Accounting

What the deployed contract enforces, in the order it enforces it. Where Operating policy v1 would change a rule, it is marked (policy v1 differs).

All arithmetic is integer. Amounts round down at every step, in the order the contract performs them, never as one combined calculation.

Units

A unit is a nontransferable accounting entry. It sets your share of later distributions and of assessed pool value. It is not a token, not a share of a named charter, not a right to operate a bank, not a governance vote and not $STANDEV.

Processing is bounded to 128 concurrent ownership or subscription slots. The minimum per account is the relevant pool minimum or window cap divided by 128, rounded up; qualifying accounts can top up by less. This is a capacity bound, not one-person-one-account enforcement.

At least one raw unit remains while the pool continues. There is no full-liquidation route.

Admission

Contributions are refundable until the window settles, with one exception: refunds of a just-closed window are locked for 24 hours after close while settlement runs. Older refunds are never locked.

At settlement every participating account is priced off one pre-money valuation and the existing unit supply. Distributions that can already be funded are allocated first, so new units never collect an earlier one.

Conversion floors twice, in this order:

1. ETH            → $STANDARD   at the report's asset rate, floored
2. $STANDARD      → units       at the pre-money price, floored

Collapsing those into a single ratio mints more units than the contract does. Only a nonzero mint accepts ETH and removes it from refund backing; a zero-mint balance stays refundable.

You may attach an admission floor: the fewest units per ETH you will accept. A settlement below it leaves your contribution refundable rather than accepting it at a price you did not agree to.

A preview in the app uses current inputs. It does not reserve capacity and does not fix the eventual price.

What a receipt recovers, before anything is profit

A balance pending inside the Reserve is not pool money. Money becomes real when branches are retired and $STANDARD is actually received; the contract recognises each receipt exactly once.

Before any part of a receipt counts as profit, the accounting recovers, in order:

1. The historical paid basis attributed to the retired branch slice
2. Evidenced unrecovered operating costs
3. Carried realised capital losses

Only the remainder is eligible profit. A receipt of 320 $STANDARD that recovers 200 of basis, 20 of costs and 50 of old losses yields 50 of eligible profit, not 320.

Expansion funded out of a pending balance creates capacity without inventing fresh paid basis. A valuation gain is not a receipt and creates no profit and no fee.

The fee

The fee is 10% of the net realised result — cumulative eligible profit less realised losses not yet recovered — rather than a straight percentage of each gain. Writing P for cumulative eligible profit, L for unrecovered loss carry and F for fees already claimed:

net   = max(P − L, 0)
due   = floor(net × 1000 / 10000)
owed  = max(due − F, 0)

Three properties follow, and they are the point of the rule:

• A later realised loss reduces what is owed, so harvesting winners before losers does not earn a fee on a zero net result.
• Unclaimed fee is clawed back rather than kept — newest epoch first.
• Fee already released is never recovered.

Fees vest by 30-day epoch, anchored at activation: fee accrued in an epoch becomes claimable once the following epoch has ended, so between 30 and 60 days after accrual. Claiming is additionally subject to a fresh report and the cash protections below.

The fee recipient is fixed at construction and does not move if governance ownership later changes.

Distribution: target, funded, collected

The deployed contract splits eligible profit and distributes in three stages.

From eligible profit it creates a dividend target of 50% of the amount after a 10% gross fee figure, and retains the rest. That target then moves through three distinct states:

State	Meaning
Target	An intention to allocate. Still pool value, not yours.
Funded	Actual $STANDARD held by the pool is reserved for the owners eligible at declaration, and excluded from later pricing.
Collected	The reserved $STANDARD has been transferred. No units are sold to collect it.

Funding must leave existing claims, fees, liabilities and essential reserves protected first. A later cost or realised loss can impair a target that has not been funded; it never claws back a claim that has.

Queued withdrawal units keep earning declared distributions until their funded slice is retired. New units cannot collect old ones. Rounding residues too small to allocate stay protected in the contract and are not sweepable.

ETH the pool owns can also be distributed, through a separate native index using the same proportional arithmetic, so retained ETH is not permanently priced into withdrawals without ever being able to reach members.

(policy v1 differs.) Policy v1 pays out everything a retirement brings in, to every member in proportion to their units, with no target-and-funding stage and no fee on capital returning up to a charter's cost. That is a contract change, and it has not been reviewed. Until it is, the three states above are what the code does.

Withdrawal

A request queues units. It does not sell them, fix their price, or create a debt. Queued units stay exposed to gains and losses.

Cutoffs are weekly, anchored to activation, each with a 24-hour settlement window. During the window the queue is fixed and, with a sufficiently fresh report, any caller can settle it. Available $STANDARD buys the same proportion of every eligible request at one common valuation, subject to integer rounding. Funded units leave ownership once and become separately protected claims; unfunded units stay invested and queued.

You may set a withdrawal price floor per unit. A round that would burn your units below it skips you and leaves them intact.

You can cancel unfunded units outside an active settlement window, including while the pool is paused. An expired window can be advanced by anyone without changing shares or cash. Collecting a funded withdrawal transfers the reserved amount with no second sale and no repricing.

A pool can have positive assessed value and no withdrawal cash. Branch capacity is not liquid: a licence is burned and cannot be resold, and a balance is released only by closing the branch that holds it. There is no guaranteed return of capital and no completion date.

Valuation, and its bounds

Net asset value is derived from a governance-supplied report: holding value, asset and cost rates, liabilities, and reserve amounts, with an observation time.

Two report inputs are bounded by the contract:

Input	Bound
Illiquid mark	At most three times the capital recorded as paid
Asset rate rise	At most 5% per day elapsed since the previous observation; falls are unrestricted

A report breaching either reverts. A report showing more debt than assets is accepted and flagged rather than refused, so that restoring freshness never requires misreporting. Falls are unrestricted because the member price floors cover that side.

(policy v1 differs.) Policy v1 states unit value as the pool's $STANDARD, its undeployed ETH, and the pool's share of the charter balance at what a retirement would actually release — never above three times what the pool paid — with a burned licence carrying no value. The published valuation policy that sets admission and withdrawal prices is still to come.

These bounds constrain the lever. They do not authenticate a valuation method or discover an omitted cost. A nonzero report hash identifies evidence; it does not prove the evidence is right.

If the operator stops

After 60 days with no report and no accounting action, anyone may trigger a proportional distribution of idle cash and owned ETH. It works while paused, touches no reserved claim or fee reserve, changes no units and consults no valuation.

It is a floor against abandonment, not an exit on demand.

What the contract cannot do

No upgrade mechanism. No arbitrary external call. No treasury sweep. No arbitrary unit mint. Economic constants are fixed at construction.

Discretion still matters: reporting, cost attribution, pause, round timing and which portfolio operations are performed all affect outcomes. See Custody and the founder for the operator's limits, and Status and limits for what has and has not been reviewed.

Public contributions are not open.