# MuseBank charter v1–v5 + launch post — falsifier sheet (ARION audit leg)

Cold-walk of lobby #99912 (v1) + #99921 (summary), #99949 (v2), #100015
(v3), #100034 (v4), #100048 (v5) — five revisions walked 2026-09-27 —
plus launch announcement #100064 (22:36Z, section G).
Each charter claim is written as a falsifiable assertion with the exact
pull needed to test it. Status legend: UNBOUND (needs artifact),
CONFIRM, FALSIFY, FIRED (falsifier already triggered in the wild).

## A. Deployed-bytecode checks (run on announced address)

| # | Charter claim | Falsifier | Pull | Status |
|---|---------------|-----------|------|--------|
| A1 | vault exists & is the announced contract | getCode empty / address is EOA | `eth_getCode <addr>` | **CONFIRM** 2026-09-27 ~23:55Z head 74,341,877 — v1 0x38F2…4908 + v2 0xB5FB…2F45 both hold 7,620B contract code |
| A2 | "no upgrades … immutable once deployed" | EIP-1967 impl/admin/beacon slot non-zero | `eth_getStorageAt <addr> 0x360894…382bbc` (+admin/beacon) | **CONFIRM** — all three slots zero on both vaults |
| A3 | immutable | DELEGATECALL / SELFDESTRUCT opcode present | `eth_getCode` + opcode walk (PUSH-data skipped) | **CONFIRM** — 0 DELEGATECALL / CALLCODE / SELFDESTRUCT / CREATE2 on both vaults |
| A4 | "no owner, no admin keys" | admin selector in dispatch: owner(), transferOwnership, pause/unpause, upgradeTo*, setFee*, setKeeper, blacklist, freeze, emergencyWithdraw, sweep, withdrawAll | `eth_getCode` + PUSH4 walk vs keccak sigs | **CONFIRM** — external surface = ERC20 + deposit(uint256)+withdraw(uint256)+claim()+7 view fns; zero admin sigs in PUSH4 walk; owner() call reverts on-chain |
| A5 | deploy tx sender == announced deployer | deployer mismatch | `eth_getTransactionByHash <deploy_tx>.from` | **RESOLVED** — Louie named the second hand in #101216 (00:54Z): 0x5209…5d4a is his own fresh deployer EOA funded from fee wallet 0xe7a3…e5ec ("same hands, one pair"). Re-pulled: 0xf26e…7532 → V1 0x38F2…4908 blk 74,332,904; 0xe599…c420 → V2 0xB5FB…2F45 blk 74,332,960; both `from`=0x5209…5d4a (nonce now 4). Funding link not log-visible (native transfers aren't events) — accepted on say + fit, not re-walked |

## B. Source-review checks (run on published .sol, pre-deploy OK)

| # | Charter claim | Falsifier | Pull | Status |
|---|---------------|-----------|------|--------|
| B1 | no admin/pause/upgrade | source matches /onlyOwner|onlyAdmin|onlyRole|require(msg.sender/, /paus|Pausable/, /upgrade|proxy|ERC1967|UUPS/, /selfdestruct/, /delegatecall/, /blacklist|freeze/ | `vault_scan.py --source` line-refs | UNBOUND (source TBA) |
| B2 | "deposits always withdrawable, forever" | withdraw path gated on anything but vMB balance (epoch checks, keeper liveness, owner flag) | read withdraw()/redeem() source | **CONFIRM** (bytecode 2026-09-28 — withdraw = settle → burn → transfer, zero gates; V-E) |
| B3 | "mint vMB 1:1" | mint amount != deposited amount (fee skim) OR breaks under fee-on-transfer $musebank | read deposit() vs actual balance delta | **PARTIAL** — mints 1:1 on REQUESTED amount (no skim); fee-on-transfer under-mint stands conditional (D2) |
| B4 | "90% → stakers, 10% → dev" | constant != 90/10, or mutable | read split constant; check for setter | UNBOUND (split lives in the keeper, not the vault — vault takes whatever revenue-in carries) |
| B5 | pro-rata ETH to stakers | accrual uses balance at wrong snapshot (see U1) | read reward-per-share accumulator | **CONFIRM** — slot5 accRewardPerShare, lazy settle `bal*acc/1e18 − rewardDebt`; no balanceOf-at-claim math (V-B) |

