Gauge-Equivalent Surplus Settlement: A Candidate Model

Historical proposal: This article explores a price-preserving Surplus candidate. The implemented settlement policy uses a reduced-pay second quote and Surplus top-ups; it preserves the direct user payout but can change relative pool prices. See Quote Engine for current behavior.

Obsolete research candidate

This article preserves an earlier large-pool coverage construction for historical context. Its receive-allocation notation and coverage algorithm have been superseded by Two-Asset Surplus Settlement for Token Launches.

Multiswap can hold protocol-owned token inventory in a Surplus account. When a user receives an asset held in Surplus, the protocol would like to deliver some or all of the output from that inventory instead of depleting the asset's pool Reserve.

The settlement source should not change the user's quote. It should not change the relative post-trade prices either. A user exchanging the same amounts against the same opening pool state should reach the same market prices whether the receive tokens come from Reserve, Surplus, or a combination of both.

That goal is harder than moving tokens between accounts. If Surplus protects a receive Reserve while the pool assigns the asset the higher price caused by direct Reserve depletion, the asset appears scarce without becoming scarce. The resulting coefficient expansion falls outside the Post-Trade Elasticity coefficient order.

This article develops a candidate alternative. The key observation is that Multiswap prices have a common scale gauge. Absolute prices depend on the internal scale unit; relative prices do not. Surplus settlement can therefore target a common multiple of the ordinary direct-swap price vector. A single global scale-accumulator update applies that gauge to the full pool without looping over every Reserve Asset. Explicit pay and receive legs then receive their own constant-time compensations.

The candidate has four principal results:

1. the user's direct-swap quote is unchanged;
2. every relative post-trade price equals the direct-swap relative price;
3. every Reserve Asset coefficient remains fixed or contracts;
4. Surplus coverage can be capped so the LP Token coefficient remains safe without minting or burning LP Tokens.

The construction is a research candidate, not implemented protocol behavior. It assumes exact arithmetic, positive reserves and scales, homogeneous elasticity

$$0<e_s<1, \qquad e_P=1-e_s,$$

and fee-free settlement. Fees are outside this candidate model rather than an unresolved part of it. Rounding, account-level authorization, and implementation tests remain open before implementation.

1. Multiswap state

Let a Multiswap pool contain Reserve Assets indexed by

$$i=1,\ldots,n.$$

Reserve Asset $i$ has reserve

$$a_i>0,$$

scale

$$s_i>0,$$

and marginal price

$$\boxed{P_i=\frac{s_i}{a_i}.}$$

Scale is the market-value magnitude assigned to an asset in Multiswap's internal scale unit. The derived market-value weight is

$$w_i=\frac{s_i}{s_0},$$

where the LP Token uses index $0$ and has scale

$$\boxed{s_0=\sum_{i=1}^{n}s_i.}$$

The elasticity coefficient of token $i$ is

$$\boxed{c_i=\frac{s_i}{a_i^{e_s}}.}$$

Equivalently,

$$s_i=c_i a_i^{e_s}$$

and

$$P_i=c_i a_i^{-e_P}.$$

The coefficient identifies the token's elastic curve. A fixed-coefficient reserve change moves the token along that curve. A coefficient change moves the token to another curve.

The coefficient-order conditions are

$$\boxed{c_i'\le c_i}$$

for every Reserve Asset and

$$\boxed{c_0'\ge c_0}$$

for the LP Token.

These conditions certify a state endpoint. A complete transaction must also have funded token movements, balanced value flow, positive state, correct rounding, and authorized account changes.

2. The hypothetical direct swap

Surplus settlement begins by calculating the ordinary direct swap. This hypothetical direct endpoint determines the user's token amounts and the market prices that settlement must preserve.

For each explicit user leg, let

$$da_i^D$$

be the signed token change from the protocol's perspective. A pay leg has $da_i^D>0$, and a receive leg has $da_i^D<0$.

Define the direct reserve multiplier

$$\boxed{ g_i^D = \frac{a_i^D}{a_i} = 1+\frac{da_i^D}{a_i}. }$$

Thus:

• a pay leg has $g_i^D>1$;
• a receive leg has $0<g_i^D<1$;
• a nonparticipating asset has $g_i^D=1$.

