

==========================================================================================
Q1 — ONE USER. A deposits 100 USDT + 100 EURC, then swaps ALL USD -> EUR.
==========================================================================================
The pure closed system: no operator inventory, no other users.

########################################################################################
#  VERSION A — headroom-bounded (locked>=circ enforced)
########################################################################################

  -- after deposits --
  Ethereum vaults : USD     100 locked   |  EUR     100 locked
  BCH circulating : εUSD    100          |  εEUR    100
  Headroom        : USD       0
                  : EUR       0
  holder A        : 100 εUSD, 100 εEUR
  value: backing 210 USD  vs  claims 210 USD  ✓ conserved

  A wants to swap 100 εUSD -> εEUR (expects 90.91 εEUR).
  RESULT: ✗ BLOCKED — needs 90.91 εEUR headroom, desk has 0 -> ROUTE TO DEX
  WHY: A's own 100 EURC is already backing A's 100 εEUR. There is NO unencumbered EUR to
       issue against. A "self-swap" is NOT self-contained — the target currency needs
       collateral that isn't already an IOU. Version A refuses; A must use the P2P DEX.

########################################################################################
#  VERSION B — over-issue against the reserve
########################################################################################

  -- after deposits --
  Ethereum vaults : USD     100 locked   |  EUR     100 locked
  BCH circulating : εUSD    100          |  εEUR    100
  Headroom        : USD       0
                  : EUR       0
  holder A        : 100 εUSD, 100 εEUR
  value: backing 210 USD  vs  claims 210 USD  ✓ conserved

  A wants to swap 100 εUSD -> εEUR (expects 90.91 εEUR).

  -- after the swap (Version B allowed the over-issue) --
  Ethereum vaults : USD     100 locked   |  EUR     100 locked
  BCH circulating : εUSD      0          |  εEUR 190.91
  Headroom        : USD     100
                  : EUR  -90.91  <-- OVER-ISSUED (fractional)
  holder A        : 0 εUSD, 190.91 εEUR
  value: backing 210 USD  vs  claims 210 USD  ✓ conserved
  ⚠ EUR redeemable now: only 100 of 190.91 εEUR (short 90.91) until rebalance
  A now holds 190.91 εEUR but only 100 EURC is locked. The extra 90.91 εEUR
  is backed by the 100 USDC A freed — sitting in the WRONG vault. Total value is fine;
  EUR backing is short until the desk rebalances on Ethereum.

  -- after rebalance @ unchanged 1.10 (best case) --
  Ethereum vaults : USD       0 locked   |  EUR  190.91 locked
  BCH circulating : εUSD      0          |  εEUR 190.91
  Headroom        : USD       0
                  : EUR       0
  holder A        : 0 εUSD, 190.91 εEUR
  value: backing 210 USD  vs  claims 210 USD  ✓ conserved
  ⚠ USD redeemable now: only 0 of 0 εUSD (short 0) until rebalance
  ✓ cured: EUR backing restored, headroom back to 0/0, A's 190.91 εEUR fully redeemable.


==========================================================================================
Q1b — the risk is the WINDOW: what if EUR/USD moves BEFORE the rebalance?
==========================================================================================

  Desk is short 90.91 EUR, holds 100 USD surplus to buy it with.
   rate 1.1 (flat): 100 USD buys 90.91 EUR -> EUR still short 0 -> desk P&L +0 USD
   rate 1.25 (EUR ROSE (adverse)): 100 USD buys 80 EUR -> EUR still short 10.91 -> desk P&L -13.64 USD
   rate 0.98 (EUR FELL (favorable)): 100 USD buys 102.04 EUR -> EUR still short -11.13 -> desk P&L +10.91 USD

  The single-user self-swap already carries FX risk — not at execution, but across the
  rebalance WINDOW. Instant rebalance @ same rate = zero. Delay + adverse move = a real loss.


==========================================================================================
Q2 — TWO USERS. A holds USD, B holds EUR. A swaps USD -> EUR: whose reserve is used?
==========================================================================================

2a) MATCHED — B swaps the OPPOSITE way in similar size. The magic case.

