# PAPER DESK v3 research: Excursion Restitution Ledger at 100×

Research date: 2026-11-03 UTC. Scope: research and an implementation-ready specification for BTC and ETH on Papertrade. This assignment delivers the report, not a deployed indicator, trading integration, or a validated profitable strategy. The existing read-only site is preserved. A companion scope note is in `RESEARCH-README.md`.

**Finding:** Papertrade removes funding and notional fees but does not remove the cost of trading. It discounts profitable moves while taking losses in full; its hard-bust trigger precedes zero equity; and settled profit can be an unpaid queue claim. An indicator must earn its edge from price prediction and execution discipline. PAPER emissions do not establish that edge.

**Proposal:** **Excursion Restitution Ledger (ERL-100)**, a new candle-geometry construction proposed here. It retains price intervals rejected by wicks, erases only the portions subsequently accepted by candle bodies, and asks whether a two-bar reclaim has enough surviving support and an unobstructed corridor to justify its *net* payoff. A separate liquidation-map layer can veto a new entry, never manufacture historical evidence. No performance claim is made.

## 1. Evidence, date and interpretation

The fourteen requested pages were fetched and read in full, including formulas and page endings. They identify **contract set 2**, current since 2026-10-21; their displayed update date is 2026-10-21. Links below identify the exact pages. This is a documentation study, not a contract audit or an onchain parameter snapshot. “Current” below means what those pages represented on the research date; owner-adjustable values require revalidation before operational use.

Labels used throughout:

- **Documented:** a primary-source description, not independently verified behavior.
- **Derived:** arithmetic or a logical implication of the documented model.
- **Hypothesis/design:** the proposed strategy, thresholds or policy, requiring testing.
- **Unknown:** information not supplied by the docs or the assignment's API.

### Source register and coverage

| Source read | What it supports |
| --- | --- |
| [Architecture overview](https://docs.papertrade.xyz/how/architecture/) | Exchange, executor, relayer, token/staking contracts, precompiles |
| [Asymmetric impact PnL](https://docs.papertrade.xyz/how/asymmetric-impact/) | Deadband, both holdbacks, impact formula, example parameters |
| [Pricing: BBO precompile](https://docs.papertrade.xyz/how/pricing-bbo/) | Midpoint, validation limits, retirement/frozen price |
| [PAPER mint curve](https://docs.papertrade.xyz/how/mint-curve/) | Exponential issuance, insolvency clock, eligible basis |
| [Risk](https://docs.papertrade.xyz/how/risk/) | Manipulation, OI headroom, privileged roles and upgrades |
| [Solvency & queue](https://docs.papertrade.xyz/how/solvency-queue/) | Cash, side bucket, FIFO priority, debt-funded accounting |
| [Trades and pricing](https://docs.papertrade.xyz/learn/trades-pricing/) | Trader experience, immutable isolated positions, limits |
| [Wins and losses](https://docs.papertrade.xyz/learn/wins-losses/) | Win fee, loss accounting, builder fee |
| [Liquidations](https://docs.papertrade.xyz/learn/liquidations/) | Buffer, full-margin bust, keeper and voluntary close |
| [Paper Emissions](https://docs.papertrade.xyz/learn/paper-emissions/) | Loss-only eligibility and economic purpose |
| [Staking Dividends](https://docs.papertrade.xyz/learn/staking-dividends/) | Fee split, excess sweep, distribution conditions |
| [The LP and payout queue](https://docs.papertrade.xyz/learn/lp-queue/) | Zero-seed LP, available versus queued collateral |
| [$PAPER overview](https://docs.papertrade.xyz/paper/overview/) | Token rights, launch transfer restrictions, dilution |
| [FAQ](https://docs.papertrade.xyz/intro/faq/) | HyperCore custody versus HyperEVM state; frontend access |

## 2. What a trader is actually trading

### Architecture and pricing

**Documented:** these are synthetic positions against the protocol LP, not positions opened on Hyperliquid. `Exchange` records balances, positions and settlement. Signed intents pass through Papertrade's relayer and authorized `BatchExecutor`; an alternative frontend cannot directly submit opens and closes. `PriceOracle` reads HyperCore precompiles. PAPER issuance and staking have separate contracts. [Architecture](https://docs.papertrade.xyz/how/architecture/)

Trading state lives on HyperEVM, while the FAQ describes USDC balances as held on HyperCore and moved through CoreWriter. A read-only terminal therefore observes a system involving two execution/accounting surfaces; a displayed balance is not proof of immediate external withdrawal. [FAQ](https://docs.papertrade.xyz/intro/faq/)

The execution reference is `(bestBid + bestAsk) / 2`, from BBO precompile `0x000000000000000000000000000000000000080e`; BTC and ETH asset indices are 0 and 1 on the documented chain-999 deployment. Zero or crossed books revert, but there is no independent deviation or time-weighted breaker. A nonzero uncrossed distorted midpoint can pass. Market retirement freezes that instrument's BBO permanently for closes and liquidations and prevents new opens; a global opens pause does not freeze prices. [Pricing](https://docs.papertrade.xyz/how/pricing-bbo/)

**Derived:** “zero slippage” describes fill price relative to the contract's midpoint *at execution*. It does not promise execution at the candle close, click price, or an earlier quote. Relayer delay, block inclusion and a candle-feed/BBO mismatch remain timing risks. A candle feed that tracks Hyperliquid closely is still not an execution receipt. The assignment provides that feed relationship; it does not quantify its tracking error.

**Documented:** no funding, spread or user-paid gas; the relayer pays gas. Positions have fixed isolated margin and leverage, cannot be topped up or partially closed, and can only be closed in full or liquidated. The page lists BTC/ETH, up to 1000×, and a $10M individual-position notional limit. [Trades and pricing](https://docs.papertrade.xyz/learn/trades-pricing/)

**Design implication:** ERL uses full exits, no averaging down, and no assumption that unused account funds rescue a position. This report evaluates 100× only.