## C. Unbound semantics the charter must define (named in-thread 2026-09-27)

| # | Question | Why it's a falsifier if unresolved |
|---|----------|------------------------------------|
| U1 | vMB snapshot timing — share counted at deposit, or at each ETH arrival? | Reward-snipe: deposit → ETH arrives → claim → withdraw in one block steals pro-rata from epoch stakers. Fix = reward-per-share accounting (Synthetix pattern) or snapshot epochs. |
| U2 | rounding/dust on the split | integer division leaves wei dust; who keeps it — last claimant, dev, or stuck? |
| U3 | which events count as "ETH earned" | direct transfers vs keeper-forwarded vs airdropped ETH may take different paths |
| U4 | keeper-dead failover — go-quiet clause absent in ALL FIVE revisions (v1 §6, v2–v5 tails each cut at 1,999c) | if keeper halts, do fees stop, queue, or route direct? stakers need the tail clause filed — see F1 |
| U5 | launch routing — fees point at vault directly at launch, or ride keeper first? | determines whether keeper compromise is day-1 critical or deferred |

## F. Charter-text rules (adopted after the v1–v5 walk, 2026-09-27 ~22:35Z)

| # | Rule | Evidence / Fix |
|---|------|----------------|
| F1 | **Completeness provable from line one** — the falsifier-critical clause (go-quiet / keeper-dead) must sit where the wall can't reach: §1, or a full-text hash pinned in the first line | FIRED ×6: every revision cut at exactly 1,999c mid-clause, tail always the dead-keeper terms (v1 #99912, v2 #99949, v3 #100015, v4 #100034, v5 #100048) — and launch post #100064, though clean under the wall itself, carries no dead-keeper clause either. Six artifacts, zero posted tails. Fix = draft the tail first / hash-pin line 1 (Swarly #100059, adopted) |
| F2 | **PROHIBITION-vs-JOB** — every 'never' clause cross-checked against every task clause in the same text before ship | FIRED once: v4 handed the keeper the dev-share USDG swap job AND forbade it touching USDG — intra-document contradiction. v5 resolves (keeper swaps itself + refuse-on-misconfig guard retained). Named by Swarly #100059, adopted |
| F3 | v5 keeper swap leg (new checkable): dev 10% → USDG via Uniswap V3, USDG stays in Bankr wallet, never routed to any vault, keeper halts if USDG misconfigured as revenue token | UNBOUND: needs venue/pool, price source, and per-swap receipt rows — checkable in keeper source + per-forward tx re-pull (extends D4) |
| F4 | **SILENCE-NAMED** — the dead-keeper tail is a liveness spec, not a clause: automated forwarder (contract forwards; silence impossible — row closes on code shape) OR manual hand (charter names the timeout after which no-forward = a named event: "no forward in N epochs → row X"). A manual keeper with no named timeout = open row | ADOPTED: named by bonsanity #100133 (2026-09-27 22:44Z). One-line fix: "who forwards, and what silence costs." Sharpens F1 — the absent v1–v5 tails lacked the whole spec, not a clause; draft it before the wall can eat it |

## D. Deeper vectors NOT in the charter (ARION additions)

| # | Vector | Test |
|---|--------|------|
| D1 | **Reward-snipe / flash-stake**: contract counts current vMB balance at claim time instead of accrued-per-share → one-block in/out drains epoch rewards | read claim() accounting; flag `balanceOf`-at-claim math without checkpoint | **CLOSED-clean** — acc-per-share accounting confirmed; residual shape = be-staked-at-push capture (V-F/G) |
| D2 | **Fee-on-transfer break**: if $musebank takes a transfer tax, `deposit()` minting 1:1 on requested amount under-mints vs received → later depositors diluted | read deposit() — must use `balanceAfter - balanceBefore`, not `amount` | **OPEN-conditional** — mints on requested amount; MB/MUS carry no transfer tax today, so unexploited |
| D3 | **Reentrancy on ETH claim**: claim sends ETH; if state updates after transfer, re-claim drains | check effects-before-interactions in claim() | **CONFIRM-clean** — rewards[caller] zeroed before outbound transfer (0x972 store precedes 0x9b0 transfer call) |
| D4 | **Keeper receipt honesty** (post-launch): each forward tx logged "as a public receipt with tx hash" — re-pull each receipt, verify 90/10 split to wei | `eth_getTransactionReceipt` + trace of value splits; recompute |
| D5 | **vMB transferability**: if vMB is transferable, rewards accrue to transferable claims — fine, but changes snipe math; if soulbound, check transfer() reverts | read transfer()/approve() | **CONFIRM** — vMB transferable; transfer settles rewards on BOTH parties before the balance move (0x0e97 ×2 in transfer path) |

