Safety Scores Changelog: v9 archive

Authored linked reserves require an explicit dependency kind, and legacy runtime rows inherit only a uniquely reviewed kind for the same native asset. Mento preserves native and bridged claim identities, USDat and Frankencoin name their immediate held intermediaries, and Avant exposes measured positive-long holdings without inventing tracked links. Pillar weights, materiality thresholds and evidence admission rules remain unchanged.

• The authored sweep assigns collateral to 32 previously untyped coinId slices across 18 assets, including seven inactive slices, without claiming refreshed reserve reviews. Runtime rows with no kind may inherit only a unique authored reserve or adapter-declared kind for the same native coinId. Missing or conflicting reviewed kinds are withheld as coinId-without-depType rather than silently treated as collateral. New linked producer rows explicitly carry collateral.
• Mento separates native USDC, EURC and USDT from reviewed axlUSDC, axlEUROC and USDT0 representations. The saved shared-reserve observation aggregates AUSD 24.11620494910088%, sUSDS 22.604477552357462%, USDT 9.73329901558276%, EUROP 5.443563870521741%, EURC 5.094805449797983% and USDC 3.799348672498531%. Reviewed bridged contributions are 1.373366633011464% axlEUROC, 1.111004752080174% USDT0 and 1.1069622264377186% axlUSDC. Mixed parent edges retain contribution annotations in reserve slices and producer metadata, not a misleading whole-edge intermediary. CDP coins retain their single cUSD collateral parent; cUSD's authored composition remains on its September 4 basis with zero keyed bridge rows.
• USDat retains its PYUSD serial parent while naming MoonPay PYUSDx as the immediate held claim. Frankencoin retains its 0.1% yBOLD collateral on the September 4 basis while naming held ysyBOLD vault shares. These annotations change provenance, not dependency weights or scores. Representation identity and documented lineage do not constitute independent bridge or escrow solvency assurance.
• Avant exposes 20 measured positive-long holdings on the September 22 checkpoint, normalized by $1,013,103,133.459377 gross positive long assets. Financing debt of $887,428,455.3230357 and net NAV of $125,674,691.9077302 remain separately disclosed. All tracked links remain withheld pending same-checkpoint position-to-token or receipt-contract and bridge-route evidence. Source labels do not establish identity, gross holdings are not divided by NAV, and unsupported cross-venue netting does not reduce exposure.
• Against committed W2 HEAD 4fb31b009, the original fixed-input replay changes 14 cards. USDat and Frankencoin change only dependency provenance. Mento BRLm, cEUR and KESm retain scores 59 C, 57 C and 59 C while reviewed reserve classification changes backing; USDO retains 50 C- and identical numerical pillars while explicit authored kinds rotate two reserve evidence keys. No binding cap changes. The only original score or grade change is nTBILL 41 D to 38 F on legacy untyped rows.
• The original replay has 259 to 254 dependency edges, not five newly offset Reservoir edges: Reservoir's five reviewed edges were already in the W2 baseline. Four transiently withheld legacy links are FRAX USDT 0.3%, nBASIS USDC 0.3%, and nTBILL USTB 87.3% plus JTRSY 12.7%. An explicit typed-stored-row counterfactual restores all four, nTBILL to 41 D, and the exact prior nBASIS and nOPAL backing evaluations. The fifth old ReUSD USDe 0.3% link remains intentionally withheld; the reviewed pooled Re producer emits no tracked token dependencies. FPI, yzUSD and syzUSD inherit the corresponding backing and availability changes without original grade flips.
• Diagnostic modified captures using new Mento, Avant and Re fixture outputs at clock 1790745438 preserve all Mento integer scores and grades, yield ReUSD 55 C with backing 48.75, and remove the newly introduced legacy missing-kind reasons after the four typed rows are restored. Avant conditionally moves 60 to 62 within C+, while savUSD moves 53 C- to 55 C and its parent cap follows; no tracked Avant edge is admitted. The saved Mento payload alone has no verified update clock, and fixture replacement bypasses production freshness admission. These conditional results are replay evidence, not live scoring admission or a forecast of the next publication.

Contemporaneous release record.

Commit provenance not recorded

Reserve producers preserve measured small positive holdings and reconcile immediate claim identities before admitting dependency links. Tori's nested holdings replace an aggregate bucket, OnRe identifies Solomon's replacement USDv mint, Reservoir identifies Sentora PRIME's PYUSD claim, and Re's pooled portfolio remains unlinked. Updated reserve evidence changes the affected backing evaluations without changing pillar weights, materiality thresholds, or evidence admission rules.

• Accountable reconciles each reviewed nested leaf to its parent category before publishing measured slices. Tori's Ethereum USDC exposure is 14.59744500315145%, including 14.211353838506993% supplied to Morpho and 0.38609116464445764% idle; USDT is 0.13569110007170007%. Undisclosed AUSD and Base Morpho dust remain measured and unlinked. The material USDC share is evaluated as a basket exposure while Morpho strategy credit and liquidity risk remain distinct.
• OnRe's refreshed September 28 schedule identifies Solomon's replacement USDv mint at 0.34270919563349855% and refreshes all other holdings on the same denominator. The $1,007,314.51 asset-total/AUM shortfall remains degraded, and the adapter remains weak-live-probe. Reviewed static evidence can change backing, but a recovered adapter fetch is not independent live scoring admission.
• Reservoir's verified Ethereum Sentora PRIME position is a high-risk PYUSD lending-vault claim at 3.5190284744068525%, not an unlinked PRIME label. Agua's 0.012354796543427447% USDC-denominated position also survives rounding. The reviewed September 30 observation date supports the curated composition; it is not an issuer accounting timestamp. Live API freshness remains unverified and cannot independently admit that balance sheet into collateral scoring.
• Re Metrics retains its measured protocol-pooled portfolio but emits no tracked token dependencies. Token-specific byAsset numerators do not allocate pooled off-chain capital or establish the senior/junior loss waterfall. The reUSD to sUSDe link, including the undecomposed LP position, remains withheld. Its dependency-relationships review does not promote protocol-wide holdings into a reviewed full reUSD composition, so unavailable token attribution remains visible in backing rather than receiving a speculative link.
• ftUSD's September 30 official dashboard composition is USDC 66.36903180891656%, USDT 33.39421400428467%, USSD 0.23410757307492755%, and USDe 0.0026466137238624625%. Exact reviewed token addresses replace an exact collateral-row count; omitted zero slots create no exposure, duplicates reject, and unreviewed positive collateral remains measured, unlinked and named. The producer remains weak-live-probe, so successful fetching alone does not establish independent scoring evidence.
• Frax, Nest and InfiniFi producers retain unrounded positive measured percentages instead of quantizing dust away. The saved Frax payload retains 0.15189863361668032% USDC and a positive PYUSD holding of 0.0000000016312479603932255%; saved Nest payloads retain 0.03615837643245557% pUSD in nOPAL and 0.037764674335609344% nTBILL in nWISDOM, while InfiniFi retains its two small PYUSD farms. True zero rows still create no dependency edge, source-total drift is not repaired, and existing freshness, reconciliation and warning gates remain in force.
• Agora discovery again resolves exactly one reviewed July PDF through Fern's relative same-origin, signed S3 or stable-mirror transport aliases. The complete reviewed content-addressed path, report month, byte length and SHA-256 remain fixed, and ambiguous or duplicate links still fail closed. This restores producer discovery rather than advancing report facts or changing a score from the frozen input.
• Report v6 adds compact commonModeGroups from the exact evaluator plan, with canonical failure-domain identity, sorted members, and optional references to existing card caps and deployment adjustments. Only multi-asset groups publish. The projection neither adds a score penalty nor changes evaluator group membership.
• On the original W2 replay of generation report-cards:9.94:1790745311 at clock 1790745438 against HEAD 47e9d3ebe, nine assets have scoring or dependency deltas and no grade changes. ReUSD moves 57 to 56 inside C and Tori 53 to 52 inside C- on old adapter rows; FRAX, FPI, yzUSD and syzUSD inherit small backing changes, OnRe backing moves 64.66175160707397 to 64.60435617990784 with 48 D unchanged, and ftUSD dependencies refresh with 61 C+ unchanged. Reservoir's initial backing drop from 60.44125954249999 to 50 was a missing reviewed observation date, not an intended reserve penalty; restoring that date yields 60.971536903821715 with 19 F unchanged and removes missing-reserve-composition.
• Modified captures using the new admitted adapter slice identities restore Tori to 53 C- with backing 50.256817850591986 and remove its introduced unstructured reserve reason. ReUSD becomes 55 C with backing 48.75 and no tracked dependencies; its token-attribution classification gap remains intentional. With new Re and Frax output, FRAX remains 56 C, FPI 67 B-, yzUSD 64 C+ and syzUSD 54 C-, with no grade flips. These are conditional producer-output replays at the frozen scoring clock, not forecasts of the next live publication. OnRe and ftUSD weak-probe output and Reservoir's undated live output are not promoted into these scoring inputs. Observe successful reserve production and the first exact-input publication after deployment.

Contemporaneous release record.

Commit provenance not recorded

Two score-semantic changes: issuer redemption routes honor reviewed explicit stablecoin payouts ahead of the legacy fiat projection, and retained Uniswap V4 exact PoolIds resolve independently of indexed USD valuation. Theo thUSD's executed stablecoin-redeem rail and measured Cash Wallet capacity are curation context, not a new scoring rule.

• Issuer redemption routes now honor reviewed explicit stablecoin payout identities before the legacy fiat projection. The bounded review identifies USDC payouts for pathUSD, USYC Teller, pUSD and USDO, and USDC/USDT payouts for thBILL, MXNB's conversion rail and StandX DUSD; HLUSD's existing explicit basket is honored. Unreviewed issuers retain the legacy default, with no variant-parent inference. Tracked outputs require captured valuation evidence rather than synthetic fiat par: a single payout remains quality 100 at par, while multi-output routes retain conservative stable-basket quality 80 and weakest-priced-component semantics (3 fewer raw route points at par). Missing output prices remain unresolved, not assumed $1. USDN remains unchanged because current primary evidence does not confirm the former Express USDC payout. Physical-delivery behavior is unchanged.
• Uniswap V4 exact-identity admission now separates physical PoolId/PoolKey evidence from the subgraph's USD valuation. Retained exact IDs are queried without the indexer's TVL floor and may resolve despite finite zero, negative or materially divergent indexed TVL, while identity-poor token/fee fallback keeps positive indexed TVL, unique-candidate collision handling and the 2% affinity requirement. Positive retained TVL, zero hooks, active liquidity, currency/hash identity, independent references, the 1.02 favorable-output ceiling and all runtime/quote/capacity gates remain unchanged. Public source-repair candidates include USDD, USDT, USDS, USP, AUDM, sUSDD and thUSD; repaired identity coverage is not guaranteed depth or a score improvement. Ethereum remains active and other registered V4 chains remain shadow, with no pool allowlist or new shadow rollout machinery.
• Trigger: the thUSD/USDC pool's subgraph TVL was -$222,031.94, which previously blocked exact identity despite a valid PoolKey and positive retained TVL. Measured does not mean deep: at Ethereum block 26088713, a $1,000 thUSD sell returned $966.94. The seven affected pool assets are thUSD, USDD, USDT, USDS, USP, AUDM and sUSDD; standalone Liquidity Score arithmetic and retained TVL/volume are unchanged.
• Curation context: thUSD moves from an issuer route to an executed stablecoin-redeem rail, consistent with USDe. The new theo-thusd-redemption adapter measures Cash Wallet capacity without a fallback; this is route evidence under the existing model, not a third score-semantic change.
• On the frozen replay of generation report-cards:9.94:1790752511 at clock 1790752628, only thusd-theo moves, from 38 F to 43 D, from its configuration, with no quarantines. The capture still carries the old issuer-api redemption observation and lacks thUSD's live-reserve fallback observation, so this is not proof of new measured capacity. Issuer-output and V4 effects are producer-driven and can appear only after the first production redemption and DEX cycles. Expected candidates for route or score movement are thBILL, MXNB, StandX DUSD, pathUSD, USYC, pUSD, USDO and HLUSD for payout treatment, and thUSD, USDD, USDT, USDS, USP, AUDM and sUSDD for exact V4 coverage; no direction, integer score change or grade improvement is guaranteed.

Contemporaneous release record.

Commit provenance not recorded

Dependency admission now reconciles native reserve identities with reviewed relationship kinds, preserves small positive reserve shares, and rejects manual collateral omitted from linked reserve identities. Reviewed reserve and parent corrections change the affected backing baskets and serial limits; intermediary annotations and shared-book provenance explain the claims without adding a new scoring rule.

