Milst Screener — the complete manual

1. What this is

Milst Screener is a monitor for the HIP-3 perpetual markets on Hyperliquid — the xyz dex, where synthetic perps track US and foreign equities, indices, FX, commodities and baskets — plus a second, walled-off universe of the main-dex crypto perps (BTC, ETH and the top names by open interest).

The design has one central idea: the heavy work happens once, on the server. A small Node process polls Hyperliquid, fetches and archives candles, samples open interest, computes every feature (momentum, volatility, reference prices, funding history, session studies, signals, sector aggregates) and caches the result. Browsers read a single pre-computed snapshot. Nobody's browser talks to Hyperliquid, so the per-IP rate limit is never a per-user problem and a cold start takes seconds rather than minutes.

How data reaches your screen

• Snapshot — the market table is rebuilt every ~15 seconds and served whole from /api/snapshot. The status line's updated field is the server's last successful poll, not your last fetch.
• Push stream — while the live stream (Server-Sent Events) is healthy the status line reads push live and the browser pulls the moment the server's data changes. The stream carries versions, never payloads: it tells the browser what changed, the browser fetches it.
• Fallback poll — if the stream drops, the browser polls at the cadence in the refresh selector (15s to 15m, default 30s). This setting is idle while the stream is up.
• WebSocket universe feed — server-side, the universe subscribes to Hyperliquid's real-time asset contexts for price / funding / OI at zero rate-limit cost; REST drops to a slow reconciliation poll while the socket is healthy.
• Persistence — open interest, funding history, the candle archive, the signal ledger, notes, messages and accounts live on a mounted volume and survive restarts and redeploys. A redeploy serves a warm table within a poll or two.

Two universes, one wall

The Stocks | Crypto switch in the nav is a hard wall: separate universes, separate benchmark (the S&P 500 perp for stocks, BTC for crypto), separate histories, never mixed in one list. Session concepts (gaps, overnight holds, cash sessions) do not exist on a 24/7 crypto tape and vanish in that scope. Crypto keeps 31 days of open-interest and funding history and a 90-day hourly spine; its daily bars match the equity side (build 2026.10.16-131): a year in memory and on the wire, read from the candle archive, which holds every closed day back to each coin's listing — so long moving averages, year-to-date, Drawdown, the daily correlation lookbacks and the backtest fill in for crypto too, and only a coin younger than the window shows a dash. The one deliberate exception: BTC may join a stock set in comp and ratio comparisons, aligned on the hours both legs traded.

Daily bars: sessions, on each instrument's own calendar

Hyperliquid's daily candles are UTC days, weekends included. On the stocks side every daily figure (moving averages, σ, the 200 lines, signals, studies, β, correlation) counts sessions: a UTC day on which the market under the perp does not trade folds into the next trading day's bar, so nothing is lost and a weekend is not two flat "days". Since build 2026.10.29-143 the calendar is the one of the market each perp tracks: US equities, ETFs, US indices the NYSE calendar; Seoul, Tokyo, Hong Kong and Shanghai listings their home exchange; energy and metals (gold, silver, copper, platinum, palladium, WTI, natural gas, heating oil) CME trade dates — the same full closures as the NYSE; Brent ICE Futures Europe, closed only on New Year's Day, Good Friday and Christmas Day; FX the weekend plus Christmas and New Year's Day; the xyz crypto and pre-IPO perps, which have no exchange underneath, calendar days, like the crypto side. A session bar's close is the perp at 00:00 UTC (20:00 ET in summer), not the exchange's own close. β and a pair's returns read only the days both instruments trade. BOW and Pulse never fold: they read TS9's native UTC candles.

Honesty rules that run through every tab

• A dash is a dash. Missing history, an unqualified baseline, a retired data series — all render as an explicit blank, never a guess, an interpolation or a zero.
• One code path. A level, a score or a record is computed once on the server and restated by every surface. The board, the drawer, the alerts and the Telegram wire cannot disagree because none of them recomputes.
• Frozen claims. Every signal is ledgered at the mark it fired at, with its void and target frozen, and scored out of sample. The record is the part to trust; the card is the part to read.
• Stamped prose. A note or a message that names a ticker carries the price it was written at, so every later read carries the move since.

2. Getting in — accounts, invites, sessions

The terminal has per-person accounts. An operator mints a single-use invite link from Admin › Access; opening it validates the code, moves it into a short-lived HttpOnly cookie and redirects to a bare /join, so the code leaves the address bar before anything renders and never lands in browser history or a Referer header. You pick a handle and a password; the invite is burned inside one database transaction, so two people opening the same link cannot both get in — the second sees "already used".

Roles — the four audience tiers

Every tab and action in Admin › Feature visibility is opened to the lowest tier that may see it, and every tier above sees it too: public (everyone) · members · elevated · admin (operators) · or off (nobody). Alerts follow the tab they come from, on Telegram and webhooks as in the app.

• Guest (no profile) — signed out. Only reaches the app on a deployment without SITE_PASSWORD; sees the features set to public. A legacy shared-password or HTTP Basic caller counts as a guest too: it is authenticated but not identified.
• Member — signed in to an account: the public and members features, plus every personal surface: watchlist, layouts, alerts, notes you can read, messages, positions.
• Elevated — a member an operator marked with make elevated in Admin › Access (audited): adds the elevated features. No operator powers. Taking it away (un-elevate) applies on the member's next request.
• Operator (admin) — everything, plus the Admin tab: accounts and invites, feature visibility, nav menus, alert recipients, the message read-through and its audit log, lane maintenance. The first account is bootstrapped with ADMIN_PASSWORD, which stays as a break-glass login for when an operator locks themselves out. A member can be promoted with make operator in Admin › Access. Operators must use a passkey (Admin › Access › Passkeys, off by default) makes every operator account's password sign-in end at a passkey prompt; it is refused while any operator has no passkey, says so when you promote a member who has none, and never applies to the break-glass login.

Scripts and curl

Scripts sign in like a browser. POST /login with {"handle","password"} and keep the session cookie (curl -c jar -b jar …); that works on every deployment. HTTP Basic with the shared password (curl -u friend:PASSWORD …/api/snapshot) is part of the legacy shared door, and it gets a script in only while that door is open and no account exists yet: once any account is on file, Basic authenticates without identifying anyone, so every /api route answers it 401 {error:"claim-account"}; with LEGACY_SHARED_PASSWORD=0 (or no SITE_PASSWORD) the header is ignored and the caller is simply signed out. The boot log says which of these applies. On a deployment without SITE_PASSWORD the public read routes need no credential at all. /api/health stays open without any credential — it is the platform healthcheck. Eight wrong passwords from one IP lock that IP out for 15 minutes; Basic attempts count against the same lock.

3. The shell — one row of chrome, one line of meta

Header

One row: the mark, the navigation, the Stocks | Crypto scope pill and the session buttons (back, home, ?, sign out). The dot beside the mark is the connection state: green = live, amber = the server's data has gone stale (its poller stalled — the snapshot carries the last successful poll time), red = the browser cannot reach the server.

Meta line

Under the header, one mono line holds every fact about the state of the machine, left to right:

Navigation ribbon

• Scope pill — Stocks | Crypto, at the right of the row. Remembered per browser. Tabs that have no meaning in a scope hide when you flip to it; Markets, Trend and Report follow the switch, Signals and Actionable have per-universe visibility the operator sets separately.
• Tabs and menus — related tabs are grouped into drop-down menus (by default Tape, Signals, Macro, Research; the operator can rename a menu or move a tab in Admin › Feature visibility without a deploy). Drag a tab to reorder it; the order is saved in this browser. Some tabs show a live count badge.
• ? — the per-tab explainer: how to read the tab you are on, plus the keyboard table. Each explainer links to the matching section of this manual.
• ⎋ — sign out.

