> For the complete documentation index, see [llms.txt](https://docs.ensemble.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ensemble.io/safety/emergency-controls.md).

# Emergency controls

What changes when a vault closes positions and recovers funds.

Emergency handling can pause normal operation, close trading positions, and recover funds. Each step has its own checks and may take several transactions. A warning or a close request does not mean withdrawals are ready.

```mermaid
stateDiagram-v2
    [*] --> Normal
    Normal --> Closing: "unsafe condition or authorized cleanup"
    Closing --> Flat: "positions observed closed"
    Flat --> Recovering: "capital recovery enabled"
    Recovering --> Withdrawals: "funds and snapshot ready"
    Withdrawals --> ClaimsPaid: "claims processed; normal operation remains closed"
```

## Detection and eligibility

A warning is a signal to investigate. The contract decides whether an emergency action can run.

Emergency paths are governed by contract state and thresholds. A displayed alert cannot independently create or clear eligibility.

## Position close

Submitting an order to close a position does not mean the position has closed.

Closing exposure and confirming positions are flat are distinct steps. Pending bridge or rebalance work may affect the transition.

## Capital recovery

After exposure is closed, available money still has to be recovered before holders can receive it.

Recovery brings eligible assets back under the emergency accounting path after the contract's preconditions pass.

## Emergency withdrawals

Each holder receives a fixed share of the recovered USDC. Turning on this withdrawal mode permanently ends normal share transfers.

Before enabling emergency withdrawals, the contract requires flat positions, no pending bridge or rebalance, no retained bridge recovery, and recovered attributable Core principal. It snapshots total shares and tracked, physically held USDC after accrued fees. Donations above accounting do not increase this payout.

Canonical share transfers freeze. Each holder calls `emergencyWithdraw()` once to burn their full balance and receive their fixed pro-rata USDC amount, rounded down. Ordinary redemption is a separate path and is unavailable in `Emergency`.

For separately enabled cross-chain deployments, pending share claims use the composer's emergency conversion path and remote lock-pool holders require reconciled recovery records. The recorded production deployment has CCIP disabled. See [Cross-chain routes](/how-it-works/cross-chain-routes.md). Users should verify the current on-chain mode before signing.

## Reading emergency status

Check the current state and observation time before deciding what to do. Closing positions, recovering funds, and enabling claims are separate milestones. A message that closing has begun does not mean withdrawals are available.