RISK MODEL
Most exchanges treat the margin model as a footnote. Here it is the product. Cross by default. Worst-first partial liquidation. An insurance fund. ADL as the last resort — with the rank visible.
From margin health degradation to ADL, as an ordered sequence. Each step is reached only if the one before it could not restore health — and every step is visible, with the mechanism behind it.
Liquidation flow
No closure yet. Your dashboard signals risk, withdrawals throttle, and you can act. The system gives you time.
The system reduces the position closest to ruin in slices. The goal is to recover margin health — not to close everything.
If partial liq fills clear at adverse prices, the insurance fund pays the difference. The fund's balance is published, real-time.
Only if the insurance fund is exhausted. Counterparties absorbing the offset are ranked by profit × leverage — visible to all in their account dashboard.
Each stage is reached only if the stage before it could not restore margin health — the sequence is the safeguard, not a single switch.
Cross-margin pools risk by default — but you will be able to ring-fence a strategy in its own sub-account, without leaving the unified ledger.
Structure
A master account plus any number of trading sub-accounts — and you can trade from the master directly too. Sub-accounts are a layer on the same unified ledger, not a second system to reconcile.
Check it: master + N trading sub-accounts, one ledger. Planned.
Isolation
Each sub-account ring-fences its own collateral and exposure, so a position in one strategy cannot reach across into another. Inside a sub-account the cross-margin pool is shared; between them it is walled off.
Check it: collateral and exposure isolated per sub-account.
One ledger
Isolating risk does not fragment the books. Sub-accounts sit on the same double-entry ledger, where the signed balances per asset still sum to zero — isolation is a structure, not a second set of accounts.
Check it: Σ per asset == 0 across every sub-account.
Margin calls, the liquidation order, sub-accounts, and where the insurance fund sits.
There is a warning stage before any closure. When margin health crosses the warning threshold nothing is liquidated yet — the dashboard signals the risk, withdrawals throttle, and you have a window to add margin or reduce. Only if health keeps degrading does the worst-first partial liquidation begin. The system gives you time before it acts.
The worst first — the position closest to ruin is reduced before any other, and in slices rather than all at once. The goal is to recover the account margin health with the smallest necessary reduction, so a single stressed position is trimmed rather than the whole book being closed.
Sub-accounts ring-fence risk per strategy: each holds its own collateral and exposure, so a blow-up in one cannot reach across into another, while positions inside a sub-account still share one cross-margin pool. That structure is locked in as its own core epic and labelled Planned — the unified account ships first, sub-accounts layer onto the same ledger later.
Between partial liquidation and ADL. If liquidation fills clear at adverse prices the insurance fund pays the difference, and its balance is published in real time. Only if the fund is exhausted does auto-deleveraging step in — ranked by profit × leverage, visible to every account. The fund is the backstop that keeps losses from being socialised by default.
The leveraged product it backs, the ledger underneath, and the receipts that keep it honest.