The models we chose — and why.

Weighed: one universal formula vs a per-channel model

Our choice: perp κ = |F − I| × 1095 · credit κ = s/(1 − δ) · loss κ = loss-cost (no divisor)

Each channel recovers the same κ from a causally-independent source. The formula differs because each source's relation to κ differs — funding is an annualized basis, a credit spread is hazard × LGD, a loss-cost is already a realized rate. Forcing one formula on all three would corrupt two.

Weighed: raw each block · asymmetric ratcheted · symmetric slow EMA

Our choice: symmetric slow EMA (~9.6h half-life) for block.kappa, with the raw instantaneous κ exposed via kappaSpot

Raw flickers to 0 every parity interval; an asymmetric ratchet latched to the cap (a real bug we hit live). Symmetric slow keeps κ stable across 8h funding gaps; exposing the raw value separately keeps the honest measurement available to anyone who wants their own smoothing.

Weighed: one global cap · cost-side 1/K_m · value-side S/(OI·dP/dκ)

Our choice: EffectiveMoveCap = min(cost-side, value-side)

A global cap is loose for thin markets and needlessly tight for BTC. Cost-side bounds the per-block move by order-book shallowness (BTC 1× … thin 350×) and is live. Value-side bounds it by repriceable value ≤ bonded stake, using the chain's OWN open interest and bonded stake (dimensionally consistent), with dP/dκ = 1.0 (the conservative 1:1 bound). Now live — a no-op until real exposure approaches the protocol's backing.

Weighed: continuous last-trade mark vs uniform-price FBA

Our choice: uniform-price frequent batch auction + a 30-block mark TWAP + ±75bp clamp

A single self-trade print moves a last-trade mark for ~$1. The FBA forces an adversary to move the cleared price against real book depth — 72×–2,739× costlier (simulation), before the TWAP and clamp even apply.

Weighed: hard switch at a volume threshold vs a continuous blend

Our choice: smoothstep blend on an asymmetric volume-EMA + a dispersion freeze

A hard switch whipsawed across the threshold (165 bp/block, tripping the margin-call line 13× per simulated run). The C¹ blend cannot be whipsawed — worst move 46 bp, zero cliffs — and freezes the perp leg when validators disagree.

Weighed: naive threshold · require cross-modality agreement · CUSUM + regime gate

Our choice: CUSUM on κ's excursion vs its own prior, frozen only when uncorroborated

A naive threshold trips on every real volatile move; requiring cross-modality agreement false-trips in a crisis when all channels move together. We freeze κ only when the move is depth-unexplained AND credit is calm — catching idiosyncratic warps without the crisis false-trip. On a real trip it abstains, never halts.

Weighed: a single feed vs a median across causally-independent modalities

Our choice: median of perp · credit · loss, each from an unrelated source

A fully-captured perp channel becomes the median's discarded outlier — published κ moves by zero. To actually move κ an attacker must breach a derivatives market AND a bond-spread index AND a federal loss register at once: a ~$23M market attack becomes an infeasible multi-institution breach. The channels stayed independent through both 2020 and 2018.

Weighed: an external oracle (Chainlink-style) vs an in-consensus vote-extension median

Our choice: ABCI++ vote-extension stake-weighted median + ≥⅔ quorum

An external oracle is a trusted third party and κ isn't a property of the block. In consensus, κ becomes block.kappa — as native as block.timestamp — and is Byzantine-robust for any adversary stake ≤ ⅓ (a stake-weighted mean would be dragged by one whale). Validators source independently (binance + coinbase + kraken, per-source median).

Weighed: permissionless open EVM vs board-approved contracts only

Our choice: permissioned — only board-reviewed contracts execute

Whether an arbitrary contract reintroduces interest is undecidable to detect statically, so the only sound guarantee of ι = 0 at the app layer is to admit only reviewed contracts. Giving up permissionlessness is the deliberate price of a credibly interest-free substrate.

Weighed: inflationary issuance / staking yield vs zero-issuance fee-only

Our choice: zero inflationary issuance; validators paid from real fees + a wakala 60/20/20 split

Staking yield from issuance behaves like interest — money bred from the passage of time. We pay validators only from real fees, with a wakala split to a tabarru fund and the board treasury. The cost (validator economics track fee volume, not a guaranteed yield) is an accepted Phase-3 question.