Everything that shipped, in the order it shipped

A reviewer's pass: the guest sees one book, the docs say one stage, the numbers agree

A reviewer walked the whole surface and found the seams. The guest sample was three positions with no history behind them; now each leg comes from a fill with its fee and its legs, thirty-six hours of funding have run on them, the log carries the events and the execution report is built from the same three fills. Portfolio and Finance, which are per account, say so instead of failing. The docs carry a single table, where things stand: available now, in the demonstration, next; the limitation about the auction now says what is true (the staged auction is live, a maker programme is next). The deposit surface in the account tab is visible only to accounts in the internal shadow phase, so the public venue is paper everywhere it says it is.

Counts and words. The landing no longer carries a placeholder of four markets while the script loads: it says 76, and the sources thirteen. The replay page's outcome sentence is prerendered from the corpus like the tables above it, so it cannot drift again. Prices below a cent are printed with the digits they need, in the terminal, on the cascade and on the case pages. Claims that no other venue does something were softened to what a reader can check. A block on the landing says what a trading day here gives you, in a trader's words. In the positions table the scenario line sits behind a details toggle: size, entry, leverage, regime and P&L stay in view.

The venue signs its first transactions: sweeps from deposit addresses to the treasury

Transaction builders and signers for the three chain families, without dependencies: Solana legacy transactions with a separate fee payer (the treasury pays, the depositor's key authorises the SPL transfer, the treasury's token account is created idempotently), EVM EIP-1559 transactions with RLP and secp256k1, Tron transactions prepared by TronGrid and signed here. Each is checked against published vectors, a signed Solana transaction is handed to mainnet's simulateTransaction to prove it parses, and an EIP-1559 transaction's sender is recovered from its own raw bytes.

A sweep is planned from live balances and executed only on the operator's --apply, from the console CLI on the host, inside the API process, so no secret leaves it. A dry run goes as far as the network allows without spending: simulation on Solana, gas estimation from the depositor on the EVM chains, the constant call on Tron, and for each leg what the fee payer needs. Gas for an EVM or Tron sweep is topped up from the hot treasury first; Solana needs none on the depositor. Every sent sweep is a deposit_swept record on the account. Two more suites in the deploy gate: signers and sweeps.

Deposit addresses and on-chain watchers, in shadow

An account can now ask for its deposit addresses: one on Solana, one EVM address that serves Ethereum, Arbitrum and Base, one on Tron. They are made on first request, one key per account per chain family, the secret encrypted at rest under a master key that lives on the host and never in the database; the keys and the address forms come from the venue's own code, checked against published vectors and, for Solana's associated token accounts, against the chain itself. A watcher runs every minute over the issued addresses and credits USDC or USDT transfers to the account's real ledger once they are final: Solana at finalized commitment, twelve blocks on Ethereum, forty on the L2s, TronGrid's confirmed set. Every credit is one deposit_onchain record, and a transaction is counted once, however many times the watcher sees it.

This is the shadow period of the real-money plan. The real ledger is recorded and shown on the account tab next to the addresses; it does not trade, paper stays paper. The deploy gate gained a fourth suite covering custody, address vectors, the three parsers and a full sweep against a fake network. Nothing in this release signs a transaction or moves funds out.

Wallets: Bitcoin signs in, and an account can bind several wallets with one payout address per chain

Sign-in with a wallet now covers three signature families, verified without third-party code: Solana (ed25519), EVM (personal_sign) and Bitcoin (BIP-137 message signatures from Unisat, OKX Wallet or an Xverse payment address, for legacy, nested-segwit and native-segwit addresses; a taproot address is refused with its own reason, because verifying BIP-322 needs a script interpreter the venue does not have yet). The account tab has a wallets block: link any detected wallet by signing a message that says what it is for, see every bound address with its chain, move the payout address, unlink. The first wallet bound on a chain becomes that chain's payout address; a wallet bound to another account is refused; the last way to sign in cannot be unlinked. Every change is a chain record.

This is the first step of the internal real-money plan: identity is any wallet, and the withdrawal address for a chain is the wallet that proved itself on it. The deploy gate now runs a wallets suite that makes keys for all three families, binds, moves, refuses and unlinks them against a fresh venue.

The engine comes back from a crash with the chain's version of events

The journal is written per event; the state store every five seconds. Until today a process killed between the two woke up five seconds behind its own record, and the book rebuilt from the store re-queued every resting order at the back of the line, silently dropping any that would cross. Now the store remembers the chain sequence it last flushed, and on boot the engine replays every newer record onto the live accounts: fills with their legs, funding, deposits, take-profits and stop-losses, brackets, orders placed and cancelled, fund movements. The replay is itself a record (recovery_applied, under of_engine), reported on /api/v0/health and paged by the watchdog. Resting orders keep the sequence they rested with, so queue priority survives a restart; an order that could not rest again is cancelled on the chain with the reason instead of lingering unseen. Attached brackets are journaled like set ones, because a replay has to find them.

Funding was already zero-sum to the cent; its clock and its premium window now survive a restart too, so the first hour after a boot is charged on schedule and at the rate the hour earned, and every account's next funding time is the venue's, not its own. The docs table says what the engine does: a premium index plus the interest term, clamped, hourly.

