KapitaalBot

Changelog

Website-Updates und vollständige Bot-Historie (Git).

Website (März 2026)

  • Changelog-Seite; Navigation.
  • Freshness-Indikator (GOOD/WARN/STALE), Null-Handling.
  • Dashboard: Metrik-Karten, sortierbare Markttabelle, Regime-Stacked-Bar.
  • Homepage: Hero, Warum / Wie Observability, Tier-Modell.
  • Tier2-Anfrage: POST /api/tier2-request, Rate-Limit.
  • Compliance-Banner pro Sprache (Cookie).
  • Admin: Snapshot-Status + Raw-JSON (Tier 3).
  • SEO: OG/Twitter, robots, Sitemap, JSON-LD.
  • Error Boundaries (error.tsx, global-error.tsx).

Changelog — Trading-Engine (Git)

Jeder Commit im Bot-Repository (KRAKENBOTMAART). Datum/Uhrzeit = Git-Committer-Zeitstempel. Beschreibung = Commit-Message; derselbe Text erscheint in allen Sprachen, bis manuelle Übersetzungen ergänzt werden.

Snapshot erzeugt: Freitag, 3. April 2026 um 17:03:13
845 Commits
/srv/krakenbot

  1. 234c5e3
    fix: resolve v2_marginal_pending to admitted/rejected in CDV after V2 eval
    Mehr im Commit-Body
    admission_source was always written as v2_marginal_pending but never updated
to the final outcome. Now resolves to v2_marginal_admitted or v2_marginal_rejected
after the marginal slot cap, using a two-step UPDATE (admitted first, remaining
as rejected). Applied on both eval paths in live_runner.

Made-with: Cursor
  2. 9c761e8
    fix: resolve orphaned open-order deadlock in check_symbol_execution_lock
    Mehr im Commit-Body
    Stale/orphaned orders (e.g. acked_open with no fill after crash) permanently
blocked new entries because the open-order count check ran before ghost
exposure reconcile. Now detects orphaned orders using a triple proof:
DB position flat + exchange balance flat + order age > threshold (default 5m).
Reconciles proven orphans to terminal status before the final lock decision.

Proven case: RAILS/USD order #1232 stuck acked_open since 2026-03-29.

Made-with: Cursor
  3. 3a1eab3
    feat: add admission_source column to candidate_decision_vectors
    Mehr im Commit-Body
    Tracks admission provenance per CDV row: readiness (tradable=true),
v2_marginal_pending (marginal band, V2 eval pending), hard_blocked.
Migration adds nullable TEXT column; Rust struct + INSERT updated.

Made-with: Cursor
  4. 78d6b78
    feat: add MAX_MARGINAL_ADMITTED_SLOTS cap for marginal-band trades
    Mehr im Commit-Body
    Caps the number of concurrent marginal-admitted execute candidates per
evaluation cycle (default 2, env-overridable). Readiness-admitted
candidates are never capped. Logs MARGINAL_SLOT_CAP when trimming.

Made-with: Cursor
  5. 50fab30
    feat: fanout gate passes marginal symbols when EDGE_ENGINE_V2 active
    Mehr im Commit-Body
    When V2 is enabled, symbols in the marginal band (MarginalForV2 blocker)
pass through the fanout gate alongside tradable symbols. Adds source
logging (readiness vs marginal_v2) and marginal_passed counter.
Applied to live_runner (both eval paths) and run-execution-once runner.

Made-with: Cursor
  6. f7d5348
    feat: add marginal band to readiness gate for V2 admissibility tiebreaker
    Mehr im Commit-Body
    Introduces SURPLUS_MARGINAL_FLOOR_BPS (default -25, env-configurable).
Symbols with surplus in [marginal_floor, 0) get blocker MarginalForV2
instead of hard SurplusBelowFloor — eligible for V2 tail-aware admission.
Adds marginal field to PairReadinessResult/Row and fanout_marginal_symbols helper.

Made-with: Cursor
  7. 58a23eb
    feat(ingest): L3 pipeline heartbeat metrics and RSS peak telemetry
    Mehr im Commit-Body
    - Add L3PipelineMetrics: WS/fan channel fill samples, slow sends (>5ms),
  WS-to-state apply lag, L3 feed reconnect and connection-failure totals,
  updates-before-snapshot counter for coarse sequence sanity.
- Stamp L3EventEnvelope with ws receive time; optional metrics on client/fan paths.
- INGEST_L3_PIPELINE_HEARTBEAT each minute with writer bulk queue depth;
  decision DB count for primary_reason=l3_resync_limit_reached.
- WRITER_METRICS bulk: mpsc buffer used/capacity; WriterSender introspection helpers.
- RESOURCE_TELEMETRY: track process_rss_peak_kb on Linux.
- symbol_safety_state::count_rows_with_primary_reason for dashboard-friendly totals.

Made-with: Cursor
  8. 8f4291a
    fix(ingest): bound L3 channels and throttle L3 metrics emits
    Mehr im Commit-Body
    Replace unbounded L3 event queues with bounded mpsc and await sends so
the WS reader backpressures when downstream is slow. Fan-in merge uses
a bounded channel as well.

Throttle per-symbol L3QueueMetrics writes on stream updates to 200ms
(snapshots and 5s interval unchanged) to reduce writer queue pressure
that previously let unbounded queues grow to OOM.

Made-with: Cursor
  9. aa6298d
    route: path observability log + pullback/passive confidence floor alignment
    Mehr im Commit-Body
    - Log PATH_CONFIDENCE_OBSERVABILITY with path_confidence, min_confidence_for_route,
  rejection, L2 flags, trend_strength, spread_stability, trade_density.
- Clamp builder confidence to min_confidence_for_route in pullback and passive only.

Made-with: Cursor
  10. cf9f936
    fix: align TrailingStopPathSimulation trace with actual cost model
    Mehr im Commit-Body
    The diagnostic trail_bps in EdgeChainTrace still included the removed
TSL_TRAIL_BASE_BPS constant, making best/median/worst scenario output
more pessimistic than the real exit_drag computation. Removed the
constant from the trace formula and deleted the now-unused constant.

Made-with: Cursor
  11. ec49c13
    fix: use mode-correct fee_bps for move/fee gate and fix trace exit_fee (audit Findings 5+6)
    Mehr im Commit-Body
    fee_bps for MoveBelowFees validation now uses entry_fee + exit_fee
(respects maker-TP-exit discount). Previously always assumed taker
exit, making the gate slightly too strict for TP routes.

Removed shadowed entry_fee_bps/exit_fee_bps locals in the trace block
that had a dead-code bug (exit_fee always taker regardless of branch).
The trace now reuses the correct variables from the main computation.

Simplified net_edge formula: both entry modes now use the same
entry_fee_bps + exit_fee_bps path instead of duplicated branches.

Made-with: Cursor
  12. 0a5b671
    fix: make cost breakdown fees mode-aware (entry_fee/exit_fee) (audit Finding 3)
    Mehr im Commit-Body
    Renamed CostBreakdown fields from maker_fee_bps/taker_fee_bps to
entry_fee_bps/exit_fee_bps. Readiness call sites now pass mode-correct
fees: Momentum gets (taker, taker), Liquidity/Volume gets (maker, taker).

Previously readiness always charged maker+taker regardless of strategy,
under-charging Momentum routes by taker-maker bps (~15 bps typical).
strategy_pipeline.rs already had mode-correct dual evaluation.

Made-with: Cursor
  13. 4463cf5
    fix: remove TSL double-count from trailing-stop exit_drag in route expectancy (audit Finding 4)
    Mehr im Commit-Body
    wait_risk_bps = READINESS_TSL_DRAG_BPS (2.0) already carries the
TSL/time reserve. The trailing-stop branch of exit_drag also added
TSL_TRAIL_BASE_BPS (2.0), double-charging 2 bps on every trailing
route. Removed TSL_TRAIL_BASE_BPS from the exit_drag computation;
vol-aware trail component and half exit_feas drag remain.

Made-with: Cursor
  14. 4f80b18
    fix: eliminate taker spread double-count in slippage estimator (audit Finding 1)
    Mehr im Commit-Body
    TAKER_SPREAD_FACTOR was 0.50, embedding half-spread in entry_slippage.
spread_net / spread_impact already carries the same half-spread cost
in cost_breakdown and route_expectancy. Both were subtracted, charging
a full spread instead of half a spread for all Momentum/taker routes.

Set TAKER_SPREAD_FACTOR = 0.0 so slippage only captures base + vol
adverse-fill risk. spread_net / spread_impact remains the sole carrier
of spread crossing cost. Also resolves Finding 2 (exit_slippage
inherited entry spread component, overlapping with exit_drag).

Made-with: Cursor
  15. b9fb4d3
    fix(readiness): activation-scoped TSL drag for ride/breakout continuation rows
    Mehr im Commit-Body
    Use 1 bps tsl_drag in cost_breakdown when SelectedStrategy::Momentum and
activate_strategies selects MomentumRide/BreakoutImmediate/BreakoutConfirmed;
keep 2 bps for other Momentum activations and all non-Momentum rows.

Align apply_activation_gated_drift_floor_to_pair_readiness with the same
short-horizon reserve when recomputing blended economics.

Made-with: Cursor
  16. d125209
    fix(economics): remove double-counted exit slippage from surplus and route expectancy
    Mehr im Commit-Body
    Made-with: Cursor
  17. ddb964b
    feat: Kraken margin short paper lane (DECISION persistence + TP/SL resolver v1)
    Mehr im Commit-Body
    - Add ExecutionSurface::KrakenMarginShortPaper and select_entry_route_for_surface
- Add evaluate_mandate_kraken_margin_short_paper (spot mandate unchanged)
- Persist krakenbot.margin_paper_trades after CDV when PAPER_MARGIN_SHORT_LANE_ENABLE=true
- Resolver v1: first-touch TP/SL on trade_samples (labeled tp_sl_v1_approximation in detail_json)
- Env: PAPER_MARGIN_SHORT_LANE_ENABLE (default false)

Made-with: Cursor
  18. 97c9d63
    feat: activation-gated drift floor economics (phase 1)
    Mehr im Commit-Body
    - Drift floor applies to readiness CDV only for momentum_ride, breakout_immediate,
  breakout_confirmed via drift_blend_applies_to_activated_strategy
- Baseline readiness uses unblended move; live_runner applies floor after activation
- route_expectancy: route-template gate (excludes pump-fade/dump-reversal paths)
- detail_json: drift_proxy_* horizon fields; DRIFT_BLEND_FACTOR unchanged

Made-with: Cursor
  19. c478787
    docs: horizon strategy tuning audit run 1968 (DECISION cohort + competition exports)
    Mehr im Commit-Body
    Made-with: Cursor
  20. 3f55d80
    docs: TRADING_SIGNAL_CDV_AUDIT_RUN1968 deliverable (DECISION live SQL)
    Mehr im Commit-Body
    Full FASE 0–7 audit text keyed to krakenbot_decision via server psql_pool;
steady-state filter on activation_context_json engine_warmup.
Notes server repo 94d1a88 vs local observability commit bb341ce deploy gap.

Made-with: Cursor
  21. bb341ce
    CDV trading-signal audit: observability logs and ENGINE_SSOT §6
    Mehr im Commit-Body
    - Warn once (SIGNAL_FRESHNESS_ABSENT) when capturable_move runs without freshness.
- Warn once (TRAIL_BPS_FALLBACK_USED) when trail_bps_v1 uses stand-in ATR.
- Log STRATEGY_ACTIVATION_HV_CHAOS_FLOOR when relaxed consistency floor applies.
- Document CDV JSON fields, surplus/mandate gates, persistence, trail split,
  continuation gap, and server-measured run 1968 facts in ENGINE_SSOT.md.

Made-with: Cursor
  22. 94d1a88
    perf(db): bound l2_raw_feature_ready scans for live loop
    Mehr im Commit-Body
    Full COUNT(*) on l2_snap_metrics for a long-lived ingest run_id could block
run-execution-live for minutes after epoch bind. Use LIMIT-capped subqueries
for the row threshold and for distinct symbols-with-spread.

Made-with: Cursor
  23. 622eac3
    fix(execution): do not stall live loop when snapshot truth is not Healthy
    Mehr im Commit-Body
    Periodic reconcile ran on every iteration while evaluation_count==0 (% 10 == 0).
If private snapshot liveness was not Healthy, the loop continued before epoch
binding and pipeline, so evaluation_count stayed 0 forever (no CDV, no
LIVE_EVALUATION logs). Skip protection submits without truth, but proceed to
epoch binding and evaluations. Align exec-only path the same way (remove fake
bump+continue on unhealthy).

Made-with: Cursor
  24. 70850f8
    fix(position): sync open long base to exchange balance both ways
    Mehr im Commit-Body
    When balances snapshot is fresh, reconcile_open_positions_truth_on_load
now sets base_position to the wallet-reported spot quantity on any material
drift (raise or lower), not only when balance exceeds DB.

- Add positions::set_long_position_qty_from_exchange_truth for shared UPDATE
- Emit POSITION_TRUTH_EXCHANGE_SYNC funnel events (replaces upward-only path)
- Keep recent-fills quiet period; keep in-flight buy guard only for upward sync

Exchange spot balance remains SSOT; fills_confirmed can be overridden by
balance_recovery when they disagree.

Made-with: Cursor
  25. 05e57a1
    activation: regime-specific consistency floor for momentum_ride in HV/CHAOS
    Mehr im Commit-Body
    Add MIN_CONSISTENCY_FOR_RIDE_HV_CHAOS = 0.22 for HIGH_VOLATILITY and CHAOS
(non-Noise) regimes when abs_drift_1m >= 1.5 bps/min. The normal floor of
0.30 applies in all other regimes and for weak drift.

Motivation: tail analysis showed 85/89 no_opportunity rows in the top-1%
expected_gross_capture tail had momentum_ride as the nearest eligible
strategy, rejected solely for direction_consistency_low. In HV/CHAOS
regimes, micro-direction switches are intrinsic; requiring 0.30 consistency
over-filters genuine high-drift entries. The 1.5 bps/min drift gate prevents
the relaxation from widening low-drift or marginal paths.

Files: src/pipeline/strategy_activation.rs, CHANGELOG.md
Made-with: Cursor
  26. 658d73f
    chore(docs): regenerate CHANGELOG commit ledger; sync counts (422/421)
    Mehr im Commit-Body
    - Ledger includes all commits through tip-1; multilingual header counts updated.

Made-with: Cursor
  27. 9bff6ce
    docs(changelog): activation Lane A entry (d7717b4); bump RAG embed bundle
    Mehr im Commit-Body
    - Document feat(activation) breakout split + consistency/maker relax in CHANGELOG.
- Sync multilingual ledger counts (421 commits / 420 table rows after this commit).
- docs/SITE_DOCS_AND_CHATBOT_PIPELINE.md: markdown bold for DOC_STATUS/DOC_ROLE.
- rag-backend/EMBED_BUNDLE_VERSION: 8 -> 9 (CHANGELOG/docs touch per CI).

Made-with: Cursor
  28. d7717b4
    feat(activation): split breakout drift floors; Lane A relax (confirmed, ride, passive)
    Mehr im Commit-Body
    - Replace MIN_DRIFT_FOR_BREAKOUT with MIN_DRIFT_FOR_BREAKOUT_IMMEDIATE (2.35) and
  MIN_DRIFT_FOR_BREAKOUT_CONFIRMED (2.10); confirmed 3m gate still uses * 0.65.
- Relax momentum ride consistency floors and maker passive max |drift| caps.

Made-with: Cursor
  29. 0b6f662
    scripts: add monitor_cdv_warmup_steady.sh for decision CDV warmup metrics
    Mehr im Commit-Body
    Made-with: Cursor
  30. 1ce75c3
    chore(ci): regenerate changelog ledger; sync counts; bump RAG EMBED bundle
    Mehr im Commit-Body
    Regenerates docs/reports ledger for anchor..HEAD so verify_changelog_coverage passes.
Updates multilingual ledger counts (417 commits / 416 rows). EMBED_BUNDLE_VERSION 8
required when docs/ or CHANGELOG.md change per verify_rag_bundle_bump.sh.

Made-with: Cursor
  31. 989a87e
    fix(cdv): persist market_regime and align live activation with readiness
    Mehr im Commit-Body
    - Add market_regime to StrategyActivation; apply_activation_to_cdv sets regime column.
- INSERT candidate_decision_vectors now includes regime (was omitted, always NULL in DB).
- Live CDV path uses per-pair p.regime for activate_strategies instead of synthetic detect_regime(zeros).

Made-with: Cursor
  32. eefab1b
    fix(live): bind ingest_epochs.run_id to ingest observation run for feature readiness
    Mehr im Commit-Body
    When run-execution-live runs alongside krakenbot-ingest, raw L2 lives under
observation_runs.mode=ingest, but epochs were created with execution_live run_id.
Epoch binding then pointed l2_raw_feature_ready at the wrong run (0 L2 rows).

