Checkpoints

After each settlement two independent validators approve an identical Merkle root over every account's cumulative entitlement. Amounts never decrease, every prior account stays included, and older roots remain valid. The vault pays the difference between the proven cumulative amount and what it has already paid.