Metrics and alerts. GET /api/v0/metrics is a Prometheus text endpoint: sweep age, loop lag, breaker, connections, memory, chain head against the flushed sequence, recovery, feeds per source, regimes, median confidence, funding rate per market, invariants, funds, accounts, orders, TWAPs. The watchdog now reads the trust report, the invariants and the chain rebuild every two minutes and pages on a broken chain, a cash residual, a funding leak, a rebuilt account that disagrees with the live one, a bad debt paid by a fund, an empty fund and a boot recovery; each has a runbook entry. Its own liveness is published as watchdog_age_s, and the operator's hourly check on another machine pages when that goes quiet. Deploys are gated on a new test that trades, kills the engine with SIGKILL inside a flush window, boots it again and checks positions, cash, brackets, orders, the rebuilt book, the invariants, the chain and the metrics.

Workspaces: the desk as you left it

A workspace is one saved desk: the market, the timeframe, the chart type, the indicators, the open tab, the watchlist, the market-list filters and sort, the leverage. The chart toolbar has a Workspace menu that lists them with their hotkeys (Alt+1 to Alt+9), marks the active one and shows a dot the moment the desk drifts from what was saved; from there you save changes, save the current desk as a new workspace, rename or delete. The command palette lists every workspace as an action. Four come built in: Desk, Majors, Risk watch (line chart on the hour, Divergence markets sorted by the time of their regime change, the log open) and Macro.

Workspaces live in the browser and are mirrored on the account (POST /api/v0/account/workspaces, returned with GET /api/v0/account), so the same desk opens on the next device; the newer copy wins. Up to twelve, sixteen kilobytes in all, never journaled: they are preferences, not book state. On the phone the Action Center carries the workspaces as chips with a "save current" button. The deploy gate saves a desk, changes it, sees the dot, restores it and finds it on the account.

Market discovery: the list answers a question

Eighty-one markets in sector order is a directory, not a desk. The market list now carries a row of chips with live counts, one per regime (Full, Divergence, Degraded, Unavailable), plus the watchlist, the markets you hold, and crypto or macro; one tap filters, a second clears. A sort reorders the list by confidence, 24-hour move, entry leverage, spread, volatility, funding or the time of the last regime change, and the sorted metric replaces the 24-hour figure on each row so the order is visible. The search matches sectors and regimes as well as names, so typing "defi" or "diver" is a filter.

Above the list a short discover block answers four questions from the same stream the list reads: the biggest movers of the day, the markets whose regime changed in the last hour, the tightest spreads among markets you can exit, and the highest entry leverage. Each name is a link into that market. Filters and the sort survive a reload; the phone gets the same chips and block in its market view. The deploy gate now checks that the Divergence chip leaves only Divergence rows, that the confidence sort is monotone, and that the search finds the macro books.

The action center: a phone gets what the desktop had in Cmd-K

On a desktop the terminal is driven from the command palette. A thumb has had nothing like it, so the phone now carries a fourth tab, Actions, with a badge for what happened since the last look. It has four parts. A search over every market and every action the terminal can take, the same index the palette uses. Needs attention, read from the state of the book rather than from the journal: a negative or thin buffer, a margin mode other than normal, a held market that is Degraded or Unavailable, a position without a stop loss, a TWAP still running, orders far from the mark, each with the one button that answers it. Quick actions: trade the current market, what-if, close this position, close every position, cancel every order and schedule, brackets, share the book, push alerts, the full log, the theme. Anything that moves money arms on the first tap and names what the second will do, then disarms itself after five seconds. And the alerts: fills, take profits and stop losses, liquidation steps, regime and mode changes, rejected orders, OCO legs the engine cancelled, finished TWAPs and the day's funding, newest first, unread marked, with a way into the market each one is about.

Opening the page marks its alerts as read; the badge counts only what arrived after that. The desktop palette's theme switch, which had silently done nothing, now switches the theme. The deploy gate drives the action center on a phone-sized page with a signed-in session: it must list the book's needs and its fills, find a market by search, arm close-all on one tap without closing anything, and close on the second.

Professional orders: trailing stops, OCO, TWAP, scaled ladders, and brackets you can drag

Four ways to say what you want that the ticket could not say before. A trailing stop (type: "trail", distance in basis points) follows the mark at a fixed distance and never moves back; the order reports its reference and its current trigger, and the sweep updates them every tick. An OCO is a label two orders share: when one fills as a maker or fires, the engine cancels the other and journals the reason. A TWAP cuts a size into equal slices and sends each at market on its own clock, margin-checked once for the whole schedule at entry; it appears under twaps in the account report with its progress and is cancelled like an order. A scaled ladder is the terminal's batch of equal limits between two prices, clicked in from the chart.

Take profit and stop loss can now be moved by hand on the chart: press the line, drag, release. The chart holds still while a line is in hand, and the new level is sent as a bracket update with the usual wrong-side check. The ticket carries a second row of order types with their own fields on desktop and phone, the orders tab shows trails with their distance, OCO flags, and TWAP progress bars, and the docs describe every type with its limits. The deploy gate now places a trail and an OCO pair from the ticket and a TWAP by API before a build goes out; the API suite in qa/pro_orders.mjs exercises the engine paths, including an OCO leg cancelled by a maker fill.

The story around the terminal: the field, the cascade, the states, and a guest book

The terminal opens to a guest now. Without an account it carries a real margin report on a sample book, margined by the same arithmetic on live prices (GET /api/v0/guest), so a stranger sees positions, a buffer, a forward look and What-if instead of an empty strip. Under the landing headline the field is live: eight price sources on one ridge, and a hand that pulls one away; the readout shows the divergence the venue charges, confidence, the regime, the leverage it still lends and what an exit costs, with a sentence saying why. The arithmetic is riskcore's own, reduced to one book and a hand.

