scheduled before mainnet. the report links from this page once cleared.

automated tests and static analysis run on every change before it ships.

funds move by pull payments, royalties are capped, and there is no always-on automation key — sensitive actions are owner-signed transactions.

single-key custody, no multisig — with pause, emergency safeguards, and owner rotation on every contract.

burns are a separate, explicit owner-signed tx — a buggy or compromised sweep can't destroy anything on its own. once confirmed, permanent.