Edge cases and limits

Two tables. The first is the edge cases the model is built to handle. The second is the limits that remain and how each is bounded.

Edge cases

Edge case	How the model handles it
Seller cannot pay	The pool is funded up front and short notional can never exceed capital, so a settled loss only moves money already in the pool. This is the 2008 CDS failure designed out.
Manufactured loss	Settlement reads the realized loss after recovery, not a default flag, across an index of many lines, so there is no cheap technical default to trigger.
Buying in after the loss	Eligibility is taken at the block the loss event occurred, so buying the short token afterward collects nothing.
Cost spikes on an open short	A short pays a fixed premium up front for its 90 day term, so a later spike moves only the quote for a new short, not a term already bought.
A faked loss number	A loss is proposed with a bond, runs through a challenge window and a determination panel, and the losing side forfeits the bond.
A hack, not a default	Only a credit loss settles. A hack of the protocol's own contracts does not.
A slow workout	The trigger is the date the loss event occurred, not the date it finalizes, so a term that covered the event still pays.
A run on the long side	A long can only withdraw capital not backing a live short, so a run cannot pull funding out from under an open position.

Limit	How it is bounded
Collateral depeg	The pool is funded in tokenized US treasuries and fully reserved dollar stablecoins named in the rulebook, and capital backs shorts at a haircut, so it holds more collateral than the notional it covers and a moderate depeg is absorbed before it falls short.
A hidden loss	Settlement reads the realized loss after recovery through the panel, which acts on the workout, not the protocol self reported mark. The honest limit is that a hidden loss settles only once it surfaces.
Two losses in one term	Total payout to a short is capped at its notional across the whole term, so it can never collect more than the dollars it took a position on.
Self dealing	Large positions are disclosed on chain, and settlement pays only realized loss across an index, so a manufactured event is expensive and the panel can reject it.
Index basis	An index short pays the book loss, not one name loss, so a lender hedging a single position carries the gap between that position and the index.
Liquidity mid term	A long backing a live short exits instantly only if a replacement or buyer takes its slot, otherwise it waits for shorts to expire and bears its share of any loss meanwhile. A short exits early only by selling its token. The exit paths are in Liquidity and withdrawals.