Buyer behavior

Buyer behavior determines when an Agreement stops or completes early. The model combines baseline hazards, price-dependent multipliers, underwater redirects, a lost-conviction rule and a rational walk-away boundary. These rules are assumptions to test, not calibrated observations of the program.

This chapter explains their order and interactions. Implementation: defaults.rs, steps 1–4 of engine.rs::run, and boundary.rs.

The repository supplies no observed BTC Now vintage dataset with which to calibrate these rules. The baseline is the program’s actuarial prior, the multipliers are motivated by mortgage evidence, and the frontier follows the explicit assumptions about the Buyer’s beliefs and choices. The last section says how a Holder should bracket them. The worked numbers use the base terms: a $60,000 coin at 1.475×, 60 payments of $1,475, payment 1 to BTC Now, 5% on every delivered dollar, par purchase, the stop sale 18 days after the missed payment at 25 bp.

The four steps of a month

engine.rs::run evaluates every calendar month in a fixed order, and the order is part of the model (spec §4):

1. Scheduled payments. Every active Agreement at age \(1 \le t \le n\) pays payment \(t\), unless a walk is pending. Under the rational boundary (input #25) the decision comes first: below the frontier the payment is not made and a walk is armed.
2. Walks. (2a) A walk armed at this date executes now; the walk is the missed payment. (2b) The lost-conviction streaks update and may arm a walk for the next date.
3. Early completions. One uniform draw per active Agreement at ages \(1 \le t < n\), against the propensity \(u_t\).
4. Stop draws. One uniform draw per active Agreement at ages \(1 \le t < n\), against the hazard \(h_t\), multiplied and redirected as the toggles say.

Two timing facts follow. An early completion or hazard draw at age \(t\) follows payment \(t\). Early completion pays the remaining schedule immediately; a hazard draw misses payment \(t+1\). A walk in step 2 consumes the date unpaid; the missed payment is \(t\) itself. The stop waterfall takes the missed date from there.

Since v1.6 every Agreement carries its own ChaCha20 stream, seeded from the configuration seed and its id (engine.rs::agreement_rng), and the draws in steps 3 and 4 are taken unconditionally before any price test. A bumped price changes which draws matter, never the draws themselves; that is what makes the risk desk’s bump-and-revalue a sensitivity rather than noise.

The baseline hazard

Input #7 in its default form is DefaultScenario::BaselineCurve { lifetime }. It produces a vector \(h_1, \dots, h_n\) of monthly hazards indexed by payment age (defaults.rs::DefaultScenario::monthly_hazard; index 0 is unused so that h[t] reads directly). \(h_t\) is the probability that an Agreement which has just made payment \(t\) stops before payment \(t+1\).

The hump

The shape is a step function of term fraction \(x = t/n\) (defaults.rs::shape_weights):

At 60 months this reproduces the program’s actuarial buckets exactly (shape_at_60_matches_actuarial_buckets). At 36 months the hump runs from payment 2 to payment 9; at 120 months from payment 7 to payment 30. Normalizing to term fraction is spec v1.1 change 1 (Marc, 2026-07-10): the term is a parameter, so the shape travels with it.

The hazard is the shape times one scalar:

\[ h_t = \min(1, K, w_t), \qquad t = 1, \dots, n-1, \qquad h_n = 0 . \]

The reachable domain

No new hazard draw occurs after the final payment. An Agreement that pays at age n completes before step 4, so monthly_hazard sets h_n = 0 and lifetime calibration uses draw ages 1…n−1. A draw after payment n−1 can still cause the Buyer to miss payment n, with the sale and receipt occurring later. A conviction walk armed earlier or a rational-boundary decision can also consume the final date unpaid. SimConfig::check rejects a positive baseline lifetime target below two months because there is no eligible earlier draw age.

Calibrating K

\(K\) is chosen so that on a flat path, with no other mode on, the lifetime stop share equals the input exactly (defaults.rs::calibrate_k):

\[ 1 - \prod_{t=1}^{n-1} \bigl(1 - \min(1, K,w_t)\bigr) = \text{lifetime} . \]

The left side is increasing in \(K\), so bisection works, over the bracket \([0, 1/\max w]\): at the upper bound the heaviest bucket stops with certainty, so any target in \([0, 1)\) is reachable at any term with a reachable age. Eighty halvings fix \(K\). A target of zero short-circuits to \(K = 0\) (zero_lifetime_means_zero_hazard).

