Surfaces and hedging

Compare the Agreement with a hedge under the same scenario. This chapter explains the price models, volatility surface, option valuation, hedge cash flows and monthly marks. It also states the costs, lifecycle rules and funding assumptions behind the comparison.

Implementation: paths.rs, surface.rs, hedge.rs, series.rs and coin.rs; reference tests include tests/paths_models.rs, tests/surface.rs and tests/hedge.rs. Use Hedge strategies for comparisons and Monthly analysis for cash and P&L.

Historical worked figures in this chapter record earlier configurations and fixtures; they predate the 0.6.0 Coin funding and stop-state corrections and the 0.6.1 monthly Coin sensitivity correction unless explicitly stated otherwise. They are not current workspace results or market quotes. Re-run a saved request on the recorded engine to reproduce an old figure. The default surface is stylised; read its source and the engine identity with each completed analysis.

Price models

The path mode is one enum, paths.rs::PathMode, and the four Phase 2 models sit beside the bridge, the replay, the bootstrap and the custom path. All four share one convention: the diffusion draws are the first horizon standard normals of the run’s seeded stream, one per month (paths.rs::draw_normals), and every model that needs more draws (jump counts, jump sizes, regime switches) takes them after. So the diffusion under a jump-diffusion at \(\lambda = 0\), or a regime switch at equal vols, is the same path as plain GBM on the same seed: the reductions are exact (jump_diffusion_without_jumps_is_gbm_exactly, regime_switching_with_equal_vols_is_gbm_exactly).

Geometric Brownian motion, PathMode::Gbm { mu_annual, vol_annual }. The monthly log step is paths.rs::gbm_log_step:

\[ \ln \frac{S_{k+1}}{S_k} = \frac{\mu - \tfrac{1}{2}\sigma^2}{12} + \sigma \sqrt{\tfrac{1}{12}}, z_k , \]

so \(\mathbb{E}[S_t] = S_0 e^{\mu t}\) with \(t\) in years; the \(-\sigma^2/2\) is the Itô correction. At \(\sigma = 0\) it is the exponential ramp at \(\mu\) (gbm_zero_vol_is_the_exponential_ramp_at_mu). Unlike the bridge, the far end is free. The drift must lie within ±500%/yr and the vol in [0, 500%), or the input is named in a 400.

Jump-diffusion, PathMode::JumpDiffusion { mu_annual, vol_annual, jump_rate_annual, jump }. Each month adds \(N_k \sim \text{Poisson}(\lambda/12)\) jumps (paths.rs::poisson_count, Knuth’s product method on the run’s own uniforms, so the draw sequence is this crate’s and not a library’s), each a log-size draw \(J\) from paths.rs::JumpKind, and the drift is compensated so that \(\mathbb{E}[S_t] = S_0 e^{\mu t}\) still holds with the jumps in (paths.rs::jump_diffusion):

\[ \ln \frac{S_{k+1}}{S_k} = \frac{\mu - \tfrac{1}{2}\sigma^2}{12} - \frac{\lambda}{12},\kappa + \sigma \sqrt{\tfrac{1}{12}}, z_k + \sum_{i=1}^{N_k} J_i , \qquad \kappa = \mathbb{E}[e^{J}] - 1 . \]

The compensator \(\kappa\) is JumpKind::compensator. For Merton (1976), \(J \sim \mathcal{N}(m, v^2)\) and \(\kappa = e^{m + v^2/2} - 1\). For Kou (2002), \(J\) is an up-jump \(\text{Exp}(\eta_+)\) with probability \(p\) and a down-jump \(-\text{Exp}(\eta_-)\) otherwise, and

\[ \kappa = p,\frac{\eta_+}{\eta_+ - 1} + (1 - p),\frac{\eta_-}{\eta_- + 1} - 1 , \]

which is why the validation insists on \(\eta_+ > 1\) (kou_rejects_eta_up_at_or_below_one): below it the mean of \(e^{J}\) does not exist. A Kou draw of eta_down: 4 has a mean down-jump of −25% in log terms, a Merton mean_log: −0.20 a typical jump of about −18%. Both compensations are checked on the terminal mean over seeds (merton_jump_diffusion_mean_is_compensated, kou_jump_diffusion_mean_is_compensated). \(\mu\) is the expected growth rate jumps included; \(\sigma\) is the diffusion’s vol alone.

Regime switching, PathMode::RegimeSwitching. A two-state monthly Markov chain on the vol, calm or stressed, one drift. Month \(k\)’s return uses the state entering month \(k\) at that state’s \(\sigma\); then one uniform decides the switch for the next month at p_calm_to_stressed or p_stressed_to_calm (paths.rs::regime_switching). A chain that can never move still takes its draws, so the path depends on the seed alone and never on a parameter’s zero; a chain pinned in one state is GBM at that vol (regime_switching_pinned_in_one_state_is_gbm_at_that_vol). start_stressed begins the run in the stressed state.

Upload, PathMode::Upload { prices }. The desk’s own path: at least horizon + 1 monthly prices, month 0 first, finite and positive, rebased so \(S_0\) is the run’s start price (paths.rs::upload, upload_rebases_to_the_start_price_and_ignores_extra_points). Fewer points than the horizon needs is PathError::UploadTooShort with both counts named. Deterministic and seed-free, like the custom path.

The crash library, paths.rs::crash_library, is data rather than a mode: six named drawdowns, each a PathMode::Custom anchor list (piecewise log-linear from \((0, 1.0)\), flat after the last anchor) served by GET /api/forwardflow/crash_library and loaded as config.path = { Custom: { points } }.

Every shape is monthly anchors, not tick data; the March 2020 move took a week and at monthly resolution it is one down mark and a three-month climb. every_crash_preset_hits_its_anchors and crash_presets_run_through_the_engine hold them to their stated shapes and through a full run. The shock designer still composes on top of any of these, since it is applied after generation.

The volatility surface

surface.rs::VolSurface is implied vol by tenor and moneyness: tenors_months ascending and positive, moneyness ascending and positive, vols[i][j] a finite fraction in [0, 500%), and a source string that names a venue and a timestamp for a real snapshot or carries the preset’s own warning. The moneyness axis is \(K/S\), strike over spot, the option-quoting convention: puts below 1, calls above. The engine’s own moneyness (contract.rs, the exposure ladder) is the coin’s price over the strike, its reciprocal, and the two are never mixed: the ladder’s legs report both.

Lookup is VolSurface::vol_at(tenor_months, moneyness): each bracketing tenor row is read linearly in the vol between its quotes (ln moneyness) and, beyond the quoted moneyness, by the wing convention (surface.rs::row_vol; model audit 2026-09-07, R01): total variance \(w = \sigma^2 T\) continues linearly in \(k = \ln K/S\) at the edge cell’s own slope \(dw/dk = 2\sigma_e \sigma’ T\), clamped to Lee’s bound \(|dw/dk| \le 2\) and floored at zero, matching the edge slope when the Lee bound does not clamp it — the flat continuation it replaced put a concave kink at every sloped edge, a butterfly priced below zero. Between two quoted tenors the rows blend in total variance, linearly in the tenor (with the price-space checks applied separately); beyond the quoted tenors the surface is flat in tenor (surface.rs::bracket). Every price beyond the quoted range is the convention, not a quote: the surface reports quoted_moneyness and wing, and every desk response carries surface_note.

The check (VolSurface::arbitrage_violations(rate); model audit 2026-09-06 M06, and 2026-09-07 R01 for the nodes and the wings): every call the surface prices on $100 of spot — on the quotes, on seven log-spaced strikes inside each cell, and on eight log-spaced wing points out to 0.25× the first quote and 4× the last, where the wing convention prices — must fall with the strike, be convex in it, sit within \(\max(S - Ke^{-rT}, 0) \le C \le S\) and rise with the tenor at the same forward moneyness. The convexity triple is taken over three consecutive quotes, over (the last fine point to the left, the node, the first fine point to the right) across every quoted node including both edges, and over every remaining consecutive fine triple, wings included. The audit’s mild peak — vols 0.40 / 0.41 / 0.40 at 0.8 / 1.0 / 1.2, one year — prices the butterfly \(C(99) - 2C(100) + C(101)\) at −$0.0294 and was accepted, because the old check deliberately skipped the triple centred on a node (a kink in the vol is not exempt from price convexity: under linear-in-vol interpolation the price’s second derivative across a node carries \(C_\sigma \sigma’’\)); it is refused naming the node (“the 12-month calls at 0.97×, 1.00× and 1.02× spot … a peak in the quoted vol at 1.00× is a butterfly priced below zero; smooth the quotes or add a node”), and so is the same peak moved to any other node. A wing failure says “beyond the quoted range (lo–hi)” and, when the edge slope was clamped to Lee’s bound, that a wing that steep is itself an arbitrage. The flat preset is bit-identical inside and outside its quotes; on the stylised preset the put wing moved the fee-gross embedded ladder $5,598.11 → $5,659.39 per Agreement (+1.09%; 28 of its 59 legs strike below 0.70× spot), the 24-month dealer call not at all (tests/model_audit_2026_09_07_r01.rs). The 60-month leg of the ladder, at \(K/S = 0.025\), reads the 24-month row’s put wing: 81.2% against the 52% quote at 0.70.

From delta quotes. Deribit and the OTC desks quote a tenor-by-delta grid, and VolSurface::from_delta_quotes converts it. Every delta is the Black-Scholes spot delta at zero rate; inverting \(\Delta_{\text{call}} = N(d_1)\) or \(\Delta_{\text{put}} = N(d_1) - 1\) for \(d_1\) and solving \(d_1 = (\ln(S/K) + \sigma^2 T/2)/(\sigma\sqrt{T})\) gives surface.rs::moneyness_from_delta:

\[ \frac{K}{S} = \exp!\Big(\tfrac{1}{2}\sigma^2 T - d_1,\sigma\sqrt{T}\Big), \]

so the 50-delta call lands at \(K/S = e^{\sigma^2 T/2}\), a shade above 1, and a 25-delta put below it. Because \(\sigma\sqrt{T}\) differs by tenor, the same delta lands at a different strike in every row; the shared moneyness axis is the union of every converted strike, and each tenor row is filled onto it by linear interpolation in \(\ln K/S\) between its own quotes and by the wing convention outside them (surface.rs::interp_ln_wing) — for the wire and the eye: the surface records each row’s own quoted columns (quoted_columns) and reads the row on those, its wing from its own edge, so another tenor’s strike inside this row’s wing is not a node of this row (read linear in the vol between union nodes, the wing’s samples were chords under a concave curve and every multi-tenor grid carried a kink at its short row’s edge quote; r01_review_a_multi_tenor_delta_grid_is_read_on_each_rows_own_quotes_and_accepted). delta_quoted_constructor_round_trips_to_moneyness checks that a 25-delta put at 55% vol and three months lands below spot with \(\Delta = -0.25\) exactly, and that a two-tenor, three-delta grid gives a six-knot axis with put skew at both tenors.

