The shift clockOne press, that period, done

04 / The press

Once per address, once per period.

Cadence is counted in blocks, not seconds. No seconds-per-block assumption appears anywhere in the system.

Status

Nothing is deployed. No factory, vault or ledger address exists on any chain, no transaction has been broadcast, and the repository carries no git remote. ./submission/check asserts all three.

06 / The equilibrium

Pressing stops paying the moment headcount catches up with the pot.

a sweeper spends fee and receives about 0.6 × pot / N

so pressing stops paying once N > 0.6 × pot / value(fee)

The equilibrium / wage against headcount

One period whose pot is 1.0000 BNB, and an entry fee worth 0.0500 BNB at the moment of pressing. Both axes are that period’s own units, so the shape holds at any pot.

wage per address 0.6 × pot / N value(fee) 0.0500 BNB, flat at every N N = 12
wage = fee
past this point a press
costs more than it returns

The wage falls as the room fills; the fee does not move, because there is no function that could move it. Where the two meet is the headcount this period can support — N > 0.6 × pot / value(fee) — and it is set by what the trading tax paid in, not by an allowlist. A larger pot pushes the crossing right; a dearer fee pulls it left. That is the whole Sybil answer.

one press per address per period

addresses pressed this period

wallet holding one entry fee

wallet holding ten million

0.6 × pot / N

Nobody has pressed this period, so the wage bill is still whole. Both wallets are owed the same expression, because the expression has no term for what either of them holds.

Sixty per cent of a period is the wage bill, split by headcount and nothing else. So the wage falls as the room fills, the fee does not, and participation is capped by what the trading tax can support. Arithmetic, not an allowlist — which is why the vault needs no Sybil defence to avoid unbounded dilution.

02 / The press

A flat fee, burned, and no way to move it.

The fee would be denominated in the launched token, sent to 0x…dEaD, and fixed at launch. A raisable fee would be a lever over everyone already enrolled; a lowerable one would be a lever over the equilibrium headcount. So the immutability is enumerated rather than promised, and the enumeration is what a reviewer can re-run:

State-writing functions on the ledger’s whole ABIinitialize, sweep

Assignments to fee in the sourceone, inside initialize

Inline assembly that could write the slot behind themnone

A setter under any name fails the first check, a fee that creeps inside sweep fails the second, and an sstore to the slot fails the third. The one remaining reach is stated rather than netted out: both contracts are beacon proxies and the Guardian owns the beacon, so an upgrade could install an implementation that does carry a setter. That is the same reach that lets the Guardian rescue funds, and it is disclosed as the emergency mechanism rather than hidden.

04 / Timing

Tax arriving in a period funds the next one.

Each period gets its own bucket, committed one period ahead. Nobody can press the button and then dispatch a backlog of tax into their own period, because the period they are pressing in was funded before they arrived. Project, referrer and rounding remainder all resolve from that funding-time snapshot, so changing the project address cannot redirect a period that is already funded.

Timing / every period is funded before anybody can work it

Four consecutive periods, left to right. The tax that arrives during one of them is committed to the next one’s bucket, which is why the arrows land one column to the right. Schematic: the pots are the worked example from the ledger above; the one-period offset is what the vault does.

Tax arriving during the period

4115

0.3081

BNB

4116

0.5140

BNB

4117

0.7412

BNB

4118

still arriving

into 4119

The pot that period pays out — funded before it opened

4115

0.9026

BNB

4116

0.3081

BNB

4117

0.5140

BNB

4118

0.7412

BNB

In from 4114Out to 4119

Nothing arrives for the period it is spent in. A sweeper cannot press the button and then push a backlog of tax into their own period, because the period they are pressing in was funded before they got there — and the project address, the referrer and the rounding remainder all resolve from that same funding-time snapshot, so changing the project address cannot redirect a period already funded. The other side of the same fact is disclosed rather than hidden: the pot is visible before anybody decides to press, so participation concentrates in well-funded periods.

A press is recorded in the block it happens in, so nothing can arrive late for a closed period. Finality is the period boundary itself — there is no extra submission window to wait out, and settlement closes one period in constant time without walking empty history.

Cadence is counted in blocks, between 20 and 1,000,000 of them. No seconds-per-block assumption appears anywhere in the system.