Strips under the nav

• Macro banner — appears on every tab when the next universe-wide macro event (FOMC, CPI, payrolls, PPI, retail sales, GDP, PCE) is ≤2 ET days out, and flips to a blue result strip once the print is out.
• Regime strip — the first line of the Markets tab, not site chrome: the stocks board's regime read (breadth, dispersion, positioning, 30d correlation), or in crypto scope the tape strip: crowd pays (OI-weighted funding APR), breadth, total OI with its weighted delta, BTC's day and the alt-season gauge.

Always-on controls

• ▸_ Ask (bottom right, or ~) — the terminal: a query console over the board.
• Chat dock (bottom left) — unread messages, on every tab, once you are signed in.
• Toasts (bottom left) — new setups and void hits, if you have enabled trigger alerts in the bell.

4. Keyboard, command palette, deep links, mobile

Keyboard

Turning the single-key shortcuts off. ? / b h j k ~ and Rewind's [ ] { } fire on one key, which speech input or a stray keystroke can trigger. The Single-key shortcuts box under the keyboard table in the ? help (or keyboard in the command palette) turns them off for this browser; Ctrl+K, Esc, Enter and every button keep working, and the ? button still opens help. On by default.

Colorway

Two colorways, one per browser: Terminal (amber on ink) and TS9, the neon-green-on-black look of the Daruma / Ledger terminal, with IBM Plex Mono for numbers and labels. Switch in the command palette (type theme or ts9, pick a Colorway row), on a phone in More → All tabs → Colorway, or in the terminal with theme ts9 / theme terminal. Until you pick one, the address decides: terminal.ts9.tools (any ts9.tools address) opens in TS9, screener.milst.app in Terminal; a pick is remembered per address, so switching on one never changes the other. Under TS9 the app is TS9 Terminal: the circle mark and its name in the header, and its own tab title and icon. On a ts9.tools address the rest of the brand comes with it before any page loads: the home-screen app (name and icon), the sign-in page, this manual's title and the link preview a chat shows for the address. The pick is applied before the page paints, so a TS9 page never flashes the default first. In TS9 the accent and gains share one green by design; a selected control is told apart by its solid fill and glow. The Plex Mono files download only for a TS9 page.

Deep links

The URL reflects where you are, so links are shareable: #sectors opens a tab, #t=NVDA opens a ticker's drawer, #report with a focused ticker opens its report. Paste a link into an open tab and it navigates.

Phone and PWA

The app installs as a Progressive Web App (browser menu → Add to home screen). The service worker is install-only and deliberately caches nothing: a caching worker is exactly the stale-client failure the version-stamped assets were built to kill. On a phone the site switches to a phone layout, decided by the screen's size (up to 680px wide, or a touch screen under 500px tall, i.e. a phone on its side) and re-decided when you rotate it: a bottom bar with Markets · Charts · Signals · Calendar · More; the markets table as one card per name (ticker and name, price, and one number you pick with 24h · Fund · Vol · OI over the list); Filters as a sheet that also holds sort, the analysis window and the grouping; and More → All tabs, every tab grouped and searchable, plus Ask, help, passkeys, sign out, the build and data freshness. Use desktop layout at the bottom of All tabs brings back the full desktop page on that phone (per browser); a Phone layout button in the status line switches back. The desktop layout on a phone-width screen still starts from a mobile column preset (ticker, price, 24h, 7d, funding, ΔOI, volume); every other column is one toggle away in the column menu and your own arrangement is never overridden later. Browser notifications for messages work with the tab closed once you enable them in the Messages rail.

5. Markets tab

One row per market, one column per lens. The table is the home screen; everything else in the app is a different cut of the same rows.

Controls

Click any header to sort (a second click flips direction). Cell shading scales with the size of the move — a wall of deep red 7d cells is the market-breadth read. ★ beside a ticker pins it to the watchlist and to the top of the table.

Ticker cell badges

Every column

Hover any cell for its exact inputs. "Window" means the column follows the window selector.

Group lens — sectors and industries

The group toggle re-renders the same board with one row per sector (GICS plus asset classes) or industry (the finer curated split — Semis vs Software vs Memory, Banks vs Capital Markets). Each cell is the weighted average of exactly the rows the names view shows, computed only over members that have the value (a missing window is excluded and the weights renormalize, never zero-filled); hover discloses coverage. Best · Worst (pinned to 24h) is the aggregate-liar detector — whether the group number is everyone or one name dragging the rest — read against Cohesion (90-day average internal correlation: high = the label trades as one block, low = a stock-picker's bucket). Click a group row to drill in: the table flips back to its members with a chip to clear. Industry rows marked = sector have no curated split yet.

Action strip — heating · cooling · strongest bid

The collapsible strip under the table is the rate-of-change read next to the table's levels, and it always describes exactly the rows the table shows (scope, window, filters, drill and group lens all apply). Who is shown it is an operator switch: Admin › Features › Markets action lists (markets.action, everyone by default).

• accel = the window's natural fast leg (1h→15m, 4h→1h, 1d→4h, 7d→1d, 30d→7d) minus the window's own pace, both relative to the tape. heat = accel + 0.6·tanh(ΔOI/8) + 0.4·clamp(RVOL−1): flow can confirm an acceleration, never replace it; RVOL is dropped at 7d/30d, not faked.
• HEATING = positive accel with flow agreeing — what is starting. COOLING = names still ahead of the tape whose pace has died — with a high MOM this is the take-profit read. "Never went anywhere" makes no list at all.
• STRONGEST BID ranks the server's dip-reclaim claims off the 5-minute archive (equities, last 4h): the deepest peak→trough dip, the fraction reclaimed, minutes since the low, ranked dip × reclaimed ÷ √minutes. Demand response, not momentum.
• M on every chip is the momentum level: high/high = ride, high/stalling = exit, low/accelerating = new rotation. In a group lens the strip regroups (share-of-tape replaces RVOL as the volume confirm; the bid column stays name-level because dips don't aggregate).

The 1d movers row above the table lists the day's biggest moves as chips; click one to open the name.

Watchlist rail — your lists, stocks and crypto together (2026.10.23)

A drawer on the left that holds named lists split into groups and, unlike every board, ignores the Stocks | Crypto switch: one list can hold NVDA, BTC and GOLD side by side. It is the ★ set organised — a star anywhere lands in the open list (a coin joins the coins, a stock the stocks), and a name leaves the ★ set only when no list holds it any more. The first time it opens, Core holds your existing stars in a Stocks group and a Crypto group. Lists and groups sync to your account (signed in); which list is open stays per browser.