The two presets, served by GET /api/forwardflow/surfaces in the shape every desk endpoint accepts back as surface:

• VolSurface::flat(0.43): 43% at every knot, tenors 1/3/6/12/24 months, moneyness 0.50 to 1.30 in six knots; the base bridge’s volatility with no skew.
• VolSurface::btc_stylised(): tenors 1/3/12/24, moneyness 0.70/1.00/1.30. ATM 41.4% from 1 to 12 months rising to 48% at 24; the 0.70 put at +9 vol points at 1 and 3 months, +6 at 12, +4 at 24; the 1.30 call at −2, −2, −1, 0. Its source reads “stylised illustration, not market data; import a real snapshot”, and the interpolation makes the ATM at 18 months 44.7%. Beyond the quoted 0.70–1.30 moneyness range, the wing convention prices the surface. Deep puts therefore use extrapolated volatility, not a flat copy of the 0.70 quote.

The stylised surface is the default wherever no surface is sent (forwardflow_api.rs::surface_or_default). It is a shape for the exhibits to have skew on, and the plan’s own warning stands: the market prices the ladder’s corner richer than a flat 43%, and by how much is a question for a snapshot.

Black-Scholes as used

The option math is written out in surface.rs so the numbers a desk sees never depend on a platform’s erf: norm_cdf is Hart (1968) as given by West (2005), accurate to about \(10^{-14}\); norm_inv is Acklam’s rational approximation with one Halley step against norm_cdf. With \(S\) the spot, \(K\) the strike, \(T\) the tenor in years, \(\sigma\) the vol and \(r\) the continuously compounded rate (surface.rs::d1d2):

\[ d_1 = \frac{\ln(S/K) + (r + \tfrac{1}{2}\sigma^2),T}{\sigma\sqrt{T}}, \qquad d_2 = d_1 - \sigma\sqrt{T}, \]

\[ \text{put} = K e^{-rT} N(-d_2) - S,N(-d_1), \qquad \text{call} = S,N(d_1) - K e^{-rT} N(d_2), \]

surface.rs::bs_put and bs_call, on one coin, in dollars. At zero tenor or zero vol both degenerate to the discounted intrinsic. The put’s spot delta is bs_delta_put \(= N(d_1) - 1\), in \((-1, 0)\), and −1 or 0 with no time or vol left; the vega is bs_vega \(= S\sqrt{T},\varphi(d_1)\), dollars per unit of vol, the same for put and call. put_call_parity_holds checks \(\text{call} - \text{put} = S - Ke^{-rT}\) at five points, including zero tenor and zero vol, and pins the textbook pair 10.4506 / 5.5735 at \(S = K = 100\), one year, 20%, 5%. price_put_on_surface reads the vol at \((T, K/S)\) and prices at it; the ladder and every hedge leg go through that one path.

Two rates appear in the chapter. Placement uses its funding_rate, 4.5%/yr continuously compounded by default. Hedge options use the explicit option_rate in OptionPricing, default zero, with the requested put-skew adjustment. Neither rate is the Coin delta continuation drift described below.

The embedded put ladder and the paper’s implied vol

The plan writes the paper’s loss as one short put on the coin struck at the remaining schedule, exercised only when the Buyer stops. surface.rs::embedded_put_ladder writes it as a strip: one European put per defaultable payment age \(t = 1, \dots, n-1\) (a draw after age n−1 can miss the final payment), at cohort-1 terms with the strike equal to the start price. Leg \(t\) is

\[ \text{strike} = R_t, \qquad \text{tenor} = t + 1 \text{ months}, \qquad w_t = \Big(\prod_{k<t}(1 - h_k)\Big), h_t , \]

with \(R_t\) the remaining schedule from exposure.rs::two_lines (the schedule line’s numerator), the expiry the missed payment date, and \(w_t\) the unconditional stop probability at that age from surface.rs::stop_mass: survival times the hazard of the config’s default scenario. The weights are price-blind on purpose. The drawdown multipliers, the conviction rule, the rational modes and early completion are all ignored, so the weights sum to the scenario’s lifetime stop rate (ladder_weights_sum_to_the_lifetime_stop_rate_and_strikes_amortize: 0.400 at the base configuration, 59 legs). Each leg carries the surface’s vol at \((t+1, R_t/S_0)\) and its Black-Scholes value at the request’s rate.

POST /api/forwardflow/placement on the base configuration, stylised surface, 4.5%:

Two things to read off the table. Through payment 19 the strike sits above the spot, so in the surface’s convention these are puts at \(K/S > 1\): deep in the money, and looked up on the call wing (1.45 is beyond the 1.30 edge, hence the 39.4% at age 1). That is not a mistake; a put and a call at the same strike and tenor share one implied vol, and an in-the-money put is priced off the out-of-the-money call’s. The heaviest leg is age 4 (\(w = 0.019\)), where the baseline hump peaks, and the ladder’s dollars sit in the first two years, which is where the risk desk already put the loss story.

The placement adds three scalars. ladder_value_usd_per_agreement is \(\sum_t w_t \cdot \text{put}_t\), what the market says the Holder’s short puts are worth per Agreement, behavior-weighted: $5,598.11 on the stylised surface, $5,468.53 on the flat 43% one. markup_usd_per_agreement is surface.rs::flat_path_markup, the completing Agreement’s net gain to the Holder at cohort-1 terms,

\[ \text{markup} = \Big(P - \sum_{k \le N} p_k\Big)(1 - f) - \text{purchase} = (88{,}500 - 1{,}475)\times 0.95 - 60{,}000 = $22{,}673.75 , \]

cents-exact then converted, and markup_pv_usd_per_agreement is surface.rs::flat_path_markup_pv, the same receipts discounted continuously at the desk’s rate to signing: $13,751 at the endpoint’s default rate. The puts are present values, so the markup they are set against must be one too.

paper_implied_vol is surface.rs::paper_implied_vol: the flat vol \(\sigma^*\) at which the weighted, fee-net ladder exactly equals the markup’s present value,

\[ \sum_{t=1}^{n-1} w_t,(1-f), \text{put}(S_0, R_t, \tfrac{t+1}{12}, \sigma^*, r) = \text{markup PV} , \]

like for like on both sides: the Holder’s shortfall on a stop is \((1-f)(R_t - V)\) because BTC Now takes its fee on what the sale delivers, so the Holder is short \((1-f)\) of each put, and the markup it earns is net of the same fee. Found by bisection on \((1%, 1000%)\); the ladder value is increasing in \(\sigma\), so the root is unique when it exists. Read against the market: where the surface’s vols at the ladder’s strikes sit below \(\sigma^*\), the markup more than pays for the puts; above it, the market values what the Holder is short at more than the paper pays.

On the base configuration the endpoint prints 160.8% at par: a markup worth $13,751 today against a fee-net ladder worth $5,318 on the stylised surface, whose at-the-money vol is 41.4% at 12 months. The paper pays for its embedded puts at roughly four times the market’s volatility. Dearer paper implies a lower vol, because a smaller markup buys fewer puts: 115.0% at 105% of the coin’s cost, 75.5% at 110%; beyond about 115% the markup’s present value falls below the ladder’s intrinsic floor and no vol balances it (paper_implied_vol_exists_and_is_positive pins the ordering). The weights are BTC Now’s 40% prior over the hump, price-blind; the surface is an illustration; both are inputs a desk replaces.

Risk-neutral fair value

surface.rs::fair_value prices the book under the desk’s measure and leaves the Buyer under BTC Now’s. The engine runs over seeds seeds under

\[ \text{PathMode::Gbm}{\mu = r_f,\ \sigma = \sigma_{\text{ATM}}(24)} , \]

the funding rate as the drift and the surface’s ATM vol at 24 months, the paper’s weighted average life, as the vol; the config’s shock and bump overlays are cleared, since a fair value is not a stress, and everything behavioral (hazards, multipliers, propensity, the conviction rule, the rational modes) stays the config’s. The skew enters the placement, not these paths. Per seed the Holder’s gross monthly receipts and purchases are read off the ledger (ledger.rs::owner_monthly_gross, cent-exact, converted once) and discounted continuously to month 0:

\[ \text{PV} = \sum_m \text{in}_m, e^{-r_f m/12}, \qquad \text{cost} = \sum_m \text{out}_m, e^{-r_f m/12}, \qquad \text{spread} = \frac{\text{PV} - \text{cost}}{\text{cost}} \times 10^4 \text{ bps}, \]

averaged over the seeds. Seed \(k\) is the config’s seed plus \(k\), run in parallel, so the figure is byte-reproducible (higher_funding_rate_lowers_the_pv runs the base book twice at 4 seeds and asserts equality). The purchases are discounted too, because a paced book buys over 24 months.

POST /api/forwardflow/fair_value on the base configuration, defaults (stylised surface, 4.5%, 32 seeds): atm_vol_used 0.48, pv_per_agreement_usd $73,662.46, pv_book_usd $17,678,990.57, purchase_book_usd $14,720,604.16, spread_bps 2,009.7. At a zero funding rate the PV per Agreement is $79,661.41 and the spread 2,987.7 bps (higher_funding_rate_lowers_the_pv). A riskless single Agreement on a flat path at zero rate returns exactly the markup: PV − cost = $22,673.75, spread 3,779 bps (fair_value_of_a_riskless_book_is_its_undiscounted_net_gain).

