This week on Nexus 07.31.26

The order ticket now confirms before it sends, the order book fills the ticket on a click, and /portfolio has a history chart — while behind the screen, a transient error can no longer refund your deposit and restore fails closed. Here is what shipped.

Merged pull requests by area this window: 107 merged feature, fix, and performance pull requests across the Exchange, 61 in orders and accounts, 32 in frontend, 12 in API and data, 1 in the engine, and 1 in oracle

Testnet accounts across this window’s daily snapshots — faucet-funded, ephemeral testnet accounts, not production figures: 25 testnet accounts on the July 30 snapshot and 13 a week earlier, on the July 23 snapshot

A new look

• Archivo for display, Geist Mono for numbers. The app moved to Archivo for display type and Geist Mono for numerals, and the brand fonts now load locally so they survive the app’s base path.
• Steadier layout. Numeric table columns and loading placeholders now reserve their width in character units, and /trade’s panel grid is pinned, so the page does not reflow as data arrives.
• Footer links, and landing copy that matches the product. The global footer carries legal and support links on the bottom right, and the landing hero names only commands that exist.

Trading

• Confirm before it sends. Orders now pass through a confirmation step, with an opt-in skip for traders who would rather not have one.
• Click the book to fill the ticket. Clicking a level in the order book fills that price into the order form.
• Scale ladders in one send. The ticket can compose a ladder of orders across a price range and submit them together as a batch.
• Keyboard shortcuts on /trade. The actions you repeat on /trade now have keyboard shortcuts.
• More ways to read the book. The order book shows cumulative depth with a totals readout, switches between size units, and updates over a live push stream instead of a poll; the depth chart is a one-click toggle.
• Open interest and the funding countdown, above the book. The stat bar on /trade now shows open interest and the time remaining until the next funding payment.
• Movers, ranked honestly. The markets page carries a ranked movers strip; markets with no price are left out of the ranking rather than ranked at zero, and every market lands in a category, including an explicit Other.
• Margin mode where you need it. The order ticket shows the margin mode it will use, and position rows show theirs.

Account and portfolio

• Portfolio history as a chart. /portfolio charts your account over time, served by new account timeseries endpoints.
• Fills you can take with you. The Fills panel exports to CSV.
• Your equity breakdown, on the trading screen. /trade keeps a persistent account-equity breakdown, so you can read your margin and balance without leaving the chart.

Accuracy on screen

• A liquidation price you can believe. The liquidation-price overlay is no longer served as live once it has gone stale, and live positions no longer show a liquidation price of 0.
• A failed refresh no longer empties the table. A transient polling error leaves a populated positions table in place, and the movers strip no longer presents cached rows as live.
• Unknown is not fresh. Portfolio history of unknown age now counts as stale rather than fresh, an asks-only book no longer quotes a fabricated spread, and per-position errors from the indexer are surfaced instead of dropped.

Accessibility

• Sort state and labels that read out. The market selector reports its sort state to assistive technology, and the funds dialog’s inputs have associated labels, with the lint rule enabled to keep them that way.

Deposits and withdrawals

• A transient error never refunds your deposit. The deposit watcher no longer refunds a dead-lettered deposit on-chain after a transient failure, and transient or authorization 4xx responses no longer trigger a refund.
• No vault release on a bookkeeping failure. A failed dead-letter write to storage no longer releases funds from the vault, and the watcher reads the vault’s locked state at the confirmed block.

Price feeds

• Synthetic pricing is refused at load. The oracle rejects a synthetic pricing configuration when it loads that config, not only in CI.

Safety and reliability

• A liquidation counts when it settles. Portfolio liquidation is now gated on actual settlement rather than on the attempt.
• Auto-deleveraging decides with coverage in hand. The deleveraging decision resolves coverage, halt state, and projections up front, records the plan it decided on the settled event, and reports drift between that plan and the state it ran against.
• Halted markets and fired triggers behave. Amends are rejected on a halted market, an order fired from a trigger is exempt from the price band, and resting-order counts read live counters instead of a cached figure.
• Replay rebuilds mark history. The matching engine rebuilds its mark-price history when it replays the write-ahead log, and every event producer now emits through one ordered lane.
• Restore fails closed. A forward schema bump is treated as a cold start rather than a failed restore, the stored checkpoint’s cursor-regression guard is epoch-aware, and the indexer refuses to persist an empty projection after a restore fails.
• One admin gate, fail-closed. The indexer and the oracle share a single fail-closed, constant-time admin gate.
• Less waiting under the exchange-wide lock. The remaining risk write-ahead-log fsyncs and the deleveraging fsync wait now happen outside the exchange-wide account locks, and the cross-partner staleness gate short-circuits.

Developer tools and SDKs

• Order preview and history in the Rust client. The Rust client now covers order preview, order history, closed positions, and equity history, returns a paginator from the cursor-paginated endpoints, and sends the page limit when it fetches fills.
• Portfolio parity in both clients. The Rust and Python clients expose the portfolio-parity endpoints and fields.
• Cursors on lists, candles from the cold store. REST list endpoints return a next-page cursor, and candle ranges are served from the durable cold store.
• Four official clients. The API has four official clients — Rust, Python, TypeScript, and a CLI — and their maturity differs, so check the client list before you pick one.

Behind the scenes

Real-user web-vitals and client error rates now beacon home keyed by release and surface on an internal dashboard; cold-data capture reports its own correctness on /metrics, funding metrics are labeled by market, and two metric-naming and gauge-parsing bugs are fixed; and a frontend parity harness captures deterministic digests and emits a diff and a gap list.

Elsewhere: work landed on jurisdiction controls, on how configuration is read at start-up, and on how changes roll out. Groundwork you should not notice, in service of an exchange that behaves the same on a quiet day and a busy one.