feat: deployed to HyperEVM mainnet, and the config now describes what exists

  XStockRegistry          0xA54BC1b31d17a6B9F76d6De1BE43B8efb8843c2B
  LaunchpadFactory        0xcEa3AcF9b70cE9807a99bcBdF0F93A437518Eaeb
    FeeVault              0xDB4cF53967e29AB3dc38cbDc47C6ceDB4d862020
    HolderRewardVault     0xF7dce0CC413D6d7F855A742A02545253Bbb0cB92
  ReferencePriceAdapter   0x772AEDd551E38de727248e2925F53aAc80BE2b32
  WrappedXStockFactory    0xc7b674f6Ec9de46852A25897305292a3d1E18d63

13,014,016 gas, 0.0013 HYPE. Governance is a 2-of-3 Safe, treasury a separate
Safe, launch fee 0.04 HYPE.

Every address recorded here was read BACK from the chain rather than copied
from the deploy log. A log records what a script believed it did.

The governance quorum guard added earlier today did its job against the real
Safe: getThreshold() = 2, getOwners() = 3, passed. Its refusals for 1-of-1 and
2-of-2 were not theoretical when it counted.

Three config-sim checks had to be rewritten because they asserted the
pre-deployment world - "no wrapper factory is deployed yet" was true this
morning and false this afternoon. Rewritten rather than deleted: the factory
is bound immutably into the registry, so a config naming a different one
describes a registry that does not exist, and that is worth pinning.

The guardian is the blocker that replaced it, and it is heavier than it looks.
addAttestor and setQuorum are both onlyGovernance, so a compromised governance
key can make itself the sole Stockback attestor and drain the reward vault
after ACTIVATION_DELAY. The Guardian's cancel is the only brake, and
setGuardian is onlyGovernance too - so an absent guardian is not a missing
formality, it is an unopposed path to user money.
assertProductionConfigReady refuses without one now.

deployer is deliberately NOT recorded in PLATFORM_ACCOUNTS. It signed the
deployment and holds no authority afterwards; listing it would suggest it is
part of the running system.

Author: Sent-lab

docs/DECISION-LOG.md

@@ -716,3 +716,70 @@ protocol. Viable as a first market; not viable as the mechanism.
 **Still open, and it is not an engineering question:** whether to launch on Backed's `wSPYx`
 first — small, someone else's contract, proves the whole path with real money at low stakes —
 and open the rest once this wrapper is audited.
+
+---
+
+## D-018 — Deployed to HyperEVM mainnet
+
+**Class:** RECORD (§178.4 release gate, partial)
+**Date:** Day 9
+
+```text
+XStockRegistry          0xA54BC1b31d17a6B9F76d6De1BE43B8efb8843c2B
+LaunchpadFactory        0xcEa3AcF9b70cE9807a99bcBdF0F93A437518Eaeb
+  FeeVault              0xDB4cF53967e29AB3dc38cbDc47C6ceDB4d862020
+  HolderRewardVault     0xF7dce0CC413D6d7F855A742A02545253Bbb0cB92
+ReferencePriceAdapter   0x772AEDd551E38de727248e2925F53aAc80BE2b32
+WrappedXStockFactory    0xc7b674f6Ec9de46852A25897305292a3d1E18d63
+
+governance   0x791fb66Ac5ff91eE7D3F1697f85c4D8b646D1e22   Safe 1.4.1, 2-of-3
+treasury     0xEd7709178EF1De028E965B4107f56b5AecBE92A2   Safe 1.4.1
+launch fee   40000000000000000                            0.04 HYPE (~$3.38)
+
+13,014,016 gas, 0.0013 HYPE
+```
+
+**Every address above was read BACK from the chain, not copied from the deploy
+log.** A log records what a script believed it did; the two have no reason to
+agree if anything went wrong in between. `registry.WRAPPER_FACTORY()`,
+`factory.REGISTRY()`, both `governance()` calls, `treasury()` and `launchFee()`
+were all queried afterwards and matched.
+
+**Three things the deployment guards proved, on the real chain rather than in a
+mock.** `_assertGovernanceQuorum` read `getThreshold()` = 2 and `getOwners()` = 3
+off the live Safe and let it through — the guard added the same day, against the
+arrangement it was written for. The refusals for a 1-of-1 and a 2-of-2 were
+therefore not theoretical when they mattered.
+
+**What the deployment does NOT include, and why each is deliberate.**
+
+`factory.router()` and `factory.referencePrice()` are both zero, and the
+allowlist is empty. A launch is refused outright. That is §279 working: the
+router's three HyperSwap addresses are immutable in its constructor and V-06 has
+no first-party confirmation, and the anchor feed is V-11 — Pyth's equity feeds on
+this chain are 63–561 days stale.
+
+**What the block lanes cost, in order.** The deployment met V-20 three separate
+times, and only the first was expected:
+
+1. `LaunchpadFactory` needs 7,360,896 gas, so the deployer needed the large-lane
+   opt-in — a HyperCore action, which itself required the deployer to first
+   become a Core user by receiving a Core asset. Neither is an EVM call.
+2. Foundry reads the block gas limit from the tip block, which is a small-lane
+   block ~99% of the time, so the simulation died at exactly 3,000,000 before
+   broadcasting anything. Hence `[profile.deploy]`.
+3. `launch()` itself was 3,068,481 — over the ceiling for **every creator**, not
+   just for us. Fixed the same day by dropping `optimizer_runs` to 400, at a cost
+   of 51 gas per trade.
+
+The third was found only because the owner asked what a launch costs before
+setting the fee. It was 2% over: the margin that gets estimated rather than
+measured, and estimated it would have shipped.
+
+**Still open, and the guardian is now the sharpest of them.** `addAttestor` and
+`setQuorum` are both `onlyGovernance`, so a compromised governance key can make
+itself the sole Stockback attestor and claim the reward vault after
+`ACTIVATION_DELAY`. The Guardian's cancel is the only brake — and `setGuardian`
+is `onlyGovernance` too, so it is not a brake at all until a Guardian Safe exists
+with signers governance does not control. `assertProductionConfigReady` now
+refuses without one.