In this worked configuration, the model value is about 20% above the assumed purchase price. That difference is conditional on the stated market and behavior assumptions; it does not identify an observed premium for behavior or illiquidity. Note what the gap is not. It is a GBM book at 48% vol drifting at 4.5%, with a 40% lifetime stop prior that is price-blind on the base configuration; a desk that turns on the drawdown multipliers, brings its own hazard, or imports a surface with a different 24-month ATM will print a different one, and the endpoint is built so it can. The plan also asks for this figure per Agreement, monthly, as a NAV mark; that is Phase 4’s, and pv_per_agreement_usd is the book-level number today.

The hedge overlay

hedge.rs::hedge_overlay never touches the ledger. Per seed the paper runs as the config says (engine.rs::run, seed = the config’s seed plus \(k\)), the Holder’s gross monthly flows are read off the ledger, and the structure’s monthly dollar flows are built on that run’s path and book (hedge.rs::hedge_flows) in f64, quantized to cents only where they join the paper’s (hedge.rs::combined_metrics). The IRR of the combined flow is outputs.rs::irr, converted to effective annual, and the undiscounted multiple is gross dollars in over gross dollars out with the hedge’s flows on the hedged side. The unhedged figure is the same paper on the same seeds with a zero overlay, so the two distributions differ only by the hedge, and every structure in one request shares one unhedged (hedge_endpoint_runs_structures_and_fills_excess_over_basis).

Three conventions, stated in every result’s notes. Options are priced on the surface at the inception’s spot, at the option pricing’s rate, for their CONTRACTUAL tenor (hedge.rs::buy_put and its siblings; audit 2026-09-05, finding 3); an option still open at the run’s last month is marked there at its remaining-life model value on the surface at that month’s spot (hedge.rs::option_close), on a leg labelled “(open at the horizon, marked)” — never settled at intrinsic on a shortened life, and a tenor running past the horizon by more than 120 months is refused (finding_3_option_tenors_are_priced_whole_and_marked_at_the_horizon: dealer calls of 13, 24 and 60 months on a 13-month horizon cost $3,417, $6,835 and $15,185, where they had all cost $3,417). An execution cost, exec_cost_bps of premium (50 by default, 0 to 1,000), is paid on every option leg traded, bought or written, and never on a perpetual (premium_and_execution_cost_scale_with_coverage: 1.005 × the premium at 50 bps, and the payoff untouched). Coverage is coins per Agreement, one Agreement being one coin, and every cost and payoff scales with it. An Agreement is on the hedge desk’s book while it is price-exposed — from its origination month up to its payoff date, or, for a stop, through every mark before the month its sale is booked, \(\lceil D + \text{lag}/30.4375 \rceil\) (hedge.rs::on_book_at reads engine.rs::price_exposed_at, the one lifecycle coverage and the monthly mark read too; model audit 2026-09-06, M04). Price exposure includes a delayed sale. A futures position follows its selected rebalancing and close-on-exit rules; calendar rules can retain a position beyond exit, which the result reports separately. An option programme incepts or rolls only while the Agreement is performing (hedge.rs::rolls_at): a coin already in transit is a short-dated exposure the futures leg carries, not one to write a fresh 3- or 12-month option on — which the desk used to do at the missed month, a 1.3% overstatement of the premium of every re-bought programme on the base book (Table D1: $5,118,459 → $5,050,244 mean premium over 4 seeds).

Instruments

hedge.rs::HedgeSpec supports the fixed structures below, three Coin structures and composed Legs, externally tagged on the wire. Structures with an explicit Inception support AtOrigination, each cohort hedging at its own origination month at that month’s spot with the strike a share of each Agreement’s own entry; or AtMonth(m), the whole book on the books at \(m\) hedging at once, later cohorts unhedged.

Put ladder, PutLadder { strike_pct_of_entry, tenor_months, coverage, inception }: one put per Agreement, coverage coins, struck at the share of entry, held to expiry (hedge.rs::buy_put). Premium \(\times (1 + \text{exec})\) out at inception, \(\max(K - S_{\text{expiry}}, 0)\) per coin in at expiry. On a zero-vol surface it costs its intrinsic and pays nothing on a flat path (put_ladder_on_a_zero_vol_surface_costs_its_premium_and_pays_nothing); on a dip it lifts the p5 (put_ladder_pays_in_a_crash_and_lifts_the_floor).

Put spread, PutSpread { long_strike_pct, short_strike_pct, … }: buy_put at the long strike and hedge.rs::write_put at the short one, execution cost on both legs’ gross premium; the long strike must exceed the short or the 400 names the put spread.

Rolling puts, RollingPuts { strike_pct_of_spot, tenor_months, coverage }: bought at each Agreement’s origination at a share of the then-spot, rolled at each expiry at the then-spot while the Agreement is on the book, through the horizon. The strike floats with the coin; the ladder’s does not.

Perpetual delta hedge, PerpDeltaHedge { rebalance_months, funding_rate_annual, initial_margin_pct, coverage }. The book’s delta is a documented proxy, hedge.rs::proxy_delta_coins, not exposure.rs::greeks, which is an ensemble figure costing seven engine runs per seed per date. For every Agreement on the book at month \(m\) with \(t\) payments made, the legs of its own embedded ladder still ahead of it, weighted by the stop mass at age \(k\) conditional on having reached \(t\):

\[ \Delta_m = \sum_{a \in \text{book}} \sum_{k = t_a + 1}^{n-1} \Big(\prod_{j=t_a+1}^{k-1}(1 - h_j)\Big) h_k \cdot \big(1 - N(d_1)\big)\big(S_m, R_k, \tfrac{k+1-t_a}{12}, \sigma(k+1-t_a, R_k/S_m)\big) \text{ coins}, \]

the surplus call above the Purchase Price left out: the desk shorts the put’s delta. The position is reset to \(\text{coverage} \times \Delta_m\) at every rebalance and marked monthly, \(-\text{position} \times (S_j - S_{j-1})\); funding is paid monthly on the short notional, \(\text{position} \times S_{j-1} \times r_{\text{perp}}/12\), and margin carry is initial_margin_pct of that (perp_hedge_with_zero_funding_on_a_flat_path_is_a_no_op, and the margin leg at 10% of the funding leg). A negative funding rate means the short is paid, and the carry is money in.

Variance swap, VarianceSwap { tenor_months, vega_notional_usd }: long variance at the surface’s ATM vol for the tenor, \(K = \sigma_{\text{ATM}}(\text{tenor})\), rolled through the horizon on its contractual tenor (seven 12-month swaps to an 84-month horizon, every_preset_runs_on_the_base_config); no premium, the execution cost charged in basis points of the vega notional at each inception. Since the model audit of 6 September 2026 (M10) every swap is marked each month at its remaining-life value, \(\tfrac{N_{\text{vega}}}{2K}(\sigma^2_{\text{exp}} - K^2)\) with \(\sigma^2_{\text{exp}} = (\sigma^2_t\, t + K^2 (T - t))/T\) — the realised months as they were, the unrealised at the strike (hedge.rs::variance_swap_mark; zero at inception, \(-N_{\text{vega}} K/2\) in vol points at expiry on a path with no moves) — carried in the series’ option_mark, its settlement on the full window booked against the mark it replaces; a swap whose window runs past the run’s last month is marked there on the (open at the horizon, marked) leg and never settled on a window cut to the horizon (m10_the_variance_swap_is_marked_monthly_on_its_contractual_tenor: on the clean 12-month book the second swap’s one visible month reads −$1,791.67, a twelfth of a swap, where it used to settle −$21,500 as a whole one). The realized variance is the zero-mean annualized sum of squared monthly log returns, \(\sigma^2_{\text{real}} = \tfrac{12}{N}\sum (\ln S_j/S_{j-1})^2\) (hedge.rs::realized_variance), and the payoff is the standard vol-point convention,

\[ \text{payoff} = \frac{N_{\text{vega}}}{2 K_{\text{pts}}}\big(\sigma^2_{\text{pts}} - K^2_{\text{pts}}\big) = 50, N_{\text{vega}},\frac{\sigma^2_{\text{real}} - K^2}{K} , \]

since \(K_{\text{pts}} = 100K\) (variance_swap_pays_realized_minus_strike_in_vol_points).

Legacy cross-book collar, CrossBookCollar { free_coins, call_strike_pct_of_spot, put_strike_pct_of_entry, tenor_months, coverage }: calls are written on separately held free_coins and their premium supports puts on the Agreements. The legacy Agreement-sleeve distribution includes that premium and the put flows, but excludes the external coin’s value and written-call liability. Call assignment is reported on its separate leg and is not charged to the Agreement-sleeve distribution. This is incomplete combined-book performance, so paired Research and explicit Coin sweep/monthly requests refuse it; the Coin workspace does not offer it as a complete strategy. The Buyer’s promised coin cannot cover a written call by the Holder.

Outputs and the two desks’ numbers

Every structure returns a hedge.rs::HedgeResult: the spec, the two Dists — median, mean, p5 and p95 effective annual IRR with linear-interpolated percentiles and the share below zero, all over the seeds_with_irr seeds that have an IRR; the median and p5 multiple and pct_cash_loss (the share whose multiple is below one) over EVERY seed; and seeds_without_irr with without_irr_reasons (single-signed, no root in range, non-finite). A seed whose combined flow has no IRR is still a path (audit 2026-09-05, finding 1: a naked written call assigned at 5× left eight seeds at a 0.29× multiple and a 0% share negative; finding_1_a_losing_written_call_is_a_cash_loss_on_every_seed now reads 100% cash loss, eight without an IRR, no root in range). Then the figures a desk reads first:

The excess-over-basis field is a USD diagnostic: hedged median USD IRR less the requested annual cash-and-carry basis. It is not a BTC return comparison, and the reference does not remove counterparty, funding or execution risk. basis_rate is one annual comparison input; a futures leg’s locked/after basis schedule determines its modeled cash costs separately.