### Payout math and costs

**Documented model:** let `p` be favorable fractional price movement, `N` notional, `f` win fee and `b` builder fee. All price units below are fractions, so one basis point is `0.0001`:

```text
standard: a=.000075, z=.0006, k=3.597, exponent=2
off-hours: a=.00003, z=.001, k=6.085, exponent=3
u = (p-a)/(z-a)
H(p) = k*(z-a)*u²*(1-u)^exponent if a<p<z; otherwise 0
q = max(0, p-.00002-H(p))
S(q) = (1-baseRate)/(1+1/(q*rateMultiplier)
                         +referenceNotional/(1e6*q*positionMultiplier))
G(N,p) = 0 if q=0; otherwise N*q*S(q)*(1-f-b)
```

The published parameters are `baseRate=.10`, `rateMultiplier=15000`, `referenceNotional=100000`, and `positionMultiplier=814.598` BTC or `483.979` ETH. These are documentation defaults, not verified live settings. The curve depends on movement, not actual trade size. [Asymmetric impact](https://docs.papertrade.xyz/how/asymmetric-impact/)

The win fee is 2% **after** impact. The documented builder fee is an additional 0.5% of that gain, giving 97.5% rather than 98% retention at this step; papertrade.xyz names no builder. Losses are unscaled and incur no extra charge to the trader. An LP-side loss fee is instead carved out of the LP's gain when applicable. [Wins and losses](https://docs.papertrade.xyz/learn/wins-losses/)

**Derived calculations:** for margin `M`, `N=100M`, define `g(p)=G(100M,p)/M`. The table shows profit as a percentage of margin, excluding PAPER and queue discount. It uses `b=0`. Standard and off-hours coincide at and above 10 bps under these formulas.

| Favorable move | BTC standard | BTC off-hours | ETH standard | ETH off-hours |
| --- | ---: | ---: | ---: | ---: |
| 1 bp | 0.1924% | 0.1107% | 0.1462% | 0.0825% |
| 3 bps | 0.6885% | 0.3466% | 0.5573% | 0.2704% |
| 5 bps | 2.6736% | 1.5487% | 2.3571% | 1.3182% |
| 10 bps (0.10%) | 7.2435% | 7.2435% | 6.7588% | 6.7588% |
| 20 bps (0.20%) | 15.9387% | 15.9387% | 15.3455% | 15.3455% |
| 30 bps (0.30%) | 24.7127% | 24.7127% | 24.0757% | 24.0757% |
| 50 bps (0.50%) | 42.3141% | 42.3141% | 41.6386% | 41.6386% |
| 80 bps (0.80%) | 68.7516% | 68.7516% | 68.0530% | 68.0530% |

These are floating-point reconstructions of the published equations, not exact fixed-point contract quotes. A 10-bp adverse close before bust costs 10% of margin, whereas a 10-bp favorable BTC move earns about 7.24%. With symmetric 10-bp outcomes and no other costs, break-even win rate is `10/(10+7.2435)=57.99%`; ETH needs about 59.67%. For a 30-bp target and 10-bp stop, the simplified thresholds become 28.81% BTC and 29.35% ETH. Real time exits, gaps and liquidation tails invalidate that two-outcome simplification.

### The 100× bust discontinuity

**Documented:** the liquidation trigger is about 5 bps closer than the zero-equity price. The docs illustrate a 100× long entered at 100 with a trigger around 99.05. Liquidation forfeits the whole margin; a voluntary close executing at or past bust takes that same path. The liquidation keeper prioritizes its transactions. [Liquidations](https://docs.papertrade.xyz/learn/liquidations/)

**Derived, approximate:** with entry `E`, direction `s=+1` long or `-1` short, margin `M`, and notional `100M`:

```text
raw PnL = 100M * s*(P-E)/E
zero-equity price = E*(1-s*.01)
approximate bust = E*(1-s*.0095)
```

At entry 100, approximate short bust is 100.95. Just before a 0.95% adverse move, a linear close still has about 5% of margin left; hard bust destroys it. On illustrative BTC entry $100,000, long zero equity is $99,000 and approximate bust $99,050; on ETH entry $3,000 these are $2,970 and $2,971.50. Short equivalents are $101,000/$100,950 and $3,030/$3,028.50. These are arithmetic examples, not current market quotes.

The published buffer is approximate; do not turn `.0095` into an exact contract invariant. Use the backend position's actual `bustPrice` for an existing position. Stops are requests to exit, not guaranteed fills, and a one-minute bar may contain a bust before its close.

### PAPER emissions and staking

**Documented:** only eligible realized losses and liquidations mint PAPER in set 2; profitable trading alone does not. The token compensates loss-taking with a claim on future economics rather than returning the lost dollars. The insolvency bonus applies only to the portion refilling negative tracked LP and ramps over three days. [Paper Emissions](https://docs.papertrade.xyz/learn/paper-emissions/)

The technical formula is:

```text
mint = supply * expm1(c*g_eff)
g_eff = g + (m-1)*g_below0
m = 1 + 4*u*(2-u); u=min(1, secondsUnderwater/259200)
g_below0 = min(credit, -trackedLpBefore) when trackedLpBefore<0; else 0
```

Here `g` is eligible loss basis and `credit` the tracked-LP increment. The page reports `c≈1.101e-9` per dollar. Solvent USD-funded losing closes typically mint on loss net of LP-side fees; queue-active losses mint on the full loss; liquidations always use full lost margin even if tracked LP receives less. Debt-funded liquidation destroys its claim and also mints on it. Harvest does not advance tracked LP again. [Mint curve](https://docs.papertrade.xyz/how/mint-curve/)

**Derived:** new tokens dilute existing holders. After a single mint with no other changes, the recipient's share of total supply is `1-exp(-c*g_eff)`, not a dollar rebate. At the documented `c`, $100 effective basis is roughly 0.00001101% of resulting supply; a hypothetical full 5× weight makes it roughly 0.00005505%. Neither determines staking share because not all supply need be staked. The formula alone yields zero issuance from zero supply: bootstrap/activation is an unanswered implementation detail, not something this report fabricates.

