@@ -54,10 +54,69 @@ Tested by `test_open_rejects_position_below_initial_margin` (formerly
 `test_single_update_moves_average_by_elapsed_fraction` and
 `test_one_manipulated_read_after_idle_does_not_move_average`. The default test market
 uses a 1,000 basis point initial margin and a 2,000 basis point band;
-`test_profit_capped_at_reserved_notional` triples the price, far outside the
+`test_profit_runs_uncapped_when_backed` triples the price, far outside the
 band, so it now calls `update_price_average` to record the new price, lets a
 full window pass, and calls it again before closing.
 
+Replace reserved liquidity with the haircut risk model from
+[Percolator](https://github.com/aeyakovenko/percolator): trader collateral is
+senior, and trader profit is junior, paid only as far as the pool can back it.
+`Pool.reserved_liquidity` is removed, and with it `open_position`'s
+`reserved + size <= liquidity` check, which failed with `InsufficientLiquidity`,
+and `close_position`'s cap on profit at the position's size. A position opens
+whatever the pool's liquidity, and profit has no cap. `close_position` computes
+the haircut ratio `h = min(1, (liquidity + insurance_fund) /
+max(0, traders' aggregate unrealized profit, closing position's profit))` from
+the per-side accumulators, before the closing position leaves them, and pays a
+winning position `profit * h / HAIRCUT_PRECISION`, rounded down, with the new
+constant at 10^9, so every winner closing at the same moment is paid the same
+fraction; a loss settles in full. A winner who closes while open losers still
+offset them is paid at most the pool's backing rather than refused, and every
+other winner's fraction is unchanged. The profit is paid from `liquidity` first
+and from the insurance fund for the rest; `PoolInsolvent` remains as a
+defensive check.
+`remove_liquidity` caps a withdrawal at `liquidity` rather than `liquidity -
+reserved_liquidity`, still failing with `InsufficientLiquidity`, whose message
+now says the withdrawal is larger than the pool's liquidity. `shared.rs` has
+the new `haircut_ratio` and `apply_haircut`.
+
+Add an insurance fund. `Pool.insurance_fund` is new, and so is
+`PoolParameters.insurance_fee_bps`, which `initialize_pool` requires to be below
+10,000 or fails with `InvalidParameter`. That fraction of every open and close
+fee goes to the fund, rounded down, and the rest to `program_fees`, through the
+new `split_fee` and `credit_fee` in `shared.rs`. `liquidate_position` takes a
+position's deficit, its loss beyond its collateral, from the fund first and
+credits what the fund pays to `liquidity`; the providers bear the rest. The
+liquidation fee is still paid only out of the position's remaining equity: the
+part the equity cannot cover is forgiven, as in Percolator, and neither the
+insurance fund nor `liquidity` pays it. The vault holds `liquidity +
+total_collateral + program_fees + insurance_fund`, plus any tokens sent to it
+directly.
+
+Add a profit warm-up. `PoolParameters.profit_warmup_slots` and
+`Position.entry_slot`, which `open_position` sets to the current slot, are new.
+`close_position` refuses to pay a profit before slot `entry_slot +
+profit_warmup_slots` with the new `ProfitNotMatured` (6022). A losing position
+closes at any time, and liquidation is not delayed.
+
+Tested by `test_open_allowed_without_full_backing`,
+`test_profit_runs_uncapped_when_backed`,
+`test_haircut_scales_profit_when_pool_stressed`,
+`test_insurance_pays_profit_beyond_liquidity`,
+`test_winner_offset_by_open_loser_is_paid_not_refused`,
+`test_remove_liquidity_capped_at_liquidity`,
+`test_profit_blocked_before_maturation`,
+`test_profit_realized_after_maturation`, `test_loss_not_gated_by_maturation`,
+`test_insurance_fund_funded_by_fees`, `test_insurance_absorbs_bankruptcy_deficit`,
+`test_liquidation_of_bankrupt_position_charges_insurance_before_liquidity` and
+`test_initialize_pool_rejects_insurance_fee_at_or_above_full_fee`. They replace
+`test_open_rejects_when_pool_cannot_back_it`,
+`test_profit_capped_at_reserved_notional` and
+`test_remove_liquidity_blocked_by_reserved`. The default test market pays half
+of each fee into the insurance fund and has a 10-slot warm-up, so the tests that
+close at a profit first let the warm-up pass, and `test_open_long_updates_pool`
+checks the fee split.
+
 ## 2026-09-30
 