POST /api/forwardflow/hedge on the base configuration, stylised surface, 50 bps, 32 seeds. The paper alone: median IRR 15.01%, mean 15.45%, p5 11.37%, p95 20.00%, median multiple 1.311, 0.0% of seeds negative. Then:

Every hedged IRR is the root nearest the unhedged paper’s rate (outputs.rs::irr_near): a hedge’s late settlements give the combined flow several sign changes, and the first root a scan meets from −95% a month is not the rate anyone means. Excess over basis is populated for structures classified as market-neutral, including supported short DollarDelta futures legs. A put alone is not classified as a market-neutral position.

The posture is the ruling of 2026-08-16 as ruled — a 70% floor, 75% density, a 24-month window — and on a bridge pinned at its start it is the dearest floor on the shelf after the rolling puts: 4.61 points of median and a p5 of 8.68%, below the unhedged 11.37%, because two-year puts on a market that ends where it began pay out 0.26 of their premium. Its worst path is seed 43 at 8.65%. The perpetual’s legs show where its cost lives: funding $316,966, margin carry $31,697, and a mark-to-market that paid $1,979,617 and received $1,659,585. Its p5 is the highest of the floors, which is what a delta hedge is for, and its median is 2.50 points lower, which is what it costs. The rolling puts buy the most protection and the most premium: 40% of deployed capital, a floor that falls to 1.87%, and a worst path of -1.88% (seed 63) on a bridge that never crashes.

The variance swap at $10,000 of vega notional is nearly free on this path — a hedged median of 15.10% against 15.01% — because a bridge’s realised variance sits close to the surface’s strike; it is the structure for a desk that thinks the surface is wrong, not for one that wants a floor. The cross-book collar is the coin-holder’s trade: 100 free coins write 130%-of-spot calls each year and the premium ($3,288,310 over the book’s life) pays for 85% puts on every Agreement ($1,581,966), lifting the paper’s median to 22.38% and its p5 to 17.67%. The calls are covered, so their assignment — $2,510,336 of upside above the strike over the same life — is the free coin’s give-up, reported on its own leg and never posted to the paper’s flows: the paper is financed, the coin book is capped, and a desk reads both lines.

Benchmarks

hedge.rs::benchmarks returns legacy market references on the same seeds as the Agreements when include_benchmarks is set. Spot: one coin per Agreement bought at its entry price in its origination month, every coin sold at the horizon’s mark. Covered call: that spot position overwritten with 12-month calls struck at 130% of spot at each roll, written at each coin’s origination and rolled every 12 months while held. A call still open at the horizon retains its signed remaining-life model value. Premium uses the supplied surface and option-pricing rate, with no execution cost; cash settlement occurs at expiry. Its IRR is the root nearest the spot reference’s. Agreements: outputs.rs::analyze on the same run. At par, actual-entry funding is one BTC per Agreement, including when entry strikes are dispersed. Non-par Agreement purchases change that funded BTC amount. The one-coin reference still has its own costs and capital basis. It differs from Research’s matched dated net contributions and is not an equal-budget or equal-cost ranking.

On the base configuration: the paper’s median 15.01% against spot’s -0.05% (mean -0.68%, p5 -8.93%, p95 7.12%, 50.0% of seeds negative, multiple 0.997) and the covered call’s 1.81% (mean 0.91%, p5 -7.00%, p95 8.57%, 46.9% negative, multiple 1.078). A bridge pinned at its start is a market that goes nowhere for seven years, and on it the overwrite’s premium is most of a spot position’s return; the paper’s 15.01% is the markup on the same coin at the same strike, with the Buyer paying the premium month by month and the stop sales taken out. The plan’s stripped-down reading of the paper as a five-year covered call is what this table tests, and a desk will run it on its own drift, where spot has one.

Presets

hedge.rs::presets is the shelf the cockpit offers and the engine tests (every_preset_runs_on_the_base_config, fifteen entries, every figure finite, the spec externally tagged): BTC Now’s posture; eleven of the risk paper’s structures as legs, each label carrying its table — the dollar seat’s loss-line ladder, year-end put and listed-futures delta hedge, the coin seat’s futures at 80% and at the full coin delta, its rolled 12-month calls, the dealer call and half of it, the call spread and the split, and the pair on both seats (the section below); and three of the table above — the monthly perpetual delta hedge, the variance swap at $10,000 vega notional, and the cross-book collar on 100 free coins with 1.30 calls and 0.85 puts at 12 months. “Dollar seat: BTC Now’s own posture — 70% floor, 75% density, 24-month window (2026-08-16)” is the put ladder at 70% of entry, 24 months, 0.75 coins per Agreement, at origination: the ruling of 2026-08-16, BTC Now’s own stance on its retained book, and the second row of the table above. The label says what the code says: one preset among several, never a recommendation. A Holder brings its own.

The desk as legs — the paper’s menu and the shelf

The risk paper (BTC Now BPA Risk Analysis v3.10, September 2026) defines the hedge menu a desk must carry, which the fixed shapes above cannot spell. HedgeSpec::Legs { legs } can: a structure is a list of legs, every leg posting into the one set of monthly flows under the label leg N: <description> (hedge.rs::Leg::describe), and a one-leg structure reproduces the fixed shape it copies bit for bit (a_legs_put_ladder_reproduces_the_put_ladder_shape_exactly; the tests are tests/legs.rs and tests/shelf.rs).

A leg is one of two kinds. Leg::Futures { side, sizing, basis, rule, initial_margin_pct, surface_vol } is listed futures per on-book Agreement, Long or Short, sized at every rebalance — rule is a TradingRule { rebalance, min_trade_coins, lot_coins, margin_funding_rate, futures_cost_bps, close_on_exit } (Phase 4a, hedge.rs::futures_leg): the policy is Calendar { months } (the original reset every k months, held through the interval whether or not the Agreement is still on the book — the default; close_on_exit: true closes the position the month the Agreement leaves the book, the close-out in the turnover and charged the trading cost, and the result’s futures_retained_agreement_months counts the Agreement-months a position was held past the paper’s exit, a speculative exposure the notes flag when positive — model audit 2026-09-07; on the wire the older rebalance_months: k still reads and writes), DeltaBand { band_coins_per_agreement } (reset when the target drifts from the position by more than the band) or PriceMove { pct } (reset when the spot has moved more than the share since the last reset); a reset smaller than the minimum is skipped, the book’s net position is rounded to the lot (CME is 5), and the initial margin is charged at the funding rate (default zero); the result reports futures_turnover_coins_mean and futures_trades_mean, and series.rs::rebalance_policy_comparison puts the policies side by side — DollarDelta { share } is the embedded ladder’s proxy delta times the share; CoinDelta { share } the lifecycle-aware coin delta, using a performing surface and known-stop valuation at the leg’s surface_vol; Coins { per_agreement } a fixed count. Leg::Option { kind, side, strike, tenor_months, roll, coverage, inception, years_limit } is a European put or call per Agreement, Buy or Write, held Once or rolled AtEachExpiry, with inception and rolls only while the Agreement performs; a live option runs to its own expiry; Coverage is Coins(c), ShareOfDollarDelta(s) or ShareOfCoinDelta(s). Three predicates on the spec — is_coin_seat, revalues_the_ladder_monthly, is_market_neutral (the perpetual delta hedge or a composition containing a short Dollar-delta futures leg; a classification, not proof that all risk is offset) — tell the API what it holds.

Strikes. Strike is PctOfEntry(k), PctOfSpot(k) at the inception, PctOfPurchasePrice(k) — entry times the multiple, so 1.0 is the paper’s 1.475× — or LossLineAtExpiry. The last is the dollar seat’s strike, the only price the Holder needs to defend: the loss line is the Holder’s unrecovered cost: the capital line of exposure.rs::two_lines, read through exposure::loss_line_of_entry(config, months) at the option’s expiry age — the sale proceeds, as a share of entry, that return the Holder’s outlay net of the fee. It sits above entry at signing (1.053, since payment one went to BTC Now), 0.782 at month 12, 0.487 at 24, and melts to zero by month 44, when no stop can lose the Holder money. A put struck there protects the capital and nothing above it; a put whose strike is zero is not bought, so the quarterly ladder buys fourteen puts, expiring at 3, 6, …, 42 months (the_loss_line_strike_reads_the_capital_line_at_expiry_and_stops_when_it_is_zero).

Dated futures. The position \(h\) per Agreement is reset at each rebalance, and at \(m+1\) two things post in dollars — the mark \(h,(S_{m+1} - S_m)\) and the basis \(h,S_m, b/12\) — on two legs, … — mark-to-market and … — basis. BasisSchedule { locked_months, locked_rate, after_rate } is the basis lock: locked_rate for the first locked_months of each Agreement’s life, then after_rate. This rate schedule is a dated-futures proxy; it does not simulate contract expiry. A long pays the basis; a short receives it. So the coin book’s long pays 4% then 10% and the dollar book’s short is paid 4% a year. The margin balance is a capital requirement: initial_margin_pct of the gross notional is reported at its monthly peak as margin_peak_of_par. The balance itself is not an expense, but a nonzero margin_funding_rate charges financing on that balance through the basis channel. The desk also reports the worst month of cash, futures_worst_month_of_par_median and _p95 — the worst single month’s marks and basis as a positive share of par.

The rule. A written option on the paper is naked. The coin inside an Agreement is promised to the Buyer, who owns its upside above the Purchase Price, so nothing covers a written call. The engine does not forbid the write (a call spread needs one); every written leg’s label ends (naked), and the covered write stays the CrossBookCollar’s business, where the free coin sits on the other book.

The option rate and the skew. OptionPricing { rate_annual, put_skew_points } is the Black-Scholes rate, and vol points of skew added to the surface’s vol for every put, calls reading the surface as it is. The default is zero and zero because that is the surface’s own quoting convention (the smile is built at zero rate, its skew already in the vol) and it reproduces every earlier figure bit for bit. The paper’s setting, OptionPricing::paper(), is 4.5% with five points (Appendix D). The two do not move a put the same way: a 12-month at-the-money put on a flat 40% surface is 15.85% of spot the default way and 15.30% the paper’s — at the money the rate’s discount outweighs the skew — while at the year-end loss line the skew wins, 5.77% against 6.00% (the_papers_pricing_moves_a_put_the_way_black_scholes_says).

