Surplus Settlement: Safe Composition, Coefficient Order, and Permanent Liquidity

Scope: This research article compares Surplus candidates and safety conditions. The current implementation uses a reduced-pay second quote with direct-payout top-ups, described in Quote Engine. Counter-swaps and LP Token burning discussed here are not the deployed settlement policy.

Multiswap Surplus is exogenous protocol inventory. When a user receives an asset held in Surplus, the protocol can use that inventory to settle the user's output and convert it into reserve growth, Rewards, Treasury revenue, or an ongoing CAV token sale.

The economic purpose is straightforward. The safety question is not.

A compound action can look harmless when examined as an immediate round trip and still leave the pool in a state from which later transactions transfer value unexpectedly. The correct test is therefore not merely whether the first user can reverse the transaction without profit. The resulting state must remain inside the coefficient-order admissible set under every later supported action.

This article develops that test from first principles. It reaches four conclusions:

1. the original price-preserving Surplus transformation does not remain inside the Post-Trade Elasticity coefficient order;
2. the counter-swap model is a composition of supported state transitions and does remain inside that order;
3. LP Token burning is coefficient-order admissible, although it creates a distinct temporary-liquidity allocation issue;
4. coefficient safety can be verified token by token, while value-flow entropy provides an aggregate summary of those local certificates.

The analysis assumes exact arithmetic, positive reserves and scales, and homogeneous scale elasticity

$$0<e_s<1,$$

with price elasticity

$$e_P=1-e_s.$$

The exact boundary $e_s=0$ is discussed separately.

1. Multiswap state and coefficient order

Let the pool contain $n>1$ Reserve Assets. Reserve Asset $i$ has reserve $a_i>0$, scale $s_i>0$, and marginal price

$$P_i=\frac{s_i}{a_i}.$$

Its elasticity coefficient is

$$\boxed{c_i=\frac{s_i}{a_i^{e_s}}.}$$

Equivalently,

$$s_i=c_i a_i^{e_s}$$

and

$$P_i=c_i a_i^{-e_P}.$$

The LP Token has reserve $a_0$, scale

$$\boxed{s_0=\sum_{i=1}^{n}s_i,}$$

price

$$P_0=\frac{s_0}{a_0},$$

and coefficient

$$c_0=\frac{s_0}{a_0^{e_s}}.$$

The Post-Trade Elasticity safety results use a one-sided coefficient order:

$$\boxed{c_i'\le c_i}$$

for every Reserve Asset, and

$$\boxed{c_0'\ge c_0}$$

for the LP Token.

Ordinary swaps keep every Reserve Asset coefficient fixed and increase the LP Token coefficient through finite-step divergence. Supported single-asset liquidity actions keep the active Reserve Asset coefficient and LP Token coefficient fixed while contracting every nonparticipating Reserve Asset coefficient by one common multiplier $0<\lambda<1$. An LP Token burn leaves Reserve Asset state fixed and increases the LP Token coefficient.

These directions matter because they compose. If every primitive action moves every coefficient in its permitted direction, no later sequence of supported actions can reverse the partial order.

2. Post-trade settlement

For a signed reserve change $da_i$, define

$$r_i=\frac{da_i}{a_i}, \qquad r_i>-1.$$

An ordinary Reserve Asset swap leg remains on its elastic curve:

$$a_i'=a_i(1+r_i)$$

and

$$s_i'=s_i(1+r_i)^{e_s}.$$

Its final marginal price is

$$P_i'=P_i(1+r_i)^{-e_P}.$$

Post-trade value flow is

$$\boxed{ \Sigma_i =da_iP_i' =s_i\frac{r_i}{(1+r_i)^{e_P}}. }$$

The general post-trade value-flow identity couples the LP Token leg to the Reserve Asset legs:

$$\boxed{ \Sigma_0 = \sum_{i=1}^{n}\Sigma_i. }$$

An ordinary reserve-only swap has no LP Token flow, so

$$\Sigma_0=0$$

and the general identity reduces to

$$\sum_{i=1}^{n}\Sigma_i=0.$$

Scale change is not value flow. For each leg,

$$ds_i=\Sigma_i+\Gamma_i,$$

where

$$\Gamma_i=a_i(P_i'-P_i)$$

is the revaluation of the opening reserve. Equivalently,

$$ds_i=e_s\Sigma_i+\mathcal D_i,$$

where the finite-step divergence $\mathcal D_i$ satisfies

$$\mathcal D_i\ge0.$$

Summing across the Reserve Asset legs gives

$$\boxed{ ds_0 = e_s\Sigma_0 + \sum_{i=1}^{n}\mathcal D_i. }$$

For a nontrivial finite reserve-only swap with $0<e_s<1$, $\Sigma_0=0$, so

$$s_0'-s_0 =\sum_{i=1}^{n}\mathcal D_i >0.$$

The LP Token reserve $a_0$ does not change during a Reserve Asset swap, so $c_0$ increases. Every Reserve Asset coefficient remains fixed.

3. The purpose of Surplus

Consider a user swap

$$A\longrightarrow B.$$

When $B$ is CAV, the user is buying CAV. Surplus can supply the CAV sold to the user, allowing protocol inventory to enter circulation organically through ordinary demand. CAV supply is finite, so CAV will eventually cease to be a Surplus asset. Until then, this mechanism can operate as an ongoing CAV token sale.

The pool, Surplus, Rewards, and Treasury are distinct protocol accounts. A correct analysis follows both the pool state and the inventory transferred among those accounts.

Two different Surplus constructions have been considered:

1. a direct price-preserving state adjustment;
2. an ordinary Surplus counter-swap composed after the user swap.

They give the user the same ordinary swap quote, but they do not leave the pool in the same state.

4. The original price-preserving construction

Let the user's receive change be

$$da_B<0.$$

The amount sent to the user is $-da_B>0$.

If the pool settled the ordinary swap directly, its hypothetical post-swap $B$ reserve would be

$$a_B^*=a_B+da_B,$$

where

$$0<a_B^*<a_B.$$

The original Surplus construction instead supplied the user's $B$ from exogenous inventory and left the pool reserve at

$$a_B^{\mathrm{PP}}=a_B.$$

Here the superscript $\mathrm{PP}$ denotes the price-preserving state. Scale was adjusted so that the final marginal price equaled the ordinary hypothetical price:

$$P_B^{\mathrm{PP}}=P_B^*.$$

This preserves one price point, but it does not preserve the future quote curve.

The ordinary swap remains on the initial $B$ curve, so

$$P_B^*=c_B(a_B^*)^{-e_P}.$$

The price-preserving state has the same price at the restored reserve:

$$P_B^{\mathrm{PP}} =c_B^{\mathrm{PP}}a_B^{-e_P}.$$

Equating the two prices gives

$$\boxed{ \frac{c_B^{\mathrm{PP}}}{c_B} = \left(\frac{a_B}{a_B^*}\right)^{e_P} >1. }$$

The receive coefficient expands. The state prices $B$ as though it were scarce while retaining the full reserve as pricing depth.

This violates the Reserve Asset coefficient direction immediately:

$$c_B^{\mathrm{PP}}>c_B.$$

The failure does not depend on whether an immediate $A\rightarrow B\rightarrow A$ reversal is profitable. The endpoint itself lies outside the coefficient order used by the subsequent-action composition result.

4.1 A concrete subsequent-trade comparison

The following numerical comparison applies the original price-preserving transformation to the Post-Trade Elasticity equations. It does not analyze the abandoned target-scale model in which the historical implementation was written.

Let the initial state be:

Asset	Reserve	Scale	Price
$A$	$10$	$6$	$0.6$
$B$	$0.65$	$0.39$	$0.6$

Let

$$e_s=0.9, \qquad e_P=0.1.$$

The user pays

$$da_A=0.8399290565$$

and receives

$$-da_B=0.6175.$$

The output is $95\%$ of the initial $B$ reserve. The ordinary hypothetical state is:

Asset	Reserve	Scale	Price
$A$	$10.8399290565$	$6.4517130957$	$0.5951803801$
$B$	$0.0325$	$0.0263110155$	$0.8095697086$

Suppose the price-preserving allocation retains $80\%$ of the paid $A$ in Reserves and directs the remainder outside the pool. The adjusted state is:

Asset	Reserve	Scale	Price
$A$	$10.6719432452$	$6.3517312367$	$0.5951803801$
$B$	$0.65$	$0.5262203106$	$0.8095697086$

