Core invariants

Configuration and identity

1. A canonical launch was created by the pinned launch factory through D17Factory.
2. A locker's rules-sensitive actions require the expected launch identity, WETH, rules hash, and canonical factory record.
3. Launch configuration and its rules hash do not change after construction.

Supply

4. sale + LP + creator distribution + dead = max supply exactly.
5. Creator distribution is at most 10%; treasury at most 20%; ordinary refund penalty at most 50%.
6. Minting closes and token ownership is renounced during launch creation.
7. Pre-trading transfers and ordinary holder burns are blocked; only the launch's narrow unsold-sale burn path is permitted.

Custody and refunds

8. Committed WETH remains accounted in the participant's locker until refund or settlement.
9. Ordinary refund policy is fixed by round: free 1–2, configured percentage 3–4, no window 5.
10. Failed launches provide a permanent full-refund path.
11. Withdrawal recipients are fixed to the locker owner.

Liveness and settlement

12. Finalization of a successful launch is permissionless after the rounds; a permanently failed launch uses the full-refund path and cannot be finalized.
13. No all-settled condition blocks pool creation; allFinalCommitmentsSettled is only a metric.
14. After the fixed grace boundary, anyone may settle a known locker without redirecting its proceeds.
15. Settlement does not expire and uses the same sale-token entitlement and configured WETH split before or after pool creation.

Liquidity

16. Initial LP-token use is proportional to liquidity WETH already settled.
17. LP tokens reserved for unsettled lockers cannot be released beyond the configured LP allocation.
18. A late settlement transfers reserved tokens and liquidity WETH into the official pair atomically.
19. Every protocol LP token is minted to the launch vault, which has no LP withdrawal path.
20. The official pair cannot already have live supply or be preseeded with the D17 token at creation.