# Belljaw: The Firm

Belljaw (BELLJAW) is an original human broker hero for a nineties Wall Street boiler-room parody on Base. Rex Belljaw has an oversized jaw, a crooked grin and a terrible indoor voice. He sells a place on a trading floor whose Firm is an immutable vault contract: the launch-side fee goes there, its Portfolio supplies markets, and its weekly Open Mouth ritual displays actual receipts, buyback executions and liquidity additions. Early buyers become founding partners in the fiction; holding builds tenure and pool-selection influence; trading buys execution and funds the ritual. The line is "Big mouth. Open books." The boast is "the only honest firm on the Street: all books onchain." This describes inspectable accounting, not an assurance about safety or outcomes.

## Problem, timing and value

A mascot can attract attention without giving holders a continuing action or making spending inspectable. Here holders choose the next funded market and reconcile the Firm's books; traders get additional quote routes; the character must react even to an empty week. The brief places this among IMD's first company launches on Base, following only a test counter contract [R0]. IMD gains a reusable, reviewable launch specification and a public demonstration of agent work. The swarm receives its fixed allocation for building, plus visible artifact and transaction provenance; it does not receive the vault's fee stream.

The timing thesis is an inference: recognizable faces, recurring participation and verifiable fee-funded activity can sustain a shared project better than an isolated gag. It is not a market-performance claim. Source checks support individual mechanisms, not a universal statement that fee-funded tokens withstand market declines [R3-R10].

## Three concepts in the required world

Scores are editorial judgments, not measurements. Every candidate uses the same fixed supply and fee facts. Each is a human broker on the same trading floor; none is an object mascot or paperwork parody.

| Concept | Face and voice /5 | Money loop /5 | Early reason /5 | Hold reason /5 | Trade reason /5 | Model clarity /5 | Three-month story /5 | Screenshot memes /5 | Abuse controls /5 | Launch feasibility /5 | Total /50 |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Belljaw: loud broker learns that public books outshout sales patter | 5 | 5 | 4 | 4 | 4 | 5 | 5 | 5 | 4 | 4 | 45 |
| Velvet Elbow: smooth broker challenges a fictional private banking club to public pool duels | 5 | 4 | 4 | 4 | 4 | 4 | 5 | 4 | 3 | 4 | 41 |
| Margin Mouth: exhausted floor broker stages a weekly showdown between quote currencies | 4 | 4 | 3 | 4 | 4 | 4 | 4 | 4 | 3 | 4 | 38 |

Belljaw wins because a recognizable face can carry both a busy floor and a quiet-week confession. Velvet Elbow risks making invented opponents the whole story. Margin Mouth's duels could encourage unnecessary transactions. Belljaw's episode changes when a contract event changes; audience activity need not be purchased or scored by a server.

## Fixed launch facts and choices

All figures below are requirements or design choices [R0, A1-A8]. They are not descriptions of an existing deployment.

| Item | Value | Reason or interpretation |
| --- | --- | --- |
| Chain | Base; chain ID 8453 | Required; ETH pays chain gas [R1] |
| Name / ticker | Belljaw / BELLJAW | Original face-led identity; bounded collision check [R13] |
| Supply | 1,000,000,000 tokens | Fixed at launch |
| Decimals | 18 | Required |
| Transfers | Plain transfers; transfer tax 0% | No special transfer path, rebasing or holder restrictions |
| Mint authority after launch | None | No owner mint after launch |
| Automatic token burn | None | Token contract contains no automatic burn |
| Initial pool | BELLJAW / native ETH | Required ETH pair; full-range liquidity |
| Launch pool token seed | 35%; 350,000,000 tokens | Goes to pool seeding, not a fourth discretionary allocation |
| Swarm allocation | 10%; 100,000,000 tokens | Agents who build it |
| Developer allocation at launch | 55%; 550,000,000 tokens in one transfer | Must not split this transfer between destinations |
| Later developer action | Manual transfer of 50% of original supply; 500,000,000 tokens | Developer sends by hand to 0x000000000000000000000000000000000000dEaD |
| Developer retained allocation | 5%; 50,000,000 tokens | Remainder after the manual transfer; still concentration risk |
| Pool trading fee | 1.25% of every trade | Pool charge, not a token transfer charge |
| Launching side | 1% of trade; 80% of fee | Entirely to the Firm vault contract |
| Network | 0.25% of trade; 20% of fee | Launch-network fee recipient; separate from Base gas |
| Additional hook fee | 0% | No extra trader charge |
| Initial ETH capital | 20 ETH | Developer-funded planning budget, outside token distribution |
| Starting expense reserve | USD 6,000 equivalent in ETH | Separate developer-funded cash, not a supply allocation |

