§23. Extended Telemetry

Jason St George. "§23. Extended Telemetry" in Next Generation Stores of Value: Privacy, Proofs, Compute. Version v1.9. /v/1.9/read/part-v/23-extended-telemetry/

Extended Telemetry

“No dashboards, no trust” is the mantra. But dashboards themselves can be gamed. If Layer 6 claims “measurement is the constitution,” then the measurement regime itself must be bulletproof.

Reference Verifier Classes

All Verify* metrics are measured on standardized reference hardware:

Reference verifier classes.

Rule: All constitutional SLOs (e.g., “VerifyPrice p95 $\leq 5$s”) are defined against Laptop-Class unless otherwise specified. This ensures the “anyone can verify” promise is falsifiable.

Reference Verifier Implementations

Reference verifier implementation requirements.

Why this matters: A single verifier implementation can have bugs that inflate or deflate measurements. Two independent implementations provide a cross-check.

Cost Vector Definition

VerifyPrice is not a single number. It is a cost vector for each workload $W$ and verifier class $V$:

Where:

• $t_{50}, t_{95}$: Median and 95th-percentile verification time (seconds)

• $m$: Peak memory usage (MB)

• $b$: Bandwidth consumed (bytes)

• $e$: Energy estimate (Joules)

• $f$: Failure rate

Sampling and Anti-Cherry-Pick

The most common attack on telemetry is selective reporting: only show receipts from good regions, fast hardware, or favorable conditions. The sampling regime prevents this:

Sampling mechanisms for Verify* telemetry.

Rule: Any dashboard point published without a verifiable sampling seed and stratification breakdown is not part of the official Verify* record.

Data Availability and Anti-Memory-Hole

Dashboards are views. The source of truth is the receipt corpus. Receipts must be:

Data availability requirements.

Why this matters: If a government or CDN can delete “bad months,” the telemetry regime is captured. Content-addressing + neutral anchoring makes deletion detectable.

Reproducibility Contract

A valid dashboard datapoint is defined as:

Validity check: Anyone can:

1. Fetch receipts by $d_{\text{root}}$ (dataset root)

2. Run $v_{\text{harness}}$ (harness version) with $v_{\text{verifier}}$ (verifier version)

3. Verify $r$ (result) matches

If the results don’t match, the datapoint is invalid and the discrepancy is a Sev-1 incident.

Published artifacts:

• Harness code (open source, tagged)

• Verifier binaries (reproducible builds, hashed)

• Dataset roots (timestamped, anchored)

• Aggregation scripts (deterministic)

This transforms “no dashboards, no trust” from philosophy into a reproducible measurement contract.

How to Measure: Receipts, Not Vibes

VerifyPrice was introduced at Layer 4; VerifyReach at Layer 1; VerifySettle at Layer 5. Layer 6 treats them as a coherent observability regime rather than three unrelated graphs.

The observability story only works if it is itself verifiable. That is why every claim, proof, settlement, and SLA outcome is turned into a receipt with enough structure that anyone can replay the metrics on a reference verifier.

In practice, this means:

• Every proof receipt carries not only the proof artifact but also start/end timestamps, resource usage, and a hardware profile tag.

• Settlement receipts encode corridor, timing, refund status, and failure codes.

• Routers emit anonymized samples of order books, matched and unmatched bids, and house vs. third-party flags.

• Hardware vendors publish lot-attestation artifacts that receipts can reference as part of their profile.

A public “VerifyPrice Observatory” then ingests these receipts and emits the aggregate vectors we refer to in the text. Anyone can pull the raw receipts corresponding to a dashboard point, feed them into the same open-source verifier suite, and see whether they obtain the same numbers. If they do not, the mismatch is itself an incident.

This architecture enforces a simple discipline: if it matters, there is a receipt for it. If a claim about performance, neutrality, or safety cannot be tied back to receipts that anyone can re-check, it is out of scope for the monetary thesis.

They are the three primary dials for answering:

• Is verification still cheap? (VerifyPrice)

• Can users still reach the network under pressure? (VerifyReach)

• Can users still move value privately and safely? (VerifySettle)

We can think of this observability regime as watching the stack across five planes:

Proof & compute plane
Are receipts reliable, and does verification asymmetry actually hold under load?

