This week on Nexus 08.06.26

Every market now carries a risk class with caps scoped to it, funding is charged on notional and prorated to the window, and a write a jurisdiction refuses now says so on screen — while behind the screen, replay is verified and the engine refuses to come up on proven state loss. Here is what shipped.

Merged pull requests by area this window — activity, not performance: 84 merged feature, fix, and performance pull requests across the Exchange, 55 in orders and accounts, 14 in the engine, 6 in API and data, 5 in oracle, and 4 in frontend

Testnet accounts across the daily snapshots — faucet-funded, ephemeral testnet accounts that reset on redeploy, not production figures: 19 testnet accounts on the August 4 snapshot, 24 a week earlier, on the July 28 snapshot, 25 on the July 30 snapshot, the high before a redeploy, and 10 on the July 31 snapshot, immediately after that redeploy reset the testnet

Trading

• Skew a scale ladder. The Scale tab builds a skewed limit ladder across a price range and submits the whole set as one batch of orders.
• A streaming channel, and the hook that reads it. The BFF carries a streaming channel with a matching client hook, so screens can take updates as they are pushed instead of asking again.
• The trade interface, hardened. The trade screen runs on real data, closes a set of accessibility gaps, and supports agent signing.
• Every live market has a page. Every live market is prerendered, so a market like NDQ-USDX-PERP no longer answers with a 404.

Risk and margin

• Every market carries a risk class. Each market has a risk class that can force its margin mode and scope its caps, and the class definitions are signed off with guard ceilings and a re-derived fund fraction.
• Backstop budgets and caps that move with the market. Each liquidation draws against a per-liquidation backstop budget, the floor under that budget is live rather than fixed, and open-interest caps are dynamic instead of pinned.
• Trading calendars, separate from risk. A market’s session class — when it trades — is its own dimension now, rather than something read off the risk class.
• Less copying on the pre-trade check. The isolated pre-trade margin check borrows positions instead of cloning them, so the check every order passes through reads the positions in place.

Funding

• Funding is charged on notional, prorated to the window. Funding is charged against position notional and prorated to the funding window, and the premium is measured against the order book.
• Funding survives a restart. The funding accrual cursor is durable across recovery, so accrual resumes where it stopped, and the engine detects funding conservation violations at the source.

Accuracy on screen

• A missing rate reads as a dash. A rate the venue does not have renders as a dash instead of 0.0%, so an unknown rate no longer reads as zero.
• Gaps reported, repairs confirmed. The indexer reports authoritative sequence gaps instead of passing over them, and confirms a stale order repair rather than assuming it took.
• The same history from every store. The three cold-store backends now agree, so what history you get back does not depend on which store served it.

Accessibility

• The market selector keeps your place. The market selector re-anchors its focus cursor, so keyboard navigation does not lose its position when the list updates.

Access and jurisdiction

• A refused write says why. Where writes are restricted, the interface raises a banner from the block-reason header and the write-access signal is resolved per visitor; reads keep working.
• The restriction is configurable, and scoped. The restricted-jurisdiction list is configuration rather than code, refusals are counted, and the gate applies to production mainnet only.

Deposits and withdrawals

• A deposit the cap rejects raises a page. A deposit refused by a cap now pages an operator, so someone sees it.
• Reconciliation reads the vault at the watcher’s block. The deposit watcher reads the reconciliation vault term at its own cursor, so both sides of the comparison come from the same block.

Price feeds

• A failover cannot jump the price. When the oracle switches to a failover source, the producer clamps the deviation, so the switch itself cannot move the published price further than the clamp allows.
• Every tick is replayable. The oracle records the raw per-vendor inputs and the decision it made on each tick, so a published price can be replayed after the fact.

Safety and reliability

• Replay is verified, and proven loss fails closed. The engine verifies its write-ahead-log replay and refuses to come up when replay proves state was lost.
• Replay chains across epochs. Write-ahead-log replay chains across multiple epochs rather than stopping at the newest one.
• Recovery stays bounded. The write-ahead log is pruned on local disk to bound recovery cost, and the startup probe budget is sized against real replay time, so a service that is still replaying is not killed for being slow to start.
• Recovery metrics that measure what they claim. The three high-availability and recovery metrics were corrected to measure what their names say, and the state-loss counter now covers the gap where a restore from cold storage fails.

Developer tools and SDKs

• One network axis. Mainnet, testnet, and local are a single axis now: the spec formalizes it, the Rust and Python clients adopt it as a breaking change with the migration in their own release notes, and the MCP server moves onto the same axis.
• Funding, risk parameters, and funds in the Rust client. The Rust client adds account funding, per-market risk parameters, the deposits and faucet endpoints, and venue stats with history; its drift checker also derives wire names correctly for enum variants, not only for fields.
• Portfolio parity in TypeScript and the CLI. The TypeScript client exposes account state, fees, and portfolio history, and the CLI surfaces the same data in nexus account and nexus positions.
• Spec drift is caught in CI. The Python client and the CLI verify themselves against the pinned API spec and bump it automatically when a new release lands. The TypeScript client verifies its operations both ways and detects new spec releases, and the MCP server verifies and classifies its coverage against the spec.
• MCP returns data or an error, never a body it cannot read. The MCP server rejects a non-JSON 2xx body instead of handing it back as data, requires an explicit smoke target, and carries the spec’s limit maximum on three tools that had omitted it.
• Eleven MCP tools are live. Two further tools are declared in the registry but not yet built server-side, so check the registry before you plan around one.
• The spec names more of what can go wrong. The API spec declares an invalid-address error and an unconfigured 503 on wallet registration, a restricted-jurisdiction 403 on state-changing operations, registered withdrawal wallets on the bridge endpoint, the slippage cap on an order request, and the liquidations and engine WebSocket channels.

Behind the scenes

The benchmark harness now sweeps the risk benches across N and records a scaling exponent and fit per sweep, alongside a throughput measure and two fixes to how the comparison finds its own results; mutation end-to-end latency and throughput are published, the write-ahead log reports its bytes and per-record-type occupancy, and the recovery-metric tests no longer share a global recorder; cold-data metric names are de-doubled, the conflict denominator is honest, and capture counters are attributed by sink.

Elsewhere: the market maker quotes with inventory in mind, keeps its quotes on a post-only amend reject, recovers from transient inventory failures, arms its dead-man switch only where the venue adapter declares support, and translates protective stop-loss and take-profit intent from execution commands; the simulation exchange takes an injectable clock and the sandbox bot fleet is re-armed for CI.

Work also landed on how changes roll out, on access control, and on network isolation and traffic filtering. Plumbing, mostly — the kind that decides whether the next change is safe to make.