• The dot: blue a stock, amber a coin, grey a commodity. Hollow = that market is closed right now; the change cell goes dotted, so a quiet closed stock never reads as a flat one.
• Columns are the operator's pick for everyone (Admin › Feature visibility › Watchlist rail columns): up to four of price, D open (since today's UTC open), the window change, σ move, RVOL, funding APR, 24h volume, open interest, ΔOI, 7d change and momentum. The default is price · D open · RVOL. The first change column also drives the group averages and the collapsed strip.
• Change (when it is one of the columns) follows the table's window (1h · 4h · 24h · 7d · 30d). Click its header for σ: the move divided by that market's usual move over the window (Vol (ann) per day, × √sessions for a stock, × √days for a coin). σ is the fair way to rank a stock against a coin; a dash means its volatility has not loaded yet. Group headers show the equal-weight move.
• Conditions (the sections above the list) scan the open list, and they are yours to change. Each is a metric, an operator, a value and which universe it scans. + Add in the Conditions bar adds one. Every section shows its controls: ✎ edits it, × removes it (with Undo), and the ⠇ grip drags it to a new place (or press Alt+↑/↓ on its header, or use Up/Down in the editor); ⋯ › Restore default conditions brings back the four it starts with: Touching EMA now, Gap ≥ 2% (stocks), Funding extreme (its own 31-day percentile in either tail at 90), Earnings ≤ 1 day (stocks).
  • Metrics: move or σ move over the table's window; 1h, 4h, 24h, 7d, 30d change; gap (stocks); funding APR; funding percentile (own 31 days); RVOL (up to the 1d window); ΔOI over the window; distance from the 30-day high; momentum score; touching an EMA 50 or 200 (with the EMA Touch feature); earnings within N days (stocks).
  • Operators: ≥, ≤, beyond ± (either direction past the value, e.g. a gap beyond ±2%), and for the percentile in either tail (at 90 = the top or bottom 10%).
  • Up to 16. Leave the name blank and it is written from the condition. A chip shows that name's own value; click it to open the name. Conditions sync with your lists.
• Editing: the search box adds from both universes, and finds baskets too (MAG7, a sector, one you made on Correlations): picked, a basket becomes a section of its name holding its members as listed now, each starred — a snapshot, nothing follows the basket afterwards; add it again for its current members. ⋯ › Basket → section does the same from a list. + New section at the foot of the list adds a named section in place (Enter adds, Esc cancels; up to 12 a list) — drag names into it, or drop them on its header. Drag to reorder or move a name to another section; double-click a section to rename it; ⋯ renames, adds and deletes lists and sections. Keyboard: ↑↓ walk the list, Enter opens the name's chart, Delete removes.
• Space: docked at 1180px and wider; ‹ collapses it to a strip of tickers and live %, ✕ hides it, ★ Watchlist in the meta line brings it back. Narrower, and on phones, it slides over from that button. A click opens the name on the Charts tab, from wherever you are — the first pane of your grid (or the MTF wall's instrument), the way the drawer's full chart → does; already on Charts, the pane just takes the name. A name from the other universe switches the scope for the visit, and leaving the tab switches it back. A viewer whose tier has no Charts tab gets the ticker drawer instead.

Operator-only while it soaks: Admin › Features › Watchlist rail (markets.rail). It reads the rows already on the page and the wlists pref through /api/prefs; it owns no route.

Depth column and Rewind (build 2026.09.30-127)

Depth ±1% (hidden by default, in the column menu): resting size within 1% of mid on the thinner side of the live book — what a round trip can count on without walking the book. The server reads two books every 15 seconds, busiest markets first, so a value can be up to about half an hour old; hover for its age. ⏱ Rewind opens the board as it stood at any past moment the archive covers (captured every 15 minutes, about three weeks): price then and the move since, and the funding, open interest, volume and premium as they were. The operator can switch it off (rewind).

(Build 2026.10.15-130.) Typing a date in Rewind waits until you pause before it asks the archive, and [ ] / { } step the board 15 minutes / a day.

Since you left: type since 4h (or 1d, 30m, a date) — or ask "what did I miss" — in the terminal for your watchlist's moves, the tape's top movers, what the engine fired, calls that closed and earnings that reported meanwhile. It no longer opens a panel on its own when you come back.

Crypto scope

Adds the tape strip (crowd pays, breadth, total OI and its weighted delta, BTC's day, alt-season gauge), the Casc and 24h Liqs columns, and BTC as the benchmark. Session columns (Gap, Sess) vanish. Crypto claims and features run on compressed horizons throughout the app.

6. The ticker drawer

Click a ticker (or press Enter on a highlighted row, or pick one in the command palette) and the drawer slides in from the right. It sets the focused ticker, so Trend, Report, Charts and the rest open on the same name. Top to bottom:

Header

Stays put while the body scrolls. The price leads, large, with the day move beside it and a tint on every tick; under it the instrument name and the coin id; then the action row — AI report →, ⚑ alert, full chart → (opens this name on the Charts tab in your own layout), ⧉ link (copies a link that opens this drawer) — and a row of chips that jump to each section (Chart, Metrics, Why it moved, Events, Ledger, News, Peers). ‹ › in the header, the ← → keys or a sideways swipe on a phone step to the previous or next name in the table's current order; the small counter says where you are. On a desktop wider than 900px, ⤢ widens the drawer to two columns with the chart across both; the choice is remembered.

Sections

The chart comes first (hourly candles, 3d to 90d; the daily closes stand in while a young listing's hourly spine fills), then Returns (1h · 4h · 1d · 7d · 30d), Market (volume, open interest, ΔOI, funding, premium, OI cap) and Character (momentum, β, volatility, gap, squeeze, carry, distance from the 30d high). Click a section's title to fold it; folded sections stay folded for this browser until you open them again (a jump chip opens one). Panels that load after the drawer opens reserve their space, so the body does not shift under your finger while they fill.

Notes

Your written notes on this name, above the charts: everything else in the drawer is the server's read, the note is yours. Each note is stamped with the mark it was written at ("wrote it at 113.90 · +4.0% since"). #tags in the body filter the Notes tab. Editing rewrites the body and nothing else; the original timestamp and price stand, and the rewrite is disclosed. Writing needs the operator's notes.write permission.

Position

If your linked wallet holds this market: side, size, entry, leverage, liquidation price, margin, funding paid since open, and unrealized P&L / ROE derived off the live mark — beside the trend board's read of the name.

Where the 30d return happened

The 30-day return decomposed into what accrued off-hours (overnight + weekend close→open) vs during cash sessions. A persistent off-hours drift is the overnight-effect edge this panel exists to expose. Anchored to the home session for foreign-home names.

Full chart →

In the action row, where the Charts tab is open to you: opens this name on the Charts tab in your own layout — the first GRID pane, or the MTF wall's instrument.

Metrics

The table's columns for this name, in one grid, including the hidden ones.

Why it moved

(Build 2026.09.30-127.) The move over 1h, 4h, 24h or 7d split three ways that always add up: market = the name's 90-day beta × its benchmark's move (the S&P perp, or BTC); sector = the average move of its sector peers beyond their own market share; its own = the rest. An accounting, not a model. Under it, the headlines, filing or earnings print that landed in the window. If a window cannot be read, the panel says so (with a Retry) instead of keeping the previous window's numbers.

OI cap

(Build 2026.10.25; xyz names, where oicap is open to you.) In the Metrics grid: the share of the deployer's open-interest cap the market uses and the cap itself, or AT CAP and for how long while Hyperliquid lists it there.

On other dexes

(Build 2026.10.16-131; xyz names, where crossdex is open to you.) The same underlying listed by another HIP-3 deployer — see Cross-dex: its mark, the mark and oracle spread against this market in bp, both legs' funding and the differential, its open interest, and the carry read after fees. Opening the drawer reads both order books (this one and up to four others): spread, depth within ±1%, and the average fill for $10K and $50K each side — cached 20 seconds server-side and drawn from the same on-demand book budget as the depth panel above, so a busy minute shows the last read, flagged. A same-name listing whose oracle is more than 10% away (a different contract size) is named and not compared.