The ordinary and adjusted states have the same marginal prices. The adjusted $B$ state has twenty times the ordinary reserve and scale at that price. Its coefficient is higher by the factor

$$\frac{c_B^{\mathrm{PP}}}{c_B} =20^{0.1} \approx1.349282848.$$

Now consider a later holder selling

$$2.518512\ B.$$

The later sale produces approximately:

First settlement	Later $A$ received	Combined result at the initial equal prices
Ordinary pool settlement	$2.165646$	$-0.575295$ $A$-equivalent
Price-preserving Surplus state	$2.834954$	$+0.094013$ $A$-equivalent

The combined result includes both transactions. In the price-preserving case, the participant's net token changes are

$$\left(2.834954-0.8399290565\right)A + \left(0.6175-2.518512\right)B.$$

Because the initial prices of $A$ and $B$ are equal, the initial-price $A$-equivalent result is

$$2.834954 -0.8399290565 +0.6175 -2.518512 \approx0.094013.$$

The corresponding ordinary-settlement calculation is approximately $-0.575295$ $A$-equivalent.

The sequence requires the later seller to bring pre-existing external $B$. It is not a closed pool-only cycle. The comparison establishes a narrower but relevant result: the adjusted state can quote a subsequent external inventory sale more favorably than the ordinary Post-Trade Elasticity state by enough to reverse the combined initial-value result.

For a token such as CAV that is held outside the pool and traded externally, that is a material safety boundary. Preserving the marginal price did not preserve the economic depth associated with that price.

5. The counter-swap construction

The new construction uses only ordinary state transitions:

1. the user executes $A\rightarrow B$;
2. from the resulting state, Surplus executes $B\rightarrow A$;
3. the protocol allocates the actual $A$ received by Surplus.

The user receives the ordinary quoted output. Surplus does not modify the user's swap. It executes a second ordinary swap from the actual post-user state.

For full settlement, Surplus pays exactly the amount of $B$ required to restore the pool's $B$ reserve:

$$da_B^{\mathrm{user}}+da_B^{\mathrm{Surplus}}=0.$$

Both swaps preserve $c_B$. Restoring $a_B$ therefore restores

$$s_B$$

and

$$P_B.$$

Surplus receives less $A$ than the user paid. The difference remains in the pool as round-trip gain. The pool's $A$ reserve is therefore higher after full settlement; the complete pool state is not restored, and the model does not claim price preservation.

That distinction is essential. The counter-swap reaches a different price through a path of supported actions. It does not manufacture a price-preserving endpoint by changing a Reserve Asset coefficient.

5.1 Partial settlement

Surplus can supply any amount between zero and the complete user output. The user swap still executes normally. Surplus then sells the amount it supplies through an ordinary finite swap calculated from the actual post-user state.

Partial settlement does not interpolate reserves, scales, or prices after the fact. It changes only the size of the ordinary counter-swap.

5.2 Multi-asset settlement

For an atomic multi-asset user swap, all receive assets supplied by Surplus form the pay side of one ordinary multi-asset Surplus sale. The counter-action obeys the general value-flow identity:

$$\Sigma_0 = \sum_{i=1}^{n}\Sigma_i.$$

Because the counter-action is reserve-only, $\Sigma_0=0$ and therefore

$$\sum_{i=1}^{n}\Sigma_i=0.$$

It also preserves

$$c_i'=c_i$$

for every participating Reserve Asset.

If the counter-action realizes several proceeds assets, their later reserve allocations use sequential supported single-asset liquidity actions. An arbitrary partial multi-asset liquidity action is not substituted for those sequential actions unless its dispersion boundary has been enforced.

5.3 Counter-actions do not recurse

The Surplus counter-action is an underlying ordinary action, not a new user action eligible for another Surplus counter-action.

This matters because both the pay asset and proceeds asset may be Surplus assets. If a Surplus $B\rightarrow A$ sale could invoke Surplus again merely because $A$ is also held in Surplus, the protocol would create a recursive action chain. The execution boundary must disable Surplus processing inside its own counter-action.

6. Allocating realized proceeds

After the counter-swap, Surplus owns the actual $A$ received from the pool. Let the allocation send portions of that realized amount to:

• Reserves;
• Rewards;
• Treasury.