• Native reserve rows with a tracked coinId inherit the reviewed depType for the same uniquely matched source key or corroborated identity. Conflicting native and reviewed identities or relationship kinds withhold the link and publish named invalid-dependency issues rather than choosing one. Blast USDB now emits its DAI relationship as a serial mechanism claim, not a collateral basket, so DAI applies the mechanism parent limit.
• Reserve dependency aggregation carries unrounded fractional shares, including a 0.000148% holding, and never canonicalizes a tiny positive mapped total to zero. Previously quantized adapter inputs cannot be recovered by derivation; adapter precision changes retain their own measured source values. Small positive edges remain eligible for backing evaluation regardless of display thresholds.
• A manual collateral upstream absent from a positive linked reserve identity now fails authored schema validation and exposes manual-collateral-not-in-reserves in effective derivation. Reserve-owned basket weights cannot silently discard an unrelated manual collateral claim. A sourced non-default exit, control-operator, or oracle-NAV role may coexist with a reserve link to the same upstream, while redundant default basket reviews remain invalid. MegaUSD retains measured USDC and USDtb Backing exposures alongside its separately reviewed USDtb control-operator role and exact 0.001 authored anchor; reserve losses do not displace or inherit the control role.
• MetaMask mUSD gains a reviewed serial M parent. Spark spUSDT and spUSDC retain native USDT and USDC parents and add full USDS serial mechanism claims: the weaker parent limits the score, never additive shares. spUSDC's unresolved deployed strategies are now basket-needs-split with 96.742127158783% known unknown exposure rather than zero; the dated weights are not revived. Polymarket and Plume pUSD change from collateral baskets to serial USDC wrapper claims, so the full parent limit replaces weighted basket treatment. USN removes the unsupported Anemoy JAAA mapping from its producer configuration and reserves, preventing false future edge admission.
• DAI and USDS admit the canonical LitePSM USDC holding against shared Sky group debt after token and pocket verification, with an explicit residual. This changes their backing baskets and any downstream parent limits. The measured stock and shared-book identity prevent duplicate exposure statistics, not duplicate or novel scoring rules; an out-of-band reconciliation remains unlinked.
• DOLA LP-secured debt, including Yearn LP vaults, remains an unlinked undecomposed protocol-position exposure instead of attributing all LP debt to its non-DOLA constituent. Direct collateral debt remains linked. The saved 2026-09-29 capture has $422,722 direct sUSDe debt versus $56.003 million of DOLA-sUSDe LP-secured debt; the corrected evidence removes the overstated sUSDe dependency share and carries the undecomposed debt in unknown exposure.
• MegaUSD's dynamically measured USDC and USDtb reserves replace an unknown envelope. GHSm, COPm, and AUDm change from CDP to fiat-cash mechanisms and remove unsupported Liquity V2 infrastructure while keeping the shared Mento reserve basket. Theo's measured USDT slice retains 0.0148486% rather than 0.01%. USDaf source-key corrections restore identity-based classification without pinning dynamic weights. ZARm's existing reserve identities and weights are unchanged by explicit collateral depTypes; insufficiently evidenced satUSD USDT and FXD CGO claims remain unlinked.
• XMD's XUSDC and SPUSD's soul-bound sUSDC lose USDC basket links because canonical escrow or the exact underlying remains unverified. AID's measured USDC share changes from 1.142545% to 1.13622166%, while its Binance-Peg USDT holding remains unlinked without canonical escrow evidence. Alto DUSD's pinned issuance-path snapshot changes frxUSD from 91.67106318% to 78.75210279%, sUSDe from 0.00024437% to 0.0006234%, and syrupUSDC from 0.00024451% to 0.00062376%, with 21.24665005% exogenous ETH residual. These corrections can change backing and dependency limits; strategy-vault lineage is retained rather than recategorized.
• mTBILL's historical measured weights retain 93.69915148717834% USTB, 6.298067468250501% BUIDL, and 0.002781044571167425% residual without reviving stale evidence. dEURO's CDP-only view, msUSD's eligible strategies, and HedgeCore's documented strategies now declare selected-slices rather than claiming measured full compositions. AlUSD remains selected-slices. These research scope corrections grant no new positive scoring admission; BENJI, WTGXX, and TBILL remain quarantined after failing runtime supply gates.
• GHO retains measured USDC GSM dust with 12-decimal producer percentages alongside USDT; the fresh reviewed envelope adds the exact USDC collateral identity without inferring unmeasured remote allocation. Agora's unlinked stablecoin category is classified as stablecoin rather than other, and reviewed source identities align with its July 31 examined envelope; individual USDC and PYUSD balances are not invented. USDe's authored liquid-cash scaffold changes from 86.9% to 81.1% with the existing producer buckets reconciled, but unresolved constituents remain candidates only. USDD's origin-chain attribution and U's single-bucket source gaps remain blocked rather than gaining speculative dependencies.
• Reserve slices may carry an optional bridge, wrapper-token, or vault-share intermediary annotation only with a tracked coinId; dependency facts retain it for publication. An aggregate or synthetic parent claim does not inherit a partial bridge annotation: Plume's reviewed native/legacy split remains a provenance limitation with a null aggregate intermediary. A unique reviewed wrapper identity, including stUSD's unverified Binance-Peg USDC representation, retains its annotation without changing variant lineage scoring. Keyed reviewed classification rows may have zero percent to classify an absent residual without admitting a dependency edge; unkeyed zero rows remain invalid. These schema allowances have no score effect.
• hbUSDT explicitly expresses its already-retained USDT wrapper lineage on the protocol-position envelope to carry an unverified USDT0 HyperEVM annotation; its constituent allocation remains 100% unknown and the review scope is dependency-relationships. No new measured basket or serial parent is claimed. Dialectic DUSD's named Pareto position is joined to AA's exact position token, but no AA basket edge is admitted without a reconciled combined claim and denominator.
• Reserve evidence corrections can withhold an entire reviewed static composition, not just an individual dependency. AID and SPUSD no longer satisfy verified full-composition admission, while FXD and satUSD carry unresolved reserve dispositions. The frozen replay therefore adds missing-reserve-composition: AID moves 40 to 41, its sAID child 32 to 33 through the parent ceiling, FXD 38 to 36, and satUSD 53 to 52, all inside their existing grades. dEURO's selected-slices review also stops supplying full-composition classification to its captured CDP rows, adds material-reserve-slice-unstructured, and moves 51 to 50 inside C-.
• Agora's reviewed Treasury category changes from money-market-fund to treasury-bill, and its July report lacks a verified publication date rather than inheriting a signature date. On the frozen old reserve rows, Treasury exposure falls from 89.1 to 81.45 and assurance remains bounded at 35; the backing change propagates to iUSD and the affected Mento baskets without an integer score or grade change. This is distinct from the new adapter's stablecoin-category classification, whose successful live refresh is not established by this replay.
• GHO's reviewed Monad residual changes from treasury-bill to other, moving that component from 61.25 to 64.25. The frozen replay's small backing improvement propagates to sGHO, stkGHO, yzUSD and syzUSD without an integer score or grade change. The capture contains no new measured USDC dust row, so this replay movement is not attributed to the adapter precision correction.
• USD3's Steakhouse USDC position now remains an explicitly reviewed, unlinked Morpho V1 vault holding after block-pinned contract reads distinguished it from the tracked V2 share token and direct USDC. The producer and review must agree on that immediate identity. Polymarket's native producer relationship is aligned to its reviewed wrapper kind so a producer refresh does not recreate the historical collateral-kind conflict.
• The default-off hypothetical dependency-boundary seam leaves canonical evaluation without overrides unchanged. On the original W1 replay of generation report-cards:9.94:1790745311 at clock 1790745438, 48 assets other than the separately owned Theo change have scoring or dependency deltas. DAI 81 A- and USDS 80 A- become 79 B+ on old Sky adapter rows, while USD3 76 B+ becomes 69 B- on an authored identity contradiction corrected during triage; these are not claimed as final live grade outcomes. Modified captures using new adapter output restore DAI to 81 A-, USDS to 80 A-, and xDAI from 61 to 62 inside C+, and remove the introduced Sky classification reason from EURO3, FPI, FRAX, nUSD and USDP. New M-wrapper output removes mUSD's old-envelope classification gap and produces 55 C rather than the old-row replay's 57 C; corrected DOLA output produces 56 C rather than 57 C with only 0.4% direct sUSDe dependency. These producer substitutions establish replay artifacts and intended identity treatment, not an exact next-production forecast. Old rows can remain eligible between deployment and the first successful reserve sync, so the first publication must be checked after fresh adapter output enters the exact input. The evaluation-build manifest must be regenerated for the changed pinned sources.

Contemporaneous release record.

Commit provenance not recorded

The XAUT lock/mint group attribution now reconciles Tether's disclosure to finalized Ethereum state on the circulating liability alone: finalized `totalSupply()` minus the treasury balance must equal the disclosed `totalAuthorized - notIssued`. It no longer requires total supply and the treasury balance to match the two disclosed inputs separately, because unissued treasury inventory is not a liability and the attribution only consumes the circulating amount.

• Trigger: Tether publishes `transparency.json` once a day, while the observer reads the live chain. At 17:08:47 UTC Tether minted 119,670.541 XAUT into its own treasury after the snapshot stamped 2026-09-27 23:30 UTC. Total supply and the treasury balance both rose by exactly that amount and circulating supply reconciled exactly with the disclosure, but the two-term check rejected the packet with `transparency-onchain-mismatch` and `xaut-tether` fell from 78 B+ to 48 D. A treasury-only mint or burn now leaves the attribution admissible because it changes both terms equally.
• What still fails closed: a circulating mismatch between chain and disclosure (still `transparency-onchain-mismatch`), a treasury balance above total supply, non-zero quarantined supply, a non-positive circulating liability, an adapter lock outside the circulating liability, a stale, future, or skewed disclosure, an unconfirmed finalized block, and any token, treasury, adapter, code-hash, or route-inventory identity mismatch. The observer and the packet re-validation apply the same shared rule.
• Frozen replay captures carry no attribution packets, so replaying them moves no card. A live observer run at Ethereum block 26077853 (clock about 1790621399) admits the packet under the new rule: on-chain total supply 827,417.63 XAUT and treasury 138,093.970468 XAUT against the pre-mint disclosure of 707,747.089 and 18,423.429468, with a circulating liability of 689,323.659532 XAUT on both sides. The partition returns a canonical row of about $2.735B and an XAUt0 group of about $0.122B.

Contemporaneous release record.

Commit provenance not recorded

A per-chain supply row that several profile routes compete for (`ambiguous-chain:<asset>:<chain>`) no longer blocks the bridge review by itself. When the row is below the deployment and common-mode materiality thresholds and every candidate route on that chain is reviewed, it is accepted as bounded supply evidence: the chain row is an upper bound on each candidate deployment's share, so it cannot hide a material deployment.

• Trigger: USDC's reviewed native X Layer deployment was added beside the reviewed third-party X Layer representation, so the single X Layer chain row (about 0.02% of supply) could no longer join one route. The bridge-inventory proof rejected every ambiguous row regardless of size, which left the bridge review bounded-unknown, raised `runtime-bridge-materiality-unavailable`, capped USDC at 55, and capped every USDC wrapper through the parent cap.
• An ambiguous chain row is accepted only when its share is below both the deployment-material and common-mode thresholds and the chain carries at least two candidate routes, all reviewed: identity is known and only the within-chain split is unmeasured. A material ambiguous row, or one with any unreviewed candidate route, still fails closed. Shares are still not summed across rows.
• The evaluator's null-share deployment bound now includes the unsplit ambiguous row for the control's chain instead of reading an unavailable within-chain share as zero, so a null-share deployment on a material ambiguous chain stays fail-closed.
• On replay of the production capture from generation `report-cards:9.92:1790617549` at clock `1790617614`, 16 assets move, all USDC or USDC dependents, and every one returns to its pre-incident replay score: `usdc-circle` C 55 -> A- 80; `gtusdc-gauntlet`, `gtusdcp-gauntlet`, and `usd3-3jane` D 45 -> B 70; `yousd-yield-optimizer` D 43 -> B- 68; `steakusdc-steakhouse` D 45 and `susdc-spark` D 46 -> C+ 64; `dusd-dialectic` F 39 -> C+ 61; `bbqusdc-steakhouse`, `syrupusdc-maple`, `usdcx-movement`, and `yvusdc-yearn` D 45 -> C 55; `aa-falconx-mev-capital` D 43 -> C- 53; `eearn-ember` and `stusd-stoneyield` D 45 -> C- 52; and `autousd-auto-finance` 43 -> 44 inside D. `buidl-blackrock`, whose ambiguous Ethereum row carries about 20% of supply, stays capped.

Contemporaneous release record.

Commit provenance not recorded

An asset whose intake publishes only an aggregate circulating quantity and no per-chain partition no longer bounds that quantity on a bridge gap the control pillar already owns, and a same-notional route the method withholds by design attributes to Pharos's missing integration instead of a feed failure.

• The aggregate supply lane now publishes the circulating USD as known when there are no per-chain rows to join, diagnosed as `supply-review.unpartitioned-aggregate`; the exit pillar can therefore size its stress request. A join that ran and failed over real per-chain rows, a missing bridge profile, stale input, and a missing or rejected runtime attribution packet all still fail closed.
• Bridge-materiality availability keeps a single owner on the control pillar (`runtime-bridge-materiality-unavailable`): no control reason was lost, and `cngn-compliant-naira` gains seven stricter per-route materiality rows once per-route materiality is evaluable.
• A gapless `missing-same-notional-route` — synthesized when the method withholds a route and no authored producer gap exists — now attributes to `integration-missing` rather than `producer-failed`; producer failure is claimed only through an authored causal gap carrying a `sourceGapId`. Scores, ceilings, and NR treatment are unchanged, so only the published limiting-fact owner moves.
• On replay of the production capture from generation `report-cards:9.91:1790140517` at clock `1790140597`, 20 assets move. Eleven grades flip: `sdola-inverse-finance` D -> C, `dusd-dialectic` D -> C, `susdai-usd-ai` D -> C-, `susds-sky` D -> C, `syrupusdt-maple` D -> C, `sdai-sky` C- -> C, `susde-ethena` C- -> C, `ustb-superstate` C- -> C, `syrupusdc-maple` C- -> C, and `usdcx-movement` C- -> C, all from a higher exit pillar; `usn-noon` B- -> C+ moves the other way on the refreshed mechanism overlay rather than this supply change.
• Nine more assets move inside their grade: `cusdo-openeden`, `brlv-crown`, and `krwq-iq` up, and `nbasis-nest`, `ntbill-nest`, `nopal-nest`, `acred-apollo-securitize`, `srusd-reservoir`, and `susn-noon` down.

