Methodology & Rulebook

Historical base rates — 54 events, 1974–2026

Base rates from the 54-event catalog: roughly one qualifying event (close ≤ −5%) per year since 1974. Of the 54: 27 stopped short of −10% (half of all events die in the speculative band), 20 landed in the 10–20% fundamental-repricing band, and 7 went past −20% into capitulation. Median event depth ≈ 10%. Every capitulation-class event carried at least one of: major credit widening, a Sahm recession signal, or constrained policy — the deepest (GFC, −56.8%) carried all three.

The failed-recovery router — why 30/60 trading days

The failed-recovery router is the system’s behavioral centerpiece. On the first −5% close it opens two windows: 30 trading days to regain the peak, 60 to avoid a lower low. Clean recoveries (regain inside 30td, or 60td passes without a lower low) extended to ≥10% only 7% of the time in the 1990–2022 cohort; failed recoveries extended 58% of the time. Three crashes (1990 January, Volmageddon, COVID) hit −10% before the window could resolve — when the router is moot, speed itself is the signal.

Depth engine — why a range and never a point

In Tier ≥ 2 the depth engine publishes an estimated further-decline range — never a point estimate (the return type has no point field). Four frozen stages: (1) seller-class base band from the event-register tag — speculative 1–5%, fundamental 5–15%, capitulation 15–50%; (2) cascade scoring — red flags (credit, Sahm, breadth, failed recovery, policy) vs green flags (credit quiet, policy free, stable claims, regain attempt) shift the range to the upper or lower half at net ±2; (3) valuation adjustment — analog-event P/E ratio, clamped ×0.5–2.0; (4) policy overlay — CONSTRAINED forces the upper half. Each range ships with the invalidation close that exits the tier.

Global context — correlated international markets

International indices are tracked because correlated selling across regions distinguishes global repricing from a local shakeout: 1987 was a worldwide crash, 1997–98 arrived through Asia and Russia/LTCM, 2010–12 through the euro area, 2015–16 through China’s devaluation, and the Aug-2024 unwind through the yen carry trade. The panel shows each index’s drawdown from its own 6-month closing high and its trailing 60-session correlation of daily returns with the S&P. High correlation + synchronized drawdowns = global confirmation; a US drawdown the rest of the world ignores points to a domestic, usually shallower, catalyst. Two caveats: Asian and European sessions close before New York, so same-date correlation understates their lead; and correlations themselves surge toward 1 in every cascade (they are partly a symptom). Context only — like VIX, this panel can never move the tier.

Falsifiability — FP ledger and retirement criteria

The system is built to be falsified, not defended. Every TRIGGERED / FIRED / ESCALATE reading opens a 9-month outcome window in the false-positive ledger (did a ≥10% event follow?). Pre-committed retirement criteria fire Slack alerts that propose — never apply — suspension: credit impulse after 3 consecutive live triggers with no ≥10% event; Sahm after a 2nd consecutive FIRED with no recession in 12m; the router if live P(≥10%|ESCALATE) drops below 35% over any 10 escalations; rate shock after 2 failed combined flags. Tripwire and state logs are append-only at the database level, and an annual January export re-runs the backtest against the year’s live readings.

Governance — why the thresholds cannot drift

Thresholds are frozen at the Postgres level: UPDATE/DELETE on a frozen row is rejected by trigger. The only mutation path is a written justification (≥50 chars) → 48-hour minimum cool-off (DB-enforced) → countersignature by a second person (proposer cannot countersign; DB-enforced) → an apply RPC. Portal and worker both verify at load that live thresholds match the committed constants and abort on any divergence without a countersigned change.

Tier reference

The frozen-threshold rulebook

These 16 numbers are everything the state machine runs on — every card on the dashboard is a comparison against one of them. They were fixed by the 50-year backtest before the first live reading, and the “backtest basis” column is each number’s evidence. They are frozen at the database level: edits are rejected by trigger, and the only change path is a written justification, a 48-hour cool-off, and a countersignature from a second person. The worker and portal verify on every run that the live values match the committed constants — so this table is provably what is running, not documentation that might have drifted.