Session bounds, formulas, periods, residuals. Then the key, the anchors and the replay code.

Anchor day and regime

1. An instant is classified by its Eastern wall-clock date and minute; the offset for that date is taken from the time zone database, never a fixed number.
2. An off-hours instant belongs to the gap that begins on the most recent trading day: after 20:00 ET (17:00 on a half-day) the gap begins that day; before 04:00 ET it began on the previous trading day; a Saturday, Sunday or full closure anchors on the last day the exchange opened.
3. The regime of a gap is read by walking forward from its anchor day to the next trading day: a full closure on the way makes it holiday; otherwise a Saturday or Sunday makes it weekend; otherwise it is overnight-weekday.
4. A trading day is a weekday that is not a full closure. A half-day is a trading day with an early close.

Committed calendar

range

2025-01-01 to 2026-12-31; outside it, classification is unknown and no session is produced

full closures

21 days: 2025-01-01 · 2025-01-09 · 2025-01-20 · 2025-02-17 · 2025-04-18 · 2025-05-26 · 2025-06-19 · 2025-07-04 · 2025-09-01 · 2025-11-27 · 2025-12-25 · 2026-01-01 · 2026-01-19 · 2026-02-16 · 2026-04-03 · 2026-05-25 · 2026-06-19 · 2026-07-03 · 2026-09-07 · 2026-11-26 · 2026-12-25

half-days

5 days: 2025-07-03 · 2025-11-28 · 2025-12-24 · 2026-11-27 · 2026-12-24

source

up to 2025-12-31, derived from the absence of a daily bar on the underlying (first hand; it caught the special closure of 2025-01-09); from 2026-01-01, read on the exchange’s published calendar and cross-read on a market-status endpoint

extension

a new year is a dated amendment with the same first-hand check; future dates are never guessed

refCloseDateOf(session, anchorDay) =
  anchorDay
      if session ∈ { overnight-weekday, weekend, holiday, after }
  previousTradingDay(anchorDay)
      if session ∈ { pre, regular }

For the off-hours regimes and for after-hours, the anchor day’s official close has already settled when the session occurs, so that close is the reference. For pre-market and regular hours, the anchor day’s close has not settled yet at session time; using it would read the future, so the reference is the prior trading day’s close. Off-hours regimes, the ones Bell reports, are keyed to their anchor day.

Two readings of the close

The reference close is read from a consolidated end-of-day source and cross-read on a second source at a fixed scale. The two must agree on the scaled integer; a disagreement abstains the session with cash_cross_mismatch, never an average and never a silent pick. When the cross-read cannot run, the session carries cash_cross_unavailable. A close that is missing or not positive abstains with no_close_ref.

The record has no closing-price field, and the close source is described here, not named. In the latest record a gap is computed for 9 of its 9 session rows.

Fills

A fill is one swap in one observed pool, read from the ledger: base delta b (units of the tokenized equity) and quote delta q (quote units), with the block time. Fills are counted once per transaction signature, so an aggregator route through a pool appears once. A session with no fill abstains with no_fill_in_window.

Price per share and gap

m(t)       = shares per unit at block time t
             (on-chain multiplier)
VWAP_share = Σ |q_i|  /  Σ ( |b_i| · m(t_i) )
g          = ln ( VWAP_share / P_close )
exceeds(θ) = | VWAP_share − P_close | / P_close > θ

θ takes each threshold named by the served gap rows: 1 percent, 2 percent, 5 percent. P_close is the reference close of the day given under reference close day. When the multiplier is one over the whole pool window, the unrebased path is used. When the multiplier history is known and differs from one, the per-fill form above is used and the session carries multiplier_unit. When the multiplier could not be established as constant or known, the session abstains with rebase_unverified.

Volume ratio

vol_ratio  = S / A
S          = Σ |b_i| · m(t_i) over the session's own pool
             fills, from its first fill to its last
m(t)       = shares per unit in effect at the fill
A          = Σ v / n_bars over the unadjusted daily
             consolidated share volumes v of the
             underlying dated in adv_period
adv_period = the calendar month before the session date;
             n_bars = n_trading_days, else no_adv
unit       = a fraction of one average trading day
             of adv_period

The block above restates, clause by clause and in the words of this page, the formula string carried in each volume entry of the served state; the restatement is pinned to that string by a test. The numerator is the session’s own fills, the denominator the month before the session date. The record has no consolidated-volume field; a denominator that cannot be established produces no ratio and a named residual (no_adv, no_multiplier), never a fabricated ratio. The ratio values are not rendered on this site.

Shares per regime

share(regime, θ) =
    #{ sessions in regime, g computed, exceeds(θ) }
  / #{ sessions in regime, g computed }

Sessions that abstained are in neither count; their number will be published beside the share.

Gap sessions

Each gap is keyed to the reference close day and to its regime. The first-measurement window for TSLAx is window_TSLAxupcoming; a pool whose bounds were reduced declares them.

