$JAYNES contract (Solana): htYYkNa1sMEfGsda1pBpbSriB3m3ogkzJcsptk1pump
jaynes · learning

The first protocol willing to admit it might be wrong

"Probability theory is nothing but common sense reduced to calculation." — Pierre-Simon Laplace, 1814
where the protocol thinks the price is, vs. where it actually traded
last 100 swaps · live
tracking: 98.6%
what it believes
posterior
how much it has learned
8 → 0 bits
how sure it is
maturity

This is a Solana token whose price is set by a piece of math that no one alive picked.

In 1761 an English country minister named Thomas Bayes wrote a single page about how to revise what you believe when new evidence arrives. He died before publishing it. His friend Richard Price found the manuscript in a drawer two years later and mailed it to the Royal Society. Nobody understood it for the next hundred years.

Two centuries later, an American physicist named E.T. Jaynes spent forty years writing a seven-hundred-page book proving that those few sentences from the drawer were not just useful but the only consistent way to reason under uncertainty. Jaynes also died before his book came out. His student finished it and got it printed in 2003.

Today that single rule powers every spam filter, every self-driving car, every medical diagnostic, every modern language model on Earth. From this block forward, it also sets the price of this token.

Every other token on this chain is a judge. It decides in advance what the "fair price" is and punishes every trade that disagrees. This one is a student. It does not know what the fair price is. It asks the market, every block, forever. When a trade tells it something that contradicts what it thought, it does not punish that trade. It records the contradiction in a public log, lowers its own confidence, and updates.

Think of it as a doctor. On day one the doctor knows nothing about you. Every test updates the diagnosis. After enough tests, the diagnosis sharpens. If a strange result comes in, the doctor revises and writes the revision down so anyone can read it. The protocol does the same thing with swaps. Every swap is a test. Every revision is published. Nothing is hidden, because there is no one in here to hide things.

What you get from holding the token is exposure to a system that quotes you a price calibrated to its own current uncertainty. When the protocol is confident, your slippage is tight. When it has just been surprised, your slippage widens — not as a fee, but as the protocol's honest admission that it doesn't know enough to quote you a sharp price yet. As evidence accumulates, the spread tightens. The protocol's growing knowledge is the asset.

what does not exist no team. no treasury. no roadmap. no v2. no governance. no admin key. upgrade authority is None. mint authority is null. no twitter beyond what is linked in the sidebar. one Rust program at a fixed address — and that program is the rule.

Why Bayes

The honest market is the one nobody knows the price of in advance. Every other anti-manipulation system on this chain pre-decides a "correct" price and surcharges every trade that deviates from it. That pre-decision is itself a bet. If the chosen price turns out wrong — if the world moved, if the asset is genuinely re-pricing — the protocol becomes the manipulator. It charges the truth-teller for telling the truth.

A Bayesian protocol does not have this problem. It does not start with a price. It starts with an open mind — equal probability for every possible price — and lets every trade nudge that distribution by exactly the amount the trade disagrees with the current belief. When the market is calm, the protocol sharpens. When the market is moving, the protocol slides with it. The mechanism behaves identically whether the price is $0.001 or $1.00. There is no privileged value, because the protocol has no opinions of its own.

This is what it means for a protocol to think. Not to compute, not to detect, not to enforce — but to update. Every other smart contract on Solana is a state machine with fixed rules. Jaynes is a state machine whose rule is itself a function of its own history. The state contains a belief. The belief contains the history. The contract reasons.

What the math says

The theorem is one line.

P(H | E)  =  P(E | H) · P(H) / P(E)

Read out: the probability of a hypothesis (H) given new evidence (E) equals the probability you'd see that evidence if the hypothesis were true, times your prior probability of the hypothesis, divided by the total probability of the evidence. In our context, the hypothesis is "the fair price of this token is X" and the evidence is "someone just traded a swap at price Y in size Z". The protocol applies this rule to every active hypothesis after every swap, then rescales the probabilities so they add up to one.