The paper’s menu as the shelf of preloads. hedge.rs::presets is fifteen entries, eleven of them the paper’s structures as legs, each label carrying its table. The paper’s figures below are the risk paper’s — \(S_0\) $78,000, the Purchase Price 1.475× spot over 60 payments, 5% servicing, payment one retained, 40% realised vol, its own hazard prior, options at 4.5% with five points of put skew — and the engine’s are its tests, on the engine’s hazard, surface and loss line.

• Put ladder on the loss line, quarterly, re-bought at each expiry (Table D1). The paper: 12.2% of spot in year one at 40% implied (20.6% at 55%), 0.3–1.5% in year two, nothing in year three. The engine on the riskless book, flat 40%, default pricing: fourteen puts, 16.4% of spot per coin all in, the first strike 100.3% of entry and the last 4.5%.
• Twelve-month put at the year-end loss line, re-bought at month 12 (Table 7d). The paper: 0.72× spot at signing, 0.44× at month 12, 4.8–8.8% of spot by vol, about 4.4% of par, lifting the flat-coin 5th-percentile dollar IRR from +3.9% to +7.3%. The engine: the line 78.2% of entry at month 12 and 48.7% at 24, the puts 5.77% and 0.39% of spot.
• Delta hedged in listed futures — the market-neutral seat (Table 20). The paper: unhedged dollar medians 11.0 / 14.6 / 17.5 / 22.4% at −18 / flat / +22 / +49% a year become 13.8 / 13.5 / 13.2 / 12.8%, the worst month of cash −1.6 to −3.0% of par at the median, margin 11% of par on day one. The engine: −18% takes 12.4% to 14.5% and +49% takes 28.3% to 24.1%, the worst month 2.7–3.6% of par (p95 5.8–7.1), margin peak 7.4% of par. The bear side lands where the paper does and the bull side does not, because the engine’s proxy delta peaks near 0.21 coins against the paper’s 0.30; the test asserts the shape (the spread narrows, the bear side inside 8–20%), not the paper’s numbers.
• Coin seat: futures at 80% of the coin delta, 4% for 24 months then 10% (Table 7c) and at the full delta (7a); rolled 12-month calls at 1.475× (7b); the 5-year dealer call and half of it (Table 7). The previous section’s structures as legs, reproduced exactly, their paper figures there; on the flat book the 80% leg holds 1.150 coins per coin with a margin peak of 0.350 of par.
• Call spread, long 1.475× short 2.5× of entry, two years (Table 7d). The paper: 10.7% of spot at 45% IV, 5.7 points of dollar yield on a flat coin. The engine at flat 45% and the paper’s pricing: 10.70% of spot per coin, the short leg (naked) and assigned above 2.5× (the_call_spread_costs_about_what_the_paper_says).

The split and the pair are single structures. The split (§6.3) is one Legs with two legs: futures at 80% of the coin delta and rolled 12-month calls at the Purchase Price on ShareOfCoinDelta(0.2); the paper puts those calls at 0.03–0.09 coins over the life, lowering the 5th percentile by about 0.03 coins. The pair (§6.5) is the quarterly loss-line ladder and the call spread in one structure, both seats at once: the paper’s 15% of par, the dollar seat at 7% on a flat coin, the coin seat below one coin from +22% up. The engine holds the pair’s premium to the sum of its two structures’ within a part in a million.

The shelf rows. hedge.rs::benchmarks_with_shelf fills Benchmarks.shelf with six ShelfRows — the shelf, the paper’s Table 18 (§13.1) — on the same coins, months and marks as spot, ShelfParams defaulting to the paper’s rates (2% coin lending, 30% of the coins overwritten, 10% out, 4% basis, 7.65% on dollars lent against coin). Coin lending grows the count at the rate over the months held. The covered calls write a one-month call each month on the share of the coins then held, at the mark or 1.1× it, premium and settlement both in coin at the month-end mark. Cash-and-carry basis and dollars lent against coin are dollar assets, read on the coin seat the paper’s way — the dollar multiple \((1+r)^{\text{years}}\) over where the coin ends, \(S_T/S_0\) — so a 4% basis is 1.24 coins on the paper’s flat median and 0.29 at the 5th percentile, losing coins on 41% of paths. The tie-out (the_shelf_ties_out_to_table_18, 48 seeds × 10 Agreements on a median-flat 40% GBM, flat 45% surface, 4.5%) — engine | paper, as dollar median / dollar 5th / coin median / coin 5th / paths losing coins: hold the coin −1.6 / −21.4 / 1.00 / 1.00 / 0% | −0.4 / −25.4 / 1.00 / 1.00 / 0%; BPA at par 15.1 / 8.2 / 1.26 / 0.85 / 21% | 14.6 / 4.1 / 1.35 / 0.75 / 21%. The paper’s Table 19 runs the same holdings by drift, and the engine’s drift sweep is where a desk reads that.

Two books, two hedges — the coin seat

The same paper can be held by a Holder whose unit of account is the coin. That is the coin seat: the brain’s risk paper (v3.6–v3.9) brought into the engine as coin.rs and three variants of hedge.rs::HedgeSpec (CoinDeltaFutures, RolledCalls, DealerCall); the tests are tests/coin.rs. Historical worked examples below quote the private risk paper, not the current workspace defaults or forecasts. Its figures are the author’s recorded runs (\(S_0\) $78,000, 1,500 paths per drift unless said otherwise); the engine’s are from tests/coin.rs.

The coin flows (0.6.0). Each Agreement represents one underlying Bitcoin. The Coin allocator funds its actual dollar purchase at that Agreement’s own entry price: if Agreement a originates in month m_a, its dollar purchase is Q_a and its entry strike is K_a, the gross funding is Q_a / K_a BTC. A par purchase has Q_a = K_a and therefore uses exactly one BTC per Agreement, including with dispersed entry prices. An 80%-of-entry purchase uses approximately 0.8 BTC and a 120% purchase approximately 1.2 BTC, subject to cent rounding of the USD purchase. The dollar ledger is unchanged.

Holder dollar receipts I_m and hedge economic flows H_m use the monthly conversion price S_m. Thus btc.rs::paper_coin_flows, also used by coin.rs::coin_flows, supplies

\[ c_m^{\mathrm{out}} = \sum_{a:m_a=m}\frac{Q_a}{K_a},\qquad c_m^{\mathrm{in}}=\frac{I_m}{S_m},\qquad h_m=\frac{H_m}{S_m},\qquad F_m=c_m^{\mathrm{in}}-c_m^{\mathrm{out}}+h_m. \]

The legacy net outcome per BTC of Agreement purchases uses gross purchases as its denominator:

\[ M_{\mathrm{paper}}=\frac{\sum_m c_m^{\mathrm{in}}+\sum_m h_m}{\sum_m c_m^{\mathrm{out}}}. \]

The BTC cash-flow IRR solves sum(F_m × (1+i)^(-m)) = 0 and reports (1+i)^12 − 1; the modeled hedge costs and signed horizon value enter once. With several roots, the hedged rate nearest the unhedged Coin rate is selected, with the ambiguity reported. Equal USD and BTC flow vectors up to a constant scale have the same IRR; different entry and conversion prices need not produce that condition.

The legacy Coin and USD multiples use different hedge-cost conventions: a negative hedge flow reduces the Coin numerator, while USD gross outflows increase. A 1-BTC purchase, 1.5-BTC receipt and 0.2-BTC hedge cost give a legacy Coin ratio of 1.30×; a receipt/all-outflow ratio is 1.25×. The net-contribution recovery ratio below has another stated denominator. None is a complete-wallet holdings ratio.

Numerical support and interpretation. BTC cash-flow IRR uses the original floating-point BTC equivalents directly in the log-space solver. It does not narrow them to Decimal or replace an unrepresentable flow with zero. Every accepted root must satisfy the solver’s relative NPV residual check on those flows; unsupported inputs report an unavailable reason. The dollar ledger remains cent-exact Decimal. An annualized cash-flow IRR excludes unused BTC reserves and does not describe annual growth of an entire starting wallet; see the workspace measurement guide.

The mass model. coin.rs::MassModel gives the seat’s exposure before the path is known: the survival-weighted expected flows of one Agreement along one price path from a given age, under the engine’s own rules — the config’s hazard and drawdown multipliers, early completion, the conviction rule and the rational boundary, and the stop priced exactly as engine::stop_sale prices it. Mass leaves by completion, early completion or stop; what remains is alive. It is the brain’s bpa_model.run_agreement in Rust (holder_coin there is the same conversion), and it matches the engine’s own mean over 200 seeds of ten Agreements on a flat path within 0.03 coins per coin (mass_model_matches_the_engine_monte_carlo_on_a_flat_path).

The performing delta surface. coin.rs::CoinDeltaSurface estimates dC/dlnS, BTC per unit log-price move, for one performing Agreement. It has a node at every monthly payment age, from origination through the month before the final payment; the value after the final payment is zero. Its log-price grid covers 0.1–10 times entry and expands in 1.5-times steps when needed. Each node values the mass model’s remaining receipts on common random continuation paths, bumps spot by ±1%, and differences:

\[ \delta_{\mathrm{performing}}(S/K,a)=\frac{\overline C(1.01S)-\overline C(0.99S)}{\ln1.01-\ln0.99}. \]

The continuation convention is median-flat lognormal, ln(S_(j+1)/S_j) = σ z_j / sqrt(12). It has zero log drift, not zero expected arithmetic price growth: E[S_t] = S_0 exp(σ²t/2). It is the exposure-estimation convention, not a claim that the research path uses that drift or that the option surface is a forecast. surface_vol supplies σ; the fixed valuation_seed defines the performing node streams. No BTC discount rate is applied.

Actual monthly observations read their own age row, interpolating only in log price. Fractional display ages interpolate between adjacent monthly states; they do not smooth a still-outstanding final receipt over a three-month interval. This corrects the quarterly age approximation used before engine 0.6.1, which could understate sensitivity around payments retained by BTC Now and the final Holder receipt. Existing quarterly node streams are preserved; additional monthly nodes use their own deterministic seed namespace. Stochastic valuation and interpolation in price remain approximations, not a guarantee of full protection.