Settlement & privacy plane
Do non-custodial payouts actually clear, with privacy and refund-safety matching the promise?

Neutrality & admission plane
Can new provers, miners, routers, and mirrors join on equal footing, or has the system ossified into a club?

Economic coverage plane
Are real fee flows, not issuance, paying a growing share of the security and operations budget?

Layer-0 hardware plane
Do “verifiable machines” remain falsifiable in practice, or did we slide quietly back into “trust the vendor”?

Each plane maps directly to the SoV requirements from Part II: credible scarcity, cheap public verification, censorship-resistance, neutrality, native demand, lawful privacy, and duration-neutrality. If any plane drifts too far from its targets, the monetary thesis weakens, no matter how elegant VerifyPrice looks in isolation.

VerifyFlow: Instrumenting the Market Realization Plane

VerifyPrice, VerifyReach, and VerifySettle answer whether the stack is real. None of them answers a question that will dominate every public conversation about the asset: why is the price doing that? §10: Work Credits: Energy-Anchored Claims says we cannot infer monetary adoption from price, and §10: Work Credits: Energy-Anchored Claims says the answer lives in external market structure. VerifyFlow is the fourth named verification family, and it measures the external financial representation and price-transmission state of the native monetary object.

The governing principle extends the existing one:

No protocol dashboards, no monetary trust. No flow ledger, no price inference.

Wrapper-Level Vector

For each external financial wrapper $i$, publish

where $L_i$ is the leverage multiple and reset rule; $A_i$ is assets or delta-adjusted exposure; $\Delta A_i$ is creations and redemptions; $\varepsilon_i$ is holder flow elasticity; $\kappa_i$ is net mechanical gain; $C_i$ is constituent concentration; $H_i$ is hedge implementation (physical, swaps, futures, options); and $D_i$ is dealer or counterparty concentration. Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture derives $\varepsilon$ and $\kappa$ and states their measurement contract.

Asset-Level Vector

For the native asset $X$, publish

Return-coupled demand $Q^{RC}$.
Exposure that moves as a function of the return itself, $Q^{RC} = \sum_i \kappa_i A_i r_i$. This term shapes volatility, momentum, persistence, and reversal severity.

Return-decoupled demand $Q^{RD}$.
Allocation flow largely independent of the day’s return, $Q^{RD} = \sum_k w_{Xk} F_k$, where $F_k$ is net creation into wrapper $k$ and $w_{Xk}$ its exposure weight to $X$. This term shapes destination, concentration, and level — which prices get accepted without valuation-sensitive selling.

Mechanical Pressure Ratio (MPR).
Let $Q^{\text{exp}} = Q^{RC} + Q^{RD}$ be total product-level exposure demand. Dealers translate that exposure into market orders, so realized market demand is its intermediated image, $Q^{\text{mkt}} = \mathcal{H}\bigl(Q^{\text{exp}},\ \text{dealer inventory},\ \text{internalization},\ \text{swap/future/option mix}\bigr)$, and $\mathrm{MPR} = |Q^{\text{mkt}}| / V_X$ measures flow pressure relative to executable liquidity $V_X$. Customer exposure and dealer hedging are the same demand observed at two stages, not two independent demands; summing them would double-count. Report $Q^{\text{exp}}$ and $Q^{\text{mkt}}$ separately and never add them.

Custodial Control Ratio (CCR).
Base asset controlled by custodians and wrappers, divided by circulating supply.

Synthetic Exposure Ratio (SER).
Delta-adjusted derivative exposure divided by liquid free float.

Wrapper–Native Growth Gap (WNG).
$\mathrm{WNG} = \Delta \ln E^{\text{wrapper}} - \Delta \ln U^{\text{native}}$, where $U^{\text{native}}$ counts native fee payments, burns, collateral, private settlement, proof purchases, and verified-compute consumption. A persistently positive WNG means financial exposure is growing faster than monetary use — the single most compact measure of financialization outrunning adoption.

