docs: correct the BONK root cause, add token-security bench feasibility

[Flotapponnier]

Two things.

Correction

v1.1 claimed the deep Orca pool was absent from Serialized's pool list. It is present, ranked second. The real defect is sharper: the ranking compares liquidityNative across different quote assets without converting to USD.

rank	pair	raw liquidity	USD	priceNative	implied
1	Bonk/USDC	4,346.7 USDC	$4,347	6.0867e-09	$6.32e-07
2	Bonk/SOL	728.7 SOL	$75,679	3.1853e-08	$3.31e-06

Seven of eight pools agree at ~$3.31e-06; rank 1 is the lone outlier and /v1/token/price prices from it. A pool quoted in USDC beats a 17.4x deeper pool quoted in SOL purely because 4,346 > 728.

This propagates into security: lpBurnedPct, lpLockedPct and lpSource are properties of the selected pool.

New section 17, token-security bench feasibility

• Cohort exists: six providers with a live security endpoint, four keyless.
• Latency is publishable today: RugCheck 91 ms, GoPlus 249 ms, Serialized 306 ms, Mobula 5,240 ms p50 with a 30 s max. Our own product would be last by 17x. Worth weighing before shipping.
• Three measured traps: tax fields agree 90-100% so they carry no signal; LP fields are semantically different across vendors and cannot share a column; coverage alone is gameable.
• Retrospective backtest: 128 graduated tokens, 77 dead / 19 alive. Age confound ruled out (0.8 h vs 1.0 h). But both cohorts are ~1 h old, so "dead" means "never grew", not "rugged". A retrospective query cannot replace snapshot-at-mint plus resolve-later.
• Which fields carry signal (n=70): top10HoldersPct 97% distinct values, usable. bundlersHoldingsPct bimodal with 13 tokens at exactly 100.0 tracking the dead group. devHoldingsPct only 30% distinct, 42 zeros plus a 79.31 template cluster, low power.
• Cost: token/security 10 credits is affordable; audit/contract 750 credits is not benchmarkable at any useful cadence.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CpArutAtXuBb1BVNUDXoYA