Contemporaneous release record.

Commit provenance not recorded

Proof-of-reserves reports can support a known assurance component for at most 100 days from the conservative UTC start of their reporting-period end. Older reports remain visible as stale evidence rather than current assurance.

• Fiat-cash, commodity-claim, and Treasury-bill mechanism reviews apply the same policy-owned 100-day report-age cap.
• Assurance components bind to the report's own period, publication date, sources, and payload instead of inheriting only generic mechanism-review evidence.
• A newer report discovered by an independent-assurance adapter still fails closed until its exact URL, hash, byte length, dates, and reconciled rows are reviewed.

Contemporaneous release record.

Commit provenance not recorded

Chain maturity is now an evidence-backed, time-bounded admission rather than a static roster. Every citation carries its captured assertion, independent verification outcome, and reachability state; unresolved sources remain pending.

• The five chain-maturity gates derive matureChains from the review registry at the fixed capture clock, with a numeric quarterly nextReviewAt and explicit expired state.
• The 404/non-supporting review queue holds Hyperliquid, Conflux, and the other affected chains outside mature common-mode treatment until evidence is independently remediated.
• Resolved evaluation clock and mature-chain identity are persisted in evaluated-set envelopes so historical replay does not consult wall-clock time.

Contemporaneous release record.

Commit provenance not recorded

Physical gold and silver outputs are valued at spot less published fees even when delivery or handling charges are unpriced. The uncertainty is explicit rather than treated as free delivery or a refusal to value.

• Unbounded delivery carries an explicit output-quality cap of 55, strictly below bounded physical delivery at 65 and never above fiat-par quality.
• Published percentage and flat fees reduce value; unbounded delivery receives no invented USD deduction. Minimum lots still apply and every physical output remains ineligible for same-notional credit.
• Historical captures lacking the raw USD-per-troy-ounce reference remain unresolved; closure requires the next peg producer cycle and refreshed redemption observations.
• Evaluation-build identity: the V9 evaluation-build digest now covers the evaluator's runtime import closure — gap-index, operational-market-depth, unavailability-roots and the reviewed chain-maturity registry enroll alongside the existing inputs — producing evaluationBuildDigest 474ced11fd05835a0f953c1041e73de92c709d1320423e7c1146d0f08f39fcc1; later edits to those score-bearing sources rotate the identity again without a methodology bump.

Contemporaneous release record.

Commit provenance not recorded

A separately reviewed physical-delivery contract values XAU or XAG at the unscaled USD-per-troy-ounce reference, with explicit token weight, delivery minimum and bounded percentage, flat and delivery fees. Physical metal never receives fiat or same-notional settlement credit.

• The physical-commodity-delivery output class reuses the blue-chip collateral policy tier of 65; minimum-lot and fee haircuts lower retained value instead of granting a new premium.
• Below the delivery minimum the requested lot has zero deliverable value. Missing structured terms or an absent, future or older-than-one-day commodity reference retains the unresolved output gap.
• DGLD remains excluded from the commodity peer median. The evaluator never substitutes token pegReference.valueUsd for a USD/oz reference.
• Historical captures without the explicit USD/oz field cannot acquire physical valuations retrospectively; producer refresh and equivalence evidence are required before any coverage claim.

Contemporaneous release record.

Commit provenance not recorded

A current exhaustive-liability attestation can complete transfer review scope for one exact active deployment with positive admitted aggregate supply and no bridge or wrapper representations. This is attributed scope, never observed chain supply.

• Singletons and savings-passthrough, risk-absorption, and strategy-vault share tokens qualify structurally; pure-wrapper, bond-maturity, and unspecified variant kinds do not. No asset allowlist grants admission.
• The attestation uses the existing 365-day reviewed-research window with an explicit expiry. Registry structure is rechecked every capture: a second deployment, unresolved identity, or bridge/wrapper representation immediately invalidates attribution.
• Exact observed transfer materiality retains precedence. This transfer-only lane creates no per-chain numbers and does not complete freeze, bridge materiality, settlement concentration, or economic-control scope.
• VUSD has two deployments; xDAI's WXDAI wrapped representation is not its native liability. Neither qualifies. The separate fiat CoinGecko fallback mapping repair preserves chain identity already returned by a successful on-chain probe.

Contemporaneous release record.

Commit provenance not recorded

The binary $100K exit-materiality gate now tests the producer-measured executable notional before output-value retention. Retention still discounts continuous capacity and output quality, so the correction removes a threshold double-charge without treating aggregate TVL or volume as executable liquidity.

• A route that demonstrably executes $100K within the reviewed cost bound clears the absolute materiality gate even when a small output-asset deviation values the proceeds just below $100K. Routes below $100K still fail the gate, and an output with zero retained value still scores zero.
• Output-value retention continues to discount completion, capacity interpolation, and output quality. The score therefore still reflects depegged or otherwise impaired proceeds after materiality is established.
• On replay of `agents/v9-captures/capture-20260919-paxg.json` at clock `1789850801`, three grades move: `paxg-paxos` NR -> 65/B-, `susd1plus-lorenzo` 36/F -> 44/D, and `usd1-world-liberty-financial` 48/D -> 56/C. No evidence was added and DEX route coverage remains fail closed.

Contemporaneous release record.

Commit provenance not recorded

Variant parents, explicit wrapped-asset claims, and manual non-collateral relationships are derived independently of reserve composition. Unmapped live reserves still cannot restore curated or manual collateral weights.

• A rejected live reserve link no longer deletes the separately authored serial parent claim or its inherited mint-control path.
• Explicit curated wrapper identities produce unit serial claims rather than reviving old reserve percentages; independent manual structural relationships survive mapped and unmapped compositions.
• Live mapping provenance, per-slice rejection reasons, and the curated basket admission gate remain intact. No evidence is added.

Contemporaneous release record.

Commit provenance not recorded

A live composition with no mapped tracked-asset slices now remains live-unmapped with no dependency edges, instead of restoring the older curated or manual graph after a failed classification join.

• Dependency facts retain per-slice rejection reasons for unmatched identities, expired matching classifications, and explicit reviewed non-links.
• Curated and manual fallback weights apply only when no live composition exists. Partial live mappings remain authoritative.
• No evidence is added; dependency edges and downstream scores may change where stale curated weights previously bypassed the live identity join.

Contemporaneous release record.

Commit provenance not recorded

A dependent's exposure to an upstream with an open reserve gap is one unresolved claim, not one per upstream reserve slice. The backing projection now folds every slice-level reason an upstream raises into a single reason per projected code, source code, and owner on each dependent exposure; the slice paths survive in the causal key. No evidence was added and no score or grade moves: the open data-point count stops multiplying one stale Tether attestation across every USDT holder.

• `projectResolvedUpstreamReserveExposure` (`shared/lib/safety-score-v9/backing.ts`) groups the projected upstream reasons by projected code, source code, and responsibility before emitting them. Previously each upstream reason path became its own `bounded-unknown-reserve-exposure` fact on the dependent, so an upstream on the audited fallback with nine stale reserve slices, reported on both its slice and reserve-envelope paths, put 18 open data points on every direct holder and 36 on a holder reaching it twice.
• On replay of `agents/v9-captures/capture-20260907-0917.json` at clock `1788772631`, open data points fell from 1,280 to 733: `published-evidence-expired` 602 -> 58 and `issuer-undisclosed` 354 -> 351, with `measured-adverse`, `method-unsupported`, `producer-failed`, and `integration-missing` unchanged. 30 assets changed fact counts (the Mento family, cUSD/cEUR, GHO, rUSD, FRAX/FPI, USDD, USDX, ftUSD, reUSD, bnUSD, EURO3, and others), 0 scores moved, 0 grades flipped.
• The trigger was producer-side: on 2026-09-07 one `HTTP 502` from Tether's transparency feed dropped a fresh USDT snapshot from the scoring reserve map because the loader required the latest sync status to be `ok`, sending USDT onto the audited fallback whose Q2 composition is outside the 38-day window. The loader now judges a snapshot on its own warnings (`selectScoringDegradedWarnings`), so a failed attempt that wrote nothing cannot demote the snapshot on disk. That repair cannot manifest in a frozen replay; it needs a real producer cycle.

Contemporaneous release record.

Commit provenance not recorded

Two evaluator mapping defects are corrected without claiming new evidence. Native issuance rows no longer enter the bridge-exposure completeness join, and physical GOLD/SILVER delivery outputs no longer enter the fiat valuation path. The fixed-input replay therefore closes nine wrongly emitted bridge facts and adds five honest unresolved exit facts; this is an accounting correction and an honest loss of false coverage, not evidence Pharos newly acquired.

• Bridge completeness now excludes reviewed-native selected supply rows from `bridgeControlsByDeployment` in `evaluateV9SubthresholdUnresolvedBridgeJoins` (`shared/lib/safety-score-v9/control.ts`). The route predicate and native-liability boundary are already explicit in `worker/src/lib/safety-score-v9/extension-bridge.ts:116-118` (`isBridgeRepresentationRoute`) and `:975-1008`: native controls remain umbrella facts, but native liability does not create bridge materiality and `bridgeClaimControls` excludes native route ids. This fixes a wrong join; Pharos learned nothing new.
• On replay of `agents/v9-captures/capture-20260904-1100.json` at clock `1788509806`, the bridge correction closed 9 facts (`nonmaterial-bridge-supply-unmatched` on `ausd-agora`, `pyusd-paypal`, `reusd-re-protocol`, `usbd-bima`, `fusd-finchain`, `cusd-celo`, `frxusd-frax`, `usdy-ondo-finance`, plus `missing-bridge-route-rows` on `fusd-finchain`), with 0 replacements and exactly 1 mover: `fusd-finchain` NR -> 46/D. Floors, the completeness predicate, and `unknownBridgeShare` are unchanged.
• Offchain-issuer commodity routes with `outputAssetType: "bluechip-collateral"` (physical GOLD/SILVER delivery) now resolve as `unresolved-asset` in `worker/src/lib/redemption-exit-route-observations.ts` instead of being mapped to fiat. The old mapping allowed `buildOutputReview` to imply a synthetic $1 value for a physical bar; removing that false valuation adds uncertainty rather than evidence. Pharos learned nothing new.
• On the same fixed capture, the commodity correction ADDED 5 facts (`unresolved-exit-output` and `missing-runtime-route-evidence` on `gldt-gold-dao`, `paxg-paxos`, `xnk-kinka`) and moved 2 grades: `gldt-gold-dao` 47/D -> NR and `xnk-kinka` 41/D -> 39/F. This is an honest loss of false coverage, not a newly discovered adverse fact.
• The affected asset set is `cgo-comtech`, `dgld-gold-token-sa`, `ggbr-goldfish-gold`, `gldt-gold-dao`, `gldy-streamex`, `kag-kinesis`, `kau-kinesis`, `paxg-paxos`, `pgold-pleasing`, `xagm-matrixdock`, `xaum-matrixdock`, `xaut-tether`, `xnk-kinka`.
• All measured counts and movers above come from the replay of `capture-20260904-1100.json` at clock `1788509806`. Producer-side repairs in these waves cannot manifest in a frozen replay; they require a real producer cycle before any live observation can change. No external evidence was added by either correction.

Contemporaneous release record.

Commit provenance not recorded

Bridge routes whose message validation is performed by an external quorum (a LayerZero DVN set, a Chainlink CCIP DON/RMN, a Bantu AMTP validator group) had no authority model that could express them, so a reviewer who wrote the quorum down with its failure domains and sources still compiled to `unknown` and published an unresolved-control gap on every route the quorum covered. The authority ladder gains a `validator-quorum` rung: known, but weak. It grades at or below a named issuer backend and never above a named multisig.

• `validator-quorum` joins the authored authority-type vocabulary and the compiled authority-model union. It names an external message-validation quorum whose membership rotates and whose individual signers are not accountable parties, so there is no single controller address to record.
• The rung is deliberately weak. On the control-quality ladder it holds the bounded-unknown default, exactly where a named issuer backend sits, and strictly below the concentrated-admin rung a multisig starts from: naming a validation domain can never lift a control into the multisig class. On the route-level weakest-authority merge it sits below `issuer-backend` and above `eoa`, so a route co-controlled by an unattested single key still reports that key as its weakest link.
• Two authored authority types, `bridge` and `custodian`, had no branch in either authority mapper and silently fell through to `unknown`. `bridge` now compiles to `contract` (the treatment `timelock` already takes) and `custodian` to `issuer-backend` (the grouping the issuer authority-key derivation already applied to it). No active asset authored either value, so this closes a latent defect rather than moving a published score.
• Measured over the 2026-09-01 production capture: 44 `selected-bridge-route-unresolved` and 27 `unresolved-control-identity` facts across 14 assets close, 70 open data points in total, all of them previously attributed to issuer non-disclosure for what was a Pharos schema limit. Control-pillar evidence rises off the limited rung on 10 assets. Three assets gain (cash-phantom 43 to 45, krwq-iq 50 to 53, iauon-ondo 54 to 57 and C- to C); no asset loses a point and no cap changes, because every 55 evidence ceiling the closed gaps carried was already non-binding.
• Independently, an Algorand ASA manager/reserve account that the reviewer read as a single-key issuer-operated account is now recorded as `issuer-backend` rather than `unknown`, matching the treatment its sibling rows on the same profiles already carried.