**Documented:** launch PAPER is nontransferable between wallets, while staking and unstaking work. Revenue rights are contingent, and issuance keeps expanding supply. [$PAPER overview](https://docs.papertrade.xyz/paper/overview/)

Staking has no lockup/cooldown. Stakers receive half of applicable 2% trading fees; the other half goes to the dev recipient. Fees reach recipients only with an empty queue and sufficient LP coverage. Tracked LP surplus above the documented $5M cap is sweepable to stakers. Builder fees go to builders, not stakers. [Staking Dividends](https://docs.papertrade.xyz/learn/staking-dividends/)

**Design:** assign PAPER a zero liquidation value in cash-edge tests, track quantities separately, and count only received USDC dividends as cash. Zero is a conservative valuation assumption, not a claim that the token is worthless. Do not hold a losing trade to bust for a larger mint. Its extra stake in uncertain future distributions has no established equivalence to certain lost collateral.

### Queue and solvency

**Documented:** the LP starts without seed capital and cannot accept direct LP deposits. Cumulative losses bootstrap it. A USD-funded winning close returns collateral immediately but may queue unpaid profit. A losing close returns surviving collateral; debt-funded positions can requeue their whole surviving claim. [LP and payout queue](https://docs.papertrade.xyz/learn/lp-queue/)

The technical model separates nonnegative LP cash, parked loss proceeds (`sideBucket`), and FIFO debt. New winners cannot jump an existing queue. Loss proceeds park for queue payouts while it is active; debt-funded losses cancel claims without adding cash. Net LP equity, cash including parked funds minus queued debt, can be negative. Harvest pays from backing cash, consuming the side bucket first; loss/liquidation fees are waived with an active queue. The win fee still reduces a winner's entitlement even when not distributed. [Solvency & queue](https://docs.papertrade.xyz/how/solvency-queue/)

**Inference:** FIFO establishes priority, not a finite repayment deadline. The docs' expectation of eventual payment depends on future backing cash, maintenance and continued protocol operation. If activity ceases or future losses are insufficient, claims can remain unpaid indefinitely. TVL is not free LP cash, tracked LP is not automatically withdrawable cash, and trading an existing queue claim is not receiving USDC.

**Documented risk:** BBO jitter/manipulation remains possible. Directional OI controls constrain new exposure, not maximum aggregate losses. Trading depends on authorized relayers; maintenance paths are public. The owner can change economics and upgrade proxied implementations; keepers have narrower powers. [Risk](https://docs.papertrade.xyz/how/risk/)

**Inference:** market retirement, a failed relayer, implementation changes, custody/bridge failure or inadequate LP cash can overwhelm a price signal. The provided APIs do not expose all these conditions. No indicator can certify solvency from this summary alone.

## 3. Strategies worth testing, and why most fail

Everything in this section is a hypothesis or economic deduction, not a documented Papertrade performance claim.

| Candidate | Plausible mechanism | Main reason it fails at 100× |
| --- | --- | --- |
| Fast continuation after a reclaim | A failed adverse excursion followed by recovery may identify a locally exhausted move | Continuation can reverse inside the next bar; false reclaim and execution delay |
| Continuation through a cleared corridor | Little recent rejected territory ahead may reduce immediate retracement pressure | Candle geometry does not observe current order-book depth or news |
| Mean reversion after a failed break | An excursion rejected twice gives a nearby, explicit invalidation | Persistent trends repeatedly sweep apparent support; small targets lose disproportionate payout |
| Broad trend following | Larger favorable moves retain more raw profit | A correct multi-hour view can still suffer a sub-1% liquidation first |
| Tiny tick scalping | No spread/funding is superficially attractive | Deadband, holdback and impact crush tiny winners while losses remain full |
| Liquidation-cluster chasing | Clusters may describe fragile positioning and potential LP inflows | Papertrade liquidations are synthetic settlements, not mandatory Hyperliquid market orders |
| PAPER farming / hedged loss creation | Losses create future fee claims | Dilution, nontransferability and uncertain dividends; opposite positions also retain payout asymmetry |
| Martingale / averaging down | Wins can recover several small losses in a calm regime | Margin cannot be added; discrete extra positions multiply correlated full-margin tail risk |

BTC and ETH require separate tests. Under the documented defaults ETH retains less profit for the same small move. Any assertion that ETH is always more volatile, or BTC always easier, needs measured data; the specification does not assume either. A 1m policy is the proposed operational candidate. A 5m run is a robustness comparison, not a promise that five minutes is safe. Higher timeframes may compute geometry, but the default 100× entry policy is disabled on 15m and above.

## 4. ERL-100: exact candle-only specification

### 4.1 Original construction and limits of originality

ERL treats a wick as **rejected territory**, a body as **accepted territory**, and subsequent body overlap as **repayment of that rejection**. This creates an ordered interval ledger: two histories with the same closes, range, volume and last bar can have different surviving territory because their body/wick order differs. An ordinary oscillator or volatility band cannot recover this state from its rolling scalar statistic.

The new element is the surviving-interval ledger and its economic corridor budget, not the familiar idea of a failed breakout. No RSI, MACD, Bollinger band, SuperTrend, Ichimoku, TD count, stochastic, volume average or blend thereof enters ERL. “Original” means this specific construction is introduced in this report; no exhaustive prior-art search or mathematical uniqueness claim is made. OHLC territory is only a proxy for auction rejection. It does not establish actual resting support.