An ordinary Post-Trade Elasticity leg keeps its coefficient fixed:

$$s_i^D=s_i (g_i^D)^{e_s}$$

and

$$\boxed{P_i^D=P_i (g_i^D)^{-e_P}.}$$

Post-trade value flow is

$$\boxed{\Sigma_i^D=da_i^D P_i^D.}$$

The ordinary multi-asset quote satisfies

$$\boxed{\sum_i\Sigma_i^D=0.}$$

This direct quote remains the user's quote. Surplus changes the internal settlement sources and the pool's final Reserve state, not the amounts the user agreed to exchange.

3. The actual Reserve endpoint

Let

$$a_i^S$$

be the final Reserve balance under Surplus settlement. Define the actual Reserve multiplier

$$\boxed{g_i^S=\frac{a_i^S}{a_i}.}$$

For a pay asset, some of the user's payment may enter Reserve while the rest goes to Rewards, Treasury, or another protocol account. If $\pi_i^{\mathrm{pay}}\in[0,1]$ is the pay-side Reserve allocation fraction, then

$$\boxed{g_i^S=1+\pi_i^{\mathrm{pay}}(g_i^D-1).}$$

Therefore

$$1\le g_i^S\le g_i^D.$$

For a receive asset, let $\pi_i^{\mathrm{rec}}\in[0,1]$ be the receive-side fraction of the user's output supplied by Surplus. Reserve supplies the remaining fraction, so

$$\boxed{g_i^S=1+(1-\pi_i^{\mathrm{rec}})(g_i^D-1).}$$

Therefore

$$g_i^D\le g_i^S\le1.$$

The ratio $g_i^S/g_i^D$ measures how far the actual Reserve endpoint differs from direct settlement. It is at most one for a pay asset, at least one for a Surplus-funded receive asset, and exactly one for direct settlement or nonparticipation.

4. Gauge-equivalent prices

Multiplying every scale by one common positive factor $\lambda$ gives

$$s_i\longmapsto\lambda s_i$$

for every Reserve Asset and the LP Token. Consequently,

$$P_i\longmapsto\lambda P_i.$$

The aggregate identity remains exact:

$$\lambda s_0 = \sum_{i=1}^{n}\lambda s_i.$$

Every relative price is unchanged:

$$\frac{\lambda P_i}{\lambda P_j} = \frac{P_i}{P_j}.$$

Surplus settlement therefore does not need to reproduce each absolute $P_i^D$. It needs a final price vector in the same gauge class:

$$\boxed{P_i^S=\lambda_S P_i^D}$$

for one common factor $\lambda_S>0$.

Then

$$\boxed{ \frac{P_i^S}{P_j^S} = \frac{P_i^D}{P_j^D} }$$

for every pair of Reserve Assets.

The direct quote is also unchanged. Since

$$\sum_i da_i^D P_i^D=0,$$

the gauge-equivalent endpoint satisfies

$$\sum_i da_i^D P_i^S = \lambda_S\sum_i da_i^D P_i^D = 0.$$

Thus the user exchanges the same token amounts at the same complete relative-price endpoint.

5. Choosing the safe gauge

At the candidate endpoint,

$$P_i^S = \lambda_S P_i (g_i^D)^{-e_P}$$

and

$$a_i^S=a_i g_i^S.$$

The final scale is

$$s_i^S = a_i^SP_i^S = s_i\lambda_S g_i^S(g_i^D)^{-e_P}.$$

The final Reserve Asset coefficient is therefore

$$\begin{aligned} c_i^S &= \frac{s_i^S}{(a_i^S)^{e_s}}\\ &= c_i \lambda_S g_i^S(g_i^D)^{-e_P}(g_i^S)^{-e_s}\\ &= c_i \lambda_S \left(\frac{g_i^S}{g_i^D}\right)^{e_P}. \end{aligned}$$

Choose

$$\boxed{ \lambda_S = \left( \max_i\frac{g_i^S}{g_i^D} \right)^{-e_P}. }$$

Because nonparticipating assets have $g_i^S/g_i^D=1$, the maximum is at least one and

$$0<\lambda_S\le1.$$

For every Reserve Asset,

$$c_i^S = c_i \left( \frac{g_i^S/g_i^D}{\max_j(g_j^S/g_j^D)} \right)^{e_P} \le c_i.$$

Therefore

$$\boxed{c_i^S\le c_i}$$

for every Reserve Asset. At least one maximally protected receive asset lies on the coefficient boundary with $c_i^S=c_i$. Every other Reserve Asset coefficient remains fixed or contracts.