Recursive Claim Ratio (RCR).
Exposure held in wrappers whose underlying is itself another wrapper or derivative.

Native Use Share (NUS).
The share of observable economic activity that actually touches the protocol-native monetary loop.

Holder Cohorts, Vintage, and Policy Concentration

Flow elasticity is not a permanent product characteristic, and treating it as one is a modeling error. Product launch date predicts holder behavior: older funds contain embedded winners who are more likely to skim gains after a rally, whereas newly launched products may contain momentum-oriented holders with no gains to realize and therefore nothing to trim. So

Telemetry should therefore track product age, average holder cost basis where inferable, the realized/unrealized gain distribution, rolling elasticity, statistical break dates, holder-cohort turnover, and fund-flow response after drawdowns.

This matters more, not less, in an agent economy. Automated treasury systems, robo-advisers, and AI allocation agents may share common rebalancing policies, producing a machine-readable version of holder elasticity at scale. The protocol should therefore monitor concentration not only of holders but of holder operating rules.

Policy Concentration Ratio

The share of net asset demand governed by the largest common rebalancing templates, treasury algorithms, robo-advisers, or agent policies. An asset can have decentralized ownership and highly centralized behavior; only the second predicts what happens on a bad day.

Capital Survival: AUM Is Not Investor Return

One further metric prevents a specific and common confusion. A leveraged wrapper can survive commercially while repeatedly destroying investor capital: reverse splits preserve a presentable share price, fresh inflows replenish assets, and the sponsor continues collecting fees on a product whose successive holder cohorts were harmed. Persistent AUM is therefore not evidence of successful capital preservation.

Capital Survival Ratio (CSR)

At the product level, every term must be an aggregate dollar amount — net assets, not per-share NAV, which would mix a per-unit price into a sum of dollar flows:

Because the stated purpose is to ask whether successive cohorts survived, the product-level figure is only a summary. The cohort form is the one that answers the question, for cohort $c$ with cohort-attributable value $V_{c,t}$:

This is a multiple on invested capital by vintage; a dollar-weighted return over the same cohort carries the same information. A product can show $\mathrm{CSR}_i$ near or above 1 while late cohorts sit well below 1, which is precisely the failure the metric exists to expose. Accounting implementations vary, but the purpose does not: AUM is not investor return, product survival is not holder survival, and a wrapper can be an excellent business for its sponsor and a disaster for everyone who owned it.

Dealer Balance Sheets and Hedge Paths

Wrapper exposure does not necessarily arrive as direct spot purchases. Dealers may implement it with swaps, futures, baskets, or options, and counterparty capacity affects how — and whether — the exposure reaches the underlying market. Product-level exposure demand must therefore never be read as an identical quantity of spot orders.

Publish: the wrapper counterparty list; top-$N$ dealer share; physical holdings versus swaps; swaps versus options; average derivative maturity; delta- and gamma-adjusted exposure; collateral and margin requirements; evidence of counterparty caps; and changes in hedge-instrument mix.

Dealer capacity warning. A migration from swaps toward options can indicate that dealer balance-sheet capacity is binding. When dealers are short calls, rising spot and rising volatility can require additional underlying purchases, adding a gamma feedback loop on top of the mechanical one. This is an empirical warning to watch for, not a universal law to assume.

Convenience-Yield Telemetry: Pricing the Holder-Side Service Flow

VerifyPrice, VerifyReach, and VerifySettle measure the stack; the wrapper vector measures the realization plane; the Native Monetary Buyer Map measures who is holding and how. None of them prices the thing the monetary claim actually rests on. §10: Work Credits: Energy-Anchored Claims relocates the premium to a regime-contingent convenience yield — a holder-side service flow with no cash flows to discount — and then concedes it is unsized. The concession is honest but incomplete: unsized does not mean unmeasurable, and an unsized quantity with no instrument is indistinguishable from an article of faith. Storage theory extracts convenience yield from observable prices rather than asserting it (the forward-curve slope net of carry); the crypto-native analog is the lending and derivatives complex around the asset. The thesis therefore publishes a fifth measurement family whose job is to make the premium a number rather than a hope.

