# Cap and maximum-loss decision record (template)

**Status:** unapproved template. All amount, asset, target, and role fields are intentionally blank. Do not infer a cap from prior pilot material or a related module.

## 1. Decision identity

| Field | Required value |
|---|---|
| Decision ID / version | `[BLOCKED — assign after change control]` |
| Scope (one module/route/action) | `[BLOCKED]` |
| Chain / asset / decimals | `[BLOCKED]` |
| Effective window / expiry | `[BLOCKED]` |
| Manifest and source/build references | `[BLOCKED]` |
| Proposal template ID | `[BLOCKED]` |

## 2. Limits — enter atomic units and display units

| Limit | Proposed | Current verified | Enforcement location | Evidence |
|---|---:|---:|---|---|
| Per position/user/action | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` |
| Module/route aggregate | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` |
| Factory/deployment count | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` |
| Reward/liability reserve | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` |
| Daily/periodic rate limit | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` | `[BLOCKED]` |

## 3. Maximum-loss analysis

State the conservative loss formula, assumptions, correlated-failure scenario, withdrawal/refund exposure, pending liabilities, oracle/evidence failure case, and residual loss. Reconcile the result to controlled assets and redeemable/reserved/pending liabilities. Do not use a yield, reserve, solvency, or insurance claim unless its supporting implementation and evidence are verified.

`maximumLoss = [BLOCKED — formula and units]`

## 4. Decision checks

- [ ] The cap is enforced in the verified implementation, not only off-chain.
- [ ] The proposed and current on-chain values were independently read at a stated finalized block.
- [ ] V2 withdrawals/routes are unaffected and V2 remains default.
- [ ] The maximum-loss analysis is independently reviewed.
- [ ] Monitoring, threshold alerts, pause/containment, and withdrawal/refund behavior are evidenced.
- [ ] No unrelated module/route/factory/write activation is bundled.
- [ ] Three approval records use all required phrases; the 24-hour timelock is verified against the selected deployed implementation.

## 5. Sign-off

Risk author: `[BLOCKED]` · Engineering verifier: `[BLOCKED]` · Independent reviewer: `[BLOCKED]` · Governance approvals: `[BLOCKED]` · Decision: `[BLOCKED]`
