Real cascades, run through the live engine

A venue can claim its risk engine would have behaved differently. The only way to settle that is to take real minutes from real venues, feed them to the same code that runs the alpha, and publish the data, the code and the result together so anyone can disagree with the arithmetic rather than the story.

What is being compared

Both sides get the same trader with the same intent: deposit $10,000, take the position at the maximum leverage the venue allows at that moment, then do nothing. The test is run from every single minute of every window, not from a chosen entry.

What caution costs when nothing happens, and the rule it broke

Four of these runs are an ordinary fortnight in July 2026: no cascade, no headline, the conditions that make up most of a trading year. They exist because a venue that tightens when its sources disagree has to be judged on what that costs when the disagreement leads nowhere. The first time they were run the answer was bad enough to change the engine.

Maintenance used to be six tenths of the initial requirement and nothing else. Initial margin rises as the engine cuts the ceiling, so maintenance rose with it, and the trader was charged for the venue's own caution: a position at eleven times was closed after a 3.2% move while a flat twentieth tier survived to 4.5%. In a quiet fortnight that cost far more entries than the flat tier lost; the calm section below carries the figures. The engine was cutting leverage and shortening the runway at the same time, which is the opposite of the intent.

Maintenance is the smaller of six tenths of the requirement and a band sized against the market, plus the close-out reserve. The band rests at 0.75% of the position and widens with four times the largest move the book has made over any one minute in the last hour, capped at two per cent. The room a venue needs to close safely belongs to the market, not to the leverage the trader happened to be allowed. Across these runs it takes liquidations from 57.7% on that tier to 44.1% here, with 1.0% of our liquidations finding the account below zero against 10.5% on the tier.

The trade-off did not disappear, it moved. The venue now carries bad debt where it carried none: 2.6 million dollars across these runs, against 54.9 million on the flat tier. Traders keep 721.2 million more of their capital than they would on that tier, and the engine is better in 64 of the 134 runs, the same in 49 and worse in 21. Every one of those numbers is in the files below.

What this test leaves out, and what was done about it

The sharpest minute in the data

The result that matters first

A liquidation that finds the account already below zero is a loss the venue absorbs rather than a liquidation. Every number in this sentence is generated from the index beside it, because an earlier version of this page carried one corpus in its blocks and an older one in its prose: across these 134 runs the flat tier finds the account below zero in 51,073 of its 487,136 liquidations and eats $54,866,766, hybrid in 54,334 of 318,985 and eats $37,467,373, and this engine in 3,787 of 372,263 and eats $2,580,401.

Results

Every run, side by side

One row per run, sorted from the widest win to the widest loss. The grey dot is a conventional venue at a fixed twentieth tier, the green dot is Openfield, and the scale is the share of entry minutes that ended liquidated. The further left a dot sits, the fewer traders it lost. Where the green dot lands to the right of the grey one it turns red, and the number on the right says by how many points we were worse.

What the numbers say, including where they say nothing

The pooled figures are in the block above. Three policies, because the Openfield rule is two decisions in one, and they deserve separate verdicts.

The leverage ceiling helps, and not for the reason this page used to give. Hybrid takes the engine's leverage and keeps the baseline's own flat maintenance band, and it liquidated fewer entries than the baseline in almost every run: on bitcoin through 12 March 2020 the baseline liquidated 82% of entry minutes and hybrid 37%. Same maintenance rule, same data, one difference. But the ceiling was not cut by venues disagreeing. Across the corpus the leverage removed is split 86% of it by confidence and 14% by volatility, and the confidence half is itself three terms: 4% of that from prices disagreeing, 75% from stale candles and 21% from the archive publishing fewer books than the venue reads. On the cascades most often quoted here, 12 March 2020, 19 May 2021 and the solana cascade of 10 October 2025, volatility does 83% of the cutting. Three venues can agree honestly all the way down a 52% fall, and on that day they did: mean confidence was 98.78 and the book held Full for most of the window. The divergence axis is built for a different event, an oracle that comes apart, which is what 10 October looks like on solana at 1,855 bps. Both are worth catching. They are not the same claim and this page had been making the wrong one.

The stricter maintenance costs the trader and buys the venue something specific. Openfield trails hybrid where it does because of the maintenance band and the close-out reserve, not because of the six tenths rule, which caps a requirement so large that it almost never binds. A band of 0.75% to 2% of the position plus 0.4% closes a position earlier than a flat 0.5% does. What it buys is on the first line of this page: 1.0% of these liquidations found the account already below zero, against 10.5% on the baseline and 17.0% on hybrid, and the bad debt that follows is $2,580,401 against the baseline's $54,866,766. The trader pays in earlier exits; the venue pays a small fraction of what the flat tier pays.

