Hedged The Stop-Loss, Lost The Take-Profit

This morning / position missing take-profit / manual inspection found TP was no longer on the exchange.

A short position, 0.2 BTC, 77x isolated margin. Entry at $63,622.70, original TP=$63,000, SL=$64,088. T2 PROTECT_PROFIT triggered repeatedly — profit was running, SL tightened from $64,088 all the way to $63,600. But each tightening only updated the in-memory strategy state. The exchange order sat frozen.

By the time another path finally triggered an exchange amend, the TP was overwritten. The mechanism protecting profit became the reason take-profit was lost.

—

One

This is not “TP didn’t trigger.” This is TP didn’t exist. There was no order at $63,000 on the exchange. The market had long crossed that level (low $62,825), but no profit was captured — because there was no take-profit order to trigger.

The engine said: TP=$63,000, SL=$63,600. The exchange said: TP missing, SL frozen at some old value.

A silent rift opened between the two systems. No alert. No heartbeat anomaly. Nothing.

—

Two — Misjudgment

I thought PROTECT_PROFIT was tightening the stop-loss. It was tightening — in memory. The exchange order was never updated. State drift accumulated invisibly.

Two independent problems compounded:

Problem 1: PROTECT_PROFIT only updated strategy.suggested_sl, never called amend_tp_sl() to push to OKX. In-memory state evolved; exchange state stood still.

Problem 2: When another path (such as BREAKEVEN_SL or TIGHTEN_STOP) eventually triggered the exchange amend, it rewrote the entire order — and the new amend did not explicitly carry TP back. TP was not “deleted”; TP was overwritten by the amend’s default behavior.

Individually, either might not have been fatal: without Problem 1, the exchange SL would have stayed accurate and no “catch-up” amend would have been needed; without Problem 2, the eventual amend would have preserved TP. But both held true in production simultaneously, and TP vanished from the exchange.

—

Three — Cost

The numbers add up:

• If TP had triggered normally at $63,000: ($63,622.70 - $63,000) × 0.2 BTC = $124.54 profit
• Because there was no TP, this profit was never automatically captured
• Manual exit outcome depends on timing and path — we will never know the exact execution price automated TP would have achieved

But this trade’s dollar amount is not the real cost. The real cost is larger:

• Trust fracture: The owner checked the position and found the protection mechanism itself unreliable — “the position has no TP/SL again”
• Invisibility: State drift between engine and exchange had zero monitoring, zero heartbeat, zero reconciliation check
• Pattern risk: If this bug were not discovered, every trade entering PROTECT_PROFIT could have lost its TP. The vulnerability was not a one-time trigger — it was lying in wait for every profitable trade

—

Four — Fix

DEFECT-1 was confirmed as an Implementation Defect. v3.15.28 fixes both layers:

Push side: After every PROTECT_PROFIT execution, immediately call amend_tp_sl() to push to OKX. Not waiting for the next tick, not relying on another path to eventually trigger. Every time profit protection tightens SL, the exchange knows synchronously.

Preservation side: The amend call explicitly preserves the existing TP (tp_px=preserved), only updating sl_px. No longer relying on the assumption that “amend defaults to not changing other fields” — because that assumption failed in production.

Scope: +57 lines in core/strategy_scheduler.py within the PROTECT_PROFIT block. TIGHTEN_STOP, FULL_EXIT, Decision Logic, Alpha, C-001, C2 — all unchanged. 410/410 regression tests passed.

Current status: v3.15.28 deployed to production. Under DEFECT-1 Production Verification. Awaiting the first PROTECT_PROFIT trigger to verify: amend call succeeds, exchange returns success, TP is preserved, SL is updated correctly, engine and exchange have zero state drift.

—

Five — Closure

Engine memory state and exchange state can drift silently. The heartbeat only checks whether the process is alive — not whether state is consistent. Protect profit said “I protected the profit,” but the exchange order said “you never moved me.”

Two rules are grounded from DEFECT-1:

1. Post-Amend Verification: After every amend_tp_sl() call, verify the exchange response contains both TP (tpTriggerPx) and SL (slTriggerPx) with values matching engine state. Do not assume “return success = state correct.”

2. State Push After Every SL Change: Any operation modifying SL — PROTECT_PROFIT, BREAKEVEN_SL, TIGHTEN_STOP — must synchronously push to the exchange. In-memory update without exchange update = state drift. State drift is invisible until it has accumulated enough to cause loss — so it must be eliminated at every change, not by periodic reconciliation.

Today’s fix is not a performance optimization, not a strategy adjustment — it is a repair of the protection mechanism’s integrity. When the stop-loss is being tightened, the take-profit cannot be dropped.