Invariants

Engine (tender, checked by unit and LiteSVM tests; appendix/CLAUDE.md):

• Before expiry, a call series' underlying vault equals LONG supply.
• Deposits round up, withdrawals round down; dust accrues to the vault.
• After expiry only settle moves collateral; claims are live pro rata.
• Every token movement is measured: the balance must change by exactly the amount.

Launch vault:

• Every call sold is fully covered at sale: its tokens sit in its own escrow.
• Day and live caps never exceed the stake (caps_scale_with_the_stake for 5% to 10%).
• A buy never writes into a non-canonical series (A-01 regression).
• A position's series and escrow are those recorded in its NFT (A-02 regression).
• Activation cannot be blocked by donations (A-03, A-07 regressions).
• The vault counts only SOL movements it made itself (C-01 regression).
• No new sale at or above a $1M reference market cap; existing positions unaffected (calls_close_once_the_reference_market_cap_reaches_1m).
• The stake leaves only by exercise, the stall rule or burning; there is no withdrawal path.

Put vault:

• The vault locks W x size USDC per position at sale; payout never exceeds it.
• Premium >= W / 4.5.
• A read must be alone in its transaction; settlement uses the median of at least 3 reads.