The exit.

An authorized participant delivers the prescribed basket and receives fund shares; returning those shares releases the basket, and that loop is how arbitrage closes the gap between a share and its constituents. On Solana the participant can be a protocol role rather than a named institution: any wallet able to satisfy the Formula can create shares, and any holder able to return them can redeem.

The complication is the constituent set. A tokenized equity may settle through the same runtime as an ordinary SPL token while retaining freeze authority, a permanent delegate, transfer-hook configuration, mutable supply, pause state and a time-dependent Scaled UI multiplier. Those controls remain attached to the asset after it enters a basket. Opening the AP set does not remove them.

The resulting problem is less about issuing a basket token than defining an exit that remains coherent when one of the assets underneath it stops behaving as the basket expects.

On 23 September 2026, Seametry captured 1,124 xStocks mints from Solana mainnet at slot 449,842,612 and decoded their Token-2022 state directly from the mint accounts.

1,124 carried a permanent delegate. 1,124 retained freeze authority. 1,124 contained a transfer hook which was disabled at capture but remained governed by an authority capable of enabling it; 0 had one enabled. 7 were in an issuer-halted state. 0 unknown extensions were encountered in that capture.

None of those observations says anything about issuer intent. They describe the authority graph of the instrument.

That graph matters to a basket because custody does not extinguish it. Moving a token into a program-owned account does not remove the mint's freeze authority. Holding it inside a vault does not neutralize a permanent delegate. A disabled hook is not the same state as no hook. A protocol which records only symbol, mint and balance has discarded information that can later determine whether settlement succeeds.

Take a basket with eight constituents and implement redemption in the obvious way: burn the basket share and transfer all eight assets to the redeemer in one Solana transaction.

Now freeze the basket's token account for constituent eight.

The first seven transfers may be individually valid. The eighth is not. Solana commits the transaction as a unit, so the failure of that transfer reverts the preceding seven as well. The issuer has authority over one constituent; atomic execution gives the resulting failure transaction-wide scope.

That failure mode is architectural. NAV is irrelevant to it.

redeem burns the Alloy share and calculates the units owed for every constituent, but it does not invoke any constituent token program. The obligation is written into a per-holder Claim. The constituent transfers occur later through withdraw, one leg at a time.

If an issuer prevents delivery of one constituent, that withdrawal fails and its claim remains. Other legs are unaffected because their withdrawals are separate transactions.

The program makes the distinction explicit in its account topology. create must actually receive every constituent and therefore takes four accounts per leg: mint, caller token account, Hall token account and token program. A failed deposit invalidates creation, as it should; an incompletely funded basket must not mint a complete share.

redeem has no corresponding dependency on the constituent mints or their token programs. It needs the Hall-held accounts to establish what exists, then converts the share into accounting claims. withdraw reintroduces the individual constituent's token program only when that particular leg is delivered.

The share therefore settles atomically into claims without requiring all constituents to settle atomically into wallets. For issuer-controlled assets, those are materially different properties.

Transfer authority is not the only condition a basket has to interpret.

Token-2022's Scaled UI Amount extension stores the raw token amount separately from the quantity presented to the holder. Its configuration includes multiplier, new_multiplier and new_multiplier_effective_timestamp. Resolving the displayed quantity therefore requires both values and a clock.

The same capture found the extension on 1,124 of the 1,124 surveyed mints. On 383 of them, multiplier no longer represented the effective value because the scheduled multiplier had already crossed its activation timestamp.

CRWDx retained 1 in that field while the effective multiplier was 4, effective since 2 July 2026. NFLXx retained 1 while the effective value was 10. PALLx retained 1 while the effective value was 5. PPLTx retained 1 while the effective value was 10.

5 other mints were in the inverse condition: new_multiplier had already been written but its effective timestamp remained in the future. Reading the new value unconditionally would be premature; reading the old field unconditionally would eventually become stale.

This is not malformed state. Both fields are valid parts of the extension.

A basket implementation that treats multiplier resolution as read(field) rather than resolve(configuration, time) can calculate against internally consistent but economically obsolete quantities. Seametry resolves the effective value before the mint reaches admission policy and records when the naive field has diverged.

The uncomfortable property here is that a balance can become wrong in an interface without a transfer, mint or burn ever occurring.

