The Projective Bregman Safety Law

Multiswap prices are gradients of a concave projective potential. Post-trade execution therefore produces a nonnegative Bregman divergence. For a closed swap, that divergence accumulates in LP Token backing. For a partial liquidity action, it finances the permitted change in the price surface. For externally owned Surplus, it combines with an explicit value flow across the Reserve boundary.

These are not three unrelated safety arguments. They are special cases of one exact balance law:

Projective-potential change equals Bregman production plus Reserve boundary value flow plus price-surface reset.

This article derives that law from the native Multiswap state and applies it to swaps, liquidity operations, and externally owned Surplus.

Status: Exact-arithmetic mathematical model. The results assume positive reserves and scales, $0<e_s<1$, post-trade execution, the stated same-token journal entries, and exact enforcement of each operation's equations. The externally owned Surplus mechanism is proposed rather than current executable behavior. Fixed-point rounding and Solidity implementation remain separate verification obligations.

1. Native state

Reserve Asset $i$ has reserve $a_i$, scale $s_i$, and marginal price $P_i$:

$$s_i=c_i a_i^{e_s}, \qquad P_i=\frac{s_i}{a_i}=c_i a_i^{-e_P}, \qquad e_P=1-e_s.$$

The LP Token is the derived claim on all Reserve Assets:

$$s_0=\sum_i s_i, \qquad P_0=\frac{s_0}{a_0}, \qquad c_0=\frac{s_0}{a_0^{e_s}}.$$

Consequently,

$$c_0 = \sum_i c_i\left(\frac{a_i}{a_0}\right)^{e_s}.$$

The economically relevant reserve coordinates are projective:

$$\frac{a_i}{a_0}.$$

They measure units of Reserve Asset $i$ per LP Token. Their corresponding marginal prices are also relative:

$$\frac{P_i}{P_0}.$$

2. The projective potential

Define the projective potential

$$\boxed{ \Psi\!\left(\frac{a}{a_0}\right) = \frac{1}{e_s} \log\!\left[ \sum_i c_i \left(\frac{a_i}{a_0}\right)^{e_s} \right]. }$$

Here $a/a_0$ denotes the complete vector of Reserve Asset amounts per LP Token. The symbol $\Psi$ names a new object: the scalar potential whose gradient generates every Reserve-Asset-to-LP-Token relative price.

Indeed,

$$\begin{aligned} \frac{\partial\Psi}{\partial(a_i/a_0)} &= \frac{ c_i(a_i/a_0)^{-e_P} }{ \sum_jc_j(a_j/a_0)^{e_s} }\\ &= \frac{c_i}{c_0} \left(\frac{a_i}{a_0}\right)^{-e_P}\\ &= \frac{P_i}{P_0}. \end{aligned}$$

Therefore:

$$\boxed{ \nabla\Psi = \left( \frac{P_1}{P_0}, \ldots, \frac{P_n}{P_0} \right). }$$

For $0<e_s<1$, the power sum is concave and positive. The logarithm is increasing and concave, so $\Psi$ is concave.

At an actual Multiswap state,

$$\boxed{ \Psi\!\left(\frac{a}{a_0}\right) = \frac{1}{e_s}\log c_0. }$$

Multiplying every $c_i$ by one positive common factor adds a constant to $\Psi$. Its gradient and Bregman divergence do not change. The geometry is therefore invariant under the common scale gauge.

3. Journal value in projective coordinates

Consider one atomic action from $(a_i,a_0)$ to $(a_i',a_0')$. Every token ledger must first balance through equal-amount same-token debit and credit entries. Only after those conservation laws hold do we value the entries that touch Reserve Asset or LP Token state.

The post-trade value entering the Reserve--LP subsystem is

$$\sum_i da_iP_i'-da_0P_0'.$$

The minus sign reflects LP Tokens issued by the pool when $da_0>0$. The following identity is exact:

$$\boxed{ \sum_i da_iP_i'-da_0P_0' = a_0P_0' \sum_i \frac{P_i'}{P_0'} \left( \frac{a_i'}{a_0'}-\frac{a_i}{a_0} \right). }$$

To verify it, use

$$\sum_i \frac{P_i'}{P_0'} \frac{a_i'}{a_0'} = \frac{\sum_iP_i'a_i'}{P_0'a_0'} =1.$$

The identity converts post-trade journal value into the relative-price gradient applied to the change in Reserve Assets per LP Token.