Event risk

The next scheduled earnings print and any macro event inside the coming days, plus the name's earnings reaction study: number of prints, average and median |cash-close → cash-close move| (with a bootstrap 90% interval from 4 prints), up/down split, cash-session gap behaviour (with its intraday coverage), and the move as a multiple of the name's usual daily range.

90-day price

Sparkline; then Top co-movers and Top hedges — inverse over 90 days of daily returns.

Hourly candles

OHLCV chart with a timeframe switcher (1h–4h aggregations, 1–60 days), crosshair readout, and the levels the signal engine froze on any open claim. (Build -132) While the drawer is open and the page visible, the forming hour moves with the market: every 20 seconds it re-reads the hour, refined by the live 5-minute candle socket. That bar is provisional — drawn lighter with a dashed outline, marked live edge in the header, and its readout says live — unconfirmed; the exchange's record replaces it within minutes. Nothing that computes (signals, levels, alerts, the ledger) ever reads it.

OI / funding history

Open interest and funding APR sparklines over the retained history, with the current hourly funding stated.

Fundamentals

Finnhub basic financials and profile for US listings: point-in-time, quarterly-updated, refreshed daily server-side. Market cap, P/E and P/S are derived live off this board's mark.

Derivs context

Crypto: aggregated CEX liquidations and open interest for the coin (Coinalyze, 15-minute buckets aggregated hourly) — market context for the Hyperliquid name, not Hyperliquid-native, and labelled as such.

Insiders · recent EMA touches

(Build 2026.10.15-130.) Where the Insiders tab is on: the name's open-market buys and sales over 90 days and, when three or more different insiders bought within 10 days, a cluster chip with the dates. Where EMA Touch is on: the name's last few 50/200 EMA touch cards (4H and 1D) straight from the tab's feed — the feed keeps a card about a day on 4H and five sessions on 1D, so this is recent history, not all of it.

News

The last 72 hours of verified headlines tied to this name — the News tab's payload, filtered.

Signal record

The out-of-sample record of every claim the engine ever fired on this name: hit = share of resolved claims that went the way the signal implied. The claim-by-claim history lives behind the ticker search on the Signals tab. Signal accuracy — live track unfolds the per-event split.

7. The tabs

Each tab is one question asked of the same rows. Tabs marked operator-only by default ship closed to the group until the operator opens them in Admin › Feature visibility; a closed tab is absent from the ribbon and its routes refuse, not hidden. Where a tab has a per-universe split, the scope pills decide which universe you are reading.

Watchlist, layouts and positions follow the account

• Wallets (build 2026.10.30; where the wallets key is open to you) — Account › Wallets holds up to 5 public, read-only addresses, each with a label and the venues it has history on (Hyperliquid, Lighter, Arcus, checked when you add it). The positions overlay, Book and the what-if panel read every Hyperliquid wallet on it; the Journal reads them all, and opens with them loaded. A wallet added or removed in the Journal changes the list too, and the first time you open the Journal its own wallets join the list (up to 5; any beyond are named in its status line). Filters › Positions then shows the list's summary and Manage wallets → in place of its address box. Private: no route answers anyone else's list, and the operators' Usage shows counts only (members with wallets, wallets, accounts at 5, added in 30 days) — never an address or a label.
• Watchlist and saved layouts sync to your account: one preference row per (member, key), last-writer-wins on the client's own timestamp, and a poke to your other tabs so a phone and a desktop converge on whichever change was made later. localStorage stays the working copy (signed out, nothing changes). The active layout is deliberately per browser.
• Positions overlay — link one Hyperliquid wallet under Filters › Positions (public address only; the app reads the public clearinghouse state and can never sign). The server reads the xyz book and, in crypto, the main-dex book every 30s — but only for wallets somebody is looking at. It ships the structure of each position (side, size, entry, leverage, liquidation, margin, funding paid); notional, unrealized P&L, ROE and the move since entry are derived client-side off the live mark, so they move with the tape. On the table: ⬡ beside the ticker, a sortable Position column (migrated in next to OI in saved layouts), the ⬡ held filter; in the drawer, a panel next to the trend read.
• Per browser, not synced — tab order, the active layout, phone or desktop layout and the phone's picked number, the funding unit, open admin folds, the mobile preset flag, the analysis window and refresh cadence, terminal history, chat drafts.

8. The terminal — ask the board

The ▸_ Ask button (or ~) opens a query console over the rows already in your browser. Every board column is a lens; the grammar below runs locally and instantly, and anything it cannot parse is handed to the AI fallback where the operator has enabled it. Tab completes verbs, fields and tickers; ↑ ↓ walk the history; a result names the rows it ran on.

Fields and aliases

Canonical fields: funding fundpct oi doi squeeze momentum vstape carry beta dd ddy vol vol30 d1 d7 d30 h1 h4 rvol gap prem adr vsvwap vsma200 vsyopen vsmopen yopen mopen turn dcap hitr rs sector price. Plain-English aliases resolve to them — apr, rate → funding; sqz → squeeze; mom → momentum; week, 7d → d7; month, 30d → d30; ytd → vsyopen; premium, basis → prem; relvol → rvol; volatility → vol30; downcap → dcap; hitrate → hitr; fromhigh → dd; spx, vssp → rs; oivol → turn.

Plain English

"who reports tomorrow", "best sector this week", "whats above the 200dma", "nvda vs amd", "most crowded shorts", "hows the tape" — a translation layer maps common questions onto the grammar first (the translation is echoed as → screen vsma200>0), and only what still cannot parse goes to the model. The AI leg is metered: the ask budget chip shows the group's remaining daily calls (ASK_MAX_PER_DAY, resets midnight UTC), each member has a daily cap, and the 🔒 chip means AI generation is locked until an operator runs admin unlock.

10. Alerts — the bell, rules, Telegram, push, schedules

The poller owns one sequenced, persisted event stream. Every transport — the in-tab toasts, the bell panel, Telegram, webhooks, browser push — is a thin consumer with its own eligibility filter, so a channel's thresholds can never censor the record of what fired. Events are announced once per claim and per fire; a rebuild or a redeploy re-announces nothing.

The bell panel

Server-side rule metrics

price · 1h % · 4h % · 1d % · 7d % · 30d % · funding APR % · funding percentile · funding 1d/7d avg APR % · premium (bp) · 24h volume · open interest · relative volume · 24h liquidations · ΔOI 1h/4h/1d/7d/30d % · % from 30d high · % from 30d low · % from 30d vwap · trend score (±4) · dist to D1 EMA21 % · % vs 200d MA · net crowding. Thresholds in the metric's unit (5 for 5%, 50 for 50M).

Net crowding (crowd) is scope-wide, not per market: the share of names whose funding sits at or above its own 90th percentile minus the share at or below its 10th, the Positioning regime's number. It takes a scope instead of a ticker and no AND extras: /alert stocks crowd > 30, /alert crypto crowd crosses 20, or /alert any crowd < -30 (stocks and crypto each evaluated on their own). Plain English works: stocks net crowding above 30. Same arm band, cooldown and crosses as every rule.

Basket alerts (build 2026.10.16-131, where baskets are open to you): a rule may name a built-in or saved basket instead of a market — /alert MAG7 d1 > 2, /alert TECH crosses 105 (its index level), or type the basket in the Rules form's ticker box. It reads the basket's level or its 1h / 4h / 1d / 7d / 30d return as /api/baskets/live prices it, with the same arm band, cooldown and per-owner cap as any rule, and fires as a rule event named ⬒MAG7. A basket kept only in your browser cannot be watched by the server.