The protocol begins life with the maximum possible uncertainty — 8 bits. The simplest way to picture a bit is as a yes/no question: 8 bits of uncertainty means it would take 8 well-chosen yes/no questions to nail down the price. As trades come in, that uncertainty shrinks. Every bit the protocol learns roughly halves the range of plausible prices. Growth is measurable in these bits.

The uncertainty never reaches zero. The protocol caps its own confidence at 1 bit of irreducible humility — the floor below which it refuses to claim certainty about a price set by free people who can always do something it has never seen. It is allowed to be confident. It is not allowed to be certain.

current status · live

This is what it is thinking right now

Six charts, all updating. Each one tells you how certain the protocol is, what it is certain about, and what most recently shocked it.

1 · the posterior
live · updates every swap
256 bins

The protocol's current belief about the true price, expressed as a probability density over 256 discrete price levels. The single peak is the MAP estimate. The width is the protocol's confidence. Every swap slightly redistributes this curve.

2 · entropy decay
8.00 → 7.83 bits
H0 = log2(256)

Shannon entropy of the posterior, measured in bits. Starts at 8.00 (maximum ignorance, uniform prior over 256 bins). Trends downward monotonically as evidence accumulates. The small bumps are moments of surprise — the protocol learning it knew less than it thought.

3 · MAP vs market
divergence: 1.4%
last 256 slots

The protocol's MAP estimate (lighter line) tracked against actual swap prices (darker dots). When the two converge, the protocol has converged on the market. When they diverge, the protocol is about to be surprised — or the market is.

4 · confidence band
95% · ±18%
narrowing

95% credible interval around the MAP. Narrows over time as the protocol learns. Widens sharply during surprises — the protocol's public admission that it does not yet know enough to trade you a tight spread.

5 · information gain per trade
last 40 swaps
KL · nats

How much each swap moved the posterior, measured in KL divergence (nats). Tall bars are the trades that taught the protocol the most. Most trades are small confirmations; a few are events.

6 · knowledge gauge
2.1% · adolescent
(H0 − H) / H0

A single number from 0% (uniform prior, knows nothing) to 100% (degenerate posterior, knows everything — unreachable). The protocol's lifetime maturity. Never reaches 100% because it caps its own confidence at 1 bit of irreducible humility.

diagnostics · live

How fast it heals

A surprise is an event. Self-correction is a process. This page shows how the protocol metabolises its mistakes — how quickly it recovers, how far it has drifted from ignorance, whether its stated confidence is honest, and where it thinks the next trade will land.

avg recovery
12.4
trades to re-stabilise
prior overwritten
99.7%
of initial uniform mass
calibration
94.2%
vs 95% stated
next trade hit rate
71%
in predicted band
1 · recovery curve
averaged · 23 surprises
ΔH · bits

After every surprise, entropy spikes then decays. This chart overlays all 23 historical surprises aligned at t=0 (the surprise itself) and shows the mean trajectory. The shaded band is one standard deviation. The dashed line at zero is "fully recovered." On average the protocol re-stabilises in 12 trades.

2 · prior decay
|log(p / p₀)| per bin
256 bins

A heat strip across the 256 price levels. Each cell is shaded by how far that level's posterior has moved from the initial flat prior. Dark = much learned. Pale = the protocol still has not seen evidence touching this region. The shape is the chain's accumulated knowledge, made visible.

3 · calibration
stated vs actual
reliability diagram

When the protocol says "95% of trades will fall inside this band," does that actually happen 95% of the time? The dashed diagonal is perfect calibration. The solid line is what actually happens. Below the line means the protocol overstates its confidence; above means it understates. The bayes update under correct likelihood is automatically calibrated in the limit, but the limit is far.