 Remove `set_funding_rate`. The pool's authority could change the funding rate at
 
@@ -22,7 +22,25 @@ Terms used in this example, in the sense they carry here.
 - **Maintenance margin**: the minimum equity, as a fraction of notional size,
   a position must keep to avoid liquidation.
 - **Liquidation**: closing an under-margined position. Permissionless here: any
-  caller can trigger it and earns the liquidation fee.
+  caller can trigger it and earns the liquidation fee out of the position's
+  remaining equity. The part of the fee the equity cannot cover is forgiven.
+- **Deficit**: what a liquidated position lost beyond its collateral, when its
+  equity is below zero. The insurance fund pays it first, and the liquidity
+  providers bear what the fund cannot.
+- **Insurance fund**: the tokens the pool holds, in `insurance_fund`, from
+  `insurance_fee_bps` of every open and close fee. It pays deficits, pays a
+  winner's profit once `liquidity` is exhausted, and never pays a fee.
+- **Senior / junior**: a trader's collateral is senior, always theirs to
+  reclaim less their losses. Their profit is junior: paid only as far as the
+  pool's liquidity and insurance fund can back it.
+- **Haircut ratio (`h`)**: the fraction of their profit every winner closing at
+  a given moment is paid: one while `liquidity + insurance_fund` covers the
+  profit owed, and that backing divided by the profit owed when it does not.
+  The profit owed is the larger of traders' aggregate profit and the closing
+  position's own, so a winner who closes while open losers still offset them
+  is paid at most the backing, and never refused.
+- **Profit warm-up**: the `profit_warmup_slots` a position must stay open before
+  it can be closed at a profit. A loss is never held back.
 - **Funding**: a periodic payment that anchors the pool's risk. The heavier
   side of open interest pays funding to the pool over time.
 - **Open interest**: the total notional size currently open on a side.
 
@@ -15,6 +15,13 @@ pub const FUNDING_PRECISION: i128 = 1_000_000_000;
 /// from two running sums instead of iterating every open position.
 pub const SIZE_PRECISION: u128 = 1_000_000_000;
 
+/// Fixed-point precision for the haircut ratio `h`, the fraction of their
+/// profit every closing winner is paid. `HAIRCUT_PRECISION` is `h = 1` (profit
+/// paid in full); a smaller value pays that fraction of it. A winner's profit is
+/// multiplied by `h` and divided by this, rounding down, so rounding never pays
+/// a winner more than that fraction.
+pub const HAIRCUT_PRECISION: u128 = 1_000_000_000;
+
 /// Liquidity-provider shares withheld from the first deposit. The first
 /// depositor receives `deposit - MINIMUM_LIQUIDITY` shares rather than the full
 /// amount, the same convention Uniswap V2 uses, and both `add_liquidity` and
 
@@ -38,7 +38,7 @@ pub enum PerpError {
     #[msg("Fill price is worse than the caller's acceptable price")]
     SlippageExceeded,
 
-    #[msg("Pool does not have enough free liquidity to satisfy this request")]
+    #[msg("Withdrawal is larger than the pool's liquidity: part of the shares' value is still in open positions")]
     InsufficientLiquidity,
 
     #[msg("Posted collateral does not cover the open fee")]
@@ -67,4 +67,9 @@ pub enum PerpError {
 
