THE LEDGER
Your custody, trading, and margin balances live on a single double-entry ledger. Conservation is enforced by construction, not by overnight reconciliation scripts.
The legacy stack kept money in two places and reconciled the difference after the fact. The new platform keeps money in one place and never lets the two disagree.
Legacy · before
Now · rebuilt
Every movement on the ledger is an atomic, double-entry transfer carrying an idempotency key. The books are required to balance — and that requirement is verified, not assumed.
01 · Atomic transfers
A balance change is a conserved pair of entries that either lands completely or not at all. An idempotency key makes a retried request safe to replay.
Mechanism: double-entry transfer + idempotency key.
02 · The zero invariant
Across the whole ledger, the signed balances for each asset must add up to zero. It is a property of the construction — value is never created or destroyed by an internal move.
Mechanism: Σ per asset == 0, by construction.
03 · The conservation gate
The conservation gate checks cache against ledger in lockstep on every batch. A mismatch aborts rather than ships. The published figure is 0 drift — a property, not a benchmark.
Mechanism: conservation gate · 0 drift, gate-enforced.
One canonical account. The diagram below shows the single ledger expressed as Custody, Trading, and Margin — with the zero invariant tying them together so the three can never disagree.
Σ per asset == 0 — the roles cannot drift out of sync, because there is nothing to sync.
Because custody and trading are roles on one ledger, moving funds from your wallet to your trading balance is an internal transfer — not an external withdrawal.
Funding from custody to trading never leaves the ledger. It is a re-labelling of the same conserved balance from one role to another.
The move is the same atomic, idempotent transfer as any other ledger entry — it either completes or it does not, with no in-between state.
Locked in as its own core epic: one master account and any number of trading sub-accounts, so you can isolate risk per strategy without leaving the unified ledger.
A master account and any number of trading sub-accounts. You can trade from the master directly too — sub-accounts are a structure layered on the same ledger, not a second system.
Each sub-account ring-fences its own collateral and exposure, so a position in one strategy cannot reach across into another.
The mechanics behind the unified account — the parts worth reading before you move funds.
It is a single canonical account whose custody, trading, and margin balances all live on one double-entry ledger. Instead of separate wallet and trading ledgers kept in step by a sync job, there is one ledger and three roles — so the balances cannot drift apart.
Yes — through sub-accounts. That work is locked in as its own core epic and is labelled Planned. The design is a master account plus any number of trading sub-accounts, each isolating its own risk while staying on the unified ledger.
For every asset, the signed balances across the whole ledger must sum to zero. A conservation gate verifies cache against ledger in lockstep on every batch; a mismatch aborts instead of shipping. "0 drift" is a property enforced by that gate, not a marketing benchmark.
Moving funds from custody to trading is an internal transfer, not a withdrawal — it never leaves the ledger. It is the same atomic, idempotent transfer as any other ledger entry, so it settles in one conserved step.
The unified account sits between the custody that holds the funds and the transparency layer that lets you verify the books.