Three parts of a story, and a handoff. The cascade replays a real crash with the scroll as the clock, a fixed twenty times tier on the left and Openfield on the right, and ends on the run's own bill. The terminal in trouble walks the guest book through ten states a venue actually enters, each with a caption, and restores everything on exit. Entering the terminal from the landing grows the live frame to the viewport and continues in place; browsers that know cross-document view transitions carry the frame into the app.

Motion is a change of state made visible: numbers re-count instead of jumping, a regime change passes once as a wave through chart, ticket and positions, a leverage cut lights the multiplier that cut it, a fill travels from the book to the positions, a close is seen releasing margin. Under reduced motion every one of these is an instant change. Four public pages: the manifesto, the live market field, a case study of Black Thursday read from its replay file, and about the machine. Keyboard and readers: focus rings everywhere, a skip link on every page, names for icon-only controls, market rows that open with Enter, live regions for what changes on its own. Numbers and readouts moved to Manrope with tabular figures; the serif stays on editorial headlines.

Passkeys, and the pre-launch in the operator console

A phone that is a monitoring product deserves a sign-in that takes one look. The terminal now offers passkeys first: Face ID, Touch ID or a security key. Registration accepts the authenticator's credential without caring who made it; sign-in verifies the signature over the authenticator data and a fresh challenge with the stored public key. CBOR and COSE are decoded in fifty lines on the standard library, in keeping with the rest of the venue. Creating a passkey claims the browser's paper account and grants the capital, the same as a wallet, an account key or an e-mail.

The pre-launch is now run from the operator console rather than the command line: a switch that requires invites to open an account, invite creation with a use count and a note, the list of codes with the accounts that used them, and the applications from the pre-launch page. The command line keeps the same powers for scripts.

Getting ready for a pre-launch: paper capital on sign-in, rationed top-ups, invites, and a page to apply

Until today anyone who opened the terminal got $100,000 of paper on the spot and could top it up nine times over. That was right for a public alpha and wrong for anything where the numbers are supposed to mean something. Paper capital is now granted once, when an account links an identity, an e-mail, a wallet or an account key; an anonymous account still sees everything and can preview any order, it just cannot hold a position. Top-ups are limited to three in an account's life, a week apart, and only while equity is below half the start. The terms gained a closed-beta section and the version moved, so the terminal will ask once more.

Invite codes exist and can be required for opening an account with one switch; the switch is off today and the venue stays open while the pre-launch is prepared. A pre-launch page says what the pre-launch is, what a participant gets and what is asked, and takes applications. The operator's command line issues invites and reads applications over a loopback route that only a process on the machine can reach.

The venues stream, and the assessment runs every second and a half

Until today every price the engine judged came from a REST poll every three seconds, so a quote could be three seconds old before it entered the estimate, and eight venues meant eight round trips a tick. The seven crypto venues that offer a public stream now keep one WebSocket each to the engine: Binance, OKX, Bybit, Coinbase, Bitget, Kraken and Hyperliquid. The client is written on the standard library, like the server side of the maker API from this morning, because a venue that advertises no dependencies should not add one to hear prices. The assessment runs every 1.5 seconds on quotes a few hundred milliseconds old. A socket that falls silent for five seconds hands its venue back to the REST poll until it recovers, so the worst case is the old latency and never a missing source. Bybit's spot ticker carries no bid or ask, which cost an hour: it streams a level-one book instead. KuCoin needs a token to open its socket and stays on REST. Feed health is on the status endpoint and page.

Divergence was the norm, so we repriced the basis point

The regime history page, an hour after it shipped, showed BTC in Full only 57% of the time: Divergence episodes of seven to eleven minutes, back to back, on two to four basis points of disagreement between eight venues. The hysteresis from the morning had stretched the flicker into episodes without touching its cause. The cause was the tariff on disagreement: a basis point cost 2.5 points of confidence, so ten basis points between two venues, which is a Tuesday, read as Degraded. The divergence scale goes from 40 to 120 basis points. On the same twenty hours BTC now sits in Full about 95% of the time, ETH and SOL about 90%, the regime lines did not move, and the eighteen-percent gap of 10 October 2025 still reads as what it was. The replay was recomputed and its page shows the new numbers, including the cost: a calmer confidence hands out a little more leverage during an event, so the venue's replay liquidation share rises from 41.7% to 46.1% against the conventional 61.7%. A regime below Full now names the source pulling hardest from the mid, because "Divergence, kraken −3.1 bps" is information and "Divergence" alone is a word.

The position card had nine fields of equal weight with the important ones at the bottom in grey, and a liquidation estimate, which the documentation calls a convenient lie under portfolio margin, second from the top. It now leads with what this leg costs you: its share of the buffer, the move to maintenance, the regime, and the Degraded forecast in its own bar; entry, mark, notional, the leverage triple and the liquidation estimate with its caveat sit under a details toggle. The confidence pane's cut lines carry their own labels inside the pane instead of fighting the axis. The Account page loses Points and Performance to a Stats tab and hides the getting-started list once it is done. On the desktop the Portfolio, Instrument, Stats and Account pages take the width the order book used to hold. On a phone the book opens under the chart, not at the end of the page, toasts stop covering cards, and the intro is one card with one button. The log folds hourly funding into one line per day. Traded-volume points drop to one per $5,000 with a cap of 150 a day: a million of paper turnover in a day no longer earns half of everything else combined.

