Fixing the settlement price

When the settlement window closes (third Friday, 15:30–16:00 ET), anyone calls settle. The protocol walks the oracle's rounds inside the window and computes a 30-minute time-weighted average price — that average is S.

A day qualifies only if the oracle and the cross-check pool agree within a 3% band and the price sits inside the gross band [P0/4, 4·P0]. Failing days slip to the next trading day; after 30 undecided days the terminate fallback engages.

The snapshot

Settlement writes every parameter once, immutably:

n0  = total Income (= Upside) issued
bal = stock tokens actually in the vault
p   = bal / n0                       ← collateral ratio, normally 1.0

eU  = p × (S − K) / S    per Upside unit (0 when S ≤ K)
eI  = p − eU             per Income unit
pair = p                 per merged 1+1 pair

No admin path can alter these numbers after the snapshot.

Claims are pull-based

After settlement, holders claim at their own pace — never expiring, partially, permissionlessly, and impossible for anyone to claim on your behalf:

| You hold | Call | You receive | | --- | --- | --- | | n Income | claimIncome(n) | n × eI stock tokens | | n Upside | claimUpside(n) | n × eU stock tokens (zero when S ≤ K) | | n pairs | merge(n) | n × pair stock tokens |

Merging stays open after settlement — at the settled pair rate.

Shortfall accounting

If the token issuer destroys vault collateral, everyone shares the loss proportionally — nobody can front-run anybody else:

• At snapshot time, p < 1 scales every entitlement automatically.
• If the vault is damaged after the snapshot, each claim scales by remaining balance / remaining obligation, and the shortfall is recorded in a public ledger.
• Issuer transfer freezes block splits and opens — never merges, claims or settlement.

Worst case (vault emptied): all positions redeem to zero, and the deficit ledger records the full loss distribution on-chain.

Termination fallback

If the oracle dies for good, the protocol does not seize up: after the 30-day deadline and a 5-day queue, anyone triggers terminate, which snapshots at the settlement window's anchored price — falling back to S = P0 if no anchored price exists. From that point on, every claim and merge rule is identical to a normal settlement.