At the base terms and the 40% program prior:

\(K = 0.009767\). The product over ages 1 to 59 gives a lifetime share of 0.400000; baseline_hits_lifetime_target_over_reachable_ages checks this within \(10^{-9}\) at terms 36 to 120 and targets 15% to 70%, and short_terms_reach_high_lifetime_targets checks that a two-month term, with a single reachable age, lands 70% exactly. The unconditional mass by year follows: 18.7% of the original book in year one, 12.4% in year two, 5.5% in year three, 1.8% in year four, 1.6% in year five. The simulate response carries the vector as hazard_monthly, and the cockpit’s “when they stop paying” exhibit charts it.

The FICO presets

Input #8 is a one-click load of the baseline with a band’s lifetime target (defaults.rs::DefaultScenario::fico_preset):

The presets change nothing but the target. The program’s pricing stance is 40%, which sits between the 600 and 500 bands; the Model Card runs 40% as Panel A and 70% as Panel B.

Flat annual

DefaultScenario::FlatAnnual { annual_rate } has rate semantics, not lifetime semantics. The monthly hazard is the rate that compounds to the annual one:

\[ h = 1 - (1 - r_{\text{annual}})^{1/12}, \qquad h_t = h ;; (1 \le t < n), \qquad h_n = 0 . \]

A 10% annual rate gives \(h = 0.8742\%\) per month, and over the 59 reachable ages of a 60-month term a lifetime share of 40.4%, near the program prior by coincidence. flat_annual_compounds_over_defaultable_months checks a 13-month term: ages 1 to 12 carry the rate and the survival product is 0.90.

Custom per-year shares

DefaultScenario::CustomYearly { shares } (spec v1.4 change 5, Marc, 2026-07-12) lets a Holder state a timing view in the form the memo’s tables use: shares[y] is the unconditional share of the original book that stops in year \(y+1\). Mass semantics, so the shares sum to the lifetime share. defaults.rs::custom_yearly_hazard converts them to hazards in two moves.

First, each year’s mass spreads uniformly over its reachable ages. Year \(y\) covers ages \(12y+1\) to \(\min(12(y+1), n-1)\); the final payment date is excluded here for the same reason as above. Second, mass becomes hazard by survival division:

\[ h_t = \frac{m_t}{\prod_{k<t}(1 - h_k)} = \frac{m_t}{1 - \sum_{k<t} m_k} . \]

The denominator is the share of the book still on it when age \(t\) arrives, so on a flat path the realized year-by-year shares equal the inputs to the last digit (custom_yearly_realizes_shares_exactly, tolerance \(10^{-12}\)).

Take shares of 10%, 8%, 5%, 3%, 2% at 60 months. Year one carries \(0.10/12 = 0.8333\%\) of the book at each of ages 1 to 12; the hazard is 0.8333% at age 1 and rises to 0.9174% at age 12 as the survivors thin, then steps down to 0.7407% at age 13. Year five has eleven reachable ages (49 to 59), 0.1818% each, and the hazard at age 59 is 0.2519%.

Validation lives inside custom_yearly_hazard, so every consumer of the hazard sees the same rules. Each names input #7:

• one share per year of the term, \(\lceil n/12 \rceil\) of them (custom_yearly_rejects_wrong_length);
• every share finite and non-negative (custom_yearly_rejects_negative_share);
• the sum at most \(1 - 10^{-9}\); a sum within a few ulps of one drives the survival denominator through zero mid-curve, and the headroom keeps every hazard finite and in \([0, 1]\) (custom_yearly_rejects_sum_at_or_above_one, custom_yearly_rejects_sum_within_ulps_of_one, custom_yearly_hazards_stay_in_range_near_the_cap);
• a year with no reachable age must carry a zero share. At 37 months, year four contains only payment 37, the final date, so its share must be 0% (custom_yearly_rejects_mass_in_undefaultable_year).

The cockpit seeds this mode with three unbranded chips (the program hump, flat through time, late-loaded stress), not with named asset-class tables: published curves blend the life-event and collateral channels, and the collateral channel is what the next modes model.