- Add epoch_queries::latest_ingest_observation_run_id
- Use epoch_data_run_id for initial and refresh create_epoch / universe snapshots
  when ingest_provides_data; refresh re-queries latest ingest run

Made-with: Cursor
  33. 54ed6fb
    fix(live): stop mandate-edge panic loop; route ingest_epochs via ingest pool
    Mehr im Commit-Body
    - Replace raw panic when mandate=execute positive CDV but zero orders with
  execution_truth error, atomic mismatch counter, and consistency_watchdog_snapshots
- detect_positive_mandate_execute_edge_candidates: mandate_decision=execute,
  admitted, execute_candidate, exclude readiness_* reason codes
- create_epoch / universe snapshot / update_epoch_status use ingest_pool
  (same as lineage) so krakenbot.ingest_epochs resolves on ingest DB

Made-with: Cursor
  34. ed3640d
    fix(rag): parse DOC_STATUS/DOC_ROLE with optional Markdown bold
    Mehr im Commit-Body
    SITE_DOCS_AND_CHATBOT_PIPELINE used **DOC_STATUS:** lines; _extract_meta
only matched bare DOC_STATUS:, so chunks fell back to BACKGROUND. Align
four pipeline docs with other allowlisted docs (bare headers) and make
regex accept both forms. Bump EMBED_BUNDLE_VERSION for reindex.

Made-with: Cursor
  35. 0afc889
    fix(maintenance): use psql_pool.sh in db_inventory_compare
    Mehr im Commit-Body
    Replaces raw psql against INGEST/DECISION URLs so assert_no_raw_psql and
AGENTS policy are satisfied; identity prelude remains on stderr per pool.

Made-with: Cursor
  36. 5ce273d
    fix(ledger): f-string anchor in coverage line; regen; sync 412-count copy; EMBED 6
    Mehr im Commit-Body
    Made-with: Cursor
  37. 5c65b02
    docs: viertalige site/RAG-pipeline (nl/en/de/fr); ledger zonder HEAD-rij; RAG taal per map
    Mehr im Commit-Body
    Made-with: Cursor
  38. a90f935
    docs: changelog ledger (409 commits), RAG CHANGELOG index, CI gates
    Mehr im Commit-Body
    - Add machine-generated docs/reports/CHANGELOG_COMMIT_LEDGER_2026-03-19_to_HEAD.md
- scripts: generate_changelog_ledger.py, verify_changelog_coverage.sh, verify_rag_bundle_bump.sh, check_public_docs.sh; changelog_coverage.anchor
- CHANGELOG.md: public website overview (2026-03-20–04-01) + ledger link; SITE_DOCS_AND_CHATBOT_PIPELINE.md
- rag-backend: index root CHANGELOG.md; EMBED_BUNDLE_VERSION=2; bundle bump enforced in CI
- .github/workflows/ci.yml: doc gates + cargo fmt/check
- docs: DOC_INDEX, RAG_BACKEND_SPEC, DEVELOPMENT_RULES, recovery report

Made-with: Cursor
  39. 898ee8b
    feat(activation): regime weights, warmup CDV fields, momentum/maker gates
    Mehr im Commit-Body
    - Persist price_history_span_seconds and engine_warmup (<300s) plus strategy
  counts and raw/adjusted scores in activation_context_json.
- Apply per-regime strategy weights to raw scores before ranking; document
  pipeline order (activation before route/exit/mandate).
- MomentumRide: OR gate for standalone 3m and 3m/1m bridge; relaxed 1m/3m
  alignment only for standalone 3m path.
- Maker passive: reject when |drift_3m| > 1.8; rejected_strategies_json adds
  score_raw.
- price_cache: price_history_span_seconds for CDV diagnostics.

Made-with: Cursor
  40. fdbe25e
    feat: strategy-space calibration — activation, maker tilt, fill estimate
    Mehr im Commit-Body
    Activation (strategy_activation.rs):
- Breakout drift floor 3.0→2.35; confirmed 3m gate uses 0.65× factor.
- Momentum: lower 1m floor 1.0→0.55; add 3m/1m alternate gate; slightly
  lower consistency floors; boost score weights; penalize maker passive
  earlier (|1m|>2.15) and reduce passive score cap (~2.45 vs 3.0 spread term).
- Mean reversion snapback: weaker 1m floor 2.0→1.55.
- Volatility surge: vol_proxy 0.8→0.68; vacuum density band widened.

Entry route (entry_route.rs):
- Maker min fill prob 0.25→0.18 (CDV/readiness pessimism).
- estimate_maker_fill_probability: L3 flag with zero quality falls back to
  spread/density blend instead of collapsing to 0.

Made-with: Cursor
  41. 1937f8a
    fix(db): skip ingest migrations for read-only observability ingest URL
    Mehr im Commit-Body
    Read-only krakenbot_observability cannot create public schema objects; export
uses INGEST_OBSERVABILITY_DATABASE_URL with run_ingest_migrations=false.

Made-with: Cursor
  42. e9a1fc7
    feat(db): isolate observability ingest via INGEST_OBSERVABILITY_DATABASE_URL
    Mehr im Commit-Body
    - Optional read-only ingest URL for export-observability-snapshots; warn if unset
- SQL script for krakenbot_observability role with timeouts and SELECT grants
- OBSERVABILITY_RUN_HEALTH_TIMELINE_LIMIT (1-50) for run-health export scope
- Docs: measurement-first baseline and rollback; trading_env + systemd comments

Made-with: Cursor
  43. 555fe6b
    fix: drift returns 0 for windows without sufficient history
    Mehr im Commit-Body
    When history span < 50% of the target window, drift returns 0.0
instead of a fallback value. This prevents all horizons from
collapsing to identical values when only short-term data exists.
1m drift works with ~30s+ of data; 5m needs ~150s; 10m needs ~300s.

Made-with: Cursor
  44. 56c6ead
    fix: gate edge-detection panic on system_live_ready
    Mehr im Commit-Body
    The strict positive-edge-but-no-orders check only fires when
system_live_ready is true. When the execution universe is empty
(not yet live-ready), positive-edge CDV rows without orders are
expected behavior, not a system failure.

Made-with: Cursor
  45. 8277599
    fix: readiness CDV spawn computes full V2 decision chain
    Mehr im Commit-Body
    Both integrated and execution-only CDV spawns now call
select_entry_route, select_exit_policy, and evaluate_mandate
after strategy activation. This ensures all live engine CDV rows
have non-NULL entry_route_selected, exit_policy_selected, and
mandate_decision — even when the execution universe is empty
and the pipeline receives 0 tradable candidates.

Made-with: Cursor
  46. 37d69fe
    fix: live engine V2 decision chain + drift horizon differentiation
    Mehr im Commit-Body
    1. Live engine data_run_id fix: route analysis and strategy pipeline
   in the integrated eval loop now use data_run_id (the ingest epoch's
   run_id) instead of the live engine's own run_id for data queries.
   This ensures analyze_run_from_state finds market data, enabling
   entry route, exit policy, and mandate computation in live mode.

2. Drift horizon fix: when no samples fall in the [0.85W, 1.15W] age
   bracket, the fallback now selects the nearest available sample to
   the target age instead of always using the oldest point. This
   prevents all 5 horizons from collapsing to identical values.

Made-with: Cursor
  47. 69c7e28
    fix: resolve all compile errors across test targets
    Mehr im Commit-Body
    - exit_path.rs / market_regime.rs: add missing drift_metrics field to
  MarketFeatures test constructors
- protection_flow.rs: remove tests referencing removed
  submit_stop_loss_and_wait_ack function, removed hard_block and
  add_stop_loss_order from trait mocks that no longer match the trait
  definitions, add missing OpenOrderAnalysis import
- order_state_lifecycle.rs: rewrite tests to match current OrderState
  API (OrderEvent/apply_state were removed from the module)
- entry_route.rs: remove unused DriftMetrics/DriftSign/RejectedStrategy
  imports
- strategy_readiness_report.rs: correct RegimeChaos → RegimeChaosNoise
  blocker label for noise-blocked pairs, add to primary_blockers list

Made-with: Cursor
  48. d608dae
    fix(lifecycle): eager transition logging to prevent double-hop loss
    Mehr im Commit-Body
    transition_to previously deferred recording via a single-slot
last_transition_from Option, which was silently overwritten when
evaluate_inner triggered two transitions in one call (e.g.
TimeStopImminent → TakeProfitReached). Now records each transition
immediately at the callsite with full context (action, trigger,
pnl, conditions snapshot). Adds regression test for the exact
BreakEvenArmed → TimeStopImminent → TakeProfitReached scenario.

Made-with: Cursor
  49. 4c70749
    feat(chaos): ChaosSubtype directional/noise split with DB-first explainability
    Mehr im Commit-Body
    ChaosDirectional (direction_consistency >= 0.5 OR |drift_3m| >= 3 OR
|drift_5m| >= 2 with alignment) unlocks strategy eligibility in CHAOS
regime — it does NOT bypass hard safety invariants (mandate spread-vs-stop,
fill probability, spot-short checks all still apply).

ChaosNoise blocks ALL strategies except NoOpportunity with machine-readable
"chaos_noise_regime" rejection reason for every strategy.

Changes:
- strategy_activation.rs: ChaosSubtype enum, classify_chaos_subtype(),
  evaluate_all() early-rejects for Noise, chaos_subtype stored in
  StrategyActivation and persisted to CDV
- strategy_selector.rs: candidate_strategies_for_regime_chaos() allows
  Momentum for ChaosDirectional in legacy path
- readiness_gate.rs: RegimeChaosNoise blocker variant, chaos_directional
  param splits the CHAOS gate, chaos_subtype in PairReadinessResult
- strategy_readiness_report.rs: computes drift to classify chaos subtype
  and passes chaos_directional to readiness evaluation
- CDV: chaos_subtype column populated from activation result

Made-with: Cursor
  50. bcd89cc
    feat(mandate): CDV migration + mandate persistence with full policy chain JSONB
    Mehr im Commit-Body
    Migration 20260401144000 adds 5 columns to candidate_decision_vectors:
mandate_decision, mandate_reason_code, mandate_reason_detail,
mandate_entry_route_reason, mandate_policy_chain_json (JSONB).

The mandate_policy_chain_json carries the complete decision path
(strategy activation, entry route, exit policy with concrete parameters,
and verdict) without lossy degradation — downstream analysis can
reconstruct exactly why a candidate was Execute/Observe/Block.

Pipeline builds mandate_by_symbol map from the full policy chain
(activation + entry_route + exit_policy + edge + spread) and threads
it through all 5 persist_pipeline_candidate_vector call sites.

Made-with: Cursor
  51. fb038e4
    feat(mandate): execution mandate + DB-explainable lifecycle transitions + noise dampening
    Mehr im Commit-Body
    New module src/pipeline/execution_mandate.rs:
- MandateDecision: Execute / Observe / Block
- DominantReasonCode: 10 machine-readable codes (approved,
  no_opportunity_strategy, entry_route_blocked, spot_short_blocked,
  exit_policy_emergency_only, direction_conflict, insufficient_edge,
  spread_exceeds_stop, fill_probability_too_low, time_stop_too_short)
- MandateResult: carries the full policy chain (activation + entry
  route + exit policy) without lossy degradation.  exit_policy is the
  original ExitPolicyResult, not an ExitConfig reconstruction.
- evaluate_mandate(): coherence checks across the full chain.

position_state_machine.rs improvements:

DB-explainable lifecycle transitions:
- LifecycleTransitionEvent struct: from_state, to_state, action,
  pnl_bps_at_transition, elapsed_secs, peak/trough, trigger,
  conditions_snapshot.
- transition_log: Vec recorded on every state change.
- transition_log_json(): serializable for DB persistence.

Noise dampening (non-PnL hooks):
- MIN_ELAPSED_FOR_CONDITION_HOOKS_SECS = 30: no condition-based
  tightening in the first 30s after open.
- SPREAD_BLOWOUT_DEBOUNCE = 3: spread must exceed threshold for 3
  consecutive ticks before triggering tighten.

Symbol-level helper documented as compatibility-only:
- get_lifecycle_for_symbol() carries explicit WARNING that it is NOT
  the source of truth for multi-position-per-symbol scenarios.
  Callers must prefer get_lifecycle(symbol, order_id) when available.

Made-with: Cursor
  52. d350832
    fix(ingest): shorten run health export query; safer observability timer; autovacuum SQL
    Mehr im Commit-Body
    - Replace LATERAL MAX probes with GROUP BY run_id IN (runs) in run_health_timeline_last_n
- Use OnUnitInactiveSec for observability export timer to avoid overlapping exports
- Add ingest run_symbol_state autovacuum reloptions script + operator doc (trader_rewrite timeout skipped when shared with writer)

Made-with: Cursor
  53. bfc0979
    feat(lifecycle): wire PositionLifecycle into runtime + market condition hooks
    Mehr im Commit-Body
    Runtime integration — position_monitor now uses policy-derived thresholds:
- TP: lifecycle.take_profit_bps() instead of hardcoded 200 bps
- BE: lifecycle.break_even_trigger_bps() instead of hardcoded 30 bps
- Trail: lifecycle.trailing_distance_bps() instead of hardcoded 0.7%
All three fall back gracefully to existing constants when no lifecycle
exists (legacy positions pre-dating the state machine).

exit_lifecycle: registers a PositionLifecycle on fill via
register_lifecycle(symbol, order_id, policy).  Logs lifecycle state
for traceability.

Global lifecycle registry: keyed by (symbol, order_id) for per-
position identity.  Provides get_lifecycle, get_lifecycle_for_symbol,
update_lifecycle, remove_lifecycle, gc_closed_lifecycles.
GC runs on each position_monitor refresh cycle.

Market condition hooks: MarketConditionUpdate struct carries drift,
accel, spread, direction_consistency, l3_quality.
evaluate_with_conditions() checks non-PnL signals (drift weakening
while trailing → tighten; spread blowout → tighten) without
overriding panic/time-stop.

ExitPolicyResult::from_exit_config() reconstructs policy from
ExitConfig for lifecycles created at runtime (after potential
degraded-policy mutation).

Invariants:
1. PositionLifecycle remains pure decision layer — never touches orders
2. Runtime actions traceable: lifecycle registered with order_id
3. Per-position identity preserved via (symbol, order_id) key
4. Non-PnL hooks available even though initial integration uses PnL

Made-with: Cursor
  54. 8b5ad6f
    feat(lifecycle): position state machine — strategy decision state layer
    Mehr im Commit-Body
    New module src/pipeline/position_state_machine.rs:

LifecycleState enum (8 states): OpenAtRisk, BreakEvenArmed,
TrailingActive, TakeProfitReached, FadeTargetReached,
TimeStopImminent, ExitRequested, Closed.

LifecycleAction enum: Hold, ArmBreakEven, ActivateTrailing,
TightenTrailing, TakeProfit, FadeExit, TimeStopExit, PanicExit.

PositionLifecycle: per-position (per-candidate) tracker with frozen
ExitPolicyResult parameters.  evaluate(pnl_bps) returns the
recommended action and advances state.  Peak/trough PnL tracked.

Separation of concerns:
- This module = strategy policy state (which phase, which thresholds)
- ExitManager/exit_lifecycle/position_monitor = exchange/order state
- No parallel exit engine: existing machinery consults this layer

Policy parameters exposed as accessors (break_even_trigger_bps,
trailing_activation_bps, trailing_distance_bps, etc.) so
position_monitor can use them instead of hardcoded constants.

Three distinct evaluation paths based on policy type:
- Trailing: OpenAtRisk -> BE -> TrailingActive -> tighten
- Static: OpenAtRisk -> BE -> TakeProfit
- Fade/Snapback: OpenAtRisk -> (BE) -> FadeTargetReached

Panic and time-stop override all paths unconditionally.

Made-with: Cursor
  55. 26a4920
    feat(cdv): exit policy migration $79-$86 + pipeline wiring
    Mehr im Commit-Body
    Migration 20260401143000 adds 8 nullable columns to
candidate_decision_vectors: exit_policy_selected, exit_policy_reason,
initial_stop_bps, break_even_trigger_bps, trailing_activation_bps,
trailing_distance_bps, fixed_take_profit_bps, time_stop_seconds.

CDV struct extended with matching fields ($79-$86).
apply_exit_policy_to_cdv() stores the authoritative ExitPolicyResult
including all concrete parameters — SQL analysis shows exactly why
a candidate got TightScalp vs TrailingBreakout vs FadeRevert.

Pipeline wiring: exit_policy_by_symbol HashMap built once from
activation + entry_route + drift + spread, threaded through all 5
persist_pipeline_candidate_vector call sites.

EmergencyMarket is only written for explicit exceptional reasons
(no_opportunity_strategy, no_family) — never as a silent fallback.