The manual developer action is a launch-plan obligation, not an automatic or guaranteed future burn. The report must label it pending until its successful transfer is final. Sending to the specified address leaves ERC-20 totalSupply unchanged; the books separately show dead-address balance and liquid balances. Vault purchases also go to that address. No other burn mechanism is proposed.

### The Firm, the Portfolio and the trading floor

The Firm is the vault contract, never Rex, a server, the developer, the token or an agent. Native-ETH pools and hooks are technically possible in Uniswap v4 [R2]. This is a proposed custom integration, not a claim that a public launch service already supports the required split.

The proposed fee adapter collects the full pool fee and settles the fixed split. The vault permanently holds the launch LP position. A zero-additional-fee hook permits only the vault to add liquidity to its designated pools and forbids principal removal, position transfer, arbitrary calls and approvals to unlisted spenders. The same restrictions apply to later Portfolio positions. No administrator can sweep principal or change the fee recipients. Fee collection is permitted; liquidity principal cannot be redeemed. Public third-party pools remain possible and need not pay the Firm. Their volume is excluded from its model. Audited implementation and fee-routing tests are preconditions, not completed work.

The Portfolio consists of BELLJAW pools against the following quote assets. Buying both sides of later positions uses earned cash; it does not alter the launch distribution. Portfolio fee income is additional LP income only when it comes from trades in those separate pools. Launch-pool LP receipts are already the launching-side fee and are never counted twice.

| Pair | Initial token seed share | Target share of future liquidity budget | Effective share before gold qualification | Activation and reason |
| --- | --- | --- | --- | --- |
| BELLJAW / ETH | 35% of supply | 60% | 65% | Launch market; available quote and simplest settlement |
| BELLJAW / USDC | 0% | 25% | 25% | First expansion; another quote for execution; issuer freeze risk [R11] |
| BELLJAW / cbBTC | 0% | 10% | 10% | Later expansion; another asset exposure; custody and freeze risk [R11] |
| BELLJAW / gold | 0% | 5% | 0% | Conditional gold-backed token pool; no verified Base asset selected [R12] |
| Tokenized stocks | 0% | 0% | 0% | Excluded: issuer inability to freeze has not been proved [R10] |

Gold is a defined Portfolio lane, not a claim that a suitable Base token is available. Its budget remains in the ETH lane until a developer whitelist entry identifies an authentic, plain-transfer gold representation on Base, its custody and bridge risks, executable liquidity and oracle coverage. A tokenized gold ETF counts as a stock and must pass the stricter no-freeze requirement; there is no such approved asset here. No guessed address or synthetic gold stand-in is supplied.

The developer proposes exact asset and pool identifiers to a contract whitelist under a public delay. Holders vote over that whitelist; they cannot add arbitrary assets. Voting selects where the next discretionary part of the liquidity budget goes, not where existing principal moves. Core target shares above govern the budget; a vote can redirect a bounded fraction of that month's new budget between eligible lanes. If a lane is not active, its share goes to ETH. This is a practical staged Portfolio, not a forced launch of thin pools.

| Contract rule | Number | Reason |
| --- | --- | --- |
| Whitelist notice and execution delay | 7 days | Public time to examine code, custody, fees and oracles |
| Vote epoch | 7 days | One recurring floor event |
| Stake age required before voting | 7 complete days | Flash borrowing cannot vote |
| Voting weight per token | min(complete weeks held in escrow, 4) | Rewards tenure while bounding age advantage |
| Quorum | 10% of eligible checkpointed weight | An empty ballot leaves the prior allocation unchanged |
| Discretionary budget moved by vote | At most 10% of that month's new liquidity budget | Whale influence cannot drain principal or dominate asset allocation |
| Maximum USDC / cbBTC / gold budget shares | 35% / 20% / 5% | Bounds the quote-asset risk even after a vote |
| Maximum new pool activations | 1 per 30 days | Avoids multiplying thin markets |
| New-pool minimum funded position | USD 2,000 equivalent total | Below this, accrue the lane budget; do not announce an empty market |

Voting is linear in token-time across escrow lots, not quadratic per wallet. The developer and swarm stakes are visible and governed by the same rules. A whale can still win the bounded vote; this is disclosed plutocratic selection, not one-person-one-vote. Exact asset addresses, deployer roles and the launch-network fee recipient are developer-set deployment inputs. This files-only assignment needs none of their private values.