Drawdown state multipliers

Input #23 (drawdown_hazard_multipliers, spec v1.4 change 10, from the program’s drawdown memo §09) is the graded middle ground between a price-blind draw and a rational robot. Each month, before the draw is compared to the hazard, the hazard is multiplied by a state read off this Buyer’s coin against this Buyer’s entry (engine.rs::drawdown_multiplier):

\[ h_t^{\text{eff}} = \min\bigl(1, h_t \cdot m(S_t / \text{strike})\bigr) . \]

A coin exactly at entry has drawdown zero and sits in the ×1.0 bucket, so a flat path at entry with the toggle on reproduces the toggle-off run draw for draw (drawdown_multipliers_scale_defaults_by_state, 2,000 Agreements; it then checks that a rally to $240,000 cuts stops and a collapse to $12,000 raises them). Depth enters through the multiplier and duration through months spent in the state. There is no cliff: a 40% drawdown costs 1.5× the hazard for each month it persists, 2.93% instead of 1.95% a month at the hump, 0.37% instead of 0.24% in the tail. Realized lifetime shares become path-dependent by design; the flat path lands the target, deep crashes run above it.

The evidence is the mortgage double trigger (memo §09). Price alone rarely stops anyone: in the underwater-mortgage literature only about 6% of defaults were purely strategic, and the median walk-away carried negative equity of about 62%. What produces a stop is price pain coincident with a liquidity shock. The multipliers embed that correlation without modeling the shock: a Buyer whose coin has halved is not assumed to walk, but to be twice as likely to let a bad month become a missed payment. The ×0.5 above entry is the same logic in reverse, and under the September waterfall it matters more than it used to: an in-the-money stop hands the surplus above the Purchase Price to the Holder, and the archived Model Card (§6) names how often such Buyers stop as the least-evidenced behavior in the model. With the X-suite oracle running the same multipliers, the deterministic crash grid ties within ±0.3 points (spec v1.4 change 10).

The rational-default redirect

Input #9 (rational_default, spec §4.2) keeps the hazard and moves the stops. Step 4 draws each Agreement as before. If the draw fires and the Buyer is underwater, the stop sticks, tagged NonPerformanceRational. If the draw fires and the Buyer is above water, the engine builds the pool of active Agreements at reachable ages that are underwater this month and picks one uniformly, from the drawing Agreement’s own stream so the redirect too is fixed by the seed. If the pool is empty the draw is suppressed and counted (SimResult::suppressed_defaults); it never spills onto an in-the-money Buyer. That was Marc’s answer to spec open question 3 (v1.1, 2026-07-10): suppress, with a visible counter.

Underwater here means moneyness below one against the amortized obligation, not against the entry price and not against the nominal schedule (engine.rs::Agreement::underwater):

\[ S_t < B_t, \qquad B_t = \text{strike},(1+i)^t - \text{PMT},\frac{(1+i)^t - 1}{i} , \]

with \(i\) the implied monthly rate, solved once per Agreement and cached. The contract chapter derives \(B_t\) and says why it, rather than \(R_t\), is the boundary: a coin at $60,000 after twelve payments is above water against \(B_{12} = $51{,}581\), and against \(R_{12} = $70{,}800\) every Buyer on a flat path would be “underwater” for nineteen months.

The effect is the memo’s moneyness conditioning in one toggle: the identical lifetime curve concentrates into drawdown periods and underwater cohorts. On a strong rally nobody is underwater late in the term, so draws are suppressed and the realized share bends below the target (rational_mode_suppresses_when_nobody_is_underwater: a zero-vol bridge to $240,000 with 200 Agreements must show a positive suppression count and fewer stops than the same seed with the toggle off). With input #23 also on, the drawing Agreement’s hazard is scaled by its own state first, then the redirect looks for someone underwater.

