How the position would work, and what has to be true first.

Preparation and open evidence: the mainnet dossier. In the latest source, operator handover is two-step (the operator proposes, the nominee accepts; authority moves on acceptance), pending independent review and the gates below.

The Curb is proposed as the place to form one company position through several stock-token issuers. The recommended MVP: one company, two issuers that pass verification, one network, a fixed composition in token units, in-kind deposits, per-component claims; mock tokens first. A real-asset pilot is considered only after instruments, holder rights, contract and costs are shown to hold.

First research candidate: Apple via xStocks (official non-rebasing wrapper; raw AAPLx not assumed static) and Ondo, on Ethereum; not yet ready to integrate. The MVP needs no CURB token. CURB's launchpad launch is decided for Robinhood Chain (the desk's own); the components are on Ethereum; the two never meet.

Similar symbols hide different issuers, contracts, providers, corporate-action rules and exits. The Curb lets a holder split one company position across plainly disclosed issuers, each right recorded and separately withdrawable. If one component is obstructed, the ledger shows what can move and what remains a claim. Company, issuer and contract risk remain.

Testable promises: a holder can know and prove their position's composition; the ledger never erases a right to a component that cannot yet be transferred; mint and exit need no decision by a model.

Claims this product does not make: capital is protected; it cannot be frozen; it is the same as holding the share directly; it is automatically safer; it can always be sold at the reference value; it earns more; the issuers or custodians are fully independent; it is the first of its kind.

A limited search found no exact precedent; that does not prove global novelty. No patentability, financial principle or scientific finding is claimed.

Study first: holders who meet access requirements and know their issuers, and integrators needing one explicit position. Fund size is not evidence of need; behaviour must be tested. Interviews are not held, by decision (20 September 2026); observed use stands in (see §15).

The baseline is holding token A and token B in one wallet, which already splits issuer exposure. The Curb must add something measurable: consistent lots, an integrable ledger, fewer steps, or integration as one position. Collateral acceptance, DEX listing and external wallets are out of scope. If users want the split without the receipt, test a purchase-and-bookkeeping service in their own wallet: a different product, not a win for the receipt thesis.

The product stays The Curb; positions are named by company and series (e.g. Apple Position — Series 1). The symbol cAAPL-S1 is illustrative, not an issued token or a checked name.

The last four, and a market sale, never share one label such as "withdraw to cash". The MVP ends at component delivery.

• —Finding. One position for simulation or pilot: company, two issuers, network, lot composition, access and product status. Until live: Try the simulation. The related-party map (issuer, broker, custodian, contract authority, wrapper, sources) marks gaps not known, never an invented safety score.
• —Access. Right network; access per the approved design for the pilot's regions and user categories, not assumed for every non-US user. Holders bring the right components; raw AAPLx versus a required wrapper is explained. Never an approval for the wrong asset or a route around a third party's restriction.
• —Forming. The review shows exact amounts, estimated value with price time, allowances, estimated gas and receipt count. It says the receipt cannot be sent or sold as one token. Deadline and input limits apply; deposits and receipt are atomic.
• —Holding. Receipts, entitled units, value weights, open claims; pending claims never count again as backing. A 50:50 start can drift to 45:55; no rebalancing.
• —Unwinding. Exit allocates all rights; A and B are claimed separately. A blocked A stays pending with a known reason or cause not confirmed; B proceeds alone. No date or recovery value is promised.

Built (§17): front, company detail and evidence screens; "My position"; wallet signing for a deployed series, the index updating next tick. Local chain only; with no series deployed, the public site omits it. The site never holds a key.

A design, not audited code. Components need unit balances proven not to change on their own; value per unit may change. Each series fixes two distinct component addresses, still to be verified as the intended issuers', and their base units per lot, for life. The receipt has decimals = 0: one unit is one lot, sized so a holder can take a small enough fraction of a share.

n       = lots of receipt outstanding
q[i]    = base units of component i per lot; positive integer, immutable
A[i]    = active liability of component i        = n × q[i]
R[i]    = base units of component i allocated for exit, not yet paid
C[u,i]  = unpaid claim of holder u on component i
B[i]    = real balance of component i held by the series
L[i]    = total liability of component i        = A[i] + R[i]

R[i] = Σ C[u,i] over all holders
B[i] ≥ L[i] while the component is solvent, in token units

Solvent means only enough token units for the Curb's bookkeeping, not issuer backing, dollar value or saleability. Tokens sent straight to the contract are a separate surplus that changes no q[i], receipt count or claim and never prices a mint. With no admin sweep, wrongly sent assets can be locked; recovery would need its own design and review.