The common gauge does not conceal an unsafe receive-side expansion. It is chosen so that the complete physical endpoint passes the existing componentwise coefficient test in one fixed representation.

6. Deriving the constant-time update

Section 5 determines the effective final scale required for every explicit leg:

$$s_i^S = s_i\lambda_Sg_i^S(g_i^D)^{-e_P}.$$

A nonparticipating asset has $g_i^D=g_i^S=1$, so its required final scale is simply

$$s_i^S=\lambda_Ss_i.$$

This is where the implementation problem appears. The pool may contain hundreds of nonparticipating assets, but the transaction cannot write each one. The common factor $\lambda_S$ must therefore be applied through the pool-wide scale accumulator that already represents effective scales as

$$s_i=L\bar s_i, \qquad s_0=L\bar s_0, \qquad \bar s_0=\sum_{i=1}^{n}\bar s_i.$$

For every untouched asset, the stored base scale $\bar s_i$ must remain unchanged. The only accumulator update that produces $s_i^S=\lambda_Ss_i$ for all of them is

$$\boxed{L^S=\lambda_SL.}$$

The accumulator update also multiplies each explicit leg by $\lambda_S$, but an explicit leg needs the additional factor $g_i^S(g_i^D)^{-e_P}$. Its new base scale is not guessed; it is obtained by solving

$$L^S\bar s_i^S=s_i^S.$$

Substituting the required effective scale and $L^S=\lambda_SL$ gives

$$\lambda_SL\bar s_i^S = L\bar s_i\lambda_Sg_i^S(g_i^D)^{-e_P},$$

so

$$\boxed{ \bar s_i^S = g_i^S(g_i^D)^{-e_P}\bar s_i. }$$

Only explicit legs change their stored base scales. The stored root can therefore be updated from those same changes:

$$\boxed{ \bar s_0^S = \bar s_0 + \sum_{i\in\mathrm{legs}} \left[ g_i^S(g_i^D)^{-e_P}-1 \right] \bar s_i. }$$

Multiplying by the new accumulator gives

$$s_0^S = \lambda_SL\bar s_0^S = \sum_{i=1}^{n}s_i^S.$$

The constant-time structure is now a consequence of the required endpoint: one accumulator write applies the common gauge to every asset, and only explicit legs need individual base-scale changes.

7. Discovering the LP Token boundary

The Reserve Asset proof determines the largest common gauge compatible with $c_i^S\le c_i$. That does not automatically prove LP Token safety, because the explicit-leg compensations also change the sum of all scales.

The candidate keeps LP Token supply fixed:

$$a_0^S=a_0.$$

The LP Token safety condition is

$$c_0^S\ge c_0.$$

Using $c_0=s_0/a_0^{e_s}$ and the fixed LP Token supply gives

$$\frac{s_0^S}{a_0^{e_s}} \ge \frac{s_0}{a_0^{e_s}},$$

which reduces directly to

$$\boxed{s_0^S\ge s_0.}$$

Section 6 already derived the final root. Substituting its explicit-leg update gives

$$\boxed{ s_0^S = \lambda_SL \left\{ \bar s_0 + \sum_{i\in\mathrm{legs}} \left[ g_i^S(g_i^D)^{-e_P}-1 \right] \bar s_i \right\}. }$$

Since $s_0=L\bar s_0$ and $w_i=s_i/s_0=\bar s_i/\bar s_0$, the same equation can be evaluated from opening derived weights:

$$\boxed{ s_0^S = s_0\lambda_S \left\{ 1 + \sum_{i\in\mathrm{legs}} w_i \left[ g_i^S(g_i^D)^{-e_P}-1 \right] \right\}. }$$

This calculation reveals the boundary. If a proposed Surplus allocation produces $s_0^S\ge s_0$, both the Reserve Asset and LP Token coefficient conditions hold. If it produces $s_0^S<s_0$, the receive coverage is too large for the fixed pay allocation. The candidate moves the receive coverage back toward direct Reserve settlement until $s_0^S=s_0$. LP Token supply never changes.