Every continuation includes the entire configured stop-sale tail (coin.rs::node_value uses MassModel::slots): a 90-day lag needs three extra months. A short supplied path extends flat without advancing the sale or receipt date. The default 18-day tail retains the previous canonical random stream. surface_domain records extrapolated columns; these remain model values. Known stops use the separate lifecycle calculation below, including sale cash that arrives after the contractual term.

Known stops and monthly receipt timing. The shared coin.rs::agreement_coin_delta reads the actual lifecycle. A stopped Agreement keeps its known paid count, remaining schedule, refund waterfall and residual sale lag; it is not put back into a performing continuation. A sold receipt is observed after that month’s booking and BTC conversion, so it has no remaining Coin receipt exposure. series.rs::delta_series_of and Coin-delta hedge sizing use this same reader. price_exposed_agreements counts performing plus stopped-unsold Agreements and is the denominator for a per-Agreement delta display.

For a known stop, let S be current spot, X the fractional-month sale spot, Y the receipt month’s conversion spot, q = exp(−haircut) × (1 − sale_cost_bps/10,000), R the remaining schedule, P the full schedule and η the servicing fee. The fee-net BTC-equivalent receipt is

\[ C_{\mathrm{stop}}=(1-\eta),\mathbb E!\left[\frac{qX-(qX-R)^+ +(qX-P)^+}{Y}\right]. \]

This is the same refund waterfall: the Holder first receives up to the remaining schedule, the Buyer is refunded up to amounts paid, and excess above the full schedule returns to the Holder. One underlying BTC does not imply one BTC of price sensitivity.

For residual sale delay n+f months (n an integer, 0≤f<1), log-linear sale interpolation and the same median-flat continuation give

\[ a=\operatorname{Var}\ln(X/S)=(n+f^2)\sigma^2/12,\quad b=\operatorname{Var}\ln(Y/S)=\lceil n+f\rceil\sigma^2/12,\quad c=\operatorname{Cov}(\ln(X/S),\ln(Y/S))=(n+f)\sigma^2/12. \]

The analytic sensitivity used by coin.rs::stopped_coin_delta, with Φ the standard normal CDF, is

\[ \delta_{\mathrm{stop}}=(1-\eta)e^{b/2}\left[\frac P S\Phi!\left(\frac{\ln(qS/P)-c}{\sqrt a}\right)-\frac R S\Phi!\left(\frac{\ln(qS/R)-c}{\sqrt a}\right)\right]. \]

A zero strike contributes zero. At zero volatility, the implementation uses the piecewise derivative of the waterfall, with a midpoint convention at a kink. The formula is checked against independent Gaussian integration of actual sale/refund/conversion cash, and the generated surface is checked against the certain-stop analytic case at 18-, 45- and 90-day lags, plus a 120-day internal stress outside the API’s accepted 0–90-day range (coin.rs::allocator_stop_tests).

Two deterministic checks illustrate the units. An early stop with no Buyer refund returns 0.9975 × 0.95 = 0.947625 BTC under unchanged future spot; its BTC sensitivity to a uniform price move is zero. A final-payment stop with $1,475 still scheduled returns $1,401.25 after the fee. At $59,400 spot its expected receipt is 0.023590067 BTC and its Coin delta is −0.023590067 BTC, even though the contractual term has ended. If the Holder instead receives sale surplus after a fixed Buyer refund, Coin delta can be positive and a signed hedge can be short. These are state-dependent claims, not a blanket one-coin hedge rule.

The futures hedge. HedgeSpec::CoinDeltaFutures { hedge_ratio, basis_locked_months, basis_locked_rate, basis_after_rate, rebalance_months, surface_vol } uses the lifecycle-aware expected BTC receipt sensitivity. For each price-exposed Agreement at month \(m\), aged \(a\), the signed position is

\[ h_m = \rho \cdot \big(-\delta_{\mathrm{state}}(S_m, a)\big) \ \text{coins of futures}, \]

\(\rho\) the hedge ratio, reset at every rebalance; each month the mark \(h_m (S_{m+1} - S_m)\) is settled and the basis \(h_m S_m, b/12\) paid, both posted in dollars at \(m+1\) — the dollar seat reads them through the combined flows, the coin seat converts them at \(S_{m+1}\). The basis lock sets \(b\): basis_locked_rate for the first basis_locked_months of each Agreement’s life, a dated listed contract held to expiry, then basis_after_rate on the rolls; the runs use 4% for 24 months, the listed December contract, then 10%. Negative Coin delta normally produces a long position; positive Coin delta produces a short one. The actual lifecycle and selected rebalancing rule determine when it changes. The result reports gross notional and worst cumulative futures loss as shares of gross USD purchases. This legacy branch has no initial-margin input; a generic futures leg is needed to supply margin and funding assumptions. On a flat path the hedge pays only the basis; on a path that doubles the long gains dollars and the seat keeps more coins (coin_delta_futures_on_a_flat_path_pay_only_the_basis). The risk paper’s basis lock (run_v38_basis_lock.py, 1,000 paths, flat coin, log of 2026-09-04): 4% for \(L\) months then 10 / 15 / 20% gives 0.99 / 0.86 / 0.72 coins per coin with no lock, 1.10 / 1.05 / 1.00 at 24 months, against 1.15 at 4% throughout — most of the notional sits in the first two to three years because the delta does.

The hedge ratio. Compare several ratios on matching market and Buyer paths, holding the valuation seed and other assumptions fixed. More coverage can reduce one exposure while increasing basis, execution and funding needs. The private risk paper’s sampled ratios were exploratory cases, not universal settings; their numerical claims are not retained as live model guidance without a complete saved configuration. A sampled p5 or minimum does not guarantee a floor. Report sample size and uncertainty even when no sampled path loses BTC. Annualizing a legacy purchase-denominator multiple is not BTC cash-flow IRR or wallet CAGR.

Rolled calls and the dealer call. HedgeSpec::RolledCalls { strike_pct_of_entry, tenor_months, coverage, years_limit } buys a call at strike_pct_of_entry times each Agreement’s entry, at origination and again at expiry while the Agreement remains on the book and within the optional years limit. Each tenor is cut to the remaining Agreement term. Premium uses the supplied surface and option-pricing rate; intrinsic settlement at expiry and any signed open value at the horizon remain distinct. The Coin view converts each component at its modeled month’s price (rolled_calls_and_the_dealer_call_price_off_the_surface). It is run_v39_listed_hedges.py::rolled_calls — premium expressed in BTC equivalents at the roll date, sized to the surviving mass, Black-Scholes at 45% IV and 4.5% — with the engine’s surface in place of a fixed IV. HedgeSpec::DealerCall is one call per Agreement for the whole tenor, 60 months as the reference, its leg labelled a dealer quote: the model does not verify the availability or executability of a matching listed instrument.

The drift sweep is the exhibit a coin mandate reads. coin.rs::drift_sweep re-runs the config under PathMode::Gbm at the sweep’s vol for each median annual return \(r\), with

\[ \mu = \ln(1 + r) + \tfrac{1}{2}\sigma^2 , \]

so the median price path grows at the specified rate. The sweep uses matching seeds throughout and reports both reporting units. Expected price growth, median price growth and the Agreement’s BTC return are distinct. Keep volatility, shock/bump overlays, surface, costs and the valuation seed attached to each completed comparison. Historical private-paper grids are examples of the method, not evidence of a fixed growth threshold at which this model always gains or loses BTC.

What the two books are. Dollar and Coin are different reporting objectives on the same Agreement economics. A fixed dollar receipt has price exposure when read in BTC equivalents, so a Coin hedge may go in the opposite direction from a USD hedge. The size and sign must follow the selected book and metric rather than a universal one-coin rule. Both objectives remain exposed to Buyer outcomes, hedge costs, model assumptions and funding requirements. Neither has a guaranteed return floor.

Running it — the monthly report, the mark, the margin, one delta, the rule

A Holder’s monthly report explains what the sleeve earned and which line moved. series.rs::hedge_series keeps the seeded paths, monthly book, cash, values and P&L, with pointwise bands across the sample and one complete selected path. objective: "coin" selects the lower-median economic BTC gain; Dollar selects the lower-median finite USD IRR, falling back to USD multiple when no IRR exists. The response records selection.metric and selection.seed. An explicit selected_seed replays that member of the requested sample. Pointwise percentile bands are not individual paths. Matching inputs, costs and the explicit valuation_seed preserve the overlay’s lifetime economics. This is the monthly report.

The mark. The purchase-yield mark is an attribution convention calibrated to purchase cost, not an independently validated market-participant fair value: \(y\) is the monthly rate at which a fresh Agreement’s expected flat-path flows under the config’s own rules equal its purchase price (series.rs::purchase_yields, solved once at the start price), and \(V(t, S)\) is the expected remaining Holder flows of an Agreement aged \(t\) along a flat continuation of the spot \(S\) — coin::MassModel::flows, every behavioural rule and the September stop the config’s — discounted at \(y\). A stop in transit is marked at the proceeds the model expects at the month’s spot (coin::MassModel::stop_value: the coin sold at the spot less haircut and sale cost, the refund, the fee), discounted at \(y\) until they land and re-marked each month — never at the recorded proceeds, which the engine prices between the next two months’ marks, so a month’s report needs only the month’s spot (the_month_is_reported_on_the_month_spot_alone: bump the path from month 30 and months 0–29 report identically, mark and every bucket). The futures carry no mark of their own — they are cash-settled monthly — and the open options carry the option mark below, since the follow-up audit of 6 September 2026. An origination enters at cost — \(V(0, K)\) at the Agreement’s own strike \(K\) is the purchase price to the cent, and the month-0 mark equals the purchases (the_month_zero_mark_is_the_purchase_price_on_a_flat_path) — so no day-one gain is booked; when the strike is not the month’s spot (intramonth strike dispersion, a held strike) the fresh mark \(V(0, S_m) - V(0, K)\) is a day-one move and is booked as price, the residual staying the cent (a_dispersed_strike_enters_at_cost_and_its_day_one_move_is_price), and that is why this and not the risk-neutral fair value is the reporting mark: at the funding rate the base configuration is worth $73,662 per Agreement against $61,336 paid, and a 2,010 bps gain on signing day is a valuation, not a month’s result. The risk paper’s Section 14 marks the same way, at the purchase yield. And \(y\) is not the schedule’s rate: on the base configuration the test prints 15.29% a year against the completing schedule’s 13.97% (schedule_yield_annual, reported beside it), because at par a stop sells a coin worth most of the remaining schedule at once — fewer dollars, sooner.