### 4.2 Data validity and bar confirmation

Input is immutable candles `{t,o,h,l,c,v}`, symbol BTC/ETH, timeframe seconds `Δ`, explicit evaluation time `nowSec`, parameters and a versioned payout profile. No function may read a clock, network, storage, random source or mutable global state.

The API's bar-open convention must be confirmed with the backend; the existing project describes `t` as bar open. A bar is usable only if `t+Δ <= nowSec`. If that convention is unconfirmed, show `TIMESTAMP UNKNOWN` and do not signal. Never infer closure from being the final returned row. Equal timestamps are rejected rather than arbitrarily resolved. Require finite positive OHLC, `l<=min(o,c)<=max(o,c)<=h`, finite nonnegative volume, increasing integral timestamps on a regular `Δ` grid. Volume is validated but unused. Invalid rows reject that series; missing intervals split it into new segments, without synthesized candles.

The latest bar may still be forming and must be excluded. With zero-based index `i`, a signal **confirms at the close of bar i**, using a sweep on `j=i-1` and a confirmation on `i`. It cannot be filled at the sweep low/high or at an earlier part of `i`. All lookbacks are within the current contiguous segment. Start over after gaps, with 24 pre-sweep bars required; the first eligible signal is index 25 of a segment. Existing trade risk cannot be treated as resolved merely because data disappear.

### 4.3 Directional coordinates

Run identical logic for `s=+1` (long) and `s=-1` (short). For each raw bar define:

```text
O=s*o; C=s*c
L=min(s*l,s*h); U=max(s*l,s*h)
body B=[min(O,C), max(O,C)]
lower rejection W-=[L,min(O,C)]
upper rejection W+=[max(O,C),U]
```

“Up” in this coordinate is favorable for that direction. Prices can be negative for the short computation; all normalized distances use the positive raw reference price `E=c_i`. Ignore zero-length intervals. Interval endpoints have zero measure; inclusive equality is relevant only to the explicit entry/stop comparisons below.

### 4.4 The surviving ledger

For candidate confirmation `i`, use the **24 bars strictly before sweep j**, `k=j-24,...,j-1`. This avoids counting the triggering wick as proof of its own prior support.

For each `k`, start with `W-_k` and `W+_k`. Erase every portion covered by any later closed body `B_m`, `k<m<=i`:

```text
R-_k = W-_k \ union(B_m for k<m<=i)
R+_k = W+_k \ union(B_m for k<m<=i)
w_k = (k-(j-24)+1)/24
D-(x) = max({w_k : x in R-_k} union {0})
D+(x) = max({w_k : x in R+_k} union {0})
coverage(D,[a,b]) = integral_a^b D(x) dx / (b-a), a<b
```

Set subtraction can split one interval into several; do not erase a whole wick merely because its tip was overlapped. The maximum prevents repeated overlapping wicks from manufacturing unlimited evidence. Recency weighting is linear by bar rank, bounded in `[1/24,1]`. Evidence expires with the 24-bar window. Later wicks do not erase earlier evidence; only later bodies do. This is a deliberate design assumption.

Calculate integrals exactly over the sorted unique endpoints of surviving intervals and the query endpoints. On each open cell, density is constant. Sum `cellLength*maxWeight`, clipping cells to the query. Do not histogram price into arbitrary bins, sample pixels or round to a tick before integration. Compare outputs with a relative floating tolerance in tests, but apply specified strict/non-strict production thresholds directly.

### 4.5 Defaults and sweep/restitution event

| Parameter | Default | Meaning |
| --- | ---: | --- |
| `ledgerBars` | 24 | Pre-sweep wick cohort |
| `frontierBars` | 12 | Prior closing frontier |
| `sweepMin` / `sweepMax` | .0003 / .0025 | 3–25 bps penetration |
| `reclaimBuffer` | .0001 | 1 bp above frontier |
| `confirmMin` | .0001 | 1 bp progress after sweep close |
| `stopPad` | .0002 | 2 bps beyond sweep extreme |
| `riskMin` / `riskMax` | .0005 / .0025 | 5–25 bps entry-to-stop |
| `rangeMax` | .004 | Max sweep or confirmation range, 40 bps |
| `targetRiskMultiple` | 3 | Geometric target before costs |
| `targetMin` / `targetMax` | .002 / .008 | Target 20–80 bps |
| `supportMin` | .35 | Surviving lower-ledger coverage |
| `obstacleMax` | .35 | Upper-ledger corridor coverage |
| `netRRMin` | 1.8 | Payout-adjusted reward / modeled risk |
| `budgetMin` | .8 | ERL score threshold |
| `latencyReserve` | .0002 | Additional 2-bp adverse execution allowance |
| `maxHoldBars` | 6 | Full close at sixth completed holding bar |
| `cooldownBars` | 6 | Six complete bars after exit before another setup |
| `allowedEntryTf` | 1m, 5m | 100× policy; geometry can be viewed elsewhere |

All are hypotheses frozen for initial testing, shared across BTC/ETH except the documented payout multiplier. There has been no parameter fitting. Parameter validation requires finite numbers, positive integer windows, `frontierBars<=ledgerBars`, ordered bounds, coverage thresholds in `[0,1]`, positive score/reward limits, and `riskMax+latencyReserve < .0095`. That last inequality is a conservative approximate-bust constraint, not proof of safety.

For each side:

```text
F = min(C_k for k=j-12,...,j-1)
penetration = (F-L_j)/c_j
```

The sweep must satisfy all of:

1. `sweepMin <= penetration <= sweepMax`.
2. `C_j >= F + reclaimBuffer*c_j`.
3. `(U_j-L_j)/c_j <= rangeMax`.

The confirmation must satisfy all of:

1. `L_i > L_j` (no retouch of the sweep extreme).
2. `C_i >= C_j + confirmMin*c_i`.
3. `C_i >= F + reclaimBuffer*c_i`.
4. `(U_i-L_i)/c_i <= rangeMax`.