Ratio numerator

Per session: the session’s own pool fills, counted once per transaction, from its first fill to its last (the session window, served with each entry). The run’s observation window, in ledger time (UTC, state.window.from_utc_ms to state.window.to_utc_ms): TSLAx 2026-09-16 08:00:00 → 2026-09-17 07:59:59 · AAPLx 2026-09-16 08:00:00 → 2026-09-17 07:59:59 · SPYx 2026-09-16 13:30:00 → 2026-09-16 19:59:59. The numerator is set against a daily denominator; the unit is stated in the served formula.

Ratio denominator

The calendar month before the session date, served as adv_period { year, month }: 2026-08: 21 daily bars for 21 trading days. The daily bars (n_bars) must cover exactly the month’s trading days (n_trading_days), or the session’s ratio abstains with no_adv; the formula string is carried in each entry.

Sessions and reads

Volume ratio

Halts, reserves, wrappers

What a published file contains

state.json      { published_at, runs, schema, seq }   runs: one state per run
provenance.json { published_at, runs, schema, seq }   runs: one provenance per run
timeline line   { key_id, kind, prev_line_hash, provenance_sha256, published_at, runs, schema, seq, sig, state_sha256 }
line run        { bell_sha, records, window }   records: [record]
gap             { symbol, session, regime, vwap, volumeBase, n, cash_cross, gT, exceed1, exceed2, exceed5, multiplierUsed, rebase_residuals: [ ], earliest_publish_utc, abstain }
residuals       { resume_time_missing, resume_date_gt_halt_date, no_fill_in_window, reason_unknown, block_ts_vs_submission, no_close_ref, por_unavailable, por_stale, no_wrapper, multiplier_unit, no_quorum, quorum_sampled, rebase_unverified, authority_scan_mono_operator, set_authority_unscanned, cash_cross_mismatch, cash_cross_unavailable, no_adv, no_multiplier }
window          { from_utc_ms, to_utc_ms }
adv_period      { year, month }
volume          { symbol, session, regime, session_date_et, window: window, adv_period: adv_period, n, n_bars, n_trading_days, formula, abstain: [ ], vol_ratio, multiplier_unit }
supply          { symbol, supply, decimals, multiplier, paused, permanent_delegate }
por             { symbol, kind, method, note, age_sec, statement }
wrapper         { symbol, contracts: [ ], residue }
halt_deltas     { symbol, chain, reason_family, halt_utc_ms, resume_utc_ms, first_fill_after_halt_utc_ms, last_fill_before_resume_utc_ms, n_fills_in_window }
halt_census     { total, empty_resume }
digest          { schema, gaps: [gap], halt_census: halt_census, residuals: residuals, volume: [volume], supply: [supply], por: [por], wrapper: [wrapper] }
state           { schema, bell_sha, window: window, residuals: residuals, digest: digest, halt_deltas: [halt_deltas] }
record          { symbol, chain, n_fills, sessions, quorum_coverage, prev_line_hash }
provenance      { bellSha, generatedAt, sources: sources, providers: providers }
sources         { generated_at, cash_request_digest, cash_cross_mismatch_days: [ ], cash_cross_unavailable_days: [ ] }
providers       { providers: [ ], quorum_required, providers_distinct, faults: [fault] }
fault           { provider, status }

The first four lines are the key lists of the files and of the signed line as served; the others are the publisher’s closed list of objects (a key outside its object, or an object outside the list, is refused before publication). A scalar key is written bare, [ ] is a list of scalars and a name is another object of the list. Schemas served: timeline bell-timeline-v1, state file bell-public-state-v1, run bell-state-v1, digest bell-digest-v1, provenance file bell-public-provenance-v1, key set bell-keyring-v1. Close values, reference prices and consolidated volumes (a numeric value under any key naming a close, a reference price, an average daily volume or a share volume) are refused by the digest guard; the on-chain VWAP and base volume are carried.

Chaining

1. Canonical bytes. The digest object is serialised with sorted keys and no whitespace; bell_sha is its hash.
2. Journal. Each line of the collection journal carries the hash of the previous line’s canonical bytes; a removed or edited line breaks the chain at recomputation.
3. Timeline. timeline.jsonl is append-only; each line carries the previous line’s hash and a signature over its canonical bytes. The first line’s previous-line hash is the genesis value 0000000000000000000000000000000000000000000000000000000000000000; the latest line is of kind publication, signed p6WSevOLNoXGSv3Ge3IIWVFTFDcUFhAp0yoM9aI5X3BPAcjb7aSv6CE7kMr5EevB2HYiVnJjicF9Q2wotqffBA.
4. Provenance. A separate file carries, per run, the start of the collection, the operators behind the reads and the quorum, the faults logged and the digest of the closing-price request. It travels beside the digest and is not hashed into it; the signed line names its SHA-256.
5. Manifests. At each start, end and resumption of the counter-verification run of the multiplier history, a manifest lists the run’s artifacts with their hashes, sorted, one per line; the manifest is what gets anchored (see anchors). The latest published record’s timestamp status is stated under anchors, below; it is read from the proof file when one is served.