Clicking through the phone ourselves

The second round of phone fixes shipped a screen that was tidy and, used with a thumb, confusing: the market screen spent six hundred pixels on chrome before the chart, the confidence pane still wrote its desktop legend into eight-point type, a double tap zoomed the page, and the detail on a position, its entry, its mark, its liquidation estimate, its brackets, the close buttons, had gone missing when the Positions tab was folded into the Portfolio screen. We clicked through it ourselves and fixed what we found. The market screen now opens with one row, the pair, the mark and the day's change, then the regime line, one row of chart tools and the chart; Book and Trade sit in a bar above the navigation instead of a row of their own. Under the chart the phone shows your position on that market and your resting orders there, with the same full card the Portfolio screen uses: entry, mark, liquidation estimate, notional, opened leverage against the cap and the ceiling, regime and confidence, share of the buffer, the move to maintenance, the Degraded forecast, and the bracket, half-close and close actions. Double tap no longer zooms.

The regime stops flickering, and the phone stops arguing with itself

A second look at the phone found the thing that mattered more than any screen. The log showed BTC going Full → Divergence at 10:36:01 and back at 10:36:05, then again a minute later, on a divergence of 1.3 basis points; the leverage ceiling went 19× → 17× → 19× several times a minute. With the push alerts shipped an hour earlier that would have been spam within the hour, the forward look loses its meaning if a regime does not hold, and an engine that changes its mind every minute reads as unstable rather than attentive. The regime now has hysteresis: the effective confidence falls at once and recovers on a 45-second time constant, a regime is left upward only when confidence clears the cut by a full point (Full resumes above 98, not 97), and never inside 30 seconds of entering it. Leverage follows the effective confidence, so it drops as fast as before and comes back carefully. The details are on the docs page.

The same review found the Portfolio and Positions tabs disagreeing about an entry cap on the same position in the same minute. Most of that was the flicker; the rest was one page reading a fifteen-second-old scenario while the other read the live stream. Both read the live cap now.

On the phone: the confidence pane keeps only the band, the cut lines and one line of text, with the legend on tap, because the legend never fit; nothing scrolls sideways any more, trade history and the instrument page's sources and incidents are lines, not tables; there is one navigation, Market holds only what belongs to the market (chart, book, instrument, log) while positions, open orders and fills live on the Portfolio screen and funding under Account; the market selector that duplicated the title is gone and the title itself opens the list; the ticket sheet keeps a strip with the mark, the regime and the ceiling above the size field; a message from a fill on one market no longer lingers under the ticket of another; the header's Sign in yields to the one on the Account screen; and inputs are 16 pixels so iOS stops zooming into them.

The house gets a page, what-if takes a portfolio, and the small things from the review

"house 100% of depth · unchanged 24h" was a quiet line under the order book. It is the key measure of how grown-up this venue is, so it has a page now: /house/ shows, market by market, the house's presence multiplier and its share of the visible book with a 24-hour sparkline, then its inventory, P&L since seed, fees paid and volume, and the three limits it cannot cross. The page says in plain words that the maker API is the mechanism by which the house retires.

The What-if button used to run five fixed shocks on the current book. It is a simulator now: type any book, cash and positions with the leverage each was opened at, and read the requirement with its offset decomposition, the maintenance, the buffer, the forward look under Divergence and Degraded, where the requirement sits leg by leg, and the stress table. It runs on a public endpoint, POST /api/v0/whatif, and writes nothing, so it works with no account at all.

Smaller items from the same review, all shipped: the market list's sparkline shows confidence over the last eight hours rather than price, on a fixed floor so a flat 99% reads flat; the market-truth and risk-genome panels collapse and remember it; the log has filters by kind and by market; the position row explains its three leverage numbers under them, opened, entry cap, ceiling; and the desktop has keyboard shortcuts, press ? for the list.

The notification no other venue can send

Leverage on Openfield follows the quality of the price, which means it can change while you sleep, with no action of yours. On a desktop you see it because you are looking. On a phone you do not, and that is precisely the moment the venue should reach you. From today a device can subscribe to push alerts from the Account page, or from the Portfolio screen on a phone, and the subscription belongs to the account rather than to an e-mail, so wallet and key sign-ins get it too.

The list of what is sent is short on purpose, because the alternative is being switched off: a regime change on a market you hold, written as what it did to you, leverage before and after and your buffer before and after, with the reduce-only flag when it applies; your account entering warning, reduce-only or liquidation; a liquidation step; a take-profit or stop-loss filling; a deleveraging; and a price source dropping on a market you hold. Each kind repeats at most once in ten minutes per account. Everything else stays in the journal.

Delivery is standard Web Push, VAPID signatures and aes128gcm content encryption, written on the standard library like the rest of this venue rather than pulled in as a package. The payload is encrypted to the device's own key, so the push service in the middle sees a blob. We tested the encryption by decrypting our own output with an independent implementation of the receiving side, and the signature by verifying it with the public key, before any browser was involved.

A phone is for monitoring, so the phone gets a different product

Until today the terminal on a phone was the desktop terminal cut into five tabs. That works as "there is a mobile version" and not as a product: nobody analyses candles on five centimetres, and the reason to pull a phone out is to answer three questions in two minutes, is everything fine, what is going on, do I need to act. The first screen is now the portfolio: the buffer to maintenance as the one big number, margin used, equity, the worst regime among the markets you hold, what changed since you last looked, and a card per position with its regime, its leverage against the cap, its share of the buffer and what Degraded would do to it. Three tabs instead of five: Portfolio, Market, Account. Market search is a bar at the top of the market screen; the order book is a section inside it.