A closed post-trade swap or liquidity operation satisfies

$$\sum_i da_iP_i'-da_0P_0'=0.$$

Therefore its projective value flow is zero:

$$\sum_i \frac{P_i'}{P_0'} \left( \frac{a_i'}{a_0'}-\frac{a_i}{a_0} \right) =0.$$

An open operation need not make this expression zero. Its nonzero value is an explicit flow across the Reserve--LP boundary.

4. Bregman production

An action can also change the price surface. Let $\Psi$ denote the opening potential and $\Psi'$ the potential formed from the ending Reserve Asset coefficients. Concavity of $\Psi'$ gives

$$\begin{aligned} &\Psi'\!\left(\frac{a'}{a_0'}\right) - \Psi'\!\left(\frac{a}{a_0}\right) \\ &\qquad\ge \sum_i \frac{P_i'}{P_0'} \left( \frac{a_i'}{a_0'}-\frac{a_i}{a_0} \right). \end{aligned}$$

The nonnegative difference is the Bregman divergence generated by the convex function $-\Psi'$:

$$\boxed{ \begin{aligned} &D_{-\Psi'}\!\left( \frac{a}{a_0}, \frac{a'}{a_0'} \right) \\ &= \Psi'\!\left(\frac{a'}{a_0'}\right) - \Psi'\!\left(\frac{a}{a_0}\right) \\ &\quad- \sum_i \frac{P_i'}{P_0'} \left( \frac{a_i'}{a_0'}-\frac{a_i}{a_0} \right) \ge0. \end{aligned} }$$

This divergence is the finite curvature produced by executing the complete action at its post-trade marginal prices.

5. The exact balance law

Add and subtract the ending potential evaluated at the opening projective reserves:

$$\begin{aligned} &\Psi'\!\left(\frac{a'}{a_0'}\right) - \Psi\!\left(\frac{a}{a_0}\right) \\ &= D_{-\Psi'}\!\left( \frac{a}{a_0}, \frac{a'}{a_0'} \right) \\ &\quad+ \sum_i \frac{P_i'}{P_0'} \left( \frac{a_i'}{a_0'}-\frac{a_i}{a_0} \right) \\ &\quad+ \Psi'\!\left(\frac{a}{a_0}\right) - \Psi\!\left(\frac{a}{a_0}\right). \end{aligned}$$

Using the projective journal identity and the actual-state value of each potential gives the master equation:

$$\boxed{ \begin{aligned} \frac{1}{e_s}\log\frac{c_0'}{c_0} &= D_{-\Psi'}\!\left( \frac{a}{a_0}, \frac{a'}{a_0'} \right) \\ &\quad+ \frac{ \sum_i da_iP_i'-da_0P_0' }{a_0P_0'} \\ &\quad+ \Psi'\!\left(\frac{a}{a_0}\right) - \Psi\!\left(\frac{a}{a_0}\right). \end{aligned} }$$

The three terms on the right have distinct meanings:

1. Bregman production is nonnegative finite-step curvature.
2. Reserve boundary value flow is post-trade value entering the Reserve--LP subsystem, net of LP Tokens issued.
3. Price-surface reset measures the coefficient change at the projective reserve state where the action began.

The equation is gauge-consistent. A common coefficient rescaling adds the same potential constant to both sides through the corresponding change in $c_0$ and the reset term. The Bregman divergence and relative prices remain unchanged.

5.1 The gauge-invariant safety margin

The master equation tracks the LP Token coefficient in a selected common gauge. Subtracting the change in Reserve Asset $i$'s coefficient produces a fully gauge-invariant identity:

$$\boxed{ \begin{aligned} \frac1{e_s} \log\left[ \frac{c_i/c_0}{c_i'/c_0'} \right] &= D_{-\Psi'}\!\left( \frac{a}{a_0}, \frac{a'}{a_0'} \right) \\ &\quad+ \frac{ \sum_j da_jP_j'-da_0P_0' }{a_0P_0'} \\ &\quad+ \Psi'\!\left(\frac{a}{a_0}\right) - \Psi\!\left(\frac{a}{a_0}\right) - \frac1{e_s}\log\frac{c_i'}{c_i}. \end{aligned} }$$

The left side is nonnegative exactly when

$$\frac{c_i'}{c_0'} \le \frac{c_i}{c_0}.$$

This is therefore an exact necessary-and-sufficient test for Reserve Asset $i$ to move in the established projective safety order. It is not merely a sufficient estimate.