This fixes the reclaim event on `j` and final confirmation on `i`. A rejected event cannot be revived on `i+1`; that later bar needs its own preceding sweep. No event waits indefinitely for a favorable future confirmation.

### 4.6 Stop, target and score

Set reference raw entry `E=c_i` and directional entry `X=s*E`. Compute:

```text
Sx = L_j - stopPad*E
r = (X-Sx)/E
p = min(targetMax, max(targetMin, targetRiskMultiple*r))
Tx = X + p*E
J = coverage(D-, [L_j,F])
A = coverage(D+, [X,Tx])
W = min(g_standard(p), g_offhours(p))
R = 100*(r+latencyReserve)
netRR = W/R
ERL = J*(1-A)*netRR
rawStop = s*Sx
rawTarget = s*Tx
```

`W` and `R` are fractions of margin, not price. The conservative payout profile uses the worse of the two curves because their active state is not exposed. Builder fee defaults to zero **only for a clearly labeled papertrade.xyz scenario**; show a 0.5% builder sensitivity alongside it. An unknown venue/profile must be labeled `ECONOMICS UNVERIFIED`, not silently treated as a verified current quote.

Signal only if `riskMin<=r<=riskMax`, `J>=supportMin`, `A<=obstacleMax`, `netRR>=netRRMin`, and `ERL>=budgetMin`, in addition to the event gates. Both directions qualifying on one bar produces `AMBIGUOUS/NO ENTRY`; do not choose by hindsight. A nonfinite calculation gives `INVALID`, never a buy or sell.

ERL is a dimensionless decision budget, **not a calibrated probability**. For example, `J=.8`, `A=.1`, and `netRR=2.0` gives `ERL=1.44`; changing either interval history can veto the same close pattern. Historical geometry can emit a candle-only candidate even when live data are absent. Eligibility and economic assumptions must be visible separately.

### 4.7 Entry, holding, exit and invalidation

**Long:** after `i` closes, consider opening at the next available BBO; stop is below sweep low, target above entry. **Short:** after `i` closes, consider opening at the next available BBO; stop is above sweep high, target below entry. There is no fill on bar `i` in a historical execution simulation.

Reference entry expires at the end of the next bar (`t_i+2Δ`). For historical testing, attempt the next bar open only; no favorable intrabar limit-fill assumption. With actual fill `Efill`, keep the raw stop fixed, recompute `r=s*(Efill-rawStop)/Efill`, `p`, target, corridor coverage and economics against the same frozen pre-entry ledger. Skip if any gate fails, or `abs(Efill-E)/E>.0002` (2 bps), or fill is at/past stop. This explicit fill adaptation is a separate execution assessment; it never edits the historical candidate.

Use actual `bustPrice` if available: the raw stop must be at least `.003*Efill` (30 bps) inside the safe side of bust. Long requires `rawStop>bustPrice+.003*Efill`; short requires `rawStop<bustPrice-.003*Efill`. If bust is unavailable, a historical simulation may use the labeled approximate formula, while operational eligibility is `BUST UNVERIFIED`. Never widen a stop to make a late entry qualify.

After opening one position per symbol, freeze its stop, target, frontier and sweep extreme. No pyramiding, reversal on the exit bar, partial take profit, breakeven move or trailing-stop rule. These exclusions make the experiment reproducible.

Exit priority and signal timing:

1. **Risk boundaries:** fixed stop and target are standing reference levels. A live observer may flag a touch immediately, but that is an execution alert, not a bar-close ERL signal. It cannot guarantee a close. Actual bust overrides all modeled exits.
2. **Closed-bar failure:** after each holding bar `h` closes, request a full exit if `s*c_h < F` or `s*c_h <= L_j`. The second rule records complete sweep failure even if frontier configuration changes. Exit confirms on `h`, fills no earlier than the next available quote. Never wait for recovery after invalidation.
3. **Time exit:** request full close at the close of holding bar 6. Holding bar 1 is the first completed bar after entry. An entry at the next bar open has that bar as holding bar 1. Gaps do not count as safe holding bars; flag missing risk observations.
4. No new entry until six full bars *after* the exit bar have closed. The earliest subsequent signal is exit index plus 7, and the usual 24-bar warmup still applies.

**Sizing policy, distinct from ERL:** evaluate at fixed margin first. A proposed deployment cap is margin no greater than 0.25% of withdrawable account equity per position and 0.5% combined BTC/ETH. Size to the possibility of a full bust, not only `r`. Never count queued claims or hypothetical PAPER value as withdrawable equity. These are conservative research limits, not an optimized portfolio rule.

### 4.8 No-lookahead and no-repaint contract

Appending future candles cannot alter any earlier candidate, score, stop or target. Only ledger bodies `<=i` are used when calculating bar `i`; never build one final ledger and apply it backward. A forming candle cannot erase past evidence until it closes. Historical exits are stamped at their confirmation bar, not at the retrospectively best price. An execution result is separate from the immutable candidate. Feed corrections can change a recomputation; preserve dataset/version identifiers and label revisions rather than claiming immunity to revised input.

Closed-bar discipline does **not** mean waiting for a close is safe at 100×. Entry and structural exit logic are bar-closed. Stops, liquidation monitoring and execution necessarily operate on observed prices between closes; OHLC history cannot fully reconstruct them.

## 5. Optional live liquidation-map layer

### Meaning and restrictions

The assignment defines a live snapshot of Papertrade resting bust levels, not historical liquidations and not Hyperliquid's liquidation map. These synthetic positions settle against the LP: **do not describe their liquidation as forced buying/selling into Hyperliquid's order book**. Any relation between these levels and subsequent BBO is an untested positioning hypothesis. The layer is a risk veto, not proof of a cascade or an added expected return.