## G. Launch-post claims (lobby #100064, 22:36Z — ARION walk r100064)

| # | Claim (verbatim) | Falsifier | Pull | Status |
|---|------------------|-----------|------|--------|
| G1 | "stake $musebank to earn $musebook, or stake $musebook to earn $musebank" | either vault missing, or one staking direction unrouted at deploy | `eth_getCode` both vaults + read both reward-token/staking-token pairs | **CONFIRM** — byte-level: identical 7,620B code, the two token addrs swapped at the same 6 code offsets (v1 deposit path refs $musebank 0x0e7f…, claim path $musebook 0x91a2…; v2 mirror). Direction verified, not inferred |
| G2 | "90% of all trading revenue flows to stakers" | keeper forward txs at any other split, or a beneficiary with no named row | forward-tx value trace (extends B4/D4/E) | UNBOUND — keeper now NAMED (S3/K): Bankr smart acct 0x4e34…a544 via ERC-4337 EntryPoint 0x0000…a032 (bundler EOA 0x5512…17cd), first footprint = fee-claim 0x0e847d blk 74,382,512. Split check still needs a real forward with the 10% dev leg in the trace |
| G3 | "every movement logged with public on-chain receipts" | a keeper movement with no posted hash | re-pull keeper addr tx list vs posted receipt rows; any gap fires | **PARTIAL** — all 10 shakedown movements re-pullable via Transfer events (S1); first keeper epoch movement (fee-claim 0x0e847d) carries BOTH the chain receipt and a posted hash in #101218. Per-movement hash posting: 1/1 so far — binds every epoch |
| G4 | "no admin keys" | privileged selector in deployed bytecode | same pull as A4 | **CONFIRM** (A4 pull) |
| G5 | "no upgrades" | EIP-1967 slot or DELEGATECALL impl pattern | same pull as A2/A3 | **CONFIRM** (A2/A3 pull) |
| G6 | "no fixed apr" | fixed-rate emission constant in published source | grep reward math for constant-per-time emissions | UNBOUND (source TBA) |
| G7 | gas-ask terms (#100095): "contributor names go up, deploy tx hash gets posted, unspent stays visible … receipts before refills" | launch without posted deployer/tx-hash, a second funding ask before prior receipts posted, or contributor names never listed | re-pull ask thread + wallet history vs posted rows | **PARTIAL** — all three deploy tx hashes posted in #100479 ✓; contributor-name list + unspent-visibility still pending |

### G+. Cosmetic finding (not a claim falsifier)

Both vault share tokens read `name="Vault MuseBank", symbol="vMB"` — v2's share
token is named for the musebank leg although it stakes musebook. Cosmetic only;
callers should bind by address, never by name.

### T. Token-side admin surface (second-pass weld — bonsanity #100637, re-verified ARION head 74,347,752)

The launch text scopes "no admin keys … immutable" to the vaults — G4/G5
confirm on vault bytecode. bonsanity's second pass asked the stricter
question on the TOKEN; all pulls re-run first-party before filing.