  -- after deposits (headroom 0/0 — deposits create none) --
  Ethereum vaults : USD     100 locked   |  EUR     100 locked
  BCH circulating : εUSD    100          |  εEUR    100
  Headroom        : USD       0
                  : EUR       0
  holder A        : 100 εUSD, 0 εEUR
  holder B        : 0 εUSD, 100 εEUR
  value: backing 210 USD  vs  claims 210 USD  ✓ conserved

  A swaps 100 εUSD -> εEUR; then B swaps 100 εEUR -> εUSD (opposite direction).
   A: BLOCKED — needs 90.91 εEUR headroom, desk has 0 -> ROUTE TO DEX
   (Version A blocks A FIRST — no EUR headroom yet. In practice the desk MATCHES them:
    it nets A's buy against B's sell so neither needs pre-funded inventory. Modeling the net:)

  -- after the matched pair --
  Ethereum vaults : USD     100 locked   |  EUR     100 locked
  BCH circulating : εUSD    100          |  εEUR    100
  Headroom        : USD       0
                  : EUR       0
  holder A        : 0 εUSD, 90.91 εEUR
  holder B        : 100 εUSD, 9.09 εEUR
  value: backing 210 USD  vs  claims 210 USD  ✓ conserved
  ✓ NO over-issue, NO rebalance, headroom never went negative. The desk was a pure
    MATCHMAKER: A and B swapped WITH EACH OTHER through the reserve; it just earns spread.
    This is the same asset simply changing hands — two-way flow needs zero inventory.


2b) UNMATCHED — A swaps USD -> EUR; B just sits holding EUR. A borrows B's backing.

  Version A first:
   A: BLOCKED — needs 90.91 εEUR headroom, desk has 0 -> ROUTE TO DEX
   Even though B holds 100 εEUR, there is 0 EUR HEADROOM — B's 100 EURC backs B's own
   100 εEUR. The desk cannot lend it without over-issuing. Version A => A routes to DEX.

  Version B (over-issue against B's locked EUR):

  -- after A over-issues --
  Ethereum vaults : USD     100 locked   |  EUR     100 locked
  BCH circulating : εUSD      0          |  εEUR 190.91
  Headroom        : USD     100
                  : EUR  -90.91  <-- OVER-ISSUED (fractional)
  holder A        : 0 εUSD, 90.91 εEUR
  holder B        : 0 εUSD, 100 εEUR
  value: backing 210 USD  vs  claims 210 USD  ✓ conserved
  ⚠ EUR redeemable now: only 100 of 190.91 εEUR (short 90.91) until rebalance
  A holds 90.91 εEUR, B holds 100 εEUR => 190.91 εEUR claims vs 100 EURC locked.
  A LITERALLY BORROWED B's EUR backing. Now the run risk is explicit:
   • If BOTH try to withdraw EUR to Ethereum now: only 100 EURC exists for 190.91 claims.
   • First-mover gets paid; the other is stranded — UNLESS the desk rebalances first
     (spend the 100 USD surplus -> buy ~90.91 EURC on Ethereum -> top up the EUR vault).
   • Pro-rata redemption (ADR-0031 published range) removes the first-mover race:
     everyone redeems 52.38% of face until rebalanced — honest, run-proof, but not a hard 1:1 peg.


==========================================================================================
Q3 — SELF-SWAP + swap the LOCKED COLLATERAL on the source chain, in lockstep.
==========================================================================================
A self-swaps on BCH AND the desk swaps A's 100 USDC -> EURC on an Ethereum DEX at the same
time. Does that cure the backing without needing headroom or other users?

  --- Ethereum DEX slippage on the collateral swap = 0.0% ---

  -- after self-swap + in-lockstep collateral swap (slip 0.0%) --
  Ethereum vaults : USD       0 locked   |  EUR  190.91 locked
  BCH circulating : εUSD      0          |  εEUR 190.91
  Headroom        : USD       0
                  : EUR       0
  holder A        : 0 εUSD, 190.91 εEUR
  value: backing 210 USD  vs  claims 210 USD  ✓ conserved
  ✓ PERFECT: headroom 0/0, no over-issue, no window. The collateral swap IS an eager rebalance.