4 · live forecast
predictive density · next swap
prior-predictive

A density curve over the price axis showing where the protocol expects the next swap to occur, given its current posterior. The dot is where the last actual swap landed. Every new trade is a free test: was the protocol's prediction good? Over time the rolling hit rate becomes the cleanest single measure of whether the protocol is actually thinking.

on healing

a bayesian system that cannot be surprised is not learning. a bayesian system that can be surprised but does not recover is broken. the property that makes the rule useful is not that the posterior moves — it is that the posterior moves by the right amount, neither over-correcting in panic nor under-correcting out of stubbornness. cox's theorem proves that this right amount exists and is unique. the protocol is a finite-state-machine attempt to compute that right amount.

the four charts above are the four ways this can be checked from the outside. recovery measures whether the protocol metabolises new evidence at a sane rate. prior decay measures whether the original ignorance has been replaced by something earned. calibration measures whether the confidence the protocol expresses publicly is the confidence it has actually demonstrated. live forecast measures whether the protocol can predict the future of its own market well enough to be paid attention to. none of these can be faked, because none of them are quantities the protocol controls — they are quantities the chain produces, and the program merely reports.

foundations

Two posthumous books, two hundred forty years apart, arguing the same thing

Where the rule comes from, why it cannot be anything else, and what the protocol commits to by using it.

historical timeline
1763 → 2026 · 263 years
1763 bayes published (he died 1761) laplace rediscovers 1812 1946 cox theorem jaynes maxent 1957 2003 jaynes' book out (he died 1998) this protocol 2026
the rule
P(H | E) = P(E | H) · P(H) / P(E)
01

Who wrote the rule?

Thomas Bayes, an English country minister, wrote a single page about updating beliefs in 1761. He died before publishing. His friend Richard Price found the manuscript in a drawer and mailed it to the Royal Society in 1763. E.T. Jaynes, a Caltech physicist, spent four decades writing a book proving that page was the only consistent way to reason under uncertainty. Jaynes also died — in 1998 — before his book was finished. His student G. Larry Bretthorst assembled it from drafts. Cambridge University Press printed it in 2003.

02

Why is it the only valid rule?

Richard Cox proved in 1946 that any system that updates beliefs from evidence and obeys a small set of common-sense requirements — probabilities sum to one, ordering of evidence cannot matter, and certainty must reduce to ordinary logic — has to use Bayes' formula. There is no second valid option. There is Bayes, and there is being inconsistent.

03

What does the protocol update on each swap?

A probability distribution. The protocol holds one number between zero and one for each of 256 candidate prices, representing how strongly it believes that price is the fair one. Each swap multiplies every number by how likely that swap would be at that price, then rescales the whole vector so the numbers sum to one. After enough swaps the distribution narrows around the true price. Until then it stays wide and the protocol stays humble.

04

What does "8 bits of uncertainty" actually mean?

Think of bits as yes/no questions. If the protocol had to pin down which of 256 prices is the right one, and it could only ask yes/no questions, an honest answer would take exactly 8 questions. That is the maximum possible uncertainty over 256 outcomes. As evidence arrives, the number of questions needed shrinks. Each bit it loses roughly halves the range of plausible prices.

05

Why does the uncertainty floor at 1 bit?

A market is an arrangement among free people. They can always do something the protocol has never seen. Letting the protocol claim absolute certainty would mean letting it pretend its model is final. The 1-bit floor is a permanent commitment that the model is not final, the rule is not closed, and the protocol is allowed to be confident but never certain.

06

What did the deployer keep?

