Settlement invariants - Pesa

The seam

Every payable order is backed by exact, liquid, reserved native Stellar USDC in the escrow. Bridge receipts, pending deposits and yield positions are permanently outside the settlement trust boundary. No settlement escrow exists on any chain but Stellar. The admin has no sweep function, and no omnibus wallet holds users’ funds.

Trades

ID	Rule
I6	An order is payable only against liquid, reserved USDC: `amount ≤ total_deposited − locked` at lock, and `Σ locked ≤ Σ total_deposited ≤ escrow balance` across depositors.
I7	Anything that can block a release fails before the taker pays fiat.
I3	Each rail transaction and nullifier credits at most once.
I9	No privileged path moves escrowed USDC to anyone but the order’s taker or the depositor.
I5	Reserved and locked funds are never deployed to yield.
I10	USDC and USDT stay distinct until a route reports native Stellar USDC.

Transfers

ID	Rule
I1	Credited Stellar USDC equals observed route outputs, less withdrawals and settled trades.
I2	Pending, attested and merely observed deposits never count as balance. Credit comes only from an observed Stellar transfer to the owner for the exact amount.
I3	Each source burn and each CCTP nonce credits once.
I4	Every credit binds source chain, source address, amount, beneficiary and destination.

Exit paths

Unlocked USDC: escrow.withdraw, depositor’s signature only.
Locked, paid, proven: fulfill_intent with a valid claim pays the taker.
Locked, paid, not proven: depositor_release by the depositor pays the taker.
Locked, not paid: expire_intent by anyone after settle_by returns it to the depositor.

Stated exactly: unlocked principal is withdrawable by the depositor alone. USDC locked to an open order is released to the taker on a verified claim or by the depositor, or returned to the depositor on cancel or expiry.