The lost-conviction rule

Input #11 (ConvictionRule, spec §4.3) is the strategic cohort, deterministic and separate from the randomizer. The rule has two dials, \(X\) and \(Y\), default off and \(X = 50\%\), \(Y = 6\) when on. Each month at step 2b, for every active Agreement at a payment age, the engine tests the coin against the entry price:

\[ S_t < (1 - X),\text{strike} . \]

A month that breaches extends the streak; a month that does not resets it to zero. When the streak reaches \(Y\), a walk is armed for the next payment date; at that date the Buyer skips step 1 and the walk executes at step 2a with that date as the missed payment, tagged ConvictionWalk. Measuring \(X\) against the strike rather than the obligation was Marc’s answer to open question 2 (v1.1, 2026-07-10): the conviction rule is about the Buyer’s own entry; the obligation boundary belongs to the rational toggle.

At the base terms with the defaults on, a Buyer walks at the seventh payment date after six consecutive payment dates with the coin below $30,000. conviction_walks_fire_on_deep_drawdown runs a zero-vol bridge to $18,000 with no hazard and 50 Agreements; all 50 walk and none complete. The tornado’s “behavioral floor” is this rule at \(X = 0\), \(Y = 2\): every Buyer whose coin has sat below entry for two dates walks at the third. Scenario chip S4 (spec §8.1) is the ruthless version, \(X = 0\), \(Y = 1\), with the rational toggle on.

Early completion

Early completion (input #12, spec §4.4) is the up-side exit and the model cannot reproduce the memo without it. At step 3, for each active Agreement at a reachable age, the propensity is

\[ u_t = p \cdot \max!\Bigl(0, \frac{S_t - R_t}{S_t}\Bigr) , \]

with \(p\) the monthly propensity (default 2.5%) and \(R_t\) the remaining nominal schedule after this month’s payment. The Buyer completes if the uniform draw falls below \(u_t\). The factor is the Buyer’s equity in the coin as a share of the coin: nobody pays $70,800 in cash for a coin worth $60,000, and the propensity is zero there. After twelve payments with the coin at $100,000, \(u = 0.025 \times 0.292 = 0.73\%\) per month; after 36 payments at $120,000, 1.76%. engine.rs::settle then posts \(R_t\) from the Buyer to the Holder less the fee, and the Buyer takes the coin, cash-only by ruling (spec v1.5 change 3, Marc, 2026-09-03); the coin-sale make-whole of v1.4 no longer exists. Every completed-early Agreement has strictly positive coin equity, because \(u_t > 0\) requires \(S_t > R_t\) (settlements_deliver_remaining_schedule_on_upside).

Input #22, the take-profit gate (settlement_min_return, spec v1.4 change 6, Marc, 2026-07-12; engine.rs::validate accepts 0 to 1000%), is the behavioral mirror of the conviction rule. Ungated, the Buyer is coldly marginal: he compares the coin to what remains, sunk payments ignored. Gated at \(x\), he only completes once the coin beats his all-in cost by the margin:

\[ S_t \ge P,(1 + x) = \text{strike} \times \text{multiple} \times (1 + x) . \]

At the base terms and the cockpit’s \(x = 10\%\), that is $97,350. The gate applies before the propensity test. On a flat path at $60,000 the ungated rule fires late in the term, once \(R_t\) falls below the coin, and a 0% gate silences every one of them because the coin never beats $88,500 (take_profit_gate_blocks_settlements_below_all_in); on a run to $200,000 a 10% gate opens and a 1000% gate stays shut (take_profit_gate_opens_above_threshold). Default off. The propensity is a prior (archived Model Card §7) and early completion accelerates scheduled receipts but removes later stop exposure and possible surplus. A Holder isolating its effect sets the propensity to zero (spec §4.4). The Model Card runs 2.5%, ungated.

The rational boundary

Input #25 (rational_boundary: Option<BoundaryParams>, spec v1.6 change 6, Marc, 2026-09-03) is the fifth mode and the only one that carries no prior. It was lifted from the parked Behavior Engine and re-derived for the September stop. The question it answers: at each payment date and each price, what would a Buyer do who values the Agreement correctly under his own beliefs? The answer is a frontier, the spot below which walking is optimal, one number per payment date. boundary.rs::rational_frontier computes it by backward induction; the engine reads it as a rule.

The parameters (BoundaryParams, validated by BoundaryParams::validate naming input #25):

The walk cost lumps the six-month lockout, the re-strike at market and the loss of access into one number, and it is a fraction of the strike so that the frontier is scale-invariant (frontier_is_scale_invariant_in_the_strike checks $15,000 and $240,000 coins against the $60,000 one to \(10^{-6}\)).

