrapper contractMutability can admit independently proved immutable roots before the aggregate mint gate, only with fresh, exhaustive, source-bound identity review of every registered deployment. Other wrapper dimensions and the known-aggregate path are unchanged. Replay changes two U and five B mutability facts to reviewed, with no score or grade change.
- Tether composition uses a reviewed signed-report packet of eleven integer USD categories conserving exactly to the report denominator instead of rounded percentages. This removes the rounding-only reserve residual inherited by holders without changing the generic conservation tolerance. Production effect follows the next admitted reserve snapshot (owner decision D-19 A).
- DEX deployment censuses are classified at their own read-completed clock, separate from the quote clock; Arc maps to its discovery network. Uniswap V4 targets require exact chain-scoped PoolIds. Uniswap V3 pages are currency-scoped and missing fees resolve only against a unique candidate across actual fees. Balancer Sonic sweeps use physical pool IDs, and V2 candidate joins require unique exact rows or unambiguous fingerprints. These corrections affect evidence after fresh producer runs, not the frozen capture.
- Redemption observers refresh Noon's verified implementation and distinguish Mento FX-market-closed reverts from RPC failure. Reviewed redemption fee and queue terms update existing route configs without inventing same-notional capacity or settlement guarantees; captured execution costs retain precedence in frozen replay.
- Independent transfer censuses gain archive-capable Alchemy state-only endpoints and pinned Aptos/Movement OFT fungible-asset supply reads, with no partial partition admission. Authenticated Curve LayerZero pending-message reads retain bounded checkpoints and reject incomplete history; scrvUSD still needs canonical message producers and a full supply census before plan registration. VeChain gains canonical chain identity without provider-coverage or bridge-applicability credit. Kraken SOFIDUSD enters the price roster, but a second hard market is still required to close its peg gap. No frozen-capture effect is claimed for these producer/evidence corrections.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-06"></a>

## v10.06 - Availability-invariant mint fallback

**Effective:** 2026-10-05

Safety Score v10.06 implements owner ruling D33: positively known economically unbounded native issuance or claim impairment is priced from its evidenced actor, power and qualifying process, regardless of reconciliation availability. This is removal of an unavailable-evidence grant, not new adverse findings. Unknown reconciliation stays an explicitly attributed unanswered factor, never a 55-point grant or a finding of measured non-reconciliation. On two production captures (clockSec 1791137823 and 1791152224, 396 cards each) the code change moves 71 cards down by 1 to 18 points (median 8) with 52 grade changes; no card rises and none is quarantined.

- Within known unbounded authority, precedence is continuous/periodic reconciliation plus prudential/attestation-only supervision (80/70), qualified D30 minority veto (70), D29 affirmative governance (60), H operational governance (55), recurring reconciliation or independently established prudential supervision (55), then unbounded-adverse (25). Active compromise overrides the ladder; generic genuinely unresolved authority/economic semantics remains unknown quality 50. Every process qualification reuses v10.05's complete certificates, typed authority closure and uniform D32 gates; no partial rung, actor-label shortcut or curated annotation grants credit.
- At fixed positive actor/process facts, reconciliation not-applicable, none, unknown and internal-ledger do not alter the base rung. The active vocabulary removes the availability-specific posture and replaces the formerly unreconciled adverse class with unbounded-adverse, base 25 / Exposed / high centralized-mint severity and cap 59 under the existing D/E proof, loss-scope, material-share and residual-hard-cap gates. Adverse authority does not claim a measured absence of reconciliation or an active mint incident. Current annotations across every registry status must match actual derivation, with no acceptance aliases; historical entries retain their original classifications.
- Ordinary adverse seasoning adds 10 once after at least 60 implementation months: with unchanged knobs 25 becomes 35, bounded by the dedicated ceiling of 39 rather than a new 39 grant. Row penalties cannot cross the adverse 25 floor. Active compromise remains 25 / critical cap 39 and never seasons. D29 retains ceiling 69 / low cap 83, D30 ceiling 79 / low cap 83, and H ceiling 59 / moderate cap 74. H continues to distinguish delayed discretionary/envelope changes from immediate certified operational flows.
- Independently evidenced prudential supervision alone retains base 55 / Managed / no centralized-mint signal only absent a qualifying D30/D29/H process, which takes precedence with its own band and signal. The retained label is Unbounded, reconciled or prudentially supervised, with the actual reconciliation and supervision facts still distinct. Continuous/periodic plus prudential retains 80, plus attestation-only retains 70, and recurring reconciliation otherwise retains 55. Attestation-only alone grants no mint rung; a custodian's regulation or unrelated affiliate does not establish prudential supervision of the issuing entity.
- Internal-ledger alone remains sourced workflow disclosure, not reserve-to-total-liability reconciliation or a numerical rung. It may clear the issuer-backend mint-control question, but a ledger can record liabilities while the same actor retains unbounded issuance power. Backing assurance and the existing non-prudential Control whole-supply question remain. Internal-ledger plus prudential earns base 55 from independent supervisory evidence, not availability.
- For every selected economically unbounded mint component with unknown reconciliation, including qualified D29/D30/H and prudential-alone cases, real scoped reconciliation factors remain alongside topology factors. Included C/U contributions carry their own nonempty resolving causal gaps; unobserved values stay null and reviewed none/not-applicable remain distinct findings. Known authority supplies adverse D support separately, never from missing cadence. Missing required gaps remain named per-asset failures, not synthetic causes, borrowed gaps, validator bypasses or a blanket fleet hold. F/NR and downstream publication gates are unchanged.
- The single shared DDR fragile and unbounded sets cut over to unbounded-adverse while retaining qualified governance, reconciled and compromised members. Adverse remains Exposed/risky and satisfies neither no-privileged-mint predicate. K1 severe-surge and R1 strong/weak anchor rules, wrapper/native ownership, installed-publication versus unavailable-publication fallback, sealed verdicts, and DDR's own version are unchanged; unknown reconciliation creates no new recovery anchor.
- Verified-curation scope is limited to the independently confirmed research ledger: ZARSC periodic reconciliation; BRSRV prudential supervision; CUMIU periodic reconciliation and prudential supervision; FILQA prudential supervision; and the independently verified reUSD supervision correction to unknown. dUSD dTRINITY's reviewed none and asset-wide VCHF fields remain unchanged. These are admitted evidence-authoring inputs, not promised scores or final fleet counts; primary documents, exact entity/liability scope and actual evidence clocks remain required. No other dossier proposal or processCandidate headline grants a process rung or favorable rewrite.
- Release impact on the 2026-10-04 production captures (clockSec 1791137823 and 1791152224, 396 cards each; the same cards move on both): the code change lowers 71 card scores by 1 to 18 points (median 8) with 52 grade changes (D to F 31, C- to D 7, C to D 7, C- to F 6, C to F 1); no score rises and nothing is quarantined. On the first capture the grade distribution moves F 58 to 96, D 113 to 96, C- 58 to 45 and C 56 to 48 (second capture: C- 56 to 43, C 58 to 50); NR stays 20. The separately committed verified curation changes one card: FILQA 42 (D) becomes NR because prudential supervision removes its high centralized-mint danger and exposes the existing two-limited-pillar withhold rule. ZARSC, BRSRV and CUMIU keep their scores, and reUSD's supervision correction lands inside the code movers. These decreases remove an unavailable-evidence grant; they are not new adverse findings.
- Unknown or incomplete reconciliation evidence stays disclosed, including unresolved scope and failed reads; no evidence date is refreshed cosmetically. Publish the complete final cohort with the explanation removal of an unavailable-evidence grant, not new adverse findings: score/grade decreases are not newly observed reserve impairment, governance compromise, issuance events or new mint incidents. Keep the separate 10.05 version entry and commit attribution even if one deployment activates 10.06 directly; regenerated policy/build/source identity and the first accepted post-deploy publication must be observed before claiming runtime health.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-05"></a>