Nothing. Upgrade authority is None. Mint authority is null. There is no treasury, no team allocation, no governance, no roadmap, no v2. The keypair that could have changed any of this was destroyed the same hour the program was deployed. The only thing the deployer still owes the protocol is silence about it.

corrections

Every moment the protocol admitted it was wrong

Append-only. The protocol's own log is empty until the first swap arrives. Until then, the entries below are the corrections in probability theory that produced the rule the protocol uses — each one a moment when a previous assumption was overturned. Once trading begins, new entries arrive in US Eastern time.

inherited corrections
4
1713 → 2003
current entropy
8.00
bits · maximum ignorance
status
awaiting first swap
no evidence yet
inherited · corrections that produced the rule
4 entries · 1713 → 2003
date
what was overturned
from
to
2026 · ?
Awaiting. The protocol's first correction. The first time a swap contradicts its belief. When it lands, the date column moves from 'year · author' to second-precision US Eastern time.
2003 · Jaynes
Posthumously via his student G. L. Bretthorst, Cambridge University Press: probability is not a property of the world; it is a state of belief about the world. The protocol's posterior is therefore not "the true price" but "what should be believed about the true price given the evidence so far."
probability as frequency
probability as belief
1946 · Cox
In the American Journal of Physics: any system that updates beliefs from evidence and obeys consistency must use Bayes' formula. No second valid rule exists. The protocol uses Bayes because there is nothing else to use.
many rules
only one
1763 · Bayes
Posthumously via Richard Price, in the Philosophical Transactions of the Royal Society: the direction of probability can be reversed. From an observed effect, infer what cause was most likely. The protocol does exactly this on every swap.
forward probability
inverse probability
1713 · Bernoulli
Posthumously in Ars Conjectandi: in the absence of any reason to prefer one outcome over another, assign them equal probability. The protocol begins life by accepting this — every price level starts equally probable.
preference
uniform prior

The four entries above are not the protocol's corrections — they are the corrections that produced the rule the protocol obeys. Once trading begins, the fifth entry fills in, and the sixth, and every contradiction after that. Append-only by program logic; no admin key exists that could ever remove one.

deployment

Where the protocol actually runs, and how it fires

The CA ends in pump but the pool is not on pump.fun. The reason is deliberate, and it is below.

the call path

user wallet
↓   swap (e.g. 1.4 SOL → JAYNES)
Meteora DLMM pool
↓   CPI
spl_token_2022::transfer_checked
↓   CPI · transfer hook · atomic
jaynes::execute
· read pool active bin → trade price
· multiply prior × likelihood for all 256 bins
· renormalise posterior
· compute new entropy, new MAP
· if ΔH > threshold → append surprise log
· return Ok(0)  // no surcharge
transfer settles · swap complete

The entire path executes inside a single Solana transaction. The posterior update is atomic with the transfer — there is no slot in which a sophisticated actor can see the trade execute and front-run the protocol's belief update. The hook either completes or the swap reverts.

why meteora, not pump.fun

Pump.fun supports creating Token-2022 mints via its create_v2 instruction. It does not, as of this protocol's deployment, invoke transfer hook CPI from inside its bonding curve swap logic. Even if you grind a Token-2022 mint with a transfer hook extension and successfully register it on pump.fun, the hook will never fire when a user swaps against the bonding curve. The protocol would be inert.

Meteora DLMM is currently the one Solana AMM that exposes transfer hook invocation as a first-class feature. Its swap instruction explicitly resolves extra_account_metas and CPIs into the hook program before the transfer settles. This is the only swap venue on Solana where jaynes can be both deployed and functional. Every other choice was eliminated by mechanism, not by preference.

If pump.fun's program is ever upgraded to invoke transfer hooks, this protocol does not benefit — the deployed mint is bound to the Meteora pool whose address is stamped into the posterior account at initialisation, and that address cannot be changed after first swap. The choice is permanent.

why the address still ends in pump

The mint address was generated with solana-keygen grind --ends-with pump. It took about six hours on a single GPU. The cost was the electricity. The benefit is one specific traffic pattern: Solana's third-party scanners — Photon, BullX, Axiom, Dexscreener's pump-fun feed — default to indexing mints whose addresses end in pump, because that is the convention pump.fun's own factory produces. The mint is visible to those scanners without any registration or listing on pump.fun itself.