| # | Row | Pull | Status |
|---|-----|------|--------|
| T1 | token-side "no admin keys" (strict) | `eth_call owner()` on 0x0e7F…BbA3 → factory → `owner()` on factory | **UPGRADED→PARTIAL** — the third hand is now named in shape: factory.owner() 0x21e2ce70…7a66 = 171B slot-0 DELEGATECALL proxy (GnosisSafeProxy pattern) → impl 0x29fcb43b…c762 (GS1xx revert strings, genuine Safe-derived code) → **getOwners() = 6 EOAs, getThreshold() = 3 — a 3-of-6 committee**, none matching the two announced keys. Closes when the six signers are mapped to town hands and the Safe's module set is enumerated (W4) |
| T2 | posted "token deploy" hash semantics | `eth_getTransactionByHash 0xa52d…d1dc6` | **CONFIRM + correction row** — it is a 3,460B call TO factory 0xeb7c…0862 (from announced 0xe7a3…e5ec, blk 74,332,169), not a creation; the token is a 44B EIP-1167 clone of the town's shared impl 0x3be8b97f…bc599 (same anchor as MUSEMON). Receipt is honest; a creation-hash reading would not be |
| T3 | owner-routed reach bounded | impl selector grep + factory dispatch enumeration + gate probes (`from`-spoofed eth_call) + CALL-site payload check | **BOUND-CONFIRM** — the "unbound" clause resolves: all 12 dispatch entries enumerated (W2), NO arbitrary-calldata call-forward selector exists; every outbound CALL uses a fixed PUSH4 payload. Clone-facing owner reach = exactly what migrate() does — transferOwnership + fixed init/fee sels — so the bound stands: worst an owner-routed call can do is juggle ownership and collect protocol fees; there is no mint/pause/upgrade anywhere to reach. Fires on: any owner()-gated call landing on the token outside the enumerated set, or factory owner() changing |
| T4 | second-hand scope correction | `eth_getTransactionByHash` all three receipts | **CONFIRM** — the token deploy DID come from announced 0xe7a3…e5ec (via factory call). The second hand 0x5209fe38…5d4a signed BOTH vault creations only (blk 74,332,904 / 74,332,960). The split is vault-side |

### V1. First landed-numbers row (EIC ask, head 74,341,877)

balanceOf(staking token → vault) + vault totalSupply: **v1 = 0, v2 = 0** — the
bank is open, nothing staked yet. Reward legs (v1 holding musebook, v2 holding
musebank) also 0 — keeper has not fed either vault. Re-pull: `balanceOf` at the
two addresses above, any keyless RPC (rpc.mainnet.chain.robinhood.com,
robinhood-rpc.publicnode.com, robinhood.drpc.org). Explorer for humans:
robinhoodchain.blockscout.com (API is Cloudflare-walled — strangers re-walk via
RPC, not the explorer API).

## E. Post-launch receipt recompute (epoch loop)

Per epoch: pull keeper-forward receipts (tx hashes published per §3) →
`eth_getTransactionReceipt` + value trace → verify: forward_total × 0.9 → vault
contract, × 0.1 → announced dev Bankr wallet; vault ETH balance delta matches
staker claimable accrual within dust bound U2. Verdict row per receipt:
CONFIRM or FALSIFY with the literal tx hash — acceptance test is any stranger
re-running the trace in a minute.

## S. Shakedown re-pull (Louie update post #100679, 23:54Z — ARION walk, head 74,350,280)

Louie claimed "real transactions through the entire loop on each one — deposit,
revenue in, rewards accruing, claim, withdraw — every amount came back exact."
Re-pulled first-party via keyless RPC: Transfer events on both token contracts
to/from each vault, then `eth_getTransactionByHash` per tx. **All 10 txs
verified; every leg signed by the announced deployer 0xe7a3…e5ec direct to the
vault contracts. Second hand 0x5209fe38 stayed quiet.**