     #[msg("Oracle price is too far from the pool's average price: trading pauses until the average catches up")]
     PriceOutsideBand,
+
+    #[msg(
+        "Profit cannot be taken yet: the position has not been open for the pool's profit warm-up"
+    )]
+    ProfitNotMatured,
 }
@@ -7,7 +7,8 @@ use anchor_spl::{
 use crate::constants::{POOL_SEED, POSITION_SEED, VAULT_SEED};
 use crate::errors::PerpError;
 use crate::instructions::shared::{
-    basis_points_of, refresh_price_and_funding_within_band, settle_position,
+    apply_haircut, basis_points_of, credit_fee, haircut_ratio, position_pnl,
+    refresh_price_and_funding_within_band, settle_position,
 };
 use crate::state::{Pool, Position};
 
@@ -18,15 +19,36 @@ pub fn handle_close_position(
     let pool = &mut context.accounts.pool;
     let price = refresh_price_and_funding_within_band(pool, &context.accounts.oracle_feed)?;
 
+    // The haircut is computed while this position is still in the per-side
+    // accumulators, so its own profit counts toward the liability and it is
+    // paid the same fraction as any other winner closing at this price. Its
+    // own profit is passed too: if open losers offset it in the aggregate,
+    // the haircut is sized against that profit, so the payout is at most the
+    // backing and the close is never refused for lack of it.
     let position = &context.accounts.position;
+    let closing_profit = position_pnl(position.side, position.size, position.entry_price, price)?;
+    let haircut = haircut_ratio(pool, price, closing_profit)?;
+
     let position_size = position.size;
+    let entry_slot = position.entry_slot;
     let settlement = settle_position(pool, position, price)?;
     let close_fee = basis_points_of(position_size, pool.close_fee_bps)?;
 
-    // Recoverable profit is capped at the reserved amount (the position's
-    // notional `size`), so the pool can always cover a winner. Losses are not
-    // capped.
-    let realized_pnl = settlement.profit_and_loss.min(position_size as i128);
+    // A profit is paid only once the position has been open for the pool's
+    // warm-up, and then only the haircut fraction of it. A loss settles in
+    // full, at any time.
+    let realized_pnl = if settlement.profit_and_loss > 0 {
+        let matured_at = entry_slot
+            .checked_add(pool.profit_warmup_slots)
+            .ok_or(PerpError::MathOverflow)?;
+        require!(
+            Clock::get()?.slot >= matured_at,
+            PerpError::ProfitNotMatured
+        );
+        apply_haircut(settlement.profit_and_loss, haircut)?
+    } else {
+        settlement.profit_and_loss
+    };
     let equity = settlement
         .equity
         .checked_sub(settlement.profit_and_loss)
@@ -44,29 +66,35 @@ pub fn handle_close_position(
     let payout: u64 = payout.try_into().map_err(|_| PerpError::MathOverflow)?;
     require!(payout >= minimum_payout, PerpError::SlippageExceeded);
 
-    // Release the position's reserved liquidity now that it is closing.
-    pool.reserved_liquidity = pool
-        .reserved_liquidity
-        .checked_sub(position_size)
-        .ok_or(PerpError::MathOverflow)?;
-
-    // Liquidity providers are the counterparty: they pay the trader's (capped)
-    // profit and receive their loss, and collect the funding the trader owed.
+    // Liquidity providers are the counterparty: they pay the trader's
+    // haircut profit and receive their loss, and collect the funding the
+    // trader owed. The part of a profit the haircut withholds stays in
+    // `liquidity`. A payment larger than `liquidity` takes the rest from the
+    // insurance fund, which the haircut counted as backing. The haircut keeps
+    // the profit within both; `PoolInsolvent` remains as a defensive check.
     let liquidity_delta = settlement
         .funding
         .checked_sub(realized_pnl)
         .ok_or(PerpError::MathOverflow)?;
     let new_liquidity = (pool.liquidity as i128)
         .checked_add(liquidity_delta)
         .ok_or(PerpError::MathOverflow)?;
-    require!(new_liquidity >= 0, PerpError::PoolInsolvent);
-    pool.liquidity = new_liquidity
-        .try_into()
-        .map_err(|_| PerpError::MathOverflow)?;
-    pool.program_fees = pool
-        .program_fees
-        .checked_add(close_fee)
-        .ok_or(PerpError::MathOverflow)?;
+    if new_liquidity < 0 {
+        let shortfall: u64 = new_liquidity
+            .unsigned_abs()
+            .try_into()
+            .map_err(|_| PerpError::MathOverflow)?;
+        pool.insurance_fund = pool
+            .insurance_fund
+            .checked_sub(shortfall)
+            .ok_or(PerpError::PoolInsolvent)?;
+        pool.liquidity = 0;
+    } else {
+        pool.liquidity = new_liquidity
+            .try_into()
+            .map_err(|_| PerpError::MathOverflow)?;
+    }
+    credit_fee(pool, close_fee)?;
 