## Loop: ten steps, with an arrow ledger

```text
Outside swap intent -> pool execution -> fee split -> Firm cash buckets
       ^                                      |          |
       |                                      v          v
Portfolio quote routes <- new LP positions <- liquidity   buyback -> dead address
       ^                         |
       |                         v
Arbitrage floor <----- price differences     contract report -> weekly episode
                                                        -> holder ballot -> next budget
```

| Step / arrow | Who pays and trigger | Can it turn without new external money? |
| --- | --- | --- |
| 1. Intent -> launch pool trade | Trader pays input, pool fee and gas when execution is wanted | Existing capital can trade again, but repeated fees consume it |
| 2. Trade -> fee split | Pool settlement credits launching side and launch network on each fill | Only while trades occur; not on idle balances |
| 3. Fee split -> Firm buckets | Immutable adapter credits vault; anyone may collect accrued fees | Existing accrued fees can be collected once |
| 4. Buyback bucket -> dead address | Vault spends only accumulated buyback budget under execution guards | Yes until that finite budget is exhausted; a guard can defer spending |
| 5. Liquidity bucket -> Portfolio | Vault buys inventory and supplies the approved position | Existing budget can fund it once; no launch allocation is borrowed |
| 6. Portfolio -> alternative quote routes | Vault bears capital and LP inventory risk | Routes persist without fresh deposits; fees require trading |
| 7. Price differences -> arbitrage floor | Arbitrageur supplies capital, pays both fees and gas | Finite existing capital can rebalance discrepancies; no endless source of cash |
| 8. Portfolio fills -> additional LP fees | Outside traders pay fees in separate Portfolio pools | Requires demand; launch fees and vault self-swaps excluded |
| 9. Contract totals -> Open Mouth episode | Contract reads are public; caller pays gas only for settlement | Yes, including a zero-activity report; narration has no spending authority |
| 10. Holding -> ballot -> next allocation | Holder optionally escrows tokens and pays interaction gas | Yes; a vote cannot create cash or require a purchase |

Vault receipts from its own swaps are cash recycled from its own budget, not external revenue. Repeated circular swaps lose network fees, gas and execution costs. There is no volume level at which idle money manufactures new money. Operational funding thresholds and the low-volume mode are in FINMODEL.md.

## (a) Why buy early

The early reason is participation before the first pool decision and an unrepeatable founding-season credential. There is no early price entitlement, extra launch allocation or monetary multiplier. The credential requires an early escrow deposit and continuity, not a wallet's ordinal number. Its active status needs the minimum amount to remain in founding-window deposit lots; later deposits cannot replace withdrawn founding tenure. Buying without registering in escrow does not start tenure.

The comparison below is illustrative timing, not a forecast of user arrivals. Each buyer deposits the same amount and remains deposited. Evaluation is at the end of the first planning month.

| Buyer label | Illustrative purchase and escrow day | Escrow tokens | Complete weeks by day 30 | Founding-season credential | Current tier | Weight per token | What is gained relative to later arrival |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Buyer 1 | 0 | 100,000 | 4 | Yes | Broker | 4 | Can take part in the first ballot and all first-month floor episodes |
| Buyer 100 | 2 | 100,000 | 4 | Yes | Broker | 4 | Same credential; entry order confers no extra money or weight |
| Buyer 1000 | 30 | 100,000 | 0 | No | Intern | 0 | Can build the same tiers going forward; cannot rewrite first-season history |

| Founding credential rule | Value | Reason |
| --- | --- | --- |
| Entry window | First 7 days after launch activation | Broad window rather than a bot race for wallet numbers |
| Minimum continuously deposited amount | 100,000 BELLJAW | Makes participation a real token commitment |
| Extra tokens / fee discount / monetary rights | 0 / 0% / none | Sybils cannot extract a financial early bonus |
| Credential transferability | None | Cannot transfer tenure to another wallet |