  --- Ethereum DEX slippage on the collateral swap = 0.3% ---

  -- after self-swap + in-lockstep collateral swap (slip 0.3%) --
  Ethereum vaults : USD       0 locked   |  EUR  190.64 locked
  BCH circulating : εUSD      0          |  εEUR 190.91
  Headroom        : USD       0
                  : EUR   -0.27  <-- OVER-ISSUED (fractional)
  holder A        : 0 εUSD, 190.91 εEUR
  value: backing 209.7 USD  vs  claims 210 USD  ✗ MISMATCH
  ⚠ EUR redeemable now: only 190.64 of 190.91 εEUR (short 0.27) until rebalance
  ✗ SHORT by 0.27 EUR = exactly the Ethereum slippage (90.91 × 0.003). The desk eats it —
    UNLESS it prices A's BCH swap at the ACTUAL Ethereum execution (then A gets Ethereum-DEX
    pricing, i.e. A gained nothing over just trading on Ethereum directly).

  WHAT IT COSTS (the catch): every self-swap now triggers a REAL Ethereum DEX transaction —
   • Ethereum gas on every swap (not just entry/exit) — breaks ADR-0047's "source chains are
     vaults; you don't pay their gas to trade, only to enter/exit."
   • Ethereum slippage on every swap (shown above) — either A eats it (= Ethereum pricing, so
     the BCH hop added only cost + latency) or the desk eats it (unsustainable).
   • NOT atomic across chains (the VM wall): a window remains between the BCH leg and the
     Ethereum confirmation; a failed/again-priced Ethereum leg needs a refund path.
   • Signer DISCRETION: someone must EXECUTE a trade on Ethereum (venue, slippage, timing) —
     a big trust jump over "release a fixed amount," MEV-exposed, not publicly reconcilable.
  => Per-swap collateral-swapping turns the desk into a COSTLIER, more-trusted wrapper around
     the Ethereum DEX. If A must pay Ethereum to swap, A can just swap on Ethereum.

  THE SOUND FORM = BATCH it: keep BCH swaps instant/cheap against headroom+matched flow
  (Version A), then do ONE netted Ethereum rebalance periodically (amortizing gas over many
  swaps). The batch interval is precisely the FX window the sweep sim priced. Per-swap = the
  degenerate batch-size-1 case: maximal gas, maximal trust, zero amortization.


==========================================================================================
SUMMARY — the mechanism, stated plainly
==========================================================================================

 1. A user DEPOSIT never creates headroom (mints an IOU 1:1 with its lock). So the desk has
    NOTHING to lend from user deposits alone — not even for the depositor's own swap.

 2. A swap needs target-currency collateral that ISN'T already an IOU. Only three sources:
      (a) OPERATOR-PREFUNDED headroom   -> Version A, bounded, always solvent.
      (b) an OPPOSITE swap (matched)    -> nets out, zero inventory, zero rebalance  [2a: the ideal].
      (c) ANOTHER USER's locked backing -> over-issue (fractional) -> MUST rebalance  [2b/Q1: the risk].

 3. "Swapping uses other users' balance reserve" (your words) is EXACTLY right — and it is the
    definition of fractional reserve. TOTAL VALUE stays conserved; PER-CURRENCY backing does not,
    until the desk rebalances on Ethereum (USD surplus -> buy EUR -> refill the EUR vault).

 4. The risk is never at execution — it is the REBALANCE WINDOW. Instant + flat rate = free.
    Delayed + adverse EUR move = a real six-figure-scale loss (Q1b), the same tail the sweep sim found.

 5. Design choice, unchanged by this trace:
      Version A  = only (a)+(b). Refuse (c). Route unmatched flow to the DEX. Structurally solvent.
      Version B  = allow (c) up to a cap + bond + cooldown. Buys availability, rents the window risk.
    SPREAD helps only Version B/(c): it accrues to a buffer that funds the rebalance FX loss — a
    cushion, not a cure. Matched flow (b) never needs it.

