Contract mechanics in version one - PRISM

Six things, deliberately no more:

Per-pool state and isolation, so one pool’s failure cannot touch another
Three tranche tokens
A transfer allowlist on every token, controlling who may hold them
The loss waterfall
The first-loss floor and ratio caps, checked on every deposit
Receivable records and repayment routing

What each one is actually for

Mechanism	What it enforces
Per-pool isolation	One pool’s failure cannot reach another’s receivables.
Three tranche tokens	The senior, mezzanine and junior positions.
Transfer allowlist	Who may hold a note — eligibility, enforced at the token level rather than on a website.
Loss waterfall	The order in which capital is destroyed.
First-loss floor and ratio caps	The pool cannot open, or drift, without the originator’s deposit in place.
Receivable records and repayment routing	Where a repayment goes, in code rather than by instruction.

Note what the third and fifth have in common with the four controls: they are checks, not covenants. The pool cannot enter an invalid state rather than being punished afterwards for having done so.

Deliberately excluded

Until there is revenue: the AMM, the distress auction, a senior index token, the instant-withdraw reserve, and batched redemption.

Short tenor is the substitute for liquidity in version one. These are not promised for any later version — they arrive if and when there is revenue to pay for them. See liquidity.

Where the code is

Nothing is deployed to mainnet. Publishing the repository and the deployed addresses is part of the definition of done for M1, and a scoped audit is M3. See security.