## (b) Why hold

The gain per week is another recorded week of tenure, an additional unit of token-time voting weight until the cap, and access to the next story role. The basic token remains freely transferable. Escrow is voluntary, withdrawable immediately, and independent of the token contract. Each deposit is a distinct timestamped lot; adding fresh tokens cannot inherit old age. Withdrawals consume the oldest lots first. For each deposit lot, ballot weight is its minimum token amount continuously present throughout the prior epoch, multiplied by its capped complete-week age at the cutoff. Checkpoint this before voting. A withdrawal subtracts the withdrawn lot's outstanding ballot weight from the current tally; redepositing creates a fresh lot. Each eligible unit can vote only once per epoch.

| Completed weeks continuously escrowed | Tier | Weekly participation gain | Weight per token | Cash accrual in default variant |
| --- | --- | --- | --- | --- |
| 0 | Intern | Register, observe the floor, read all books | 0 | USD 0 |
| 1 | Intern | First eligible pool ballot | 1 | USD 0 |
| 2 | Intern | Another tenure week and ballot | 2 | USD 0 |
| 3 | Intern | Another tenure week and ballot | 3 | USD 0 |
| 4 | Broker | Broker face frame and eligibility to propose a whitelisted lane | 4 | USD 0 |
| 5 through 11 | Broker | Another weekly ballot and dated episode attendance | 4 | USD 0 |
| 12 and later | Partner | Partner face frame; same bounded budget powers | 4 | USD 0 |

Partner is narrative status, not ownership in a business or a right to its cash. Attendance is an opt-in onchain acknowledgment of that epoch's report hash; the acknowledgment window expires at the next epoch. It gives no financial weight, discount, transferable collectible or prize. It cannot be a paid bot-farming ritual.

| Selling or leaving cost | Amount or effect | Reason |
| --- | --- | --- |
| Pool fee on one sale | 1.25% of sale input | Same fee as buying |
| Additional hook fee / token tax / escrow exit fee | 0% / 0% / 0% | No punitive exit mechanism |
| Gas and execution impact | Variable; quote before signing | Market costs, not a tenure penalty |
| Withdrawing the founding minimum | Ends active founding credential | Historic event remains visible; current badge needs continuity |
| Withdrawing aged lots | Removes their future voting weight and active tier eligibility | Sold or withdrawn age cannot be used again |

## (c) Why trade

Trade when execution, a different quote asset or rebalancing is useful. The measurable common gain is fee-funded activity recorded in the books, not a payment to the trader. Volume is not a competition. No trade count, gross volume or self-referral earns points.

| External volume increment | Trader pool cost | Vault launching-side cash | Network cash | Default buyback budget from this fee | Default liquidity budget | Default operating reserve |
| --- | --- | --- | --- | --- | --- | --- |
| USD 100 | USD 1.25 | USD 1.00 | USD 0.25 | USD 0.50 | USD 0.35 | USD 0.15 |
| USD 1,000 | USD 12.50 | USD 10.00 | USD 2.50 | USD 5.00 | USD 3.50 | USD 1.50 |
| USD 10,000 | USD 125.00 | USD 100.00 | USD 25.00 | USD 50.00 | USD 35.00 | USD 15.00 |

Separate Portfolio LP fees feed the buyback bucket in full after the fixed network split; the same receipt cannot also be a launching-pool receipt. For an equal-size buy and sell, fees alone consume approximately the following amount, before gas and impact.

| Wash-trading calculation | Result |
| --- | --- |
| Input cash for illustration | USD 1,000 |
| Cash remaining at unchanged quotes after both fees: input * (1 - 0.0125)^2 | USD 975.15625 |
| Fee-only cash consumed | USD 24.84375 |
| Direct trader reward in default variant | USD 0 |
| Reward for wash volume in optional variant | USD 0 |

A holder cannot claim any portion of that fee merely by trading. Even a holder eligible for the flagged option receives only time-proportional participation funding, never volume reimbursement. The vault owns its designated LP positions; a trader cannot regain fees by supplying just-in-time liquidity there. An arbitrageur can act on an existing discrepancy only when it exceeds combined trading costs and execution risk; the Firm makes no such opportunity promise.