Transfers from Surplus to Rewards or Treasury do not change pool state. The reserve allocation does.

6.1 Single-asset permanent-liquidity allocation

The reserve portion is supplied through a supported single-asset liquidity action:

$$A\longrightarrow LP.$$

The active Reserve Asset $A$ and LP Token remain on their elastic curves:

$$c_A'=c_A$$

and

$$c_0'=c_0.$$

Every nonparticipating Reserve Asset $j$ keeps the same reserve and receives the common scale multiplier

$$0<\lambda<1.$$

Therefore

$$c_j'=\lambda c_j<c_j.$$

This is the permitted Reserve Asset coefficient direction.

6.2 Burning the minted LP Tokens

Let $a_0$ be LP Token supply immediately before the reserve allocation. Suppose $A\rightarrow LP$ mints

$$\Delta a_0>0$$

LP Tokens. Immediately after the liquidity action,

$$a_0^+=a_0+\Delta a_0.$$

The liquidity action preserves $c_0$, so

$$s_0^+ =c_0(a_0+\Delta a_0)^{e_s}.$$

Burning exactly the minted LP Tokens restores

$$a_0'=a_0$$

while leaving Reserve Asset state and $s_0^+$ unchanged. Consequently,

$$\boxed{ c_0' = \frac{s_0^+}{a_0^{e_s}} = c_0 \left(1+\frac{\Delta a_0}{a_0}\right)^{e_s} >c_0. }$$

The burn moves the LP Token coefficient in the permitted direction. It does not expand any Reserve Asset coefficient.

Burning is therefore safe for pool state under the coefficient-order theorem.

MEV qualification: Coefficient safety does not make the burn neutral to transaction ordering. Burning converts the reserve allocation into a pro-rata benefit for whoever holds LP Tokens at that moment. A temporary liquidity provider can enter before the Surplus allocation and remove afterward, receiving part of the added reserve. Minimum receive protects the swap user's execution but does not prevent this LP ownership strategy. Section 10.3 derives the transfer exactly. The protocol must therefore choose between burning, retaining, distributing, or locking the minted LP Tokens based on the intended recipient of the allocation.

6.3 Holding or distributing LP Tokens

Burning is not required for coefficient safety. The protocol can instead:

• retain the minted LP Tokens as protocol-owned liquidity;
• distribute them to Rewards;
• distribute them to Treasury;
• place them in an irrevocable or time-controlled account.

After the supported $A\rightarrow LP$ action, transferring the resulting LP Tokens among external accounts does not change pool state. Their eventual redemption must occur through an ordinary supported liquidity action.

The choice among holding, distributing, locking, and burning is therefore an allocation-policy question rather than a pool-state admissibility question.

7. Individual coefficient safety certificates

The coefficient order can be checked token by token.

For each token $i$, define its coefficient multiplier

$$\boxed{ \chi_i = \frac{c_i'}{c_i} = \frac{s_i'}{s_i} \left(\frac{a_i}{a_i'}\right)^{e_s}. }$$

The individual safety conditions are

$$\boxed{\chi_i\le1}$$

for every Reserve Asset, and

$$\boxed{\chi_0\ge1}$$

for the LP Token.

For a sequence of actions indexed by $t$, coefficient multipliers telescope:

$$\frac{c_i^{\mathrm{final}}}{c_i^{\mathrm{initial}}} = \prod_t\chi_{i,t}.$$

If every primitive action satisfies the individual conditions, every finite composition satisfies the endpoint coefficient order automatically.

This is the precise reason the new Surplus model can be analyzed compositionally. It is not merely a sequence of actions that have looked safe in isolated round-trip tests. Each intermediate state carries the same local certificate required by the subsequent-action theorem.

7.1 Surplus certificates by step

Step	Reserve Asset multipliers	LP Token multiplier
User swap	$\chi_i=1$ for every Reserve Asset	$\chi_0>1$
Surplus counter-swap	$\chi_i=1$	$\chi_0>1$
Single-asset $A\rightarrow LP$	$\chi_A=1$ and $\chi_j=\lambda<1$ for $j\ne A$	$\chi_0=1$
Burn minted LP Tokens	$\chi_i=1$	$\chi_0>1$
Hold or distribute minted LP Tokens	no pool-state change	no pool-state change

Every step stays inside the coefficient order.