Made-with: Cursor
  56. 77e8670
    ops: include Postgres pool snapshots in incident captures
    Mehr im Commit-Body
    - Timebox DB commands and include db_target_precheck + pg_stat_activity + pg_stat_statements + bgwriter
- Make systemd ExecStart point to /usr/local/lib/krakenbot/incident_snapshot.sh
- Installer now copies script outside repo and ensures /var/log/incident-snapshots exists

Made-with: Cursor
  57. 4ef31af
    feat(position_policy): 10-variant exit policy selection, strategy-driven + route-aware
    Mehr im Commit-Body
    New module src/pipeline/position_policy.rs:

- ExitPolicy enum (10 variants): TightScalp, MakerLadderPassive,
  TrailingBreakout, TrailingMomentum, FadeRevert, SnapbackQuick,
  VolatilityAdaptive, LiquidityDrain, TimeDecayOnly, EmergencyMarket.

- ExitPolicyResult carries concrete parameters for every selection:
  initial_stop_bps, break_even_trigger_bps, trailing_activation_bps,
  trailing_distance_bps, fixed_take_profit_bps, time_stop_seconds.

- to_exit_config() produces an authoritative ExitConfig that is the
  binding source for ExitManager / exit_lifecycle / position_monitor.
  No parallel exit engine created — this module selects policy only.

- select_exit_policy() dispatches on ActivatedStrategy family +
  EntryRouteFamily.  Same strategy with different entry route can
  yield different exit policy (e.g. BreakoutImmediate + taker gets
  TrailingBreakout; + maker gets TightScalp).

Invariants:
1. Strategy-driven and route-aware dispatch.
2. to_exit_config() is authoritative, not advisory.
3. No parallel exit engine — policy selection only.
4. All results carry concrete numeric parameters.

Made-with: Cursor
  58. 514e331
    ops: add incident snapshot systemd timer
    Mehr im Commit-Body
    - Add scripts/incident_snapshot.sh to write periodic snapshots to /var/log/incident-snapshots
- Add systemd unit+timer and installer script for git-only server install
- Captures CPU/mem/disk/iostat/journal/networkd/resolver + krakenbot service tails

Made-with: Cursor
  59. a3c0639
    fix(activation): derive MomentumFade direction from 10m drift, not 1m
    Mehr im Commit-Body
    eval_momentum_fade trades counter to an established 10m trend. It was
using drift_sign (derived from 1m drift) to determine direction. When
1m fades or reverses while 10m remains strong, this produced the wrong
direction — e.g. 10m DOWN + 1m reversed to UP gave Short instead of
the correct Long (counter to 10m DOWN), causing spot short blocking.

Now derives fade_direction directly from drift_bps_per_min_10m sign.

Made-with: Cursor
  60. cf0e7d6
    feat(cdv): entry route migration + struct $73-$78 + pipeline wiring
    Mehr im Commit-Body
    Migration 20260401142000 adds 6 nullable columns to
candidate_decision_vectors: entry_route_selected, entry_route_reason,
entry_fill_probability, entry_expected_fee_bps,
entry_expected_slippage_bps, entry_expected_latency_bps.

CDV struct extended with matching fields ($73-$78).
apply_entry_route_to_cdv() stores the exact EntryRouteResult that
feeds downstream execution — no recomputation or lossy summary.

Pipeline wiring: entry_route_by_symbol HashMap built once from
activation + v2_state + fee_tier, threaded through all 5
persist_pipeline_candidate_vector call sites.

Invariants enforced:
1. Every routed candidate persists all 6 fields.
2. entry_route_selected=None always has non-empty machine-readable
   entry_route_reason.
3. Persisted values are the actual selection result, not a recomputed
   summary.

Made-with: Cursor
  61. 2a57aba
    feat(entry_route): strategy-driven entry route selection with 3 hard invariants
    Mehr im Commit-Body
    EntryRouteFamily taxonomy: MakerPassive, MakerStepAhead,
TakerAggressive, TakerMarket, HybridPassiveThenCross, HybridLimitIoc.

select_entry_route() enforces:
1. Strategy-driven: breakout/momentum → taker/hybrid;
   maker strategies → MakerPassive/MakerStepAhead.
2. Direction-aware: Short on spot → None + "spot_short_not_supported".
3. No silent None: every blocked route carries machine-readable reason
   (fill_probability_too_low, spread_too_wide, insufficient_orderbook_depth,
   spot_short_not_supported, no_opportunity_selected, strategy_family_none).

Legacy EntryMode mapping via to_legacy_entry_mode().

Made-with: Cursor
  62. 32c4a7a
    feat(cdv): migration + struct for 8 activation columns ($65-$72) with pipeline wiring
    Mehr im Commit-Body
    Migration 20260401141000 adds selected_strategy, eligible/rejected
strategies JSON, activation_reason, activation_score, selected_direction,
strategy_family, activation_context_json.

apply_activation_to_cdv() populates all 8 fields from StrategyActivation.
activation_context_json includes spot_execution_blocked_for_short flag
to prevent Short direction from leaking into spot execution.

Pipeline builds activation_by_symbol map (regime + features + drift)
and passes to all 5 persist_pipeline_candidate_vector call sites.
Both live_runner readiness blocks compute activation inline.

Made-with: Cursor
  63. 4725398
    feat(activation): 11-variant strategy activation with explicit rejection reasons
    Mehr im Commit-Body
    ActivatedStrategy taxonomy: BreakoutImmediate, BreakoutConfirmed,
MomentumRide, MomentumFade, MeanReversionSnapback, MeanReversionGrind,
MakerStepAhead, MakerPassiveQueue, VolatilitySurge, LiquidityVacuum,
NoOpportunity.

activate_strategies() scores all 11 against regime + features + drift,
returns exactly one selected with full audit trail: eligible set,
rejected list with machine-readable reasons, activation_reason string.
No black-box fallback to NoTrading — every rejection is explicit.

Legacy SelectedStrategy mapping preserved via to_legacy().

Made-with: Cursor
  64. 2bd433d
    feat(drift): wire DriftMetrics into MarketFeatures, pipeline CDV, and live_runner
    Mehr im Commit-Body
    - Add drift_metrics field to MarketFeatures; enrich_with_drift() calls
  compute_drift_metrics from price history ring buffer.
- apply_drift_to_cdv() helper populates 13 drift fields on CDV rows.
- persist_pipeline_candidate_vector accepts drift; all 5 call sites pass
  drift_by_symbol lookup (pre-computed per symbol before the main loop).
- Both live_runner readiness CDV blocks compute drift inline and apply
  before insert.
- Route selectors (v1 + v2) call enrich_with_drift after ignition.

Made-with: Cursor
  65. ab589c3
    feat(cdv): migration + struct for 14 drift/movement columns ($51-$64)
    Mehr im Commit-Body
    Migration 20260401140000 adds drift_bps_per_min_{1,3,5,10,15}m,
accel_bps_per_min2, expected_persistence_min, direction_consistency,
drift_sign, expected_gross_capture_{bps,long_bps,short_bps},
persistence_confidence, chaos_subtype.

All existing CDV construction sites use ..Default::default() for the
new fields (None until pipeline wiring in next commit).

Made-with: Cursor
  66. acccd34
    feat(drift): signed drift/accel/persistence engine with median-anchored windows
    Mehr im Commit-Body
    DriftMetrics with 1m/3m/5m/10m/15m signed drift (bps/min), direction-
aware gross capture (long/short), acceleration, persistence model,
alignment signals, and persistence_confidence.

Anchor price uses median of ±15% age bracket to dampen single-tick
noise without masking genuine level changes.

Made-with: Cursor
  67. 9c66772
    feat(price_cache): add 900s mid-price ring buffer for drift metrics
    Mehr im Commit-Body
    Stores (Instant, f64) mid-price ticks in a per-symbol VecDeque,
retained for 15 minutes. Exposes price_history() API for the
drift/acceleration engine.

Made-with: Cursor
  68. cb32443
    fees: allow env override of bootstrap fee bps
    Mehr im Commit-Body
    Adds BOOTSTRAP_MAKER_FEE_BPS and BOOTSTRAP_TAKER_FEE_BPS (clamped) for analysis/testing when no live fee provider is available; defaults remain 25/40 bps.

Made-with: Cursor
  69. 11390e6
    Align readiness fill prob with L3 quality; add env tunables
    Mehr im Commit-Body
    - Move compute_l3_quality_score to analysis::l3_quality (shared with market_features).
- Readiness: use L3-based quality for hybrid fill_probability instead of edge_score.
- fill_probability: env FILL_PROB_REF_TIME_SECS, MISSING_L3_PENALTY, FLOOR, HYBRID_BASE (clamped).
- readiness_gate: READINESS_MIN_FILL_PROB_LIQUIDITY override (clamped 0.05–0.45).
- Drop redundant route_engine::l3_quality module.

Made-with: Cursor
  70. 15e0c48
    fix(writer): chunk multi-row INSERTs under Postgres bind parameter limit
    Mehr im Commit-Body
    - Cap each INSERT at 32000/columns (ticker+trade 4000 rows, L3 2000 rows)
- On failure after partial flush, only restore unwritten tail; avoids
  irrecoverable errors and documents behavior in WRITER_PARALLEL_DESIGN

Made-with: Cursor
  71. bcd7367
    ingest: multi-row batch INSERT for ticker, trade, L3 queue metrics
    Mehr im Commit-Body
    - Use sqlx QueryBuilder push_values for one INSERT per flush batch
- On DB error, restore batch buffer so rows can retry
- Document DualWriter limits, ops runbook for DNS/network vs WS logs,
  and update L3 scaling + LOGGING WRITER_METRICS notes

Server baseline (ingest): bulk writer_channel_pending saturated at 4096;
pg_stat_statements showed ~809k single-row L3 inserts before this change.

Made-with: Cursor
  72. af0b969
    feat(edge): strict executable edge markets (top per symbol)
    Mehr im Commit-Body
    Made-with: Cursor
  73. d896321
    fix(cdv): backfill required detail_json keys for edge detection
    Mehr im Commit-Body
    Made-with: Cursor
  74. 5744c1e
    fix(cli): route debug-edge mode via cli_mode
    Mehr im Commit-Body
    Made-with: Cursor
  75. 66e2ccc
    feat(edge): DB-first per-candidate positive-edge detection and hard no-order assertion
    Mehr im Commit-Body
    - Add decision DB query for raw positive-edge candidates (no aggregates)
- Add debug-edge CLI to print per-candidate truth from Postgres
- Enforce required detail_json fields (entry_type, exit_type, expected_fill_probability) with ERROR+counter
- In live execution loop: ERROR if positives exist, and panic if positives>0 but orders==0

Made-with: Cursor
  76. 23bb33c
    fix(cdv): backfill explainability v2 fields for historical rows
    Mehr im Commit-Body
    Made-with: Cursor
  77. 56986f2
    feat(cdv): v2 DB-first explainability fields for no-trade root cause
    Mehr im Commit-Body
    Add non-null edge decomposition + strategy/market context columns to candidate_decision_vectors, and populate them at all write points (route eval, pipeline, readiness, execution precheck).
CDV insert failures now emit ERROR with run_id+symbol and increment a write-failure counter.

Made-with: Cursor
  78. 89e5e13
    feat(parquet): validate manifest and skip exported partitions
    Mehr im Commit-Body
    Made-with: Cursor
  79. 4144fa6
    feat(parquet): production-grade cold export with manifests, boundaries, ZSTD, and CDV dataset
    Mehr im Commit-Body
    - Manifest completeness: row_count, min/max ts, checksum_sha256, exported_at, schema_version
- Atomic writes for parquet+manifest; refuse overwrite (idempotency safety)
- trade_samples: hard boundary via --max-run-id or --ended-before (closed runs only)
- candidate_decision_vectors: decision DB export with --older-than-days cutoff
- Chunked streaming export (no full table loads)
- Parquet compression: ZSTD

Made-with: Cursor
  80. ce4617c
    Ensure candidate_decision_vectors always has evaluation_index
    Mehr im Commit-Body
    Generate negative non-cycle evaluation_index values for route_eval and execution hooks so every vector row has a unique (run_id, evaluation_index) without relying on DB constraints.

Made-with: Cursor
  81. d6187b8
    Harden candidate_decision_vectors writes and indexing
    Mehr im Commit-Body
    Make evaluation_index unique per run, add fail-visible logging + cdv_write_failed counter, and add a concurrent index plus a health query script for DB-first safety checks.

Made-with: Cursor
  82. cc7501f
    Fix trailing comma in candidate_decision_vectors insert
    Mehr im Commit-Body
    Removes a stray trailing comma in the VALUES list that caused a syntax error and prevented readiness vectors from persisting.

Made-with: Cursor
  83. 0cf15bf
    Fix extra placeholder in candidate_decision_vectors insert
    Mehr im Commit-Body
    Removes a stray $38 placeholder so VALUES count matches the target column list, unblocking DB-first persistence for readiness vectors.

Made-with: Cursor
  84. a18864a
    Fix candidate_decision_vectors insert column/value mismatch
    Mehr im Commit-Body
    Restores the insert statement to the canonical column list so persistence does not fail with "more expressions than target columns"; new explainability fields remain nullable and are carried in detail_json for now.

Made-with: Cursor
  85. c9c6f67
    fix(parquet): write manifest parquet_file as string
    Mehr im Commit-Body
    Made-with: Cursor
  86. a7b4c81
    Warn once when readiness vector persistence fails
    Mehr im Commit-Body
    Adds a single warning on the first insert failure per evaluation cycle so DB-first candidate vector persistence errors can't silently yield zero rows.

Made-with: Cursor
  87. fb02e48
    fix(parquet): avoid broken pipe panic when output is piped
    Mehr im Commit-Body
    Made-with: Cursor
  88. b974f1d
    Persist readiness vectors in exec-only loop
    Mehr im Commit-Body
    Ensure candidate_decision_vectors are written in the execution-only evaluation loop so DB-first edge/surplus/blocker evidence is available even when no orders are submitted.

Made-with: Cursor
  89. d8b1efe
    fix(parquet): align timestamp schema with Arrow builders
    Mehr im Commit-Body
    Made-with: Cursor
  90. b814580
    Persist readiness candidate economics to candidate_decision_vectors
    Mehr im Commit-Body
    Writes one row per readiness-evaluated symbol per evaluation cycle so edge/surplus and blocker reasons are queryable DB-first even when no orders are submitted.

Made-with: Cursor
  91. e8654a2
    feat(cold): add Parquet archival CLI for trade_samples
    Mehr im Commit-Body
    Add a read-only cold export path to local-disk Parquet for ingest raw data.
The new CLI mode `export-parquet-cold` exports ended runs older than a cutoff and
writes one Parquet file per (dt, symbol, run_id) with a manifest for reproducibility.

Runtime and execution paths remain Postgres-first; no live reads from Parquet.

Made-with: Cursor
  92. 0cce304
    docs(parquet): classify hot/warm/cold and select archival candidates
    Mehr im Commit-Body
    Define where Parquet adds structural value without affecting runtime SSOT.
Includes a per-dataset classification and an explicit ML lens (raw/features/decision/outcome)
with strict exclusions for live/execution/safety/state tables.

Made-with: Cursor
  93. 162e5f7
    docs(redis): live validation of pipelining optimizations
    Mehr im Commit-Body
    Made-with: Cursor
  94. 6e402ea
    docs(redis): add latency optimization implementation report
    Mehr im Commit-Body
    Made-with: Cursor
  95. f83707c
    perf(redis): pipeline batch reads and writes for MSP state
    Mehr im Commit-Body
    Latency audit revealed sequential Redis commands as the largest bottleneck:
- redis_get_batch: 643 sequential HGETs → 1 pipeline = ~240× faster
- redis_set_state: 2 round-trips (HSET + SADD) → 1 pipeline = 2× faster
- redis_rebuild_from_db: 1286 sequential commands → 1 pipeline = ~200× faster

Changes:
- redis_get_batch now uses redis::pipe() to batch all HGET commands
- redis_set_state pipelines HSET + SADD in a single round-trip
- redis_rebuild_from_db pipelines all writes for startup/reconnect

Impact:
- MSP runtime phase check: 2.4ms → <10us
- Position reconciliation: 2.4ms → <10us
- ~4.8ms saved per evaluation cycle (hot-path)

Audit: docs/redis_latency_audit_2026-03-31.md
Made-with: Cursor
  96. 2bfd4d8
    perf(postgres): pre-live tuning measurement-first (random_page_cost, effective_io_concurrency, work_mem)
    Mehr im Commit-Body
    Applied safe-now tuning based on comprehensive measurement:
- random_page_cost: 4 → 2 (both instances, SSD/NVMe-appropriate)
- effective_io_concurrency: 1 → 100 (both instances, modern SSD)
- work_mem: 4MB → 16MB (INGEST only, 44GB temp files proved necessity)

Proven improvements:
- symbol_safety_state multi-get: Seq Scan → Bitmap Index Scan
- L3 incremental: Parallel Seq Scan (cost 622K) → Merge Append Index Scan
- Runtime validated: no regressions, services healthy

Deferred: autovacuum per-table overrides (no bloat proof, high risk pre-live)

Settings persistent via ALTER SYSTEM (postgresql.auto.conf).
Rollback-ready via ALTER SYSTEM RESET + pg_reload_conf().

Made-with: Cursor
  97. 1ce3efe
    fix(tooling): make retention/proof_runner ingest-canonical for observation_runs
    Mehr im Commit-Body
    - Retention: guard deletes per-pool with to_regclass; never require observation_runs on decision.
- Proof runner artifacts: read observation_runs run_id from ingest pool only.

