> ## Documentation Index
> Fetch the complete documentation index at: https://shield.fi/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rounding, overflow, and invariants

> Integer safety rules that a current Shield Swap quote engine must preserve.

## Numeric domains

* Native token amounts, liquidity, owed balances, and protocol fees use `u128`.
* Square-root price and fee growth use `u256::U256`.
* Liquidity net uses `i128`.
* Fee pips use a one-million denominator.
* Q128.128 values use a `2^128` denominator.

## Rounding direction

The contract chooses floor or ceiling per operation. Funding calculations commonly round required input up. Output and fee entitlement calculations commonly round down. Copy the implementation, including operation order, instead of simplifying formulas algebraically.

## Saturating amount helpers

`amt0_x128_sat` and `amt1_x128_sat` return an amount and overflow flag. A caller must use the flag. It must not treat `u128::MAX` alone as evidence of overflow.

## Liquidity safety

`LIQ_AMOUNT_SAFE_CAP` bounds positions so amount deltas fit through the complete tick domain. Pool creation also applies a net-liquidity-sum cap based on tick spacing. Mint and increase enforce the stored per-tick cap at both boundaries.

## Swap invariants

* Price never moves past the user limit.
* A bounded partial fill never jumps past the next initialized tick.
* Input consumed, fee charged, refund, and output use the same capped arithmetic path.
* Zero fee-adjusted input is refunded.
* Stored tick, price, active liquidity, and outside fee-growth crossing parity remain consistent.
* Multi-hop continuity is checked by concrete token ID.

## Position invariants

* Lower tick is less than upper tick.
* Both ticks align with spacing and lie in the user domain.
* The NFT fields bind token ID, pool, range, owner, and immutable withdrawal address.
* Burn requires zero liquidity and zero owed balances.

Property tests, source vectors, and accepted-network tests should cover all branch boundaries. Floating-point agreement at ordinary values does not prove transaction equivalence.