Contemporaneous release record.

Commit provenance not recorded

A mechanism component the reviewer covered and found unpublished now publishes that finding (the review date, the reason, and the source checked) instead of the generic "not a current known fact" sentence it shared with components nobody has reviewed yet. Scores, grades, owners, and the open-gap count are unchanged by construction: the fact stays bounded-unknown and the gap stays issuer-undisclosed.

• A curated `applicability: "unavailable"` mechanism component carries a written rationale and a cited source. The compiler passed both through for `not-applicable` and dropped them for `unavailable`, so the reader saw only the generic bounded-unknown sentence. The gap message now reads `Reviewed <date>: the <component> input is not published by the issuer. <rationale> Source checked: <url>`.
• The `bounded-mechanism-review` reason-code label changes from "Mechanism review incomplete" to "A mechanism detail is unresolved". The old label was false for the adjudicated majority: their review is complete, and its finding is that the issuer publishes nothing to review.
• Nothing about scoring moves. The fact remains bounded-unknown at the policy bounded-unknown quality, the gap keeps `bounded-mechanism-review` and its `issuer-undisclosed` owner, and the open data-point count is unchanged. `MECHANISM_REVIEW.completionCriteria` already admits a reviewed unavailable disposition that retains the bounded-unknown gap without changing score or grade; this release makes that disposition legible rather than acting on it.
• The same-UTC-day overlay clock guard is untouched. It reports a review the exact admission policy cannot use yet and stays `method-unsupported`; it is mutually exclusive with the adjudicated path, which requires a current overlay.
• Measured over the 2026-09-01 production capture: 183 adjudicated component rows across 98 assets carry a rationale and a source. Replaying that capture against this change produced zero score and zero grade movers.

Contemporaneous release record.

Commit provenance not recorded

An open operator-batched redemption request queue whose settlement completion bound is unproven is a bounded exit evidence gap, not a measured zero. When that gap is the pillar's score-bearing evidence, Exit floors at the bounded-unknown score under the exit-unverified ceiling and the public card carries an explicit warning; the standalone redemption route is unrated because its capacity is missing.

• The new `unproven-settlement-bound` reason code is owned by Exit and globally bounded: when the flagged route is the pillar's score-bearing evidence, the Exit pillar floors at the policy bounded-unknown score, the existing exit-unverified ceiling applies, and the public label is `Redemption is an operator-batched request queue with no proven settlement bound`.
• As with the existing bounded missing-route treatment, a portfolio whose exit is genuinely scored by another eligible route is neither floored nor capped by an auxiliary unproven-settlement-bound diagnostic; the flagged route stays visible as an excluded trace.
• The v9.44 measured-zero ruling is unchanged. This corrects its input: an observer-synthesized zero standing in for an unproven completion bound is bounded uncertainty, not a measurement. A paused queue keeps the measured pause and the no-viable-exit-path treatment; the marker is withheld unless withdrawal requests are open on-chain.
• The eearn-ember operator-batched queue observer now publishes `unproven-settlement-bound` instead of a synthesized measured zero. The public observation carries no capacity curve; the internal fact retains the schema-required zero point for an observed route, which marker precedence keeps out of scoring and labels as the `unproven-settlement-bound` exclusion in the route trace.
• The standalone redemption route score for this shape is unrated (missing capacity) rather than zero (paired redemption-backstop v4.4).
• On the 2026-08-26 production snapshot, eEARN is the only affected asset and the only projected grade change: Exit moves from 0 to the bounded floor 35, lifting the weighted quality from 59.66 to 71.92, with the exit-unverified ceiling binding the final score at 65: projected 20 (F) to 65 (B-) once the first post-deploy reserve-sync cycle republishes the flagged observation.

Contemporaneous release record.

Commit provenance not recorded

Exit no longer discards a fully observed issuer or protocol redemption route merely because its executable capacity is zero or below the first material breakpoint. The route remains the attributable primary evidence with a zero route score, its measured capacity and confidence stay public, and a zero pillar emits the explicit no-viable-exit-path reason. Atomic protocol redemptions are no longer misclassified as inherently delayed when deciding whether discounted evidence can receive credit.

• A known zero or immaterial redemption route is retained as measured evidence instead of being relabeled unsupported-same-notional-route. Its score remains zero, so the change repairs attribution and explanation rather than granting exit credit.
• The public trace preserves executable capacity, modeled-request completion, confidence, and the binding zero-capacity cap for both the primary route and alternatives. Zero completion is displayed as 0% rather than being omitted.
• A zero Exit pillar publishes no-viable-exit-path even when an older producer omitted the reason, preventing cards with a numeric zero and F grade from presenting a blank explanation.
• Protocol redemption timing now follows the route's admissible reviewed settlement model. Favorable terms retain the existing 365-day evidence expiry; conservative corrections remain durable. Atomic protocol routes remain eligible for atomic treatment, while queued or delayed routes retain the existing discount and horizon rules.
• On the pre-release production snapshot, nine cards had Exit 0 and four of those paired it with a standalone redemption headline of at least 50. This release removes that semantic contradiction through the paired redemption-backstop v4.39 capacity and settlement correction; it does not infer capacity where none was observed.
• wsrUSD is the only observed grade change on the pre-release production snapshot: its measured $74,992.50 executable capacity is immaterial against the $10 million modeled request, moving Exit from 35 to 0 and the overall score from 45 (D) to 19 (F).

Contemporaneous release record.

Commit provenance not recorded

The `tether-transparency` adapter now uses the existing 7-day disclosure source-age tier instead of the 3-day dashboard tier. The retained 30-day history contains 24 upstream publications with a 1.00-day median gap and a 3.00-day maximum from the recurring Friday-publish/weekend-skip pattern; that gap landed exactly on the old bound with zero margin, and the 2026-08-16 shift from 01:00Z to 23:30Z consumed the remaining margin. The last publication was 2026-08-21T23:30:02Z, and the first production breach was detected at 2026-08-25T00:11:34Z when warning_count rose from 1 to 2. This is a live-reserve admission policy change, not evaluator arithmetic.

• The seven-day tier accepts the adapter's `collateralizationRatio`, `totalAssetsUsd`, `totalLiabilitiesUsd`, and chain details up to seven days old. Reserve-category percentages remain curated in `liveReservesConfig.params.slices` and do not age with the feed, so the widened clock applies only to the upstream totals and chain details.
• Those totals are currently unscored for a `fiat-cash` asset. The bound therefore protects whether the live snapshot retains `strong` backing evidence rather than assigning points to an otherwise unscored number; for `usdt-tether`, retaining the live path keeps the policy-declared market-anchor premium eligible instead of entering the adequate audited fallback ceiling.
• The adapter declaration is shared by `usdt-tether` and `xaut-tether`. A fixed-input replay cannot observe this producer-admission change because `liveToFallbackCoins` is captured before evaluation: the 2026-08-25 production capture remains byte-identical with zero score or grade movers. The next live capture can retain a source aged 3.36 days instead of emitting `stale-source-data` and falling back.

Contemporaneous release record.

Commit provenance not recorded

An independently attested reserve composition that is no longer current was priced identically to a partial review: both floored the backing evidence level at `limited`, capping the asset at 69. A complete composition signed and reconciled by an independent attestor is stronger evidence than a partial one even after it ages, so it now carries its own reason with the `adequate` ceiling the policy declares. The evaluator also stops flooring every ceiling reason at `limited` and honours the level each reason declares, which made an existing `adequate` declaration reachable for the first time.

• `reasonClassifiedEvidenceLevel` read `limited` for any ceiling-treatment reason, ignoring the per-reason `ceilingRule.level` the policy already carried. `missing-latest-assurance-report` declared `adequate` and could never reach it, because the implied 69 evidence ceiling always bound below the reason's own 84. The declared level is now used and the weakest declared level still wins; replay shows this alone moves nothing, because every affected card also carries a `limited`-declaring reason
• A stale exposure whose composition was admitted through the audited fallback emits `stale-audited-reserve-composition` instead of `partial-reserve-review`, with a ceiling at the `adequate` rung and public copy that says the audited composition is not current rather than implying the review was incomplete
• The ladder for a stale upstream feed is now graduated rather than a cliff: a current feed scores normally, a stale feed with an independently audited composition is capped at the adequate rung, and no admissible composition at all still falls to the reason-coded floor
• Three assets become rateable that were previously withheld as `insufficient-evidence`: brla-brla-digital to 51/C-, sbc-brale to 50/C-, and wars-argentine-peso to 47/D. This is a deliberate consequence rather than a side effect: if an audited composition is adequate evidence for a ceiling it is also adequate evidence for rateability, and treating the same fact as adequate for one and limited for the other would be incoherent
• On the fixed-input release replay 3 assets move and 3 change grade, all from NR into a rated band. No previously rated card moves

Contemporaneous release record.

Commit provenance not recorded

An issuer without prudential supervision could publish an independently attested reserve composition and still be reported as having no reserve composition at all, because admission required supervision and the asset's only other source was a live feed. One upstream feed going stale then removed an entire backing pillar. Such a composition is now admitted one rung down, as static-validated evidence under the shorter composition window, and it keeps the issuer attribution so an expired document is reported as expired rather than undisclosed.

• Admission and strength are separated: an independent audit is evidence about the reserves, prudential supervision is evidence about the issuer. Supervision no longer decides whether a composition is admitted, only the rung it enters at. An unsupervised issuer's audited composition enters as `static-validated` and can never reach `independent` strength through this path, so the supervision gap still costs the asset its ceiling
• The rung is reachable only where a live reserve producer was observed returning nothing for that capture. An asset with no live producer keeps the existing standalone path, and an asset whose producer is excluded from falling back is not rescued
• Audited fallback evidence is emitted with the report's own publisher and dates instead of as an anonymous standalone review, and it carries the 31-day composition window plus the 7-day reporting grace rather than the 365-day audit window it was admitted under, so the rung degrades as the composition ages
• Because the publisher is retained, a lapsed composition now resolves to `published-evidence-expired` rather than `issuer-undisclosed`. The public copy for that value stops stating that an issuer has not disclosed reserves it did in fact publish. Unknown provenance continues to fail closed
• On the fixed-input release replay, 8 assets move and 6 change grade, all upward: fdusd-first-digital, xagm-matrixdock, vnxau-vnx, tryb-bilira, wcop-ripio, and wmxn-ripio flip, with audx-aussie-dollar-token and wbrl-ripio moving inside their grade. Every mover has a live producer that was observed falling back

Contemporaneous release record.

Commits: a1034c254

Safety Score V9 replaces several broad assumptions with reviewed, scope-aware evidence. Exit terms must be established for the scored request, reserve classification and composition age independently, chain maturity follows a dated five-gate review, local controls are charged to the liabilities they can reach, and reviewed incidents enter their owning risk domain. The release also corrects stale oracle-applicability dispositions and distinguishes expired published evidence from issuer non-disclosure. Scores move in both directions because better evidence can remove a conservative penalty while adverse or missing evidence can lower or withhold a rating.

• A favorable faster-settlement term can replace the conservative default only when the exact delay has a review date and source; a conservative correction can still lower credit without asserting a favorable promise. A route whose stress capacity, settlement, or cost is not established receives the explicit bounded-terms-gap disposition: valid partial facts remain visible, but the route is excluded from primary and diversification credit and ordinary uncertainty cannot manufacture a measured-danger F
• Reserve classification remains admissible for 365 days, while reserve composition uses a 31-day window plus a fixed 7-day reporting grace. The clocks apply to live overlays as well as curated fallback rows, so an expired classification cannot remain score-bearing merely because a live adapter supplied percentages
• Chain maturity is now a dated quarterly review with five fail-closed gates: 36 months of continuous production history; a 365-day liveness record; permissionless participation or at least 21 independently operated block producers or finality members; no unilateral instant change path, with L2s at Stage 1 or later and at least a 7-day holder exit; and documented bridge or data-availability dependencies with a holder exit. Cardano, Gnosis, Hedera, Rootstock, Sui, Conflux, and Kaia are admitted; Celo remains excluded after its security-model migration and failed continuity, change-control, and dependency/exit gates
• Oracle applicability now preserves the V9 distinction between a top-level price authority and a genuinely non-applicable path. Stale pre-9.17 dispositions were reviewed asset by asset: a mint, redemption, NAV, or exchange-rate authority is scoreable without fabricated borrower-liquidation branches, while verified adverse evidence and bounded uncertainty retain different cap treatment
• A reviewed control that reaches only one deployment is charged proportionally when its liability partition is complete and reconciled; unresolved or root-reaching controls remain global. Common-control thresholds now count independent root liabilities rather than wrappers or derivatives, same-issuer controls remain diagnostic, and corrected Mento issuer attribution removes a manufactured cross-issuer failure domain
• The evidence-responsibility vocabulary adds `published-evidence-expired` for stale issuer- or parent-published material that Pharos has not kept current. Unknown provenance continues to fail closed under the existing fallback, and the new responsibility changes attribution and public copy without directly changing a score
• Reviewed incidents are typed as control, wrapper-local, operational, or peg events and enter the existing component that owns the risk rather than creating another scoring dimension. Scope distinguishes root-claim, deployment, integration-only, and holder-exit consequences, and remediation evidence preserves active, mitigated, and resolved treatment
• On the fixed-input release replay, 87 assets move and 67 change grade. The mover set contains upgrades, downgrades, newly rated cards, and newly withheld cards, so the release is explicitly not score-neutral

Contemporaneous release record.