Made-with: Cursor
  98. 8257997
    fix(ingest): make run_id/id index rollout safe for partitions
    Mehr im Commit-Body
    Skip parent index creation in migration when raw tables are partitioned, and create per-partition indexes concurrently via the DBA script.

Made-with: Cursor
  99. e7d7f3f
    perf(ingest): add (run_id, id) indexes for incremental refresh
    Mehr im Commit-Body
    Adds indexes on raw ingest tables to support WHERE run_id = $1 AND id > watermark patterns used by run_symbol_state incremental refresh. Includes a DBA script to create them concurrently in production.

Made-with: Cursor
  100. a6a61d3
    perf(decision): add time-window indexes for execution_orders and fills
    Mehr im Commit-Body
    Adds execution_orders(created_at) index for 24h/1h observability windows and an expression index on COALESCE(ts_exchange, ts_local) for fills time-window queries. Includes DBA scripts to create indexes concurrently in production.

Made-with: Cursor
  101. e646c4d
    perf(decision): add indexes for positions and open execution_orders symbols
    Mehr im Commit-Body
    Adds partial indexes to speed up positions pinned/exposure queries and a partial index (with DBA concurrent helper) to avoid seq scan + sort for pinned_symbols_from_open_orders.

Made-with: Cursor
  102. 801fedf
    perf(ingest): serve run health counts from run_symbol_state
    Mehr im Commit-Body
    run_health_timeline_last_n no longer counts raw ticker/trade/L2/L3 rows. It sums counts from run_symbol_state per run and uses per-run LATERAL MAX(ts_local) to compute feed freshness.

Made-with: Cursor
  103. 70479e1
    perf(decision): add index for raw_private_executions unmatched parsed fetch
    Mehr im Commit-Body
    Adds composite index on (matched_status, parse_status, first_seen_at) and a DBA script to create it concurrently in production.

Made-with: Cursor
  104. 3ee9edd
    fix(safety): reset l3_resync_count when hard block expires
    Mehr im Commit-Body
    Keep clear_expired_hard_blocks consistent with clear_l3_resync_blocks by
also zeroing l3_resync_count; prevents immediate re-block after expiry.

Made-with: Cursor
  105. 290dad6
    Revert "fix(safety): reset l3_resync_count when hard block expires"
    Mehr im Commit-Body
    This reverts commit 04f02595e66400732fef02a4a467edf23b33b36d.
  106. 04f0259
    fix(safety): reset l3_resync_count when hard block expires
    Mehr im Commit-Body
    clear_expired_hard_blocks now also zeroes l3_resync_count to prevent
immediate re-blocks after expiry cleanup.

Made-with: Cursor
  107. 02805bd
    Revert "docs: PostgreSQL ingest/decision query audit report (2026-03-30)"
    Mehr im Commit-Body
    This reverts commit 1418a3dc1c228d48d68b9f7c197ef9959bde6583.
  108. 8153b51
    Revert "fix(safety): reset l3_resync_count when hard block expires"
    Mehr im Commit-Body
    This reverts commit 4fcc1b58ddb245f87b314dc4f3aa6686a60765e9.
  109. a666000
    fix(live): retry instrument preload with bounded backoff
    Mehr im Commit-Body
    Instead of failing run-execution-live immediately when instrument preload fails, retry in-process with exponential backoff capped at 60s to avoid restart storms on transient network/DNS issues.

Made-with: Cursor
  110. 4fcc1b5
    fix(safety): reset l3_resync_count when hard block expires
    Mehr im Commit-Body
    When clearing expired hard blocks, also clear l3_resync_count so symbols return to a clean safety state.

Made-with: Cursor
  111. 1418a3d
    docs: PostgreSQL ingest/decision query audit report (2026-03-30)
    Mehr im Commit-Body
    Made-with: Cursor
  112. cf18695
    fix(safety): auto-clear expired hard_blocked symbols at startup
    Mehr im Commit-Body
    Symbols with mode='hard_blocked' and expired hard_block_until were
never reset to 'normal', permanently inflating dashboard counts.
Added clear_expired_hard_blocks() called at startup of ingest,
execution, and exec-only paths.

Made-with: Cursor
  113. 9189d80
    fix(observability): scope run_health_timeline query to relevant run_ids
    Mehr im Commit-Body
    The CTEs for ticker/trade/L2/L3 aggregation were scanning ALL rows
across all runs instead of filtering by the last N run_ids from the
runs CTE. With millions of L2/L3 rows this took 5+ minutes, blocking
DB I/O and stalling the ingest epoch cycle.

Made-with: Cursor
  114. 646acf1
    fix(freshness): eliminate remaining slow L3 MAX(ts_local) queries
    Mehr im Commit-Body
    All 3 remaining callers of last_timestamps_for_run (ingest_runner stream
health, consistency_watchdog, observability export) only used ticker/trade
timestamps but still triggered ~10-min L3 table scans. Switched to
freshness_timestamps_for_run and removed the now-dead function.

Made-with: Cursor
  115. 052d04d
    fix(pinned): include error/reconcile/done as terminal order statuses
    Mehr im Commit-Body
    pinned_symbols_from_open_orders only excluded filled/rejected/canceled,
causing 711 stale orders (error/reconcile/done) to pin 133 symbols.
This reduced epoch active symbols from ~170 to ~34.

Made-with: Cursor
  116. 582b026
    fix(freshness): use only ticker/trade for freshness, skip L2/L3 hot-path queries
    Mehr im Commit-Body
    The DATA_FRESHNESS_STATE check was querying MAX(ts_local) on l2_snap_metrics
(2M+ rows) and l3_queue_metrics (3M+ rows), taking 631 seconds under write
contention. By the time all four queries completed, ticker/trade timestamps
were stale, causing false data_stale=true.

Freshness now uses only ticker/trade timestamps (millisecond queries).
L2/L3 coverage is already checked separately via FEATURE_READY_SIGNAL.

Made-with: Cursor
  117. 7c294a6
    fix(writer): dual-channel writer separates ticker/trade from L2/L3
    Mehr im Commit-Body
    The single bounded mpsc(2048) channel was shared by all data types.
High-volume L2/L3 writes saturated the channel, blocking ticker/trade
writes and freezing DB timestamps that readiness depends on — causing
data_stale=true even when feeds were active.

Split into two independent writer tasks:
- Priority channel (512): ticker + trade only (freshness-critical)
- Bulk channel (4096): L2 + L3 only (high-volume)

Each channel has its own writer task, batching, and metrics logging.
L2/L3 backpressure can no longer starve ticker/trade freshness updates.

Made-with: Cursor
  118. 7ca95b3
    fix(live_runner): use data_run_id for l2_feature_coverage state sync check
    Mehr im Commit-Body
    When ingest_provides_data=true, the coverage check queried run_id (execution's
own) which has no market data in the DB. This caused STATE_SYNC_REQUIRED to
fire on every evaluation, blocking the entire eval loop. Now queries
data_run_id (the ingest epoch's run_id) which has the actual state.

Made-with: Cursor
  119. ae164ca
    fix(arch): unify freshness on ingest SSOT, eliminate duplicate execution writes
    Mehr im Commit-Body
    When a separate ingest process is active, the execution process now:
- Feeds price_cache from ticker/trade WS in cache-only mode (no DB writes)
- Skips spawning L2/L3 feeds (ingest provides canonical data)
- Uses the ingest epoch's run_id (bound_run_id) for all data queries:
  refresh_run_symbol_state, readiness, universe, feature_ready
- Exec-only mode: ticker WS is always cache-only

Removes microstructure_stale gate from execution_realism. Global data
freshness is handled by the readiness report (data_stale) which gates
the evaluation loop. execution_realism now focuses on per-symbol market
activity: spread cap, tape count, trade recency, edge expiry.

Root cause: execution ran duplicate WS connections and wrote duplicate
ticker/trade/L2/L3 rows, causing writer channel backpressure (2048
bounded mpsc saturated by L2/L3 volume) that blocked ticker/trade
persistence and froze readiness timestamps. Additionally,
execution_realism used price_cache (in-memory, change-driven) as a
second freshness truth that diverged from the canonical ingest DB.

Made-with: Cursor
  120. fbab34d
    fix(exit): align static SL breakeven activation threshold
    Mehr im Commit-Body
    Apply the same breakeven activation floor as position_monitor for static stop-loss protection so low-fee accounts don’t diverge between exit lifecycle and monitor takeover.

Made-with: Cursor
  121. 8feb704
    chore(cleanup): delete unused skeleton and stage modules
    Mehr im Commit-Body
    Remove proven-unused skeleton directory and legacy pipeline stage modules that had no call sites.

Made-with: Cursor
  122. cd31084
    chore(cleanup): remove unused skeleton and legacy modules
    Mehr im Commit-Body
    Drop proven-unused skeleton modules and legacy pipeline/validation helpers, and silence a DB-row dead_code warning without altering runtime behavior.

Made-with: Cursor
  123. a8a97d3
    fix(pipeline): make missing state-row liquidity fallback symmetric
    Mehr im Commit-Body
    Use the same conservative spread-only liquidity classification when the per-symbol state row is missing, for both maker and taker entries, to avoid asymmetric forced Ineligible outcomes.

Made-with: Cursor
  124. 36f888a
    fix(pipeline): do not hard-block pure taker via conflict lane
    Mehr im Commit-Body
    Keep maker-preferred behavior by applying taker penalties, but remove the maker-only hard block so profitable taker fallbacks remain possible.

Made-with: Cursor
  125. 64fc1ea
    refactor(edge): use canonical surplus edge in readiness
    Mehr im Commit-Body
    Align readiness edge with route/pipeline by using expected_surplus_bps (cost breakdown) as the canonical expected edge instead of a separate fill_prob-weighted formula.

Made-with: Cursor
  126. efe1285
    refactor(readiness): make spread anchor a soft signal
    Mehr im Commit-Body
    Remove readiness’ hard spread cap so spread admission is single-sourced downstream (conflict lane / realism), while keeping spread health only for high-conviction labeling.

Made-with: Cursor
  127. 0d1a390
    fix(route): align feature-complete with rolling L2 window
    Mehr im Commit-Body
    Use a rolling 15-minute L2 snapshot count for is_feature_complete so restart/run_id rollovers don’t wrongly pre-exclude symbols before edge/route evaluation.

Made-with: Cursor
  128. e68fbc9
    fix(health): base watchdog stats on process run_id
    Mehr im Commit-Body
    Use live runner’s process run_id for funnel/order activity and ingest freshness checks to avoid false stalls when the bound epoch run_id differs from writer scope.

Made-with: Cursor
  129. a0ab818
    fix(exit): enforce BE floor for native trailing stops
    Mehr im Commit-Body
    Cap trailing-stop distances after a fee-aware break-even level so protection cannot trail below break-even once price has moved sufficiently.

Made-with: Cursor
  130. a4a5596
    fix(exit): make break-even fee-aware
    Mehr im Commit-Body
    Compute break-even floors using roundtrip fees instead of fixed bps offsets, for both static SL amend logic and the position monitor’s static SL trailing.

Made-with: Cursor
  131. d8e06fa
    fix(universe): use rolling 15m activity counts for gating
    Mehr im Commit-Body
    Replace per-run cumulative activity counters with a rolling ts_local window so universe selection and epoch validity don’t collapse after run_id rollovers.

Made-with: Cursor
  132. e581d71
    Revert "fix(universe): warm-gate hard trade liquidity filter"
    Mehr im Commit-Body
    This reverts commit 533027677ec7253e929e34f150d8d31dc2a6f471.
  133. 5330276
    fix(universe): warm-gate hard trade liquidity filter
    Mehr im Commit-Body
    Delay hard execution liquidity filtering until run data is warm (sufficient rows and age>=10m), and clamp run-age to avoid divide-by-zero.

Made-with: Cursor
  134. 7be0e7e
    fix(execution): apply spread realism cap only for taker entries
    Mehr im Commit-Body
    Maker/post-only routes already price half-spread capture; enforcing
EXECUTION_REALISM_SPREAD_CAP_BPS against full spread blocked valid
Execute plans (e.g. ENTRY_BLOCKED_EXECUTION_REALISM spread_cap_exceeded).

Made-with: Cursor
  135. d8c1a36
    fix(pipeline): maker limit falls back to last ticker top-of-book
    Mehr im Commit-Body
    Thin pairs can skip the 5s fresh ticker window while still passing L2-backed
V2 admission, which produced only no_price_snapshot_for_maker Skips and
ranked=0. After snapshot_fresh fails, use snapshot; try normalized pair key for
BTC/XBT-style cache entries.

Made-with: Cursor
  136. c5712fe
    fix(pipeline): V2 edge floor uses same EV basis as route admission
    Mehr im Commit-Body
    validate_candidate gates on pre-L3 net edge; L3 only scales ranking. The pipeline
used post-L3 expected_net_edge_bps for edge_floor_block, so valid selections could
still be skipped and EDGE_FLOW_RANKED stayed empty.

Use max(post-L3, pre-L3) for hard EV checks, conflict taker shortfall, sizing,
and outcome edge_score so admission matches selection (incl. adaptive edge).

Made-with: Cursor
  137. 57af163
    fix(route): maker pre-L3 net edge matches readiness surplus (no fill_prob wrap)
    Mehr im Commit-Body
    Readiness expected_surplus_bps is linear in capturable/fees/slips/spread/drag.
The maker branch scaled only the core block by fill_probability while subtracting
full wait/drag, making route validation far stricter than readiness on low-fill
names and causing pervasive pre-L3 EdgeNegative.

Made-with: Cursor
  138. ec04465
    fix(route): align surplus stack with readiness (TSL drag, L3 validate)
    Mehr im Commit-Body
    - Replace dynamic wait_risk with fixed READINESS_TSL_DRAG_BPS (2) matching
  strategy_readiness_report cost breakdown.
- Run validate_candidate / EdgeNegative on net edge before soft L3 multiplier;
  L3 only scales ranking edge and time_adjusted_score per existing intent.

Made-with: Cursor
  139. 1cd91a8
    fix(route): unify expectancy move basis with readiness strategy move
    Mehr im Commit-Body
    Path expected_move alone could be below the move/fee gate while readiness
already used compute_expected_move_for_strategy (vol_proxy=micro like
strategy_readiness_report). Use max(path, strategy move) for capturable
inputs, net-edge move scaling, relative_move_score, and validate_candidate.

Made-with: Cursor
  140. 7a8e431
    fix(edge): drop adaptive matrix rows with disallowed exit regimes
    Mehr im Commit-Body
    Route families included exit modes that select_allowed_exit_regimes never
admits for the current path/features, yielding only ExitRegimeNotAllowed
candidates. Pre-filter the regime matrix so evaluation matches the same
exit-regime contract as the path model.

Made-with: Cursor
  141. ff692b7
    fix(edge): align adaptive V2 regime with readiness detect_regime
    Mehr im Commit-Body
    Readiness uses RegimeMetrics (scaled trade_density) + detect_regime for
strategy fan-out; adaptive used classify_regime on raw features, so the
route matrix could disagree with the same symbol’s readiness tradable
rows. Drive V2 route matrix bucket from the same metrics/mapping and
refresh payoff asymmetry for the selected bucket.

Made-with: Cursor
  142. cdd7de0
    fix(live): ingest readiness/route/pipeline use writer run_id, not epoch run_id
    Mehr im Commit-Body
    Combined observe+execution path used bound_run_id from epoch while ticker/trade/L2/L3
WS writers tag rows with the process observation run_id. When LIVE_USE_OWN_RUN_ONLY
is false, those can differ — last_timestamps_for_run and run_symbol_state then read
stale MAX(ts_local) for the wrong run. Align with execution-only path (run_id).

Made-with: Cursor
  143. b9cb33b
    fix(readiness): structural freshness uses L2/L3 ts_local, not only ticker/trade
    Mehr im Commit-Body
    data_stale used min age over ticker and trade MAX(ts_local) only; Kraken ticker
is change-driven so MAX can lag while L2/L3 keep advancing. Align staleness with
all ingest feeds already returned by last_timestamps_for_run.

Made-with: Cursor
  144. fbf025c
    fix(readiness): align live data_stale with ticker/trade timestamps
    Mehr im Commit-Body
    run_readiness_analysis_for_run_from_state used only MAX(updated_at) on
run_symbol_state, which could mark DataStale while raw ticker/trade rows
were still within LIVE_DATA_MAX_AGE_SECS. Structural freshness now matches
run_readiness_analysis_for_run; last_* fields in the report reflect real
L2/L3/ticker/trade max(ts_local).

Made-with: Cursor
  145. 0c7de5e
    fix(edge): scenario tail net edge uses regime-scaled tail_upside
    Mehr im Commit-Body
    build_move_distribution already scales tail_upside by regime (e.g. 1.5× for
VolatilitySpike), but compute_scenario_edges used p90 (= raw upside) for
net_edge_tail. is_admissible TailPositive therefore ignored that scaling,
keeping admitted=false and tradable_count=0 despite candidate volume.

