Every private note, backed on the public ledger.

What this page proves — and what it doesn't. Every figure above is read from a standalone monitor canister via certified queries: the response carries a subnet signature that this page verifies in your browser against the Internet Computer root of trust, so neither the monitor nor this website can fabricate it. A stale or unverifiable response always renders as red/unknown, never as a stale green.

These signals prove token supply integrity (no tokens minted after genesis), the pool's on-ledger holdings, freshness, and — since the pool attestation landed — the full solvency delta is proven: the shielded pool continuously certifies that its escrow backing plus in-flight reimbursements covers every outstanding private note.

What the delta figure shows, and why it is usually zero. The pool publishes min(delta, 0), so a healthy pool always reads exactly 0 — deliberately, because a live healthy figure would leak how much is moving through the pool and when. A negative value is a real shortfall and is shown in full. Timestamps are coarse to 5 minutes for the same reason. If the attestation cannot be read, is malformed, or is stale, this page renders red or unknown — never a green it could not verify.

Stray funds in the treasury account are shown in yellow on their own row and do not affect backing. The Treasury stray funds row above reads 0 STSH when there are none, the amount in yellow when there are some, and UNKNOWN in yellow when the treasury balance could not be read at all. None of those three outcomes changes the badge: stray funds are foreign by definition — excluded from the pool's custody accounting and from the solvency delta — so a yellow row means "someone sent tokens to the treasury address", or "we could not check", never "the pool is short".

VIOLATED is not the same as UNAVAILABLE. Token supply invariant reads VIOLATED when the ledger computed the supply invariant and it did not hold, and UNAVAILABLE when the ledger could not compute it at all (an arithmetic error); both render red, because an invariant that was never computed has not been proven, but they are different claims and the page states which one it is.

Schema transition. This page currently accepts both monitor snapshot schema 2 and schema 3, and the transition is deployed page-first — this page goes live before the monitor is switched to emit schema 3, never the other way round. Schema 2 has no UNAVAILABLE signal and cannot report it, so while the monitor still emits schema 2 an uncomputable invariant reads as VIOLATED; once the monitor emits schema 3 the two are told apart.

Release