If WallRoom didn’t load
The room requires JavaScript. The lesson it teaches, in plain text:- A 3-of-5 multisig stablecoin treasury holds 2 self-controlled signers and 3 with an external custodian. Quorum cannot be reached without the custodian, so custody is a real dependency.
- Requiring a replacement signing scheme changes no fact about the treasury — it changes which requirement is binding.
- When quorum is neither confirmed nor ruled out, the answer is
UNKNOWN. Not safe, not blocked.
What this is
WallRoom runs a synthetic world. The treasury, the signer split, and the custody arrangement are invented for teaching. Nothing here observes a real system, and no result establishes an external fact — a controlled world shows how readiness reasoning behaves, not what is true of anyone’s vault. It also invents no score. The outcome is one of four categorical states —AVAILABLE, PARTIAL, BLOCKED, UNKNOWN — because the point is the reasoning
chain, not a number.
The scenario
A multisig stablecoin treasury in an EVM environment, signing withsecp256k1:
That split is the whole point. With a quorum of 3 and only 2 self-controlled signers,
the custodian is load-bearing — a quorum cannot be reached without it. Custody is a
real dependency in this world, not a decorative one.
How the reasoning runs
Two numbers drive the signer requirement:- Confirmed — signers observed able to adopt a replacement scheme.
- Not ruled out — confirmed signers plus the ones nothing is known about.
UNKNOWN is exactly the gap between them: quorum is not confirmed, and not ruled out
either. It is a real state, not a rounding of “probably fine”.
Requiring a replacement changes what is binding
Turning on Replacement signing scheme required changes no fact about the treasury. It changes which requirement is load-bearing. While the current scheme stays valid, signer adoption is latent — nobody has to adopt anything. The moment a replacement is required, that latent property becomes a constraint, and the unknowns that were harmless become material. This is the same idea as Independent Authority: a conclusion is only as strong as what it actually rests on, and changing the question changes what it rests on.Unknown stays unknown
At least one condition in this room is genuinely unobserved, and WallRoom will not resolve it for you.Unknown is not safe, and unknown is not blocked. It means this world does not
contain the information needed to conclude. Two of the controls are three-valued for
exactly this reason — a checkbox cannot express “not observed”, and recording an
unobserved condition as a plain yes or no is the failure this room exists to show.
WorldSplitter
WorldSplitter holds every condition fixed and changes exactly one, then shows both worlds side by side. It highlights the variable that changed and the consequence that followed. A controlled counterfactual is an argument about reasoning, not evidence about the world. Two synthetic worlds differing in one condition demonstrate what that condition decides — they do not establish that any real treasury is in either state.Where to go next
- Migration Readiness — the real tiers this scenario simplifies
- Stablecoin Vault & Vault Simulator — the product surface behind it
- Vault Boundaries & Disclosures — what the vault work does not do
- WallAtlas — the concept map this room sits inside