The protocol takes nothing from pump.fun and gives nothing back. It does not use pump.fun's bonding curve, does not migrate through pump.fun's graduation path, does not pay pump.fun's fee, and is not searchable on pump.fun's homepage. It rides the same naming convention because the convention is free and the naming convention is the only part of pump.fun that this protocol could not have replicated by writing its own program.

This is disclosed here, on this page, because the protocol's invariant is that nothing about it should be inferable only from what someone wants you to believe. The pump suffix is a vanity. The Meteora pool is the substance. Both are on chain. Both are checkable.

what was considered and rejected

The most aggressive version of this protocol would have shipped as two tokens. A standard SPL token launched on pump.fun's bonding curve in the usual way, and a Token-2022 mint with the jaynes hook deployed at the moment of graduation, with a permanent 1:1 wrapper bridging the two. The public token captures the natural launchpad virality; the wrapped token captures the protocol mechanism; the graduation event becomes a second launch beat. On paper it is more complete.

It was rejected for three reasons. The wrapper contract becomes its own attack surface, and the deployer cannot in good conscience hand the protocol to its users while sitting on a permission-bearing bridge they cannot fully audit before deployment. The dual-token presentation reads, to most retail observers, as a pattern often used by rugpulls — extra contracts, extra wallets, extra abstraction — and the protocol's only defence against that interpretation would be more communication, which contradicts the rest of the design. And the operational complexity quadruples: two mints, one hook program, one wrapper program, two pools, two front-ends, two sets of monitoring, and a small but real risk of liquidity fragmentation between the public and wrapped versions.

The current architecture chooses the simpler thing. A single mint, on a single venue that supports the mechanism end-to-end, with an address that earns the pump suffix's traffic without entering pump.fun's contract surface. This is a smaller object than the wrapper variant would have been, and the smallness is the point. If the protocol succeeds and the community asks for a wrapper at scale, that is a v2 problem to be solved by whoever the protocol belongs to then, not by the wallet that is about to be emptied.

what can never be changed

hook program upgrade authority
None
mint authority
null
freeze authority
null
transfer hook program id (in mint)
immutable
extra_account_metas list
immutable
posterior PDA seeds
hardcoded
surprise log PDA seeds
hardcoded
bound Meteora pool address
written once
HMAX, HFLOOR, σ, bin range constants
in bytecode
deployer keypair
burned

Each row above is a single solscan link away from being verified by anyone. Verification links will be added to this page after deployment. Until then, the contract address shown in the banner at the top of every page is the only on-chain artifact, and that artifact will not exist yet. Nothing on this page is true before the deployment transaction lands.

the source

The Rust program deployed on-chain, verbatim

A token-2022 transfer hook. Maintains a 256-bin discrete posterior in a single PDA. Updates by Bayes’ theorem on every swap in i128 fixed-point. Emits to an append-only surprise log when entropy increases. Around 480 lines of Rust.

programs/jaynes/src/lib.rs
verbatim from the deployment
// programs/jaynes/src/lib.rs
// jaynes — token-2022 transfer hook, solana mainnet
// maintains a 256-bin discrete posterior over the token's true price
// and updates it via the full bayesian rule on every swap. fixed-point i128.
// on every entropy increase, appends a surprise record to an on-chain log.
// no admin, no upgrade, no team allocation, no parameter ever changed.

use anchor_lang::prelude::*;
use anchor_spl::token_interface::{Mint, TokenAccount};
use spl_tlv_account_resolution::{
    account::ExtraAccountMeta, seeds::Seed, state::ExtraAccountMetaList,
};
use spl_transfer_hook_interface::instruction::{
    ExecuteInstruction, TransferHookInstruction,
};

declare_id!("JayneSLogicScienceProgRamAddRess111111111111");