The lattice

Time runs in price steps finer than decisions: SUB = 4 steps per month, \(\Delta = 1/48\) of a year, 240 steps over a 60-month term. Each step is a Cox-Ross-Rubinstein move in log-spot, \(u = e^{\sigma\sqrt{\Delta}}\), \(d = 1/u\); at the defaults \(\sigma\sqrt{\Delta} = 0.05976\), \(u = 1.0616\). The up-branch probability matches the believed drift, so the expected gross return per step is \(e^{\mu\Delta}\):

\[ q = \frac{e^{\mu\Delta} - d}{u - d} , \]

which is 0.5287 at \(\mu = 25\%\), 0.4851 at \(\mu = 0\), and must lie in \([0, 1]\); the code rejects \(|\mu|\sqrt{\Delta} > \sigma\) with a message to raise sigma or lower the drift. Continuation values discount at the Buyer’s rate, \(e^{-r_c \Delta} = 0.99688\) per step.

The grid is full width rather than a tree from a single root: node \(k \in [-K_{\max}, K_{\max}]\) has spot \(S_0 u^k\), with \(K_{\max} = 240 + 12\), 505 nodes. A recombining tree rooted at entry reaches only \(e^{-4\sigma\sqrt{\Delta}} = 0.787\) of entry at month one, so it could not see a coin that had halved at payment 1; the Phase 1 adversarial review (2026-09-03) found that such a Buyer kept paying until payment 4. The full grid sees the walk region from the first date (frontier_covers_every_payment_and_is_visible_from_payment_one), and rational_boundary_walks_the_book_in_a_crash_and_spares_it_in_a_rally pins the fix: a coin at 45% of entry at payment 1 walks at payment 1. At the outermost nodes the missing neighbor is the node itself.

The three payoffs

Controls apply at payment dates only, steps \(s = 4t\) for \(t = 1 \dots n\). At the date of payment \(t\), before paying, with \(A = \sum_{k<t} p_k\) the payments already made and \(R = P - A\) the remaining schedule with payment \(t\) included, the Buyer chooses the best of (boundary.rs::rational_frontier, closure decide):

\[ \text{walk} = \text{refund}(t, S) - c_{\text{walk}}, \qquad \text{refund} = \min\bigl(A, \max(0, S(1 - c_{\text{sale}}) + A - P)\bigr) , \]

\[ \text{settle} = S - R ;; (\text{only if } S > R), \]

\[ \text{pay} = -p_t + \mathbb{E}\bigl[e^{-r_c\Delta}, V_{\text{next step}}\bigr], \qquad \text{pay}_n = -p_n + S . \]

Walking is the September stop from the Buyer’s side: the coin is sold at spot less the sale cost, the refund is what the waterfall pays him, and the walk cost is subtracted. Settling is cash-only early completion: pay the rest, keep the coin. Paying buys the continuation; at the last date the coin is owned at once, the terminal condition. Between dates the value propagates, \(V = e^{-r_c\Delta}(q V^{+} + (1-q) V^{-})\).

The lattice’s settle uses \(R\) with payment \(t\) included, because the decision precedes the payment; the engine’s step 3 uses \(R_t\) after payment \(t\), because payments ran first. Same quantity, read one payment apart.

The frontier

At each payment date the code records, for every node, the gap between walking and the better of paying and settling. The frontier is the crossing between the highest node where the gap is positive and the next node up, interpolated on the gap in log-spot:

\[ S^\ast_t = S_k \cdot \exp\Bigl(\sigma\sqrt{\Delta} \cdot \frac{g_k}{g_k - g_{k+1}}\Bigr) , \]

clamped to the step. It is not the node itself; a node-valued frontier would jump by 6% at a time. None means no node on the grid walks at that date. FrontierRow carries the crossing in dollars (walk_below_spot), as a fraction of entry (walk_below_of_entry, the frame of the risk desk’s two lines), and in moneyness against \(B_{t-1}\) (walk_below_moneyness), plus \(B_{t-1}\) and \(R\) themselves.