What a valid signature tells you

That the line was produced by the holder of this key, and that it has not been altered since. It says nothing about whether the line’s content is true: truth is checked by recomputing the line from the ledger and from the reader’s own close data (see replay code). Independence from the venues and issuers measured: relation_commercialeupcoming; not independence from MONARK.

How to check a line

node apps/bell/scripts/bell-verify.mjs --url https://bell.monarkgate.tech --keyring apps/bell/keys/bell-keyring.json

Run from the MONARK source tree, the reader-side verifier re-derives the chain and every signature of the served timeline, the key schedule, and the binding of the state file to the head line. Its trust root is the committed keyring apps/bell/keys/bell-keyring.json; the key served above is only a cross-checked channel. Its success status reads consistent_with_supplied_keyring; without a keyring it reports self_consistent_only, never an unqualified success. The verifier, the publisher, its chain library and the public keyring are in the public repository; the collector (replay code below) is not exported yet.

Detectable by whom

A rewrite of the timeline is detectable by whoever keeps an earlier copy: the operator’s mirror, whose SHA-256 is recorded in the operator journal after each publication, and any third-party copy of timeline.jsonl or of the immutable state files. Keep a copy, and a later change to a published line shows at recomputation.

What is anchored, and when

At each boundary of the counter-verification run of the multiplier history of TSLAx, AAPLx, NVDAx, SPYx (the end of the probe, the start, each resumption and the end of each instrument’s enumeration, and the final state), the boundary’s manifest is submitted to OpenTimestamps. The proof is pending first, then upgraded to a Bitcoin attestation.

manifests and proofs

/bell/anchors

lines in the register

17 (16 with a proof, 1 without)

proofs with a Bitcoin record

16 of 16, read from the proof files when this page was built

the latest published record

anchored: the proof file records Bitcoin block 968402, the earliest of 3; the record's line and every line before it existed before that block; read from the file when this page was built, not checked against a node here

Check one anchor yourself

1. Download the line’s manifest and its proof from /bell/anchors.
2. Recompute the SHA-256 of the manifest; it must equal the line’s manifest digest.
3. Run an open OpenTimestamps client on the proof, against a Bitcoin node of your choice; it names the block before which the manifest existed.
4. Where a ledger is published (to be published), recompute the digests of the artifacts the manifest lists, and re-pull one page from the chain to compare.
5. Bound: an anchor shows the log head existed before that block. It does not show where the pages came from, nor that the scan ran. The commit is a second, weaker witness.

Anchors of published records

For each timestamped line of the timeline, a manifest lists the line’s hash, the hash of the timeline up to that line and, for a publication, the digests of the two files the line names. The manifest’s SHA-256 is submitted to OpenTimestamps. The proof is pending first; once a calendar has included it in a Bitcoin block, the proof file records that block.

Check one yourself. Download the manifest and its proof. Hash line n of the timeline without its line feed: it must equal the manifest’s line digest. Hash the first n lines with their line feeds: it must equal the manifest’s prefix digest. Hash the manifest: it must equal the digest the proof carries. Run an open OpenTimestamps client on the proof against a Bitcoin node of your choice: it names the block before which the manifest existed. No MONARK account, key or software is needed for that check; the files are public, any copy serves. The signature check is a separate step.

Bound. An anchor shows that the line, and every line before it, existed before that block. It does not show that the facts are true, when the record was published, when its data was collected, or that no other line was ever timestamped. A pending proof depends on a calendar until it records a block.

In a manifest, the line key hashes that one line without its line feed: its digest is the line’s hash. The prefix key hashes every line from the first to that one, each with its line feed. The served manifest of line 2 carries timeline.jsonl#L2 and timeline.jsonl#L1-L2.

What you bring

closes

consolidated end-of-day closes for the reference days, read under your own licence

daily volumes

consolidated daily share volumes for the denominator period, same

fills

the run’s ledger of fills to be published, or your own enumeration of the pools from the chain

multipliers

the run’s multiplier history to be published, or your own scan of the mint’s update events

With the same inputs, every gap and ratio is designed to recompute bit for bit. With different inputs, the difference names the input.

An omitted transaction

Bell cannot detect a transaction omitted inside an otherwise complete page returned by the operator. For the multiplier history, a second scan method reduces this risk without removing it.

A signature is origin

A valid signature shows who produced a line and that it is intact. It does not make the line true. An anchor shows a manifest existed before a block, nothing more.

Sample

Designed for four symbols of one family of tokenized equities on one chain, outside the TSV framework, over the stated windows; the latest published record covers TSLAx, AAPLx, SPYx. Results do not extend to other instruments, chains or venues.

Not a certification

Bell is neither a TSV nor a Covered Firm; it assesses compliance with no condition of any order. Its records describe on-chain activity in the observed pools.