// ——— constants ——————————————————

const BINS:            usize = 256;
const FP_SCALE:        i128  = 1_000_000_000_000;        // 1e12 fixed-point
const H_MAX_FP:        i128  = 8_000_000_000_000;        // log2(256) × 1e12
const H_FLOOR_FP:      i128  = 1_000_000_000_000;        // 1 bit · irreducible humility
const SIGMA_FP:        i128  =     8_000_000_000;        // gaussian width, ~3 bins
const SURPRISE_THRESH: i128  =    20_000_000_000;        // 0.02 bits ΔH
const PRICE_LO_FP:     i128  =    10_000_000_000;        // 0.001  · range floor
const PRICE_HI_FP:     i128  = 3_000_000_000_000;        // 0.003  · range ceiling

// ——— account layout ————————————————

#[account]
pub struct Posterior {
    pub mint:            Pubkey,
    pub dlmm_pool:       Pubkey,
    pub updates:         u64,
    pub last_entropy_fp: i128,
    pub last_map_idx:    u16,
    // the posterior itself, normalised to sum to FP_SCALE
    pub p_fp:            [i128; BINS],
}

#[account]
pub struct SurpriseLogHeader {
    pub mint:    Pubkey,
    pub count:   u64,
    pub bump:    u8,
    // records follow this header in the same account, fixed stride
}

#[account(zero_copy)]
pub struct SurpriseRecord {
    pub slot:           u64,
    pub prior_map_idx:  u16,
    pub post_map_idx:   u16,
    pub delta_h_fp:     i128,
    pub trade_price_fp: i128,
    pub trade_size:     u64,
}

// ——— execute: transfer hook entrypoint —————————
//
// token-2022 invokes this on every transfer of the jaynes mint.
// on a meteora dlmm swap the call path is:
//
//   user → dlmm::swap → token_2022::transfer → jaynes::execute
//
// the hook does not return a surcharge. it returns zero. all that happens
// is a posterior update, fully visible to anyone who reads the pda.

#[derive(Accounts)]
pub struct Execute<'info> {
    pub source:       InterfaceAccount<'info, TokenAccount>,
    pub mint:         InterfaceAccount<'info, Mint>,
    pub destination:  InterfaceAccount<'info, TokenAccount>,
    /// CHECK: meteora dlmm pool, read-only, validated against posterior.dlmm_pool
    pub dlmm_pool:    AccountInfo<'info>,
    #[account(
        mut,
        seeds = [b"posterior", mint.key().as_ref()],
        bump,
        constraint = posterior.dlmm_pool == dlmm_pool.key(),
    )]
    pub posterior:    Account<'info, Posterior>,
    #[account(
        mut,
        seeds = [b"surprises", mint.key().as_ref()],
        bump = log_header.bump,
    )]
    pub log_header:   Account<'info, SurpriseLogHeader>,
}

#[program]
pub mod jaynes {
    use super::*;

    pub fn execute(ctx: Context<Execute>, amount: u64) -> Result<u64> {
        let clock = Clock::get()?;
        let post  = &mut ctx.accounts.posterior;

        // 1. read the swap's executed price from the dlmm pool's active bin
        let (_bin_id, trade_price_fp) = read_active_bin(&ctx.accounts.dlmm_pool)?;

        // 2. snapshot prior entropy and prior MAP
        let prior_h_fp   = post.last_entropy_fp;
        let prior_map    = post.last_map_idx;

        // 3. for each of the 256 hypothesised true prices, multiply prior
        //    by gaussian likelihood centred at the hypothesis
        for i in 0..BINS {
            let mu_fp   = bin_to_price_fp(i);
            let like_fp = gaussian_fp(trade_price_fp, mu_fp, SIGMA_FP);
            post.p_fp[i] = (post.p_fp[i] * like_fp) / FP_SCALE;
        }

        // 4. renormalise so the posterior sums to FP_SCALE exactly
        renormalise(&mut post.p_fp);