Instruments.

For each venue publishing a rate, report:

Base-asset lending rates.
The market-clearing rate for borrowing the base asset itself, segmented by venue, term, and counterparty class. A borrower pays this rate to be short the asset; what they are paying for is the units. When holders of the bearer service lend out their units, they are selling the service flow for the term of the loan — so the lending rate is the direct market price of temporary access to bearability, the closest available analog to a lease rate.

Forward and perpetual basis.
Forward price minus spot, and perpetual funding rate, net of the reference interest rate. Persistent positive basis that exceeds carry costs indicates demand for deferred or levered exposure outrunning demand to hold the units — demand for the price story rather than the bearer service. Persistent negative basis indicates the reverse: entities that need the units (operators meeting collateral calls, shorts delivering into settlement) bidding against the float.

Wrapper basis.
The premium or discount of a custody-restricted wrapper over the value of its native holdings. A persistent premium is the price of not holding natively: legal wrapper, custody, and access convenience purchased in place of self-custody, agency, and exit. It is the complement of the lending rate — both price the friction between native holding and representative holding — and under §10: Work Credits: Energy-Anchored Claims a large and rising wrapper premium with stagnant native use is financialization, not monetary adoption.

What the instruments read.

Convenience yield is a residual claim on holding, extracted from prices that also contain discount-rate and risk information, so each reading requires the same care as $\varepsilon$ in Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture:

• Lending rate decomposition. Borrow demand has three sources: directional short interest, market-making inventory financing, and operational short squeeze against locked float. Segment by borrower class where observable; an operational squeeze (collateral calls meeting immobile supply) is a liquidity event, not a premium reading.

• Regime conditioning. The thesis’s claim is specifically regime-contingent: the yield should rise in exactly the states where substitutes weaken. The instrument earns its place only if the rate series is published against the macro-state model of §26: Adoption Curve & Ecosystem Dynamics and the pressure index $R$ of §10: Work Credits: Energy-Anchored Claims, so that $\text{convenience yield} = g(R)$ becomes an estimable function rather than a slogan. A yield flat across regime states is the null result and must be reported as such.

• Both tails checked. A convenience yield that appears only in benign states — holders renting out units for yield-farming while nobody needs the bearer service — is a fee-like cash flow, not the regime-contingent service flow, and belongs in the DCF bucket with the rest of §10: Work Credits: Energy-Anchored Claims.

The null result is publishable.

The instrument is falsification machinery, not advocacy. If, after the stack delivers measurable service, the lending and basis series show no regime-contingent premium — holders charge nothing extra to part with units exactly when substitutes fail — then the holder-side flow is priced at zero and the store-of-value claim has lost its mechanism in public. That outcome belongs on the Value Capture Board beside fee coverage, and it is a more direct test than any red line currently operating on it: the red lines test whether the chain broke; this tests whether the premium exists.

Buyer Quality and Price Provenance

Wrapper vectors answer which product is transmitting exposure. They do not answer who is absorbing the risk, with whose capital, under what mandate, at what leverage, against which liability, through which benchmark, and with what capacity to sit through a mark. That is the sovereign-market question of §2: The World Forces New Monetary Primitives, applied to the native asset’s own realization plane. Publish, as a checklist rather than as a multiplicative index:

• Persistence ($P$). Does the bid recur because contributions, a mandate, or a liability continue, or because a trade has not yet finished?

• Horizon ($H$). Is the holder matching a multi-decade promise, a quarterly risk limit, or a daily reset?

• Liability match ($M$). Is the purchase offsetting an enduring obligation, or following a weight?

• Loss-bearing capacity ($B$). Can the holder absorb marks without forced sale, margin call, or redemption?

• Countercyclicality ($C$). Does incremental buying increase when prices fall, or does the governing rule absorb less risk precisely then?

A high-persistence, low-match, low-countercyclicality buyer is the automatic index flow of §2: The World Forces New Monetary Primitives: it keeps arriving and still fails as an anchor. A leveraged relative-value fund can score the opposite way on persistence and the same way on loss-bearing capacity. Neither score is a number to multiply into a headline $Q_A$. The fields exist so that “there is demand” cannot be reported without saying what kind.