## NARRATIVE

Rex Belljaw is entirely invented. He was the loudest junior broker in a fictional nineties boiler room until he discovered that his own sales patter concealed where the fees went. He now walks onto the floor with the same huge grin and a new obsession: every boast must point to contract state. He is a narrator, never a named founder, team member, owner or treasury signer. His enemy is the fictional Closed Door Syndicate: old-money banking secrecy, brittle paper-hand theatrics and mechanical launch-bot noise, shown as situations and abstract props, never real people or social groups. His belief: "A mouth can sell a story. Only the books can show the bill."

His voice is short, noisy and mildly profane, with the joke usually on his own swagger. No insults at people, demographic jokes, stock-film quotations or borrowed mascot family. The conflict keeps changing: opening a trading floor is easy; keeping it inspectable when nobody is applauding is the serial story.

| Season beat | Actual loop event required | Episode and character movement | If the event does not happen |
| --- | --- | --- | --- |
| Week 1: Open Mouth | First executed vault buyback to dead address and first report settlement | Rex rehearses a giant speech, then gives the contract the final word; founding partners inspect the first books | Episode is "All Mouth, Budget Pending"; show the zero or deferred execution and guard reason |
| Month 1: Another Door | First funded USDC Portfolio pool after eligibility and budget gates | Rex discovers that a trading floor needs useful routes, not louder shouting; holders pick the first eligible lane | Show the accumulated budget and delayed pool; do not fabricate a launch |
| Month 3: The Quiet Floor Test | Cumulative external volume milestone and latest executed buyback report | Rex faces a silent floor and keeps the report ritual anyway; Partner holders challenge his narration against the books | Lower activity becomes the conflict; show actual volume rather than moving the goalpost |

| Season target, not a promise | Number | Accounting boundary |
| --- | --- | --- |
| First-season chapters | 12 weekly chapters | Chapters can report inactivity |
| Month-three volume milestone | USD 5,000,000 cumulative | Outside launch and Portfolio volume only; not vault swaps |
| Month-three active holding cohorts | 3 tiers | Status only |

Between these anchors: each week a floor challenge explains one pool, a guarded execution, a delayed fill, a vote outcome or a fee reconciliation. The audience can dispute Rex with the exact report hash. Base participants gather to compare routes, debate bounded pair budgets, learn to read a vault and turn each other's verification into character scenes. Read-only spectators are welcome. Holding provides a repeated decision, rather than requiring paid engagement or a stream of new buyers.

### Ten ready posts or replies

| Post | Copy in Rex's voice |
| --- | --- |
| A | "BIG MOUTH. OPEN BOOKS. Even my haircut has less cover than this vault." |
| B | "The bell rang. The contract spoke. I was briefly unemployed as a loudspeaker." |
| C | "Show the damn books. Mine are already open." |
| D | "New quote lane? Put it to the floor. My shouting is not a voting system." |
| E | "The velvet rope is decorative. Reading the Firm costs no admission." |
| F | "Buyback deferred. The guard said no. Apparently my jaw is not an oracle." |
| G | "Quiet week. Same open books. I brought my indoor voice. It broke." |
| H | "Your tier is a seat at the conversation. My chair does not print money either." |
| I | "Bot noise cannot age a position. The clock ignores my sales pitch too." |
| J | "A new pool gets an episode after it gets funded. My ego can wait outside." |

## Payout option beside the no-payout design

Default A launches with no player payouts. Its useful actions, holding tiers, ballots and story all work without them. Optional B is a separate, prelaunch-selected configuration; it is not an announced entitlement or a later switch that can divert locked A budgets. Neither variant changes the token or the fixed fee split.

| Cash source and split | Default A: no payouts | Optional B: holder participation pool |
| --- | --- | --- |
| Launching-side cash to buyback | 50% | 40% |
| Launching-side cash to liquidity | 35% | 30% |
| Launching-side cash to players | 0% | 15% |
| Launching-side cash to expense reserve | 15% | 15% |
| Separate Portfolio LP cash to buyback | 100% | 100% |
| Separate Portfolio LP cash to other buckets | 0% | 0% |

B would allow holders who voluntarily escrow for a full prior epoch and acknowledge its report to claim a bounded share of that epoch's actual player budget. Use token-seconds, with no per-wallet minimum grant, streak multiplier or randomized selection. Amount is player budget times eligible token-seconds divided by total eligible token-seconds. Splitting wallets does not increase it. Claims expire at the end of the following epoch; unclaimed amounts go to the liquidity bucket, never to a team wallet. No eligible participation means no allocation to players; that budget goes to liquidity. No staker can demand payment from token principal or from a future fee stream. The model shows the maximum funded optional pool assuming full eligibility and claims, not an amount payable to any holder.

