Part III: The machine

8. Price, and the 24/7 mark

Every market in Float prices off one reference, and everything else bends around it. This is where it comes from, who supplies it, and what happens when they stop.

8.1 The hub

contracts/src/OracleHubMedian.sol. Posters submit a price, a timestamp and a marketOpen flag per asset. getQuote takes the median of the submissions that are still fresh, where fresh means within posterFreshWindow, 12600 seconds today, and up to MAX_POSTERS of 15 may be registered.

Two details of the median matter more than the median itself.

The timestamp travels with its price. The sort is by price and the timestamp moves with the entry it belongs to, so the age you read is the age of the median submission, not the newest one. With two posters that is the older of the two, which means the quote is only as fresh as the slowest poster. This is not theoretical: one poster was installed with a heartbeat six times longer than intended, and although the other was posting exactly on schedule the whole board read about 28 minutes stale and was minutes from falling out of its freshness window. Both services reported healthy and both logs looked fine. The lesson is in the runbook: check the age getQuote returns, not whether the process is running.

Losing quorum does not fail loudly, it fails closed. Below minPosters, getQuote hands back the last known price with its age forced to DEGRADED_AGE and marketOpen false, so the Desk's own staleness check flips the market to settle-only. Exits keep working and nothing new opens. An asset that has never been posted at all reverts NeverPosted rather than returning a zero anyone could mistake for a price.

minPosters is 1 today, deliberately. Three posters are registered but only two carry all thirty-six, so a quorum of two would still mean either of those two going down puts every market into settle-only. It is raised when a third poster covers the full set, not merely when a third address exists.

8.2 Where the price comes from

Three registered posters, on separate hosts. Two of them carry the whole set and read different vendors, so one vendor being wrong or unreachable does not move the mark on its own. The third posts a single asset.

That third one is worth knowing about rather than rounding to "three posters", because it is the median timestamp above made concrete. Read just now, NINTENDO had three fresh submissions: 3,177 and 3,442 seconds old from the two vendors, and 16,355 from the third. getQuote reported the price as 16,381 seconds old, because the age travels with the median entry and not the newest. Two posters under an hour, a quote reading four and a half hours. Nothing is broken and nothing would alert; that is simply what a median of three does when one member is slower, and it is the reason to read the age the hub returns rather than to count healthy processes.

The vendor split is forced rather than chosen, and it is worth knowing why, because it constrains where a third poster can live. EODHD is unreachable over IPv6, and val2 is IPv6 only, so val2 can never be the EODHD poster. GitHub is IPv4 only from there as well, which is why tooling has to be copied onto that box rather than installed.

Japan does not price directly. EODHD does not carry Tokyo on the All World Extended plan. It carries the US lines of the same companies, so a Japanese name is priced through its ADR and converted back:

Nintendo mark  =  NTDOY price  /  0.25 ordinary shares per receipt

The ratio there is the same sharesPerUnit the reserve uses, and it is verified from live prices for the same reason. So the ADR ratio appears twice in this system, once in custody and once in pricing, and an error in it would move both the backing and the mark in the same direction, which is precisely why it is checked continuously rather than read from a fact sheet. A Nikkei futures line sits behind that as a further fallback.

8.3 The deadband

A poster that writes every asset on every tick spends a straight product of assets times cadence. At a 36 name genesis set on a five minute tick that is roughly $15,000 a month of gas to re-post numbers that did not change.

So a post happens when either is true:

• the price differs from the last posted price by MIN_MOVE_BPS, 10 today;
• the last post is older than HEARTBEAT_MS, which must stay comfortably under the smallest maxStaleness in use, 14400s on every live market today, rather than equal to it.

The first post of an asset always goes through. The record of what was posted is written only after the post returns without throwing: writing it earlier would mark a failed post as done and suppress its own retry until the next heartbeat, which is the one failure a deadband can introduce that posting everything cannot.

8.4 The premium, and the 24/7 mark

On top of the reference the Desk carries a premium of its own, and that is what moves the price when the home exchange is shut:

• a buy pushes it up, a sell pushes it down, scaled by trade size over the cap;
• it is clamped to a band, zero in hours and plus or minus 300 bps at night, so the token cannot drift away from the company;
• it decays at 100 bps per hour back toward the reference.

So at 2am the price is the last print plus whatever the night's flow has pushed it to, bounded and decaying. At the home open the band closes to zero and the reference takes over, which is the snap-to-print the essay describes. That is the honest version of round-the-clock price discovery for an instrument whose underlying is not trading: flow moves it, and the movement is bounded by how wrong the market is willing to let it be.