A second capture, on 24 September 2026, measured executable depth through Jupiter for 7 tokenized equities at 100, 1,000 and 10,000 USDC. 4 produced a route at the smallest size. 3 did not.

Against the smallest observed size, the shortfall at 1,000 USDC was 12 basis points for AAPLx, 232 basis points for NFLXx, 346 basis points for TQQQx and 8,237 basis points for STRKx. At 10,000 USDC it was 36 for AAPLx, 1,664 for NFLXx, 2,055 for TQQQx and 9,744 for STRKx.

A wider capture on 4 October 2026 measured 25 instruments at the same sizes. 21 routed at the smallest size and 4 did not. The table below carries every routed instrument from that capture.

These measurements are intentionally narrow. They represent one aggregator, one direction and observations made seconds apart. They do not establish a permanent liquidity characteristic for any ticker.

That limitation is the reason depth is stored as an observation rather than a label.

The same treatment applies to unsupported state. If the mint decoder encounters a Token-2022 extension it does not understand, the extension is retained as unknown rather than discarded. If Jupiter returns an unfamiliar refusal, the provider's refusal survives normalization instead of being coerced into a known error class.

Otherwise two materially different states become indistinguishable inside the system: absence and ignorance.

Before an instrument enters a Seametry Formula, the Assay therefore combines several independent properties: the legal form assigned to the claim, issuer prerogatives decoded from the mint, effective multiplier state, unknown extensions, corporate-action state and depth observed at a stated size. Seametry calls the admission discipline Good Delivery.

The Assay itself does not decide whether an instrument belongs in a basket. That is policy.

server/internal/policy evaluates an explicit input object against a versioned policy document. It has no network dependency, database access or ambient clock. AsOf is part of the input rather than something the evaluator discovers for itself.

The result is ALLOW, WARN or BLOCK, accompanied by stable reason codes, the policy version and a SHA-256 digest of the canonical input.

The policy can distinguish an unclassified legal grade from a paused mint, a non-transferable constituent, an unresolved multiplier, absent depth, excessive measured shortfall or an unrecognized route refusal. Issuer powers such as freeze authority and permanent delegation are separately represented rather than collapsed into a generic risk flag.

The current snapshot applies policy-2026.10.1 to 46 captured instruments. 33 are admitted with a non-zero measured capacity; 15 of those clear the largest measured size, 10,000 USDC: AMD, MRNA, MSTR, MU, NFLX, SNDK, SPCX, AMZNx, SPCXx, GOOGLx, TSLAx, METAx, AAPLx, NVDAx and MSFTx.

The specific thresholds are not sacred. DepthCeilingBps, for instance, is documented in the implementation as an assumption rather than a discovered natural constant. What matters is that a later reader can recover which rule was applied to which observation. A decision issued under policy-2026.10.1 remains interpretable after a later policy exists.

That property is more useful than pretending an admission system has discovered a timeless definition of acceptable collateral.

The Hall's ownership arithmetic operates on quantities, not valuations.

Strike determines the constituent units required for the requested number of shares. Melt determines the constituent units represented by shares being destroyed. No oracle price participates in either operation.

Market prices remain essential outside that boundary. An AP deciding whether to create or redeem needs constituent observations, share price, executable depth, fees and assembly cost. A Terminal needs NAV to expose premium or discount. None of those values needs authority to rewrite how many constituent atoms a valid share represents.

The distinction isolates ownership arithmetic from market-data failure. If an oracle disappears, an AP may lose the information required to judge an arbitrage. A holder should not consequently lose the protocol's ability to establish what the share is owed.

Open AP therefore describes more than permissionless minting. The mechanism only becomes credible if the exit remains legible under conditions inherited from the constituents themselves. That is where the simple versions begin to fracture.

Seametry applies the same reproducibility requirement after a decision has been made.

Domain objects are canonicalized before hashing. Receipt bodies form leaves in an RFC 6962-style Merkle tree. Policy decisions retain their input digests and versions. Batches can be anchored separately.

The Go implementation seals receipts while an independent JavaScript verifier reproduces canonicalization, leaf composition and proof verification without sharing the server implementation. CI runs the two against each other.

The receipt is deliberately narrow evidence. It does not establish that an admission threshold was wise or that a trade was desirable. It establishes which inputs were recorded, which policy processed them and whether the resulting object still verifies. That is enough to make later explanations falsifiable.