Commits: 2f510a8d7, 68714f9e2, 392d3187c, ca437e069, f07597c45, 29839cff9, 78a765eb9, bfe391a51, fd62fe2f9, b6735756e

Safety Score V9 removes two ways the host environment could influence a published result. When two cap candidates share a limit, the specific observed or withheld fact is now published ahead of the generic absence reason instead of letting alphabetical ordering decide. Separately, every canonical ordering and digest input across compilation and publication now uses a locale-independent code-unit comparator rather than host-locale collation. Cap limits and score arithmetic are unchanged.

• A specific observed or withheld fact outranks a generic absence reason at equal source and limit. Remaining ties fall through to source priority, then locale-independent code-unit ordering of kind and then reason, so the selection stays total and replay-stable
• The candidate dedupe and binding-selection comparators were unified into one ordering function. They previously differed: only the dedupe path applied the final `reason` tie-break, so the two stages could rank identical candidates differently
• On the frozen capture replay (clock 1787500014, 337 cards) no score, grade, or cap limit moves. Exactly one binding reason changes: usdaf-asymmetry publishes `peg-supply-floor-withheld` instead of `missing-applicable-peg`, both 60-point evidence ceilings. The diagnostic `caps[]` ordering also changes on 12 cards (bd-basedollar, deuro-deuro, kau-kinesis, krwq-iq, nect-beraborrow, pht-pht, scusd-rings, usdaf-asymmetry, usdu-usdu-finance, usdxl-last, weusd-picwe and xnk-kinka) where a specific peg reason now precedes `missing-applicable-peg`. Every candidate set is identical before and after; only the order moves, and two consecutive replays are byte-identical
• Canonical V9 ordering no longer depends on the runtime locale. 44 `localeCompare()` call sites across the dependency, exit, scoped-risk and archetype evaluators and the extension-transfer, publication-assessment and supply-attribution publishers now use the existing locale-independent `compareText()` comparator. Two were demonstrably load-bearing: Exit resolved an equal-score route tie before primary and diversification route identity and the ordered route traces were emitted, and the reviewed-transfer sequence feeding `sha256Hex` made a published digest input locale-dependent. A probe with two equal-scoring Unicode route keys selected different primary and secondary routes under `en_US.UTF-8` than under `sv_SE.UTF-8`
• Replaying identical facts can no longer select a different equal-scoring route, reorder a dependency path, or hash a different reviewed-transfer sequence because the host locale changed. Numeric scores and grades are unaffected (this is ordering, not arithmetic), but route and path identity, ordered traces, and their digests can rotate where a previously published non-ASCII or case-sensitive key collated differently from code-unit order. The evaluation-build manifest digest rotates accordingly

Contemporaneous release record.

Commit provenance not recorded

Safety Score V9 aligns cap outputs and evidence dispositions with their published meaning: cap limits now live in the integral published score space, unrated cards do not assert binding caps, and a pillar-priced signal needs an asserted residual before it can impose a whole-score cap. Absent wrapper facts stop being treated as issuer non-disclosure, and active-depeg peaks resolve through `pegReferenceId`; the release also records the existing policy-declared USDT market-anchor-longevity premium and its non-inheritable public adjustment.

• Candidate cap limits are floored at the published-score funnel before deduplication and selection. Wrapper-local parent measurements remain exact in their own trace, while published cap limits are integral. On the frozen capture replay (clock 1787500014, 337 cards), 0 scores and 0 grades moved; asusdf-astherus 49.55 became 49, susd1plus-lorenzo 43.45 became 43, and susn-noon 61.9 became 61, with no non-integral cap limit remaining
• An NR card no longer reports a binding cap because no numeric score exists for a cap to constrain. syzusd-yuzu was the only affected card; rated scores did not move, all 18 NR cards now report `bindingCap: null` with zero binding flags, and their `caps[]` candidates remain available as counterfactual diagnostics
• Absent custodyEscrow, leverage, and rehypothecationCorrelation profiles on known pure serial wrappers resolve as `not-applicable` rather than `issuer-undisclosed`; strategy vaults retain the latter when disclosure is genuinely missing, and reviewed leverage 1.0 resolves as reviewed/none. Complete wrapper fact sets rise from 1 to 11 of 56, exactly 6 published scores move, all upward: sdai-sky 75 to 78, scrvusd-curve 68 B- to 71 B, sdola-inverse-finance 51 to 54, susdd-tron-dao-reserve 38 F to 41 D, srusd-reservoir 54 C- to 55 C, and susds-sky 75 to 77
• A signal already priced in a pillar can impose a whole-score cap only when `additionalHardCapRisk` asserts the residual risk that remains outside that pillar. The replay moves 0 scores, changes 0 binding-cap identities, and preserves all 15 structural caps; the 9 pillar-priced caps remain grandfathered by the provisional marker still owed per-asset review: seven `centralized-mint:high` caps (cusd-celo, ftusd-flying-tulip, jpym-mento, jupusd-jupiter, rusd-reservoir, usd0-usual, and ussd-sonic-labs), `usdt-tether` at `centralized-mint:low`, and pht-pht at `weak-oracle-branch:critical`
• Active-depeg peak inheritance follows one `pegReferenceId` hop without redirecting child-keyed peg data, supply, or wrapper-local facts. The replay moves 0 scores and 0 `pegMultiplier` values; apyusd-apyx gains a non-binding inherited `active-depeg:f@39` candidate
• The policy-declared `market-anchor-longevity` premium is recorded as a bounded USDT-specific adjustment: 12 points, with `signal:centralized-mint:low` relief from 83 to 87 and a maximum published score of 87. Eligibility remains gated on rank 1, at least 120 months, base score at least 75, exit score at least 70, strong evidence, a clean peg, and `stress-redemption` plus `reserve-reconciliation`; the public 87 does not replace the pre-premium 83 returned for dependency inheritance

Contemporaneous release record.

Commits: fa7ce76ce, 1037bc89c, 80f319339, b8260d9f1, fd4d5f590

Exit-route evidence whose producer window expired now loses credit instead of leaving the capacity denominator, and the published route payload widens so no single route is a tenth of an anchor's evidence. Together these remove a scoring cliff in which an ordinary producer-schedule delay re-graded an asset with no market event behind it, and propagated that move through the dependency graph to everything the asset backs.

• A route whose observation aged past its lane freshness bound is now included at the reviewed `staleObservationConfidenceFactor` (0.6, the same credit other low-confidence observations receive) rather than excluded outright. The factor derates both the route's own score and the capacity it contributes, and the route reports an `observation:stale` cap in its trace. A `missing` observation, no retained evidence at all, still fails closed exactly as before, as does a stale creditable non-atomic redemption, which keeps its stricter reviewed requirement
• The bounded public route payload widens from 10 observations to 24, and its concentration bounds scale with it (per-chain 6 to 14, per-protocol and per-adapter 3 to 7) so the extra slots admit genuinely new evidence. Measured on the live surface the previous bounds were saturated on concentration, not on slot count: usdc-circle, usdt-tether and dai-makerdao each published exactly six Ethereum, three Curve and three Uniswap-V3 routes. Common-mode risk continues to be modelled downstream, where routes sharing a physical resource are grouped and only the strongest member is credited
• The measured-execution freshness ceiling moves from two hours to three, one full publication cycle wider than the two-hour score-bearing Liquidity Score cadence it must cover. At two hours the expiry ceiling equalled the republication period, so one delayed or degraded even-hour publication expired every measured profile simultaneously. Generation retention moves from three hours to four to stay above the widened bound
• Measured on the 2026-08-21 production capture replay (337 cards): no card changes score or grade. The release is score-neutral on a healthy capture by construction: the derate only engages on evidence that the previous rule would have discarded, and the widened payload only engages where the producer had more admissible evidence than it could publish. The policy semantic digest rotates with the added exit key
• A new `dex-exit-route-turnover-watchdog` reports degraded when a coin's published route set turns over substantially between publications, so producer-driven route churn is visible as an operational signal instead of surfacing only as an unexplained grade change

Contemporaneous release record.

Commit provenance not recorded

The mint component splits the exposed floor by reconciliation evidence, recognizes verified collateral-gated issuance, and extends bounded seasoning credit to eligible adverse postures. Economically unbounded minting with unknown reconciliation now scores 35 instead of the confirmed 25 floor; a collateral-gated path scores 50 below the concentrated-admin rung at 55; and an eligible adverse posture can season without crossing the dedicated 39 ceiling. The release also reclassifies CASH as continuously reconciled and the spUSDC and USDF vaults as raiseable rather than unbounded.

• The reviewed vocabulary gains reconciliation `none` for a positively established absence, cap semantics `collateral-gated`, and the derived postures `unbounded-reconciliation-unknown` and `collateral-gated`; `unknown`, `none`, and `not-applicable` remain distinct findings
• A reviewer's explicit reconciliation `unknown` on a reviewed direct non-backend mint control now compiles through to the evaluator instead of being swallowed by the not-applicable inference, and the facts schema admits that known-review shape: the 9.27 doctrine that a recorded could-not-establish finding beats silence. An absent field keeps the fail-closed inference, issuer-backend minters keep the PoR-derived cadence, and inherited share wrappers keep the wrapper convention
• `unbounded-reconciliation-unknown` maps to the existing Exposed band at 35, while `collateral-gated` maps to the existing Concentrated band at 50. No public band, CSV header, filter value, or saved screener URL changes
• DDR conservatism is preserved: both new postures join the fragile set, only `unbounded-reconciliation-unknown` joins the economically unbounded set, and the K1 risky set is unchanged because both postures land in existing risky bands
• After at least 60 months, a non-active `unbounded-or-compromised` posture and an `unbounded-reconciliation-unknown` posture can earn the existing 10-point seasoned credit without claiming reconciliation. The former uses the dedicated 39 ceiling rather than falling to the generic 34 next-rung ceiling created by the new 35 rung; the latter remains capped at 44 by the ordinary next-rung rule. An active incident remains ineligible
• Curated evidence moves cash-phantom to continuously reconciled `unbounded-reconciled`, and moves susdc-spark plus usdf-astherus to raiseable `partially-bounded-admin`; no broader recuration is part of this release
• Measured on the 2026-08-21 production capture replay: 60 of 337 cards move, all upward, none newly unrated. The Exposed floor shrinks from 78 to 26 cards; 49 assets derive the new unbounded-reconciliation-unknown posture, and 5 not-applicable-reconciliation assets earn the adverse seasoning lift to 35. 23 grades improve (18 F to D, plus susdc-spark D to C+, usdf-astherus D to C, usg-tangent and yusd-yieldfi D to C-, cash-phantom F to D), and the largest single move is susdc-spark 44 to 64

Contemporaneous release record.

Commit provenance not recorded

Curated basket links no longer assert a dependency relationship when the same reserve composition is inadmissible for Backing and no live reserve slices are present. The dependency overlay now degrades with the reserve envelope, leaving the existing reserve gap to carry the bounded score consequence instead of publishing an unrelated unreviewed-dependency reason.

• When a curated review is stale, incomplete, non-verified, or otherwise fails the existing full-composition admission path, its curated collateral edges are omitted for that cycle when no live reserve slices exist; the reserve envelope continues to publish its existing missing or partial-review gap
• A verified, current curated composition keeps the same basket edges, and live-derived edges plus manual dependency reviews remain unchanged
• No pillar weights, aggregation, caps, grade thresholds, or reason vocabulary changes; the release aligns dependency-edge admission with the reserve-envelope gate
• On the current-tree replay, five affected assets keep their score and grade while six lose the stale dependency reason; jusd-juicedollar moves 40/D to 37/F because removing its expired full-weight curated edge also removes the inherited-backing path. Accepted at release: the 2026-08-20 on-chain re-verification found the StablecoinBridgeUSDT reserve holding ~0.00042 USDT.e against ~10,460 JUSD supply, so the D grade rested on a stale optimistic edge

Contemporaneous release record.

Commit provenance not recorded

The mint component's top rung moves from 95 to 100. A derived `none-resolved` posture states that no reviewed control can mint, authorize minting, or expand issuance on this component's scope, so reserving five points at the top of that rung priced a residual the component does not measure. The motivating case is proven outright: LUSD and BOLD resolve `none-resolved` on immutable, owner-renounced deployments where no privileged minter can ever be added, yet their mint component was capped at a ceiling nothing could reach.

• `mintPostureQuality["none-resolved"]` moves 95 to 100; every other posture rung, the reconciled grading rungs, the seasoned credit, and all merged mint signals are unchanged. The ladder keeps its invariants: 100 is the new top rung and bounded credits still cannot lift a lower posture class past the rung above it
• The rung is mint-scoped, as the V9 derivation is: reviewed no-local-issuance wrappers and other assets whose mint component resolves `none-resolved` also take it, whatever their other control domains score. The oracle and bridge tier tables are independent calibrations and are unchanged
• The curated `none-resolved-mint` annotation stays a banding-only value with no quality rung of its own; the depeg resolver consumes posture bands, not component scores, so no DDR verdict input moves
• Measured on the 2026-08-20 publication capture: 30 evaluated assets move their mint component: 29 from 95 to 100 and srusd-reservoir from 92 to 97 through its unchanged -3 merged-signal penalty; 29 of them appear in published control breakdowns (syzusd-yuzu moves in the evaluated set only). Five assets move their Economic Control pillar 95 to 100 (susde-ethena, usdb-blast, usdk-kast, usdn-noble, xo-exodus) and exactly one published score moves, xo-exodus 56 to 57. No grade changes anywhere; usdn-noble's parent cap at 60 becomes its binding cap without moving its published score
• The policy semantic digest rotates because a posture quality value changed; pillar weights, aggregation, caps, grade thresholds, and every score-bearing gate value are unchanged

Contemporaneous release record.