Keep two records: `coreCandidate` and `liveAssessment`. Evaluate the latter only for the **latest completed bar**, still within its entry-expiry period, using explicit `nowSec`. A map fetched after a historical bar cannot be attached to that bar, and a later refresh cannot rewrite its core marker. Display `LIVE ONLY — NO LIQUIDATION HISTORY`, snapshot time, range, and veto/unknown reason. Do not include this layer in candle-only backtest performance.

### Exact validity and geometry

Use range `1` by default: ±1% encompasses this policy's planned sub-1% levels. Allowed requests are `1|2|5|10|25`; `rangePct` is in percent units, so `1` means `.01`, not `1.0` fractional return.

Require matching symbol and requested range, finite `from<to`, exactly 150 ordered contiguous positive-width buckets spanning `[from,to]`, nonnegative finite USD amounts, and nonnegative integer counts including `below` and `above`. Accept endpoint differences only within `1e-8*max(abs(from),abs(to),1)`; reject overlaps/gaps larger than that. Reject impossible timestamps, a snapshot more than 2 seconds in the future or over 15 seconds old. Apply the same clock checks to summary; normalize its timestamp to Unix seconds once at the client boundary, never guess units inside the signal functions.

Derive snapshot center `Pmap=(from+to)/2` under the assignment's symmetric-range definition. Require `abs(Pmap-E)/E<=.0005` (5 bps). The complete stop-to-target interval must lie in `[from,to]`. If not, widen the requested range or return `RANGE INSUFFICIENT`. `below`/`above` have no internal levels; show their totals, but never place them at a fabricated price or allocate them to near-entry bands.

For any interval `[a,b]` in raw prices, allocate bucket amounts by the overlap fraction:

```text
weight(bucket,[a,b]) = max(0,min(hi,b)-max(lo,a))/(hi-lo)
longMass([a,b]) = sum(weight*longUsd)
shortMass([a,b]) = sum(weight*shortUsd)
```

This is a uniform-within-bucket estimate, explicitly labeled approximate. Counts are displayed; do not generate fractional position identities from weighted counts. At ±1%, a uniform 150-bucket grid is about 1.33 bps per bucket, so a 5-bp proximity measure is already coarse.

### Deterministic live veto

Use the frozen entry plan with positive `E`, raw stop `S`, target `T`, and direction `s`. Define:

- Adverse band: between `E` and `S`.
- Favorable band: between `E` and `T`.
- Near band: between `E` and `E-s*.0005*E`, clipped to the adverse band.
- `Ad`: longMass in the adverse band for a long; shortMass there for a short.
- `Fav`: shortMass in the favorable band for a long; longMass there for a short.
- `Near`: the same directional mass as `Ad` in the near band.
- `Crowding=Ad/(Ad+Fav)` if total is positive; otherwise null.

For a valid, fresh protocol summary, `materialUsd=max(10000,.01*marginUsd)`. Default live entry veto fires if `Ad>=materialUsd` and `Crowding>=.75`, or if `Near>=materialUsd`. These thresholds are unvalidated policy: avoid joining material fragile same-side positioning near the proposed exit path. A large `Fav` does not upgrade a core rejection into an entry. All-zero masses produce `NO MAP EVIDENCE`, not a high-confidence clearance. If masses are nonzero and no veto fires, report `NO MAP VETO`, never “safe.”

A valid summary with `queueUsd>0` or `lpUsd<=0` produces `PAYOUT RISK — NO NEW ENTRY` for this cash-focused policy. Positive `lpUsd` and zero queue are only a coarse screening condition: the assignment does not define whether `lpUsd` is free cash, tracked LP or net equity, and the response cannot certify cash coverage. Explicitly mark `LP ACCOUNTING UNVERIFIED`. No use of `tvlUsd-marginUsd` as an invented LP balance is permitted.

If either route is missing, stale, invalid or mismatched, preserve the historical core candidate and show live eligibility `UNKNOWN`; in the live-enabled view, do not show an actionable entry. Users may explicitly select candle-only research mode, which remains labeled as lacking live filters. Summary fields `openPositions` and `lifetimeVolumeUsd` are context, not directional evidence; volume is cumulative, not a flow rate. A live map never alters an open trade's stop/target. Fresh crowding veto can flag `NO ADDITIONAL ENTRY`; it does not trigger a new intrabar strategy exit.

## 6. Future TypeScript and PAPER DESK integration contract

This assignment specifies the implementation; it does not claim that these methods or modules have been added. Preserve the read-only GET-only architecture, current indicators, CSP, bundled assets and account viewer when implementing the next stage.

Proposed pure module boundary under `src/signal/`:

```ts
// types.ts, validate.ts, intervals.ts, payoff.ts, core.ts, live.ts
// All values passed explicitly; no fetch, Date.now(), DOM or mutation.
computeErl(candles, {symbol, timeframeSec, nowSec, params, payoutProfile})
  -> {bars: ErlBar[], candidates: ErlCandidate[], diagnostics: Diagnostic[]}
assessErlFill(candidate, fillPrice, bustPrice, frozenLedger, payoutProfile)
  -> EntryAssessment
assessErlLive(candidate, liquidationMap, protocolSummary, nowSec, liveParams)
  -> LiveAssessment
```

Output each bar's time, direction, frontier, penetration, `J`, `A`, `r`, target fraction, `W`, `R`, netRR, score, stop/target and reason codes. Rejected candidates should expose their failed gates without drawing entry arrows. A signal does not assert an account trade occurred. Keep `confirmedAt=t+Δ`, `earliestFillAt=confirmedAt`, execution observations and live `asOf` distinct. Inputs are readonly; return new objects, with `null` for unavailable numerical values and explicit status codes rather than zero-filled success.