Under a common gauge transformation, the price-surface reset and the final Reserve Asset coefficient term change by equal amounts and cancel. Every remaining term is already gauge invariant.

6. Closed swaps

An atomic swap has

$$da_0=0, \qquad \sum_i da_iP_i'=0, \qquad c_i'=c_i.$$

The boundary and price-surface-reset terms are therefore zero. The balance law reduces to

$$\boxed{ \frac{1}{e_s}\log\frac{c_0'}{c_0} = D_{-\Psi}\!\left( \frac{a}{a_0}, \frac{a'}{a_0} \right) \ge0. }$$

Thus $c_0'\ge c_0$. Because every Reserve Asset coefficient remains fixed,

$$\boxed{ \frac{c_i'}{c_0'} \le \frac{c_i}{c_0} \qquad\forall i. }$$

The projective safety inequality is therefore derived from post-trade self-financing and concavity. It is not an independent assumption for swaps.

For a nontrivial finite swap, strict concavity makes the divergence positive. The LP Token's projective backing gain is exactly the Bregman divergence.

7. Liquidity operations

An $m\leftrightarrow1$ liquidity operation has zero Reserve boundary flow:

$$\sum_i da_iP_i'-da_0P_0'=0.$$

For participating Reserve Assets and the LP Token,

$$c_i'=c_i, \qquad c_0'=c_0.$$

When $m<n$, every nonparticipating Reserve Asset receives the common multiplier

$$c_j'=\lambda c_j, \qquad 0<\lambda<1$$

for every admissible nontrivial action. This is a genuine price-surface change, so a fixed-potential proof would be wrong.

Because $c_0'=c_0$, the left side of the balance law is zero. Therefore:

$$\boxed{ \Psi'\!\left(\frac{a}{a_0}\right) - \Psi\!\left(\frac{a}{a_0}\right) = -D_{-\Psi'}\!\left( \frac{a}{a_0}, \frac{a'}{a_0'} \right). }$$

The Bregman divergence exactly finances the downward reset of the projective price surface. Participating coefficient ratios remain unchanged, while every nonparticipating ratio decreases:

$$\frac{c_i'}{c_0'} = \frac{c_i}{c_0},$$ $$\frac{c_j'}{c_0'} = \lambda\frac{c_j}{c_0} < \frac{c_j}{c_0}.$$

For proportional all-Reserve-Asset liquidity, every projective reserve remains unchanged. The Bregman divergence and price-surface reset are both zero. The action is projectively neutral even though absolute LP Token price can change.

8. Externally owned Surplus

Consider a user exchanging $A$ for CAV. The ordinary direct quote is

$$da_A^D>0, \qquad da_{\mathrm{CAV}}^D<0.$$

It satisfies post-trade value-flow balance at the direct endpoint:

$$da_A^D P_A^D + da_{\mathrm{CAV}}^D P_{\mathrm{CAV}}^D =0.$$

Externally owned Surplus routes independent fractions of these token legs through Reserve:

$$da_A = \pi_A^{\mathrm{pay}}da_A^D,$$ $$da_{\mathrm{CAV}} = \pi_{\mathrm{CAV}}^{\mathrm{rec}}da_{\mathrm{CAV}}^D.$$

The fractions are independent. Multiswap does not require

$$\pi_A^{\mathrm{pay}} = \pi_{\mathrm{CAV}}^{\mathrm{rec}}.$$

8.1 Same-token journals

The non-Reserve $A$ leg is posted on the $A$ ledger:

Debit	Credit	Amount
CavalRe Treasury $A$	CavalRe Payable $A$	$(1-\pi_A^{\mathrm{pay}})da_A^D$

The non-Reserve CAV leg is posted separately on the CAV ledger:

Debit	Credit	Amount
CavalRe Payable CAV	Surplus CAV	$(1-\pi_{\mathrm{CAV}}^{\mathrm{rec}})(-da_{\mathrm{CAV}}^D)$

The Reserve legs use the ordinary same-token Reserve settlement journals. There is no debit in $A$ matched with a credit in CAV.