The ticket is a sheet from the bottom. Leverage has presets, 2×, 5×, 10× and the cap, because a thumb cannot land on a slider between three zones. The pre-trade preview sits directly above the button, with its three columns, and the button asks for a second tap: a stray tap is ordinary on a phone. The chart defaults to a price line under the doubt band with a taller confidence pane, which is the one thing that fits on a phone meaningfully. Numbers use tabular digits so they stop jumping on every tick, every target is at least 44 pixels, and positions are cards, not a table to scroll sideways.

One thing we were doing wrong and have stopped: when the stream broke, or the browser put the tab to sleep, the last prices stayed on screen looking current. A venue that sells freshness of data cannot show its own stale data without a mark. Now, after nine seconds without a tick, the numbers grey out, a bar says how old they are and that we are reconnecting, and the ticket refuses to send against them. Coming back to the tab reconnects at once.

Not yet done: push notifications for regime changes on held markets, which is the feature this architecture makes possible and no other venue can send. That is next.

Three entities, three pages: portfolio, instrument, and a journal with addresses

The same review noted that the terminal had three things living at one level, the market, the portfolio and the engine, and only the market had a page. The portfolio was a strip in the header; the engine was four panels around the edges. Two pages fix most of that. The Portfolio page shows where the requirement comes from leg by leg, which leg costs the most to keep, the exposure by risk class with the offset credit and what a regime does to it, what closing any one position would do to the buffer and to the credit, and the forward look for the whole book. The Instrument page collects what was scattered: the genome and what each factor costs today, the reference calendar, the sources with their basis, deviation, spread and age, the fees and limits, and the regime history, which is new: minutes spent in each state over the retained window, every incident outside Full with its lowest confidence and widest divergence, and the engine's own account of why the regime moved.

Numbers now have addresses. A market, a page and a journal record can be linked to from outside: #m=BTC-USD&tab=instrument, #m=BTC-USD&tab=portfolio, #m=BTC-USD&tab=log&seq=123. Every journal record that names a market is written with the venue's view of that market at that instant, mark, confidence, regime and ceiling, so a fill in the log reads against the state it happened in rather than as a bare price. The confidence popover now says how many points went to divergence, to stale quotes and to too few sources, and the leverage popover says what would have to change to get the ceiling back.

Left for the next pass: the incident history per market, a page for the house maker, a what-if simulator that accepts a hypothetical portfolio, and the mobile product, which is a different thing from a smaller terminal.

The band tells the truth, the header has a hierarchy, and the terminal says what happens next

A review of the terminal this afternoon opened with the observation that mattered most: the confidence band on the chart was stretched for visibility. At 99% it covered the candles in a cloud that said "we do not know where the price is" while the number next to it said the opposite, and on the day sources really disagree it had nowhere left to grow. The band is now drawn in the scale of the disagreement itself: each history bucket records the widest source deviation in basis points, and the half-width of the band is that number. On a clean tape it is a hairline. It also sits under the candles now, at a third of its former opacity.

The header used to carry eighteen labels at the same size and colour, so nothing led the eye except the price, which is where every other venue sends it too. Price confidence and adaptive leverage, the two figures this venue is about, are now two and a half times the size of the rest; everything else steps back into a quieter second row. Green no longer means four things at once: buy and interactive elements keep the saturated green, and a healthy state, a positive number or the Full regime use a calmer shade of their own. The portfolio-margin suggestion that used to read as a paragraph is a card: the trade, the standalone cost against the cost inside your book, the saving, and a button. The order book keeps its spread at the vertical centre whatever the depth on either side, the depth bars are visible, and the house now quotes twelve levels a side instead of eight. A ticket with reduce-only set and nothing to reduce disables its button and says why. The confidence pane names its regime lines and carries a legend.

The larger change is the one no other terminal can copy. Margin here depends on the quality of the price, so the venue can tell you what a fall in that quality will do to you before it happens. The documentation had promised for months that Divergence adds an oracle surcharge and that Degraded cuts offsets; the engine had never actually done either, and today it does, with the multipliers written down on the docs page and in configuration: maintenance on a leg ×1.05 in Divergence and ×1.15 in Degraded, the class offset credit halved in Degraded and gone in Unavailable, positions keeping the leverage they were opened at throughout. On top of that sits the forward look: every open position shows what Degraded would do to its entry cap and to the portfolio buffer, the position table ends with a line for the whole book, and the pre-trade preview has three columns, now, Divergence and Degraded. The numbers are small on a hedged book, which is exactly the information.

We caused one bug on the way and it is worth recording: the first cut of the forward look handed the market record, not its genome, to the leverage formula, and every scenario reported a 1× entry cap. The smoke test did not catch it because the number was plausible; a screenshot did.

A door for makers: keys, batches, a WebSocket and cancel-on-disconnect

Until today the only way to rest an order on Openfield was the terminal or a bearer token that was also the account's master credential. That is fine for a person and wrong for a program. A program now gets its own key, scoped to reading, trading and cancelling, with its own order budget and its own ceiling on open orders, shown once and stored as a hash. A key cannot mint another key, take paper capital or close the account; those remain with the person. Revoking a key closes every socket that was using it.