Alert classes

Every class below has one entry in the server's registry (compute.ALERT_REGISTRY): its name, its group, what fires it and its bell tag. The bell, the Delivery chips, the channel table and webhooks all read that one list, and the bell's line for an event is derived from the same formatter that writes the Telegram message, so the two can never describe one event differently.

Only what your tier can see (build 2026.10.26). The alerts panel lists, describes and offers a class only to a tier that may see what fires it: the same rule delivery applies. A class belongs to its tab (BOW, Pulse, Congress, Insiders, …), setups and their outcomes to the Actionable / Signals universes, and server health to operators. So when a tab is closed to members, members neither see its class in the panel, the Delivery chips, the "where each alert shows up" table or the webhook chips, nor receive it. The setup thresholds show only to a tier that receives setups. Rule metrics follow the same rule: trend score and distance to the D1 EMA21 belong to Trend, and days to earnings belongs to Earnings. They are offered and accepted (from the panel, plain English or /alert) only while that tab is open to you, and a rule set before the tab closed rests until it reopens. A Telegram chat counts as its owner without operator rights, because a chat may be a group: it receives what the tab is open to at that tier, unless an operator marks it an operator chat.

Recipients with no selection get the default set (setups, outcomes, rules, calls, and server health for operators); every other class is opt-in, shown on its chip with how often it fired in the last day. A ticker mute and only my watchlist apply to the per-name classes: setups, technicals, levels, funding, filings, insider buys, earnings and AI flips.

An alert follows its tab (build 2026.10.16-131). A class that comes from a tab reaches you — on Telegram, a webhook, the bell, the in-tab pop-ups and browser notifications — only while that tab is visible to you, checked at delivery against the live switchboard: congress ↔ Congress, filing ↔ Funds for a watched fund's 13F and News for a material EDGAR filing, trend ↔ Trend, ma200 / levels ↔ Sessions, ma50 / touch200 / touch50 ↔ EMA Touch, earnings / macro ↔ Earnings, ai ↔ AI Report, calls ↔ Calls, funding ↔ Funding, insider ↔ Insiders, focus ↔ Focus. While a tab soaks operator-only, so do its alerts; opening the tab opens them; switching a tab off silences its alerts for everyone, operators included. setup / ledger / coverage follow the Signals and Actionable universe slices instead; rule, regime and ops have no tab of their own.

Telegram

1. Open the bell → Link Telegram (also in the Messages rail). The panel mints a single-use code (10 minutes) bound to your account.
2. Tap Open Telegram and press START — the link carries the code, so there is nothing to type. On a computer, scan the QR with your phone instead. The panel flips to Linked by itself within a few seconds, with a Send me a test button. Fallbacks: send the bot /start CODE, or just the code on its own. The bot's @username is read from Telegram at boot (getMe), so renaming it in BotFather needs no change here.
3. Open your chat's row and pick what you get: the chips are grouped by topic (Setups, You & people, Technicals, Positioning, Filings & insiders, Calendar, Research, System); hover one for what fires it. quiet opens an hour picker (your local time — alerts in the window are held and arrive when it ends, never dropped; a void taken and server stalls still come through); each scheduled send opens an hour picker and seven day toggles.

Bot commands: /start CODE link (a bare /start replies with how to link) · /alert … sets a price/threshold alert · /stop unlink (always works — control of the Telegram account outranks any cookie) · /status or /help · /r message and /r @handle message reply into Messages. Delivery is paced (1 message / 3s, 20 per recipient per hour — held, not dropped, and disclosed), with Telegram's own errors surfaced verbatim in the panel log. The whole transport is dormant without TG_BOT_TOKEN.

Webhooks

(Build 2026.10.16-131; the webhooks feature, operator-only while it soaks.) Up to 3 endpoints per member, added in the bell → Delivery → Webhooks with a label and a URL. The kind is detected from the URL:

Verifying a generic webhook (the signature covers the timestamp since build 2026.10.16-131, so a captured delivery cannot be replayed later under a new one): (1) read X-Xyz-Timestamp and the raw request body exactly as received, before any JSON parse; (2) compute "sha256=" + hex(HMAC-SHA256(secret, timestamp + "." + rawBody)); (3) compare it with X-Xyz-Signature in constant time (e.g. crypto.timingSafeEqual, hmac.compare_digest); (4) refuse a timestamp more than 5 minutes from your own clock; (5) dedupe on the body's id (a retry re-sends the same id with a new timestamp and signature). In Node: crypto.createHmac("sha256", secret).update(ts + "." + raw).digest("hex").

Each endpoint takes the same alert classes as Telegram (no selection = the default set; operator-only classes reach operators only), the same setup thresholds, ticker mutes and watchlist-only switch as your linked Telegram (they live on the chat; an endpoint with no linked chat behind it gets the class choice only), and follows your Telegram quiet hours unless its own quiet hours switch is off (held, never dropped; ops and a void taken pierce). Send test posts one test message and shows what the endpoint answered.

Safety. A webhook URL must be https on port 443, a public DNS name (never an IP address, never user:pass@), at most 512 characters. Before every send the name is resolved and every address it returns must be public — loopback, private (RFC 1918), link-local, CGNAT, multicast, unspecified, reserved and documentation ranges, IPv6 unique-local / link-local / site-local and any IPv4-mapped, NAT64, 6to4 or Teredo form are refused — and the request goes to the address that passed (pinned; no second lookup). Redirects are never followed; each request has a 5-second limit; the response body is discarded (read at most 16 KB). A Discord or Slack URL is itself a credential: after creation the panel shows only the host and its last four characters, and no log line carries a URL or a secret.

Delivery. Through a persisted outbox (it survives a redeploy; an alert older than a day is dropped from it), at most 20 posts a minute per endpoint. The outbox holds at most 50 waiting alerts per endpoint, 100 per member and 300 in all; when one is full the oldest alert of whoever holds the most is dropped (and counted on that endpoint's row), so a member whose receivers are down or rate-limiting can never crowd out anyone else's alerts. A 5xx, a timeout or a network error is retried with backoff (up to 6 tries per alert); a 429 waits out the receiver's Retry-After; any other 4xx or a redirect drops that alert. After 10 consecutive failures the endpoint is disabled: its row says why, your Telegram (if linked) is told once, operators get an ops event, and Re-enable brings it back. While the feature is closed to you, or your account is disabled, nothing is delivered.

Scheduled sends

Each recipient sets the hour (local) and the days per send, with the hour picker and day toggles on the send's chip in the Delivery fold. (An operator setting someone else's schedule in Admin still types the days: all, weekdays, mon,wed,fri or MWF.)

Browser push

Browser notifications in the bell shows whatever pops up in the tab (new setups, a void taken, your rules, calls, trend and EMA closes, funding extremes, insider cluster buys) as system notifications while a tab is open. Enabling notifications in the Messages rail adds web-push with the tab closed for unread messages (same 5-minute grace, mute and mention-piercing rules as Telegram), a followed member's call, the post-mortem reminder and duel events. VAPID keys are minted once on the volume.

11. Signals reference — the engine

How a condition becomes a card, a claim, a record and an alert. The full per-event reference with every threshold, stamp and knob is a separate page: Signal, study & shadow reference.

