This week on Nexus 08.07.26

Public analytics no longer reports individual accounts, market history now says when it does not know rather than showing an empty market, and an API key is valid on exactly one network — while behind the screen, every candle written to cold storage is checked against the live fold and a service that loses its configuration stops instead of guessing. Here is what shipped.

Merged pull requests by area this window — activity, not performance: 69 merged feature, fix, and performance pull requests across the Exchange, 52 in orders and accounts, 8 in API and data, 5 in frontend, 2 in the engine, and 2 in oracle

Testnet accounts across the daily snapshots — faucet-funded, ephemeral testnet accounts that reset on redeploy, not production figures: 28 testnet accounts on the August 5 snapshot, 25 a week earlier, on the July 29 snapshot, 25 on the July 30 snapshot, before a redeploy reset the testnet, and 10 on the July 31 snapshot, immediately after that reset

Trading

• Screener filters, and a sort where blanks sink. The screener filters and sorts on totals, with null values sinking to the bottom instead of sorting as zero.
• A screener view you can send someone. The filters and sort you set encode into the URL, so a view can be shared or reloaded as it was.
• The spread holds still while the market maker requotes. The order book keeps a stable spread through a market-maker requote, so the top of book stops flickering between quotes.
• Rolling volume comes back with the fills. The BFF relays fills together with a computed 14-day volume, so the rolling figure arrives with the trades that produced it.

Market history

• History says when it does not know. An absent coverage header now means “we do not know how far back this goes” rather than “nothing traded”, so a gap in coverage no longer reads as an empty market.
• Every stored candle is checked against the live fold. Each candle written to cold storage is reconciled against the hot fold it came from, so drift between the two is measured rather than assumed to be zero.
• No captured fill leaves the tape unsignalled. Every fill leaving the capture tape carries a signal, so fills dropped at shutdown are recorded instead of disappearing quietly.
• A candle that cannot be stored is refused. A candle whose market id cannot be a valid document id is rejected rather than written.
• The coverage headers survive the proxy. Both candle coverage headers are forwarded through the web proxy, so the browser sees the same coverage signal the API sent.

Accuracy on screen

• A conversion that failed no longer reads as zero. The indexer stops substituting a silent zero when a decimal conversion fails, so a number it could not convert is not shown as a real one.
• NDQ-USDX-PERP comes off the site. The market is dropped from the prerendered market list and from the landing-page transcript.

Price feeds

• An absent feed reads as absent, not as zero. Oracle monitoring records a missing feed signal as null rather than 0.0, so a feed that is not reporting no longer charts as a price of zero.
• One vendor out of every config. Stork is removed from every oracle configuration, so no environment still carries it.

Privacy and access

• Public analytics stops reporting individual accounts. Per-account risk surfaces are removed from the public analytics page; it reports the venue, not the accounts trading on it.
• An API key is valid on exactly one network. Keys are scoped to their environment, so a key issued for one network is rejected on another instead of working across both.
• Agent registration is checked against the chain that was signed for. The indexer verifies a registration against the chain the client signed, so a registration signed for one chain is not accepted on another.
• Agent registration completes behind Cloudflare Access. Registration no longer fails when the request arrives through Cloudflare Access.
• The interface and the backend agree on which writes are exempt. Bridge wallet writes that the backend exempts from the write restriction are exempt in the interface too, so the two do not disagree about what is blocked.

Deposits and withdrawals

• An unset credit cap stops the watcher. The deposit watcher fails closed when the per-address credit cap is unset, rather than crediting with no bound in place.
• Registered withdrawal wallets come back from the bridge endpoint. The bridge endpoint returns the withdrawal wallets an account has registered, which the API spec already declared.

Safety and reliability

• Only the coordinator writes. The indexer’s three write-side singleton roles run on the coordinator alone, so two replicas cannot both take the write path.
• Shutdown finishes inside its budget. The indexer’s shutdown budget fits inside the orchestrator’s grace period, so a drain completes instead of being cut short by the kill.
• A restored market is gated on its own. A market restored from a snapshot is gated individually rather than holding the whole venue closed.
• Misconfigured history storage fails closed. A cold-data configuration failure stops the service instead of falling back to an in-memory tape or running without the funding database.
• A failure is not cached. Server-error responses no longer carry a cache header, so an error is not held and served again.

Developer tools and SDKs

• One network axis in the CLI. The CLI adopts the mainnet, testnet, and local network axis as a breaking change, with the migration in its own release notes.
• Paged requests actually page. The TypeScript client follows the next-cursor header, so a paged request returns the following page instead of repeating the first.
• The bridge, in TypeScript. The TypeScript client wraps the first phase of the bridge endpoints — assets, deposit addresses, and deposits.
• Post-only from the command line. The CLI accepts --tif post-only.
• A command with nothing behind it is withdrawn. nexus account margin-mode is removed as a breaking change, because no endpoint backs it.
• Four official clients, one spec. Rust, Python, TypeScript, and the CLI are the official clients, and each is checked against the same pinned API spec.

Behind the scenes

Market-history capture is enabled in a development environment; the writer stamps a capture-start marker when it starts, the on-disk tape is indexed, candles are no longer folded from windows too short to support them, a bounded candles request is answered from its own window with cold data off, and the sustained-drop warning is rate-limited on a monotonic clock. The engine publishes settlement-apply latency and throughput, exports per-market write-ahead-log progress, and gives four previously undescribed metrics a description.

Elsewhere: work landed on access control and on how services address one another. Plumbing, mostly — the kind that decides whether the next change is safe to make.