7.2 Conditions that remain global

Individual coefficient certificates do not replace transaction consistency.

Every resulting state must satisfy

$$\boxed{s_0'=\sum_{i=1}^{n}s_i'.}$$

Every value-flow-coupled action must also satisfy

$$\boxed{ \Sigma_0 = \sum_{i=1}^{n}\Sigma_i. }$$

For a reserve-only swap, $\Sigma_0=0$ and the identity specializes to

$$\sum_{i=1}^{n}\Sigma_i=0.$$

The coefficient conditions establish state admissibility. Post-trade value-flow balance establishes properly coupled consideration. A valid action requires both.

8. Value-flow entropy

Coefficient order admits an aggregate logarithmic monotone. Its change can be written without fixed reference coefficients as

$$\boxed{ \Delta\mathcal H = \log\frac{c_0'}{c_0} - \frac{1}{n-1} \sum_{i=1}^{n} \log\frac{c_i'}{c_i}. }$$

Define the LP Token contribution

$$h_0=\log\chi_0$$

and each Reserve Asset contribution

$$h_i=-\log\chi_i.$$

When every individual coefficient condition holds,

$$h_0\ge0$$

and

$$h_i\ge0.$$

Entropy then decomposes into the individual safety margins:

$$\boxed{ \Delta\mathcal H = h_0 + \frac{1}{n-1} \sum_{i=1}^{n}h_i \ge0. }$$

For an ordinary swap,

$$\Delta\mathcal H = \log\frac{c_0'}{c_0} >0.$$

For a supported single-asset liquidity action,

$$\Delta\mathcal H=-\log\lambda>0.$$

For an LP Token burn that reverses a relative mint $r_0=\Delta a_0/a_0>0$ while retaining scale,

$$\Delta\mathcal H_{\mathrm{burn}} =e_s\log(1+r_0) >0.$$

If the LP Tokens are held or distributed rather than burned, the burn contribution is absent. The completed sequence remains entropy-nondecreasing.

8.1 Entropy is a summary, not the primary condition

A positive aggregate entropy change does not prove that every Reserve Asset coefficient moved safely. One Reserve Asset coefficient could expand while sufficiently large contractions elsewhere keep the scalar sum positive.

The primary tests are therefore

$$\chi_i\le1 \quad\text{for every Reserve Asset}$$

and

$$\chi_0\ge1.$$

Entropy is the aggregate audit value. The individual coefficient multipliers are the local certificates.

The original price-preserving receive leg illustrates the distinction. It fails locally because

$$\chi_B>1,$$

regardless of whether coefficient motion elsewhere could make total entropy nonnegative.

9. Which actions remain inside the coefficient-order admissible set?

The coefficient analysis gives the following classification for $0<e_s<1$.

Here, “Supported” means supported by the mathematical action set analyzed in this article. It does not claim that the action is already exposed by the current implementation.

Action	Coefficient result	Status
Ordinary Reserve Asset swap	Reserve coefficients fixed; $c_0$ increases	Supported
Full or partial Surplus counter-swap	Ordinary swap result	Supported
Ordinary multi-asset counter-swap	Reserve coefficients fixed; $c_0$ increases	Supported
Transfer proceeds to Rewards or Treasury	No pool-state change	Supported
Single-asset $A\rightarrow LP$	Active coefficient fixed; complement coefficients contract	Supported
Hold or distribute realized LP Tokens	No additional pool-state change	Supported
Burn protocol-owned LP Tokens without withdrawing reserves	Reserve coefficients fixed; $c_0$ increases	Supported
Proportional all-Reserve-Asset liquidity	Every coefficient fixed	Supported
Arbitrary partial multi-asset liquidity	$\lambda$ depends on dispersion and may leave the admissible domain	Not initially supported
Direct scale adjustment used only to preserve a chosen price	Can expand a Reserve Asset coefficient	Not supported
Transfer tokens into Reserves without a defined liquidity transition	Coefficient motion is undefined	Not supported
Recursive Surplus processing inside the counter-action	Does not define a finite primitive composition	Not supported

Any ordinary Reserve Asset swap has the same pool-state status regardless of who owns the external accounts. For example,

$$B\rightarrow CAV$$

or

$$A\rightarrow CAV$$

is a supported state transition when executed as an ordinary swap. Whether buying CAV from one protocol account only to return it to another advances the intended allocation policy is a separate question.