7.1 Mint

Minting k lots takes exactly k × q[i] of each component. The contract checks eligibility and the mint limit, transfers both, and requires B_after[i] ≥ (n + k) × q[i] + R[i] before minting. Fee-on-transfer and non-conforming tokens are unsupported. Maximum inputs and a deadline bind the mint to the preview; no NAV oracle is needed. The cap, in units, counts pending claims: (n + k) × q[i] + R[i] ≤ capLots × q[i]. capLots × q[i] must not overflow from deployment.

7.2 Exit allocation

require the caller holds k lots
burn k lots of receipt
for every component i:
    C[user,i] += k × q[i]
    R[i]      += k × q[i]

Only the Curb's ledger changes; no external token, oracle or model is called. A[i] falls as R[i] rises, so total liability holds and a frozen component never blocks the exit record. There is no public burn or burnFrom bypass and no admin mint; supply moves only by complete deposit or exit allocation.

7.3 Claiming one component

claimComponent(i) pays the whole claim on one component, only to the claimant's own wallet. It checks the right, recipient access, component status, and that the balance covers the whole liability. The claim is marked paid before the transfer; a failed or wrong-amount transfer reverts. Claiming A never reads or calls B; paying x of A lowers only B[A] and R[A], by x. Only the claimant can change a recipient; alternate recipients, transferable and partial claims are deferred. Below total liability, a component's nominal payments stop; a haircut, substitution or recovery sharing would need a new specification.

7.4 A worked example

Units only, no Apple price or address. One lot is 10 A and 20 B; 100 lots are outstanding; Alice exits all 25 of hers.

Bob deposits 100 A and 200 B and gets none of Alice's 250 pending A. While A is halted, his whole mint fails. The simulation and tests/positions.test.ts reproduce the table row by row.

7.5 The limit of 50:50

Fixed units do not hold value weights at 50:50; fees, multipliers, dividends, prices and transaction obstacles move them. The Curb never buys a troubled token to restore the ratio. A new series may set new units after evaluation; holders choose whether to move, with no forced migration by token vote.

Three units stay apart: component units held (these set withdrawal rights), documented underlying-equivalent exposure, estimated money value. xStocks conversion and unwrap use the verified wrapper version's contract method, never a summary's multiplier formula or a lookalike wrapper. Ondo documents dividend reinvestment in token pricing, with display that can differ by network; the Curb keeps no cash dividend balance (Ondo corporate actions).

On a corporate action: archive source and time, match affected tokens, check conversion and indicative value, stop minting if assumptions are unconfirmed, publish status. No component is swapped quietly on a merger, ticker change or discontinuation.

Four separate statuses: transferable to a wallet; unwrappable; a market offer at the intended size; issuer redemption for an eligible holder. A wrapper transfer does not prove the underlying can be cashed; a withdrawn token keeps its issuer risk.

Live value:

indicative_receipt_value = Σ q[i] × indicative_price_per_base_unit[i]
indicative_holder_value  = holder_lots × indicative_receipt_value

Pending claims show separately. Prices carry unit, source, effective time and read time; a wrapper conversion is not a market price. A missing price shows total value incomplete with known subtotals, never a zero or a complete NAV. Prices decide no mint right or claim; exits can be booked while pricing is down, if contract rules allow.

The wallet uses the Curb interface (access status, evidence, preview), which passes transactions to the series contract. That contract holds A and B and the per-component claim ledger, so no escrow is needed; A and B claims are separate transactions. Contract events and issuer sources feed a chain index and deterministic checks, stored in Postgres and an evidence archive.

One series contract, receipt built in; a permissionless factory and public series list wait for a second series.

On-chain access:

• —Minting needs an unexpired mint permit.
• —Claiming uses the holder's recorded claim permit; no fresh backend signature per withdrawal.
• —Revocation is explicit, under a published policy; a revoked holder needs the pilot document's settlement process.
• —Exit allocation uses the receipt right; no new external check.
• —A Curb permit never overrides an issuer's contract restriction.
• —A backend outage blocks no claim while the permit holds, the chain works and the component transfers.
• —The MVP receipt refuses transfer, even between permitted wallets.

Stack: the existing Next.js, TypeScript, React and Postgres; Solidity and Foundry proposed. The backend never holds a holder's private key. A model may word explanations from checker-accepted facts; it decides no balance, binding price, recipient or claim amount.

