Every credit, accounted for.

Credits are created only when USDT arrives in the vault. There is no admin mint, and the USDT is never lent out. These numbers are read from the contract every 15 seconds.

USDT held by the vault

Everything it owes

User balances: …
Held for running jobs: …
Claim links: …
Unpaid company earnings: …
Network fees: …

USDT bought into credits

…

Credits spent in apps

…

Paid out to companies

…

Apps on the network

…

The check.

The vault keeps a running total of everything it owes and compares it with the USDT it holds. Anyone can call totals() on the vault and compare its liabilities with the vault's USDT balance, straight from the chain.

USDT held by the vault
   =  user balances
    + held for running jobs
    + claim links
    + unpaid company earnings
    + network fees

What can't happen.

No one can create credits without paying USDT into the vault.
No app can charge a user past the limit that user signed.
Only an app's own signer key can charge for it. The network's operator key can't charge anyone, redirect a payout or raise an app's fee.
Payouts go only to an app's own payout address, and keep working even if the vault is paused.