> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pesapay.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Settlement invariants

> The rules every fund path must keep. Each change to a fund path names the invariant it preserves.

## The seam

Every payable order is backed by exact, liquid, reserved native Stellar USDC in the escrow. Bridge receipts, pending deposits and yield positions are permanently outside the settlement trust boundary. No settlement escrow exists on any chain but Stellar. The admin has no sweep function, and no omnibus wallet holds users' funds.

## Trades

| ID | Rule |
| - | - |
| I6 | An order is payable only against liquid, reserved USDC: `amount ≤ total_deposited − locked` at lock, and `Σ locked ≤ Σ total_deposited ≤ escrow balance` across depositors. |
| I7 | Anything that can block a release fails before the taker pays fiat. |
| I3 | Each rail transaction and nullifier credits at most once. |
| I9 | No privileged path moves escrowed USDC to anyone but the order's taker or the depositor. |
| I5 | Reserved and locked funds are never deployed to yield. |
| I10 | USDC and USDT stay distinct until a route reports native Stellar USDC. |

## Transfers

| ID | Rule |
| - | - |
| I1 | Credited Stellar USDC equals observed route outputs, less withdrawals and settled trades. |
| I2 | Pending, attested and merely observed deposits never count as balance. Credit comes only from an observed Stellar transfer to the owner for the exact amount. |
| I3 | Each source burn and each CCTP nonce credits once. |
| I4 | Every credit binds source chain, source address, amount, beneficiary and destination. |

## Exit paths

* **Unlocked USDC:** `escrow.withdraw`, depositor's signature only.
* **Locked, paid, proven:** `fulfill_intent` with a valid claim pays the taker.
* **Locked, paid, not proven:** `depositor_release` by the depositor pays the taker.
* **Locked, not paid:** `expire_intent` by anyone after `settle_by` returns it to the depositor.

Stated exactly: unlocked principal is withdrawable by the depositor alone. USDC locked to an open order is released to the taker on a verified claim or by the depositor, or returned to the depositor on cancel or expiry.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.