The desk's role. Registrar: identity, authority changes. Archivist: corporate actions. Pillar and the Bell: price, session. Specialist: on-chain price versus feed. Tally and Warden: reconciliation. Counsel: document changes, for human review. Gazette: verified changes. A new chain needs new sources and tests; the MVP takes only the deterministic functions it needs. A source reading read does not mean safe, legal for every holder, or backed by reserves the Curb audited.

Proposed product API; token amounts are strings of integer base units, never floats:

GET  /api/positions
GET  /api/positions/{seriesId}
GET  /api/positions/{seriesId}/evidence
GET  /api/positions/{seriesId}/preview-mint?lots=...
GET  /api/positions/{seriesId}/preview-exit?lots=...
GET  /api/wallets/{address}/positions
GET  /api/wallets/{address}/claims
GET  /api/status

Previews send nothing and prove nothing about success. Access-specific or identity data needs authentication; a public address opens nothing private. Proposed events PositionMinted, ExitAllocated, ComponentClaimed, MintStatusChanged and ComponentClaimStatusChanged carry series, holder, component, amount and any operator reason. The index is idempotent on chain id, transaction hash and log index, stores block hashes against reorgs, and separates pending, included and confirmed. The contract, not the display index, defines liability.

The pilot uses an operator multisig with published roles; quorum and people are decided before the pilot. The Robinhood Chain treasury has them: three signers named by address, 13 September 2026, in the operator policy. An Ethereum series needs its own operator. A per-component claim stop (exploits, balance shortfall) is allowed; it adds operator dependence, may delay withdrawal, and is shown in the series document. A mint-only stop design needs a reviewed decision first.

Incident order: identify, stop what must stop, preserve evidence, show a specific status, reconcile, decide and test the fix, announce resume or hold. Never write the issuer is bankrupt from one reverted transaction. A bad price status does not stop component claims, which are in units. A core contract exploit can hit every series and needs a broader response. Separate claims remove no shared failure of chain, contract, operator keys or common providers.

Deferred, with no promise of addition: single-stablecoin deposit, automatic routing; cash redemption; dynamic rebalancing; leverage, lending, insurance, bridges; uncurated stock lists; permissionless series; unrestricted receipt transfer; a market for stuck claims; reward tokens; buybacks; governance able to change an old series' backing.

Without two eligible issuers on Robinhood Chain, two tokens from one issuer do not meet the thesis; choose a chain that passes the gates or stay in simulation, with no hidden bridge plan. Receipt terms may need their own structure and distribution arrangements; nontransferable or testnet status does not settle every real-asset obligation. This is feasibility work, not a claim of regulatory approval.

Fuzz and invariant tests vary holders, operation order, the failing component and lot count. The minimum lot must make every q[i] a positive integer. Mocks come first; forks check real code, not every future condition.

Status, 12 September 2026: the ledger model runs T01–T08, T11, T12, T19, T22, T23 and T24. The contracts/ prototype runs T01–T12, T17, T19, T20, T22–T25 and a recorded fuzz run.

• —T13: the site's valuation; a missing or stale price is a stated reason, never a zero.
• —T14: two Ethereum forks, component A (see §17).
• —T15: the daily drift check (code hash, symbol, decimals, asset(), EIP-1967 slots), raised as DARK.
• —T16: index idempotency and reorg-rollback tests, the local rehearsal, the drill's dead-RPC scenario; T18: its backend-down scenario.
• —T21: an Ethereum fork, component A; the wrapper unwraps for an arbitrary holder; its whole reserve was about ten tokens at the block read.

None of this is a review or a public deployment: only a local chain, forks and mocks.

Decided by the product owner, 20 September 2026: the interviews below are not held. They stay on record for the stop rule and comprehension test. Observed use stands in: desk readers and alert subscriptions paid once the desk is configured. It also shows whether holders keep two tokens once a receipt's cost and risk are in view. The stop rule is read against that use. The risk is carried openly: the position proceeds without asking a prospective user (the interview guide).