Each external asset--liability pair contains equal amounts of the same token and inherits the same token price. Repricing therefore changes both sides equally. The entries remain on the ledger for ownership, authorization, and auditability, but their net Protocol-equity revaluation is exactly zero.

The surviving price-forming endpoint is

$$a_A^S = a_A+\pi_A^{\mathrm{pay}}da_A^D,$$ $$a_{\mathrm{CAV}}^S = a_{\mathrm{CAV}} +\pi_{\mathrm{CAV}}^{\mathrm{rec}}da_{\mathrm{CAV}}^D,$$

with

$$a_0^S=a_0, \qquad c_i^S=c_i.$$

8.2 The Surplus boundary term

Because the Reserve coefficients remain fixed, there is no price-surface reset. The Reserve boundary value flow is

$$\pi_A^{\mathrm{pay}}da_A^D P_A^S + \pi_{\mathrm{CAV}}^{\mathrm{rec}} da_{\mathrm{CAV}}^D P_{\mathrm{CAV}}^S.$$

The balance law becomes

$$\boxed{ \begin{aligned} \frac{1}{e_s}\log\frac{c_0^S}{c_0} &= D_{-\Psi}\!\left( \frac{a}{a_0}, \frac{a^S}{a_0} \right) \\ &\quad+ \frac{ \pi_A^{\mathrm{pay}}da_A^D P_A^S + \pi_{\mathrm{CAV}}^{\mathrm{rec}} da_{\mathrm{CAV}}^D P_{\mathrm{CAV}}^S }{a_0P_0^S}. \end{aligned} }$$

This gives the exact acceptance condition:

$$\boxed{ \begin{aligned} &D_{-\Psi}\!\left( \frac{a}{a_0}, \frac{a^S}{a_0} \right) \\ &\quad+ \frac{ \pi_A^{\mathrm{pay}}da_A^D P_A^S + \pi_{\mathrm{CAV}}^{\mathrm{rec}} da_{\mathrm{CAV}}^D P_{\mathrm{CAV}}^S }{a_0P_0^S} \ge0. \end{aligned} }$$

Because Reserve Asset coefficients and LP Token supply remain fixed, this condition is equivalent to each of

$$c_0^S\ge c_0,$$ $$s_0^S\ge s_0,$$

and

$$\frac{c_i^S}{c_0^S} \le \frac{c_i}{c_0} \qquad\forall i.$$

The Reserve boundary value flow need not be nonnegative by itself. A moderately negative flow can be offset by positive Bregman production. Safety fails exactly when the value leaving Reserve exceeds the curvature produced by the Reserve transition.

8.3 Immediate cases

For a pure Surplus sale,

$$\pi_A^{\mathrm{pay}} = \pi_{\mathrm{CAV}}^{\mathrm{rec}} =0.$$

No Reserve or LP Token coordinate changes. Both the Bregman and boundary terms are zero, so the sale is projectively neutral.

If

$$\pi_A^{\mathrm{pay}}>0, \qquad \pi_{\mathrm{CAV}}^{\mathrm{rec}}=0,$$

Reserve receives $A$ and supplies no CAV. Both terms are nonnegative and $c_0^S>c_0$.

If

$$\pi_A^{\mathrm{pay}}=0, \qquad \pi_{\mathrm{CAV}}^{\mathrm{rec}}>0,$$

Reserve supplies CAV and receives nothing. Direct evaluation gives $s_0^S<s_0$, so the action fails the acceptance condition.

Equal fractions form one sufficient subfamily, but equality is not enforced. Independent fractions are accepted exactly when the complete Bregman-plus-boundary expression is nonnegative.

To see the sufficient result, set

$$\pi_A^{\mathrm{pay}} = \pi_{\mathrm{CAV}}^{\mathrm{rec}} =\pi.$$

Along this Reserve path,

$$s_0^S(\pi) = c_A(a_A+\pi da_A^D)^{e_s} + c_{\mathrm{CAV}} (a_{\mathrm{CAV}}+\pi da_{\mathrm{CAV}}^D)^{e_s} + \sum_{i\ne A,\mathrm{CAV}}s_i.$$

This function is concave. Its derivative at the direct endpoint is zero because

$$da_A^D P_A^D + da_{\mathrm{CAV}}^D P_{\mathrm{CAV}}^D =0.$$

The derivative is therefore nonnegative before that endpoint, giving

$$s_0^S(\pi)\ge s_0 \qquad \text{for }0\le\pi\le1.$$

This proves that the equal-fraction path is safe without turning equality of the fractions into a protocol requirement.