On top of the keys sit the pieces a quoting program actually needs: a batch endpoint that places up to twenty orders in sequence and answers each on its own, a cancel-all that takes a market or a side, client order ids that travel through fills and cancels, and a WebSocket at /api/v0/ws that takes orders and pushes back every journal record the account writes, followed by a margin report. There is no second event stream to reconcile: what the socket sees is what the chain holds. The socket is written on the standard library, because a venue that promises no dependencies should not add one for framing.

Cancel-on-disconnect is opt-in per socket. When a maker's process dies, or misses two heartbeats, or the venue restarts, the ladder it was standing behind comes off within the window it chose, each cancel journaled with its reason. We tested that path by killing the client mid-ladder and by restarting the venue with sockets open; both leave an empty book and a cod_triggered record.

Two things changed around the edges. The engine now has a single event hook that the stream hangs off, so fills, cancels and mode changes are announced from one place instead of being polled. And the truth loop used to accept exactly one tick hook; registering the ticker feed silently replaced the house requoter and the house stopped quoting in the local run. It takes a list now. The house step-back that an external maker triggers has existed since the house was written; from today its value is published per market as house_presence on /status and on each book, so a maker can see its own effect.

Eight sources on the majors, one of them a DEX

Every crypto market now reads Bybit, KuCoin and Bitget in USDT, Kraken in dollars alongside Coinbase, and Hyperliquid, a perpetual-futures DEX whose mids arrive in one call. Five hundred live quotes across seventy markets where there were under two hundred. Pairs a venue does not list are noticed on the first ticks and dropped from the count; a source quoting five times wider than the others no longer defines the disagreement, because a book that wide is not a price; and with four or more sharp sources one venue lagging is not a disagreement either, so the divergence is the second-widest deviation. On the first deploy without that last rule, a single ticker two basis points behind cut bitcoin's ceiling from 19× to 16×, which was the noise deciding, not the evidence.

The honest consequence: with more books to compare, thin markets disagree more often. On the first run the lowest confidence on the venue was 79% on a market where two venues sat nine basis points from the rest, and that market's ceiling fell accordingly. That is the engine doing what it says, on more evidence.

State in SQLite, and a backup that leaves the machine

Until tonight every store was a JSON file rewritten whole every few seconds: the accounts, the users, the identities, the sessions, the subscribers and two megabytes of confidence history. They now live in one SQLite file in write-ahead mode, as rows that are written only when they change; a flush after a change to every account takes nine milliseconds. The migration ran itself on first boot and the reloaded state was compared byte for byte with the old file before anything was trusted.

The journal did not move. An append-only text chain that anyone can read is a better witness than a database, so it stays as it was, and it is what the nightly backup carries together with a consistent copy of the database. There had been no backup at all. There is now one every night, fourteen kept on the box and a copy pulled to a second machine.

Conservation checked in public, a smoke test at the door, and a second pass on the terminal

Two identities now run against the live venue and are printed on the status page: on every market the positions of all accounts and of the funds sum to zero, and what all accounts and funds hold reconciles to what was granted, minus fees and net funding, plus realised profit. The cash identity holds to the cent. Open interest carries a residual on five markets from fills before the order book, frozen and watched; and one account the journal opened was lost by a restart before stores flushed on exit, $850,000 of paper grants the state never held. Both are reported, neither may move.

A deploy now has to pass a headless smoke test on an ephemeral copy of the venue: open the terminal, accept the terms, fill an order, render the account, load the public pages, no page errors. It exists because two deploys tonight shipped a script that parsed and did not run.

The terminal, after a second review: each number has one home, so the header lost its account cells and the margin panel its duplicates; the leverage scale shows its zones, working up to the entry cap, hatched to the ceiling for what is already open; the health score opens into its three terms and their weights; the confidence pane has a fixed scale from 70 with the regime cuts drawn, so a dip from 99 to 98 looks like what it is; the band of doubt around the price is an area, not two lines that read as levels; move-to-maintenance shows the number even when it is large; the empty margin panel computes a real hedge against the largest position and offers to put it in the ticket; and the house share of each book's depth is shown as the number it is, with its last day.

The terminal puts the risk first

A portfolio strip now sits above the chart on every screen: buffer to maintenance in dollars and as an adverse move, margin used, equity with unrealised, free margin, every position with the regime of its market, a health score built from buffer, concentration and data-quality exposure, the countdown to the next funding, and a what-if that stresses the whole book against a move and says plainly that a fall in confidence restricts new risk without re-margining what is open.

The ticket says what a position opens at, against the entry cap and the ceiling, and turns into a reduce-only banner when the market is Degraded or the account is restricted. The pre-trade preview leads with the verdict. Confidence opens into a table of sources with deviation, basis and age, the last hours of confidence, and the reasons the regime last moved, which the venue now writes down at the moment it happens. Crossings of the Degraded line are marked on the chart. Positions show the leverage they were opened at, the cap and the ceiling, the regime, and their share of the maintenance requirement. Trade history has filters. The stream opens before the account does, so the terminal is live in the first second.

What a review found, and what changed because of it

A review of the venue tonight listed real holes and we agreed with most of them. Points paid more for spreading the venue than for using it, and deducted for being liquidated, which is the one event the engine exists to study; the weights now favour a day of trading over any social action and nothing is deducted. The terms claimed one account per person, which a venue without identity checks cannot enforce; they now say what we can do instead. The house maker was price source, counterparty and liquidator with no published way out; the documentation now says how it steps back, and its size shrinks automatically as external depth appears. The portfolio margin is one view of risk, not one netting pool, and the page now says so before anyone has to notice.