Why one threshold

Walking beats settling only where the refund is zero. With \(V = S(1 - c_{\text{sale}})\), if the refund is positive it equals \(\min(A, V - R)\), and

\[ \text{settle} - \text{walk} = S - R - \text{refund} + c_{\text{walk}} \ge S - V + c_{\text{walk}} = S,c_{\text{sale}} + c_{\text{walk}} > 0 . \]

So above the schedule line the Buyer who wants out settles rather than walks. Where the refund is zero the walk payoff is the constant \(-c_{\text{walk}}\), while the pay payoff increases with spot through the continuation. A constant against an increasing function crosses once, so the walk region is a lower region and the frontier is a single threshold per date. walk_region_sits_where_the_refund_is_zero checks that every crossing lies at most one grid step above \(R / (1 - c_{\text{sale}})\), which at payment 12 is $72,456.

A function of belief

The frontier depends on what the Buyer believes about the coin, and the engine reports it for several beliefs rather than one. The risk endpoint (POST /api/forwardflow/risk, default frontier_mus of 0, 10%, 25% and 50% per year) returned the following at the base terms and default parameters, as a fraction of entry:

Read the first column. Under zero believed drift the rational Buyer walks at 116% of entry at payment 1, and in moneyness against \(B\) the boundary stays at or above 1.0 through payment 46. A coin you do not expect to appreciate is not worth financing at 1.475× and a 15% discount rate, whatever the volatility; the lattice found this on 2026-08-06 and the new stop did not change it (pessimist_robot_walks_at_par). At \(\mu = 10\%\) the boundary sits within about a percent of the amortized obligation for two years, the Buyer who is indifferent to the deal. At the default \(\mu = 25\%\) the frontier is about half of entry through the first year and 0.24 of entry at payment 48. At \(\mu = 50\%\) it starts at 15% of entry. Every column meets at 2.4% of entry at payment 59: two payments remain, $2,950, walking costs $1,500, so the Buyer pays whenever the coin is worth more than about $1,450. At payment 60 paying always wins.

The tests fix the directions: higher sigma does not raise the frontier (higher_sigma_deepens_the_frontier, 30% against 60%), and neither does a higher walk cost or a stronger belief (walk_cost_and_belief_deepen_the_frontier). Every number in the other four modes is a prior about people; this one is arithmetic about the contract, given a belief. That is why the plan (§4, Marc, 2026-09-03) lifted it out of the parked Behavior Engine and left the thirty-seven-parameter machine on its branch.

In the engine

With input #25 on, engine.rs::run computes the frontier once per run from cohort-1 terms and keeps walk_below_of_entry per row; scale invariance makes that vector serve every Agreement, dispersed strikes included. At step 1, before payment \(t\), the Buyer reads frontier[t − 1] and compares:

\[ S_m < f_{t} \cdot \text{strike} ;\Rightarrow; \text{do not pay; arm the walk} . \]

The walk executes at step 2a in the same month with the exit tag RationalBoundary (rational_boundary in the exit split and the per-Agreement table), and the missed date is \(t\): the walk is the missed payment. The stop waterfall then runs as for any stop. The engine test runs a zero-vol collapse to $12,000 past the pessimist robot, with no hazard and no early completion; all 30 Buyers walk with exit month equal to payments made plus one, and the same book on a rally to $240,000 under \(\mu = 25\%\) completes in full.

The bracket a Holder should run

No single mode is BTC Now’s house view, because there is no vintage to make it one. The plan (§4), the spec (input #25) and the archived Model Card (§7) ask for a bracket instead, four readings of the same paths:

The first three differ mostly in how often an in-the-money Buyer stops, which under the September waterfall is the parameter that moves the upside: a stop above the Purchase Price hands the surplus to the Holder, and the replay medians move by ten points on a handful of such stops per vintage (archived Model Card §6). The frontier answers a different question, the floor under a fully informed Buyer with a stated belief, and the risk desk draws it beside the schedule line and the capital line. A Holder who runs all four has the band; the plan’s recommendation (§6) is to state the band and the best-estimate preset, and to say that the band is the answer. The six-month lockout after a stop (Marc, 2026-09-03) is not modelled (spec v1.5 change 8); it enters only through the walk cost of input #25.