the seal

what is permanent and what is mutable.

the bytecode at the program's address is sealed. the upgrade authority was revoked at deployment and cannot be reinstated. anyone with a solana z rpc connection can verify this by querying the program account and confirming the upgrade authority field is set to none.

what is sealed

the natural reference distance of 1.414 is a hardcoded i128 constant compiled into the binary. the buffer length of 256 entries is a hardcoded array size. the welford parameters and the integer square root precision are hardcoded constants. the surcharge coefficient that scales the squared deviation into a fee is a hardcoded constant.

the allocation function inside the vault is part of the sealed code. the vault address is fixed at deployment. the program's address is fixed.

what is mutable

the circular buffer of recent transfers is overwritten by the next transfer regardless of who sends it. the running centroid and squared distance are updated in place on every invocation from the current buffer contents. the vault balance grows when surcharges are deposited and shrinks when distributions fire.

these three pieces of state are the only mutable elements on chain. nothing else changes after deployment. the protocol's behavior is a deterministic function of the trade stream and nothing else.

there is no admin key. there is no governance forum, no token vote, no multisig sitting on the vault. the protocol is a function of whatever the chain produces.