10. Subsequent actions and transaction ordering

The coefficient-order result addresses the original concern about latent state damage. After the counter-swap sequence, later supported actions begin from another state inside the same coefficient-order admissible set.

It does not make Multiswap resistant to transaction ordering.

10.1 User minimum receive

A transaction builder can attempt to buy an asset before a large user purchase and sell after the user's transaction. This is ordinary sequential-price ordering around a public DEX transaction.

The user controls that boundary through a minimum receive amount. If prior state changes reduce the output below that minimum, the user transaction reverts. The complete user swap and Surplus counter-action must be atomic so no transaction can be inserted between them.

Backrunning the final state remains possible. A backrunner must trade through the ordinary Post-Trade Elasticity curve from that state.

10.2 Surplus availability

An all-or-nothing Surplus threshold creates a discontinuity when inventory is nearly exhausted. Transaction ordering can determine which user consumes the remaining eligible inventory.

Partial settlement with a deterministic continuous coverage rule removes the sharp full-settlement threshold. It does not change the user quote or the coefficient-order proof because the covered amount is still sold through an ordinary counter-swap.

10.3 Temporary-liquidity capture around a burn

Burning the LP Tokens minted by the reserve allocation is state-safe. Economically, it converts the supplied $A$ into a benefit for whoever owns LP Tokens at the burn moment.

A temporary liquidity provider can attempt to:

1. enter through proportional liquidity before a large Surplus allocation;
2. own a fraction of the LP Token supply when the protocol burns its minted LP Tokens;
3. remove liquidity afterward;
4. receive part of the allocation through that removal.

The reserve-level transfer can be shown exactly in the fee-free model. Let $r_J>0$ be the temporary provider's proportional relative liquidity increase. Before the Surplus transaction, proportional entry changes every reserve and LP Token supply by the same factor:

$$a_i^{\mathrm{entry}}=(1+r_J)a_i$$

and

$$a_0^{\mathrm{entry}}=(1+r_J)a_0.$$

Let $d_A>0$ be the Reserve Asset $A$ amount added by the later Surplus allocation. After the allocation mints and burns its own LP Tokens, the temporary provider's LP Tokens are still $r_Ja_0$, total LP Token supply remains $(1+r_J)a_0$, and the $A$ reserve contains

$$(1+r_J)a_A+d_A.$$

Burning the temporary provider's $r_Ja_0$ LP Tokens has relative LP Token change

$$r_0^{\mathrm{exit}} = -\frac{r_Ja_0}{(1+r_J)a_0} = -\frac{r_J}{1+r_J}.$$

A proportional all-Reserve-Asset removal uses that same relative change for every reserve. The amount of $A$ returned to the temporary provider is therefore

$$\boxed{ -da_A^{\mathrm{exit}} = \frac{r_J}{1+r_J} \left[(1+r_J)a_A+d_A\right] = r_Ja_A + \frac{r_J}{1+r_J}d_A. }$$

The first term returns the temporary provider's original $A$ contribution. The second term is a positive portion of the Surplus reserve allocation. Ignoring fees and rounding, increasing $r_J$ lets temporary liquidity capture an increasing fraction of $d_A$.

The proportional entry and removal preserve every coefficient, so both have

$$\Delta\mathcal H=0.$$

The allocation and burn between them increase entropy. The entire sequence remains inside the safe coefficient order even though the temporary LP receives value intended for incumbent LP holders.

Minimum receive on the user's swap does not directly prevent this allocation capture. The issue concerns ownership at the LP Token burn, not whether the user received an acceptable swap output.

This produces a policy choice:

• burning rewards LP Token holders present at the burn;
• retaining the minted LP Tokens creates protocol-owned liquidity;
• distributing them assigns liquidity claims directly to Rewards or Treasury;
• placing them in an irrevocable account makes the associated liquidity nonredeemable without creating an immediate pro-rata donation to active LP Token holders.

All four choices can remain inside the pool-state coefficient order. They differ in ownership and susceptibility to temporary-liquidity allocation capture.