Regression test: spike tail net edge exceeds calm for the same path.

Made-with: Cursor
  146. 4fd10fd
    fix(edge): apply adaptive admission for any V1 reject when is_admissible
    Mehr im Commit-Body
    Production logs showed candidates>0 but pairs_no_valid_candidate=10 and
pairs_valid_but_nonpositive_score=0 — V1 dominant codes included
path_confidence_too_low, which was never eligible for the narrow override.

When is_admissible passes, promote using scenario ranking edge and recompute
time_adjusted_score with regime-aware confidence so select_winner_adaptive can
rank positive scores.

Made-with: Cursor
  147. e3e8584
    fix(route): analyze_run_from_state uses ingest pool when split
    Mehr im Commit-Body
    run_adaptive_route_analysis / run_v2_route_analysis_with_ingest passed the
decision pool into analyze_run_from_state, which reads observation_runs and
run_symbol_state on ingest. Use ingest_pool.unwrap_or(pool) for that read.

Made-with: Cursor
  148. c4873a2
    fix(execution): route V2 pipeline ingest vs decision pools
    Mehr im Commit-Body
    analyze_run_from_state reads observation_runs and run_symbol_state on ingest;
funnel/candidate vectors/shadow trades stay on decision. Live was passing only
the decision pool and crashed with missing observation_runs. Shutdown UPDATE
for observation_runs now uses ingest_pool.

Made-with: Cursor
  149. 226181a
    fix(execution): pass edge_score as L3 quality for hybrid fill probability
    Mehr im Commit-Body
    Hardcoded l3_quality_score=0 forced hybrid path to fp*0.5, crushing
expected_edge_bps and blocking all pairs at readiness EdgeNegative.

Made-with: Cursor
  150. 21dfa73
    feat(db): harden dual-pool ops — no DATABASE_URL, identity suffix, overlap guard
    Mehr im Commit-Body
    - Reject legacy DATABASE_URL; require distinct INGEST_DATABASE_URL and DECISION_DATABASE_URL.
- Validate current_database() suffix _ingest vs _decision per role.
- Fail startup if krakenbot table names overlap across pools (DB_SCHEMA_OVERLAP_FORBIDDEN).
- Route epoch/lineage/run_symbol_state and related reads through ingest pool in live_runner;
  remove ingest→decision sync helpers from run_symbol_state and symbol_safety_state.
- ingest_runner: decision pool for safety/pinned; drop dual-write of epochs to decision.
- Add operator maintenance DROP scripts and db_inventory_compare.sh for overlap proof.
- Update .env.example, trading_env, DBA scripts, and execution systemd comment.

Made-with: Cursor
  151. 4882871
    feat(db): dual-pool env INGEST_DATABASE_URL + split sqlx migrations
    Mehr im Commit-Body
    - Replace DATABASE_URL with INGEST_DATABASE_URL in config, probes, scripts, docs
- trading_env: INGEST_DB_* URL construction; no legacy DATABASE_URL shim
- Split migrations into migrations/ingest (13) and migrations/decision (32);
  edge persistence ALTER runs after candidate_decision_vectors (20260331110000)
- Optional INGEST_/DECISION_EXPECTED_DATABASE_NAME -> DB_TARGET_MISMATCH
- Runbook, audit, decontaminate inventory SQL, negative-test notes

Made-with: Cursor
  152. cb8393e
    feat(scripts): enforce DB pool via psql_pool.sh + CI assert
    Mehr im Commit-Body
    - Add scripts/psql_pool.sh: ingest|decision|replay|exec with live identity on stderr
- Add assert_no_raw_psql.sh and run it from scripts/check.sh (no raw psql in scripts/**/*.sh)
- Migrate all shell scripts that called psql on DATABASE_URL/DECISION URLs to psql_pool
- measure_reconcile + flow_capture: DECISION_DATABASE_URL only (remove ingest fallback)
- pg_dba_vacuum_analyze_hot_tables: use decision pool for execution/safety tables (was DATABASE_URL)
- Docs: AGENTS.md + db-diagnosis-routing note

Made-with: Cursor
  153. 44915c5
    fix(execution): create execution_live observation run on ingest first (dual-DB contract)
    Mehr im Commit-Body
    Aligns with ingest_runner: ingest owns raw-sample FK chain; decision receives
the same run_id via ensure_observation_run_on_pool. Removes shutdown re-ensure
to ingest (run already originated there).

Made-with: Cursor
  154. c684a53
    feat(scripts): mechanical DB pool precheck + AGENTS gate
    Mehr im Commit-Body
    - Add db_target_precheck.sh: live SQL identity for ingest/decision with mandatory block output
- Run precheck before readiness in validate_execution_on_server and validate_live_engine_server
- ws_safety_report: decision precheck before execution/safety SQL
- AGENTS.md: operator/agent instructions beyond Cursor rules; link from trading_env + db rule

Made-with: Cursor
  155. eef104c
    fix(execution): mirror observation_runs to ingest at execution_live start
    Mehr im Commit-Body
    execution_live inserts the run on decision; ticker/L2/L3 writers use ingest.
Without the same run_id on ingest, partitioned l3_queue_metrics FK fails and L3
state can diverge. Sync row at startup and realign observation_runs id sequence.

Made-with: Cursor
  156. 03c3725
    fix(execution): seed price_cache from ingest before run-execution-once submit
    Mehr im Commit-Body
    CLI one-shot had instrument cache after preload but no ticker WS, so market
prevalidation failed on empty price_cache. Pull latest bid/ask from
ticker_samples for the run (fallback l2_snap_metrics) and update price_cache.

Made-with: Cursor
  157. b452080
    fix(execution): preload Kraken instrument WS cache in run-execution-once
    Mehr im Commit-Body
    run-execution-once is a separate process from the long-lived runner; without
preload_all the constraints cache stayed empty and exchange prevalidation
skipped submit (e.g. after route-proof zero-tradable fallback).

Made-with: Cursor
  158. 4477ca4
    fix(execution): route proof fallback when V2 tradable_count=0; configurable realism spread cap
    Mehr im Commit-Body
    - When ROUTE_PROOF_MODE is on and no tradable routes, pick tightest-spread
  feature-complete symbol in scope and plan a small taker entry via plan_execution.
- Add EXECUTION_REALISM_SPREAD_CAP_BPS (5..500, default 60) for flow_execution
  pre-submit spread check.

Made-with: Cursor
  159. 63a0f7f
    feat: MIN_L2_SNAPSHOTS_FEATURE_COMPLETE env for feature-complete gate
    Mehr im Commit-Body
    Default remains 50; operators may lower (1..=200) when a fresh observation
run must participate in routing before L2 sampler reaches 50 ticks per symbol.

Made-with: Cursor
  160. 891c1de
    fix(v2): sync time_adjusted_score after adaptive admission override
    Mehr im Commit-Body
    Adaptive is_admissible could mark a route valid while the candidate still
carried V1 negative edge and a non-positive time_adjusted_score, so
select_winner_adaptive never selected a route (tradable_count stayed 0).

After override, set expected_net_edge_bps from median/tail/best edge and
recompute time_adjusted_score with the same elasticity factors as
evaluate_route_candidate.

Made-with: Cursor
  161. fd5e6e2
    fix(execution): run phantom open-order reconcile every epoch; remove is_fresh gate
    Mehr im Commit-Body
    - Periodic phantom cleanup now matches startup: ownOrders coherent only
- Invoke reconcile_phantom_open_orders_periodic once per bound epoch (live + exec-only)
- Removes silent no-op when cache was coherent but slightly stale

Made-with: Cursor
  162. e0086ea
    fix(execution): periodic DB open-order reconcile vs exchange ownOrders
    Mehr im Commit-Body
    - Treat coherent+fresh own_orders_cache as SSOT for open Kraken order IDs
- Mark DB rows in active statuses missing from snapshot as reconcile (incl cancel_requested)
- Run every 10 evaluations on execution-live and execution-only loops
- Clarify module docs: DB drift corrected toward exchange, not vice versa

Made-with: Cursor
  163. 057985b
    chore(cursor): enforce ingest vs decision DB routing for diagnosis
    Mehr im Commit-Body
    Made-with: Cursor
  164. 5c14d8f
    Add minimal execution summary counters (no log spam)
    Mehr im Commit-Body
    Single EXECUTION_SUMMARY line per v1/v2 pipeline cycle plus optional
EXECUTION_FULL_BLOCK when ranked candidates exist but none execute.
Classify skips into aggregate buckets without per-symbol logging.

Made-with: Cursor
  165. dde0dd6
    collect_open_ssot_evidence: single time-bounded aggregate (avoid full-table max)
    Mehr im Commit-Body
    Made-with: Cursor
  166. 2864c4a
    collect_open_ssot_evidence: set PG statement_timeout for psql
    Mehr im Commit-Body
    Made-with: Cursor
  167. cfd83dc
    Persist SSOT audit rows: fanout, route scope, MSP blocks; run-once regime
    Mehr im Commit-Body
    - trading_funnel_events: FANOUT_GATE_APPLIED (live_runner + run-execution-once),
  FANOUT_ROUTE_SCOPE from route analysis when funnel_pool is decision DB,
  EXECUTION_BLOCKED_NO_MSP*, MSP_ADMISSION_BLOCK from flow path.
- run_execution_once: stamp intent.regime from CapitalAllocator bucket;
  optional RUN_ONCE_EQUITY_QUOTE for sizing context.
- scripts/collect_open_ssot_evidence.sh: SQL counts for new markers + regime column.
- Unit tests for queue_decision and ImprovePrice propagation in execution_planner.

Made-with: Cursor
  168. aa9866c
    docs(ENGINE_SSOT): sluit GEDEELTELIJK af — AFGELOPEN, OPEN, L2/L3-afronding
    Mehr im Commit-Body
    - Statusregels: AFGELOPEN (ontwerp), AFGELOPEN (observatie), OPEN (bewijs pending)
- Matrix: Multiregime/Maker/MSP/eligibility/reconcile/protection/Fan-out → OPEN; Multistrategy + flow + warming → AFGELOPEN
- Tabel afronding L2/L3-plan ↔ SSOT; forced validation 2026-03-27 bijgewerkt

Made-with: Cursor
  169. ae18d81
    docs(ENGINE_SSOT): matrix + V3 gate — flow-poller, D5 fan-out, maker-queue
    Mehr im Commit-Body
    - §6: execution bullet uses flow-poller/heap wording (not legacy Top-1)
- §7: V3 BLOCKING checklist (L2/L3 plan): SQL + journal + L2 regressie AND
- Multiregime row: primary bewijsniveau runtime-seen; regime column code-wired
- Maker/queue row: reflects D5 intent wiring; GEDEELTELIJK until ImprovePrice proven
- Flow poller row renamed; fan-out D5 matrix row + testmethoden; probe/ExitManager VERWIJDEREN row

Made-with: Cursor
  170. d537b00
    feat(execution): run-execution-once uses D5 chain (V2 + fanout + pipeline_v2)
    Mehr im Commit-Body
    - Refresh run_symbol_state, readiness from state + live fee tier (same as live path)
- Hard-block filter on decision DB, fanout gate + FANOUT_* logs
- V2 route analysis with EDGE_ENGINE_V2 gate; run_strategy_pipeline_v2 with exec_allowed
- EXECUTION_DECISION log; pass LiveFeeProvider into submit path

Made-with: Cursor
  171. c1d0298
    chore(execution): D5 cleanup — legacy queue_ahead from L2, lean logs
    Mehr im Commit-Body
    - Legacy readiness pipeline: queue_decision uses depth_near_mid from L2 map when present (was always 0)
- order submit log: include execution_mode alongside queue_decision/post_only
- EXECUTION_DECISION: structured fields only (no duplicate format args)

Made-with: Cursor
  172. d3a0cb8
    feat(execution): D5 contract — fanout gate, maker/taker intent, adapter + logs
    Mehr im Commit-Body
    - OrderPlan/ExecutionIntent: execution_mode, post_only, fallback_policy, queue_decision
- plan_execution validates maker vs taker; ExecutionIntent::from_order_plan enforces contract
- V2 route analysis optional fanout symbol filter + FANOUT_ROUTE_SCOPE
- live_runner: intersect exec_allowed with fanout, FANOUT_DECISION / FANOUT_GATE_APPLIED; pass set into V2 ingest
- kraken_adapter: post_only and queue_decision from intent; EXECUTION_DECISION in flow_execution
- diagnostics/shadow_compare: adaptive route analysis fanout arg None

Made-with: Cursor
  173. 4eca86e
    docs(SSOT): correct L3/is_feature_complete claim, add L2 persistent chain row
    Mehr im Commit-Body
    L3 data (l3_count) is NOT part of is_feature_complete — that gate checks
only spread + microprice + l2_count >= 50. L3 absence is handled via
MISSING_L3_PENALTY and L3_QUALITY_FLOOR_NO_L3 (graceful degradation).

Add statusmatrix row for L2 persistent chain (server-proven, VOLLEDIG):
run 934, 638/638 symbols l2_count >= 50, ~18 rows/sym/min, reader-sampler
split (f6c99b6).

Made-with: Cursor
  174. f6c99b6
    l3_ts_partition_retention_drop: support --dry-run flag
    Mehr im Commit-Body
    Made-with: Cursor
  175. 3fa1001
    observe(l2): pass 2 — checksum/resync WARN only via heartbeat thresholds
    Mehr im Commit-Body
    - L2_CHECKSUM_MISMATCH and L2_READER_CHECKSUM_RESYNC_REQUESTED always DEBUG
- Aggregate WARN: L2_CHECKSUM_MISMATCH_ELEVATED (>=80/30s), L2_CHECKSUM_RATE_EXTREME (>=200)
- L2_CHECKSUM_RESYNC_STORM when resync batches >=25 per heartbeat window
- Drop per-symbol cooldown maps; enrich extreme WARN with top_symbols context

Made-with: Cursor
  176. 2cca6ce
    Add L3 time-partition cutover, daily ensure, and partition-DROP retention scripts
    Mehr im Commit-Body
    Made-with: Cursor
  177. 96bd3ab
    Add L3 time-partition target table (daily UTC), BRIN, ensure_l3_daily_partitions()
    Mehr im Commit-Body
    Made-with: Cursor
  178. d9ff636
    observe(l2): move L2_SAMPLE_TICK and L2_SAMPLE_ROW_WRITTEN to DEBUG
    Mehr im Commit-Body
    - Per-interval sampler detail stays at DEBUG; L2_SAMPLER_HEARTBEAT remains INFO

Made-with: Cursor
  179. deb8893
    observe(l2): rate-limit checksum/resync WARN + L2_CHECKSUM_HEARTBEAT
    Mehr im Commit-Body
    - L2_CHECKSUM_MISMATCH: WARN at most once per symbol per 60s, else DEBUG
- Resync requested/completed: WARN only for symbols newly outside cooldown; completed at DEBUG
- L2_CHECKSUM_HEARTBEAT on reader 30s tick with aggregate counters and top symbols
- L2_CHECKSUM_RATE_EXTREME WARN when window mismatch count exceeds threshold

Made-with: Cursor
  180. b31d275
    observe(l3): replace per-symbol l3_metrics_emitted INFO with DEBUG + L3_METRICS_HEARTBEAT
    Mehr im Commit-Body
    - Log per-emit l3_metrics_emitted at DEBUG only
- Emit aggregate L3_METRICS_HEARTBEAT at most once per 30s with window counts

Made-with: Cursor
  181. 7ba30e4
    L3 maintenance: empty-cut and zero-row skip, optional BRIN SQL, retention preflight skip flag
    Mehr im Commit-Body
    Made-with: Cursor
  182. 8ae4247
    L3 maintenance: scalable preflight (observation_runs + run_id-scoped mx), lighter inventory SQL
    Mehr im Commit-Body
    Made-with: Cursor
  183. 96cb9c2
    Add L3 ingest maintenance: inventory, watermark preflight, batched time-cut delete, retention
    Mehr im Commit-Body
    Made-with: Cursor
  184. c19388f
    fix(l2): split runtime loop into reader + sampler tasks (D1 structural fix)
    Mehr im Commit-Body
    The single-task select! loop could not guarantee 5s sample timer
execution under continuous WS book traffic. Split into two independent
tokio tasks sharing books via Arc<RwLock<HashMap>>:

- Reader task: drains WS messages, short write-lock for book mutation,
  handles checksum resync with explicit markers
  (L2_READER_CHECKSUM_RESYNC_REQUESTED/COMPLETED, L2_READER_STREAM_ENDED).
- Sampler task: 5s interval, short read-lock for minimal snapshot
  extraction, builds rows + sends outside lock.
- Failure propagation: either task exit aborts sibling, returns Err
  to trigger outer reconnect. Exit logs include explicit cause field.
- Dual heartbeats: L2_READER_HEARTBEAT + L2_SAMPLER_HEARTBEAT (30s).
- Subscribe phase unchanged (single-threaded before split).

Made-with: Cursor
  185. 1feba08
    fix(l2): subscribe drain wait for acks or budget, not idle gap
    Mehr im Commit-Body
    10ms read timeout no longer ends the batch drain; only full ack set,
drain wall budget, stream end, or read error stops the loop.