packages/config/sim/env.ts

@@ -24,6 +24,7 @@ import {
   REFERENCE_PRICE_FEEDS,
   GRADUATION_ROUTER,
   WRAPPER_FACTORY,
+  PLATFORM_ACCOUNTS,
 } from "../src/chain.ts";
 
 let failures = 0;
@@ -334,27 +335,47 @@ section("Production readiness is still gated (§279)");
    * governance COULD list. The refusal has to say that rather than leaving an
    * operator to conclude the allowlist is merely unfinished.
    */
-  check("no wrapper factory is deployed yet (D-017)", WRAPPER_FACTORY === null);
-
-  let namesWrapper = false;
-  try {
-    assertProductionConfigReady();
-  } catch (error) {
-    namesWrapper = error instanceof Error && error.message.includes("wrapper factory");
-  }
+  /*
+   * The wrapper factory IS deployed now, and this check used to assert the
+   * opposite — correctly, until Day 9.
+   *
+   * Rewritten rather than deleted, because "the factory exists" is worth
+   * pinning: it is bound immutably into the registry, so a config that names a
+   * different one is a config describing a registry that does not exist.
+   */
+  check("the wrapper factory is deployed (D-017)", WRAPPER_FACTORY !== null);
+  check(
+    "and it is the one the registry is bound to",
+    WRAPPER_FACTORY === "0xc7b674f6Ec9de46852A25897305292a3d1E18d63",
+  );
 
-  check("and the refusal names the wrapper factory", namesWrapper);
+  /*
+   * The guardian is the one that replaced it as a blocker, and it is a heavier
+   * one than it looks. `addAttestor` and `setQuorum` are both onlyGovernance,
+   * so a compromised governance key can make itself the sole Stockback attestor
+   * and drain the reward vault after ACTIVATION_DELAY. The guardian's cancel is
+   * the only brake, and governance can also set the guardian — so an absent
+   * guardian is not a missing formality, it is an unopposed path to user money.
+   */
+  check("no guardian Safe yet (C-08, §588)", PLATFORM_ACCOUNTS.guardianSafe === null);
 
-  let saysWhy = false;
+  let namesGuardian = false;
   try {
     assertProductionConfigReady();
   } catch (error) {
-    saysWhy = error instanceof Error && error.message.includes("every xStock rebases");
+    namesGuardian = error instanceof Error && error.message.includes("guardian Safe");
   }
 
-  // The reason, not only the fact. "Allowlist empty" invites someone to go fill
-  // it; "every xStock rebases, so nothing can be listed" says why they cannot.
-  check("and says why nothing can be listed without it", saysWhy);
+  check("and the refusal names it", namesGuardian);
+
+  // Governance and treasury are live and verified on-chain. Asserted because
+  // the whole point of the deployment guard was that these are not placeholders.
+  check("governance is recorded", PLATFORM_ACCOUNTS.governanceSafe !== null);
+  check("treasury is recorded", PLATFORM_ACCOUNTS.treasurySafe !== null);
+  check(
+    "and the deployer is deliberately NOT recorded",
+    PLATFORM_ACCOUNTS.deployer === null,
+  );
 }
 
 console.log(failures === 0 ? "\nconfig: all checks passed" : `\nconfig: ${failures} FAILED`);