Pipeline in one pass

data (hourly spine · daily · funding · OI · Coinalyze · Finnhub earnings · EDGAR)
  ↓ studies      in-sample base rates, per market per event, memoized to the data version
  ↓ signals      live surveillance: condition fires → intensity 0–50 + evidence 0–50
  ↓ ledger       claim frozen at fire: mark · side · void · target · 30d σ · context stamp
  ↓ gates        episode re-arm · universe whitelist · geometry (no inverted or degenerate levels)
  ↓ resolve      at horizon: realized (play-signed) + stop-aware track + bracket track
  ↓ records      blend back into evidence · no-edge cap · earned confluence · variant promotion
  ↓ surfaces     Signals cards · Actionable board · drawer record · ticker history · AI report
  ↓ stream       one sequenced event log → browser toast / bell · Telegram · push

Scoring

• Evidence is scored on edge (build 2026.10.26): each past occurrence minus what holding the market in that direction earned anyway (the market's own unconditional drift over the same horizon, in R) and minus the round trip (the taker fee in and out plus one spread — the depth lane's measured spread when fresh, else 3 bp; SIGNAL_TAKER_BP sets the fee, 4.5 bp by default). A long-only study in a rising year no longer earns points for the year, and a sub-cost edge on a quiet name scores as neg exp. The card's base rate is the edge (tagged net; the gross move is in its tooltip) and the play's target still uses the gross median. Claims state the gross base rate, so claimed vs live compares like with like.
• Evidence is expectancy-centred: an event whose average outcome is ≤0 scores 0 evidence and wears neg exp, however loud the condition. Otherwise min(1, avg/scale)·30 + max(0, hit−0.5)·2·20, with scale = 0.5R for R-united events and 0.8% for %-united ones.
• Source (build 2026.10.26, partial pooling): the market's own edge is pulled toward its asset-class pool with weight n / (n + 20), and the pool toward zero with weight d / (d + 20), where d counts the pool's distinct event-days (thirty names breaking down on one day are one observation). It replaces the old cliffs (own at n ≥ 8, else the pool at a 0.7 discount, else a token): a market's own rate at n = 8 now carries 29% of the weight. With nothing at all to go on, a token 6–8 points. The card shows the own rate from 8 occurrences and the pool below that, as before (unproven below 8). Crypto pools in its own bucket.
• Live blend: once an event has ≥5 live resolutions, stats blend study and live record with weight resolved/(resolved+25). No-live-edge cap: ≥10 resolved, hit <50%, median ≤0 → evidence capped at 8.
• Universe lanes: 40 signals per universe, so a volatile crypto day cannot evict the equity board.

Ledger mechanics

• Frozen geometry — at fire: entry mark, play side, void level, target (absolute), 30-day daily σ for R normalization, score and prime flag. Never re-derived, never moved.
• Episode re-arm — if a claim resolves while its condition still fires, no new claim opens until the condition lapses for a full build. One episode, one claim.
• Units — premium in bp; the R-united set (big move, breakout, breakdown, funding flip, vol shift, OI flush, funding–price divergence, the shadows, cascade, funding extreme) in R via σ; everything else in %. Crypto levels are built in log space so σ constructions cannot produce negative prices.
• Costs and benchmark (build 2026.10.26) — every claim stamps its round trip at fire (cst, % of notional) and resolves a net-of-cost leg (realizedN), shown as net on the record. Equity claims now resolve a benchmark-excess leg against the S&P proxy, as crypto claims always did against BTC (vs S&P / vs BTC on the record).
• Context stamp — funding and its percentile, 5d OI change, position in the 30d range, the benchmark's 24h move, session or hour-of-day bucket, day of week — so records can be sliced later. Absent means unknown, never null-padded.
• Persistence — ledger.json plus an append-only archive on trim; optional weekly off-site backup to a GitHub repo.

Event roster

Actionable gates

Horizon ≥ 3d equity / 2d crypto · ≤ 10 bars in trigger · CONFIRMED needs n ≥ 8, positive average and positive EV here, no no-edge cap · net R/R between 2.0 and 20 · void ≥ 0.05% (plus a σ-relative floor). R/R is repriced from the live mark every build, so a chased setup dies on its own.

12. Data sources, cadences, persistence

Sources

Retention

• The permanent history archive (build 2026.11.01) — nothing the app has recorded ages out for good any more. The rolling windows below stay as they are (every study reads the same window it did), but what leaves them is kept: hourly candles in candles.db's candles_1h table (every closed hour of the spine, never evicted — seeded with the spine's ~180 days on the first refresh), every 5-minute bar (no eviction unless M5_KEEP_DAYS is set), and under archive/ the open-interest and funding samples leaving oi.log (one per market per hour), the Coinalyze rows leaving derivs.log (15 minutes), every regime sample, and one premium reading per market per hour (mark, oracle, premium in bp). Delisted markets' rows stay on disk too. The app never reads the archive back (no memory cost); the research scripts do, through GET /api/admin/history and scripts/history-pull.js. A compaction that cannot write the archive keeps the rows it would have dropped, tries again the next day and raises an ops warning while it lasts; an append is all or nothing and on disk (fsync) before the live copy is pruned. The hourly table is also backfilled once per market to the ~208 days Hyperliquid serves (crypto included, whose spine holds 90). The disk guard: under 30% free (or 2 GB) an ops warning; under 15% (or 1 GB) the 5-minute archive falls back to 370 days so the rest of the volume never runs out, with a warning; the daily candles.db.bak is skipped (the previous copy kept) when it would not fit with 1 GB to spare. Rows the archive files may repeat (a restart, an hour across two compactions) are the same reading twice — read them keyed by market and time.
• Open interest — append-only log, 365 days: full resolution for 31, thinned to hourly beyond (the crypto roster keeps a flat 31); pruned daily. OI accrues and cannot be re-fetched, so this is the one series a lost volume actually loses.
• Candles — a SQLite archive: 5-minute bars since the lane started (kept, build 2026.11.01), the hourly spine for ~180 days in memory and every closed hour in candles_1h, daily bars back to each listing's birth — crypto included: each coin is seeded once, in one request spread through the deep lane's own worker under the rate limiter, then captured a closed day at a time and never evicted (a coin that leaves the roster keeps its history and resumes from it). Crypto's daily refresh reads that archive and asks Hyperliquid only for the last few days (build 2026.10.16-131). Only spines that went stale while the server was down are re-fetched after a redeploy.
• Analyst consensus — one row per asset per clock hour in consensus.db, 400 days, pruned daily; the newest full reading per asset is kept beside it so a redeploy paints before the first read. CryptoQuant's free tier has no history, so this file is the only record of how a reading moved.
• Short-sale volume — one row per roster symbol per trade date in shortvol.db, 400 days, pruned daily, with a record of which dates were read for which symbols. FINRA keeps its files online, so a lost file costs a re-download, never the history.
• Short interest & floats — one row per symbol per settlement date in shortvol.db (400 days) with the files read, and each company's float estimate with its inputs, rebuilt weekly.
• OI-cap episodes — which markets sat at their cap and when, in oicap.json: the open ones and the last 90 days (at most 400) of closed ones.
• Funding history — seeded from the OI samples and topped up by a best-effort backfill; the heatmap hatches what it cannot see.
• News 72h · messages 30d in a 1-to-1, 7d in groups (pins exempt) · ledger trimmed to an archive, never deleted.

What lives on the volume

DATA_DIR (mount it at /data). Every JSON file is written atomically (temp file, then rename) and warm-loaded on boot.

