Design commitments

Eight properties the contracts enforce structurally, rather than promise. Each one is a thing the source does or refuses to do, and each is checkable by reading the file named next to it. None of them is a security claim: they say what the code is shaped like, not that the code is free of bugs.

• Locked liquidity has no exit. Neither AgiLaunchLocker nor AgiV2LaunchLocker exposes a withdraw, a transfer, a burn or an arbitrary-call function. Once a position NFT reaches a locker there is no code path that sends it anywhere else — not for the owner, not for the creator, not for anyone.
• Nothing is upgradeable. There are no proxies anywhere in either tree. A fix means a new deployment; the old one keeps running exactly as it is, which cuts both ways and is why the Addresses section matters.
• Launch tokens have no admin. AgiLauncherToken and AgiV2LauncherToken are fixed-supply ERC-20s with no mint, no pause, no blacklist and no owner. Name, symbol and metadata are set in the constructor and never move. V1's temporary max-wallet and max-transaction window is the only extra rule, and it expires by block number.
• A launch's economics freeze at launch. Each curve receives its fee, creator tax, phantom reserve, graduation threshold and fee policy as constructor immutables, and the factory snapshots the pool fee, the tick spacing and the fee policy per launch. An owner retuning anything afterwards governs later launches only. A creator can also pin the exact terms they were quoted with expectedEconomics, so a change cannot land underneath an in-flight launch.
• Fees are pulled, never pushed. AgiV2FeeEscrow is a ledger: claim() pays msg.sender and nobody else, so no privileged account can route somebody else's accrued fees to itself, and a recipient that cannot receive a transfer cannot wedge anyone else's payout.
• The ceilings are constants, not settings. Every MAX_* bound listed under Fee schedule and caps is declared constant. No owner call moves them. Only a different deployment could, and a different deployment is a different address.
• Graduation is permissionless and cannot strand reserves. Both phases are open to any caller, and the second is retryable: a launch stays in the Swept phase until a pool seed actually succeeds. Anyone blocked by a wedged launch can settle it themselves rather than wait for us.
• Model V2's ownership cannot be renounced. renounceOwnership() reverts with OwnershipCannotBeRenounced on AgiV2LaunchFactory, AgiV2MemeHook, AgiV2LaunchLocker and AgiV2BuybackVault. That is deliberate, and it is not a comfort: an ownerless V2 could never rotate a fee sweep operator or recover a creator's fee recipient, so the powers in Owner powers are permanent until the owner hands them to somebody else, two-step. Model V1 does not do this — its factory and locker can be renounced, with the consequences set out there.