The plan (proposed experiment targets, not benchmarks or research done):

• —10–15 relevant prospective users, holders and a few integrators, asked about past issuer exposure, not about the idea; no token allocation for choosing the product.
• —Three costed options in rotated order: one share representation, two in their own wallet, one Curb receipt exactly as the MVP. A tradable or collateralisable receipt is a separate hypothesis.
• —Record reasons, task time, misunderstandings, willingness to pay and recurring needs.
• —Signals to continue, not proof of product-market fit: at least five show a real operational problem; at least three retest after seeing the added cost and risk; at least one integrator needs the receipt, if integrators are the primary customer.
• —Required comprehension test: the share can still fall; a component can get stuck; a brand split does not prove separate custody; the MVP receipt cannot be sent or sold as one token; the Curb promises no cash redemption. Systematic misunderstanding means revising copy and flow before a pilot.

Stop or change the receipt thesis if informed people hold the two tokens themselves. Do the same if added cost and contract risk bring no measurable benefit, or if access rules make the segment too narrow for the chosen business.

The prototype and an early technical pilot may charge no product fee; gas is paid as the flow requires. No fee logic before basic demand is shown; a paid release states its cost in the preview and series document.

Assets under management are never equated with transaction volume. Hypothetically, US$1 million of paid volume a month at 0.10% is US$1,000 gross revenue before costs: not a projection, final rate or promise of scale. Spread, gas and issuer fees are not all Curb revenue.

Three instruments stay apart: the issuer component (held) and the company receipt (a proportional right to a series' components). The third, CURB, is a candidate token whose need must be proven on its own.

Governance, if ever used, may take proposals on research priorities or new series. No vote changes a balance, takes claim reserves, replaces an old series' components or declares an issuer safe. No basis exists yet for supply, allocation, vesting, buybacks, fee sharing or CURB covering losses, launchpad or not. Positions never depend on a CURB price or a bridge.

CURB's one function is decided (the product owner, 12 September 2026): payment for data services that actually exist, with stated prices, a stated conversion, slippage limits, credit validity and a cancellation policy. It is built (what exists today; the token record, the services page):

• —Dollar prices for the history and fan-out the site keeps; a US$20 opening minimum.
• —The credit desk contract moves CURB to a published treasury, emitting the key hash and amount.
• —The rate is the pool's own price at a block: a pair's reserves, a v3 square-root price, or v4 state via the StateView. The last is the kind the decided venue produces after graduation. Market capitalisation is price times supply; CURB per dollar is never typed in.
• —A top-up gets the lower of its block's rate and the pool's lowest rate in the prior hour. The block rate comes from node state while served, else the pool's events at that block. For a pool that did not yet exist, it is the head, when indexed only. This limits short-spike credit; it is no defence against sustained manipulation or a thin pool.
• —Credits do not expire while a service is offered; closure takes thirty days' notice; nothing is refunded.

No token exists; nothing is configured (launch venue: §1). The services and gate were built first.

Startable now without a token or launch: the instrument candidate file; testing the narrative against the two-tokens-in-a-wallet baseline, begun by the simulation; proving the accounting with mocks, begun by the ledger model.

What is implemented, piece by piece, with where to check each one, is on its own page: what exists today. In short: nothing is deployed and no real asset is held; the contract is unaudited and unreviewed; the interviews are not held, by decision (20 September 2026).

Is one receipt one share? No; it is one lot of the series' components (§5).

Do I receive cash dividends? None is promised (§8).

Are the weights always 50:50? No; units are fixed, value weights move (§7).

Can the early receipt be sold or sent? Not in the proposed MVP; transfer and other integrations are not available.

What happens when one token halts? The other component can still be claimed; recovery of the halted one is not promised (§6).

Why not hold the two tokens myself? A valid alternative; the Curb must prove it is worth the added cost and contract risk (§4).

Do I have to buy CURB? Not for the proposed MVP; positions never need it (§16).

Status on 12 September 2026 and interim assumptions: the assumption register. A01: rights not reviewed (see G1, G3). A04: one dividend activation, no split. A06: willingness to pay not measured. A02, A03, A05, A07, A08: open, on the conservative assumption (hold, unreviewed, not eligible until an issuer says so, no configured token/credit desk). Treasury signers: see §11; the Ethereum series operator: see G5.

Production decisions left blank on purpose:

• —final component pair, wrapper version and hash, final chain;
• —q[i], minimum lot, total pilot lot cap;
• —participants and eligibility, operator quorum, auditor or reviewer;
• —deployment addresses, fees, launch date. With results, each gate gets a commit link, contract version, test block, results, review date and decision owner.

Public copy separates the position prototype and simulation from the treasury mainnet record, and calls nothing available before it is. The stage moved to mainnet on 13 September 2026 because the treasury is on chain; copy says in the same breath that the token, the desk and the series are not.