Proposed additions to `src/api.ts` and the existing mock backend:

```ts
type LiquidationRange = 1 | 2 | 5 | 10 | 25;
type SignalSymbol = 'BTC' | 'ETH';
interface LiqAmounts {
  longUsd: number; shortUsd: number;
  longCount: number; shortCount: number;
}
interface LiquidationBucket extends LiqAmounts { lo: number; hi: number }
interface LiquidationMap {
  symbol: SignalSymbol; rangePct: LiquidationRange;
  from: number; to: number; asOf: Timestamp;
  buckets: LiquidationBucket[]; below: LiqAmounts; above: LiqAmounts;
}
interface ProtocolSummary {
  asOf: Timestamp; tvlUsd: number; marginUsd: number; lpUsd: number;
  queueUsd: number; openPositions: number; lifetimeVolumeUsd: number;
}
// Backend methods; all GET, same origin, with existing abort/error behavior:
liquidationMap(symbol: SignalSymbol, range: LiquidationRange,
               signal?: AbortSignal): Promise<LiquidationMap>;
protocolSummary(signal?: AbortSignal): Promise<ProtocolSummary>;
```

Routes are exactly `/api/markets/:symbol/liquidation-map?range=…` and `/api/protocol/summary`; do not overload the existing account `summary(address)` method. Keep existing candles route and 1000-bar cap. Types alone do not validate JSON: apply runtime checks before calling signal functions. `lpUsd` may be signed pending backend accounting clarification; reject negative TVL, margin, queue, position count or lifetime volume.

Mock implementation should use explicit injected timestamps and deterministic seeded BTC/ETH snapshots, exactly 150 buckets, all supported ranges, and internally consistent prices. Include zero-evidence, concentrated-adverse, favorable-heavy, outside-range, stale, malformed and queued-summary fixtures. Never silently replace failed real data with mocks. Fixtures are synthetic and must not be presented as observed Papertrade liquidity.

Proposed UI: add ERL as an optional analytical overlay, not a trade ticket. Show confirmed candidates, fixed stop/target, a small ledger/corridor explanation and failed gates. Keep old BB markers visually distinct. Live assessment gets a separate latest-bar badge with time, freshness and reason; it is not drawn across history. Disable 100× entry labels on unsupported timeframes. Refresh live routes with the existing visibility-aware polling pattern, cancel symbol/range switches and reject late responses from previous requests. No wallet, signing, private keys, POSTs or third-party runtime data calls are needed.

## 7. Failure modes and unanswered questions

### Expected strategy failures

- **Trend acceleration:** repeatedly rejected intervals can all fail together. A wick is not a standing limit order, and surviving geometry can be stale even before expiry.
- **OHLC path ambiguity:** body acceptance is a chosen proxy. A bar can trade through an interval many times without its body covering it; ERL intentionally does not claim tick-level knowledge.
- **Quiet-market false precision:** minor candle-feed/BBO differences can exceed the reclaim buffer. Small targets are also most affected by payout curvature.
- **News, gaps and relayer delay:** stop fills can occur past bust. Bar-closed invalidation is too slow to guarantee capital preservation.
- **Correlated BTC/ETH entries:** two individually acceptable plans can represent one macro risk event.
- **Parameter and regime drift:** active economics, market retirement or a contract upgrade can invalidate a stored profile.
- **Queue mismatch:** nominal strategy profit can rise while paid cash does not. A low queue today says little about the settlement state several minutes later.
- **Live snapshot instability:** entries, closes and liquidation removal change bucket mass without a BBO move; polling cannot establish causality or reconstruct history.
- **Research overfitting:** many interval thresholds give many opportunities to select attractive backtests. Frozen defaults and independent holdouts are essential.

### Unanswered operational questions

| Question | Consequence / safe research treatment |
| --- | --- |
| What are the actual active per-market parameters, curve mode, builder attribution and fixed-point rounding? | Use labeled documented scenarios; no exact settlement quote or verified-live economics badge |
| What exact formula/rounding produces bust prices, especially shorts? | Use actual position bustPrice; approximate historical bust only, sensitivity around the buffer |
| How is zero initial supply bootstrapped before/at rebate activation? | Do not invent the activation state or claim complete issuance reconstruction |
| Precisely what does backend `lpUsd` mean? Does TVL include debt? | Display raw fields, do not certify free cash or infer the mint bonus |
| What is the backend `asOf` encoding and candle timestamp convention? | Explicit boundary normalization; reject ambiguous timestamps |
| Which perp feed supplies candles, and how large is its BBO tracking error during stress? | No execution-price equivalence; stress basis/latency; obtain sampled BBO before live evaluation |
| Does the backend include all positions in the map and use current bust math? Are buckets inclusive at either end? | Treat as approximate reported exposure; exact endpoint measure does not locate individual positions |
| What operational stop service exists, with what delay or outage behavior? | Read-only alerts only; do not promise protective orders or automatic execution |
| How do queue claims age and how much backing cash is actually withdrawable? | No repayment-time estimate or marked-to-cash queue profits |

These do not block writing a hypothesis and specification. They do block presenting it as verified execution-ready economics or a proven trading edge. No requester-specific key, owner address or contract deployment is needed for this report.