The identity. Every month, on every seed and on the mean band, the attribution is

\[ \text{total} = (\text{in} - \text{out}) + \Delta,\text{mark} + \Delta,\text{option mark} + \text{hedge cash} = \text{carry} + \text{price} + \text{stops} + \text{early} + \text{hedge mark} + \text{hedge settlement} + \text{basis} + \text{option value} + \text{residual}, \]

with hedge cash the option premium and settlement plus the futures mark and basis, and the option mark every open option’s remaining-life value on the surface at the month’s spot (series.rs::Book::option_mark, since the follow-up audit of 6 September 2026); the option value bucket is its change plus the settlement cash of the positions closed that month, so a bought call is no longer a loss of its premium on the day it is bought. Per Agreement, with \(d = 1/(1+y)\) and \(S_m\) the month’s spot,

\[ \text{carry} = y,V(t-1, S_{m-1}), \qquad \text{price} = (1+y)\big(V(t-1, S_m) - V(t-1, S_{m-1})\big), \]

the book rolling forward one month at \(y\) first, then re-priced at the new spot at the same ages — the factor is that order (carry, price). A stop in transit adds its re-mark at the month’s spot to the price line, and an origination adds \(V(0, S_m) - V(0, K)\). Stops are realised against the prior: an Agreement that stopped this month books its cash (the payment plus the proceeds expected at the month’s spot, discounted at \(y\) from their landing month) less \((1+y),V(t-1, S_m)\), and the month the sale cash lands books the recorded proceeds against that expectation at the month’s spot — the sale’s interpolated spot against the month-end’s; a survivor books the stop the model expected and released, \(q,\big(V(t, S_m) - \text{stop value}\cdot d^k\big)\), \(q\) the stop mass at age \(t\) and \(k\) the posting lag. Early completion is the same pair with the payoff. Under the config’s own hazard the stops bucket averages to zero over a book. The hedge has four attribution buckets: hedge_mark carries futures mark cash; the attribution field hedge_settlement carries premium and settlement cash excluding option settlements already assigned to option_value; basis carries futures basis, trading costs and margin financing; and option_value carries the change in Book::option_mark (every open position at Black-Scholes on the surface at the month’s spot with its remaining tenor, the premium’s own pricing, a written option negative, a position still open at the last month staying in the mark at the signed value included once in the overlay’s economic terminal outcome, not settled cash) plus the settlement cash of the positions closed that month, so a termination or expiry is booked once. The report is total P&L on marks, with the cash beside it: the paper at the purchase yield and the options at their remaining life are marks, hedge_premium, hedge_settlement, futures_mark and futures_basis are the month’s cash, and total_pnl is the first with the second inside it — a reader who wants the month’s cash alone adds the four cash buckets to in − out. tests/audit_2026_09_06.rs pins it on the audit’s own case: a bought 24-month call on a flat $60,000 path at 43% (premium $6,834.90) reads total_pnl[0] 0.00 — the month-0 option mark offsets the premium to the cent — and month 1 = 2,244.58 of carry − 288.76 of decay = 1,955.82; a written call’s month 0 is 0 too (finding_3_a_bought_call_is_an_asset_at_inception_and_decays_after, finding_3_a_written_call_is_a_liability_at_inception), and finding_3_the_identity_holds_with_the_option_bucket_on_a_stopping_book holds the identity with the bucket in it. Before the audit the options were cash alone, so total_pnl[0] read −$6,834.90: paying the model price for an equally valuable asset booked as a loss. the_identity_holds_every_month_on_a_bridge_and_on_gbm (8 seeds, 240 Agreements, futures and put ladder, bridge and GBM) holds the gap under \(10^{-6}\) of par every month and measures it at \(2 \times 10^{-15}\). On a riskless flat path every bucket but carry is zero and the carry sums to the flat-path markup exactly, $90,695 on four Agreements. The price line is small — a fixed dollar schedule is price-blind except through the masses and the sale: 0.24 coins of the month’s move per Agreement at signing, the dollar seat’s delta, under 0.5% of par at ±3% a month — and the September stop’s surplus makes every expected stop a long call, and a stop in transit rides the line as a whole coin for its ~1.6 months (hedged the same months): at +10% a month it peaks at 9.6% of par in month 50.

The residual is what no formula claims: the fee’s cent rounding against the model’s unrounded net payment, the conviction rule’s memory (the model restarts each month with no streak), a completion’s last payment against its discounted mark, and at origination the cent between \(V(0, K)\) and the purchase price. Measured, not assumed away: at most \(9 \times 10^{-8}\) of par across the identity test.

The margin path. The treasury posts the futures’ cash, and the variation call is what it posts:

\[ \text{call}_m = \max\big(0,, -(\text{futures mark}_m + \text{futures basis}_m)\big), \]

the month’s futures cash floored at zero — a received basis is not a call, and a flat path with a zero basis posts nothing (variation_calls_are_non_negative_and_zero_on_a_flat_path_with_zero_basis). A call is met inside a month the engine cannot see, so the intramonth proxy re-reads the mark on the paper’s 18-day sigma: the month’s log move \(r\) scaled by \(k = \sqrt{18/30.4375} \approx 0.769\), the mark multiplied by \((e^{kr}-1)/(e^{r}-1)\), plus the basis, floored at zero. A proxy: a typical 18-day move inside the month, not the path’s own worst point; the month-end mark is the call actually settled. The margin buffer is over the seeds as shares of each seed’s par: the worst single call at p95 and p99, the deepest point of the cumulative futures cash at p95, and the month of the worst call at the median. margin_balance is the initial margin, charged only when a leg’s margin_funding_rate is set, at rate/12 on the basis channel (at 6% the test charges $2,806 over the life on a $44,521 peak). The test’s figures, base configuration, the futures preset, 8 seeds: on GBM the p95 worst call is 3.83% of par, the p99 3.88%, the p95 worst cumulative 4.92%, the worst month 20.5 at the median; on the bridge 4.16%, 4.20% and 5.08%; the median seed’s peak call $349,793 against an intramonth proxy of $261,053.

One delta for a stated purpose. The delta series carries three readings on the same selected path. DollarDelta sizes from the embedded-ladder proxy (hedge::proxy_delta_coins), a USD sensitivity expressed in BTC position units. CoinDelta uses coin::agreement_coin_delta, the lifecycle-aware remaining BTC-receipt sensitivity described above. It uses the performing surface while payments continue and the known-stop waterfall while collateral awaits sale. Coin delta may be negative, zero or positive; it need not vanish at the contractual term if a stopped receipt is still pending. The per-Agreement display divides by price_exposed_agreements, including performing and stopped-unsold Agreements, rather than only the performing count.

The optional Greeks (exposure::greeks, eight valuation seeds every third month when include_greeks is set) bump and revalue the USD Agreement book and remain a separate measure. The quantities cannot be compared as interchangeable coin holdings. Keep the realized-path seed, valuation seed, selected objective and coverage rule attached to every sizing comparison.

The rule. The rebalancing rule is a parameter of the futures leg — Calendar { months }, a delta band, PriceMove { pct } — with a minimum trade and a lot (CME is 5), and its cost is measured rather than assumed: series.rs::rebalance_policy_comparison runs one structure under each policy on the same seeds at the desk’s own execution cost (the request’s exec_cost_bps, bps of premium on every option leg; a futures leg carries none, so a structure of futures alone reads the same at any value of this premium-cost input; its own futures_cost_bps still charges futures turnover) and reports turnover in coins and the trade count; every row’s result.exec_cost_bps and the response’s notes say the cost used, and the run page’s exhibit 05 says “net of N bps”. Until the follow-up audit of 6 September 2026 (“Costs”) the comparison priced every policy at zero by convention, so a structure with an option leg compared its policies on a different cost basis from the run above the table; the_policy_comparison_is_priced_at_the_desks_execution_cost pins the fix — a futures leg beside a bought put ladder, monthly against quarterly, hedged median 22.19% at zero and 22.18% at 50 bps, each row equal to the overlay of the same structure under the same policy at that cost. The page subtracts each hedged median from the monthly reset’s. The test’s one cohort on a moving path: monthly, 16.02% hedged median, 3.39 coins turned over, 53 trades; a band no drift can cross, 16.84%, 3.32 coins, one trade; yearly, 16.21%, 5 trades. The minimum trade thins the reset monotonically — 55 trades at zero, 49 at \(10^{-6}\) coins, 5 at 0.05 — and lots of five keep the identity conserved. A policy’s cost is the path it holds: a held position is not the melting one.

To reproduce: POST /api/forwardflow/hedge_series with the cockpit’s BASE_CONFIG and one structure (the loss-line ladder when omitted; 16 seeds by default; include_greeks for the third delta); POST /api/forwardflow/rebalance_policies for the table. cargo test --release -p forwardflow --test series -- --nocapture prints every figure above.

What each instrument supports

The model audit of 6 September 2026 (M10) asked for one table saying, per instrument, which of the desk’s measures the branch actually computes — so that the label “total P&L” on the run page never implies a capability a branch lacks. This is that table, read off hedge.rs and series.rs for engine 0.6.1, spec v1.14. Yes means the figure is computed from the instrument’s own contract and validated against an independent book (the Black-Scholes reference to \(1.5 \times 10^{-11}\), the stop waterfall to the cent, the monthly identity to \(2 \times 10^{-15}\) of par); proxy means a stated approximation stands in for it; no (stated) means the desk does not compute it and says so in the result’s notes, and a Holder comparing structures must supply it from outside.

