Safety properties are conditional and operational.
The specification treats data freshness, settlement confirmation, signing authority, and reconciliation as part of the mechanism—not implementation details. Mathematical properties rely on these controls being real at the connected venue.Core controls
- Isolated margin: each position has distinct collateral, debt, cash, and token balances.
- Reduce-only boundary: no new borrowing is allowed after the scheduled risk boundary.
- Settled-not-matched accounting: debt is reduced only by cash whose settlement is confirmed.
- Stale-data rejection: new leverage and hard-flat calculations must not rely on a stale or unreconciled book.
- Quantity and cash conservation: token and cash movements must reconcile across order, venue, and ledger state.
- Bounded signing: a signer accepts only typed intents that satisfy position, market, and timing constraints.
- Authoritative payout ingestion: redemption uses the venue’s final payout vector, including its actual void or cancellation treatment.
Timing is a risk parameter
Hard-flat must start early enough for orders to execute and settle before the venue can become non-tradable. A close timestamp alone is not enough: execution and settlement latency, order rejection, balance reconciliation, and concentration can all consume the available buffer. The reference model can derive a leverage constraint from stressed executable recovery. In a simplified proportional model, the bound depends on the ratio between stressed exit proceeds and entry cost, together with debt growth. It is a constraint under its assumptions—not a universal production leverage setting.Preconditions for a live market
A live implementation requires venue-specific validation of market access, execution behavior, settlement semantics, signing controls, reserve funding, incident handling, security review, and jurisdictional suitability. Markets with unpredictable closure timing or weak executable depth may be unsuitable for leverage.The protocol is deliberately conservative: an identified failure blocks the affected market from taking new leverage until the state is investigated and reconciled.