     // The pool signs the CPI below with its own seeds.
     let pool_seeds: &[&[u8]] = &[
 
@@ -41,6 +41,13 @@ pub struct PoolParameters {
     /// oracle price and that average at which positions may still open or
     /// close and liquidity may still move.
     pub max_price_deviation_bps: u16,
+
+    /// Fraction of each open and close fee, in basis points, paid into the
+    /// insurance fund; the rest goes to program fees. Must be below 10_000.
+    pub insurance_fee_bps: u16,
+
+    /// Slots a position must stay open before it can be closed at a profit.
+    pub profit_warmup_slots: u64,
 }
 
 pub fn handle_initialize_pool(
@@ -99,6 +106,12 @@ pub fn handle_initialize_pool(
         parameters.max_confidence_bps > 0 && parameters.max_confidence_bps < denominator,
         PerpError::InvalidParameter
     );
+    // At 10_000 every fee would go to the insurance fund and none to the
+    // program.
+    require!(
+        parameters.insurance_fee_bps < denominator,
+        PerpError::InvalidParameter
+    );
     // Zero would refuse every price move, however small. At 100% or more the
     // band could never refuse a fall, since the oracle price is always
     // positive.
@@ -124,9 +137,9 @@ pub fn handle_initialize_pool(
     pool.custody_vault = context.accounts.custody_vault.key();
     pool.lp_mint = context.accounts.lp_mint.key();
     pool.liquidity = 0;
-    pool.reserved_liquidity = 0;
     pool.total_collateral = 0;
     pool.program_fees = 0;
+    pool.insurance_fund = 0;
     pool.long_size = 0;
     pool.short_size = 0;
     pool.long_size_scaled = 0;
@@ -144,6 +157,8 @@ pub fn handle_initialize_pool(
     pool.liquidation_fee_bps = parameters.liquidation_fee_bps;
     pool.max_confidence_bps = parameters.max_confidence_bps;
     pool.max_price_deviation_bps = parameters.max_price_deviation_bps;
+    pool.insurance_fee_bps = parameters.insurance_fee_bps;
+    pool.profit_warmup_slots = parameters.profit_warmup_slots;
     pool.bump = context.bumps.pool;
 
     Ok(())
 
@@ -17,14 +17,9 @@ pub fn handle_liquidate_position(
 
     let position = &context.accounts.position;
     let position_size = position.size;
+    let position_collateral = position.collateral;
     let settlement = settle_position(pool, position, price)?;
 
-    // Release the position's reserved liquidity now that it is closing.
-    pool.reserved_liquidity = pool
-        .reserved_liquidity
-        .checked_sub(position_size)
-        .ok_or(PerpError::MathOverflow)?;
-
     // Liquidatable only once equity has fallen to or below the maintenance
     // margin. A healthy position can only be closed by its owner.
     let maintenance = basis_points_of(position_size, pool.maintenance_margin_bps)?;
@@ -33,24 +28,44 @@ pub fn handle_liquidate_position(
         PerpError::PositionHealthy
     );
 