## v10.05 - Operationally governed issuance and uniform voting control

**Effective:** 2026-10-05

Safety Score v10.05 adds D31 / rule H for positively certified affirmative operational-flow governance: discretionary expansion and envelope changes require public token governance, while formula interest and activity-bound compensation may execute immediately within reviewed envelopes. Issuance stays economically unbounded. D32 voting-control doctrine applies uniformly to D29, D30 and H; class certificates, typed authority roots and per-control diagnostics replace signer-prose admission. On two production captures, DAI moves from 53 (C-) to 74 (B) and USDS from 44 (D) to 71 (B) under the new rung; crvUSD falls from 69 (B-) to 44 (D) because Convex's 3-of-5 Safe can replace the caster of 54.1% of veCRV.

- The new posture unbounded-operationally-governed starts at mint quality 55 in the Governed band, with moderate centralized-mint severity and cap 74. Ordinary seasoning and final positive merged credit clip at 59 through the existing ladder below D29's 60; D30's 70 and graded reconciliation retain precedence. It remains fragile and unbounded for DDR. No surplus floor or lifetime issuance budget is required; D14 is unchanged.
- H0–H4 require fresh complete reviewed reach, all discretionary and operational-envelope raise routes bound to flash-resistant affirmative token governance with at least 172800 public code/calldata-bound seconds, source-enforced formula/keeper accounting and screened envelopes, enumerable deduplicated native liabilities, and closed other-class/bounded-stock/freshness proofs. Operational exercise can remain zero seconds; the release does not claim all issuance is delayed.
- Final per-action screens are 500000 ppm maximum effective annual growth, 1000 ppm maximum keeper proportional coefficient, 10 ppm of unique native supply maximum fixed award, and 3600 seconds minimum funded repeat. The former aggregate daily repeat ceiling is replaced by a 48-hour exposure anchor: ceil(certified maximum annual growth × 172800 / 31536000) + ceil(repeat reward supply ppm per 86400 seconds × 172800 / 86400) must meet the existing 5% moderate-exposure threshold, 50000 ppm. Initial liquidation compensation remains activity-relative with anti-farming and historical paid-fragment stock proofs, not an absolute daily liquidation-turnover cap.
- The combined-exposure certificate is valid only for 0 < W <= T: W reuses the existing public-governance minUnavoidableDelaySec (172800 seconds), and T is operationalFlow.annualWindowSec (31536000 seconds). Policy loading rejects W > T; pure H admission independently denies an out-of-domain anchor with H3 / aggregate-flow-unproved. No threshold or duplicate policy key is added.
- Bounded delegated stock is admissible only with a proved finite cap, every raise/reset/replacement requiring the public 172800-second token-governor route, and no fresh chosen-recipient issuance outside the stock. Downstream strategy/custody losses belong in Backing; external strategy-target closure is not an extra H Mint gate. Refillable flow buckets are not lifetime stock caps.
- Uniform D32 uses actual source-enforced unilateral route thresholds, exact controller-plus-residual conservation to pinned voting supply, own versus other-holder vote provenance and every operator/replacement alternative. A holder voting its own locked/escrowed tokens is admissible even above threshold or with unknown beneficial affiliation unless positively identified issuer/team/council-affiliated; concentration is diagnostic. A key needing others' votes to pass alone, or replacing their caster without on-chain token-holder approval, denies. Nongovernance privileged/forced vote creation or delegation denies. Below-threshold controllers need no identification; there is no universal concentration cap or grandfathering.
- Execution classes compress repeated contract-type source invariants without weakening evidence: exact runtime/proxy/implementation, instance conditions, full authorization census and member/path bindings remain required. Typed authority and economic-provenance graphs replace signerIdentity word/address parsing, close every alternative and invalidate changed authority state. Unmatched members block process admission without erasing independently known adverse paths; there is no permanent partial rung.
- Compiled assets retain one issuanceFacts object and native rows only its matching issuanceFactsRef; referenced H diagnostics carry empty evidence refs plus that ref instead of hydrated copies. Public breakdowns.control.issuanceSummary carries compact governance/process scalar/count/screen metadata and aggregated diagnostics keyed by code/gate/classId/field, with whole-group count, complete sparse normalized controlRefs (including null process-level failures) and at most three explicitly sampled, non-exhaustive path/member/evidence exemplars. Exemplars retain evidenceRefCount and at most three evidence refs. Full process/diagnostic objects are removed from component controlDetails; the UI reads the summary once, matches full control refs and never treats group totals as per-control counts or recalculates qualification.
- ZCHF's D30-S rate envelope remains separate: its minority-replaceable 604800-second window and uint24 nominal annual-ppm domain are justified by minority correction and D30-R closure, not H's 50% effective-growth envelope. Typed authority/provenance and uniform D32 still apply; veto-only monetary-policy paths cannot become H.
- O0 corrects GHO fixed configured-pool first hops and ordinary payload timing to 345603 seconds (1 + 259201 + 86401), distinguishes current versus legacy Sky LockstakeClipper Mom authority, and encodes positive D3M suck/grab fees and donations as matched paired accounting rather than atomic heal or blanket loss replacement. Fixed first hops and zero-current states do not grant global closure.
- GHO stays mint 25 (historical captured total 42/D): removing the Council's chosen-recipient direct mint, restricting it to genuinely reserve-backed issuance, or imposing a finite aggregate token-governed budget is the public improvement trigger for testing ordinary D29, not a promised future score.
- Release impact on the 2026-10-04 production captures (clockSec 1791137823 and 1791152224, 396 cards each; the same scores on both): 10 cards change and every change is a grade change. Up: DAI 53 (C-) to 74 (B), USDS 44 (D) to 71 (B), sDAI 51 to 64 (C+), sUSDS 40 to 63 (C+), stUSDS 36 to 63 (C+), Spark sUSDC and sUSDT 39 to 64 (C+), SkyMoney USDS flagship 36 to 59 (C). Down: crvUSD 69 (B-) to 44 (D) and scrvUSD 63 (C+) to 42 (D) under D32. GHO stays 42 (D) and ZCHF 81 (A-); zero quarantines. Reconciliation-availability fallback changes are outside v10.05.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-04"></a>