8.4 One-parameter self-financing construction

The general mechanism permits independent pay-side and receive-side fractions. A distinguished subfamily needs only one policy input.

Choose

$$0\le\pi_A^{\mathrm{pay}}\le1$$

and route

$$da_A^S = \pi_A^{\mathrm{pay}}da_A^D$$

to Reserve. Then calculate $da_{\mathrm{CAV}}^S<0$ as the output of an ordinary smaller Reserve swap:

$$\boxed{ da_A^S P_A^S + da_{\mathrm{CAV}}^S P_{\mathrm{CAV}}^S =0. }$$

Surplus supplies only the difference between the direct quote and the smaller Reserve output:

$$\boxed{ da_{\mathrm{CAV}}^S-da_{\mathrm{CAV}}^D \ge0. }$$

The user therefore receives the complete direct quote:

$$-da_{\mathrm{CAV}}^S + \left( da_{\mathrm{CAV}}^S-da_{\mathrm{CAV}}^D \right) = -da_{\mathrm{CAV}}^D.$$

CavalRe Treasury receives the remaining pay asset:

$$(1-\pi_A^{\mathrm{pay}})da_A^D.$$

This construction lies inside the independent-fraction model with the derived receive-side fraction

$$\boxed{ \pi_{\mathrm{CAV}}^{\mathrm{rec}} = \frac{da_{\mathrm{CAV}}^S}{da_{\mathrm{CAV}}^D}. }$$

It is not a second policy parameter. Once the direct quote, live Reserve state, and $\pi_A^{\mathrm{pay}}$ are fixed, the ordinary Reserve swap determines it.

The defining Reserve equation makes the boundary value flow exactly zero. Reserve coefficients also remain fixed, so there is no price-surface reset. The balance law reduces to

$$\boxed{ \frac{1}{e_s}\log\frac{c_0^S}{c_0} = D_{-\Psi}\!\left( \frac{a}{a_0}, \frac{a^S}{a_0} \right) \ge0. }$$

Thus the Reserve portion inherits the closed-swap proof directly. The external journals determine ownership and complete the user's direct quote; they do not need to compensate for an unsafe Reserve endpoint.

At $\pi_A^{\mathrm{pay}}=0$, the construction is a pure Surplus sale with no Reserve movement. At $\pi_A^{\mathrm{pay}}=1$, it is the complete direct Reserve swap with no Surplus fill. Interior values continuously combine a smaller ordinary Reserve swap with an externally owned Surplus sale.

9. Numerical verification

9.1 Independent equal-fraction example

Take a two-Reserve-Asset pool with

$$e_s=e_P=\frac12, \qquad a_A=a_{\mathrm{CAV}}=a_0=1, \qquad c_A=c_{\mathrm{CAV}}=1.$$

Then

$$c_0=P_0=2.$$

Use the direct quote

$$da_A^D=0.1, \qquad da_{\mathrm{CAV}}^D=-\frac1{11},$$

and choose

$$\pi_A^{\mathrm{pay}} = \pi_{\mathrm{CAV}}^{\mathrm{rec}} =\frac12.$$

The Reserve endpoint is

$$a_A^S=1.05, \qquad a_{\mathrm{CAV}}^S=\frac{21}{22}.$$

The ending prices are approximately

$$P_A^S=0.975900, \qquad P_{\mathrm{CAV}}^S=1.023533, \qquad P_0^S=2.001703.$$

The normalized Reserve boundary flow is

$$\frac{ \tfrac12 da_A^D P_A^S +\tfrac12 da_{\mathrm{CAV}}^D P_{\mathrm{CAV}}^S }{a_0P_0^S} \approx0.001134.$$

The Bregman divergence is

$$D_{-\Psi}\!\left( \frac{a}{a_0}, \frac{a^S}{a_0} \right) \approx0.000568.$$

Their sum is

$$0.001134+0.000568 =0.001703.$$

The independently calculated projective-state change is

$$\frac1{e_s}\log\frac{c_0^S}{c_0} = 2\log\frac{2.001703}{2} \approx0.001703.$$

The two sides agree.