packages/config/src/chain.ts

@@ -109,7 +109,36 @@ export const LIQUIDITY_LOCK: `0x${string}` | null = null;
  * mismatch between the two is a deployment error, and `assertProductionConfigReady`
  * cannot detect it — only reading `XStockRegistry.WRAPPER_FACTORY()` can.
  */
-export const WRAPPER_FACTORY: `0x${string}` | null = null;
+export const WRAPPER_FACTORY: `0x${string}` | null =
+  "0xc7b674f6Ec9de46852A25897305292a3d1E18d63";
+
+/**
+ * The deployed core, on HyperEVM mainnet.
+ *
+ * Deployed Day 9. Every address below was read BACK from the chain rather than
+ * copied from the deployment log — a log records what a script believed it did,
+ * and the two have no reason to agree if anything went wrong in between.
+ *
+ * Verified at deployment:
+ *
+ *   registry.governance()        the governance Safe
+ *   registry.WRAPPER_FACTORY()   WRAPPER_FACTORY above, bound immutably
+ *   factory.REGISTRY()           REGISTRY below
+ *   factory.governance()         the governance Safe
+ *   factory.treasury()           the treasury Safe
+ *   factory.launchFee()          40000000000000000  (0.04 HYPE)
+ *
+ * `router` and `referencePrice` on the factory are still zero, and the
+ * allowlist is still empty. That is the state the deployment log describes as
+ * NOT DONE, and a launch is refused until it changes — see
+ * `assertProductionConfigReady`.
+ */
+export const XSTOCK_REGISTRY: `0x${string}` = "0xA54BC1b31d17a6B9F76d6De1BE43B8efb8843c2B";
+export const LAUNCHPAD_FACTORY: `0x${string}` = "0xcEa3AcF9b70cE9807a99bcBdF0F93A437518Eaeb";
+export const FEE_VAULT: `0x${string}` = "0xDB4cF53967e29AB3dc38cbDc47C6ceDB4d862020";
+export const HOLDER_REWARD_VAULT: `0x${string}` = "0xF7dce0CC413D6d7F855A742A02545253Bbb0cB92";
+export const REFERENCE_PRICE_ADAPTER: `0x${string}` =
+  "0x772AEDd551E38de727248e2925F53aAc80BE2b32";
 
 /**
  * Fee tiers enabled on the HyperSwap V3 factory.
@@ -151,10 +180,31 @@ export interface XStockEntry {
   readonly verified: boolean;
 }
 
-/** Platform accounts (§555). All open pending the key ceremony (C-08, V-13). */
+/**
+ * Platform accounts (§555).
+ *
+ * Governance and Treasury exist and are verified on-chain. The rest of the
+ * six-account structure does not, and each absence blocks something specific
+ * rather than being a formality:
+ *
+ *   guardianSafe    the ONLY brake on governance reaching the reward vault.
+ *                   `addAttestor` and `setQuorum` are both `onlyGovernance`, so
+ *                   without an independent guardian the 6-hour ACTIVATION_DELAY
+ *                   has nobody to act inside it. §601 forbids it sharing
+ *                   governance's signers, and that is the point of it.
+ *
+ *   opsRelayer      the graduation keeper. Needs the large block lane, like the
+ *                   deployer did.
+ *
+ *   founderProfit   founder revenue. Blocks nothing technical.
+ *
+ * `deployer` is deliberately still null. It signed the deployment and holds no
+ * authority afterwards — recording it here would suggest it is part of the
+ * running system, and it is not.
+ */
 export const PLATFORM_ACCOUNTS = {
-  governanceSafe: null,
-  treasurySafe: null,
+  governanceSafe: "0x791fb66Ac5ff91eE7D3F1697f85c4D8b646D1e22",
+  treasurySafe: "0xEd7709178EF1De028E965B4107f56b5AecBE92A2",
   founderProfitSafe: null,
   guardianSafe: null,
   deployer: null,
@@ -232,6 +282,21 @@ export function assertProductionConfigReady(): void {
       "no wrapper factory deployed (D-017) — every xStock rebases, so nothing can be listed",
     );
   }
+
+  /*
+   * The guardian, checked separately from the other platform accounts.
+   *
+   * It is the only thing standing between a compromised governance Safe and the
+   * reward vault: `addAttestor` and `setQuorum` are both `onlyGovernance`, so
+   * the holder of that key can make itself the sole attestor and claim the vault
+   * after ACTIVATION_DELAY. The guardian's cancel is the brake, and it is not a
+   * brake at all if governance can also set the guardian to itself.
+   */
+  if (PLATFORM_ACCOUNTS.guardianSafe === null) {
+    problems.push(
+      "no guardian Safe (C-08, §588) — nothing can cancel a bad Stockback commitment",
+    );
+  }
   if (PLATFORM_ACCOUNTS.governanceSafe === null) problems.push("platform accounts unset (C-08)");
 
   /*