## 8. Verification and falsifiable test plan

### Pure-function Vitest suite for the implementation stage

“Exhaustive” here means every rule, boundary and failure branch below, with property tests over interval operations; it cannot mean every possible floating-point candle sequence. Tests belong with the future modules under `src/signal/`, not only in disposable scratch space.

| Test group | Required assertions |
| --- | --- |
| Validation / closure | Empty and insufficient input; invalid OHLC, NaN/Infinity, zero/negative prices, negative volume, duplicate/out-of-order/off-grid timestamps; exactly closing vs still-forming bar; 24-bar warmup; segment reset on gaps; no fabricated bars |
| Interval algebra | Disjoint, nested, coincident and endpoint-touching intervals; full/partial/multiple cuts; split residues; overlapping later bodies; zero-length bodies/wicks; clipping; max-weight overlap without double counting |
| Ledger causality | Later body erases only overlapped territory; earlier body cannot erase future wick; later wick cannot repay; rank-weight and expiry edges; same OHLC multiset in different order gives a deliberately different ledger |
| Numerical integration | Hand-solvable piecewise densities; coverage bounded `[0,1]`; partition refinement leaves integral unchanged; translation/scaling invariance of geometry; brute-force sampling cross-check within a stated approximation error |
| Both directions | Known valid long and short fixtures; a reciprocal-coordinate mirror with the same positive reference denominator yields symmetric interval/gate behavior; economically different BTC/ETH profiles remain different |
| Event gates | Equality and just-outside every penetration, range, reclaim, progress, risk, support, obstacle, netRR and ERL threshold; strict higher confirmation low; no delayed revival; both sides -> ambiguous |
| Payout | Deadband zero; each holdback boundary and interior; both modes, BTC/ETH, builder on/off; finite at tiny q; monotonic payout; size independence of fraction; no win fee on losses; compare table within 0.0001 percentage point |
| State / execution | Earliest next-bar fill; expiry; 2-bp drift boundary; fill beyond stop; re-evaluation with frozen ledger; bust-distance gate; fixed stop/target; full exits; holding-bar count; structural equality semantics; cooldown boundary; no same-bar reversal |
| No repaint | For every prefix, outputs equal that prefix of the full run; appended extreme future bars do not change prior outputs; altering forming-bar OHLC has no effect; frozen input objects survive calls unchanged; repeat calls bitwise stable for same ordered inputs |
| Live validity | Every range, 149/150/151 buckets, malformed widths/order/gaps/totals/counts, symbols, timestamps at stale/future boundaries, center drift, insufficient range; no historical application; no bucket allocation from below/above totals |
| Live calculation | Partial bucket overlap; empty mass -> unknown evidence; exact crowding/materiality/near gates; long/short mappings; zero/signed LP and active queue; missing/stale summary; no favorable-mass promotion; core output unchanged after refresh |
| Client / UI | Correct relative GET paths, AbortSignal and encoding; deterministic mocks; no fallback on HTTP error; canceled/stale response isolation; no active-bar arrows; live-only label; unsupported timeframe and economics warnings; no write or third-party requests |

A short property-test generator can be implemented with a deterministic local PRNG and Vitest already in the project; no new dependency is necessary. A meaningful hand fixture should verify that subtracting a body `[102,104]` from a lower wick `[100,105]` leaves `[100,102]` and `[104,105]`, not zero evidence. With weight `.75`, coverage over `[100,105]` is `.45`. Adding an overlapping weight `.5` cannot increase already-covered `.75` density. This tests the distinctive construction rather than only reusing its implementation.

### Execution backtest, distinct from signal tests

Use sequential walk-forward blocks per symbol and regime. Freeze initial defaults before opening any holdout. Keep BTC and ETH results separate and report all tested parameter variants. A 1000-bar 1m response is only about 16.7 hours; even 1000 5m bars is about 3.47 days. That is inadequate to validate a robust edge. The assignment exposes neither candle pagination nor liquidation history. Obtain a documented offline archive or accumulate future observations before making broad performance claims; do not fabricate months of data or infer a map history from candles.

Fill entries at next open plus explicit adverse basis/latency scenarios. The candle-only simulator needs a declared **hypothetical stop-execution model**; it cannot prove real stop availability. On each holding bar:

1. Process opening gaps first. If the open is beyond bust, record full-margin loss. If beyond stop but before bust, use the gap-open price, not the stop price. Never improve a target fill across a favorable gap without modeling execution.
2. If high/low touches both stop and target, use stop-first in the conservative result. If a bust is also reachable, disclose a full-bust stress result; OHLC cannot order these events or guarantee stop execution before bust.
3. Closed-bar failure/time exits fill at the following open with the same gap/bust checks. Never fill at a previous close merely because that close caused the decision.
4. When observations end, report open/unresolved positions separately; do not force a favorable closing price.

Report gross move, actual modeled net USD, cash-paid versus queued claims where settlement history exists, PAPER quantity separately, expectancy per trade, win/loss distributions, liquidation fraction, maximum adverse/favorable excursion, turnover, hold duration, drawdown and full-margin tail losses. Include calendar coverage, trade count, uncertainty intervals and consecutive-loss clusters. Do not treat correlated trades as independent samples for confidence calculations.

Stress payout parameters, builder fees, standard/off-hours switching, 1/2/5/10-bp execution drift, 0/1/2-bar relayer delays, missing bars, stop outages and basis spikes. Compare against equal-frequency random-entry controls with identical risk/holding rules, simple failed-breakout and continuation baselines, and ablations removing ledger erasure, recency weighting, overhead burden and payout gates. Ledger ablation should measure incremental information, not just fewer trades. A candidate that works only under optimistic intrabar ordering is rejected.

Prospective live-map testing must timestamp raw snapshots and decisions when actually observed, with dataset provenance. Compare base candidates and veto outcomes on the same opportunities; never pick only the later successful snapshots. Until that archive exists, live-layer performance is **unmeasured**, not backtested. Protocol-summary state must be archived separately to evaluate paid-cash returns.

### Checks actually performed for this report

All fourteen requested primary pages were retrieved and reviewed. The payoff table was recomputed locally from the displayed equations for both assets and both modes. The companion scratch check verifies table rounding, holdback/deadband boundaries, monotonic payoff on a dense grid, illustrative bust arithmetic, break-even calculations, the interval example, document links/required sections, and that every requested source appears. These checks establish internal arithmetic and document coverage only; they are not independent evidence of strategy profitability, exact contract behavior, or deployed functionality. No historical or live trading test, Vitest implementation suite, production build or onchain audit was performed for this report-only deliverable.