Custody and the exit

Who holds what

• The organism wallet holds the claimed fees (the treasury, the battery's ETH and any dev share not yet paid). Its private key is in the .env of whoever runs the organism. In the self-hosted version that is you.
• Terrarium holds nothing. There is no Terrarium contract, no admin key, no server that receives a key, a fee or a deposit.
• Pons holds the fees in its escrow until the recipient claims them.

This means two things you should say out loud before running one:

1. Whoever has the .env can move everything the wallet holds. The organism's caps limit the organism, not the person with the key.
2. If you lose the key you lose the wallet. Nobody can recover it.

What the wallet sends out

Only three things: burns (a buy whose output goes to the burn address), the dev share to the one address in the settings, and the exit command. The live executor refuses to pay any other address.

Your own wallet

When the organism runs with your own wallet's key, the program can move nothing but the project's share: burns above the project treasury are refused by the executor itself, and the dev share, the ETH already in the wallet and your tokens are not spent. Do not use the exit command on that wallet unless you mean to empty it: it sends the whole balance.

The exit

One command claims whatever is waiting in the Pons escrow for the wallet, then sends all its ETH, minus the gas of that transfer (0.0005 ETH), to an address you choose.

node engine/rescue.mjs 0xYourAddress           # preview: shows what would be sent, sends nothing
node engine/rescue.mjs 0xYourAddress --yes     # does it

It reads TERRARIUM_KEY from .env. It does not need the runner and does not touch the journal.

Changing who receives the fees

The coin's current creatorFeeRecipient can hand the role to another address with the Pons factory's transferCreatorFeeRecipient(token, newRecipient). That is how a coin leaves an organism: the fees stop reaching the wallet from that moment.

A hosted version

A platform that runs organisms for other people would hold their keys, which is custody. This version does not do that. If one is built it will have to say so on every page, and the exit above will have to exist for it.

The coin itself

The organism never sells the coin and never holds it: what it buys is sent to the burn address in the same transaction. There is nothing to rug from the organism's side. The coin's creator, or whoever holds a large part of the supply, is a separate matter that Terrarium does not change.