## v10.04 - No unresearched facts for inapplicable maturity or float dust

**Effective:** 2026-10-04

Safety Score v10.04 stops publishing two compiler artifacts as unresearched (U) evidence facts that no research could close: maturity gaps on reserves whose maturity is already established as not applicable, either by the policy's maturity-not-applicable classes or by an admitted reviewed bound fact, and whole-asset remainders that are only floating-point accumulation dust. No card score, grade or rating status changes on the replayed production capture; the unresearched fact count falls by 599.

- Maturity on an admitted, current reserve row whose class is in the policy's maturityNotApplicableClasses compiles as a known not-applicable fact instead of a U material-reserve-slice-unstructured gap on maturityDaysMax. The factor still scores at the policy's 100 rung and publishes as an included contribution, so backing arithmetic is unchanged. Unadmitted classes, maturity-applicable classes and stale envelopes keep their existing gaps.
- The same applies when an admitted, current, exposure-scoped, all-in-scope maturity-applicability bound fact concludes maturity is not applicable to that exact exposure. The evaluator already covered the whole factor with that bound at 100, so the score is unchanged. Rejected, expired, not-yet-elapsed, partial-scope, sub-instrument or non-matching facts keep the gap.
- Admitted reserve weights that fall short of the whole-asset denominator by at most 1e-9, the fact schema's conservation tolerance, are complete. Machine-precision shortfalls such as 0.9999999999999999 no longer create a U partial-reserve-review reserveCompositionRemainder tail; genuine shortfalls above the tolerance, including the 1e-8 rounding remainder, keep it.
- An A or B reserve factor, such as a maturity datum classified as public but not yet curated, is excluded only from its own row: the row stays a scored, included contribution renormalized over its remaining factors, and the factor publishes as excluded-uncurated or excluded-pipeline with a null score, zero weight and its causal gap, flagged in partialEvidence. A/B controls a reserve row or the concentration component only when nothing in it remains scored; otherwise its controlling cause is the scored C, U or D. Previously such a classification made the row claim an included disposition with cause B and failed the whole publication.
- A card that still violates its public contract is quarantined as evaluation-failed, naming its first failing field, and the cohort is recompiled without it; other cards publish under the existing healthy-asset gate instead of the attempt failing. Projection failures from one pass are quarantined together, and a quarantined stub that still fails ends the attempt.
- A quarantined reserve parent contributes an excluded-pipeline A upstream without quarantining its dependents: unavailable-upstream evidence retains pipeline responsibility rather than unrelated issuer/unresearched diagnostics, and local adverse facts in excluded pillars no longer claim score-causal attribution. The forced four-parent replay removes 14 dependent projection quarantines and one cohort recompile; ordinary capture scores, grades, rating statuses and unresearched count are unchanged.
- Release impact on the 2026-10-03 21:46:42 UTC capture (clockSec 1791064002, 396 cards): no card score, grade or rating status changes, and no grade flips. 574 maturity gaps on cash, stablecoin, cryptoasset, hedged-crypto, protocol-position and commodity-allocated rows and 25 dust remainders on 25 assets leave the published unresearched responsibility, which falls from 3957 to 3358 facts across 206 cards. Removing the dust rows moves four full-precision Backing pillar values by less than 1e-11 (fpi-frax, frax-frax, jpyt-dephaser, usdo-openeden) without changing any published score. The six reviewed maturity-applicability facts (hbd-hive, kag-kinesis, kau-kinesis, USDT physical gold, ZCHF BOSS and REALU) are reviewed 2026-10-03 and are not yet admissible at that capture clock; once admitted, they remove six more maturity gaps with no score change.
- On that capture, the B-factor fix and the projection quarantine change no card and produce 0 drift. With throwaway classifications (B on audd-novatti and ausd-agora maturity, C on ausd-agora liquidity), publication succeeds where it previously failed: audd-novatti moves 68 to 69 (B-) as its maturity factor leaves the score, ausd-agora keeps 74 (B) with Backing 91.04 to 91.09, and unresearched facts fall 3097 to 3094. Without the B-factor fix, the same input now publishes with 24 projection quarantines (the two assets and their reserve dependents) instead of failing.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-03"></a>

## v10.03 - Minority-veto issuance due process

**Effective:** 2026-10-04

Safety Score v10.03 implements owner ruling D30: an unavoidable public minority-veto process protects issuance admission against majority capture and ranks above affirmative governance. Qualifying Frankencoin-style issuance derives unbounded-veto-guarded at quality 70 while remaining economically unbounded under unchanged D14. ZCHF, dEURO and JUSD are re-researched against the same fail-closed gates; a cohort member missing any gate keeps its ordinary unbounded rung. On the replayed production base only ZCHF moves, from 44/D to 81/A-.