Commit provenance not recorded

The 9.27 scoped-question contract now covers structured bridge controls. A curated bridgeRouteRisk review can author scopedQuestions, each naming one structured control by its id, its exact label, or its controllerChain:controllerAddress pair, with its own question text, review date, and sources. While such a question is fresh, an unresolved named control takes the 69 control-scoped-gap ceiling instead of the 55 control-unverified ceiling: the same ninety-day freshness window, the same reversion when it ages out, and the same rule that a question softens only the control it names. The compiled bridge fact is the route-level merge of its structured controls, so the merged overlay inherits the marker only when every unresolved contributor on that route is named; one unnamed unresolved sibling keeps the hard treatment, mirroring the mint-authority whole-inventory rule at route granularity.

• bridgeRouteRisk gains scopedQuestions[] with the same shape as mintAuthority.review.scopedQuestions. The schema rejects a controlRef that names no authored structured control, and questions attach nothing to conservative route-derived fallback controls, which have no reviewer behind them
• No scoring policy changes: the scoped-control-question reason, its 69 control-scoped-gap ceiling, and its deployment-control path kind all exist since 9.27, so the policy semantic digest does not move. Only the sidecar vocabulary, the bridge compiler, and the version label change
• The three open questions the aug18 control-research wave could not attach in 9.27 are authored in the same release: usn-noon's Starknet owner account-class identity and Sophon-origin Hyperlane validator operator, and usdat-saturn's CCIP RMN blessing-roster membership
• Measured on the 2026-08-18 publication capture: no score, grade, or pillar score moves. The named controls were already resolved by the same wave's research, so the questions document residual soft unknowns today and bound the downgrade to 69 instead of 55 if any of those controls later degrades to unresolved

Contemporaneous release record.

Commit provenance not recorded

Economic Control distinguishes a reviewer who investigated a control and recorded exactly what stays unknown from a control nobody has resolved. A curated mint-authority review can now author scoped questions, each naming one control by chain:address or label with its own question text, review date, and sources. While such a question is fresh, the named control's gap takes the new 69 control-scoped-gap ceiling instead of the 55 control-unverified ceiling. The 9.23 boundary migration had recorded several of these as prose (PAXG's Solana Token-2022 authority was reviewed, dated, sourced, and explicitly retained as an unresolved fact), yet the score treated that documented, bounded unknown identically to total ignorance, publishing an 85 A asset at 55 C.

• The reason registry gains `scoped-control-question` and `namedReasonCeilings` gains `control-scoped-gap` at 69, aligned with the limited-evidence ceiling: a scoped, dated, sourced open question is limited evidence, not absent evidence. All other named ceilings, treatments, weights, and thresholds are unchanged
• A scoped question names exactly one control and softens only that control's gap. The legacy `unresolvedQuestions` list keeps its all-or-nothing semantics unchanged; curators migrate a question to the scoped form only when it genuinely binds one named control
• Freshness is enforced at compile time with a 90-day window: a scoped question whose review date ages past it reverts to the hard 55 ceiling, so a named gap cannot rot as a permanent softener. The gap row stays in the DEPLOYMENT_CONTROLS curation queue throughout
• The whole-asset inventory reason softens only when every unresolved control in the inventory carries a fresh scoped question; one unscoped unresolved control keeps the hard reason for the asset
• Deployment-scoped controls with a null supply share gain a materiality release: when the asset's supply partition is complete and reconciled, the deployment's measured rows (or zero, when a complete partition holds no row for it) bound the share, and a proven sub-threshold bound stops binding the control-unverified ceiling. A missing or unreconciled partition keeps the fail-closed treatment, and global-claim controls are never released by materiality. No currently tracked asset relied on this release at the 2026-08-18 capture; it closes the gap class the 9.26 aggregate-residue fix left open per control
• Reference curation in the same release converts the documented open questions for paxg-paxos (Solana Token-2022 mint authority attribution) and xsgd-straitsx (Hedera supply and admin key attribution) into scoped questions
• Measured on the 2026-08-18 publication capture: exactly two assets move, both upward: paxg-paxos 55 C to 69 B- and xsgd-straitsx 55 C to 69 B-. No other score, grade, or pillar score changes
• Pillar weights, bounded aggregation, grade thresholds, the withhold band, and every score-bearing gate value are unchanged. The policy semantic digest moves because the registry gains the reason and the named-ceiling table gains its entry

Contemporaneous release record.

Commit provenance not recorded

Economic Control grades unattributed bridge supply against the same 10% deployment-materiality floor its per-row check already used. The aggregate check fired on any residue at all, so a rounding tail ($257 of EURC's $470M inventory, $40 of frxUSD's) was published as a material control gap and took the 55 control-unverified ceiling. Because a ceiling-treatment reason also classifies its pillar as limited evidence, the same trace applied the 69 evidence ceiling underneath it, and EURC published C/55 against an 82 it had otherwise earned. Sub-material residue is still published, now as a diagnostic that scores nothing.

• The aggregate unattributed-supply check moves from "any residue" to the deployment materiality floor already applied per row, which is what the reason's own name asserted. Residue at or above 10% keeps the material reason and its 55 control-unverified ceiling unchanged
• Residue below the floor publishes the new diagnostic reason `nonmaterial-bridge-supply-unmatched`, the twin of the existing non-material dependency reason. It carries no ceiling and does not classify its pillar as limited evidence, so the gap stays visible on the card and in the BRIDGE_MATERIALITY curation queue without bounding a score
• The material check no longer consults the subthreshold completeness proof. That proof clears each unmatched row against the floor individually, so rows that are each immaterial could sum past it and still prove complete: harmless while the trigger was any residue, an escape once the trigger is the floor itself. A material aggregate now fails closed on its own terms, and no tracked asset relied on the exemption
• Measured on the 2026-08-18 publication capture: 5 assets change score, all upward, and none worsens or becomes unrated. eurc-circle 55 C to 82 A-, frxusd-frax 55 C to 70 B, pyusd-paypal 55 C to 70 B, ausd-agora 55 C to 63 C+, and ussd-sonic-labs 45 D to 59 C as a strategy-vault wrapper whose frxUSD parent limit rises with it
• Five further assets exchange the material reason for the diagnostic without moving: cusd-celo, eurs-stasis, fusd-finchain, usbd-bima, and usdy-ondo-finance were each bounded by something other than this gap
• usdtb-ethena keeps its 55. Its 11.37% ($45.9M) Solana row matches two curated routes rather than one, which is a genuinely material attribution gap and not a rounding tail
• Pillar weights, bounded aggregation, grade thresholds, the withhold band, and every score-bearing gate value are unchanged. The policy semantic digest moves only because the reason registry gains the diagnostic entry

Contemporaneous release record.

Commit provenance not recorded

The published access posture's primaryExit now reads the same route set the Exit pillar credits, and reserves "none" for a reviewed-complete, genuinely empty exit surface. Everything else (routes that exist but earn no credit, and a missing, stale, or unsupported exit surface) publishes the new "undisclosed" state. The derivation previously counted only score-eligible routes, so an asset whose Exit pillar was scoring a reviewed issuer, protocol, or eventual redemption simultaneously published "Primary exit: None", asserting an absence its own scoring contradicted. The same release fixes the mirror-image defect in Economic Control, where a missing reconciliation cadence was read as evidence of a periodic one.

• primaryExit is derived from any credited route: score-eligible, or admitted by the creditable-non-atomic-redemption rule that the Exit pillar already applies to the reviewed issuer-redemption, protocol-redemption, and eventual-redemption families. That rule now has a single definition shared by both surfaces, which is what stopped them drifting apart
• "none" now requires known negative evidence: a required exit surface observed complete with zero routes. A surface that is missing, stale, or unsupported is an absence of evidence and publishes "undisclosed" instead
• accessPostureVocabulary.primaryExit grows from five members to six with the addition of "undisclosed". It is not an unknown value, so it does not enter accessPosture.unknownFields and the detail page renders it as an explicit "Primary exit: Not disclosed" row rather than dropping the row
• Measured on the 2026-08-18 publication capture: primaryExit moves from none 184 / permissionless 146 / eligibility-gated 7 to a distribution in which every card publishing a scored exit route reports the access posture of that route. BUIDL, USDY, USYC, VBILL, JAAA, USDPT, YLDS, and the Spiko and Midas ranges stop asserting that no exit exists
• primaryExit is a published posture projection and not a scoring input. Measured against the 2026-08-18 capture, the posture change alone leaves every pillar score, cap, and grade byte-identical to 9.24; only the policy semantic digest and the version label move
• Economic Control no longer infers a periodic reserve reconciliation from the absence of one. The inference read proofOfReserves.cadence for truthiness, and the sentinel values "none" and "undisclosed" are non-empty strings, so an issuer-backend mint whose issuer publishes no reconciliation at all was graded as reconciling periodically. A dated latestReport, or a cadence that names a real rhythm, still establishes "periodic"; everything else is now "unknown"
• "unknown" rather than a known negative is deliberate: an undisclosed cadence establishes only that nothing is published, never that the issuer does not reconcile internally. The mint reconciliation vocabulary has no member for a proven absence, and inventing one would assert more than the evidence carries. A reviewed economicControlReview.mint.reconciliation continues to supersede the inference, so the gap is closable by curation
• That correction moves three assets on the 2026-08-18 capture, and only downward: a7a5-old-vector 23 to 19 (F, unchanged), cngn-compliant-naira 37 F to NR, and euri-banking-circle 52 C- to NR. Both withholds are the insufficient-evidence path (an F requires an attributable measured-adverse fact, and losing an unearned reconciliation credit does not supply one), so the model declines to rate rather than publishing an unjustified F. No asset improves, and no other asset moves

Contemporaneous release record.

Commit provenance not recorded

Economic Control now reads three reviewed answers as the measured facts they are. An inventory whose every reviewed route is native issuance is not bridge-exposed even when structured controls govern those canonical deployments; a bridge review whose unattributed supply is immaterial keeps the rows it did review; and a reviewed no-local-issuance exception compiles as a not-applicable mint section when the risk it displaces is carried by a serial-claim parent or by Bridge Risk. The 9.23 boundary release had made each of these compile as missing evidence, collapsing the control pillar to its neutral default and withholding otherwise rateable assets.

• A structured bridge control whose only reviewed routes are native issuance no longer keeps the bridge section applicable, so an asset whose reviewed answer is "no bridge" scores single-chain-or-native instead of the opaque-or-unknown fallback. A reviewed representation route keeps the section applicable even when no control compiled for it, and an unresolved zero-share deployment remains an audit fact rather than proof of no bridge
• A bounded bridge review keeps its reviewed rows when the supply the compiler could not attribute is below the deployment materiality threshold, or when a known supply review selected no bridge route at all. A material residual, an unknown share, and a supply review that is not itself a known fact all keep the previous discard, and every row still fails closed on its own
• mintAuthority.review.noLocalIssuance compiles as the mint review's existing not-applicable state. It is granted only when an inherited claim carries a compiled serial-claim edge to its parent, or an external-only representation carries the reviewed route inventory covering every authored deployment; any authored control keeps the section required
• USDN and USDK are re-curated to hold a serial claim on M0 rather than a copy of M0's collateral composition, ending a threefold count of the same Treasury exposure and scoring the inherited mint risk on the dependency edge. Both are rated D/45, below the C/55 their parent scores, which is the intended result of binding an inherited claim to its parent
• cngn's boundary-migration review questions are recorded as the decided dispositions they were. As open questions they made the mint review incomplete, which zeroed the control's incident state and suppressed the centralized-mint signal carrying the asset's only measured-adverse attribution, so the F-floor withheld a grade the evidence still supports
• Measured on the 2026-08-18 publication capture: 17 assets changed on score-material terms, 9 of them rated again and 8 improving. No asset worsened, none became newly unrated, and no rated asset moved by 10 points or more. Not Rated falls from 25 to 16
• Pillar weights, bounded aggregation, caps, grade thresholds, the withhold band, and every score-bearing gate value are unchanged; only the methodology version label moves

Contemporaneous release record.

Commit provenance not recorded

Economic Control now binds Mint Authority controls to reviewed canonical native-issuance deployments and compiles structured bridge controls separately for each referenced route. A controller may operate in both domains, but a representation or transfer-rail capability can no longer become global native-mint risk.

• Active multi-deployment Mint Authority controls and mutable mint-logic upgrade paths name their reviewed native deployments; inherited or external-only products require an explicit reviewed no-local-issuance exception
• Bridge mint/burn, adapters, lockboxes or escrow, messaging, peer configuration, limits, upgrades, validators, pause, and administrators are authored as structured route-scoped controls, while conservative route-derived controls remain when structured evidence is absent
• The ownership gate blocks active bridge vocabulary in Mint Authority, invalid or non-native deployment references, and duplicate cross-domain bridge capabilities instead of silently filtering them during compilation
• A structured bridge control covering a reviewed bridge- or wrapped-representation route must name that route's bridge-mint holder; otherwise the ownership gate fails closed, because leaving the route unreferenced is what preserves the conservative route-derived mint overlay
• Common-mode evidence for a shared critical control identity is now resolved per receiving asset: a reviewed bounded-unknown member stays measured-adverse, a missing or stale member remains an integration gap, and evidence confidence is high only when the receiving asset's own member facts are known. Previously one bounded-unknown member released the shared-critical-control ceiling for peers whose own facts were known, so weaker evidence could raise a published score
• USDai's satellite OToken administrator exposure remains scoreable under Bridge Risk but no longer classifies canonical Arbitrum issuance as unbounded-or-compromised; the corrected scope moved USDai from D to B
• Across the 375 scoreable assets, 159 changed on score-material terms: 16 improved and 37 worsened, with the rest moving only posture, bridge tier, or compiled capabilities. The distribution is net more conservative, the largest moves being downgrades of 33, 23, and 22 points where satellite bridge machinery had been masking canonical or route risk
• Pillar weights, bounded aggregation, caps, grade thresholds, and non-bridge Mint Authority scoring are unchanged

Contemporaneous release record.