8. Deriving the single-receive coverage rule

Consider one pay asset $A$ and one receive asset $B$. Their direct reserve multipliers are

$$g_A^D=1+r_A>1, \qquad g_B^D=1+r_B\in(0,1).$$

Fix the pay-side Reserve allocation and choose a receive-side Surplus coverage:

$$g_A^S = 1+\pi_A^{\mathrm{pay}}(g_A^D-1),$$ $$g_B^S = g_B^D+\pi_B^{\mathrm{rec}}(1-g_B^D).$$

There is one Surplus-funded receive asset. Its ratio $g_B^S/g_B^D$ is therefore the largest ratio in the safe-gauge formula, which forces

$$\boxed{ \lambda_S = \left(\frac{g_B^D}{g_B^S}\right)^{e_P}. }$$

Now apply the root equation derived in Section 7. The pay leg contributes $w_A[g_A^S(g_A^D)^{-e_P}-1]$, the receive leg contributes $w_B[g_B^S(g_B^D)^{-e_P}-1]$, and the nonparticipating complement is already contained in the opening $1$:

$$\begin{aligned} s_0^S &= s_0\lambda_S \left\{ 1 + w_A\left[g_A^S(g_A^D)^{-e_P}-1\right] + w_B\left[g_B^S(g_B^D)^{-e_P}-1\right] \right\}\\ &= s_0 \left\{ \left[ 1-w_A-w_B+w_Ag_A^S(g_A^D)^{-e_P} \right] \left(\frac{g_B^D}{g_B^S}\right)^{e_P} + w_B(g_B^S)^{e_s} \right\}. \end{aligned}$$

The second line is only the first line after substituting the forced gauge and collecting terms. No additional model quantity has been introduced.

The goal is to use the greatest inventory-supported $\pi_B^{\mathrm{rec}}$ for which $s_0^S\ge s_0$. Because $g_B^S$ rises linearly with $\pi_B^{\mathrm{rec}}$, it is enough to understand how the displayed expression changes with $g_B^S$.

Differentiating it gives

$$\frac{ds_0^S}{dg_B^S} = s_0(g_B^S)^{-e_P-1} \left\{ e_sw_Bg_B^S - e_P \left[ 1-w_A-w_B+w_Ag_A^S(g_A^D)^{-e_P} \right] (g_B^D)^{e_P} \right\}.$$

The factor outside braces is positive. Inside the braces, only the first term depends on $g_B^S$, and it increases linearly. The derivative can therefore change sign only once, from negative to positive. The final LP Token scale is monotone or decreases and then increases; it has at most one interior minimum.

This observation produces the coverage algorithm rather than merely verifying it:

1. fix $\pi_A^{\mathrm{pay}}$ and verify that zero Surplus coverage gives $s_0^S\ge s_0$;
2. calculate the maximum $\pi_B^{\mathrm{rec}}$ allowed by available Surplus inventory;
3. evaluate $s_0^S$ at that maximum;
4. use the maximum if $s_0^S\ge s_0$;
5. otherwise solve the unique boundary $s_0^S=s_0$ between zero and maximum coverage.

The boundary solve is bracketed because its zero-coverage endpoint is safe and its proposed maximum-coverage endpoint is unsafe. It is unique within that bracket: the derivative can turn only from negative to positive, so the function cannot cross below $s_0$, cross back above it, and still end below $s_0$ at maximum coverage.

9. Deriving atomic multi-asset coverage

With several receive assets, each inventory balance produces its own maximum coverage fraction $\bar\pi_j^{\mathrm{rec}}$. Reducing those fractions independently would require a multidimensional search and would leave the protocol without a defined priority among receive assets.

The one-dimensional parameter appears by requiring the candidate to preserve the inventory-supported proportions. Choose one utilization fraction

$$t\in[0,1]$$

and apply it to every receive leg:

$$\boxed{ \pi_j^{\mathrm{rec}} = t\bar\pi_j^{\mathrm{rec}}. }$$

This gives

$$g_j^S(t) = g_j^D+t\bar\pi_j^{\mathrm{rec}}(1-g_j^D)$$

and hence

$$\frac{g_j^S(t)}{g_j^D} = 1 + t\bar\pi_j^{\mathrm{rec}} \frac{1-g_j^D}{g_j^D}.$$

All receive ratios are now lines beginning at one. For $t\ge0$, the largest line is the one with the largest slope. Substituting that observation into the safe-gauge formula gives

$$\boxed{ \lambda_S(t) = \left[ 1 + t \max_{j\in\mathrm{receives}} \left( \bar\pi_j^{\mathrm{rec}} \frac{1-g_j^D}{g_j^D} \right) \right]^{-e_P}. }$$

The gauge is therefore discovered directly from the common utilization rule; no separate per-asset distortion variable is needed.