- The new posture unbounded-veto-guarded has quality 70, public band Governed, neutral label Unbounded, veto-guarded, and a low centralized-mint signal with cap 83. Its ordinary merged-ladder seasoning ceiling is 79, the same as partially-bounded-admin: the next grading rung is prudential reconciliation at 80. DDR fragile and unbounded membership is unchanged in economic meaning; neither DDR nor the retired Mint Authority lane receives a version bump.
- V1 requires complete runtime/signer-bound execution-scope certificates on every authored mint control, a fresh closed review, no scoped question and no active incident. V2 requires decisionRule minority-veto and a minimum, never summed, unavoidable public window of at least 1209600 seconds across every reachable unbounded issuance path. V3 limits the unilateral veto quorum to 200 bps of flash-resistant holding-period-weighted, lock-escrowed or past-block-checkpoint votes; overrides must be absent, symmetric vote destruction, or a certified unreachable insolvency-gated restructure.
- V4 roots every unbounded path in the veto governor through structured signer identity naming only authored contract execution hops and no numeric/word-numeral quorum or signature phrasing. The governor itself cannot carry an unbounded bypass. V5 requires an active parameter-change veto path containing every declared exact selector and targeting each guarded issuance controller; dormant vetoes fail. V6 requires enumerable authorization events and capacity reads. Unknown evidence fails closed.
- Curated governedIssuance records now require an explicit decisionRule; every existing governed record migrates to affirmative-vote without refreshing its evidence. veto and monetaryPolicyPaths are forbidden on affirmative profiles. Compiled facts preserve the rule and null veto fields only for affirmative voting, reporting governor-without-veto-path:<controlLabel> for each missing veto target and governor-carries-unbounded-path for a governor bypass.
- D30-S / V7 treats formula-bound deposits × rate × time interest as bounded-impairment monetary policy only with a hard-coded positive annual-ppm rate cap and minority-replaceable rate changes delayed at least 172800 seconds. The strict monetaryPolicyPaths inventory resolves each declared control/path and records cap, rule, delay and evidence; unreviewed or inadmissible raiseable issuance fails coverage. This deliberately reuses raiseable with null bound and bounded impairment, outside the fourteen-day admission minimum. Already-admitted issuers retain their own exercise delay: an unbounded zero-delay mint cannot inherit the admission window.
- D30-R admits insolvency-gated-restructure only with observed pinned whole-token equity at least threshold times the policy multiple 2. Lower equity emits restructure-reachable. A reachable governor-certificate path must contain all restructure selectors or restructure-path-missing fails coverage. Only declared disabled-reactivatable dependent paths are excluded from window/rooting while unreachable; missing or active paths fail. Evidence names the constant/function, value and pinned block, and proves only restructure can reduce governance-share supply to zero while ordinary redemption retains at least one share. Cross-certificate reactivation binding remains an evidence-backed residual risk.
- Permissionless position borrowing against the borrower's own posted collateral, and flash mints repaid in the same transaction, carry claimImpairment none in execution-scope certificates. Exercising them cannot issue unbacked supply, and liquidation or credit loss remains a backing-pillar risk. Admin-held collateral-gated minting keeps bounded impairment.
- Within unbounded issuance the precedence is graded reconciliation, veto-guarded, affirmative-governed, base reconciliation, reconciliation-unknown, then unreconciled; active compromise overrides all. A failed minority-veto profile cannot fall back to the affirmative-governed rung. Cohort outcome: ZCHF qualifies and moves from 44/D to 81/A- in the Governed band. dEURO stays unbounded-unreconciled (asymmetric DEPSWrapper vote-age halving; position interest accrues past expiry with shortfall minting). JUSD stays unbounded-reconciliation-unknown (restructure currently reachable, five unverified minters, the same position-interest path). No other card changes.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-02"></a>

## v10.02 - Governed unbounded issuance and uniform D14

**Effective:** 2026-10-03

Safety Score v10.02 implements owner ruling D29: D14's unchanged economic-bound question and the actor's issuance process are separate axes. Positively proven, delayed, flash-resistant on-chain token governance can derive unbounded-governed without making issuance economically bounded. The release splits active compromise from unreconciled unbounded issuance, adds the 60-point mint-quality rung, and applies a uniformly sourced D14 sweep with fail-closed governance and cap-review validators. On the captured 331-card production base, 88 cards change and 34 grades flip; every change is declared.

- The new derived posture unbounded-governed has quality 60, a low centralized-mint signal with cap 83, public band Governed, ordinary seasoning ceiling 69, and membership in both DDR fragile and unbounded sets. Qualification requires complete runtime/signer-bound execution-scope certificates on every authored mint control; the minimum, never summed, unavoidable delay across all reachable unbounded issuance paths must meet the policy-owned 172800-second floor.
- Every governance gate must be positively proven: structured, chain-qualified governor rooting admits only the token-vote governor or authored contract execution hops in certificate signer identities, with no multisig or threshold phrasing; voting power must be lock-escrowed or past-block checkpointed; issuance must be enumerable; the review must be fresh and closed; and there must be no active incident. Unknown evidence fails closed. Governor references are EVM-only in v10.02.
- Removes unbounded-or-compromised in favor of compromised, reserved for active incidents with a critical centralized-mint signal, and unbounded-unreconciled, without an active incident and with a high signal and adverse seasoning ceiling 39. Both postures have quality 25. Public labels are updated; posture strings remain opaque in published payloads, and screener band keys are unchanged.
- The mint-quality ladder now includes 60. Both seasoned and positive merged-signal credits on 55-base postures clip at 59: frax-frax and home-homecoin move 65 to 59; eurs-stasis and xusd-babelfish move 64 to 58; ousd-origin-protocol moves 76 to 56 with its D14 reclassification and merged-credit correction; brz-transfero moves 53 to 47.
- The uniform D14 anti-drift validator requires a sourced capSemanticsReview on every raiseable, bounded or collateral-gated record with a direct or can-authorize control, or any canRaiseCap: true control. Governed evidence is invalid on wrappers: under D08, wrapper D14 concerns only wrapper-local minting, while inherited parent issuance follows the serial-claim dependency.
- Across 232 changed records, 47 flip to unbounded (39 from raiseable and 8 from bounded), plus thUSD from collateral-gated; 7 become unknown where bounded construction could not be verified; and 55 carry a sourced capSemanticsReview. sUSDS reverts to bounded under D08 parity with sDAI. The sweep renames 85 curated annotations and aligns 71 to derived postures. Every research unit was independently verified by GLM verifiers.
- Release impact uses the 2026-10-03 18:17:59 UTC production capture: clockSec 1791051479, sourceGeneration report-cards:10.01:1791051364, baseInputGenerationId report-cards-input:v1:11decc5045c479694536d051041e05de2a3e53f4b7ded8f7057baa59fd91ca5b, and 331 cards. There are 88 changed cards and 34 grade flips, all declared. crvUSD is the only asset qualifying as governed, moving 44/D to 69/B-; scrvUSD moves 42 to 63.
- DAI moves 81/A- to 53/C- and USDS 81/A- to 44/D because their governance paths could not be certified: 129 live Vat wards lack complete certificates. sDAI, stUSDS, sUSDS and Spark sUSDC/sUSDT follow their parent caps. GHO moves 72/B to 42/D after verification of an independent Risk Council 2/3 Safe direct-facilitator mint path; ZCHF moves 81/A- to 44/D because permissionless minter applications execute unless vetoed; fxUSD moves 71/B to 44/D because pool registration is unvalidated.
- Other declared changes include cUSD 79 to 59 and yvUSDC 78 to 45, plus the Safe/timelock-rooted cohort including Mento GBPm, dUSD Alto, Polymarket pUSD, Resupply reUSD, Rings scUSD, dEURO and others. Grade distribution changes are A- 4 to 1, B+ 11 to 9, B 18 to 14, B- 10 to 8, C+ 36 to 26, C 48 to 53, D 88 to 94, F 38 to 49 and NR 17 to 16; JPYm is newly rated.
- 42 assets join the DDR fragile and unbounded sets; sUSDS leaves them under the D08 reversal. Neither DDR nor the mint-authority lane receives a version bump. The curated-versus-derived mint-posture queue converges to zero disagreements: four external-only representations with reviewed no-local-issuance exceptions are annotated none-resolved-mint (newly admissible independent of mintPath), usda-anzens is annotated from its reviewed reconciliation, and fusd-finchain's annotation becomes unknown because one control's economic loss scope remains unresolved.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-01"></a>