Made-with: Cursor
  186. c579c57
    fix(l2): bounded subscribe drain + batch timing markers (D1)
    Mehr im Commit-Body
    Evidence: batch drain waited for 10ms idle while book updates never go idle,
stalling wall-clock minutes per subscribe batch before the sample loop ran.

- Cap per-batch drain at L2_SUBSCRIBE_BATCH_DRAIN_MAX (350ms) and exit early
  when batch_acked >= chunk.len().
- Add monotonic elapsed_ms markers: L2_BATCH_* lifecycle, first sample/row,
  L2_SUBSCRIBE_BATCH_DRAIN_INCOMPLETE when capped without full acks.
- Log L2_FEED_LOOP_STARTED / L2_SNAPSHOT_WINDOW_COMPLETE with elapsed_ms.

Made-with: Cursor
  187. a50c4ea
    chore(scripts): add collect_l2_l3_plan_evidence for D1-D2-V3 SQL gates
    Mehr im Commit-Body
    Made-with: Cursor
  188. 67f38ec
    fix(l2): biased select + heartbeats + markers for persistent sampling
    Mehr im Commit-Body
    - Use tokio::select! { biased; } so sample_interval wins over read.next()
  (avoids WS update starvation of L2Snap writes).
- Explicit read stream end (None) and L2_FEED_LOOP_EXITED; channel close
  logs L2_WRITER_CHANNEL_CLOSED.
- L2_FEED_HEARTBEAT every ~30s: subscribed_symbols, books_tracked,
  sample_ticks, rows_written_total; L2_SAMPLE_TICK / L2_SAMPLE_ROW_WRITTEN
  aggregates per tick.
- L2_WRITER_ERROR on l2_snap insert failure (writer).
- L2_FEED_TASK_ABORTED / L2_FEED_TASK_RESTARTED around L2 handle in
  ingest_runner and live_runner.

Made-with: Cursor
  189. 3af9fb4
    fix(ingest): avoid L2/L3 feed restart when universe sets unchanged
    Mehr im Commit-Body
    Universe refresh ran every 60–120s and always aborted and respawned L2/L3
feeds even when pool/L2/L3/execution symbol sets were identical. That
repeatedly reset multi-chunk L3 bootstrap (staggered connections + subscribe
ACKs), starving l3_queue_metrics and keeping l3_count low.

Restart feeds only when L2 set, L3 set, or execution set (for L2 validation)
actually changes; log UNIVERSE_SELECTION_SKIP_FEED_RESTART when skipping.
Initialize ingest current_l2/current_exec from the first snapshot.

Made-with: Cursor
  190. 82f61f6
    docs(ENGINE_SSOT): regime persist open until DB proof; L3 data note
    Mehr im Commit-Body
    - Multiregime: code-wired for regime column; no server-proven upgrade before SELECT
- New section: regime persist open proof + SQL success criteria
- Section 6: L3/l3_count and feed coverage; regime fix pending post-deploy order
- Forced validation test 8 marked not closed

Made-with: Cursor
  191. 3156897
    docs(ENGINE_SSOT): forced validation run 2026-03-27 + regime persist notes
    Mehr im Commit-Body
    Document restart/MSP rebuild evidence, multistrategy log samples, regime DB
counts; update section 6 and Multiregime row; replace regime gap with historical
NULL note.

Made-with: Cursor
  192. c6eeabf
    feat(execution): persist capital RegimeBucket to execution_orders.regime
    Mehr im Commit-Body
    Wire regime from sizing_decision through ExecutionIntent to insert_order so
observability no longer shows NULL for all orders. Protection and external
backfill paths pass None.

Made-with: Cursor
  193. b35206f
    docs(ENGINE_SSOT): matrix hardening — bewijsniveau-kolom, statusregels, 8 degradaties
    Mehr im Commit-Body
    Sectie 7 herschreven als bewijs-gedreven beslisinstrument:
- Bewijsniveau-definities (server-proven/runtime-seen/code-wired/docs-only)
- Afdwingbare statusregels (VOLLEDIG alleen bij server-proven)
- 8 items gedegradeerd van VOLLEDIG naar GEDEELTELIJK met concrete testmethoden en upgrade-voorwaarden
- Alle VOLLEDIG items voorzien van concreet bewijs (DB counts, log markers, Redis state)

Made-with: Cursor
  194. 9d46601
    docs(ENGINE_SSOT): NULL inet_server_addr edge case for live triple guard
    Mehr im Commit-Body
    Made-with: Cursor
  195. a686aba
    audit(docs): ENGINE_SSOT matrix verification and closure
    Mehr im Commit-Body
    Full matrix audit (27+ items) against code, runtime, and server state.
Corrections: execution attach (run-execution-only); DbPools mandatory;
competitive scoring replaced by V2; ExitManager dead code; dual regime
system documented; DB model A discontinued. Known gaps documented:
execution_orders.regime never populated; dual regime not consolidated.

Made-with: Cursor
  196. 31fa607
    feat(db): dual-DB live identity validation and distinct triple guard
    Mehr im Commit-Body
    - Add DbRole, LiveDbTriple, validate_pool_live_identity, assert_dual_db_live_identities_distinct
- create_pools: connect both pools, validate URL vs current_database, refuse identical triples, then migrate
- create_pools_from_env_urls for probes; main passes pre-parsed SanitizedDbTarget
- check-execution-readiness: print and log live triple per pool
- trading_env_psql_ingest/decision helpers; script role headers; docs and changelogs

Made-with: Cursor
  197. 0ecf8c7
    fix(msp): add flush_dirty diagnostics, material drift gate for entries
    Mehr im Commit-Body
    - flush_dirty: log MSP_FLUSH_CYCLE with dirty_total, eligible count,
  interval to diagnose why market_state_projection DB stays at 0 rows
- flow_execution: drift_detected only blocks entries when exchange or
  reconciled position qty is non-zero (material exposure), preventing
  phantom drift from stale expected_position_qty from blocking trades

Made-with: Cursor
  198. accc5eb
    fix(deploy): git-only deploy.sh; document in git-only-codeflow rule
    Mehr im Commit-Body
    Replace rsync-to-releases flow (forbidden by git-only policy) with
ssh git pull --ff-only + cargo build --release on /srv/krakenbot.
CHANGELOG: note under Systemd/operations.

Made-with: Cursor
  199. 5865903
    docs: MSP bootstrap invariant for live + exec-only (ENGINE_SSOT, CHANGELOG)
    Mehr im Commit-Body
    Document mandatory bootstrap, proof order (logs → decision DB → sample),
and verify_msp_projection_db.sh; changelog rows for 2bd36ef and c60f165.

Made-with: Cursor
  200. c60f165
    Add verify_msp_projection_db.sh for decision vs ingest MSP proof
    Mehr im Commit-Body
    Documents that market_state_projection must be queried on DECISION_DATABASE_URL;
ingest DATABASE_URL may show zero rows without indicating MSP failure.

Made-with: Cursor
  201. 2bd36ef
    Fix MSP DB persistence on run-execution-only
    Mehr im Commit-Body
    Execution-only never called init_global, init_engine, redis_rebuild_from_db,
or seed_symbols (only run-execution-live did), so MSP workers and periodic
DB flush never ran while Redis could still hold keys from prior runs.

Add bootstrap_msp_engine_and_redis + seed_pool_symbols helpers and invoke
them at execution-only startup; refactor execution-live to use the same helpers.

Made-with: Cursor
  202. c136add
    Document DB-first validation; trim execution/state dead code
    Mehr im Commit-Body
    - VALIDATION_MODEL + ENGINE_SSOT: PostgreSQL funnel + MSP as primary proof; journal secondary
- Remove duplicate market precheck and price_cache stale-diagnosis helpers (prepare_order covers path)
- Wire epoch_completed_at in DATA_FRESHNESS_EVALUATED; flow poller observes skipped; fill avg in logs
- Delete unused market_state module, load_unprotected_from_msp, ProofState, heap prune helper
- Consolidate MspEvent allows; explicit reservations for Halt and RepeatedFailure variants

Made-with: Cursor
  203. 6d56e92
    docs: add H/I dead_code scope — large-file inventory, no big refactor in lint rounds
    Mehr im Commit-Body
    Made-with: Cursor
  204. 6e95ecc
    docs(lint): finalize dead_code policy; parent mod allows for skeleton domains
    Mehr im Commit-Body
    - ENGINE_SSOT: definitive policy (no Cargo [lints] dead_code, item-level allow+reason,
  parent mod attributes for domain/skeleton; execution stays explicit)
- CHANGELOG + CHANGELOG_ENGINE: A/B/C summary for dead_code cleanup
- main.rs: #[allow(dead_code, reason)] on core/domain/edge/fees/market/observe/pipeline/
  risk/selection/skeleton/trading module declarations
- analysis/mod: allow on adverse_selection, friction_attribution, latency_breakdown,
  realized_surplus
- db/mod: allow on read; exchange/mod: allow on kraken_private

Made-with: Cursor
  205. 8cd1b59
    chore: replace blanket dead_code lint with targeted per-item annotations
    Mehr im Commit-Body
    Remove [lints.rust] dead_code = "allow" from Cargo.toml and add
#[allow(dead_code)] with reason strings on specific items across 78
files. Remove genuinely unused MSP code (MarketStatePatch,
upsert_partial, redis_invalidate, count). Adds rust-version = "1.83".

Made-with: Cursor
  206. c2eed1c
    docs: dead_code policy roadmap (execution/state/MSP first)
    Mehr im Commit-Body
    - ENGINE_SSOT: baseline accepted + phased narrowing plan
- CHANGELOG + CHANGELOG_ENGINE: reference

Made-with: Cursor
  207. 7267ea5
    chore: sqlx 0.8, dead_code via Cargo.toml lints
    Mehr im Commit-Body
    - Bump sqlx 0.7 -> 0.8.6 (drops never-type future-incompat in sqlx-postgres)
- Remove #![allow(dead_code)] from main.rs; set [lints.rust] dead_code in Cargo.toml
- Document policy in ENGINE_SSOT + changelogs

Made-with: Cursor
  208. a054350
    fix(msp): align upsert values with target columns
    Mehr im Commit-Body
    Correct the market_state_projection INSERT expression count to match
its 59 target columns (58 bind placeholders + now()). This resolves
runtime MSP_FLUSH_FAILED/MSP_EVENT_FAILED SQL errors.

Made-with: Cursor
  209. 9f548e6
    chore: warning debt cleanup, redis 0.32, probe price_cache
    Mehr im Commit-Body
    - Crate-level allow(dead_code) with documented rationale (schema/API reserves)
- Mechanical fixes: imports, mut, unused assignments, ignition invariant log field
- Probes: bid/ask from price_cache::snapshot_fresh (no deprecated REST)
- position_reconcile: reduce classification as bool directly
- raw_execution_backfill: keep tuple cl_ord_id for mark_event_matched
- redis 0.25 -> 0.32.7 (fixes never-type future-incompat in redis crate)
- sqlx 0.7 future-incompat noted in CHANGELOG (upgrade deferred)
- CHANGELOG.md + docs/CHANGELOG_ENGINE.md

Made-with: Cursor
  210. 1b5ebec
    fix(msp): correct market_state_projection upsert placeholder count
    Mehr im Commit-Body
    The INSERT statement listed more target columns than provided values,
causing MSP_EVENT_FAILED/MSP_FLUSH_FAILED on server runtime. Add missing
$57-$59 placeholders for event/runtime fields so upserts succeed.

Made-with: Cursor
  211. 6dd17f4
    execution/docs: align asymmetric MSP gating semantics
    Mehr im Commit-Body
    Make MSP mandatory for entry admission while keeping exit/protection paths
risk-reducing and degradable. Add hybrid MSP+DB/WS lock/notional checks,
startup phase visibility, and align docs/changelogs to hard-vs-soft
eligibility semantics and operational dual-DB wording.

Made-with: Cursor
  212. a360a4e
    msp: implement phase transition and confidence inference in derive_flags
    Mehr im Commit-Body
    The runtime_phase was permanently stuck at "bootstrap" because no
transition logic existed. This blocked ALL entries via entry_eligible=false.

Three fixes in derive_flags():
1. Phase transition: bootstrap→warming→live based on market_data_confidence
2. Confidence inference: exposure/order/protection confidence inferred
   from actual data state (no position + events processed = medium/high)
3. Readiness flags derived from phase (live = entries allowed)

Made-with: Cursor
  213. 31f9a68
    execution: debounce private ws reconnect requests
    Mehr im Commit-Body
    Rate-limit reconnect requests at the hub boundary so repeated watchdog/live-runner requests cannot trigger rapid reconnect churn.

Made-with: Cursor
  214. bd103a8
    execution: harden private ws reconnect and external TP guard
    Mehr im Commit-Body
    Prevent stale reconnect signals from immediately tearing down fresh private WS sessions, and ignore external TP-like sell orders when no live base position exists to avoid false protection/exit adoption.

Made-with: Cursor
  215. 9ecccc0
    docs: document MSP runtime projection integration
    Mehr im Commit-Body
    Capture the unified market-state projection and Redis runtime read-layer across architecture, runbook, and changelog docs so deploy/readiness behavior stays traceable and consistent with live execution paths.

Made-with: Cursor
  216. cae6ab5
    execution: move MSP migration to unique version
    Mehr im Commit-Body
    Replace the conflicting migration version with a new timestamped file to avoid sqlx duplicate-version and checksum conflicts during dual-DB startup migrations.

Made-with: Cursor
  217. ba904f8
    execution: add unified market-state projection with Redis runtime cache
    Mehr im Commit-Body
    Introduce an event-driven market_state_projection on the decision DB and wire live runtime flows to publish and consume MSP state through Redis for faster, consistent execution/protection/reconcile decisions.

Made-with: Cursor
  218. d768c71
    execution: enforce spot long-only order policy
    Mehr im Commit-Body
    Block sell-side entries in runner and reject negative-qty protection paths so execution remains crypto spot long-only (buy entries, sell exits only).

Made-with: Cursor
  219. 3b22b72
    execution: align spot exit classification with Kraken WS docs
    Mehr im Commit-Body
    Treat reduce/exit coverage by close-side direction relative to live spot position and stop relying on reduce_only as a required signal, matching Kraken WS v2 spot behavior.

Made-with: Cursor
  220. 2e6b975
    execution: treat manual reduce orders as protection truth
    Mehr im Commit-Body
    Merge private WS own-orders reduce quantities into exposure reconcile so manual protection orders are recognized and not repeatedly flagged as unprotected due to DB-only blind spots.

Made-with: Cursor
  221. 5126e04
    execution: prevent unintended protection cancellation on TP/remediation
    Mehr im Commit-Body
    Keep protection active unless TP market submit succeeds, and stop auto-canceling extra reduce orders during reserved-funds remediation so manual protection orders are preserved.

Made-with: Cursor
  222. 73466ca
    execution: unblock entries with per-symbol halt and single submit gate
    Mehr im Commit-Body
    Replace global entry_halt with per-symbol TTL halts, remove duplicate submit-time realism/precheck blockers, and keep submit admission consistent with the flow-stage realism decision.

Made-with: Cursor
  223. e73f51d
    execution: add stale-freshness protection-only escape and configurable reconcile age gates
    Mehr im Commit-Body
    - Add ALLOW_PROTECTION_ON_STALE_FRESHNESS when freshness is stale but private WS is recent and explicit exchange spot sum >= qty_min.
- Keep entries blocked by using AllowProtectionOnly decision only in reduce/protection flows.
- Make reconcile freshness caps env-configurable via RECONCILE_BALANCE_MAX_AGE_SECS and RECONCILE_OWN_ORDERS_MAX_AGE_SECS (defaults remain 30s).

Made-with: Cursor
  224. f0482b2
    scripts: check_execution_runtime_truth uses restart log in nohup mode
    Mehr im Commit-Body
    Nohup redirects stdout to run_execution_live_restart_*.log; journalctl _PID
often lacks FLOW_* markers. Use --log for truth check when not using systemd restart.

Made-with: Cursor
  225. b80f3ae
    execution: log EDGE_BIAS_BACKFILL_WORKER_STARTED marker when backfill disabled
    Mehr im Commit-Body
    check_execution_runtime_truth.sh greps for this substring; emit disabled_noop line
so waived path passes worker section without changing shell contract.

Made-with: Cursor
  226. b07969f
    execution: waive EDGE_BIAS_BACKFILL self-verify when backfill disabled
    Mehr im Commit-Body
    When EDGE_BIAS_BACKFILL_ENABLE is false no worker runs; mark gate satisfied so
EXECUTION_RUNTIME_SELF_VERIFY_OK can pass and restart_execution_live_validated.sh succeeds.

