\n\n## English Version\n\n**I Thought It Was Open: Ghost Position After Gate Veto**\n\nv3.15.38-alpha01 / C-ALPHA-01 vetoed a strategy / engine restarted. Journal showed EMERGENCY_CLOSE with decision_id=\"\". FSM recorded IDLE. Exchange had no position. Triple cross-validation revealed: the strategy was vetoed at the entry gate but never cleaned from disk. On restart, the scheduler unconditionally assumed the position was open — a ghost position.\n\n**Section 1 — Veto Without Cleanup**\n\n2026-07-20 23:22:48 UTC. Tier1 created strategy btc-20260720-7366a2b5. The signal loop passed through C-ALPHA-01 gate: depth imbalance triggered a veto. FSM transitioned PRECHECK → IDLE \"alpha01_depth_imbalance_veto\". Position was NEVER opened. notify_position_opened() was NEVER called.\n\nThe strategy remained on disk. No code cleaned it up.\n\n**Section 2 — Restart Assumes Truth from Stale State**\n\nThe engine restarted at ~00:11 UTC. RecoveryEngine correctly restored FSM=IDLE (exchange had no position). Scheduler.start() loaded the pending strategy from disk — plus stale scheduler_state from the prior run (position_open=True, entry_decision_id=\"\").\n\nstrategy_scheduler.py:549 executed unconditionally — setting position_open=True and entry_decision_id=\"\" for any strategy with status pending. The code assumed: strategy file exists + prior state had position → current strategy represents an open position. This assumption is false when the strategy was vetoed.\n\n**Section 3 — The Misjudgment**\n\nI assumed the gate veto was complete. FSM returned to IDLE. The signal file was cleared. The strategy file was harmless residue.\n\nIt wasn't. The strategy file is input to the scheduler's recovery logic. The scheduler interpreted \"pending strategy exists\" + \"stale position_open=True\" as \"position is open\" — and triggered T2 reviews that generated EMERGENCY_CLOSE entries every ~5 minutes.\n\nState is stored in a two-component system: FSM (correctly reset) + strategy file (not cleaned). Cleaning one component and leaving the other created a recovery-time inconsistency.\n\n**Section 4 — The Cost**\n\nBetween Jul 20 and Jul 21 2026, the journal recorded 6 ghost position events across 5 unique strategies:\n\n- Jul 20 08:02 UTC — btc-20260720-5f982212\n- Jul 20 12:00 UTC — btc-20260720-4aee531c\n- Jul 20 12:59 UTC — btc-20260720-4aee531c (same strategy, second occurrence)\n- Jul 20 15:51 UTC — btc-20260720-180e794b\n- Jul 20 15:56 UTC — btc-20260720-180e794b (same strategy, second occurrence)\n- Jul 21 00:16 UTC — btc-20260720-7366a2b5\n\nEach ghost triggered an EMERGENCY_CLOSE every ~5 minutes with reason \"ghost_position: has_position=False\" and an empty decision_id. T2 Observer (v3.15.29) suppressed actual close orders — no PnL loss. But every ghost generated noise, contaminating the journal and breaking tri-state consistency.\n\nThe real cost isn't dollars — it's signal. Every ghost EMERGENCY_CLOSE entry made real events harder to detect. When decision_id is empty, the post-hoc evidence chain is severed.\n\n**Section 5 — Cognitive Closure**\n\nThis is not a missed edge case. It is a systematic state-consistency failure.\n\nThe engine has two sources of truth: FSM (runtime) and strategy file (disk). The gate veto correctly reset FSM. It never considered the strategy file — because it's not FSM. But the scheduler reads both sources on recovery. When one is clean and one is dirty, it picked the dirty one.\n\nThe cognitive pattern: Single-source completion bias. After confirming FSM was reset (visible, verified), the brain closed the \"state is clean\" task. The other state store — the strategy file — was invisible to the veto code. Not in the same function. Not in the same file. Not in the same concern domain.\n\n**Section 6 — Extractable Protections**\n\nRule 1: Gate veto MUST invalidate the strategy on disk. After every fsm.transition(IDLE, veto_reason) in _handle_signal(), the strategy file must be invalidated or removed. No pending strategy should survive a veto.\n\nRule 2: position_open at restart MUST be verified against exchange. The scheduler shall not assume position_open=True unless exchange confirms a position exists. On-disk state is cache, not ground truth.\n\nRule 3: Scheduler state older than a configurable TTL MUST be discarded. Without TTL, stale state survives restarts indefinitely.\n\n—\n\nThis wasn't a production outage. No money was lost. But it exposed a systematic gap in state management — cleaning one data store while leaving another at the application-logic level. The same pattern will reproduce in any two-component system with cross-store recovery. The fix isn't for this strategy — it's for ensuring no vetoed strategy ever survives to a restart.\n\n
", "wordCount": 7720, "related": [] }