Substitute the receive endpoints into the root equation from Section 7:

$$\begin{aligned} s_0^S(t) = s_0\lambda_S(t) \Bigg\{ 1 &+ \sum_{i\in\mathrm{pays}} w_i \left[ g_i^S(g_i^D)^{-e_P}-1 \right]\\ &+ \sum_{j\in\mathrm{receives}} w_j \left[ \left( g_j^D+t\bar\pi_j^{\mathrm{rec}}(1-g_j^D) \right) (g_j^D)^{-e_P} -1 \right] \Bigg\}. \end{aligned}$$

This is the multi-asset coverage equation before any shorthand. It also shows why the problem remains one-dimensional: the expression in braces is affine in $t$, and the gauge is a negative power of another affine function of $t$.

For the sole purpose of differentiating that structure, collect the constant term in braces as $A$, its coefficient of $t$ as $B$, and the maximum receive-ratio slope as $Q$:

$$\begin{aligned} A &= 1 + \sum_{i\in\mathrm{pays}} w_i \left[ g_i^S(g_i^D)^{-e_P}-1 \right] + \sum_{j\in\mathrm{receives}} w_j \left[ (g_j^D)^{e_s}-1 \right],\\ B &= \sum_{j\in\mathrm{receives}} w_j\bar\pi_j^{\mathrm{rec}}(1-g_j^D)(g_j^D)^{-e_P},\\ Q &= \max_{j\in\mathrm{receives}} \left( \bar\pi_j^{\mathrm{rec}} \frac{1-g_j^D}{g_j^D} \right). \end{aligned}$$

These letters do not represent new protocol state. They name the constant term, linear coefficient, and maximum slope that appeared before the shorthand was introduced. This is the first point in the derivation where naming them makes the next step shorter. The preceding equation now becomes

$$s_0^S(t) = s_0(A+Bt)(1+Qt)^{-e_P},$$

where $A>0$, $B\ge0$, and $Q\ge0$. Differentiation gives

$$\boxed{ \frac{ds_0^S}{dt} = s_0(1+Qt)^{-e_P-1} \left[ B-e_PQA+e_sBQ t \right]. }$$

The bracket is affine and nondecreasing. Therefore $s_0^S(t)$ has at most one interior minimum, exactly as in the single-receive case.

The resulting atomic rule is:

1. fix every $\pi_i^{\mathrm{pay}}$ and require $s_0^S(0)\ge s_0$;
2. calculate each inventory-supported $\bar\pi_j^{\mathrm{rec}}$;
3. evaluate $s_0^S(1)$;
4. use $t=1$ if $s_0^S(1)\ge s_0$;
5. otherwise solve the unique boundary $s_0^S(t)=s_0$ on $0<t<1$;
6. settle every receive leg with $\pi_j^{\mathrm{rec}}=t\bar\pi_j^{\mathrm{rec}}$.

When the maximum-coverage endpoint is unsafe, the same derivative shape makes the bracketed boundary unique. When the maximum-coverage endpoint is safe, the candidate executes $t=1$ directly. Other values of $t$ describe alternative endpoints; the transaction does not traverse them on its way to $t=1$.

The calculation visits only explicit pay and receive legs. It never loops over the full pool.

10. Ledger and value-flow accounting

The pool Reserve is only one account in the complete transaction. Surplus, Rewards, and Treasury are separate accounts. The accounting must distinguish the user's total token flow from the portion assigned to Reserve.

For token $i$, define the total user-facing protocol flow

$$\boxed{da_i^U=a_i(g_i^D-1).}$$

The actual Reserve flow is

$$\boxed{da_i^R=a_i(g_i^S-1).}$$

The remaining protocol-account flow is

$$\boxed{ da_i^X = da_i^U-da_i^R = a_i(g_i^D-g_i^S). }$$

For a pay leg, $da_i^X\ge0$ is the payment routed outside Reserve. For a receive leg, $da_i^X\le0$ is the amount supplied from Surplus.