Made-with: Cursor
  227. d0b4dc2
    execution: per-symbol reconcile single-flight + phantom-flat cooldown
    Mehr im Commit-Body
    - Gate reconcile_symbol_durable with tokio Semaphore (try_acquire) so concurrent
  calls return SkippedConcurrentInvocation without running phantom logic again.
- After successful close_dust_position on phantom, record 5s exit-path cooldown
  (SkippedCooldownAfterPhantomResolve); CancelOnlyCleanup bypasses cooldown only.
- Add atomic + RECONCILE_DECISION metrics for skip totals; reconcile_invoke_guard logs.
- reconcile_symbol_durable_ignition retries skips for ignition critical path.
- protection_flow Pending on skip; live_runner/position_monitor info logs (not halt).

Made-with: Cursor
  228. 053cf7d
    obs: reconcile stabilisatie KPIs — SQL script + export JSON + shell runner
    Mehr im Commit-Body
    - reconcile_stabilization_metrics.json from export-observability-snapshots
  (halt funnel emitted/suppressed, freshness-still-halt-after-retry, suppress ratio)
- sql/analysis/measure_reconcile_stabilization_kpis.sql: HALT windows, phantom vs uncertain,
  BalanceInconclusive text, orders/fills 15m/60m, incident sessions + median duration
- scripts/measure_reconcile_stabilization_kpis.sh

Made-with: Cursor
  229. 54011b0
    fix(reconcile): exchange spot sum None≠0, HALT dedupe, freshness retry
    Mehr im Commit-Body
    - Use exchange_base_spot_sum_for_base (dual-source sum) for phantom/reserved paths;
  BalanceInconclusive → uncertain, never phantom or DB repair from unknown keys.
- HALT funnel inserts deduped per (symbol,event)+fingerprint TTL 30s; emitted/suppressed counters.
- Single 400ms retry only for FreshnessStale when retryable; metric for still-halt-after-retry.
- protection_flow: no resolved unwrap_or(0); inconclusive → reserved/uncertain paths.
- Optional FILL_POSITION_DRIFT_LOG=1 before phantom DB correction.

Made-with: Cursor
  230. 7bc8bd7
    populate funnel latency_ms on execution critical stages
    Mehr im Commit-Body
    Record submit-path elapsed milliseconds on realism and order-decision events so 15-minute audits can quantify decision-to-submit latency from persisted funnel data.

Made-with: Cursor
  231. d1e40ed
    add event-driven wake path for flow poller scheduling
    Mehr im Commit-Body
    Wake the flow poller on recycle-driven heap updates so ranking/submit no longer depends only on timer cadence and emits explicit heap refresh markers for timing audits.

Made-with: Cursor
  232. 1cbb53d
    disable edge-bias backfill in execution hot path by default
    Mehr im Commit-Body
    Gate the realized-move backfill worker behind EDGE_BIAS_BACKFILL_ENABLE so execution no longer runs nearest-mid diagnostic scans unless explicitly enabled.

Made-with: Cursor
  233. e17a1f7
    enforce explicit trade-recency guard in shared realism contract
    Mehr im Commit-Body
    Require last-trade freshness to be present and within the same realism horizon used by admission and submit so stale candidates are blocked earlier and reason aliases remain audit-compatible.

Made-with: Cursor
  234. 63ca853
    stop repeated phantom halts after reconcile auto-correction
    Mehr im Commit-Body
    When reconcile returns skip-no-real-position or corrected-phantom-to-flat during amend checks, remove the symbol from the monitor set so stale in-memory position state does not keep re-triggering HALT_PHANTOM_POSITION events.

Made-with: Cursor
  235. 1fc1b34
    enforce per-call order price/constraint invariants across entry and exits
    Mehr im Commit-Body
    Require price presence only for limit orders, hard-drop market limit_price on wire, and remove 5dp/fallback price paths in exit flows so all priced submits must normalize against live instrument constraints.

Made-with: Cursor
  236. 2a0dc47
    harden ws price quantization fallback to prevent invalid price rejects
    Mehr im Commit-Body
    When instrument constraints cache misses, quantize outbound limit/static trigger prices conservatively on wire (USD pairs to 4dp) instead of sending raw floats, preventing exchange invalid-price rejections across entry/exit paths.

Made-with: Cursor
  237. 4fc9134
    add cooldown for repeated microstructure-stale execution realism blocks
    Mehr im Commit-Body
    When execution realism blocks due to microstructure stale, set a temporary symbol quiet window so stale symbols stop re-entering every cycle while market data catches up.

Made-with: Cursor
  238. 763e462
    add tape-gate quiet cooldown to reduce repeated dead-symbol retries
    Mehr im Commit-Body
    Apply a short symbol quiet period after tape_gate_entry_blocked and check quiet/hard-block state before tape evaluation so repeatedly underactive symbols stop consuming admission cycles.

Made-with: Cursor
  239. d026edf
    tune conflict lane defaults to reduce false-negative admissions
    Mehr im Commit-Body
    Lower the quality-override tape floor and default spread minimum to avoid blocking otherwise valid low-spread candidates while preserving the 60 bps hard safety cap.

Made-with: Cursor
  240. 195cb39
    align selection and submit with a shared execution realism contract
    Mehr im Commit-Body
    Use one microstructure/freshness decision path across tape admission and submit precheck, emit unified realism observability with legacy aliases, and add O(1) trade recency cache signals to reduce stale-mid mismatches.

Made-with: Cursor
  241. 323682f
    fix(execution): align market precheck freshness with live data contract
    Mehr im Commit-Body
    Apply a global freshness floor from LIVE_DATA_MAX_AGE_SECS to mid-snapshot and price-cache prechecks so tier defaults (5/15/30s) no longer cause avoidable missing-mid failures on active symbols.

Made-with: Cursor
  242. 37def28
    fix(execution): avoid sending market price on Kraken add_order
    Mehr im Commit-Body
    Prevent market submissions from carrying intended_price_quote as wire limit_price, so pair decimal precision checks do not reject otherwise valid market entries.

Made-with: Cursor
  243. 56b71d9
    docs(env): document MAX_OPEN_NOTIONAL_PCT and conservative PnL exposure mult
    Mehr im Commit-Body
    Made-with: Cursor
  244. f42cd00
    fix(scripts): harden execution restart self-verify journal wait
    Mehr im Commit-Body
    Use systemd ActiveEnterTimestamp as journal --since anchor, extend wait
to 120s to tolerate journal indexing lag.

Made-with: Cursor
  245. ae5dd36
    feat(audit): persist EDGE_FLOW_RANKED to funnel DB, pad SQL 10-13, funnel windows always 4 rows
    Mehr im Commit-Body
    - live_runner: insert trading_funnel_events heap rows after each EDGE_FLOW_RANKED (v1 + exec_only) with active_heap_plausible in detail JSON
- migration: partial index on heap EDGE_FLOW_RANKED events
- SQL 01: LEFT JOIN so 3m/10m/2h/24h always emitted
- SQL 10-13: path_tape mix, skip vs admit by segment, heap stats from DB, trace spotcheck
- export_audit_csv.sh for cohort CSV; README + report note for redeploy

Made-with: Cursor
  246. 3515240
    docs: use full dominant_skip_reason strings in audit report
    Mehr im Commit-Body
    Made-with: Cursor
  247. 8c35c99
    docs: drop volatile commit hash from audit report header
    Mehr im Commit-Body
    Made-with: Cursor
  248. aac140e
    docs: align audit report HEAD hash
    Mehr im Commit-Body
    Made-with: Cursor
  249. ebfc835
    docs: simplify audit report run header
    Mehr im Commit-Body
    Made-with: Cursor
  250. 0367ad8
    docs: note report commit hash for server audit run
    Mehr im Commit-Body
    Made-with: Cursor
  251. 20bce56
    docs: fill EDGE_SURVIVAL_AUDIT_REPORT with server SQL + journal results
    Mehr im Commit-Body
    Made-with: Cursor
  252. 6655927
    fix(audit): restore defaultdict import; split 04 admitted query CTE scope
    Mehr im Commit-Body
    Made-with: Cursor
  253. 7376975
    Add edge survival audit SQL, journal log parser, and report template
    Mehr im Commit-Body
    - SQL 01-09: plausible cohort funnel, clusters, killers, admission economics,
  move_below_fees ticker proxy, capital/slot pressure, symbol killers,
  latency percentiles, signal-to-exec trace latency
- scripts: parse_execution_logs.py (EDGE_FLOW_RANKED, SYMBOL_EXECUTION_LOCK),
  fetch_execution_journal_audit.sh
- docs/reports/EDGE_SURVIVAL_AUDIT_REPORT.md: sections 1-8 methodology + STAP 4b matrix

Made-with: Cursor
  254. ea9a59c
    fix(execution): ghost exposure lock — reconcile DB vs exchange before SYMBOL_EXECUTION_LOCK
    Mehr im Commit-Body
    Root cause: unprotected_exposure used krakenbot.positions.base_position alone; a stale
non-zero row blocks submits while exchange balance + fills are flat.

- balance_cache: sum_balance_all_keys_for_base (incl. zero legs) for exchange-flat detection
- positions: get_position_meta, force_flat_position_after_desync
- position_truth: pub fill_net_base_qty + has_recent_fills for pre-lock checks
- exposure_ghost_lock: try_resolve_ghost_exposure_before_lock (fresh balances, dust,
  fill ledger agreement); clear_exit_only_when_position_flat; SYMBOL_* logs
- check_symbol_execution_lock: open orders first, then ghost reconcile, then gates

Short positions skip auto-flatten; recent fills skip reconcile.

Made-with: Cursor
  255. f83dbe3
    fix(scripts): journalctl _PID must use --since, not -n tail (L3 noise)
    Mehr im Commit-Body
    Made-with: Cursor
  256. 8613fa5
    fix(execution): align live argv, systemd, and runtime role truth
    Mehr im Commit-Body
    - Remove EXECUTION_ONLY from live unit; load .env first then force EXECUTION_ONLY=0
- Add run-execution-only CLI entry + run_execution_only() for split mode
- run-execution-live always logs argv role run-execution-live; truth script enforces ROLE_MATCH
- Add krakenbot-execution-only.service template for exec-only split
- Extend check_execution_runtime_truth.sh: role_match, argv role, cmdline, repo unit guard

Made-with: Cursor
  257. e62bfcd
    fix(ops): validated restart uses systemd when krakenbot-execution is enabled
    Mehr im Commit-Body
    - Auto-detect krakenbot-execution.service (enabled/active); systemctl stop, kill stragglers, systemctl restart
- Wait for EXECUTION_RUNTIME_SELF_VERIFY_OK in journal for MainPID
- KRAKENBOT_EXEC_RESTART_VIA and KRAKENBOT_EXEC_SYSTEMD_UNIT overrides
- nohup mode still stops the unit first to avoid Restart=always duplicates

Made-with: Cursor
  258. 2cf8c93
    fix(ops): absolute krakenbot path + /proc PID scan for execution-live singleton
    Mehr im Commit-Body
    - Add scripts/_execution_runtime_pids.sh (pids_run_execution_live, count)
- start_live_validation_engine_server: exec REPO_ROOT/target/release/krakenbot
- restart: kill/wait via pids_run_execution_live; fail if count != 1 after self-verify
- truth check: same PID source; pgrep sanity uses target/release/krakenbot
- Cursor rule: warn against dual supervisor (systemd + nohup)

Made-with: Cursor
  259. 547d56f
    fix(ops): execution truth — strict cmdline match + journalctl fallback
    Mehr im Commit-Body
    - Avoid pgrep false positives; match run-execution-live via /proc cmdline regex
- check: --journal-pid for systemd/socket stdout; list all release krakenbot PIDs
- restart: wait loop recounts live PIDs; truth check prefers journalctl when available

Made-with: Cursor
  260. c187a00
    feat(ops): self-verifying execution runtime + truth scripts + embed CLI
    Mehr im Commit-Body
    - build.rs: KRKBOT_EMBED_GIT_COMMIT, KRKBOT_BUILD_UNIX_SECS
- execution_runtime_verify: EXECUTION_RUNTIME_* logs, worker atomics, 8s self-verify exit 1 on missing workers
- Worker markers: FLOW_POLLER_STARTED, FLOW_RECYCLE_*, EDGE_BIAS_*, PRIVATE_WS_RECYCLE_HOOK_*, EXEC_ONLY_FLOW_LOOP_STARTED
- CLI execution-runtime-embed-info; live_runner parity for exec-only
- scripts/check_execution_runtime_truth.sh, restart_execution_live_validated.sh
- Cursor rule execution-runtime-truth.mdc; CHANGELOG

Made-with: Cursor
  261. 1b04ee3
    fix(execution): preload instruments before universe fetch in run-execution-live
    Mehr im Commit-Body
    Cold restart failed with empty instrument cache; align startup order with ingest_runner.
Remove duplicate preload later in the same function to avoid a second instrument WS.

Made-with: Cursor
  262. 7fc1707
    chore(repo): gitignore /reports/ for clean server deploy tree
    Mehr im Commit-Body
    Made-with: Cursor
  263. ea8502e
    chore(sql): order A–I report windows 15m, 60m, 4h
    Mehr im Commit-Body
    Made-with: Cursor
  264. ec39529
    feat(observability): bias realized-move backfill + A–I report SQL
    Mehr im Commit-Body
    - edge_bias_entry_capture: ingest ticker_samples lookup for +3m/+10m mids (bps vs entry_mid), 30s worker spawned from live and exec-only runners
- sql/analysis/55_flow_capture_report_a_i.sql: 15m/60m/4h metrics A–I including sequential JSON, route/gate mix, bias coverage, realized backfill rates
- flow_capture_metrics_report.sh runs 55 then legacy window blocks
- private_ws_hub: recycle on trade/filled/canceled/expired/rejected exec_type
- CHANGELOG: unreleased bullet updated

Made-with: Cursor
  265. e8ec3ac
    feat(execution): WS flow recycle, edge bias capture, route near-tie, metrics SQL
    Mehr im Commit-Body
    - private_ws_hub: optional FlowSymbolRecycleHook after first executions snapshot; terminal exec reports schedule symbol recycle.
- flow_poller: FlowRecycleTrigger + spawn_flow_recycle_worker; recycle_symbol_into_heap public; live + exec-only wire hub hook.
- edge_bias_entry_capture table + insert on live_validation submit from runner; ExecutionIntent bias fields; flow_execution fills them.
- route_selector_v2: near-tie score band with non-breakout family preference (ROUTE_FAMILY_NEAR_TIE_SCORE_DELTA).
- sql/analysis/54_flow_capture_metrics_windows.sql + scripts/flow_capture_metrics_report.sh; CHANGELOG.

Made-with: Cursor
  266. 95c3c38
    feat(execution): single flow-poller execution path and exec-only parity
    Mehr im Commit-Body
    - Remove duplicate inline submit loops from live and exec-only eval cycles; orders only via spawn_flow_poller + flow_execute_single_candidate.
- spawn_flow_poller takes Arc<AtomicI64> correlation run_id (exec-only sets per epoch bind).
- Exec-only: shared FlowHeapState, latest_v2, exec_allowed, readiness/engine atomics, EDGE_FLOW_RANKED, pipeline_config Arc<RwLock>.
- CHANGELOG: document flow-poller-only and exec-only parity.

Made-with: Cursor
  267. 4c8a666
    feat(execution): flow-ranked edges, dynamic slots, gate softening, route matrix
    Mehr im Commit-Body
    - Add edge_heap scoring (realism x edge / decay) and rank all Execute outcomes
- CapitalAllocator: flow-driven total slots, MAX_CAPITAL_SLOTS_PER_SYMBOL (default 1)
- conflict_lane: liquidity soft-pass in quality segment; tape min lowered by bucket
- Route matrix: Pullback + PassiveSpreadCapture taker variants
- candidate_decision_vectors: expiry, edge age, reentry_count + migration
- ExecutionIntent + runner persist new analytics fields

Made-with: Cursor
  268. 9c808ba
    feat(throughput): activate non-breakout routes and targeted quality unlocks
    Mehr im Commit-Body
    Unlock multi-route flow by adding non-breakout candidate variants and family-aware winner selection, while reducing liquidity/spread/tape overblocking only in high-quality segments.

Made-with: Cursor
  269. fe1e905
    fix(harvest): unblock low-liquidity option and honor size policy env
    Mehr im Commit-Body
    Add a bounded conflict-lane low-liquidity option for controlled harvest widening and make risk policy read POSITION_SIZE_MIN_QUOTE/POSITION_SIZE_MAX_QUOTE so runtime sizing floors can be changed via env as intended.

Made-with: Cursor
  270. e38900f
    feat(data-harvest): add bounded gate widening and fixed monitor query
    Mehr im Commit-Body
    Make conflict-lane spread constraints hard-capped at 60 bps and add env-tunable, bounded economics/confidence harvest knobs so borderline candidates can pass without disabling safety protections. Add a single DB-first monitor SQL used identically for pre/post harvest baseline comparison.

Made-with: Cursor
  271. 0dbb303
    persist full candidate decision vectors for auditability
    Mehr im Commit-Body
    - Add candidate_decision_vectors SSOT table with staged decision snapshots and hard FK from trading_funnel_events.
- Persist route_eval/path_validation vectors for all route candidates and conflict/admission/capital/execution_precheck vectors in pipeline/execution flows.
- Extend route candidate payload with confidence/fallback/move-fee diagnostics and add reconstruction SQL for recent blocker examples.

