What this does not protect you from

A reverse split lowers the multiplier. The same raw units become fewer, larger shares — so honouring the shells suddenly takes more raw units than the vault holds. Dividends already settled to pearls are final; they were paid out of shares that genuinely existed at the time. The shortfall therefore falls on the shell, which redeems pro-rata instead of in full.

Said plainly: the shell carries the share count, the pearl carries the income, and a share consolidation is a share-count event. The alternative — locking pearl withdrawals until maturity — would make the protocol safe on this one point and useless on every other.

At maturity the vault freezes the multiplier the series settles at, and it uses effectiveAt to refuse a payment that took force after the series ended. To do that it falls back on the last multiplier it recorded.

If nobody touches a vault for a long stretch that straddles both a dividend and maturity, that fallback can be stale by one payment. sync is permissionless, costs almost nothing, and is called by every deposit, withdrawal, claim and transfer — but it is not called by nothing at all. A series with no activity for months before maturity is the case to watch.

Robinhood’s Stock contract has pause(), adminBurn(address,uint256), a blocklist, and a beacon its owner can upgrade. Nacre holds those tokens. It cannot hold them any harder than anybody else does.

Transfers are permissionless — a blocklist, not an allowlist — which is why a vault can hold them at all. Everything past that is the issuer’s to decide, and no contract on this chain changes that.

The implied rate the desk shows is arithmetic on a pool price: what one pearl costs, restated as a fraction of a share per year. It is not a valuation, there is no discounting in it, and it is exactly as good as the depth behind it. Early on that depth will be thin, and a thin pool is a price somebody can set on their own.

A pearl is worth the dividends left before maturity and nothing afterwards, so its price walks steadily down over the life of the series. A liquidity position is on the other side of that walk. The hook donates each dividend to the providers holding the pool’s pearls, which is a real offset — it is not a guarantee of one.

Positions here are full range on purpose: a concentrated one would be walked out of and left holding the side nobody wants.

• 0.30% — ordinary
• 1.00% — a dividend is announced and has not taken force
• 5.00% — a dividend has landed and has not been delivered
• 0.50% — the caller’s cut for delivering it, out of the dividend

The 5% is not a punishment. It is the interval in which the pool is demonstrably worth more than it is quoting, priced so that trading through it is a worse move than ending it.

When a pearl balance moves, the vault credits what it earned rounded down and re-bases what it owes rounded up. Two floors add up to less than the floor they came from, so with both sides rounding down every transfer would quietly raise the vault’s liabilities by up to a wei above what it set aside — and a pearl that changed hands often enough would leave its last holder unable to close their position.

The asymmetry costs a holder at most one wei per settlement. It makes the shortfall impossible rather than merely unlikely.

There is no owner, no pause, no fee switch and no proxy anywhere in Nacre. The hook is wired to the register by a single-shot setter that burns its own admin in the same transaction, and after the deploy script returns there is nothing settable left. Each series’ stock and maturity are welded in at creation. The hook is inside every pearl pool’s PoolKey and cannot be swapped out of it.

That cuts both ways, and it is worth saying which ways. Nobody can take your position, change what a pearl is entitled to, or turn the fee up. Nobody can fix a bug either.