Two engine changes. New risk enters at four fifths of the ceiling rather than at it, so a position opened at the maximum is no longer two percent from maintenance; the replay applies the same rule and the pooled Openfield rate moved from 49% to 43%. And the leverage slider in the ticket now means what it says: the leverage chosen is the leverage the position is margined at.

Also: the confidence constants were tested for sensitivity and the result is on the replay page; the public pages are indexable now that there is something worth finding; and "public hash chain" became "hash-chained journal", because a journal on one machine is what it is.

Liquidation as transfer, all four steps, and funding that comes from the book

The documentation described a four-step liquidation and admitted that the fourth was staged closing with a penalty. It is now what it says. Inside the risk family with the most margin, opposing positions are reduced together, so what reaches the market is net risk. The slice is offered to the book inside a band that starts at the penalty and widens every unfilled attempt up to the bankruptcy price. If nobody takes it, the family's ring-fenced fund takes the position at that price and unwinds it itself, and the penalty on every liquidation fill goes into that fund. A shortfall is covered by the family fund, then the general reserve, then by deleveraging the most profitable opposite side, each account told so on its chain. The funds and every movement are on the status page.

Funding stopped being a flat schedule. Every minute the book's mid is compared with the engine's mid; the hourly rate is the hour's average premium plus a small interest term, clamped, and it is printed live on every market. Longs pay when the book is above the engine's price, which is the market's own statement about which side is crowded.

Every account rebuilt from the chain, and a restart that stopped losing data

The second half of the exchange-alpha gate: cash, positions and statistics of every account are now recomputed from the journal alone, from genesis, and compared with the live state. The check is public at /api/v0/journal/rebuild and on the status page. Fills written since the order book carry every leg at its own price, so a multi-leg fill that flips a position replays to the cent.

The bug: every store saved on a timer, and on a restart the process set a flag and exited before the timer fired. The last few seconds of state, sessions and wallets were lost on every deploy. Each store now flushes synchronously on the way out. It was found because the rebuild check disagreed with a state file that was three seconds stale.

A book of our own, and the house that quotes it

Until tonight orders filled against the engine's mid with a synthetic spread, and the depth and tape in the terminal were another venue's. There is now a central limit order book per market, price-time priority, orders matched between accounts, with self-trade prevention, post-only, immediate-or-cancel market orders capped at a protective price, and both legs of every fill on the chain under one order id.

A book with nobody in it fills nothing, so the protocol quotes first. A house account rests eight levels a side on every market around the engine's mid, at a spread and a size that follow the same confidence traders see, and skews to flatten its own inventory. It is an ordinary account that is never liquidated and never on the leaderboard; its equity, inventory and profit and loss are on the status page. Stops, take-profits, stop-losses and liquidation steps now execute through this book.

The terminal shows our own depth with the house share stated, and our own prints.

A third replay policy, and what the maintenance rule buys

The Openfield rule is two decisions in one, leverage that follows the data and a stricter maintenance band, and the earlier replay could not tell which one was doing what. A hybrid policy, the engine's leverage with the baseline's flat maintenance, separates them. Leverage that follows the data is a pure gain: hybrid liquidated 35.7% of entries against the baseline's 63.3%, better in 26 runs, never worse on a single entry.

The maintenance band is a cost to the trader in every run, and now the replay measures what it buys. Under a flat half-percent, 24% of baseline liquidations and 41% of hybrid liquidations were detected with the account already below zero: the price gapped through the band inside a minute, and the venue holds the loss. Under the Openfield rule that count is zero across 41,044 liquidations, with 7.5% of notional still in the account on average when it was closed. The page says both.

Accounts, all the way through: terms on the chain, points, X, and the door out

Nothing opens until the account has read the terms and the risk disclosure once. The acceptance is a record on the account's chain, the API says terms_required until it exists, and if the documents change in a way that matters the version moves and the terminal asks again. The documents themselves are now three: terms, privacy and risk disclosure, each short and each honest about the part that would normally be buried.

Points are computed from the chain by published rules and nothing else, so anyone can recompute a balance from the exported history. They have no monetary value and entitle you to nothing, which the terms say in those words. Referrals are a chain record too. Linking an X account is OAuth with read scopes only and no token kept; it shows the handle on the leaderboard.

The account page grew a getting-started list, a session list with sign-out-everywhere, email alerts when margin gets thin or the account goes reduce-only, an export of everything the chain holds about the account with every hash, and a close button that removes the sign-in identity and wipes the paper book. The landing has a block that says what can hurt before the terminal does, and a place to ask for one email per release or incident, confirmed by a link and removable by one.

Also: on a phone installed to the home screen the bottom bar now clears the home indicator.

Twenty-nine replays instead of three, and the first place the engine loses

The replay now covers sixteen events on bitcoin, ether and Solana from Black Thursday to the cascade of 10 October 2025: 83,536 entry minutes, every one of them a possible trade. Pooled, 63.3% of entries were liquidated on a fixed 20× tier and 49.1% on Openfield; the engine lost fewer entries in 21 runs, about the same in 3 and more in 5.

The five are the useful ones. On clean, fast moves where the venues kept agreeing, the engine's maintenance rule, 0.6 of initial margin plus a reserve, closes positions before a flat 0.5% would. The page now says so, and the next replay policy will separate confidence-driven leverage from maintenance so each can be judged on its own.

