Protocol Invariants
Machine-enforceable rules that should never be violated.
These should become executable tests and, where practical, formal-verification targets.
Supply and liquidity
I1: NewTokenSupply(t) = NewTokenSupply(launch).
I2: ProtectedInitialLiquidity(t) >= ProtectedInitialLiquidity(launch) for no-withdraw templates.
Identity/versioning
I3: World → BlueprintVersion is immutable.
I4: SeasonRules(t) = SeasonRules(entry_open) after entry begins.
I5: provenance_hash / code_hash / runtime_hash cannot silently change within a version.
Player capital
I6: vault_assets >= unsettled_claims + reserved_principal.
I7: settlement_sources = settlement_uses for every settlement domain.
I8: SettlementCount(Season) <= 1.
I9: withdrawn(Position) <= finalized_claim(Position).
Finality
I10: status != FINALIZED => settlement prohibited.
I11: SETTLED is terminal for that settlement domain.
Runtime
I12: RuntimeBalance >= 0.
I13: PAUSED preserves last finalized state/checkpoint.
I14: RuntimeProviderAuthority ∩ PlayerVaultWithdrawalAuthority = ∅.
Checkpoint chain
I15: checkpoint[t].prev_root = checkpoint[t-1].state_root for the finalized chain.
I16: input_root commits to the exact ordered inputs consumed by the transition.
Data
I17: data required to challenge a pending result must be retrievable until its finality deadline.