Commit provenance not recorded

Safety Score policy provenance now binds the reshape withhold band, danger and F-grade predicates, material-bridge share band, and score-bearing evidence-expiry windows. Policy-only replay and sensitivity analysis can change those gates through one validated projection and observe a different semantic digest instead of relying on code literals invisible to policy comparison.

• The shared scorer reads withhold, danger, F-only attribution, pre-exit danger, and material-bridge thresholds from the validated score-bearing-gates policy
• Reviewed research, access, research-overlay, mechanism-overlay, issuer-attested reserve, and curated-reserve expiry windows are separately named and included in the semantic digest even where their current values coincide
• The active values are unchanged, so scores, pillars, caps, grades, and evidence freshness outcomes do not move; the policy semantic digest and published score provenance rotate
• Presentation grade bands now derive from the active scoring policy, preventing a second display threshold authority from drifting from the engine

Contemporaneous release record.

Commit provenance not recorded

A live reserve slice's percentage is now only a scoring weight, never part of the join that attaches reviewed asset class, obligor, liquidity, maturity, or dependency metadata. Adapters can emit a namespace-qualified stable source key; a keyed live row joins one-to-one by that exact key and fails closed on a missing or duplicate reviewed key. Historical unkeyed rows retain a unique normalized-name compatibility join.

• Ordinary issuer rebalancing can no longer turn an unchanged reserve category into bounded unknown merely because its live percentage moved more than a fixed tolerance
• Circle USDC and EURC, Re Protocol reUSD, and Noon's USN now carry adapter-owned source keys on both live and reviewed rows; the same matched identities drive Backing classifications and dependency compilation
• On the current USDC publication inputs, the two drifted Treasury and systemically-important-bank rows leave the bounded 35 floor; the unchanged-pillar counterfactual restores Backing from 68.39 to about 90.02 and the public score from 79/B+ to 89/A+
• Explicit-key mismatches and collisions remain unclassified, newly introduced source buckets cannot inherit metadata by label accident, and live percentages remain the only weights used by scoring
• Pillar weights, reserve quality scores, bounded-unknown floors, score aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

Exit gap accounting treats the public route-selection bound as the admitted observation set. A populated p4a.8 surface that already carries its budgeted score-eligible routes is complete even when hundreds of other recognised venues failed target construction or sit behind a reviewed model limit. Leftover `quote-failed` attempts no longer keep a payload-saturated surface open; they still fail closed when the bound is not full. A recognised venue whose only remaining gates are reviewed model limits is method-unsupported rather than producer-failed.

• USDT, USDC, DAI, EURC, and other payload-saturated or fully-carved populated surfaces leave `incomplete-dex-route-coverage` instead of publishing as a data-feed failure
• Exact-route scoring completeness is unchanged: only gap accounting uses the budgeted denominator, so a partial observation set still cannot replace the aggregate DEX path
• Rate-bearing, unsupported-invariant, metapool, and paused/swap-disabled gates on a zero-observation surface are method limits, not feed outages
• Pillar weights, score aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

DUSD's Makina reserve snapshot now uses the oldest underlying Caliber position-accounting timestamp and the reviewed Machine's three-hour staleness threshold. A newly generated index response can no longer make stale contract accounting score-eligible.

• Makina-indexed balances, AUM, supply, debt flags, oracle values, and redemption state were independently reconciled to Machine and Caliber contracts; the API remains the source of human protocol and strategy labels
• DUSD reserve snapshots become stale when any included position accounting exceeds the Machine's three-hour threshold, even if both API envelopes were generated recently
• Frax, Tether, and USD.AI mixed native feeds retain conservative issuer-attested ingestion provenance and now use proof-style public presentation instead of claiming that the complete feed is independently measured
• Pillar weights, score aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

Two reviewed-but-unproven residuals stop appearing as missing inputs. A current freeze review whose honest verdict is `possible` is measured as `reviewed-possible-access` instead of `missing-access-review`. Independently subthreshold unmatched bridge-supply rows on a resolved chain no longer mint unknown-identity controls, extending the 9.03 D-J dust rule from unrecognized labels to recognized deployments below the 10% floor.

• Twelve assets whose freeze review is current `possible` leave the open-data census for freeze/blacklist; scoring stays bounded-unknown and the verdict is not rewritten to true or false
• Transfer access facts are unchanged: they still require a material-scope bind and do not inherit the freeze disposition
• USDT's 27 unmatched resolved-chain identity facts (Starknet, Metis, Aurora, and the rest of the dust book, each well below 10% of supply) stop publishing as `unresolved-control-identity`; a row at or above the deployment floor still fails closed
• Pillar weights, score aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

The 9.19 single-count deduplication could collide two distinct reasons that shared a gap identity, keeping the raw entry and dropping the score-bearing one whose bounded-uncertainty attribution then pointed at no owned open fact. On an asset whose mechanism reviews had aged into bounded gaps this made score publication fail its own reconciliation schema. The published fact list now restores any direct reason attribution the deduplication displaced, so every bounded-uncertainty entry reconciles to an owned open fact with its exact code, path, and responsibility.

• Score publication can no longer throw when a mechanism review ages past its window: the far-future regression compiles a full candidate with aged reviews and asserts every reason-sourced bounded attribution reconciles
• Where the collision occurred, both colliding facts are now visible, so an asset's open-fact count can rise by the entries that were previously silently dropped; on the aged-review fixture this is one additional fact
• Current-clock published output is unchanged: the reconciliation fixture pins today's USDC card byte-equal (same grade, same five open facts, same reason codes)
• Attribution semantics, the reconciliation schema, pillar weights, score aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

An asset's open-fact mass double-counted every mechanism gap: once through its pillar reason and again through a generic re-emission under a different path, which no consumer could reconcile back to a single gap. The duplicate entries also carried no usable fact path, so a reader could not tell what to disclose to clear them. Separately, a DEX surface on a chain with no registered discovery provider stops being reported as a method floor.

• Each gap is now published once. Deduplication is by gap identity only, so two distinct gaps that share a reason code both survive; entries that carry no gap identity keep their previous behaviour exactly
• Published facts carry the `exactFactPath` the gap constructor already held, so an open fact can be traced to the component that produced it and answered. Three assets whose residual mass was previously unattributable (nopal-nest, ntbill-nest and xusd-babelfish) resolve to their real gaps: for example nopal-nest's seven facts were five real paths plus two re-emissions
• No score, pillar, cap or grade moves: this removes duplicate reporting entries, not scored inputs, and a fixed-input replay confirms score equality
• A DEX exit surface whose deployment census carries no registered discovery provider is attributed `integration-missing` rather than `method-unsupported`, in both the portfolio-coverage and zero-route branches so one condition cannot publish two responsibilities. The chain has deployments and markets; Pharos has not wired a provider for it. `no-exact-capable-venue` remains the genuine method limit and is unchanged
• This supersedes in part the 2026-07-29 ruling that classified the no-provider census condition as a method limit
• Pillar weights, score aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

The transfer scope test proves a review covers material deployments from per-chain supply, which only the DefiLlama list provides. An asset absent from that list had no supply rows, so the test could never be satisfied and an authored transfer review was withheld as unreviewed. A materiality-only on-chain observation now establishes deployment scope for a bounded cohort, and it is structurally walled off from circulating supply and market cap.

• Thirty-nine assets that carry an authored transfer review but no DefiLlama listing can publish that reviewed posture instead of gapping as `missing-access-review`; the remaining assets in the unlisted cohort have no review to admit and stay fail-closed
• Materiality on this path is any deployment carrying non-zero supply, not a share of a summed total. Raw `totalSupply()` is never summed across deployments: for lock-mint and bridged representations the same liability is reported more than once, which would overstate the denominator and could drop a material deployment out of review while still reporting the scope complete
• The observation carries only a deployment key, raw token units, decimals, block number and observation time. It has no USD or price field, so it cannot be consumed by the circulating-supply or market-cap paths, which are unchanged and remain sourced solely from the DefiLlama list
• The path is fail-closed on every leg: a stale generation, a null or unreadable on-chain result, decimals that disagree with the registry, an identity mismatch, a partial deployment read, or a registry or base-input fingerprint mismatch all return the existing `bounded-unknown` result
• The on-chain path engages only where there is no per-chain supply at all; where the DefiLlama list reports supply the existing share-based materiality threshold continues to decide scope unchanged
• Pillar weights, score aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

Economic Control now separates a genuinely oracleless mechanism from privileged internal pricing, while a reviewed not-applicable oracle path is neutral and emits no scored component instead of manufacturing a green 95.

• The combined `oracleless-or-internal` posture is replaced by `oracleless` at 95 and `privileged-internal-pricing` at 45; external-feed tiers and scores are unchanged
• A not-applicable oracle review emits no oracle component and contributes neither credit nor penalty to Economic Control
• A reviewed top-level price authority can be scored without inventing collateral-liquidation branches
• Tori trUSD moves to privileged internal pricing because its backend constructs the economically effective signed-order quote without an independent on-chain feed or collateral-depeg circuit breaker
• Tori's strUSD loss-reporting authority is disclosed separately as wrapper-specific risk and is not attributed to ordinary trUSD balances
• On the 337-card fixed-input replay, 281 manufactured not-applicable oracle rows disappear; after partitioning unrelated registry drift, Tori is the only methodology-attributed score move, from 57/C to 52/C- as Economic Control moves from 70 to 45
• Pillar weights, aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

Two engine mechanisms made the access branch publish 'we never looked' about assets it had looked at. The transfer scope test is contract-addressed, so a chain-native asset with no contracts by design could never satisfy it; and an inherited freeze verdict whose upstream is not a tracked asset was deleted rather than measured. Both now resolve to an explicit structural fact, and neither invents data where no current review exists.

• A curated transfer review publishes a known posture with the applicability basis `non-contract-native` when the asset offers nothing the contract-scope machinery can address (no supported-chain contract, no material supported-chain supply) and every reviewed deployment sits on a chain outside the supported chain registry. The curated review is then the complete deployment scope, not a partial view of one
• That path is fail-closed on every leg: one supported-chain deployment, any material supported-chain supply, a review touching a supported chain, or a stale or absent review, and the asset keeps gapping as `missing-access-review` exactly as before. Three assets qualify: FUSD on Zano and the two Zephyr protocol assets
• An `inherited` freeze verdict that names no tracked upstream is retained as `inherited-untracked-upstream` instead of being dropped. No upstream id and no failure domain are asserted, because the branch verifies neither; the reach stays `possible` and the gap is the measured `inherited-access-exposure` rather than missing data. Seven assets move: DAI, crvUSD, BUCK, FPI, lisUSD, LUAUSD, and NXUSD
• Freeze facts stay bounded-unknown for scoring; the freeze exposure those seven assets publish moves from `unknown` to the measured `possible`. Transfer facts that become known publish a posture where they previously published none
• Pillar weights, score aggregation, structural caps, and grade thresholds are unchanged; no card changes grade
• The curation incentive is corrected at the source: an honest `inherited` verdict is no longer penalised as an unreviewed asset, which is what pushed the wave-1 over-suppression of 29 verdicts restored in `1134ab32f`

Contemporaneous release record.

Commit provenance not recorded

The published card drops `stressStateDigest`. The what-if stress evaluator it identified was never wired into any published surface, and no consumer read the digest.

• `stressStateDigest` is no longer present on Safety Score V9 cards, in the V9 response schema, or in the OpenAPI contract
• No score movement: the field was an identity digest over retained scoring state, never an input to any pillar, cap, or grade
• The unused stress what-if evaluator that consumed the identified state is removed with it
• Pillar weights, score aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

Gold and silver tokens stop being scored as custodial cash. The new `commodity-claim` mechanism archetype asks the questions the asset actually poses (legal title to identified bars, vault custody continuity, bar-list assurance, and operable physical redemption) instead of reusing the fiat-cash reserve component names and smuggling the real semantics in through a mechanism profile.