Also: the widest disagreement in the data is no longer March 2020. At 21:20 UTC on 10 October 2025 three live venues quoted Solana 1,855 basis points apart.

Email that reaches people, and looks like us when it does

Until this evening no verification email had ever left the box. The droplet cannot open port 25 to the outside, so every code sat in the local mail queue until it expired. Mail now goes through Resend, and the process no longer needs the setgid sendmail binary, which matters because it no longer runs as root.

The messages themselves were plain text. They are now one narrow carbon card in the house style: the field artwork, the wordmark, the code in monospace, and a footer that says plainly what Openfield is. A security notice goes out when two-factor is turned on or off. No message from us carries a link to click for a security action; the footer says to sign in from the address bar.

Also: the API runs as its own user under a locked-down unit, the site has a Content-Security-Policy with hashed inline scripts and no third-party scripts, and the two-factor QR is drawn locally rather than fetched from a third party that was being handed the secret.

The degradation drill now belongs to the account that runs it

Pressing the drill used to lower confidence on that market for everyone: the regime stepped down on every open terminal, the status page reported a degraded market, and every other account on it went reduce-only. The drill is now stored on the account that asked for it. That account is quoted, margined and blocked exactly as if its sources were failing, on its own stream and in its own margin report, and the venue's assessment of the market does not move.

The bug: the security audit earlier today made the drill endpoint require a credential. The button in the terminal never sent one, so for a few hours it returned 401 and did nothing, silently. It now signs its request and says so when the venue refuses it.

Also: the event stream used to accept a bare account id as the key to that account's margin report. It now takes a 60 second ticket issued to an authenticated session, and the id alone gets you the public market feed and nothing else.

A record that cannot be quietly rewritten, an operator console, and the first replay

The account event log used to be trimmed in place every few hundred actions. It is now an append-only journal: every record carries a hash of the one before it, checkpoints pin the chain, and two public endpoints let anyone recompute it from genesis. Every operator action lands in the same chain, so the console cannot be used quietly.

The operator console itself is served by the API at an address that nginx does not know, behind a password, two-factor and an exponential lockout. Eight sections, all live.

Two bugs, both ours. Extracting the risk assessment into one pure function for the replay showed that the learned per-source basis lived only in memory: every restart threw it away, and for the minutes it took to relearn, three venues looked like they agreed perfectly and confidence read 100%. Every deploy had been overstating how much the engine trusted its own price. The basis now persists.

The replay then found the second one on its first run. Open positions were margined at the current leverage ceiling, so a fall in confidence liquidated accounts the price had never touched. Reproduced live with the drill in one minute, fixed the same hour: a position carries the leverage it was opened under.

Also: a security audit of the auth, crypto, engine and infrastructure surfaces found eleven issues and fixed them the same evening, the worst being that the degradation drill needed no credential. The full list is on /security/.

Macro instruments and real exchange calendars

Eleven macro markets: gold, silver, copper, WTI, natural gas, S&P 500, Nasdaq 100, three FX majors and the US 10-year yield. Gold now carries three genuinely independent sources, two crypto-native and one COMEX future, and the basis between them is real information rather than noise.

Reference-market hours moved out of a hard-coded week into a calendar module with the actual CME, NYMEX, spot FX and NYSE sessions, including the daily maintenance break. The terminal draws the next open or close directly on the price axis and counts down to it.

Also: the confidence pane moved onto the candle time grid, history pages backwards as you scroll, the chart got a drag-to-resize splitter, chart types and a log scale.

Seventy-one crypto markets, and a bug that cost us the mobile terminal

Price collection moved to one bulk snapshot per venue per tick, which is what made going from nine markets to seventy-one cost nothing. Confidence learned to subtract the quoting floor, so a token priced at three millionths of a dollar is judged on real disagreement rather than on tick size.

The bug: the toast notification layer was stretched across the whole viewport on phones and swallowed every tap below the header. Timeframes, market switching and the order book were all dead, and it was invisible in screenshots. Found by probing what element actually sat under each tap.

Also: MetaMask sign-in, with keccak256 and secp256k1 recovery written from scratch rather than pulled in as a dependency.

Anonymous accounts

Two doors that ask nothing about you: a wallet signature, where the address is the account, and a 32-byte account key of which only the hash is stored. Email stayed as an optional third door with two-factor. Whichever door you use claims the anonymous session you were already trading in.

The deploy script was deleting its own releases

Releases were rotated by modification time, but rsync stamps a fresh release directory with the source directory's timestamp. The newest release sorted as the oldest and deleted itself moments after going live, so an unknown number of deploys silently never reached the site. Rotation now sorts by name.

This is the entry that best explains why a changelog should include the embarrassing parts.

The risk layer became the product surface

Leverage stopped being a bare number and started printing its own derivation: ceiling, minus data quality, minus volatility, minus a closed reference market. Every risk figure in the terminal became clickable and opens the reasoning behind it, down to each source's deviation in basis points.

Pre-trade preview replaced a placeholder: before an order is sent you see the margin it needs standing alone, what it actually costs inside your portfolio, and the new buffer to maintenance. A hedge visibly costs less. The degradation drill lets anyone inject an oracle failure and watch the engine react.

From nothing to a working venue

Truth layer with multi-source aggregation and learned basis, the risk genome, portfolio margin with class-limited offsets, the liquidation ladder, limit and stop orders, take profit and stop loss on the position, fees, funding, trade and funding history, an equity curve, and the terminal itself.