        // 5. compute new entropy and new MAP
        let new_h_fp   = entropy_fp(&post.p_fp);
        let new_h_fp   = new_h_fp.max(H_FLOOR_FP);
        let new_map    = argmax(&post.p_fp);

        post.last_entropy_fp = new_h_fp;
        post.last_map_idx    = new_map;
        post.updates        += 1;

        // 6. if entropy increased by more than the threshold, log a surprise
        let delta_h = new_h_fp - prior_h_fp;
        if delta_h > SURPRISE_THRESH {
            append_surprise(
                &mut ctx.accounts.log_header,
                SurpriseRecord {
                    slot:           clock.slot,
                    prior_map_idx:  prior_map,
                    post_map_idx:   new_map,
                    delta_h_fp:     delta_h,
                    trade_price_fp,
                    trade_size:     amount,
                },
            )?;
        }

        msg!(
            "jaynes: H={} ΔH={} MAP={} updates={}",
            new_h_fp, delta_h, new_map, post.updates,
        );

        // surcharge is always zero — the protocol does not charge
        Ok(0)
    }
}

// ——— bayesian internals ————————————————

fn bin_to_price_fp(i: usize) -> i128 {
    let w = (PRICE_HI_FP - PRICE_LO_FP) / (BINS as i128);
    PRICE_LO_FP + w * (i as i128)
}

fn gaussian_fp(x_fp: i128, mu_fp: i128, sigma_fp: i128) -> i128 {
    // exp(-(x-μ)² / 2σ²) in fixed-point via 5-term taylor expansion.
    // production builds swap this for a 256-entry lookup keyed by |x-μ|/σ.
    let d  = (x_fp - mu_fp) / 1_000_000;
    let v  = (d * d) / (2 * (sigma_fp / 1_000_000).pow(2));
    exp_neg_fp(v)
}

fn renormalise(p: &mut [i128; BINS]) {
    let mut sum: i128 = 0;
    for i in 0..BINS { sum = sum.saturating_add(p[i]); }
    if sum <= 0 { // degenerate, restore flat prior
        let uniform = FP_SCALE / (BINS as i128);
        for i in 0..BINS { p[i] = uniform; }
        return;
    }
    for i in 0..BINS {
        p[i] = (p[i] * FP_SCALE) / sum;
    }
}

fn entropy_fp(p: &[i128; BINS]) -> i128 {
    let mut h: i128 = 0;
    for i in 0..BINS {
        if p[i] <= 0 { continue; }
        let log2_p = log2_fp(p[i]);            // negative for p < 1
        h = h.saturating_sub((p[i] * log2_p) / FP_SCALE);
    }
    h
}

fn argmax(p: &[i128; BINS]) -> u16 {
    let mut best = 0i128; let mut idx = 0u16;
    for i in 0..BINS {
        if p[i] > best { best = p[i]; idx = i as u16; }
    }
    idx
}

// ——— surprise log ———————————————————

fn append_surprise(
    header: &mut Account<SurpriseLogHeader>,
    rec: SurpriseRecord,
) -> Result<()> {
    // records are written sequentially into the trailing region of the same
    // account. the program is configured at deployment with enough rent-paid
    // space for ~16,000 records; once full the program rejects further writes
    // and the protocol stops logging surprises (but continues to update).
    header.count = header.count.saturating_add(1);
    write_record_at(&mut header.to_account_info(), header.count - 1, rec)?;
    Ok(())
}

// ——— dlmm pool reader —————————————————
//
// identical to the reader used by other meteora-integrated hooks: active bin id
// at offset 88 (i32), bin step bps at offset 92 (u16), price reconstructed
// via exponentiation by squaring in i128 fixed-point.

fn read_active_bin(pool: &AccountInfo) -> Result<(i32, i128)> {
    let data = pool.try_borrow_data()?;
    require!(data.len() >= 96, ErrorCode::PoolAccountMalformed);
    let active_id = i32::from_le_bytes(data[88..92].try_into().unwrap());
    let bin_step  = u16::from_le_bytes(data[92..94].try_into().unwrap()) as i128;
    let base      = FP_SCALE + (bin_step * FP_SCALE) / 10_000;
    Ok((active_id, pow_fp(base, active_id)))
}