• Backing mechanism components for a commodity claim are `title-and-allocation` (0.15), `custody-continuity` (0.10), `assurance-and-reconciliation` (0.13), and `physical-redemption` (0.07), against the same 0.55 reserve weight the fiat-cash archetype carries; title and custody remain the serial claims that fail closed, and title failure keeps the critical unsafe-backing signal
• Physical redemption is now graded in Backing rather than existing only as a profile exit fact. It is stated once: the Exit pillar keeps reading the same curated fact to explain a missing runtime route, so the two pillars cannot disagree and no fact is counted twice
• There is deliberately no price-basis component. A commodity token's reference price is the metal, and the peg layer already measures the token-versus-reference spread; adding a backing component for it would double-count. Price-coupling context belongs in the physical-redemption rationale
• Gold-collateralized dollar tokens are not commodity claims and stay in their dollar archetypes with metal recorded as allocated-commodity reserve; the archetype is for direct claims on the commodity itself
• Commodity-claim components follow the same ratified strict evidence standard as fiat-cash and tbill: they are compiler-bounded, only a source-cited curated overlay may claim them, and insufficient disclosure records a sourced unavailable disposition that stays bounded and non-scoring
• A commodity claim is oracle-free like custodial cash and T-bill claims: nothing is liquidated against a price feed, so the oracle review publishes not-applicable instead of demanding a profile that cannot exist
• Fifteen assets migrate off fiat-cash: XAUT, PAXG, XAUm, XAGm, PGOLD, VNXAU, GLDT, DGLD, CGO, KAU, KAG, GGBR, GRAMG, GRAMS, and XNK. Gold-referenced dollar and franc tokens (USDKG, CHFAU) and tokenized metal ETF shares (IAUON, SLVON) keep their existing archetypes
• Measured over the full active registry at a fixed input, 12 of 337 cards move and none flips a grade. Three lose one point (PAXG 79 to 78, XAUm 73 to 72, VNXAU 71 to 70) where the newly asked physical-redemption question is not answered by the sources already pinned in their reviews. XAUT's exit pillar is unchanged at 35, because the exit fact is now derived from the same curated redemption component rather than declared twice
• Pillar weights, score aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

When a risk-absorption product's taxonomy does not reveal who operates the wrapper, its reviewed operator ownership now selects the existing parent-cap form: third-party wrappers use the strategy-vault treatment, while parent-protocol wrappers keep the native-staked treatment.

• No new cap tier, pillar weight, aggregation rule, or grade threshold is introduced; the change selects between the existing vault and native-staked wrapper treatments
• K3 sBOLD is a third-party wrapper over BOLD and now receives the same vault fallback discount as Yearn yBOLD: on the fixed production replay its parent limit moves from 79 to 74 and its published result moves from 78/B+ to 74/B
• Strata srUSDe is also classified as third-party but remains 52/C- because its own score is already below the parent cap; Aave stkGHO and Sky stUSDS remain parent-protocol wrappers and keep native-staked treatment
• Every risk-absorption variant must now declare `wrapperOperator`; the field is rejected on unambiguous variant kinds, preventing product taxonomy from silently granting a third-party wrapper native treatment

Contemporaneous release record.

Commit provenance not recorded

The resolved-mint-incident decay shipped in 9.1 at the strongest ladder that flipped no grade: a calibration constraint, not a judgment, whose whole effect was one point on one asset. The severity is now chosen on merit: while the incident is recent the mint reads as a concentrated admin, from 24 months as a partially bounded admin, and from 48 months as a bounded admin. Every rung is an existing V9 posture value, and because the last rung sits above every uncapped mint in the incident-carrying set the penalty genuinely expires rather than becoming a permanent tax.

• The resolved-incident cap on the mint component moves from 79/85/90 to 55/70/85 for the recent (under 24 months), aging (24-48 months), and dated (48+ months) tiers; the tier boundaries themselves are unchanged
• One published grade changes: pyusd-paypal moves A- to B (mint 79 to 55, score 80 to 70) on a resolved 2025-10-15 incident. Its cap relaxes to 70 on 2027-10-15 (B+) and to 85 on 2029-10-15, by which point its seasoned-issuer credit has raised its uncapped mint to 84, so A- is fully restored
• One published score changes without a grade change: reusd-resupply 47 to 45, D either way
• usdt-tether, dola-inverse-finance, ousd-origin-protocol, lisusd-lista and the four USDT wrappers are untouched, so the dependency-projection channel is never engaged; dgld-gold-token-sa and nxusd-nereus stay pinned at the unbounded-or-compromised floor
• The decay still measures only the age of the most recent resolved incident, not its severity: an operational error reversed the same day and an exploit with real bad debt take the identical cap. Making the decay severity-aware is a schema change and is not in this version
• The curated `authorityPosture` vocabulary gains two values, neither of which scores. `unbounded-reconciled` ("Unbounded, supervised & reconciled") stops a supervised issuer being annotated with the same value as an issuer with no reconciliation at all; the depeg resolver treats it exactly like `unbounded-or-compromised`, so it moves no depeg verdict. `none-resolved-mint` ("No privileged mint path") is the mint-scoped sibling of `none-resolved`, for an asset no control can mint while other control domains still exist (the scope V9 already derives at, which whole-of-chain `none-resolved` could not express). 14 share wrappers whose own token has no minter move onto it from an adverse posture; the resolver reads it as benign (neither fragile nor risky) and it does not earn the R1 non-inflatable-supply anchor, so two of the 14 change structural stratum and seven lose K1's curated risky-minter leg
• Pillar weights, aggregation, structural caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

The shared exit engine's two descending penalty ladders read their thresholds the same way. The queue-backlog ladder already matched at-or-above; the minimum-redeem ladder matched strictly above, so a route whose minimum landed exactly on a boundary took the gentler band. Both now match at-or-above.

• A route with a minimum redemption of exactly $1,000,000 takes the 0.75 capacity multiplier instead of 0.9; exactly $10,000 takes 0.9 instead of no penalty
• Only routes whose reviewed minimum sits exactly on a ladder threshold can move; every other route is arithmetically identical
• The comparison mode is no longer a parameter of the shared band resolver, so the two ladders cannot silently diverge again
• Ladder thresholds and multipliers, component weights, pillar weights, aggregation, caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

The standalone Mint Authority Score is retired and its distinct signals are merged into the Economic Control pillar's mint component. A resolved mint incident now decays instead of disappearing, MPC/HSM key custody reclassifies an externally-owned mint key, multisig quorum granularity replaces a binary strong-quorum test, and Safe module evidence is a small modifier. This is the only deliberate score-moving change in the consolidation wave.

• A resolved mint incident caps the mint component at 79 while recent (under 24 months), 85 while aging (24-48 months), and 90 once dated (48+ months), so it can never score as a clean record; an active incident keeps its unchanged critical path
• An externally-owned mint key takes a 3-point quality penalty that reviewed MPC or HSM custody attestation waives, mirroring the retired engine's issuer-backend treatment
• Multisig mint authority is graded on threshold, signer set, timelock, and Safe module surface instead of a single strong-quorum test; credits are relief against the penalty and can never lift a score above its posture rung
• A reviewed Safe module or guard on the binding mint control applies a 2-point penalty; unknown and not-applicable module surfaces are inert
• 41 of 337 published cards moved their mint component (-1 to -3 points) and 16 moved their published score by one point; every letter grade is unchanged, verified by a full-set replay against the 9.07 release baseline
• The curated `authorityPosture` field no longer affects the Safety Score: V9's derived posture is canonical and a curated-vs-derived disagreement raises a curation-queue item instead. It is still a structural input to the depeg resolver, so re-curating a posture can move a published depeg verdict
• Mint route-family pricing is excluded by design because the cap and claim semantics already price it; pillar weights, aggregation, caps, and grade thresholds are unchanged
• Breaking for header-keyed CSV consumers: the homepage and screener exports rename the `Mint Authority Score` column to `Mint Control Score` and `Mint Authority Band` to `Mint Control Band`. Band keys, filter values, and saved screener URLs are unchanged, and the export provenance line now stamps the safety-score identity instead of the retired mint-authority lane

Contemporaneous release record.

Commit provenance not recorded

The V9 compiler now captures a native input schema; the retired V8 scoring engine no longer executes, and no published score, grade, pillar, breakdown, or reason changes.

• Input identity is bound to the V9 evaluation build instead of the retired V8 digest
• The V8 dimension engine, penalty blends, and evaluation-build manifest are deleted
• Peg-analytics publication is an explicit producer step with unchanged content and cadence
• Captures taken before 9.07 remain replayable read-only through the retained v3 parser
• Backing, Exit, and Economic Control weights, score aggregation, caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

V9 Exit now scales its bounded backup-route credit by the backup route's own score and presents primary-route, backup, and completion measurements separately.

• Backup credit is min(10, 100 - primary route score) multiplied by backup route score / 100
• A primary route below 100 can no longer reach 100 from backup-route credit alone
• The Exit card names the selected primary route, identifies the backup credit, and shows actual stress-request completion separately from its capacity component score
• The Exit pillar name, aggregation weight, route components, caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

Strategy-vault wrapper loss-control facts can now use reviewed local controls from a partial deployment inventory while unresolved controls remain bounded and risk-transfer credit remains disabled unless separately documented.

• Reviewed local controls on a strategy-vault wrapper populate the wrapper loss-absorption and emergency-control dimension even when the aggregate mint/control review is still bounded
• Unresolved deployment surfaces still fail closed in Economic Control and keep their original evidence responsibility
• Security-module, recovery-mode, and other local emergency controls do not create parent-loss absorption credit; wrapper risk-transfer remains zero unless a separate enforceable backstop is reviewed
• Backing, Exit, and Economic Control weights, score aggregation, caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

Exit-coverage, route-evidence, and dependency gaps that no supported adapter can observe are now attributed to unsupported methodology instead of transient producer failure, deployment census coverage is reported per chain, and a peg with no usable price but an adverse record becomes measured adverse.

• Deployment census coverage is evaluated per chain: deployments on chains with no supported liquidity provider are reported as an explicit unsupported remainder instead of leaving the whole asset's coverage unknown, so a clean supported scope publishes real coverage
• An exit surface with no retained pool, or with retained pools but no score-eligible execution-capability pool, is attributed to unsupported methodology when its census remainder is methodology-unsupported and no execution-capability gate applies; genuine producer failures keep producer-failed responsibility
• Runtime route evidence for that unsupported cohort is reported as unsupported rather than missing, so later adapter coverage silently returns those assets to scoring without a responsibility rewrite
• Unreviewed dependency relationships are unsupported methodology when the asset has no live-reserve adapter and remain producer-failed when one exists, correcting the misattributed hubble USDH dependency gap
• Zero-pool and zero-exact-capable exit surfaces carry their own gap messages; the reviewed-capability-pool message is now emitted only where reviewed execution-capability pools actually exist
• An asset with no usable current price whose tracked peg record is already adverse is classified as measured adverse instead of a producer feed failure, while a clean record with no usable price stays a quiet observation and the deviation is never coerced to zero
• The unreachable subthreshold unrecognized chain-label pool reason is retired from the reason registry
• Reclassified surfaces stay bounded and remain at the same evidence ceiling, so pillar weights, score aggregation, caps, and grade thresholds are unchanged and no published grade moves

Contemporaneous release record.

Commit provenance not recorded

Subthreshold unrecognized chain-label supply pools remain tolerated by the bridge-materiality proof but no longer surface as public evidence-responsibility facts.

• Small raw provider chain-label pools below the common-mode materiality floor no longer create producer-failed remediation items
• Material unmatched bridge supply still fails closed through the ordinary bridge-supply reason at or above the materiality floor
• Backing, Exit, and Economic Control weights, score aggregation, caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

V9 now preserves causal responsibility through inherited and upstream evidence paths, distinguishes producer-unpriceable exit outputs from issuer non-disclosure, and retains reviewed controls in partial inventories without changing score or grade formulas.

• Explicit reason-level responsibility is authoritative; legacy reason defaults are used only when no explicit attribution is available
• Inherited reserve gaps, unavailable backing and role-pillar dependencies, and missing parent scores propagate the originating owner instead of defaulting downstream gaps to integration-missing
• Every attributed root receives a causal-root-qualified path even when it is the only root, so adding another root cannot rename an existing public fact; only unattributed fallbacks retain aggregate base paths, and mutable ownership never enters public fact identity
• Applicable but unpublished mechanism metrics retain issuer-undisclosed responsibility and never become measured-adverse merely because a related component was reviewed
• A reviewed external exit output with known identity but no same-notional valuation is producer-failed; an issuer-undisclosed settlement asset stays issuer-undisclosed, and neither output becomes scoreable
• Date-only mechanism and exit-output dispositions become admissible after the reviewed UTC day and cannot enter earlier replay clocks
• Reviewed mint controls remain present when the aggregate inventory is unresolved; unreviewed deployment surfaces stay bounded and fail closed
• Backing, Exit, and Economic Control weights, score aggregation, caps, and grade thresholds are unchanged

Contemporaneous release record.

Commit provenance not recorded

Exit routes now need economically material capacity, and sub-1% completion cannot score above 50 even when the absolute-capacity floor is met.

• The prior threshold derived from two-decimal trace rounding is replaced by the policy's first positive 1% coverage or $100K absolute-capacity breakpoint
• A route below both breakpoints receives a zero route score; a route that reaches $100K but remains below 1% completion is capped at 50
• Public Exit breakdowns identify capacity as selected-route-specific and expose executable amount, request, cost bound, horizon, protocol, pool, evidence kind, and evidence time
• Issuer redemption remains a separate near-term or eventual horizon and is not inferred from exchange volume, aggregate DEX TVL, or issuer reserves

Contemporaneous release record.

Commit provenance not recorded

Pharos activates the identity-bound V9 model with three risk pillars, explicit evidence responsibility, structural ceilings, and fail-closed publication health.

• All active consumers select V9 without recomputing or falling back to V8
• Backing, Exit, and Economic Control replace the five V8 dimensions for native V9 output
• Transient producer failures hold the last accepted V9 snapshot and expose held status instead of publishing infrastructure-attributed score movement
• Capability-free immutable protocol contracts resolve to immutable governance access posture instead of being mistaken for concentrated administrators
• V8.17 remains available only as historical methodology and archived score history

Contemporaneous release record.

Commit provenance not recorded