Price then requires a provenance model, not only a feed: who bought, with whose capital, under what mandate, at what leverage, with what redemption terms, against which liability, through which benchmark, and with what capacity to survive losses. A policy that treats the resulting price as an external referendum on credibility is reading an instrument the state and the financial industry themselves constructed. That is the epistemic loop §2: The World Forces New Monetary Primitives already warns about, now stated as a VerifyFlow requirement: no buyer-quality ledger, no inference from the long yield—and no inference from the native asset’s price either.

Native Monetary Buyer Map

Buyer quality belongs inside the monetary chain, not only in the external price model. Publish a Native Monetary Buyer Map that reconciles protocol flows and holder cohorts without pretending that pseudonymous addresses are known persons:

Just-in-time fee acquisition.
Share of fee-paying units acquired within pre-declared windows before expenditure, versus fees paid from retained balances.

Operator sell-through and inventory.
Rewards and fee receipts sold, retained, hedged, or pledged by operators, by cohort and interval.

Burns and net issuance.
Gross burns, gross issuance, and net issuance separately; a burn is supply arithmetic, not evidence of a buyer.

Self-custodied reserve demand.
Net accumulation in addresses or proofs-of-control classified under published, conservative reserve criteria, excluding custodial and wrapper inventories.

Wrapper demand.
Custodial, fund, treasury-company, and synthetic exposure reported apart from native reserve holdings.

Leverage.
Borrowed funding, derivatives, rehypothecation, liquidation sensitivity, and margin terms where observable.

Holding period.
Cohort survival and realized holding-duration distributions, not a single average that mixes fees with reserves.

Loss-bearing capacity.
Evidence that the funding source can absorb marks without margin call, redemption, or forced sale.

Countercyclical accumulation.
Whether native self-custodied reserve cohorts add units during drawdowns and regime-pressure episodes rather than merely after recoveries.

The map must reconcile identities only to the degree evidence permits. Unknown holdings remain unknown; they are not assigned to the most favorable category. Gross native volume passes Premise 7 only when the retained, self-custodied, unlevered or transparently financed, loss-bearing, countercyclical cohort is material and persistent.

The Public Boards

Metrics surface as twelve public boards or maps. The original five have grown to twelve as the thesis has extended from pure verification economics into physical capacity, political economy, dependency, holder quality, and market structure:

Proof & Compute Board.
Summarizes VerifyPrice per workload, SLA attainment, queue depths, and failure modes.

Settlement & Privacy Board.
Reports swap success, refund safety by corridor, time-to-finality, and anonymity-set health.

Neutrality & Admission Board.
Tracks time-to-first-proof for new entrants, top-N share, geo/ASN distribution, and house share.

Layer 0 Capacity Board.
Extends hardware-profile telemetry with Facility Energy Receipts and Facility Capacity Receipts (§14: Layer 0: Verifiable Machines & Energy): grid node, interconnection class, outage history, backup duration, fuel mix, cooling dependency, and Physical VerifyPrice (§19: Layer 4: Truth & Work). Reports both Sovereign Optionality and scenario-specific Delivered Verified Capacity, active minimum cuts, substitution latency, and dependency groups (§14: Layer 0: Verifiable Machines & Energy). Tracks whether the compute/proof layer is physically resilient or just another hyperscaler/cloud bottleneck, including the Homestead Ratio (§4: Threat Model).

Economic Coverage Board.
Charts fee-coverage ratio, physical VerifyPrice against SLOs, and demand curves indexed to policy events.

Value Capture Board.
Tracks fee coverage, native-asset burn rates, collateral lockup volumes, issuance vs. capacity growth, workload mix (budgeted vs. speculative), and bypass-channel indicators (operator off-ramp rates, stablecoin-denominated fee share). This board makes the §10: Work Credits: Energy-Anchored Claims from §6: The Triad and the Monetary Candidate auditable: if value capture is failing, it shows here before it shows in price. It also carries the triple divergence composite — persistently positive WNG, flat or falling regime-conditioned convenience yield, and falling Homestead Ratio against improving closed-stack service metrics — which is the observable signature of the joint failure mode named in §29: The Closed Sovereign Stack.

