Before this change, an affiliate could be deregistered, but deregistration only stopped new affiliate relationships. It did not give the affiliate a clear shutdown process for its existing positions. The protocol now supports an explicit shutdown schedule. Once an affiliate announces a shutdown date, new positions through that affiliate stop immediately, solvers get a window to close the existing positions, and the Clearing House can close anything that remains after the selected date.
Why shutdown is staged
Scheduling must stop new exposure without forcing every existing position to close immediately.
- Users should not keep opening fresh positions through an affiliate that is leaving.
- Existing positions should not be forced closed immediately if solvers can close them normally first.
The shutdown flow separates those concerns. Scheduling a shutdown makes the affiliate close-only right away, but it still leaves time for normal close flows and solver-driven emergency closes before the Clearing House steps in.
The schedule gives solvers a deadline. If positions remain open at that deadline, the Clearing House can close them.
Flow
1. Affiliate chooses a shutdown timestamp.
2. Affiliate or AFFILIATE_MANAGER_ROLE schedules that timestamp on-chain.
3. The affiliate becomes close-only immediately.
4. Users and solvers can keep closing existing positions.
5. PartyB can use emergencyClosePosition for quotes of that affiliate.
6. After the shutdown timestamp, Clearing House can close any remaining affiliate positions.
The protocol does not decide the notice period. The affiliate chooses the timestamp, and the contract only requires it to be nonzero.
If the shutdown plan changes, the affiliate or affiliate manager can cancel the shutdown. The timestamp cannot be edited in place; changing the date means cancelling the current schedule and creating a new one.
Scheduled state
The scheduled timestamp is stored per affiliate:
mapping(address => uint256) affiliateShutdownTime;
0 means no shutdown is scheduled. Any nonzero timestamp means the affiliate is in shutdown mode.
Two views expose this state:
function isAffiliateShutdownScheduled(address affiliate) external view returns (bool isScheduled);
function getAffiliateShutdownTime(address affiliate) external view returns (uint256 shutdownTime);
What close-only means
Close-only means no new position can be opened through the affiliate once shutdown is scheduled.
This blocks the full opening pipeline:
- Users cannot send new quotes with the affiliate.
- PartyB cannot lock pending quotes for that affiliate.
- PartyB cannot open locked quotes for that affiliate.
- Batch open rejects quotes for that affiliate.
Closing remains available so users and solvers can wind down existing exposure.
Solver window
During the shutdown window, the existing emergencyClosePosition path can be used for quotes that belong to the
shutting-down affiliate.
This is scoped by quote affiliate. Scheduling one affiliate does not enable emergency close for unrelated affiliate quotes, and it does not activate global emergency mode.
emergencyClosePosition already has the required close semantics. PartyB closes its own quote using signed UPNL
and price data, while the normal solvency and quote-status checks still apply.
Clearing House backstop
If positions remain after the shutdown timestamp, Clearing House can call:
function closeAffiliatePositions(
address affiliate,
uint256[] memory quoteIds,
uint256[] memory prices
) external;
This is the final backstop in the flow. It is only available after the scheduled timestamp and only for quotes that belong to the scheduled affiliate.
The close uses normal close accounting. It is not a liquidation path, so it avoids positions that are already inside PartyA or PartyB liquidation flows.
CLEARING_HOUSE_ROLE supplies the close prices for this backstop. That role is treated as the trusted shutdown
settlement authority for remaining solvent affiliate positions; this path does not perform a separate Muon price verification.
End state
After all positions are closed, operations can treat the affiliate as fully shut down. If the shutdown is cancelled before that, opening through the affiliate becomes available again, assuming the affiliate is still active and the usual protocol checks pass.