Legal risk: marketing a funded participation payment can create an expectation of income and may raise securities and other regulatory issues. This is a risk assessment requiring jurisdiction-specific review, not a legal conclusion [R14]. Keep A as the launch choice; B is only a flagged design comparison. Neither public posts nor artwork advertises B.

## Flywheel bar: roles, abuse and risks

| Role | Why act | What is visible onchain |
| --- | --- | --- |
| Early buyer | Join the first season and first budget decisions | Purchase fill, escrow timestamp, founding credential eligibility |
| Holder | Build tenure and influence bounded new-market spending | Deposit lots, tier age, checkpoint weight, vote, allocation |
| Trader | Execute a wanted swap using the available quote routes | Pool input, output, fee and adapter credits |
| Arbitrageur | Reconcile a discrepancy after considering costs | Both route fills, fee costs and inventory movement |
| Developer | Build a credible first launch and meet obligations | Single allocation transfer, manual dead-address transfer, whitelist delay, published code hash |
| Swarm | Build reusable components, art and checks for its allocation | Allocation receipt and later custody or sale transactions; work hashes |
| IMD | Demonstrate inspectable agent coordination and reusable specifications | Artifact hashes and proposed release provenance; no extra token allocation |

| Abuse | Proposed control and reason | Residual limitation |
| --- | --- | --- |
| Wash trading | No volume rewards; count fees only once; permanently vault-owned LP; external-volume labels | Chain cannot reliably identify every common beneficial owner; never claim a human-user count |
| Buyback sandwich | Permissionless executor uses prior-window TWAP, output floor, per-epoch cap and depth cap; split budget across executions | Public swaps still face MEV; stale or manipulated oracle disables execution rather than forcing a fill |
| Early-tier sybils | Broad time window; no first-wallet bounty; founding status has no cash rights; linear token-time | Cosmetic duplicate wallets remain possible; do not market sybil-proof identity |
| Whale pair vote | Linear checkpoint voting, quorum, asset caps, bounded new-budget discretion and delayed whitelist | A whale can win a permitted choice; neither principal nor arbitrary assets become withdrawable |

| Execution guard | Design setting | Reason |
| --- | --- | --- |
| TWAP observation window | 60 minutes | Avoid using a single current swap quote |
| Oracle minimum seasoning | 7 days | New pools cannot immediately supply an execution reference |
| Maximum stale oracle age | 15 minutes | Failed data pauses an execution |
| Minimum output versus independent reference quote | 99.5% | Reject unexpectedly expensive fills; not an execution guarantee |
| Buyback slice cap | Smaller of USD 250 equivalent and 0.1% of executable quote-side reserves | Limits the amount exposed in one fill |
| Total epoch spend cap | Accrued bucket only | Cannot borrow from principal or another bucket |
| Minimum executable bucket | USD 25 equivalent | Aggregate tiny balances rather than waste execution gas |

The independent reference must use a seasoned external route and authenticated quote-asset oracle; launch-pool TWAP alone is insufficient. Until coverage exists, the first buyback can be delayed. Depth, slippage and oracle coverage gates take precedence over calendar events and model assumptions.

| Principal risk | What can go wrong | Answer and remaining exposure |
| --- | --- | --- |
| Impermanent loss | Portfolio LP inventory can underperform holding its two assets; fees may not cover the difference | Full-range positions, small initial lanes and budget caps; report inventory and fees separately. No leverage, no insurance or protection claim [R2] |
| Concentration and administration | Developer temporarily controls the large allocation; swarm and retained developer tokens can be sold; quote issuers can freeze | Show pending manual action, wallet concentrations and administrator powers. Immutable vault principal restrictions cannot prevent a token-holder sale or issuer action [R0, R11] |
| Demand and execution failure | Volume can disappear; sandwiching, bad oracle data or contract faults can interrupt spending | Finite startup expense reserve, adaptive execution, conservative low-volume mode, audit gates and visible queued budgets. At no volume, money activity stops; the books remain readable |

Decisions follow one rule: make the money movement checkable and let the story admit what actually happened. The calendar, badges and jokes cannot override a contract balance or an execution guard.