The vault

A program-derived address with no private key behind it. Funds inside move only when the program checks a one-time hash-based signature on chain, and never before the unlock time written into the vault's own address. One spend per key: whatever you leave rolls straight into a fresh vault. The program is upgradeable only until its audit, then frozen.