Inherited leverage is the open question, and it is not free. A position keeps the leverage it was opened under, so a later fall in confidence cannot liquidate it. That is what fixed the bug below. The cost is the other side of the same rule. The inheritance is held for six hours of the ceiling staying below it and then decays on a twelve hour half-life, and the honest reading of that is that on crypto a ceiling rarely stays down for six unbroken hours, so in ordinary conditions the inheritance is held rather than decayed. Time below the ceiling now accumulates and unwinds at the same rate, rather than resetting on the first recovery, and the honest consequence is harsher than the old wording: a ceiling that sits below the opened leverage half the time or more never clears the clock at all, however long that lasts.

When the data is good, this engine does not protect you from a price move, and it does not claim to. It reacts to disagreement between sources, staleness and sources dropping out, and it keeps a maintenance band wide enough that a liquidation lands while there is still something to close.

How much the constants matter

Confidence is computed from three numbers that are heuristics: divergence is charged at exp(-bps / 120), freshness at exp(-(age - 3 s) / 6 s). The tick-size note called the quoting floor a heuristic in so many words; the same honesty is owed here, so every incident was rerun with each constant moved a quarter in both directions.

The divergence scale is the one that matters: a quarter either way changes the regime on roughly one minute in seven and the leverage ceiling on one in three, by about two points of confidence on average. The freshness constants cannot be tested on this data at all: one-minute candles make a source either current or a whole minute stale, and both settings answer the same. On the live venue freshness acts at 2.5 second resolution, and that sensitivity is unmeasured.

The bug this found

The first version of this replay margined open positions at the current leverage ceiling, which is what the engine did at the time. It produced an odd result: on two of the three incidents Openfield liquidated more accounts than the fixed-leverage baseline.

That was not an artefact. On the live venue, an account was opened with a $800,000 position against $100,000 of equity and a 42% buffer, and the oracle degradation drill was run against that market. The price barely moved, equity went from $98,004 to $96,410, and the account was liquidated anyway: the leverage ceiling fell from 10× to 1×, the initial-margin requirement jumped from $88,889 to $337,922, and the buffer went to minus $107,695.

The replay was built to test a claim about competitors and the first thing it found was a hole in our own engine. That is the argument for building it.

Reproduce it

Every candle file is published below with its sha256. The fetcher pulls the same public endpoints; the runner is deterministic, so the same inputs give byte-identical output and the result hashes on this page should match yours.

git clone <repo> && cd openfield
node replay/fetch.mjs          # pulls 1m candles from Binance, OKX and Coinbase
node replay/run.mjs            # writes replay/out/*.json
sha256sum replay/out/*.json    # compare with the hashes on this page

What this does not prove

• Candle closes are not an order book. Neither policy models slippage, fees or funding, and a real liquidation at these moments would have been filled worse than the mark on both sides.
• Historical candles carry no bid or ask, so the replay assumes a constant 1 bps spread for the quoting-floor correction. On a five-figure instrument that is a hundredth of a basis point either way.
• The baseline is a reasonable description of a conventional 20× tier, not any specific named venue's exact parameters on the day.
• The trader does nothing after entry. A real trader would react, and the reduce-only restriction that fires hours earlier here is worth more to somebody who is awake than this test can show.
• Crypto and a small macro book, read from the venues that publish minute history far enough back, which is fewer than the live engine reads. Portfolios with offsets across instruments are not replayed.
• Fewer liquidations can mean less trading. A venue that admits nobody liquidates nobody, so the rate above is only meaningful beside the leverage that produced it: this engine allowed 10.7× on average against the tier's fixed 20×, which is 53% of the notional. In 5 runs it allowed 1.5× or less, and a book at that ceiling can barely lose: those runs are corpus, not evidence. The per-run table carries the entry leverage beside every rate for exactly this reason.
• It is not a uniform tax on the trader either. Below about 14.7× the engine leaves more room to a falling price than the flat tier does, and above it less. 67 of these runs sit below that line, so on much of the corpus the wider band is what saves the account rather than what closes it.
• Most of the ceiling here is cut by the archive, not by the market. Of the leverage removed by the confidence term, 4% comes from prices disagreeing, 75% from stale candles and 21% from the archive carrying fewer books than the venue reads. Stale candles and a shorter source list are properties of the data this replay could obtain, not of the days it replays, and the live venue reads more books more often.
• The replay reads volatility higher than the venue does, and that flatters this engine. Volatility here comes from the range of each minute; live it comes from about forty ticks. Measured on 3 September 2026, sampling the live venue at its own sweep for three minutes against the calm windows of this corpus, the replay reads 3.6 times the venue's figure on bitcoin, 2.7 on ether and 1.8 on solana. A higher reading means a lower ceiling, so the leverage this corpus allowed is lower than the venue would have allowed on the same book, and every liquidation avoided by taking less risk is avoided here more easily than it would be in production.
• One-minute candles overstate gap risk for all three policies: a move that gaps through the band inside a minute would, on the live engine, be seen at 2.5 second resolution and closed earlier. The ratio between the policies is the finding, not the absolute count.