One wallet per coin. Each coin's fees end up in an address of their own, the coin's sub-wallet, which is also the owner of the coin's Lighter account. Funds for one coin can never touch another coin's position, and every sub-wallet is public on the explorer.
Adoption. The hook fixes where a pool's fees go at initialization and has no setter, so the launch gives it the coin's fee sink, cloned in the same transaction. The keeper then points the sink at the coin's sub-wallet. After that first step the keeper key cannot move it: only the router's owner can, the recovery path for a sub-wallet that became unusable, and the sink exposes no way to touch the fee matrix the launch set. Until it is pointed, fees simply accumulate in the sink. The coin's page shows its sink and where its fees are going at any time.
Who holds the keys. Sub-wallet keys are derived deterministically from a single master secret, an HMAC-SHA256 over the token's address, so they exist only inside the keeper process. Never stored in a database, never handed to a browser, never shown to the person who launched the coin.
Why nobody can drain the position. Each coin's Lighter account is opened under its own sub-wallet, and Lighter only accepts orders signed by the account's key. A creator cannot drain, close, or borrow against the position backing their coin, and neither can the creator of any other coin. The backing is operated by the keeper on a fixed policy, in public, or not at all.