Full-Ledger Post-Trade Accounting

Multiswap uses double-entry accounting. Every posting is balanced within one token ledger: the debit and credit contain the same amount of the same token. A cross-token action is therefore a collection of balanced same-token journal entries, never one debit in token $A$ and one credit in token $B$.

Accounting conservation is always required. Safety is a second question: after the complete atomic action has been posted and the price-forming state has been updated, did the pool move in the permitted projective direction?

This article gives the full-ledger test and explains why many journal entries cancel before the safety calculation.

1. Price-forming state

For each Reserve Asset $i$,

$$s_i=c_i a_i^{e_s}, \qquad P_i=c_i a_i^{-e_P}, \qquad e_P=1-e_s,$$

with $0<e_s<1$. The LP Token is the derived claim on the Reserve:

$$s_0=\sum_i s_i, \qquad P_0=\frac{s_0}{a_0}, \qquad c_0=\frac{s_0}{a_0^{e_s}}.$$

The safety-relevant coordinates are $(a_i,s_i)$ for every Reserve Asset $i$ and for the LP Token $i=0$.

An account may hold token $i$ without forming its price. Surplus, Treasury custody, Rewards custody, and a payable denominated in token $i$ inherit $P_i$. Their marked scales are derived from their token amounts and the Reserve price.

2. Atomic journals stay inside one token ledger

If an action exchanges $A$ for $B$, its accounting contains at least one balanced $A$ journal and one balanced $B$ journal. Schematically,

Token ledger	Debit amount	Credit amount
$A$	$da_A$	$da_A$
$B$	$-da_B$	$-da_B$

The table is not a cross-token journal. Each row balances independently in its own token.

The action endpoint is evaluated atomically. Repricing is applied to the completed endpoint, not to an arbitrary ordering of its bookkeeping entries.

3. Exact matched price-taking pairs cancel

Suppose CavalRe owns CAV held in Surplus. The funding entry is

Debit	Credit
Surplus CAV	CavalRe Payable CAV

If both balances contain the same amount $a_{\mathrm{CAV}}^{\mathrm{Surplus}}$, their net marked contribution is

$$a_{\mathrm{CAV}}^{\mathrm{Surplus}}P_{\mathrm{CAV}} -a_{\mathrm{CAV}}^{\mathrm{Surplus}}P_{\mathrm{CAV}} =0.$$

After any repricing,

$$a_{\mathrm{CAV}}^{\mathrm{Surplus}}P_{\mathrm{CAV}}' -a_{\mathrm{CAV}}^{\mathrm{Surplus}}P_{\mathrm{CAV}}' =0.$$

The cancellation is exact because the debit asset and credit liability are equal amounts of the same token and inherit the same token price.

This gives a precise screening rule:

A balanced journal entry that changes neither $(a_i,s_i)$ nor $(a_0,s_0)$ has no immediate effect on the projective safety coordinates.

The journal must still be posted and retained for ownership, authorization, solvency, and auditability. It drops only from the immediate repricing inequality.

The cancellation does not apply when amounts differ, the credit is denominated in another claim, either side has an independent price, or the entry changes a Reserve or LP Token amount or scale.

4. Gauge-invariant safety

The claim-free Reserve--LP balance sheet gives

$$\frac{s_i}{s_0} =\frac{c_i}{c_0} \left(\frac{a_i}{a_0}\right)^{e_s}.$$

Summing over Reserve Assets gives

$$\sum_i\frac{c_i}{c_0} \left(\frac{a_i}{a_0}\right)^{e_s}=1.$$

The projective safety condition for an atomic action is

$$\boxed{ \frac{c_i'}{c_0'} \le\frac{c_i}{c_0} \quad\text{for every Reserve Asset }i. }$$

Only ratios appear. Multiplying all scales and coefficients by one positive common factor does not change the test.

5. Why the condition protects LP backing

The endpoint balance identity and the safety inequalities imply

$$1\le\sum_i\frac{c_i}{c_0} \left(\frac{a_i'}{a_0'}\right)^{e_s}.$$

Using the opening balance identity, this becomes

$$1\le\sum_i\frac{s_i}{s_0} \left(\frac{a_i'/a_0'}{a_i/a_0}\right)^{e_s}.$$

Because $x^{e_s}$ is concave, Jensen's inequality gives

$$\boxed{ \frac{\sum_i P_i a_i'}{a_0'} \ge\frac{\sum_i P_i a_i}{a_0}. }$$

The final Reserve basket per LP Token cannot be worth less at the opening Reserve prices.

The ratio inequalities also compose. If every atomic action makes every $c_i/c_0$ nonincreasing, the same is true across every finite sequence. Round trips and subsequent actions require no separate exception.

6. Per-entry safety procedure

For each atomic protocol action:

1. Write every same-token debit and credit entry. Do not net away the journals.
2. Verify equal token amounts on the debit and credit sides of every token ledger.
3. Identify every posting that changes $(a_i,s_i)$ for any Reserve Asset or $(a_0,s_0)$ for the LP Token.
4. Cancel only exact matched price-taking asset--liability pairs in the safety calculation.
5. Reconstruct the complete post-action price-forming endpoint.
6. Require positive reserves, positive scales, and every operation-specific admissibility condition.
7. Enforce

$$\frac{c_i'}{c_0'}\le\frac{c_i}{c_0}$$

for every Reserve Asset $i$.

This is a per-action test, not a claim that each individual debit or credit is independently safe. Safety belongs to the complete atomic endpoint because one action can contain several balanced token journals that jointly determine the price-forming transition.

7. Closed and open systems

Swaps and liquidity operations are closed in the Reserve--LP state. Their price-forming journals remain inside the system described by $s_0=\sum_i s_i$, so their safety follows directly from the ratio test.

An open action can also contain external assets and liabilities. It reduces to the same closed proof when every external component is an exact same-token matched pair and its creation, repricing, and settlement cancel identically. The remaining price-forming core must still pass the ratio test.

Externally owned Surplus has exactly this form. Surplus CAV and CavalRe Payable CAV cancel at every CAV price. A pure Surplus sale changes no Reserve or LP Token coordinate. A mixed sale changes only the Reserve fractions, whose complete endpoint must pass the projective test.

More general liabilities do not automatically cancel. Independently priced claims, unmatched payables, owner distributions, and administrative changes to price-forming state require their own explicit model before they can inherit this theorem.

Conclusion

Double entry supplies conservation. The projective ratio supplies direction.

Every journal remains visible and balanced inside one token ledger. Exact matched price-taking pairs cancel under repricing. The safety calculation then focuses on all and only the entries that change $(a_i,s_i)$, including $i=0$, and accepts the atomic endpoint exactly when

$$\boxed{ \frac{c_i'}{c_0'} \le\frac{c_i}{c_0} \quad\forall i. }$$