9.2 One-parameter self-financing example

Keep the same opening state and direct quote, but choose only

$$\pi_A^{\mathrm{pay}}=\frac12.$$

Reserve receives

$$da_A^S=0.05.$$

The ordinary smaller Reserve swap determines

$$da_{\mathrm{CAV}}^S=-\frac1{21}.$$

Therefore the Reserve endpoint is

$$a_A^S=1.05, \qquad a_{\mathrm{CAV}}^S=\frac{20}{21},$$

and Surplus supplies

$$da_{\mathrm{CAV}}^S-da_{\mathrm{CAV}}^D = \frac{10}{231} \approx0.043290.$$

The ending prices are approximately

$$P_A^S=0.975900, \qquad P_{\mathrm{CAV}}^S=1.024695, \qquad P_0^S=2.000595.$$

The Reserve boundary value flow is zero:

$$0.05P_A^S - \frac1{21}P_{\mathrm{CAV}}^S =0.$$

The entire projective-state gain is therefore Bregman production:

$$D_{-\Psi}\!\left( \frac{a}{a_0}, \frac{a^S}{a_0} \right) = 2\log\frac{2.000595}{2} \approx0.000595.$$

10. Finite sequences

Apply the balance law to every atomic action in a finite sequence. The actual-state potential changes telescope:

$$\boxed{ \begin{aligned} \frac1{e_s}\log\frac{c_0^{(m)}}{c_0^{(0)}} &= \sum_{k=0}^{m-1} D_{-\Psi^{(k+1)}}\!\left( \frac{a^{(k)}}{a_0^{(k)}}, \frac{a^{(k+1)}}{a_0^{(k+1)}} \right) \\ &\quad+ \sum_{k=0}^{m-1} \frac{ \sum_i da_i^{(k)}P_i^{(k+1)} -da_0^{(k)}P_0^{(k+1)} }{a_0^{(k)}P_0^{(k+1)}} \\ &\quad+ \sum_{k=0}^{m-1} \left[ \Psi^{(k+1)}\!\left( \frac{a^{(k)}}{a_0^{(k)}} \right) - \Psi^{(k)}\!\left( \frac{a^{(k)}}{a_0^{(k)}} \right) \right]. \end{aligned} }$$

This is the finite-sequence accounting identity. It does not assume that intermediate operations use the same price surface.

For the currently analyzed operation classes:

• swaps have zero boundary flow and zero price-surface reset;
• partial liquidity actions have zero boundary flow and use their Bregman production to finance the permitted price-surface reset;
• full proportional liquidity is projectively neutral;
• pure externally owned Surplus sales have all three terms equal to zero; and
• mixed externally owned Surplus settlements have zero price-surface reset and an explicit Reserve boundary flow.

If every atomic endpoint satisfies

$$\frac{c_i'}{c_0'} \le \frac{c_i}{c_0} \qquad\forall i,$$

the inequalities compose across splits, round trips, and subsequent actions. The Bregman balance law now explains where that one-sided coefficient movement comes from for each supported operation, rather than merely declaring it.

The law also identifies the remaining general problem. An arbitrary non-uniform coefficient update introduces a price-surface-reset term. A scalar condition on $c_0$ cannot by itself control every Reserve Asset ratio. Such an operation needs either its own componentwise proof or a direct cyclic-monotonicity proof over the supported continuation actions.

Conclusion

Multiswap's projective safety structure is generated by a concave potential whose gradient is the complete vector of Reserve-Asset-to-LP-Token prices. Post-trade execution produces a nonnegative Bregman divergence.

For swaps, that divergence becomes additional derived LP Token backing. For partial liquidity, it exactly pays for the permitted downward reset of the price surface. For externally owned Surplus, exact same-token asset--liability journals cancel, leaving a measurable value flow across the Reserve boundary.

In words, projective-potential change equals Bregman production plus Reserve boundary value flow plus price-surface reset.

This supplies one auditable framework for closed operations, open settlement, round trips, and subsequent actions. It also makes the unresolved boundary precise: general non-uniform coefficient changes require control of the price-surface-reset term, not another isolated endpoint heuristic.