The four funds, and who may move them

This is the section the architecture exists for. Every fund is on the Asset Hub. Every authority is on the People chain. Read each row as a sentence: this office proposes, this body decides, this vault pays.

9.1 The map

9.2 What the vaults refuse

Three of the five vaults name exactly one chain they will accept instruction from: the People chain. Not the relay. Not root. Not a key. The airdrop pot, the presale pot, and both PEZ pots are configured with an origin that matches the People chain's location and has no root arm at all.

The consequence is worth stating plainly: the relay's superuser cannot spend the airdrop, the presale, or either PEZ pot. It can halt the chain, it can upgrade the runtime, it can reject a proposed spend — but it cannot pay itself. To move that money it would have to become the People chain, and the People chain is a register of elected offices.

The HEZ treasury is the exception and is documented as such: root can spend it without limit. It is the fund of last resort and it is the one place where the network's own governance, rather than the state's, holds the purse.

9.3 A payment, end to end

The airdrop path shows the whole shape:

1. The Prime Minister proposes an amount and a beneficiary.
2. The President approves. If the amount exceeds one million HEZ, the Treasurer must also sign, and the payment cannot execute for seven days after the last signature — a cooling period proportional to the size.
3. Anyone may then execute. Execution is permissionless because every discretionary decision has already been made and recorded; what remains is arithmetic, and arithmetic should not wait on a signature.
4. The People chain sends a message to the Asset Hub naming the pot, the beneficiary and the amount. The pot's origin check confirms the sender is the People chain.
5. The beneficiary collects, within the payout window.

Every step is an event. The proposal names its proposer, the approval names its approver, and the amount is on the wire in the clear.

9.4 The budget

The government pot is not spent proposal by proposal. The Parliament passes a budget, which credits an approved figure; the Finance Minister then spends against that figure and cannot exceed it. This is the ordinary shape of public finance, and it is enforced by a bound rather than by an audit after the fact.

9.5 The citizens' share

The incentive pot is distributed per epoch, weighted by trust: a citizen's share is their trust score over the network's total active trust, times the epoch's pool. Ten percent of each epoch is reserved for holders of role badges. Unclaimed rewards are clawed back after a week so that the pool cannot silently drain into abandoned accounts.

No office signs a citizen's reward. It is claimed, and the arithmetic is the authority.