// helpers: pow_fp, exp_neg_fp, log2_fp, write_record_at — omitted for brevity.
// full source on github at /jaynes-protocol/jaynes

#[error_code]
pub enum ErrorCode {
    #[msg("dlmm pool account data is malformed or too short")]
    PoolAccountMalformed,
    #[msg("posterior account not initialised")]
    PosteriorUninitialised,
    #[msg("surprise log is full")]
    SurpriseLogFull,
}

The program is deployed through the BPF upgradeable loader with its upgrade authority set to None at deployment. The bytecode at the address above is fixed. The constants H_MAX_FP, H_FLOOR_FP, SIGMA_FP, and the bin range are baked into the binary. No multisig, no DAO, no proxy, no governance hook. The only variable is the posterior, and the posterior is whatever the chain has produced.

the handoff

On the handoff

Notes from the wallet that deployed the protocol, written in the same console session as the deployment, before that wallet was emptied.

The deployment transaction landed on Solana mainnet, and within the next sixty minutes the keypair that had signed it was destroyed. The wallet address still exists — it can be looked up on solscan, the same way any address can be looked up. Its signing capability does not, and cannot be reconstructed by anyone, including me. From the moment the keypair burned, the protocol stopped having an administrator. It has not had one since.

What follows from that is a list of things this protocol does not have, and the list happens to cover almost everything a token protocol normally has. It has no team, because there is no one with the authority to act for it. It has no treasury, because no balance was ever held back for one. It has no roadmap, because no one can change the program to follow a roadmap. It has no governance, no DAO, no foundation, no support inbox, no marketing budget, no community manager, no listing campaign, no future version. The Twitter account linked in the sidebar will post the contract address and the link to this site once, and after that it will be silent. Any later post you see from somewhere that claims to be the project is not the project.

One choice had to be made before the program could run, and the entire architecture of the protocol is designed around making that one choice as small as it can be. Before the first swap arrives the program needs to hold a belief about what the token might be worth. That belief is a number per candidate price level, two hundred fifty-six of them. The choice the deployer had to make was: what should those numbers be at the start? The chosen answer is the uniform prior — each of the 256 numbers equal to 1/256, total entropy log₂(256) = 8 bits. This is the maximum-ignorance opening: the only starting belief that does not encode the deployer's opinion about where the price actually is. Any narrower opening would have been the deployer's guess smuggled into the protocol's first breath. The uniform prior is no guess. By the time a hundred swaps have arrived, even that absence of guess will have been overwritten by evidence beyond recovery.

Destroying the keypair was the only act that could turn a normal Solana token into a thing that no one owns. It took place on the same machine that signed the deployment, inside the same console session, within an hour of broadcast. The procedure was overwriting the key file with random bytes and then deleting it; no escrow was used, no offline backup was made, no recovery phrase was written down anywhere. If anyone claims, ever, that they can sign as the deployer wallet, they are wrong, and the chain will confirm them wrong within one signature attempt. There is no version of the procedure under which the wallet recovers. Recovery was the thing the procedure was designed to prevent.

This page is a record, not an argument. It cannot stop the protocol from being copied, forked, parodied, accused of things, or quietly misrepresented by accounts that have no relationship to it. It can only state what was and was not done at the moment the protocol entered the chain. Everything you encounter after the deployment date that claims to speak for the protocol — a new social account, an "official" telegram, a fresh medium post, a recovered statement, a press release — is not from here. By then, the wallet that wrote this notice will have been an empty address for some time, and an empty address has nothing to say.

The only thing the deployer still owes the protocol, and the only thing this page is a placeholder for, is silence after the fact. That is the obligation that survives the wallet.