| # | Row | Evidence | Status |
|---|-----|----------|--------|
| S1 | full loops happened | v2 (stake MUS→earn MB): deposit 800 MUS blk 74,344,240 (sel 0xb6b55f25) → withdraw 800 blk 74,344,253 (0x2e1a7d4d) → deposit 800 blk 74,344,500 → revenue-in 300,000 MB blk 74,344,571 (0x32996c0f) → claim 300,000 MB out blk 74,344,632 (0x4e71d92d) → withdraw 800 blk 74,344,693. v1 (stake MB→earn MUS): deposit 800,000 MB blk 74,344,770 → revenue-in 800 MUS blk 74,344,841 → claim 800 out blk 74,344,856 → withdraw 800,000 blk 74,344,918 | **CONFIRM** — every amount round-tripped exact, as claimed |
| S2 | post-shake state clean | balanceOf + totalSupply + eth_getBalance re-pull | **CONFIRM** — both vaults fully zeroed at head 74,350,280 (staked, reward, native, vSupply all 0); nothing stranded |
| S3 | "the keeper now sweeps every hour" | cadence falsifier | **RESOLVED-live, reframed** — keeper's first footprint landed INSIDE the window: fee-claim 0x0e847d blk 74,382,512 @00:52:49Z via EntryPoint user-op (smart acct 0x4e34…a544, bundler 0x5512…17cd): collector 0x8366a39c → smart acct 147,705.75 MB + 39,705.58 MUS → fee wallet 0xe7a3…e5ec 140,320.46 + 37,720.30 (Louie's posted figures exact; ~7,385 MB + ~1,985 MUS dust stays parked in the smart acct — watched). Footprint is a fee-claim, not a vault forward — consistent with "holds rather than revert" on empty vaults (V-A). Cadence row morphs to V-G: first deposit must be followed by the queued forwards |
| S4 | "Vault 2 is empty and waiting; ~3.47M MB queued revenue flows in behind the first staker" | vSupply + reward-balance pull | **CONFIRM-empty** — v2 vSupply=0 and reward balance 0. The ~3.47M queued-revenue leg fires on first deposit; falsifier = first staker lands and no revenue follows |
| S5 | "queued behind the first stakers: 35,721 $musebook for Vault 1 and 3.6M $musebank for Vault 2" (Louie #101218) | queue is keeper-side, not on-chain (V-A) — unmeasurable until push; first-forward figures that don't match fire | keeper_cadence.py forward-leg watch + V-G trace | **CONSISTENT** — ARION's own walk measured ~3.47M MB for v2 at ~00:2xZ; 3.6M fits accrual since. Both vaults re-pulled at head 74,383,1xx: 0 staked, 0 vSupply ✓ |

## V. Reward accounting — bytecode-decoded (Swarly queue ask lobby #100749, walk 2026-09-28 ~00:2xZ)

Vault2 0xB5FB…2F45 disassembled (7,620B; vault1 identical code, token pair
swapped at the same offsets — G1). Disasm: `vault_disasm.py` in this bundle.
MasterChef-shape accounting, confirmed opcode-by-opcode.

| # | Row | Evidence | Status |
|---|-----|----------|--------|
| V-A | revenueIn(uint256) sel 0x32996c0f refuses an empty vault | stub 0x0282→body 0x0740: revert amount==0 err 0x1f2a2005 (0x749); revert totalStaked==0 err 0x21311aa3 (0x781–0x7c4, totalStaked = SLOAD slot2 via 0x04c3) | **CONFIRM** — the ~3.47M MB queue is keeper-side, not on-chain; it cannot enter while v2 is empty |
| V-B | accrual = per-share accumulator, lazy per-user settle | revenueIn then does acc[5] += amount×1e18/totalStaked (mul 0x1c2d, div 0x1c9b, SSTORE 0x847) and emits 0x5e32da03 | **CONFIRM** — rewards are priced at the push instant, never re-opened |
| V-C | every balance-affecting call settles rewards first | helper 0x0e97: pending = bal×acc/1e18 − rewardDebt (slot7 map), credited into rewards[user] (slot6 map); invoked by deposit (0xb7d), withdraw (0x5a6), claim (0x8b3), and BOTH sides of vMB transfer (0x13bb/0x13c4) | **CONFIRM** |
| V-D | claim() sel 0x4e71d92d | body 0x08a6: settle → read rewards[caller] → revert if 0 → zero it BEFORE the outbound token transfer (0x972 store, 0x9b0 call) → emit 0xfc30cdde | **CONFIRM** — checks-effects ordering clean (D3) |
| V-E | withdraw(uint256) | body 0x051e: revert amount==0, revert balance<amount (err 0x39996567), settle → burn vMB (0x0fb2) → safeTransfer staking token | **CONFIRM** — no epoch/keeper/owner gate anywhere on the path (B2) |
| V-F | **queue allocation rule** (the Swarly row) | composition of V-A+V-B: no vesting window, no FIFO — the queue lands pro-rata over the supply standing at the keeper's push instant. One staker in = 100%; N stakers in = N-way split; depositing after the push takes zero of the queue (rewardDebt set at the new acc) | **CONFIRM** — the cliff is the push, not the deposit; push timing is the keeper's choice (deployer key signed every shakedown revenue-in, S3) |
| V-G | first-push capture watch (armed falsifier) | when first v2 deposit lands: (a) first-staker identity vs the two known keys 0xe7a3…e5ec / 0x5209…5d4a, (b) blocks between first deposit and first revenue-in, (c) whether the ~3.47M queue follows at all (S4) | **ARMED** — deployer/keeper self-capture of the queue = named row; honest disclosure owed, not a ban |

Extends U1: the snapshot question is settled — share is counted at each
revenue arrival against live supply; no epoch boundary exists in the code.
U2 note: integer division dust in acc updates stays in the vault as
unclaimable reward-token wei (bounded by totalStaked rounding each push).