-    // The liquidator's reward comes out of whatever equity remains, capped so a
-    // position already past zero equity cannot pay out more than it has.
+    // The liquidator's reward comes out of whatever equity remains. Whatever
+    // part of the fee the equity cannot cover is forgiven: neither the
+    // insurance fund nor the liquidity providers pay it.
     let remaining_equity: u64 = settlement
         .equity
         .max(0)
         .try_into()
         .map_err(|_| PerpError::MathOverflow)?;
-    let liquidation_fee = basis_points_of(position.size, pool.liquidation_fee_bps)?;
+    let liquidation_fee = basis_points_of(position_size, pool.liquidation_fee_bps)?;
     let liquidator_payout = liquidation_fee.min(remaining_equity);
     let trader_refund = remaining_equity
         .checked_sub(liquidator_payout)
         .ok_or(PerpError::MathOverflow)?;
 
+    // A position whose equity is below zero lost more than its collateral. The
+    // insurance fund pays that deficit as far as it can, and the liquidity
+    // providers bear only the rest.
+    let deficit: u64 = settlement
+        .equity
+        .min(0)
+        .unsigned_abs()
+        .try_into()
+        .map_err(|_| PerpError::MathOverflow)?;
+    let insurance_payment = deficit.min(pool.insurance_fund);
+    pool.insurance_fund = pool
+        .insurance_fund
+        .checked_sub(insurance_payment)
+        .ok_or(PerpError::MathOverflow)?;
+
     // Everything the trader does not get back stays with the liquidity
     // providers. Derived from vault conservation: the pool keeps the position's
-    // collateral minus whatever is paid out as equity.
-    let liquidity_delta = (position.collateral as i128)
+    // collateral minus whatever is paid out as equity, and the insurance
+    // fund's payment toward the deficit moves, inside the vault, from
+    // `insurance_fund` to `liquidity`.
+    let liquidity_delta = (position_collateral as i128)
         .checked_sub(remaining_equity as i128)
+        .ok_or(PerpError::MathOverflow)?
+        .checked_add(insurance_payment as i128)
         .ok_or(PerpError::MathOverflow)?;
     let new_liquidity = (pool.liquidity as i128)
         .checked_add(liquidity_delta)
 
@@ -7,7 +7,7 @@ use anchor_spl::{
 use crate::constants::{BASIS_POINTS_DENOMINATOR, POOL_SEED, POSITION_SEED, VAULT_SEED};
 use crate::errors::PerpError;
 use crate::instructions::shared::{
-    basis_points_of, refresh_price_and_funding_within_band, scale_size,
+    basis_points_of, credit_fee, refresh_price_and_funding_within_band, scale_size,
 };
 use crate::state::{Pool, Position, Side};
 
@@ -57,19 +57,9 @@ pub fn handle_open_position(
         PerpError::InitialMarginNotMet
     );
 
-    // Reserve liquidity to cover this position's maximum recoverable profit
-    // (its notional `size`). The reserve must be backed by liquidity-provider
-    // capital, which also caps total open interest at the pool's liquidity.
-    let new_reserved = pool
-        .reserved_liquidity
-        .checked_add(size)
-        .ok_or(PerpError::MathOverflow)?;
-    require!(
-        new_reserved <= pool.liquidity,
-        PerpError::InsufficientLiquidity
-    );
-    pool.reserved_liquidity = new_reserved;
-
+    // Nothing is set aside to back this position's profit, and the pool's
+    // liquidity does not limit its size: `close_position` pays each winner the
+    // fraction of their profit the pool can back (see `haircut_ratio`).
     let size_scaled = scale_size(size, price)?;
 
     // Effects: record the position and the pool's new aggregates before moving
@@ -83,16 +73,14 @@ pub fn handle_open_position(
     position.entry_price = price;
     position.size_scaled = size_scaled;
     position.entry_funding = pool.cumulative_funding;
+    position.entry_slot = Clock::get()?.slot;
     position.bump = context.bumps.position;
 
     pool.total_collateral = pool
         .total_collateral
         .checked_add(net_collateral)
         .ok_or(PerpError::MathOverflow)?;
-    pool.program_fees = pool
-        .program_fees
-        .checked_add(open_fee)
-        .ok_or(PerpError::MathOverflow)?;
+    credit_fee(pool, open_fee)?;
 
     match side {
         Side::Long => {