Phase 3 — veForge Gauge Spine

Router 1 — gauge weights → Keep allocations

GaugeWeightRouter is the spine. Anyone can poke() it. It reads each strategy's gauge weight, normalizes the set to basis points summing to the vault's deployable budget, and calls Keep's set_allocations — the only function it ever calls.

• Holds only the vault's STRATEGY_MANAGER_ROLE; sets target weights, moves no funds.
• The vault still caps every strategy at max_debt and honors withdrawals — a vote is a capital tilt, nothing more.
• Fails closed: wrong-length mapping reverts; a killed gauge reads 0 and drops out; all-zero is a no-op.

Router 2 — surplus → savings, emissions as a junior slice

SurplusSplitter becomes the engine's savings_vault: it receives the surplus skim and divides it — a senior slice to sTARE, a capped slice to emissions.

• SAVINGS (sTARE) is immutable; the owner can never redirect it.
• emission_bps is hard-capped at 3000 (30%); savers always get the majority.
• Only ever touches TARE the engine already released above its bad-debt buffer — the solvency gate stays in the engine.

Router 3 — emissions → gauges → voters

EmissionRouter splits its TARE pot across gauges by relative weight and funds each gauge's bucket in the already-hardened BribeDistributor via deposit_bribe. Voters claim pro-rata.

• Approves the distributor for exactly each gauge's slice; allowance returns to zero every time.
• Floor-division dust rolls into the next round — never stranded, never over-spent.
• A killed or zero-weight gauge is skipped.

Invariants, fuzzed

Each router ships with a Hypothesis stateful machine driving the full pipeline — locks, votes, kills, time-travel, funding, apply — asserting:

• Σ bps == deployable exactly (dust absorbed by last slot); each share ≤ deployable ≤ MAX_BPS.
• Conservation — no token created or destroyed across the pipeline.
• Savings stays senior — emissions never exceed the 30% cap, cumulatively.
• One function only — the distributor's deposit counter equals exactly the applies made.
• Liveness — poke / split / distribute never revert under a consistent config.

Totals: GaugeWeightRouter 15+1 · SurplusSplitter 14+1 · EmissionRouter 22+1 — all green, all compile clean.

Traced on-chain

We fed the SurplusSplitter 50 TARE and called the permissionless split(). On-chain result: 40 TARE landed in sTARE — its share price stepped from 1.0000 to 1.4000 in one transaction — and 10 TARE routed to the emission sink. Exactly the 80/20 the cap promises; the splitter held nothing afterward. A self-review drove four hardening fixes before deploy (owner-set emission schedule, delayed 180-day escape hatch, reentrancy guard, buffer-bounds check), all re-fuzzed.

Sepolia addresses (chain 11155111)