Write cadence and durability

• News cache — news.json is rewritten only when a feed brought something new (or an item was purged or reclassified), at most once every 30 seconds, and once more on shutdown or crash. A hard kill can cost the last 30 seconds of headlines; the feeds refill them on the next rotation.
• SQLite files — every database runs in WAL mode with synchronous=NORMAL: a commit is not fsynced on its own, the log is fsynced at each checkpoint. A crash or kill of the process loses nothing; only an operating-system crash or power loss can roll back the last few commits (a message, a prefs save) since the previous checkpoint. The files are never left corrupt either way. accounts.db takes the same setting as the archives so a message or prefs save no longer waits on the disk.
• Client files — the server starts listening before the compressed copies are ready (a second or two after a deploy); in that window the same files are sent gzipped per request.

13. HTTP API

Everything the site shows comes from these routes. All JSON, under /api, unless noted. The reference below lists every route the server registers; a test fails the build when a route is added without appearing here.

How a request is judged

• Site gate — with SITE_PASSWORD set, every route needs a signed-in session (cookie), except the doors and the few routes marked Open. Signed out is 401. Once accounts exist, a shared-password session — and HTTP Basic, which is the shared password — is sent to /claim (401 {error:"claim-account"} on /api); before then Basic passes while the legacy door is open, and never once LEGACY_SHARED_PASSWORD=0.
• Feature gate — a route owned by a tab or action in the feature manifest answers 403 {error:"feature-gated", feature} when that feature is closed to you. The column below names the key and its default audience; the operator can change it in Admin › Features. The gate judges the decoded path and the route that will actually run, so a percent-encoded or re-spelled path meets the same gate; an undecodable path is 400.
• Operator — routes marked Operator re-check the admin session inside the handler as well (403), whatever the feature flag says.
• Account — personal routes need a member account (not the shared password): messages, prefs, positions, usage, the adopt flow.
• Writes — every non-GET refuses a cross-site request (Sec-Fetch-Site: cross-site → 403); cookies are HttpOnly, SameSite=Lax, Secure over HTTPS. Bodies are size-capped per route (413 past it).
• Limits — a limited route answers 429, usually with Retry-After. Per-IP limits key on the last X-Forwarded-For element only when TRUST_PROXY is on (see Configuration).
• Caching — cached payloads carry an ETag and revalidate (304); personal and operator bodies are no-store. GET /api/events (Server-Sent Events) tells a client when to re-fetch.

Access column: Open = no credential · Site = behind the site gate · Account = a member account · Operator = the admin session, re-checked in the handler · key (default) = the feature key that gates it and who sees it by default.

Doors and open routes

Markets and studies

Signals, calendar, news

AI

Without an account (shared password or Basic), AI quotas are counted per IP address.

Alerts and Telegram

Messages

Your account

Operator

Pages and assets

14. Configuration — environment variables

Every variable the server reads. The value shown is the default when unset. Nothing reads a .env file automatically; on Railway set them on the service.

Storage and runtime

History depth is not an environment variable. Open interest keeps 365 days (the last 31 at full ~5-minute resolution, one sample per hour beyond; the crypto roster a flat 31), set by OI_RETENTION, OI_FULL_RES and MAIN_HIST_DAYS in src/poller.js — see §12 Retention.

Access

Data sources

AI

15. Running and deploying

Locally

npm install
DATA_DIR=./data npm start
# open http://localhost:3000

Node 22.5+ (the built-in WebSocket client and SQLite). On first boot the server backfills candle history for every market — the slow part, once, server-side; the table fills progressively and the status line shows syncing X/Y.

Railway

1. Push the repository to GitHub; New Project → Deploy from GitHub repo. Nixpacks detects Node and runs node server.js from railway.json.
2. Add a volume mounted at /data and set DATA_DIR=/data. Without it every redeploy loses the OI history.
3. Set ADMIN_PASSWORD, then the optional keys above. Do not set PORT.
4. Settings → Networking → Generate Domain; set PUBLIC_URL to it so push and Telegram links resolve.
5. Open the domain: the first account is created at /bootstrap with ADMIN_PASSWORD. Mint invites from Admin › Access.

Keep the service always-on: the whole benefit is the warm cache. Redeploys keep the OI history and candle archive; only stale spines are re-fetched. The build stamp in the status line is how you tell a fresh deploy from a stale one; every asset URL carries it, so a browser can never run last build's client against this build's API.

Tests, lint, bench

npm test          # node:test, one file per module and area under test/, in parallel
npm run test:cov  # the same with Node's coverage table (what CI runs)
npm run lint      # ESLint flat config: server (CommonJS), client (ES modules), service worker
npm run bench     # event-loop cost of the poller's synchronous builds on a synthetic 150-market book

CI runs npm audit, lint and the covered test suite on every push and pull request. Many tests are pins: they read the source and assert that a convention still holds (every tab has a feature entry and a help entry, every inline script gets a nonce, every level ships from the server), so a change that breaks a contract fails the suite by design.

Project layout

server.js            Fastify server: /public, the JSON API, auth, SSE, CSP, the docs routes
src/hyperliquid.js   REST client + weight-based rate limiter, WebSocket feed, Coinalyze
src/compute.js       stats and feature extraction, event studies, calendars, the feature manifest
src/poller.js        every data lane, the snapshot build, the ledger, alerts, Telegram, AI
src/webhooks.js      member webhook channels: URL/SSRF rules, pinned delivery, the webhook outbox
src/store.js         persistence on the volume
src/oihist.js        the in-memory OI/funding history, columnar
src/accounts.js      SQLite: members, invites, messages, prefs, wallets
src/sectors.js       curated sector / industry / display-name tables
public/index.html    the app shell · public/docs.html this manual
public/app.js        client entry; public/js/*.js one ES module per area
public/styles.css    styles · public/sw.js install-only service worker
test/                node:test suites · docs/ design notes and reference pages

16. Security model

• Sessions are stateless HMAC tokens in SameSite=Lax, HttpOnly cookies carrying the account id and a per-user epoch. Bumping the epoch (password reset, disable, sign out everywhere) invalidates one person's sessions only.
• Two gates, in order. The site gate answers 401 to anyone without a session (the login page for pages, JSON for the API). The feature gate, registered last, answers 403 to a route whose owning feature is closed to the caller. Routes no feature claims pass through. The escalation path (health, login, logout, the AI unlock pair, /api/features) can never be closed by a flag write.
• Two locks on every privileged write. The manifest gate decides audience visibility; the handler's own admin check decides authorization; both must pass. Opening a tab to the group can never hand the group its write verbs.
• Cross-site writes are refused before any handler runs when the browser says the request came from another site (Sec-Fetch-Site: cross-site).
• Headers on every response: nosniff, X-Frame-Options: DENY, same-origin referrer, HSTS over HTTPS, and a per-request-nonce Content-Security-Policy (enforced; CSP_ENFORCE=0 sends it report-only; violations are counted on /api/health either way).
• Server errors say nothing about the server: every 5xx body is {error:"internal", id}, including errors raised while the response is being sent, and the id finds the stack in the log. The log keeps at most five such lines per client per minute, then one line counting the rest; the responses themselves are never held back.
• Login throttling: eight wrong passwords from one IP lock it for 15 minutes, keyed on the trusted proxy's forwarded address. Reset codes are capped and the reset page never reveals whether a handle exists. A failed passkey assertion counts like a wrong password.
• Passkeys (WebAuthn, @simplewebauthn/server): only public keys and signature counters are stored. Every challenge is single-use, expires in 5 minutes, and is bound to its ceremony, its account, its origin and the browser that asked. The origin and RP ID come from PUBLIC_ORIGIN / PUBLIC_URL, never from the Host header alone. A counter that goes backwards (a cloned authenticator) is refused and logged. Adding or removing a passkey needs a fresh password or passkey check, and so do the operator's account-takeover-shaped powers (clear passkeys, the operator requirement off, a reset link for oneself or a passkey-guarded account); removing a passkey or turning the requirement on ends every other session. In-flight challenges are capped per source — per address at the sign-in door, per account for a member's own ceremonies, in separate pools — so one caller can only ever evict its own; an expired or evicted challenge is not counted as a failed sign-in. A required passkey survives a password reset; only an operator's audited clear passkeys lifts it, and break-glass ADMIN_PASSWORD remains the operator's way back in. WebAuthn needs no CSP source (the browser's own credential manager, not a fetch), and no Permissions-Policy header restricts it on this origin.
• Invites burn inside one database transaction; codes never reach a Referer header or the history. Attachments are typed by magic-byte sniff and non-image files are served as downloads with a sandboxed CSP. Text a member typed is escaped everywhere it renders, including inside inline scripts (the JSON is HTML-safe).
• Wallets are public addresses; the app reads clearinghouse state and holds no key.
• Operator read-through is a separate, admin-gated, audited surface (see Admin), and members are told.
• Rate budgets: a weight-based limiter keeps Hyperliquid calls under the per-IP budget; FRED, Finnhub and EDGAR lanes are paced to their published limits; AI spend is metered per user and per group.