Wrapper Dominance Board.
Tracks whether the asset is becoming a financial wrapper rather than money: the Wrapper Dominance Ratio (§10: Work Credits: Energy-Anchored Claims) alongside its component series (ETF/wrapper AUM, custodied balances, exchange balances, wrapped supply, native fee share, non-custodial settlement volume, shielded settlement volume, collateral lockups). A rising WDR while native usage stagnates is surfaced here before it appears anywhere else.

Agency Preservation Board.
Tracks non-custodial usage share, selective-disclosure scope, dossier-reconstitution risk, and forced-disclosure incidence (§24: Legal, Policy, and Jurisdictional Posture), operationalizing the ninth SoV requirement (§3: First Principles: What a SoV Must Survive). This board is optional in early phases but becomes load-bearing once the protocol has material institutional and administrative-state interaction.

Market Realization & Wrapper Board.
Reports the VerifyFlow vectors (§23: Extended Telemetry): wrapper inventory by class, assets and delta-equivalent exposure, creations and redemptions, holder flow elasticity, net mechanical gain, Wrapper Recycling Ratio, constituent concentration, market-depth ratios, hedge-instrument mix, counterparty concentration, the Wrapper–Native Growth Gap, custodial versus self-custody shares, recursive wrapper exposure, cross-jurisdiction exposure, holder-cohort statistics, and the convenience-yield telemetry of §23: Extended Telemetry (lending rates, forward and perpetual basis, wrapper basis, published against the regime-pressure index).

Native Monetary Buyer Map.
Separates just-in-time fee acquisition, operator sell-through and inventory, burns and net issuance, self-custodied reserve demand, wrapper demand, leverage, holding period, loss-bearing capacity, and countercyclical accumulation (§23: Extended Telemetry). It asks who warehouses native monetary risk, not merely whether demand exists.

Common-Cause Dependency Board.
Maps dependencies crossing nominally independent facilities or jurisdictions: hardware and accelerator vendors, firmware and signing systems, energy and fuel markets, cables and network routes, identity, custody, market making, banking, legal recognition, cooling-water basins, and software distribution. For each dependency publish affected capacity, substitutable alternatives, substitution latency, correlated stress scenarios, and the DVC loss if the group fails. The correlated physical-failure framing is adapted selectively from Doomberg’s A Minor Detail, treated as scenario commentary rather than forecast.

Sponsor Dependency Board.
Reports subsidy concentration, politically contingent demand, cloud-credit dependence, dominant-customer exposure, state or foundation veto power, operator exit capacity, sponsor-withdrawal sensitivity, conflicting terminal objectives, capacity removable on short notice, and spillover to neutral third parties. Subsidized operators and sponsors are separate strategic actors even when their current incentives align. The principal–agent framing is adapted selectively from Doomberg’s Over Target; inferred intent and tactical escalation claims are excluded.

Do not merge the last two economic boards. The Value Capture Board and the Market Realization & Wrapper Board answer different questions, and collapsing them destroys the distinction the thesis depends on:

• Value Capture Board: Is service value accruing to the native asset?

• Market Realization & Wrapper Board: What is currently setting its price?

The Value Capture Board stays focused on protocol economics. The Native Monetary Buyer Map asks whether a monetary-risk warehouse exists. VerifyFlow stays focused on market realization. A reader needs all three to distinguish service accrual, monetary adoption, and financialization.

These boards are not marketing pages; they are part of the protocol’s public interface.

Detecting Drift

Telemetry detects drift:

Verification cost creep.
VerifyPrice shows p95 verify time creeping up. Response: R&D lab proposes fixes; governance ratifies changes.

Verifier concentration.
80–90% of verifications performed by one hardware profile. Response: adjust rewards to subsidize diverse profiles.

Reachability degradation.
VerifyReach shows a major country blocking protocol ports. Response: shift transports, promote alt routes.

Corridor fragility.
VerifySettle shows corridor success dropping. Response: re-weight corridors, onboard new LPs.

