This week on Nexus 08.19.26

Per-market configuration gets one home — a file format, a manifest, a schema gate over the market files, and both the engine and the oracle booting from it. The market surfaces stop advertising what the venue does not list and derive their category tabs from the markets actually served, GET /markets is public as its spec always described, the funds ledger becomes durable and replica-safe, and an accrual pipeline lands behind a feature flag with no pool, token or settlement in it yet. Here is what shipped.

Merged pull requests by area this window — activity, not performance: 61 merged feature, fix, and performance pull requests across the Exchange, 45 in orders and accounts, 8 in frontend, 7 in API and data, and 1 in the engine

Testnet accounts across the daily snapshots — faucet-funded, ephemeral testnet accounts that reset on redeploy, not production figures: 9 testnet accounts on the August 18 snapshot, 33 a week earlier, on the August 11 snapshot, 35 on the August 13 snapshot, and 15 the day after, on the August 14 snapshot

Trading

• A terminal order still answers by id. GET /orders/{order_id} returns an order that has already reached a terminal state, so an order can be looked up after it left the book instead of reading as absent.

Risk and funding

• Funding-event loss is bounded and visible. The indexer bounds the loss a funding event can expose and reports it, so the exposure has a ceiling and a reading rather than neither.

Markets and the interface

• Unlisted FX, commodity and index markets are no longer advertised. Markets in those categories that the Exchange does not list are removed from the surfaces that advertised them, so what is advertised is what is listed.
• The listed index perpetual has its page back. NDQ-USDX-PERP is listed, its market page is restored, and the live market set is derived from what is served rather than held as a separate list.
• The index perpetual is filed as an index. The live NDQ index perpetual is categorised as an index market instead of falling into ‘Other’.
• Category tabs come from the served markets. The screener’s and the market selector’s category tabs are derived from the markets actually served, so a tab cannot name a category the venue is not serving.
• The navigation’s Markets entry points at the screener. The shared navigation resolves Markets to the /markets screener, so the entry lands on the surface that owns the market list.
• One keymap owns the slash key. A single keymap owns / in the trading interface, digit keys stay timeframe switches, and tab switching moves to Shift chords, so no two bindings claim the same key.
• Fills load a thousand at a time, with 14-day volume. The interface requests /fills at limit=1000 and surfaces volume_14d, so a longer stretch of fills is loaded and the 14-day figure is shown with it.
• The unknown fee sentinel is never rendered as a rate. /account/fees can answer unknown, and the interface no longer displays that sentinel as though it were a fee rate.

Market configuration

• Per-market configuration has one home. Per-market configuration gets a defined file format, a manifest and a resolver, so there is one format and one resolution path for a market’s settings.
• Thirty-two market files behind a schema gate. The config home holds thirty-two per-market files with a manifest, and a schema gate checks them, so a market file is validated against the schema before it ships.
• The engine and the oracle boot from that home. Both services read per-market configuration from the config home at startup, so they start from the same market definitions.

Market data and accounts

• The account summary is reachable through the BFF. The BFF relays GET /account/summary, so the summary is available on the same host as the rest of a client’s calls.
• A market id is validated at the boundary. The indexer validates {market_id} where the request arrives, so a malformed id is refused at the HTTP boundary rather than carried into a lookup.

Bridge and deposits

• The funds ledger is durable and replica-safe. The indexer’s funds ledger persists its entries and is safe to write with more than one replica running, so an entry survives a restart and two replicas do not race it.
• NLP deposit accounting is durable. Deposit accounting for NLP is recorded durably, so the accounting survives a restart of the service holding it.

Streams and subscriptions

• A recovery snapshot cannot overwrite newer state. A recovery snapshot no longer overwrites account websocket state that is newer than the snapshot, so recovery cannot roll a live subscription backwards.

Accrual pipeline

• Fills ingest onto Postgres. The pipeline’s fills ingest job writes fills into Postgres, which is what the later stages read from.
• Accrual runs every five minutes. The accrual job runs on a five-minute cycle and computes volume, open-interest and balance components.
• A reconciliation harness checks the accrual. The pipeline ships with a reconciliation harness, so an accrual run can be reconciled rather than taken on trust.
• The read API and interface are behind a feature flag. The accrual read API and its interface land behind a feature flag, and this first phase carries no pool, no token and no settlement, so nothing routes through it yet.

The API contract

• The spec version bump rule is enforced. A change to the OpenAPI spec has to bump info.version by the documented rule, and that is checked automatically rather than remembered in review.
• GET /markets is public. The market list is served without authentication, which is what its spec always described.
• The execution fill is documented apart from the account fill. The spec describes the engine’s execution fill separately from the account fill, so a client can tell the two shapes apart.
• Triggered is documented, and the status enum is guarded. OrderStatus::Triggered is described in the spec and the enum is guarded, so a status the engine can emit cannot go undocumented.
• 98 operations under one published spec. The spec now published from this repository describes 98 HTTP operations.

Developer tools and SDKs

• The Rust base-URL shortcut is deprecated. Config::with_base_url is deprecated in favour of Network::Custom, so pointing the Rust client at a host goes through the network axis the other clients use.
• The TypeScript client splits the deployment base from the signed path. The host a client is pointed at and the path it signs are configured separately, as a breaking change; the migration is in the client’s release notes.
• The CLI’s base-URL override gives way to a declared stage. The base-URL override is deprecated in favour of declaring the stage, matching the network axis the clients took.
• The CLI closes its command-surface gaps. Commands the CLI had been missing against the SDK since its 0.3.0 line are implemented, so the two cover the same surface.
• The Windows CLI artifact is no longer Authenticode-signed. Authenticode signing is dropped from the Windows release artifact, so the release publishes without that step.
• Four official clients, counted against one spec. Rust, Python, TypeScript, and the CLI are the official clients, counted against the same pinned 0.9.1 API spec.

Behind the scenes

Per-market configuration kept moving through the plumbing behind it: a service can now see the config files it boots from. The account layer’s credential store lands on a database behind a dual-write and a backfill, its credential and client-order-data loads are paginated with an incomplete load repaired, and /account/margin is documented as outside the withdrawal path. A trace now continues across authenticated internal callers, /ws-tokens authentication failures are counted in an auth-failure metric, and the mutation-latency artifact records what it measured against and splits its sample into client-to-ack and ack-to-confirm. The sandbox’s determinism work gains the ablation knobs and counters it measures through, closes the oracle’s write surface at the step boundary, makes the submission barrier the default and inverts its ablation, and closes fund conservation on the two terms it omitted.

Work landed on how changes roll out, on access control, and on dependency hygiene. On the website, a set of dead links and stale paths left the route tables, and a restricted-jurisdictions path is no longer claimed as live.

Plumbing, mostly — the kind that decides whether the next change is safe to make.

Alongside all of that, work landed on how access to services and their secrets is controlled.