17. Glossary

HIP-3 · xyz

Hyperliquid's permissionless perp-deployment standard; xyz is the dex whose synthetic equity, index, FX and commodity perps this monitor covers. The "main dex" is Hyperliquid's native crypto book.

Perp · mark · oracle

A perpetual future has no expiry; funding payments keep it near the reference price. The mark is the perp's own price; the oracle is the reference (the cash market, frozen near the last print while that market is closed). Prem is the gap between them.

Funding · APR · carry

The hourly payment between longs and shorts. Shown annualized (×24×365). Positive = longs pay. Carry is window-average funding per unit of realized vol.

OI · ΔOI · regime tag

Open interest — standing positioning. Its change with price tells one of four stories: longs+, squeeze, shorts+, unwind.

Window

The selected lookback (1h–30d) every windowed column shares.

RVOL

Relative volume, clock-hour matched against the prior month.

vs tape · DownCap · Hit%

Relative strength against the universe median; the share of red-tape moves a name ate; the share of red-tape bars it beat the median.

Momentum · MOM+

The board's −100…+100 score, and its candidate under adjudication.

Squeeze · OI/Vol

Short-squeeze susceptibility; standing positioning relative to daily flow.

Gap · overnight · cash session · home session

The close→open move; the hold from close to open (and Friday to Monday); the open→close hold; the exchange whose clock a foreign-listed name's session follows.

Signal · claim · ledger · record

An unusual condition; the frozen entry/void/target it was scored against; the store of every claim; the out-of-sample outcome statistics.

Void · target · R · R:R · EV

The level that invalidates a claim; where it aims; one unit of risk (entry-to-void distance, or 1σ where levels are σ-built); reward-to-risk; expectancy in R.

Prime · confluence · decay · re-arm

A high-quality signal at fire; same-side agreement across conditions; the fade past horizon; the one-episode-one-claim gate.

Shadow · variant · promotion

A candidate threshold or strategy ledgering silently; the process by which one replaces the incumbent on out-of-sample evidence.

Setup · CONFIRMED

An open claim on the Actionable board; one that clears the record and geometry gates and is announced as an alert.

BMO · AMC · DMH · TBD

Earnings sessions: before the open, after the close, during hours, date known but session not.

13F · N-PORT · Form 4 · PTR · 8-K

Quarterly institutional holdings; monthly fund holdings; insider transactions; congressional Periodic Transaction Reports; a material-event filing.

TGA · ON RRP · H.4.1 · SOFR · IORB

The Treasury's account at the Fed; the overnight reverse repo facility; the Fed's weekly balance-sheet release; the overnight funding rate; interest on reserve balances.

EMA 13/21 · rung · retest

The trend ribbon; one of its four timeframes; a pullback into the ribbon that held.

Scope · universe · lane

Stocks or crypto; the set of markets in a scope; one server-side data or scan loop.

Feature key · act · scope key

A tab's visibility switch; a write verb's switch; a per-universe slice of a tab.

Snapshot · spine · archive

The cached table; the hourly candle series every feature is built on; the SQLite candle store.

18. Troubleshooting

The dot is amber and "updated" is minutes old.

The server's poller stalled or Hyperliquid is rate-limiting it; the browser is fine. It recovers on its own; an operator sees the ops alert and the health endpoint.

A column shows dashes.

Read the hover. Usually: history still backfilling after a deploy (hourly features fill within ~10 minutes), a coin or stock younger than the column's window (a long MA, YTD), a baseline that does not qualify (RVOL on 7d/30d, DownCap under 20 matched bars), or a feed key the deployment lacks.

A tab I used to see is gone.

The operator changed its visibility, or you flipped to a scope where it has no meaning. Gated tabs are absent, not hidden.

I see the wrong build / a stale UI.

Compare the build in the status line with the latest delivery. Every asset URL carries the build stamp, so a hard reload always fetches the current client.

The refresh selector does nothing.

Correct while the status reads push live: updates arrive as the server has them, and the selector only paces the fallback poll.

No Telegram alerts arrive.

Check the bell's Delivery section: linked, the class enabled, not inside quiet hours, not at the hourly cap (held messages are disclosed). The panel log shows Telegram's own error text. /status to the bot reports what it thinks.

The regenerate button on a report is disabled.

The report is fresh for everyone; the freshness line counts down to the cooldown, or names the material change that unlocked it. The server enforces the same rule with a 429.

The AI answered with 🔒 / "budget".

Generation is locked or the group pool for today is spent; an operator can admin unlock or admin reset-reports. Your own daily cap is separate.

My phone shows different columns than my desktop.

By design: the phone layout draws ticker, price and the one number you pick over the list; your column set is untouched (CSV export and the desktop layout still use it). On the desktop layout, the first phone visit starts from the mobile preset and the active layout is per browser. Saved layouts and the watchlist sync.

A note or message "moved" after I edited it.

It did not: the timestamp and the price stamp are written once; only the words changed, and the edit is disclosed.

I lost access after a password reset.

Intended — a reset signs out every other device. Sign in again with the new password.

My password reset asked for a passkey, and I have lost it.

Intended — a reset changes the password, not the passkey requirement. Ask an operator to clear passkeys on your row in Admin › Access (audited); then your password signs you in alone and you can register a new passkey.

19. Further reading

Longer reference pages, served from the same site and gated the same way:

• Explainer — the plain-language tour for people using the terminal: what each screen is for, what the numbers say, what is yours, what the app will not do.
• How to use this site — feature by feature: the value of each, the steps to use it properly, worked examples, and a daily routine.
• Signal, study & shadow reference — every event, threshold, stamp and knob, on four axes: trigger, measurement, display, alert.
• Feature map — every feature with its scope, audience and the code that owns it.
• System map — how the lanes, stores and surfaces connect.
• Mechanics — the computations behind the columns and studies, in detail.

The reference pages describe the engine as of the build noted on each; the code and its test pins remain the source of truth. This manual is regenerated with the app and its build stamp is at the top of the page.

Not investment advice. Everything here is a description of what the software computes and shows.