## v10.01 - Cause-aware evidence: pipeline gaps are not asset risk

**Effective:** 2026-10-03

Safety Score v10.01 distinguishes pipeline and curation gaps from researched issuer non-disclosure, unresearched questions, and measured adverse facts. Proven Pharos-side gaps stay visible without scoring penalties; bounded uncertainty remains in components without missing-data ceilings. The release preserves identified reserves, admits named-firm reports for 120 days, separates Exit confidence causes, and selects the strongest feasible route portfolio. It also includes the reviewed monotonicity, native-bridge, supply-capture, peg-coverage, and data corrections. Missing evidence still grants no executable capacity, favorable rights, or measured-adverse claim.

- Each missing factor carries a scoped cause proof: A, pipeline unavailable; B, current required data public but not curated; C, researched issuer non-disclosure; U, not yet researched; D, measured adverse. A/B relief requires captured producer evidence or current dated public-data research; absent proof defaults to U. Known constraints and adverse facts survive unrelated gap relief.
- A/B factors remain diagnostic with null scored values and zero effective weight. Exactly one A/B-only pillar is omitted and the other two policy weights are renormalized, with a visible Partial evidence: pipeline gap flag. With two or three such pillars, ratingStatus is pipeline-gap and card score and grade are null, not NR or a single-pillar Safety Score. Subcomponent exclusions also carry the partial flag.
- C/U quality credits use max(the pre-v10.01 value, the comparable ordinary non-adverse family minimum); charge and discount ladders retain their previous values. This raises reserve liquidity uncertainty to 55, maturity to 48, generic mint uncertainty to 50 and unbounded-mint reconciliation uncertainty to 55. Cost 50, holder 0.85, topology -6, current route defaults and wrapper form charges 3/5/10 retain explicit disclosure inversions: an honestly measured weaker fact can score lower. Unknown-driven quality never manufactures measured danger.
- Removes every missing-data named or evidence-level whole-score ceiling, including control, oracle, backing, Exit, peg and generic limited/adequate evidence ceilings, plus the duplicate generic missing-peg cap. Measured adverse and positively evidenced method, parent, history and structural limits remain; component uncertainty is not a replacement ceiling.
- Evidence-derived NR gates count only genuinely limiting C/U/D witnesses (U treated as C until classified), never A/B diagnostics. A pillar counts only when the pre-v10.01 evidence predicate still limits it after A/B relief and it carries a compiled witness; newly tagged bounded components do not by themselves make a pillar limited. C/U does not directly make a component or pillar NR. The existing collective limited-evidence thresholds remain. A computed F without attributable measured adversity is still withheld, with the distinct reason Score below the F threshold without a measured adverse fact; it receives neither a score uplift nor an invented adverse fact.
- Admits independently identified whole-asset reserve holdings instead of rejecting the entire composition above the former 0.1% unclassified-residual threshold. Disjoint unknown tails remain visible: C/U is bounded at 35, D retains measured pricing, A/B is excluded only from scoring. Whole-asset exposure and dependency denominators are unchanged. Named-firm attestations, audits and examinations admit through 120 days inclusive from period end at their actual assurance strength; chronology, scope and fingerprint rejection remain strict.
- Inherited parent Backing quality is bounded by the asset's own known reserve class, liquidity and source strength, with missing local factors at their best ordinary rungs; parent quality replaces only unknown local defaults. Reserve concentration no longer credits rows without identified issuers or obligors as diversified: unidentified bounded shares use the bounded-unknown quality, a correction that lowers XO, dEURO, sDOLA, USDK and USDN Backing by 3.3 to 5.2 points. Placeholder obligor prose on newly admitted TGBP, EURQ, USN and USX rows is removed.
- Same-run verified live queue/proxy readings gain a dedicated capacity-method tier at 0.75. Observation, model and capacity-method confidence expose separate causes; A/B missing dimensions are neutral, while known weaker models and C/U uncertainty still apply. Neutral confidence never refreshes stale capacity or waives execution, output, holder, fee, settlement or resource admission. Public-but-unevaluated fee and holder gaps follow their own causes.
- Exit chooses the maximum full-precision score over all feasible single routes and independent two-route portfolios, retaining the 10% backup allowance, same-notional requests and resource/correlation guards. A correlated route improving cannot displace a better feasible pair. The admitted bounded-gap floor applies once after selection; missing-route explanations remain independent of whether that floor binds.
- Wrapper A/B local gaps no longer trigger form uncertainty deductions or favorable risk-transfer credit; eligible C/U local gaps retain current form charges. Expired reviews are classified by current evidence rather than presumed issuer silence. New public schemas preserve partial weights, cause traces, separate pipeline-gap completeness, and technical-null parent/scenario status. History and grade-change alerts do not turn availability gaps into NR or downgrades.
- Fixes the known-only mint-credit ladder and separates Exit floor eligibility from missing-route reason emission. Positive included routes, including certified lower bounds, are usable evidence; exhaustive measured zero remains adverse. This removes the reviewed FRAX, XUSD Babelfish, hCHF and OUSG unknown-rung cross-talk.
- Corrects native bridge applicability for exact single-chain yBOLD/sBOLD partitions and BUIDL's reviewed native Ethereum share classes. Aggregate native supply is preserved without invented contract shares; bridged, controlled or unreviewed candidates retain fail-closed attribution.
- The five-minute reserve-recovery lane refetches active assets whose stored snapshot fingerprint mismatches the deployed live-reserve configuration, through the normal adapter path and authoritative CAS under the producer lease. It attempts at most six assets within a two-minute budget, with ten-minute per-fingerprint backoff; an asset without a registered fetcher is quarantined with a structured warning instead of aborting the lane. A read-only operator report lists configuration changes against an explicit base. Fingerprint mismatch remains an absolute rejection, never cause-relief admission.
- Economic supply captures honor the admitted capture clock and rederive against the prepared consumer's exact base/source/aggregate without redating external observations. wM retains Linea's 12-block safety lag and 120-second skew gate and now runs last in the supply slot. Its single maturity/reread pass waits only the computed deficit plus 15 seconds (at most 120) and only when the slot's remaining budget still covers the reserve for later work; otherwise it rejects as deployment-observation-window-insufficient. Persistent skew still rejects.
- Renews yBOLD and sBOLD whole-allocation evidence from current pinned on-chain reads rather than date-bumping old reviews, retaining liquidation-loss-absorption treatment and unknown measured unwind. Admission remains bound to each review's actual observation clock and expiry.
- Reverifies USDT's company-owned LBMA physical gold bars while retaining reserve class other: commodity-allocated is restricted to metal-pegged claims, and USDT retains gold-price risk. Restores the disclosed overnight reverse-repo one-day horizon; other researched unknown horizons remain unknown, average maturities are not maxima, and the June 30 composition is not refreshed.
- Withdraws unsupported VCRED credit-fund, reserve and on-chain-custody claims while retaining declared USD intent and its non-core listing during unresolved exact identity/mechanism research. USDK and XO retain existing classifications because funded indexed M custody and deployed executable hashes do not prove source equivalence.
- Together with peg methodology 6.31, admits current measured deviation for sub-$1M assets while keeping the $1M minimum for event creation. Unknown-price time inside an open depeg is not counted as observed off-peg time; trusted intervals and coverage gaps are persisted without invented historical observations. Safety Score applies measured peg evidence independently of missing-price diagnostics, without duplicate missing-data ceilings.
- Release impact on the 2026-10-03 12:48 UTC production capture (331 cards): 138 cards change score or status, with 126 up, 2 down and 10 status changes; 65 grades change. Both numeric declines are reserve reports outside the 120-day named-firm window (GUSD 62 to 58, YLDS 61 to 52). Eight not-rated cards become rated, and two rated cards become NR: KAG, a computed F without measured adversity, and PHT, after a missing-data bridge danger signal no longer exempts two witnessed limited pillars. NR falls from 23 to 17; there are no pipeline-gap cards and no quarantines. Residual peer-order inversions (trUSD over USDU; XUSD and wBRL over pUSD) are documented follow-ups. No numerical uplift is implied for an unmeasured gap.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded

<a id="scoring-v10-0"></a>

## v10.0 - V10: curation, owner rulings, and physical-to-USD Exit

**Effective:** 2026-10-02

V10 is a major release consolidating the 2026-10-01 curation pass, owner rulings, and physical-to-USD Exit. It brings known-supply Exit sizing, whole-book custody and report-date discipline, measured collateralization, deployment-local control pricing, adverse mint evidence continuity, wrapper and inheritance corrections, and reviewed physical-metal redemption composed with conservative USD sales. Missing evidence never grants credit.

- The Exit-only supply projection admits a bounded-unknown supply fact only when its required policy rule is v9.supply.bridge-materiality, the producer's marker that the current amount is established but its partition is not. Known supply keeps its existing behavior, and the reviewed stress fraction, grid, cost bound, and settlement horizon are unchanged.
- Missing bridge profiles, ambiguous route joins, and missing or rejected attribution packets no longer suppress Exit sizing when a current circulating amount is established. No bridge shares, chain distribution, transfer materiality, control facts, or evidence gaps are inferred or promoted; their existing gaps and ceilings remain.
- Sizing is not executable-capacity evidence: every route still needs the existing same-notional capacity, output valuation, cost, access, and settlement admission. Exit and downstream scores may change where measured routes can now be compared, without guaranteeing a grade improvement.
- Asset-wide institutional custody labels now require whole-book evidence. Custody gains mixed and unknown values; omitted custody for centralized or RWA-backed classes defaults to unknown instead of an institutional label, while structural on-chain defaults remain. Mixed and unknown never qualify for regulated-only or on-chain-only Selector eligibility and add no numeric Safety Score credit.
- Explicitly adapter-owned reserve compositions keep their own date when a separately evidenced monthly report has a known period end and publication date. Curated-only compositions keep report-period lockstep, audit-grade admission still requires matching periods, and independently dated fallback rows retain only their own static-validated evidence, completeness, and freshness gates.
- Dated, primary-source-backed catalog withholding replaces sUSD1+'s hardcoded parent Backing exception without removing its parent cap or peg relationship. Privileged wrapper-local NAV pricing remains high risk without a whole-score ceiling; direct-wrapper onchain custody relief requires current fully-onchain allocation proof or complete zero-unknown-exposure custody checks.
- Security history gains an informational record for disclosed, remediated, non-realized vulnerabilities (USD3 batch auction, XAUT transferFrom, fxUSD router), dated from primary disclosures, with no realized-exploit, loss, or mint-incident routing.
- Mint-control selection prices the worst applicable durable-mint authority across deployments: native root issuance stays asset-wide, and proved deployment-local controls keep supply-weighted treatment.
- Privileged-pricing ceilings are removed while the oracle Control component retains its 45-point bound. Evidence-backed adverse mint findings survive unresolved reviews until positive evidence clears them.
- A reserve report without an explicit publication date may use its exact printed signed or as-of date as a typed, visibly signed conservative publication stand-in. Chronology, report age, composition lockstep, and assurance-scope gates remain; no later date is invented.
- Adverse minority mint authorities remain published and proportionally charged by deployment exposure; expired aggregate reviews preserve each control's own adverse or unknown evidence. Unresolved pricing charges the full admitted unresolved/unknown/unreviewed cohort, proportionally below 5%, smoothly blending the whole-coin ceiling from 5–15%, and fully at 15% or unknown shares, with interpolated cap traces and aggregate-aware bridge joins.
- Measured collateralization retains source, dated evidence and stable measurement identity. Ratios below 100% cap Backing, including inherited reserve quality, only with current evidence within the mechanism-overlay freshness budget; expired, undated or unevidenced measurements grant neither haircut nor credit. Serial wrappers apply the same inherited parent measurement once, while distinct local shortfalls remain chargeable.
- Reviewed physical-metal redemption composes with conservative modelled USD sales under the 500-bps admission ceiling, lot arithmetic, expiry and captured-price gates; execution cost uses the common request denominator and public traces prevent double counting. Modelled capacity is bounded by evidenced throughput over the complete settlement window or one minimum lot; verified customers receive no institutional discount, coverage is explicitly modelled, fee and timing assumptions lower confidence, and best-effort cash branches retain the policy sale spread.
- Reviewed physical-to-USD terms cover ten commodity assets, preserving conservative delivery scope, lot identity, published fees, and settlement gaps. Physical delivery alone remains diagnostic rather than USD Exit credit.
- Oracle applicability follows exact reviewed issuance paths: evidenced non-price-sensitive GHO allocations emit no scored component without hiding lending gaps, and Horizon's externally relayed NAV tier is admitted under its documented-feed-heartbeat owner ruling without implying enforced timestamp rejection.
- Risk-absorption wrappers retain local emergency and slashing/configuration loss controls without parent first-loss credit. Parent-only custody uncertainty leaves local strategy complexity only when current reviewed allocation and reserve facts establish a direct single-parent claim; expired proof and local private-credit exposure remain conservative.
- Fresh, uniquely keyed classification-only reserve reviews supply classification metadata without certifying whole-book composition, changing unknown exposure, replacing live percentages, restoring withheld pooled dependency weights or overriding non-link dispositions.
- BabelFish and USD0 branch-reserve censuses are corrected and USD0 registry drift is guarded. Census and valuation remain separate: unavailable exposure stays unknown, and USD0-denominated self-referential claims stay unclassified pending reviewed netting and an independent-backing denominator.
