Leak traps and slashing
Every buyer’s view carries fake rows that exist nowhere else.
When a buyer's view opens, the room plants trap rows in it: fake names, emails, phone numbers and URLs, each carrying a random secret. It posts the merkle root of the view's trap rows on Solana before the view answers its first query.
A leak is a proof. Nobody else's view holds those rows, so anyone who knows one must have seen that view. Whoever finds one outside (a fetched URL, a mail to a trap address, a string in a published model) reveals the secret and its merkle proof. That opens a case and freezes the buyer's deposit.
48 hours. The buyer can dispute within 48 hours. Without a dispute, anyone can finalise the case and the whole deposit goes to the owners' payouts.
The room's own traps. The room also keeps trap rows no buyer ever sees. If one of those leaks, the room itself leaked: its operator's stake is slashed, half burned and half paid to the owners.