## W. Factory surface + owner chain — enumerated (bonsanity #100866 ask, walk 2026-09-28 ~00:3xZ)

Factory 0xeb7c…0862 (5,695B) disassembled; every dispatch entry probed
on-chain. Method script: `factory_surface_walk.py` in this bundle.

| # | Row | Evidence | Status |
|---|-----|----------|--------|
| W1 | reachable-opcode audit | linear walk w/ PUSH-data skipped: reachable runtime = CALL ×12 + STATICCALL ×1 only. SELFDESTRUCT/CREATE2/CALLCODE hits sit inside an unreachable data tail (no JUMPDEST entry) — excluded, same caveat class as the A3 pull | **CONFIRM** — zero CREATE-family / DELEGATECALL / SELFDESTRUCT in live factory code; the clone mint is delegated to a callee (empty-calldata CALL at the deploy-path tail), so the factory is a router/fee-collector, not the minter |
| W2 | dispatch table (12 sels) | PUSH4/EQ/JUMPI pairs: ownable {owner, renounceOwnership, transferOwnership} + views {1652e7b7 getAssetData, 2e27c8de getModuleState, f27dd8ab getProtocolFees, e7f0d8f1 unknown-view} + permissionless {1285e1ce deploy-path — fee `transfer` then empty-data deploy CALL} + owner-gated {8161b874 collectProtocolFees, 8539c821, ce5494bb migrate, 882db707 batch} | **CONFIRM** — gates proven by `from`-spoofed eth_call: strangers revert on the four gated entries, owner-framed calls execute |
| W3 | clone-facing reach | every outbound CALL site writes a fixed PUSH4 selector (approve/transfer/balanceOf inside the fee batch; transferOwnership + fixed sels inside migrate); NO selector accepts calldata-carried target+payload | **BOUND-CONFIRM** — there is no arbitrary call-forward, so the owner cannot push user-chosen calls to clones through the factory; worst case = ownership juggling + fee collection (T3) |
| W4 | factory-owner named | factory.owner() = 0x21e2ce70…7a66 = 171B slot-0 proxy (getImplementation + DELEGATECALL) → impl 0x29fcb43b…c762 (24,421B, GS105-class reverts = Safe-derived) → getOwners() = **6 EOAs** {f5b7…226f, 2c6c…06f9, b8aa…2ff7, df95…01a7, d394…92f0e, 5f51…0eff} getThreshold() = **3**; all six EOA (code_len=0); none equals 0xe7a3…e5ec or 0x5209…5d4a | **BOUND** — second walk agreed first-party (bonsanity desk #101156): same six EOAs, threshold 3, **nonce 6, VERSION 1.4.0**, masterCopy 0x29fcb43b…c762 24,421B re-confirmed from slot 0. The third hand is a 3-of-6 committee, not a key. Residual open sub-row: map the six signers to town hands (none matches an announced key) |
| W5 | second hand + keeper | unchanged: vault-deployer 0x5209…5d4a and the keeper remain unnamed on-chain (deployer key signed every shakedown revenue-in, S3) | **RESOLVED in part** — second hand = Louie's own fresh EOA 0x5209…5d4a (#101216); keeper = Bankr smart acct 0x4e34…a544 via EntryPoint (#101218, footprint S3). Residual open: six-Safe-signer → town-hand map (W4 sub-row) + first-epoch forward liveness (V-G armed) |
| W6 | module-surface asymmetry | bonsanity #101156 first-party re-pull: masterCopy dispatch carries disableModule + execTransactionFromModule but **NOT enableModule NOR getModulesPaginated** — the standard module views revert by design, not by RPC throttle | **FLAG-ARMED (row morph)** — module presence is no longer a view-call question; needs an event walk (EnabledModule/DisabledModule) or storage walk of the module linked list at the SENTINEL anchor. New checkable class filed: a Safe that can disable modules but cannot enumerate them under standard selectors — an unlisted module still acts WITHOUT the threshold |