The ceiling

The ceiling answers one question: over the declared design space, what is the most the protocol can earn while surviving every stress scenario and keeping every counterparty at the table?

The shape of the result

Protocol profit is a residual. The borrower pays a coupon; the holder takes a pass-through; the insurer, reinsurer, hedge desk and service providers each take their charge; what remains is the protocol's. So the ceiling is

advance × (borrower's alternative cost of capital) + treasury carry − every other player's outside option − real costs

which is the intermediation spread, stated as an inequality.

Calibration

The original model used placeholder seeds that put the facility spread below the treasury yield — under which the model preferred less lending. Corrected against the deck's 9–12% facility band, the ceiling is 357 / 462 / 567 basis points across that band.

The admissible set does not change under recalibration, and there is a theorem explaining why: no stability coordinate reads the facility spread (stability_ignores_facility_spread). Recalibration changes what the protocol earns, never what it survives.

The participation-feasible optimum

Once every player has an outside option, the optimum is an advance of 7500 bps funded against a 2500-bps buffer, a pass-through of 450 bps, and a coupon of 1000 bps — clearing 404 bps before the protocol's own cost base.

It is elegant in a provable sense: every player it controls is paid exactly its outside option, because slack costs the protocol precisely itself and buys nothing in the stability gate.

The frontier

The optimum exists only at a high enough borrower alternative:

At a 400-bps cost base, break-even needs about 11.6%. Inverting the claim: the $50m threshold is right if and only if the operator's alternative cost of capital is about 12% — which pins the one number the deck never discloses.