- Reviewed economic-deployment attribution preserves the original circulating aggregate and source generations, using exhaustive exact holding censuses, independently timed conversions, primary-proven escrow/receipt/exclusion/in-flight reconciliation and hash-bound EVM, Solana and XRPL observations. Partial-provider renormalization is rejected; exact native/wrapper deployment keys govern transfer materiality. Existing native-single-route and independent-lane eligibility moves into reviewed registry data without new coin allocations; unresolved-control bands and issuer non-disclosure charges remain.
- Local exact-request Exit certificates add integer-unit order-book and off-ramp execution, policy admission, independent compiler/evaluator verification and sanitized public proof traces. Reviewed identities remain empty; existing scored routes, canonical supply, pool census and documented issuer charges are unchanged.
- Deployment-bound, execution-complete control scope covers latent, re-enabled and counterfactual paths and Safe-extension noninterference without absence credit. Weighted contract and XRPL signing uses minimum cryptographic signatures, including master/RegularKey bypasses, without human-independence credit. Unreviewed or stale siblings retain uncertainty/adverse treatment, and native bridge-mint/burn rails remain controlled.
- XRPL issued amounts retain exact decimal-string coefficient/exponent semantics instead of fabricated fixed decimals; fixed-unit readers reject native XRPL.
- Exact-contract and independently dated per-dimension allocation evidence retains conservative entity/holder completeness and worst-risk aggregation. Scoped claims cannot satisfy whole-allocation/A3 proof; parent legal context is adverse-only, while issuer non-disclosure charges, adverse facts, supply accounting and parent caps remain.
- New capabilities activate only on their own reviewed data; without new reviewed data the production capture replays identically. Partial execution scopes and weighted quorums cannot worsen legacy Control unless they add newly verified adverse reach; only closure-complete scope may narrow.
- The verified data wave authors native-family identities and overlays for EURSAFO's UCITS/TRS mechanism, Mento shared reserves and USDB/USDU protocol positions; Mento single-relayer oracle profiles; lossless XRPL issued-currency encodings; partial execution scopes; and wrapper scoped claims. Unverified facts remain unresolved and retain their charges.
- Scoped financial reports admit exact deployment/book denominators and exclusions, with current-generation liability weighting and charged unknown residuals. Without an admitted current partition and book join, exact coverage remains diagnostic and preserves legacy report treatment; only verified exclusions of nonzero or unknown-amount still-owed liabilities may remove overbroad credit.
- Independently dated standing feeder identity and header-bound on-chain observations use separate admission lanes, including reviewed reserve/escrow contracts and native technical subjects. They never grant financial assurance, supply or current-holdings credit.
- Bounded reserve facts distinguish contractual maturity maxima, observed tenor, exhaustive enforceable eligibility, current native availability, structural applicability and stressed final realization. Exact current scope, coverage and freshness are required; undisclosed composition, concentration, unknown tails and original constraints remain charged. Origin's same-pin idle USDC fraction adds no redemption capacity; its cross-chain observation remains diagnostic pending reconciliation.
- Reviewed receipt/bridge reserve-access graphs retain originating authorities and exact deployments, deduplicate physical positions and expose unpriced or unresolved remainder. Public freeze look-through is diagnostic-only, independent of holder-transfer posture, with no new freeze penalty or economic score change.
- Verified data wave B adds scoped reports for USDtb, QCAD and VCHF; bounded observations for xDAI and LVUSD; HLSCOPE standing feeder identity; CASH, STAC and OUSD maturity/liquidity facts; and Nexus NUSD, NXUSD, yzUSD and syzUSD access graphs. Unjoined scopes remain monotonic and diagnostic.
- Positively proven, runtime-bound Safe-module reach is recognised even in a partial control inventory, exposing verified adverse paths such as OUSD's signature-free vault withdrawals; only exhaustive closure grants a noninterference waiver, and partial inventories still add no charge for unsearched closure.
- Verified data wave C resolves unknowns that had lowered scores: Zilliqa is registered so XSGD's issuer-native deployment joins its reviewed controls; frxUSD satellite deployments, stkGHO role holders, yzUSD collateral-funded minting, USDU internal pricing, sUSDD/sDOLA on-chain custody, scrvUSD satellites and OUSD's Safe modules are authored from pinned reads. Facts that remain unknown after exhaustive research keep their charges.
- Disclosed issuer internal mint-ledger reconciliation (Quantoz EURQ and USDQ) resolves only the issuer-backend Control process question, without cadence, financial-assurance or key-custody credit; independent reserve assurance stays charged in Backing.
- Centrifuge deployment attribution keeps reviewed sibling deployments when an unresolved route has positively observed zero raw supply in the same generation; nonzero or unobserved unresolved routes still reject, and the unresolved route's controls stay charged.
- A fresh reviewer-scoped question on an admitted partial mint scope whose active path has unknown reach keeps that controller bounded-unknown under the existing limited-evidence treatment instead of compiling it as known global-claim reach with inferred incident absence. A separately reviewed path that establishes global, unbounded mint power keeps its adverse posture and structural failure.
- Reviewed EVM supply observations work on chains without the canonical Multicall3 contract, using block-pinned sequential calls with a final block-hash recheck; unavailable or failing required reads still reject. wM's seven newly catalogued deployments carry reviewed producer identities, so its full twelve-deployment supply partition can be observed after deployment.
- A Not-Rated wave researched all 18 unrated coins with independent verification. Ratings come only from verified facts; coins that remain Not Rated keep their documented research and unknown-is-not-zero charges.
- Complete, verified, dated curated compositions and whole-asset portfolio observations admit an explicitly reconciled unclassified residual at or below the policy-owned 0.1% floor. The residual stays charged as bounded-unknown; above-threshold, unrecorded or unchargeably small positive tails reject, and zero-residual behavior is unchanged.
