Wednesday, July 29, 2026

The risk calculator had been sizing trades against a price from two months ago, and reporting success every time.

Building a live market heatmap meant building a real quote feed, and building a real quote feed surfaced a production bug that had been running quietly for two months: a price endpoint answering with a fifty-nine-day-old number at a success status. Both the feature and the fix went live.

Shipped

• A fifty-nine-day-old price, returned as fine — the price endpoint had a stale-cache fallback with no upper bound, so when its data source died it kept serving the last number it ever saw, indefinitely, at a success status. The risk calculator was sizing positions against a two-month-old price and reporting no error. The fallback is now bounded, which is what makes a permanently dead source distinguishable from a momentary blip
• A heatmap built here, because every embed is end-of-day — checked four of the ready-made market heatmaps during open market and every one reported end-of-day data, with blocks that didn't move across four minutes. Built a real one instead: a squarified treemap fed by live quotes
• A quote feed with a failover — one source primary because it takes five times as many symbols per call and reports its data as real-time, a second behind it as failover. Worth knowing the second banned the machine's address about three hours into a single afternoon of development traffic, with no guidance on when it would lift
• Ten-minute cache, deliberately — freshness beyond what the page needs is the cheapest possible defence against an undocumented rate limit
• Real print time, in the reader's timezone — a relative label like "just now" is a lie every minute the market is shut; the page shows the actual time the price printed
• The heatmap live on paiddaily.io — the hero is now a fifty-fifty split, pitch on the left and the live intraday map on the right, verified in a browser with every block rendering and a clean console
• List creation gated — the create-a-watchlist action is limited to the accounts that should have it, using a role the identity system already carried
• One redistribution question answered by reading the terms — a broker feed that would have been convenient forbids passing quotes to non-clients, so it's off the table for a public page. Filed instead as a feature where each account connects its own broker, which is the sanctioned shape of the same idea
• The production service had run fifteen days without a reload — meaning anything merged in that window only went live today. Worth auditing what else was dark

Notes

An unbounded stale-cache fallback is one of those decisions that looks like defensive engineering and is actually the opposite. The intent is obvious and reasonable: if the upstream source blips, serve the last known price instead of failing the request. Applied to a blip, that's exactly right. Applied without a limit, it converts a total permanent outage into a normal-looking response, forever — and it does so in the one place where being quietly wrong is most expensive, because a risk calculator's whole job is to size against a number taken on trust. The bug wasn't the dead source; sources die. The bug was that nothing in the system could tell the difference between "this data is a few seconds old" and "this data is from May." A bound turns that back into a real error, which is worth far more than the availability it costs. The heatmap was the feature; the fifty-nine days was the finding.