| Owner Safe, a 2-of-3 Safe | Owns every Mountain contract that has an owner. Sets Mountain’s settings. Re-points unlocked registry entries. Starts issuance, which it can do only once. Unpauses anything. Ends or pauses the founding sale. Runs buyback and vault steps. Sends CSM or ETH from the Hayloft |
| Treasury Safe | Spends its own funds. It gets 166,500,000 CSM at genesis, the Gatehouse’s 70% after net-buying Treks, a share of the sale ETH and the Deed royalty. No Mountain contract can spend from it, and no code locks it |
| Team Safe | Receives the team’s 15% of the Gatehouse and Base Camp’s pool fees, at launch settings. The owner Safe can change both receivers at once |
| Cashmere wallet | Receives the ETH of every founding Barn buy. Sends the launch transaction and pays the Public rebates. The owner Safe can do both too |
| Guardian | Can only pause. Only the owner Safe can unpause |
| Operator key | Runs Base Camp buyback and Avalanche vault steps, as the owner Safe can. It can do nothing else |
| Mountain’s filler account | Fills the Shepherd orders that name it |
