This week on Nexus 07.17.26 — This week on Nexus

Isometric money-handling safety motif

This edition is mostly about making the things that touch your money behave exactly as you’d expect — under stress, at the edges, and when a data source misbehaves. A few new surfaces make it clearer whether you’re trading with play funds or real ones.

Merged pull requests by area this window as a stem-and-dot chart: 31 in orders and accounts, 9 in API and data, 8 in the engine, 6 in frontend, and 4 in oracle

Trading

Liquidations now bound their own slippage. When a position is liquidated at bankruptcy, the order goes out as a Limit IOC with a bounded backstop sweep, so a liquidation can’t walk the book further than it should.
Trailing stops must be anchored. Orders that specify a trailing stop without a valid anchor are now rejected up front instead of resting in an undefined state.
Orders fail closed on bad prices. A non-positive or otherwise invalid price is rejected rather than accepted, closing off a class of malformed orders.
Halted markets reject batches cleanly. Batch submissions to a halted market are correctly rejected, and that rejection is preserved end to end.

Margin, funding, and account safety

Withdrawals wait on funding you owe. If a pending funding amount is still owed, withdrawal is blocked until it settles, so balances can’t leave with obligations outstanding.
Shortfalls route through the insurance fund correctly. Organic-close shortfalls now draw on the insurance fund as intended, and a case where the fund could drain on zero-fill bad debt has been closed.
Auto-deleveraging is applied consistently. ADL closures now flow through to the engine’s position store and settle bankrupt residuals correctly, keeping recorded positions in sync with what actually happened.

Price feeds

Source failover with hysteresis. Price feeds now fail over between sources and won’t flap back and forth on a source that’s only intermittently healthy.
Stricter freshness on the freeze gate. The freeze gate now judges freshness by timestamp and transport, so stale data is caught before it can be used.

Account history and market data

Steadier historical data. Behind the account-history and market-data pipeline, we fixed a case that could cause stale replay jumps and added support for named databases, making the backing store easier to operate and more reliable.

Testnet play and mainnet real funds

A clearer line between practice and real money. You can now switch between the testnet play surface and the mainnet real-funds surface in-app, with a Testnet · Play Funds badge so it’s always obvious which one you’re on.
Real-funds disclaimers. The mainnet surface carries an acknowledgement gate, banner, and footer before you trade with real funds.
Region handling scoped correctly. The US block dialog now applies only to the real-funds surface.
Mainnet API docs. Added documentation for bridge-USDX funding and launch-market details.

For developers

Version-aware clients. The Rust, Python, TypeScript, and MCP clients now send an API version header and a normalized User-Agent, and validate enum values against the spec so drift is caught early.
Amend responses decode correctly in the Rust SDK.
The MCP server is easier to reach. The hosted MCP server is now discoverable, and the package is published to npm as @nexus-xyz/exchange-mcp.

Behind the scenes

Hardened how the exchange runs in production: the engine now runs as a non-root process, background services stay alive as expected, and disruption policy keeps the singleton engine available during maintenance.
Expanded observability — funding cap-hit and pool-balance metrics, feed-task liveness, and tracing — so we can see and resolve issues faster.