What is built,
and what is wrong.

Sixteen external functions remain untested; all are trivial getters. The bonding engine went from zero coverage to 27 tests during this build-out, which is where every defect below was found.

Each was found by writing tests for code that had none. That is the honest argument for why the test work mattered more than adding features.

A treasury seeded at exactly parity emits nothing.

The mint gate binds at 1.01× backing, deliberately, so it bites before dilution rather than after — unlike the predecessor’s gate at exactly 1.0, where the backstop engaged only once the dilution had already happened.

The consequence: seed at $1.00 backing per token and excess reserves are zero, so there are no staking rewards and no keeper bounty until backing grows through fees or appreciation.

That is a launch decision, not a defect. Either seed above the floor, or accept a quiet period at the start. Both states are demonstrated in the test fixture.

Kept

The gons pattern for rebasing, the index stored once at genesis, the permissionless bounty-paid rebase, warmup held in gons, bond notes denominated in the wrapper and staked immediately, excess reserves as a hard mint gate, balanced-point liquidity valuation, and the timelocked permission queue.

Rejected

• Fixed-fraction-of-supply emissions. The predecessor’s rate was a fixed fraction of supply minted every eight hours — 0.35% per epoch compounds to roughly 4,487% annual inflation. Rebases mint tokens but create no backing, so when bond demand slowed, supply inflated against a static treasury.
• A stepped emission curve. Gameable at every boundary: at 1.30× the rate jumped four-fold, an 11.6% to 55.1% annual swing from an infinitesimal move in premium, with roughly 1,095 windows a year at each of five boundaries and two handles to push.
• A headline APY. Emission figures render muted throughout, never as a yield. The compounded number rises as holders unstake, because the same mint divides among fewer stakers — a signal that looks bullish precisely when the system is failing.

Bugs specifically avoided from the predecessor and its forks: an epoch countdown that reverted when overdue; missed epochs silently skipped rather than caught up; a warmup expiry any third party could extend indefinitely with dust, rated High in a fork’s audit; unchecked downcasts on user-supplied amounts; live decimals reads; and inconsistent rebase-before-conversion between staking and wrapping, which let wrapping either side of an epoch boundary convert at different indices.

Unaudited, and the code audit is not the expensive risk. The predecessor died of mechanism design, not assertion failures. A separate economic review — agent-based simulation of the emission policy, the redemption floor under stress, and reflexivity at various own-token treasury shares — matters more here than line-by-line code review. Formal verification proves only what the specification asserts, and non-linear arithmetic is where solvers struggle most.

The floor is a liquidity problem, not a treasury problem.

The predecessor holds roughly $195m of treasury against about $11.20 of backing per token, trading near $20 — a persistent premium nobody arbitrages, on roughly $97,000 of daily volume. Enormous backing, near-zero liquidity, permanent premium. Treasury size did not separate the surviving forks from the dead ones; one fork holding real assets sits at a five-figure market cap.

Liquidity here is unproven. A 4,000-block scan for transfer events on a live tokenized equity on the target chain returned zero. The redemption arbitrage band assumes an arbitrageur can liquidate the in-kind basket; if depth is thin, the band is wider and the floor softer than computed. Measure it per asset before committing capital.

Legal. Permissionless redemption at net asset value is plausibly what converts this into a collective investment scheme — the feature that makes the floor credible is the feature that creates the liability. Two independent UK perimeters apply, and the US Investment Company Act question turns on the asset mix regardless of token classification.

Bytecode caveat. The finding that tokenized equities carry no transfer restrictions rests on decompiled bytecode, not verified source. A testnet transfer-to-contract closes it cheaply and should be done before writing integration code against it.

Proxy upgradeability. The tokenized-equity implementations sit behind proxies, so transfer restrictions could be added later. The largest protocol risk, and outside our control.

Name. The chosen ticker already exists as a live token on the target chain, and a prior project of the same name failed in DeFi in 2021. Proceeding was a deliberate decision made with those findings in hand; ticker and search confusion is the accepted cost.