Making Neutrality and Repression-Resilience Falsifiable

Neutrality and repression-resilience are usually sold as moral properties. In this thesis, they are falsifiable hypotheses:

Neutrality hypothesis:
“No actor or group can reliably censor, privilege, or front-run specific flows across Layers 1–5 without being detected and without other actors being able to route around them.”

Repression-resilience hypothesis:
“Under YCC, capital controls, DPI, and blacklists, the triad’s core capacities retain sufficient DVC and the base asset’s self-custodied holder constituency retains sufficient agency to remain a monetary candidate.”

Telemetry makes these hypotheses testable:

• If VerifyReach shows certain flows consistently blocked and no alternatives emerge, neutrality is falsified.

• If VerifySettle shows privacy corridors collapsing under regulation, repression-resilience is falsified.

• If VerifyPrice shows verification cost pushed beyond reach, “anyone can verify” is falsified.

A system that cannot tolerate bad news cannot be money; it can only be marketing.

Policy-Attack Stress Harness

A monetary stack designed for repression should publish the exact conditions under which it considers itself passing or failing. For each attack scenario, we define tests and pass criteria:

Yield-curve control & negative real yields:

• Test: Over 24–36 months of $-300$ to $-500$ bps real yields, fee+burn share of security budget is stable or rising.

• Pass: Tokens behave like claims on useful capacity, not synthetic bonds.

On-/off-ramp throttling:

• Test: Non-custodial corridors maintain $\geq 95\%$ success and 100% refund safety; anonymity sets remain above thresholds.

• Pass: Users can move capital via non-custodial rails even when custodial ramps are hostile.

Provenance mandates:

• Test: Canonical provenance workloads have healthy VerifyPrice; regulators can run verify(receipt) with commodity tooling.

• Pass: The triad is the cheapest way to comply with provenance mandates.

Hardware backdoor mandates:

• Test: A non-trivial share of receipts are tied to open or sampled hardware profiles, not a single opaque TEE.

• Pass: Hardware mandates become one option among many, not a kill switch.

When the stack claims “we can survive policy attacks,” the proof is not a blog post; it is a corpus of stress-harness runs with metrics and receipts.

Market-Realization Stress Tests

The harness above stresses repression and availability. The Market Realization Plane needs its own scenarios, because the compositional adversary (§4: Threat Model) does not respond to any of the tests above. Each scenario is run against the VerifyFlow vectors of §23: Extended Telemetry.

A. Wrapper inflow cannon.

A large spot or thematic fund launches; creations arrive independent of daily returns; holdings are concentrated; native liquidity is shallow. Measure: $Q^{RD}/V$, constituent concentration, price impact, native-use response, WNG. Question: does the bid convert into native usage, or only into price?

B. Elasticity regime break.

A $2\times$ or $3\times$ wrapper grows rapidly and holder elasticity drifts toward zero, so recycling declines. Measure: $\kappa$, Wrapper Recycling Ratio, volatility feedback, reversal symmetry. Question: has a product quietly become a momentum amplifier?

C. Creation halt.

Wrapper inflows stop while protocol-native usage stays constant, removing passive support. Measure: price drawdown, native fee coverage, governance response. Pass: native fee coverage remains sound and governance does not respond by inflating issuance or subsidizing price.

D. Overnight gap or market halt.

The underlying gaps beyond a daily-reset wrapper’s viable range before it can rebalance. Measure: wrapper solvency, dealer collateral calls, liquidation paths, cross-venue settlement. Pass: native protocol operations continue unaffected; wrapper failure stays contained in the Market Realization Plane.

E. Swap-capacity exhaustion.

Dealers reduce swap exposure and funds migrate to options. Measure: implied-volatility demand, gamma hedging, dealer concentration, collateral requirements, spot–volatility correlation.

F. Price up, protocol flat.

Price triples and wrapper AUM grows while native fees, settlement, proofs, and compute usage do not. Expected result: market success, monetary-adoption failure, and an automatic dashboard warning. A thesis that cannot raise an alarm during a rally is not falsifiable.

Tip: hover a heading to reveal its permalink symbol for copying.