Treasury Invariants

Across every operational state — pre-launch, live, and shutdown — the following properties hold. Each is structural: enforced by the shape of the contracts, not by policy.

• Value enters only through defined pathways — the supporter vault's finalization at launch, swap proceeds from the engine's own liquidations, and (for $PURE) the ecosystem receiver's market-making leg.
• Value leaves only through defined pathways — the distribution split at each liquidation, a passed and capped governance release, and pull-based claims at shutdown. No other exit exists in code.
• The Treasury holds no one's money but the market's. Team compensation lives in TeamDistribution, supporter value in SupporterDistribution, ecosystem contributions in the EcosystemReceiver. A claim on any bucket is a claim on that bucket's own contract — never a ledger entry inside the Treasury.
• No bucket can drain or override another. The buckets are separate contracts with disjoint authorities; there is no cross-bucket transfer path.
• No actor has discretionary access. Not the team, not the arbitrator, not governance — each has exactly the narrow, coded powers documented in this section, and nothing else.
• Failure activates no new privileges. Shutdown repositions capital among the launch's own contracts and opens pull-based claims; nobody gains a power at shutdown they did not have before.
• All value is WETH internally; native ETH exists only at final payout. No internal transfer runs recipient code, so no internal flow can be blocked or re-entered by any counterparty.

Once deployed, the Treasury is a closed economic system whose outcomes are fully determined by code and market behaviour.