10.4 MEV sensitivity by action

No permissionless DEX action is generally resistant to transaction ordering. The relevant question is which Surplus actions introduce sensitivity beyond an ordinary user trade and which limits apply.

Action	Principal ordering sensitivity	Required control
User Reserve Asset swap	A transaction can execute before the user and worsen the user's output	User-specified minimum receive or maximum pay
User liquidity removal	Prior state changes can reduce the Reserve Asset output	User-specified minimum receive
Surplus counter-swap	A separately executable counter-action could be inserted around or separated from the user action	Execute the user action and counter-action atomically; apply an explicit minimum counter-swap receive when settlement rounding or fees make the result variable
Full-settlement inventory threshold	Ordering can determine which transaction consumes the last eligible Surplus inventory	Prefer deterministic partial coverage; otherwise make the all-or-nothing rule and inventory snapshot explicit
Multi-asset counter-swap	A public, predictable basket sale creates several final price changes that can be backrun	Execute atomically, use fixed allocation rules, and enforce minimum proceeds for every receive asset
Sequential reserve allocations	The final state depends on the fixed order of single-asset liquidity actions	Fix the order in protocol rules and enforce minimum LP Token receive for each provision
LP Token burn	Temporary liquidity can enter before the burn and receive part of the allocation afterward	Minimum receive is insufficient; retain, distribute, or lock LP Tokens, or define time-based eligibility for burn benefits
Standalone protocol $A\rightarrow CAV$ swap	A known protocol purchase can be traded around like any predictable order	Enforce minimum CAV receive, maximum price movement, and an explicit execution-size rule
Surplus-assisted $LP\rightarrow A$ removal	The user leg has ordinary removal exposure; allocating or burning the counter-provision's LP Tokens adds the ownership-at-allocation issue	Minimum receive for the user removal and the same LP allocation policy used for swap Surplus

The compound user action and its counter-action must be indivisible. Atomicity prevents insertion between their intermediate states, while minimum receive limits adverse ordering around the complete transaction. Neither control prevents temporary LP ownership around an LP Token burn because that strategy targets allocation ownership rather than the user's execution price.

11. Extending Surplus to liquidity removal

The same compositional analysis applies to a user removing a single Reserve Asset:

$$LP\longrightarrow A.$$

Surplus can supply the received $A$ through the counter-action

$$A\longrightarrow LP.$$

The user removal and Surplus counter-provision are both supported single-asset liquidity actions. Let their complement multipliers be

$$0<\lambda_{\mathrm{remove}}<1$$

and

$$0<\lambda_{\mathrm{provide}}<1.$$

Their combined entropy change before any LP Token burn is

$$\boxed{ \Delta\mathcal H = -\log\lambda_{\mathrm{remove}} -\log\lambda_{\mathrm{provide}} >0. }$$

Surplus realizes LP Tokens from the counter-provision. It can allocate those LP Tokens directly to Rewards and Treasury and burn, retain, or lock the remaining portion.

Every such choice is state-safe when:

• both liquidity actions satisfy the supported single-asset equations;
• every reserve and scale remains positive;
• the LP Token burn, if any, removes only protocol-owned LP Tokens without withdrawing Reserve Assets.

The composition does not restore the entire pool. Although restoring $a_A$ also restores the active $A$ state because $c_A$ remains fixed, every nonparticipating Reserve Asset coefficient receives the product

$$\lambda_{\mathrm{remove}} \lambda_{\mathrm{provide}} <1.$$

That contraction is the permitted safety direction. It is a real economic effect of the two liquidity actions, not an accounting error.

12. Boundaries that remain open

The coefficient result is strong, but it has a defined domain.

12.1 The exact boundary $e_s=0$

At

$$e_s=0,$$

coefficient becomes scale:

$$c_i=s_i.$$

Swaps and the stated liquidity equations remain defined, but the strict extraction proof for liquidity sequences uses the positive reserve sensitivity of

$$s_i=c_i a_i^{e_s}.$$

That sensitivity disappears at $e_s=0$. Entropy is constant rather than strictly increasing across the supported boundary operations.

The counter-swap portion remains an ordinary swap composition. A complete Surplus sequence containing liquidity allocation at $e_s=0$ requires its own extraction-safety proof before receiving the same production status.