Three sentences the table leans on. The monthly report is total P&L on marks — mark_paper, option_mark and the futures’ cash — with the cash reported beside it (hedge_premium, hedge_settlement), and the identity holds bucket by bucket; a “no (stated)” cell means that instrument’s figure in the total is the contract’s cash and mark as modelled and nothing more. Margin and cash requirements are reported (initial margin, the variation call, the intramonth proxy, the buffer) and do not constitute a constrained cash and margin account: available cash, deposits and releases, written-option collateral, venue haircuts and forced deleveraging are Phase 4b and are not in any row above. Close-out follows the one lifecycle: a futures position follows its rebalancing and close-on-exit rules; an option runs to its own expiry, and the unhedged residual (a put still open on a sold coin, a call bought on a coin that stopped) stays in the flows and in the risk desk’s coverage, never dropped. The capability table is the word for this section.

What a desk should read first

Read the selected objective and the actual Agreement/BTC funding count first. For Coin, compare BTC deployed, receipts, net contributions, recoveries and gain before the annualized IRR. Check loss probability and expected shortfall across matched simulations, then inspect an actual adverse path. Price the hedge with the recorded surface, option rate, basis, execution costs and funding assumptions.

Read realized cash settlement separately from signed open derivative value. The legacy payoff_mean_usd includes both, so it cannot be treated as cash collected. Keep USD margin requirements separate from BTC recovery: neither a sensitivity hedge nor a positive terminal outcome proves that a finite wallet can meet interim cash calls.

Reproduce current results with the exact saved configuration, structure, price/valuation seeds and engine identity. POST /api/forwardflow/hedge_research gives matched per-seed outcomes; hedge_series gives the selected monthly path and bands. The wire formats are in The API; the validation procedure is in Verification and reproduction. Historical figures elsewhere in this chapter require their historical configuration and engine version.

Compare hedges across possible outcomes

Open Hedge strategies or Risk analysis, choose up to eight strategies, and run the comparison. Unhedged is always included. Each strategy faces the same Bitcoin path and Buyer outcomes on each seed. A bridge pins the terminal market price; fixed historical/custom/uploaded paths do not sample terminal-price uncertainty. The experiment description above the results identifies that distinction.

Start with 256 simulations to explore. Use 1,024 or 2,048 and Check on new simulations to assess whether the result persists on a separate seed range. At 32 simulations, a 5% tail contains only 1.6 observations of sample weight. More simulations improve sampling precision under the assumptions; they do not calibrate the market or Buyer model.

The primary table compares:

• Mean NPV: all monthly dollar cash flows, including surviving derivative marks at the horizon, discounted at the chosen effective annual rate. Zero discount gives economic gain, including any signed horizon mark; it is not all realized cash. The approximate 95% error band is 1.96 times the sample standard error; it measures Monte Carlo noise only.
• Capital loss probability: the proportion of scenarios with negative undiscounted net gain. A 95% Wilson interval remains nonzero even when no loss is observed. Dollar loss uses a half-cent numerical tolerance; coin loss uses 1e-10 BTC.
• Average loss in the worst 5%: expected shortfall of nonnegative capital loss, max(0, −net_gain_usd). Sort losses from greatest to least and average exactly 5% of sample weight, using a fractional boundary observation. A profitable tail is shown as zero loss. The Coin reading applies the same rule to its dated BTC flows: Agreement funding at actual entry and receipts/hedges at monthly spot.
• Cash needs: the 95th percentile and maximum of the initial cash required on the monthly path. Hedge cash excludes Agreement purchases and receipts; total cash includes them. Receipts remain available. At each month, required cash is supplied futures margin minus cumulative realized net cash, floored at zero. Derivative marks at the final horizon are excluded from cash available to meet margin. The optional cash allowance reports how often this requirement exceeds the amount entered.
• Paired improvement: the proportion with higher NPV than unhedged on the same seed, plus the mean paired NPV difference. This is not the difference between separately ranked percentiles.

A cash allowance is a monthly liquidity screen. It does not change trades or simulate forced closure. Daily calls, short-option/swap collateral, venue rules and intramonth timing remain outside this calculation. A strategy can have attractive lifetime results and still require unaffordable interim cash. Cross-book collars are excluded because their free-coin capital is outside the Agreement ledger.

Expand Sampling stability, coin outcomes and IRR to compare the full sample with its first half. This is a diagnostic, not a convergence certificate. IRR statistics retain the missing and ambiguous-root counts. Paper exposure shows distributions of peak unrecovered capital and schedule shortfall; these are paper exposures, not net derivative Greeks or expected losses.

Run stress on matching seeds changes either the surface volatility level, option execution costs, or the lifetime Buyer default prior. The saved inputs and changed assumption remain visible. These are separate conditional experiments, without assigned probabilities; do not pool them into the primary distribution. Futures basis, trading costs, margin and lifecycle remain the selected strategy’s inputs. These simple stresses do not model a jointly stochastic future volatility surface or basis process.

Inspect an actual adverse path replays the seed with the greatest dollar loss, greatest hedge cash need or greatest NPV deterioration. Export all samples saves every scalar observation, exact batch request, assumptions, seed range and engine/data identity. A changed engine is refused during a batch run or saved-path inspection. Runs continue while the page stays open, in sequential batches of at most 32; they are not durable server jobs. Cancellation preserves the previous completed result.

Implementation: forwardflow/src/research.rs::compare_with_cancel runs one immutable Agreement book per seed and applies every selected overlay to it. research.rs::observation defines the cash/NPV calculations; web/app/forwardflow/research.ts defines ES, quantiles, Wilson intervals and paired aggregation. Batches retain raw observations, never averages of batch percentiles. Agreement ledger and trading-rule calculations remain those described earlier in this chapter. Automated reconciliation tests compare these outcomes with the original hedge engine and verify batch splitting and horizon-mark handling.

The coin-delta estimation seed (valuation_seed, API default 42) stays fixed across batches, stress cases and separate realized-path samples. Changing it changes the estimated trading rule; it is not changed automatically when config.seed advances. The browser records both seeds in every exact request.

The Coin holding benchmark

Dollar asks how much USD the Holder can gain or lose. Coin asks whether the Holder recovers more BTC than retaining the BTC contributed to the strategy. These are reporting objectives on the same Agreement books, paths and trades; switching objective does not change raw economics.

The supported Coin convention funds each Agreement purchase at its own actual entry price and converts Holder receipts and hedge cash at the monthly simulated spot. With the dated BTC economic flow F_m defined above:

• Contributed BTC: sum(max(−F_m, 0)).
• Recovered BTC: sum(max(F_m, 0)).
• Holding benchmark: retain those same dated contributed BTC through the horizon.
• BTC surplus over holding: recovered BTC minus contributed BTC, equal to sum(F_m).
• BTC shortfall: max(0, −surplus). Event counts use a 1e-10 BTC numerical tolerance; tail loss averages exactly the worst 5% of sample mass. No USD discount rate is applied to BTC.

Netting occurs in BTC after applying the appropriate funding/conversion price to each component. It is no longer correct to net all USD cash and divide that net by monthly spot when Agreement entry prices differ. Receipts can offset same-month purchase funding or hedge costs; later negative months require additional contributions. Each strategy has its own matched contribution schedule, so this is not a common initial-budget comparison. Reserves, borrowed capital, conversion trading costs and external free BTC are outside this convention. Gross Agreement funding is one BTC per originated Agreement at par; net contributions can be smaller when earlier receipts are reused. The legacy purchase-denominator multiple is separate from the recovered/contributed ratio.

Surviving derivative marks enter the final month’s economic flow at horizon spot. They can increase economic recovery or, for a negative net month, add a hypothetical terminal contribution. coin_holding.realized_cash_contributed_coins and realized_cash_recovered_coins exclude marks; horizon_mark_coins reports the signed BTC-equivalent mark separately. None of these fields claims a live wallet balance or execution of BTC conversions. Monthly replay supplies the actual spot vector so every amount can be reconciled.

The USD cash screen retains receipts in dollars and reserves supplied futures margin. Coin economic outcomes instead value monthly BTC conversion. These separate conventions cannot establish that the same portfolio meets cash calls: converting receipts may remove dollars needed later. Reserve allocation, borrowing, daily margin and forced closure require a reconciled cash and conversion policy before any joint funding-feasibility claim.

Implementation: btc.rs::paper_coin_flows, btc.rs::observe and btc.rs::holding; ResearchConventions records the policy and ResearchBatch::with_objective selects reporting context. Tests cover nonconstant spot, netted phased contributions, purchase price different from strike, hedge costs, positive/negative horizon marks, unchanged economics across objectives and deterministic batch/replay identity. Version 0.6.0 changes Coin outcomes where actual Agreement entry differs from the monthly price; old monthly-purchase-conversion results must retain their old convention and be re-run for comparison. The underlying USD ledger is unchanged.

Amounts, ratios and settlement

BTC cash-flow IRR remains a useful annual timing measure alongside the amount bridge. One contribution of 100 BTC and recovery of 110 BTC gives 10% total return. With only those two flows one year apart, annualized IRR is also 10%; two years apart it is about 4.88%. Intermediate cash flows can change it again. Costs already included in Holder receipts and hedge flows must not be deducted a second time.

Keep gross Agreement purchases and gross Holder receipts separate from monthly net contributions and recoveries. The economic recovery ratio is recovered_coins / contributed_coins; the realized-only ratio uses the corresponding realized cash fields. Ratios are dimensionless (×); total return is ratio minus one, and a zero denominator is unavailable. These are distinct from the legacy purchase-denominator multiple above. Compute per-path ratios before summarizing their distribution.

The horizon bridge is economic recovery − economic contribution = realized cash recovery − realized cash contribution + signed horizon derivative value. A terminal mark can change a month’s sign, so economic recovery alone need not equal realized recovery plus the mark. Display both contribution sides.

All of these BTC figures are unit-of-account conversions of modeled flows. They do not establish an actual BTC settlement asset, executable FX trade or withdrawable custody balance. For example, a venue’s inverse option can quote and settle in BTC while another instrument uses USD-sized contracts and different collateral. ForwardFlow does not claim to reproduce a venue’s settlement and margin rules. See the measurement guide and release model card.