Token amounts balance account by account:

$$\boxed{da_i^U=da_i^R+da_i^X.}$$

At the common final price,

$$\Sigma_i^U=da_i^UP_i^S,$$ $$\Sigma_i^R=da_i^RP_i^S,$$

and

$$\Sigma_i^X=da_i^XP_i^S.$$

Therefore

$$\boxed{ \Sigma_i^U = \Sigma_i^R + \Sigma_i^X. }$$

The user-facing transaction remains balanced:

$$\boxed{\sum_i\Sigma_i^U=0.}$$

The Reserve subaccount need not balance by itself because it is an open subsystem receiving value from and sending value to other protocol accounts. Surplus settlement is funded by an explicit Surplus debit, not by an unsupported scale edit.

The current Multiswap ledger already distinguishes Reserve, Surplus, Rewards, and Treasury settlement destinations and already stores scales through a global accumulator. The candidate uses those architectural capabilities, but the current executable Surplus adjustment does not implement the model derived here.

11. Candidate transaction

An atomic gauge-equivalent Surplus transaction has the following planning-level sequence:

1. Calculate the direct quote. Solve the ordinary Post-Trade Elasticity multi-asset swap and obtain $da_i^D$, $g_i^D$, $P_i^D$, and balanced $\Sigma_i^D$.
2. Determine account allocations. Choose pay-side Reserve fractions $\pi_i^{\mathrm{pay}}$ and inventory-supported receive coverage fractions $\bar\pi_j^{\mathrm{rec}}$.
3. Choose coverage. Evaluate the full inventory-supported vector. If its endpoint has $s_0^S<s_0$, solve the one-dimensional boundary $s_0^S(t)=s_0$.
4. Calculate actual Reserve endpoints. Compute every explicit leg's $g_i^S$.
5. Choose the gauge. Set $\lambda_S=(\max_i g_i^S/g_i^D)^{-e_P}$.
6. Update the accumulator. Apply $L^S=\lambda_SL$ once.
7. Compensate explicit legs. Apply $\bar s_i^S=g_i^S(g_i^D)^{-e_P}\bar s_i$ for each pay and receive leg.
8. Update the root. Add only the explicit stored-scale deltas to $\bar s_0$.
9. Settle accounts. Debit user pay amounts into Reserve, Rewards, and Treasury according to allocation; debit receive amounts from Reserve and Surplus according to coverage.
10. Verify the endpoint. Require positive state, $s_0^S=\sum_i s_i^S$, $c_i^S\le c_i$ for every explicit leg, and $s_0^S\ge s_0$.

Nonparticipating Reserve Assets require no individual read-modify-write cycle beyond the data already needed to quote explicit legs. Their common transformation is carried by the accumulator.

Surplus inventory does not require a separate concurrency model. The inventory balance, coverage factor, and settlement transfers must be calculated from the same state inside one atomic transaction. EVM transaction ordering then prevents two transactions from spending the same Surplus balance: the later transaction sees the balance left by the earlier one. The current Multiswap settlement architecture already reconstructs quotes from live pool state during execution and enforces minimum receive amounts. A stale offchain quote is therefore an ordinary slippage problem, not a distinct source of coefficient unsafety. An implementation may expose a minimum Surplus-coverage condition for integrators that care about the settlement source, but the user's token amounts and the candidate's safety certificate do not require one.

12. What the candidate establishes

Under its exact-arithmetic assumptions, the construction establishes the following endpoint results:

Same user amounts

The direct quote fixes the user's token amounts before the protocol chooses their settlement accounts. From the definitions of $g_i^D$ and the user-facing flow,

$$\boxed{ da_i^U = a_i(g_i^D-1) = da_i^D. }$$

Surplus settlement therefore changes how each leg is divided between Reserve and other protocol accounts, but it does not change the amount paid or received by the user.

The common gauge rescales every final price by $\lambda_S$; it does not rescale token quantities. Consequently, the unchanged user amounts also remain balanced at the gauge-equivalent final prices:

$$\sum_i da_i^U P_i^S = \sum_i da_i^D P_i^S = \lambda_S \sum_i da_i^D P_i^D = 0.$$

Same complete relative-price vector

$$\frac{P_i^S}{P_j^S} = \frac{P_i^D}{P_j^D}.$$

Reserve Asset coefficient order

$$c_i^S = c_i \lambda_S \left(\frac{g_i^S}{g_i^D}\right)^{e_P} \le c_i.$$

LP Token coefficient order

$$c_0^S\ge c_0 \quad\Longleftrightarrow\quad s_0^S\ge s_0.$$

Constant-time complement update

The action performs one global accumulator update and work proportional only to its explicit pay and receive legs.