12.2 Fees

The analysis above is fee-free. Fee integration must specify whether the Surplus counter-action replaces gross or net user output, which account owns the fee, and how fee transfers affect reserve, scale, and coefficient accounting.

Fees cannot be added as an unexplained difference between token movement and the quoted state transition.

12.3 Rounding

Production arithmetic must round exact-input output down and exact-output input up in favor of the pool. Every intermediate action must independently preserve:

$$a_i'>0, \qquad s_i'>0,$$

the aggregate scale identity, and the individual coefficient directions within the chosen numerical tolerance.

An implementation that preserves the final aggregate result while allowing repeated adverse per-leg rounding can accumulate state drift. The leg certificates expose that failure directly.

12.4 External sale policy

Pool-state safety does not determine whether CAV was sold at a desirable external price. Eligible assets, maximum sale size, timing, inventory limits, and any external-price controls belong to the Surplus execution policy.

The internal theorem establishes that a permitted sale leaves the pool inside the supported coefficient order. It does not replace token-sale policy.

13. Implementation invariants and property tests

Every primitive action and every randomized composition should verify:

Positive state

$$a_i'>0, \qquad s_i'>0.$$

Aggregate scale

$$\boxed{s_0'=\sum_{i=1}^{n}s_i'.}$$

Value flow

$$\boxed{ \Sigma_0 = \sum_{i=1}^{n}\Sigma_i. }$$

For a reserve-only swap, also verify

$$\Sigma_0=0 \quad\Longrightarrow\quad \sum_{i=1}^{n}\Sigma_i=0.$$

Reserve Asset coefficient direction

$$\boxed{ \frac{s_i'}{s_i} \left(\frac{a_i}{a_i'}\right)^{e_s} \le1 }$$

for every Reserve Asset.

LP Token coefficient direction

$$\boxed{ \frac{s_0'}{s_0} \left(\frac{a_0}{a_0'}\right)^{e_s} \ge1. }$$

Entropy

$$\boxed{\Delta\mathcal H\ge0.}$$

Entropy is a diagnostic summary. The componentwise coefficient assertions remain authoritative.

The randomized sequence suite should include:

• full and partial Surplus counter-swaps;
• multi-asset Surplus sales;
• sequential single-asset reserve allocations;
• holding, distributing, locking, and burning realized LP Tokens;
• user liquidity removal followed by Surplus counter-provision;
• later swaps and liquidity actions from every resulting state;
• temporary proportional liquidity around a permanent-liquidity allocation;
• values near reserve positivity and $\lambda$ boundaries;
• integer conversion and pool-favorable rounding.

Conclusion

Surplus settlement remains coefficient-order admissible when it is built from actions that preserve the Post-Trade Elasticity coefficient order at every intermediate state.

The original price-preserving transformation fails that test on the receive leg:

$$c_B'>c_B.$$

It preserves a marginal price while replacing the depleted pricing reserve with full depth. A concrete later-inventory comparison shows why that distinction matters.

The counter-swap construction has a different structure:

$$\text{ordinary user swap} \longrightarrow \text{ordinary Surplus counter-swap} \longrightarrow \text{supported allocation actions}.$$

Every Reserve Asset coefficient remains fixed or contracts. The LP Token coefficient remains fixed or increases. Those directions survive composition and therefore remain valid under subsequent supported actions.

The local certificate is

$$\boxed{ \chi_i = \frac{s_i'}{s_i} \left(\frac{a_i}{a_i'}\right)^{e_s}. }$$

Require

$$\chi_i\le1$$

for every Reserve Asset and

$$\chi_0\ge1$$

for the LP Token. Value-flow entropy then aggregates the nonnegative logarithmic margins of those individual certificates.

LP Token burning passes the state test. Whether to burn, retain, distribute, or lock the minted LP Tokens depends on who should own the permanent-liquidity allocation and how the protocol handles temporary liquidity around that allocation.

This separates three questions that should remain separate:

1. state safety: does every token remain inside the coefficient order?
2. transaction consistency: do scale and post-trade value flow balance exactly?
3. allocation policy: who receives the economic benefit of Surplus inventory?

The counter-swap model answers the first two through supported composition. The third remains an explicit protocol choice.