- Reviewed, dated, primary-sourced suspension removes only an exact redemption channel's capacity and credit, with public diagnostics. Independent routes retain their evidence; suspension cannot infer total-exit failure, measured-adverse attribution, lifecycle or wind-down. VNXAU's legacy vnx.li rail is suspended without rating the asset.
- Inventoried deployments with unresolved economic boundaries use the smooth supply-share band without a second Control evidence cliff below 15%. Observed zero and captured shares retain bounded facts and gaps; unknown shares, exposure at or above 15%, out-of-cohort uncertainty and verified adverse charges retain their treatment.
- All six reviewed registries isolate malformed asset-local evidence and duplicate keys into precise admission quarantines without blocking healthy assets. Envelope failures remain global; valid-file provenance digests and scoring stay unchanged.
- Reviewed finalized EVM pending-message observations supplement HTTPS sources with exhaustive identities and generation-bound block/hash anchors. Unavailable reads and escrow surplus reject; conservation includes excluded receipt holdings. scrvUSD remains unresolved without every satellite's authenticated pending source.
- Reviewed, fail-closed provider-row exclusions remove proven distinct liabilities only from unresolved-deployment and unmatched/unreviewed bridge-share numerators, with public proof traces. The original aggregate denominator, provider observations, reconciliation and all other materiality facts remain unchanged.
- The decision wave rates mTBILL C-/50 using its verified October 1 composition with a charged 0.0049% residual, and moves FRAX from 55 to 56 by excluding the migrated Fraxtal frxUSD row. AUDM refreshes to September 30, EURQ to August 30 with its 1% residual charged, and ZARP's publication date corrects to September 21; assets without newer reports receive no date bumps.
- Exit exhaustion requires score-eligible, output-resolved exact-complete measurements, known or stale. Lower bounds retain positive credit but, like documented terms and modelled capacity, cannot prove exhaustion; non-exhaustive gaps retain bounded uncertainty.
- Wrapper unwinds require exact-complete measurements, inherited parent controls are not double-charged, and producer-side gaps do not trigger the missing-facts form fallback. Disclosed unquantified fee formulas retain uncertainty but never score worse than undisclosed fees.
- Partial disabled-final execution labels cannot remove established issuance economics: known liability reach and adverse semantics persist until current execution-complete closure proves removal. Unknown activation or reach cannot establish adverse promotion.
- Whole-composition obligation closure gates standing and portfolio reserve observations, not partial on-chain technical evidence. Technical observations retain source bindings and unresolved obligations without composition or financial-assurance credit.
- Reviewed EVM supply and identity reads require canonical block-hash pins, including direct fallback. Economic accounting rejects overlapping deductions and mixed snapshot tuples, reconciles canonical provider aliases, isolates malformed plans per asset and requires exact-context-slot Solana blocks. Economic capture/publication handoff remains owner-deferred before plan activation.
- Physical-to-USD proof traces publish net USD only for positive proceeds; non-positive or below-minimum requests publish null with explicit rejection reasons and no score credit. Cost retains the full loss from signed proceeds without zero-clamping.
- Compile hot-path optimisations preserve byte-identical publications through incremental evidence hashing, copy-on-write projections, admitted-fact reuse and streamed canonical gzip. Real-capture success at 128 MiB old-space improves from 2/6 to 6/6; warm CPU falls 24% at 160 MiB.
- The final review covers 148 D/F cards with independent verification of every score-bearing change. Binding KAG terms establish no holder reserve title and discretionary redemption (F/38); BRL1 refreshes to October 1; legacy ICON bnUSD loses a misattributed Sonic overlay; NUSD's 0.51-USDC programme records a holder-exit incident. ctUSD allocation and identity, oracle and route terms are corrected without date bumps.
- Reviewed opaque oracle topology becomes bounded issuer non-disclosure at component quality 45 and ceiling 55, without critical weak-oracle, common-mode or wrapper-NAV adverse signals. Verified unsafe and single-source/manual pricing keep their treatment; public coverage, curation and API expose oracle-topology-undisclosed. Backing attribution names actual maturity, liquidity or private-credit triggers.
- NUSD's verified 0.51-USDC programme replaces historical queue terms while retaining its incident, eligibility restrictions and raw-capacity gap. Reviewed over-budget costs retain exact traces and yield zero within-budget execution rather than quarantine. yUSD's route becomes unknown from current pause evidence without invented onset or loss.
- DOLA separates attributable Frontier bad debt from explicitly marked unknown non-FiRM issuance on the same live denominator; unknown residuals stay bounded and charge once. USDh uses its September 30 scoped custody report and STRCx credit exposure, retiring unsupported March metrics; cNGN's December 2025 allocation remains historical only.
- Sourced unavailable CDP metrics require null values and cited rationales, never numeric adverse signals or favorable credit. Unauthenticated applicable components retain bounded-unknown charges and traces; independently evidenced quality remains intact.
- Economic supply plans and provider-row exclusion evidence/key collisions admit per asset with exact-field quarantine paths, preventing cohort-wide import failures. Native single-route tables reuse the admitted envelope; healthy publications and valid registry digests remain unchanged.
- ctUSD becomes a verified pure fixed-unit M wrapper (D/47 to C-/54), retaining parent, bridge, permissioned swap-out, intervention and upgrade risks. USDK and XO retain default classification pending exact deployed-source equivalence.
- Small-item rulings preserve conservative BRLV settlement, sdUSD parent treatment, legacy USDv August scope and Pharos-owned physical/integration gaps. Unauthenticated BUCK liquidation and dormant FXD backing claims no longer imply measured adversity; suiUSDe July upstream metrics remain context. VCRED listing stays unchanged, with no date bumps.

Origin: Contemporaneous release record

Commits: Commit provenance not recorded