Compatibility with later actions

The gauge-equivalent endpoint is a valid starting state for later swaps and liquidity actions. Under a common gauge $s_i\mapsto\lambda s_i$, every value flow scales by the same factor, so the normalized quote input

$$\sigma_i=\frac{\Sigma_i}{s_i}$$

is unchanged. The Post-Trade Elasticity solve therefore returns the same reserve ratio $r_i$ and the same token amounts. Only scale-denominated value flows and value changes inherit the common factor.

The accumulator-based single-asset liquidity calculation is homogeneous for the same reason: its liquidity multiplier is a ratio of scale differences, so a common factor cancels from its numerator and denominator. Proportional liquidity is also unchanged because the gauge preserves every derived weight $w_i=s_i/s_0$.

Coefficient safety then composes by transitivity. If the Surplus endpoint satisfies

$$c_i^S\le c_i, \qquad c_0^S\ge c_0,$$

and a later action is safe relative to that endpoint, then

$$c_i^{\mathrm{next}}\le c_i^S\le c_i, \qquad c_0^{\mathrm{next}}\ge c_0^S\ge c_0.$$

Thus no mathematical reset or reversal of the gauge is required before a later action. This is an exact-arithmetic composition result. Fixed-point accumulator updates, rounding, and near-depletion behavior still require randomized sequence tests in the implementation.

These results establish coefficient-order admissibility and balanced user consideration for the candidate endpoint. They do not yet establish production safety.

13. Remaining implementation work and scope decisions

The deterministic coverage policy, root selection, atomic inventory handling, and exact-arithmetic composition with later actions are specified above. The following work remains before the candidate can replace the current Surplus path:

1. Rounding. Fixed-point power evaluation, coverage solving, accumulator updates, and token conversions must round toward $c_i^S\le c_i$ and $s_0^S\ge s_0$.
2. Ledger journals. Every Reserve, Surplus, Rewards, Treasury, Protocol, and external-user debit and credit must be enumerated against the live account tree.
3. Sequence tests. Randomized implementation tests must combine gauge-equivalent Surplus settlement with swaps, single-asset liquidity, proportional liquidity, and extreme near-depletion states. These tests validate fixed-point realization of the composition result; they are not standing in for a missing exact-arithmetic argument.
4. Boundary elasticity scope. The formulas remain meaningful at $e_s=0$, where $e_P=1$. At that boundary, the terms proportional to $e_s$ disappear: the single-receive derivative is strictly negative and the multi-asset derivative has a constant sign, so the coverage function is monotone rather than U-shaped. Whether the launch protocol permits $e_s=0$ remains a product and safety-scope decision; this candidate assumes $0<e_s<1$ until that decision is made.
5. Authorization. Only the intended settlement path may move protocol Surplus or change the scale accumulator.

The current implementation must not be described as supporting this candidate until the remaining work is completed and the equations are implemented and tested.

Conclusion

Surplus settlement does not need to choose between protecting a receive Reserve and preserving the user's market endpoint. Absolute Multiswap prices contain a common scale gauge. The economically relevant target is the ordinary direct swap's complete relative-price vector.

The candidate first computes the direct swap, then chooses an actual Reserve endpoint based on pay allocation and Surplus coverage. One common gauge factor converts that endpoint into the direct relative-price state. The factor is applied through the existing scale-accumulator pattern, while explicit transaction legs receive individual compensations. The resulting Reserve Asset coefficient multipliers are bounded by construction.

The LP Token supplies the final coverage boundary. Keeping LP Token supply fixed requires

$$s_0^S\ge s_0.$$

When full inventory-supported coverage violates that condition, the mechanism reduces all proposed receive coverage through one common factor until $s_0^S=s_0$. No pool-wide loop and no inventory of burnable LP Tokens is required.

This gives Multiswap a concrete candidate Surplus model with the same user quote, the same relative post-trade prices, explicit account funding, componentwise Reserve safety, LP Token safety, and transaction-leg complexity. Its remaining work is fixed-point implementation, ledger-journal specification, authorization, and adversarial validation.