Enforced by the contract — cannot be bypassed:

• Player money and project money live in two different accounts. You can see both above.
• Before the unlock date there is no instruction that moves treasury tokens to an address chosen at payout time. The only exit is a claim against a Merkle root published 48 h earlier, and the recipient comes from the leaf — not from whoever signs.
• The unlock date can only be pushed further away, never brought closer.
• Caps can only be tightened. Once finalized, not even that.

Provable by publication — detectable, not prevented:

• That the winners are the ones from the leaderboard. Each day is hashed into a chain and published before anyone knows who will win, and the full prize list sits on-chain as a Merkle root for 48 h before a single token moves.
• That the matches happened. Receipt hashes are anchored on Solana every minute, so the past cannot be invented after the fact — and each receipt carries the signature every player used to enter the room, which we cannot forge.
• That we are not hiding what we owe you. The full balance list is published with its root anchored on-chain. Understating the debt means shaving somebody's balance, and they can check it above.

Not guaranteed — say it out loud:

• If the program is still upgradeable, everything above is decoration: a new version could drain the vaults. That's why the upgrade authority is the first thing on this page.
• We could still run our own wallets. Nothing tells our wallet apart from yours. What stops it being free is that they must pay entries, must cross paths with enough distinct opponents to qualify, and every match they play is anchored with a timestamp. It is not impossible — it is slow, expensive and visible.
• We write the kills. The game runs at 40 Hz off-chain; nobody can re-verify a match from outside. Receipts prove a match existed at a given time and who signed into it; they do not prove the score. The only thing that would close this is a multisig where one signer is not us.
• In-game balances are off-chain. The contract knows how much sits in custody, not who is owed what. That is what the liabilities snapshot is for.