Made-with: Cursor
  272. b6016a0
    conflict lane: soft-admit taker with tunable penalties and funnel events
    Mehr im Commit-Body
    - Default maker-preferred: require_maker_entry env now defaults false; true restores hard taker block.
- Pure taker passes lane with size_mult * taker penalty, extra net-edge floor in pipeline, soft-gate discount for logging/detail.
- New env: CONFLICT_LANE_TAKER_SIZE_MULTIPLIER, TAKER_NET_EDGE_PENALTY_BPS, TAKER_SOFT_GATE_MULTIPLIER.
- Funnel: conflict_lane_maker_allowed, conflict_lane_taker_soft_allowed, conflict_lane_rejected_other_reason; richer CONFLICT_LANE_EVAL log.
- Add sql/analysis/62_conflict_lane_tuning_snapshot.sql for post-deploy counts.

Made-with: Cursor
  273. cee5e0e
    feat(execution): optional conflict-lane admission gate for V2 pipeline
    Mehr im Commit-Body
    - Add CONFLICT_LANE_* env-driven filters: liquidity tier (mid+), spread band,
  min 24h trade_count, 15m forecast confidence, maker-priority entries
- Relax thresholds when account taker fee is at/below configured threshold
- Apply conservative size multiplier on pass; log CONFLICT_LANE_EVAL
- Wire from Config into live + exec-only pipeline config (default off)

Made-with: Cursor
  274. c3d19f5
    fix live-runner truth halts and funnel reject telemetry
    Mehr im Commit-Body
    Harden periodic entry halts to require healthy truth snapshots and add standardized funnel counters plus structured reject-map payloads for direct no-trade diagnostics. Update changelogs to document the runtime and observability behavior changes.

Made-with: Cursor
  275. 029f43c
    docs(changelog): backfill website updates since March 20
    Mehr im Commit-Body
    Add missing changelog entries in existing hash-based style so website changelog reflects all recent repository updates without gaps.

Made-with: Cursor
  276. ab9693f
    feat(observability): add derived per-market 15m forecast and soft-gate scoring
    Mehr im Commit-Body
    Introduce a conservative 15m forecast derived from route/path outputs, apply it as bounded ranking weight (never as hard block), persist per-symbol snapshots per evaluation, and expose the data in tier2_data_bundle.

Made-with: Cursor
  277. 70d3a87
    fix(route-engine): reduce false-negative no-trade gating
    Mehr im Commit-Body
    Calibrate confidence and economics gates to admit clearly positive-edge candidates while keeping strict spread/confidence guardrails for safety.

Made-with: Cursor
  278. cb52825
    fix(observability): make 15m pnl bucketing Postgres-safe
    Mehr im Commit-Body
    Replace non-portable date_trunc('15 minutes') with an hour+minute-floor expression so snapshot export works on the server Postgres version.

Made-with: Cursor
  279. 6bb39e4
    fix(observability): align dashboard counts with factual windows
    Mehr im Commit-Body
    Use created_at-based order windows for 24h dashboard metrics and keep status feed counters/freshness on a single status run to avoid mixed-run inconsistencies.

Made-with: Cursor
  280. 70bda28
    feat(execution): add hybrid_v1 ignition exit path with phase telemetry
    Mehr im Commit-Body
    Introduce a feature-flagged hybrid TP-first to overshoot-trailing exit path behind allowlist routing while keeping legacy trailing intact, and persist per-trade hybrid summary events for cohort analysis.

Made-with: Cursor
  281. 218fa90
    fix(observability): include pending shadow trades in outcome counts
    Mehr im Commit-Body
    Keep unresolved shadow trades visible in run-level outcome summaries by removing the outcome-not-null filter and labeling null outcomes as pending.

Made-with: Cursor
  282. d7c8616
    fix(execution): enforce message freshness eligibility and remove dead runtime paths
    Mehr im Commit-Body
    Make max_message_age_secs a hard execution gate with explicit eligibility_message_stale evidence in funnel events, and remove unused legacy code paths in execution/protection/reconcile modules to reduce critical-path ambiguity.

Made-with: Cursor
  283. 827b9bd
    fix(execution): unblock raw backfill fill normalization path
    Mehr im Commit-Body
    Fix fills_ledger insert placeholder mismatch that broke process_fill, and keep raw backfill diagnostics so unmatched raw executions can now normalize into fills/positions idempotently.

Made-with: Cursor
  284. 4740f81
    chore(execution): add context to raw backfill failures
    Mehr im Commit-Body
    Annotate raw execution backfill errors with per-event processing stage and IDs so runtime diagnostics can pinpoint the failing normalization step.

Made-with: Cursor
  285. cf6653e
    fix(execution): make raw backfill synthetic order upsert robust
    Mehr im Commit-Body
    Replace dynamic SQL upsert for synthetic external orders with a deterministic insert-or-fetch path based on insert_order, preserving idempotency while avoiding runtime insert shape mismatch.

Made-with: Cursor
  286. 601502a
    feat(execution): backfill unmatched raw executions into fills and positions
    Mehr im Commit-Body
    Add a background worker that scans unmatched parsed raw private executions, resolves orders or creates deterministic synthetic external orders, writes fills idempotently through the ledger, and marks raw events matched.

Made-with: Cursor
  287. 6eb92cd
    feat(execution): persist all private executions as durable raw events
    Mehr im Commit-Body
    Add append-only raw_private_executions storage with idempotent event dedupe and parse-error capture, persist every executions-channel event before correlation, and mark matched events asynchronously when order correlation succeeds.

Made-with: Cursor
  288. 4ba12d0
    fix(execution): recover timeout orders via ownOrders reconcile
    Mehr im Commit-Body
    Parse both status/order_status from ownOrders payloads and allow snapshot reconcile transitions from reconcile state so timeout-marked orders can recover to exchange-truth terminal states.

Made-with: Cursor
  289. 53d32ce
    fix(ws): subscribe executions with snap_trades for fill recovery
    Mehr im Commit-Body
    Enable snap_trades on private executions subscriptions so reconnects can recover missed trade events and reconcile order status/fills after transient WS gaps.

Made-with: Cursor
  290. f4599dc
    fix(execution): add single precheck retry for transient cache gaps
    Mehr im Commit-Body
    Retry missing-mid and price-cache precheck failures once after 400ms before skipping, while keeping fail-closed behavior and persisting retry diagnostics for direct funnel measurement.

Made-with: Cursor
  291. 586a750
    fix(execution): gate periodic entry halt on healthy exchange truth
    Mehr im Commit-Body
    Only trigger periodic_unprotected_pending after healthy private snapshots and a reconcile-confirmed real exposure. Stage pending as unknown while truth is stale and short-circuit dust/phantom records out of pending.

Made-with: Cursor
  292. be04a11
    fix(execution): align early mid-snapshot gate with tiered cache freshness
    Mehr im Commit-Body
    Use the same liquidity-tier cache age policy for the early BLOCK_ENTRY_WITHOUT_MID_SNAPSHOT check as the market precheck, removing the overly strict fixed 2s choke before order execution decisions.

Made-with: Cursor
  293. 78e379f
    perf(ingest): lower epoch refresh to safe 120s cadence
    Mehr im Commit-Body
    Reduce default ingest universe refresh cadence to 120s and clamp effective interval to a safe 60-120s range so execution consistently gets fresh epochs while avoiding overly aggressive churn.

Made-with: Cursor
  294. fc68ea1
    fix(ingest): clamp epoch refresh cadence below execution freshness window
    Mehr im Commit-Body
    Keep ingest epoch publication within execution's 300s bind window by capping effective ingest refresh to 240s and lowering the default universe refresh interval.

Made-with: Cursor
  295. bd8b6ea
    fix(protection): fail-closed liveness and degrade reconcile constraints
    Mehr im Commit-Body
    Treat missing snapshots as stalled for reconnect recovery and avoid PayloadIncoherent deadlock on missing/invalid instrument constraints by using degraded cached/fallback constraints in reconcile.

Made-with: Cursor
  296. 7910242
    fix(protection): add deadlock recovery loop for stale private WS snapshots
    Mehr im Commit-Body
    Prevent permanent entry_halt deadlocks by adding snapshot liveness watchdog transitions, reconnect/truth-refresh recovery hooks, and starvation detection in emergency protection retry logic.

Made-with: Cursor
  297. eba9b50
    docs: protection deadlock-recovery Mermaid in EXIT_PATHS + DOC_INDEX
    Mehr im Commit-Body
    Made-with: Cursor
  298. efb53b2
    fix(exec-only): write ticker_samples with bound ingest run_id
    Mehr im Commit-Body
    Execution-only public ticker WS used run_id=0 for DB rows, while trade/L2
live on the epoch ingest run — observability and freshest_active_run_id
then mixed partitions. Resolve the same epoch as the eval loop (valid
epoch, else exit-only fallback) and pass that run_id to run_ticker_ws;
fall back to 0 only if no epoch exists within max_age.

Made-with: Cursor
  299. cc46163
    feat(observability): diagnose PRICE_CACHE_STALE_SKIP (MISSING/STALE/SYMBOL_MISMATCH)
    Mehr im Commit-Body
    - Extend RAM price_cache snapshots with wall_updated_at for post-hoc timestamps.
- Classify precheck failures via diagnose_stale_skip_for_precheck (canonical pair incl. XBT/BTC).
- Persist structured JSON in trading_funnel_events.detail plus enriched reason and logs.
- precheck_market_price_cache returns MarketOrderPrecheckSkip; no threshold or tape changes.

Made-with: Cursor
  300. f2af13f
    fix(live_runner): run economic snapshots on execution-only path
    Mehr im Commit-Body
    Periodic exposure_nav + data_quality writes lived only in the combined
run-execution-live loop; EXECUTION_ONLY=1 uses run_execution_only_loop
and never called them. Factor write_periodic_economic_snapshots helper
and invoke from both loops after periodic reconcile.

Made-with: Cursor
  301. d47ed18
    fix(exposure): align exposure_nav_snapshots INSERT binds and harden observability
    Mehr im Commit-Body
    - Fix VALUES placeholder drift: use $1..$9 for nine bound columns (was $10 with nine binds).
- Centralize SQL in insert_exposure_nav_snapshot_sql; add max_dollar_placeholder guard + anyhow context.
- Log breakdown/insert failures at ERROR with operation/table; info on success with snapshot_id.
- Alert after two failed periodic cycles (CRITICAL); warn when eval_count>=10 and snapshot missing.
- Unit test for placeholder arity; optional ignored DB round-trip test.

Made-with: Cursor
  302. e0ec180
    feat(observability): trace IDs, fill/PnL lifecycle, exposure & DQ snapshots
    Mehr im Commit-Body
    - Schema: strategy_run_id, position_id, correlation_id on orders; position_opened_at;
  realized_pnl entry/exit/position timestamps; fill fee_base + data_quality_violations;
  exposure_nav_snapshots + execution_data_quality_snapshots tables
- Enforce decision_trace_id on inserts (emergency_stop exempt); stamp submit_ts/ack_ts;
  persist orderbook mid at entry when available
- fills_ledger: slippage/mid on fill rows, fee/mid DATA_QUALITY warnings, realized_pnl
  links exit_order_id + position_closed_at vs entry first-fill open time
- Runner: block missing trace; optional strict mid (default on); pre-DB 98% deployment cap
  and conservative global exposure when 24h PnL negative
- Live: periodic exposure + data-quality snapshot rows and log thresholds
- SQL analysis script for new tables

Made-with: Cursor
  303. 87cb2de
    feat(observability): align L3 snapshot with epoch run + verification scripts
    Mehr im Commit-Body
    - Export l3_count/l3_symbol_count using epoch_run_id when present (consistent L3 % vs epoch_symbol_count)
- Add optional epoch_run_id to public_status_snapshot
- OBSERVABILITY_SNAPSHOT_CONTRACT + scripts for DB/runtime L3 checks
- CHANGELOG

Made-with: Cursor
  304. cf442b3
    chore(cursor): rule for website changelog + git deploy + live validation closeout
    Mehr im Commit-Body
    Made-with: Cursor
  305. 99df44f
    feat(orders): persist decision_trace_id for WS fill funnel correlation
    Mehr im Commit-Body
    Made-with: Cursor
  306. 714b207
    feat(funnel): decision_code + correlation on live_runner, protection, reconcile, truth
    Mehr im Commit-Body
    Made-with: Cursor
  307. dcd0d96
    feat(observability): Tier-2 data bundle + funnel correlation columns
    Mehr im Commit-Body
    - Migration: trading_funnel_events correlation_id, cl_ord_id, order_id, decision_code, detail JSONB + indexes
- TradingFunnelEvent/insert_event extended; runner/ws_handler set trace + order linkage on key paths
- Outcome.decision_trace_id + ExecutionIntent.decision_trace_id; pipeline generates UUID per candidate
- Export tier2_data_bundle.json (ingest+decision aggregates, disclosure_policy NL)
- shadow_blocker_reasons_for_run query; contract_version 1.1 + OBSERVABILITY_SNAPSHOT_CONTRACT §3.8

Made-with: Cursor
  308. 5595af1
    docs+script: clarify decision DB for execution; truncate ingest mirror safely
    Mehr im Commit-Body
    Made-with: Cursor
  309. 8e949c3
    docs: path_tape_class DB rollups (SQL + operational notes)
    Mehr im Commit-Body
    Made-with: Cursor
  310. 119176f
    feat(obs): path_tape_class on funnel + orders (schema, writers, reads)
    Mehr im Commit-Body
    Made-with: Cursor
  311. 6bfdc8f
    docs: path-tape log queries + continuation tuning reference
    Mehr im Commit-Body
    Made-with: Cursor
  312. 12097f4
    feat(routes): continuation move/fee relax + score blend (guarded)
    Mehr im Commit-Body
    - move/fee ratio 0.76 vs 0.80 for Breakout/Pullback only when trade_density,
  l3_quality, spread band OK; net_edge>0 gate unchanged
- time_adjusted_score: blend path confidence with continuation_prob for
  same routes + trailing exits (ranking only)
- validate_candidate takes explicit threshold; tests for relaxed band

Made-with: Cursor
  313. 025ac09
    feat(edge): tie-break spread-farming to trend on continuation tape
    Mehr im Commit-Body
    - When SF wins by <=0.10 over trend_score but trend_strength/direction/
  density/impulse show continuation, classify TrendContinuation so breakout/
  pullback matrix runs
- Unit test for narrow-SF fixture
- Confidence uses winner score after tie-break; payoff asymmetry follows final regime

Made-with: Cursor
  314. 5e2a5ed
    fix(execution): persist resolved base qty for market orders (not notional-as-qty)
    Mehr im Commit-Body
    - plan_execution used notional USD as quantity_base placeholder for market orders
  → dashboard showed 20 for min $20 notional; exchange path was already correct
- prepare_order_for_submit once before DB-first; store prep.order_qty on execution_orders,
  OrderTracker, ack path; submit_order_with_prep avoids double prepare
- Document placeholder in execution_planner

Made-with: Cursor
  315. 2145ec1
    fix(kraken): quantize OTO/trailing pct with fixed decimals
    Mehr im Commit-Body
    - trigger_price_type=pct is a percentage, not a quote price; using
  effective_price_decimal_places (pair tick) could round to 0–1 dp and
  corrupt trail distance → exchange rejects on some alts (e.g. SYND/USD)
- Use 6 fixed fractional digits via quantize_wire_f64; add regression test

Made-with: Cursor
  316. ef28db2
    fix(routes): move/fee ratio gate 0.85 -> 0.80 for spread-style economics
    Mehr im Commit-Body
    - Still requires net_edge > 0 after full cost stack (no negative-edge admits)
- Targets dominant move_below_fees churn in spread_farming without touching
  liquidity/L3/safety gates; unit tests pin threshold boundary

Made-with: Cursor
  317. 5d2e11a
    obs(edge): ADAPTIVE_TRADABILITY_SNAPSHOT per cycle
    Mehr im Commit-Body
    - tradable_rate_pct, pairs with no valid candidates vs valid but score<=0
- aggregated top invalid dominant_reason counts (per invalid candidate)
- complements SYMBOL_ROUTE_DECISION + ADAPTIVE_ANALYSIS_COMPLETE for before/after tuning

Made-with: Cursor
  318. 48e12f5
    fix(kraken): wire price/pct quantization from instruments (max decimals)
    Mehr im Commit-Body
    - effective_price_decimal_places: min(price_precision, increment-derived dp)
  so pairs like BTR/USD (4 dp cap) are not overridden by finer increments.
- auth_ws: quantize limit_price on add_order/add_order_with_conditional;
  quantize OTO conditional trigger_price + optional conditional limit_price;
  quantize stop-loss static trigger and trailing pct triggers; amend_order
  limit_price; amend_stop_loss_trigger + amend_trailing_stop_trigger_pct
  (new symbol arg for instrument lookup).
- Call sites: exit_lifecycle, ignition_exit, position_monitor, kraken_adapter.
- Test: effective_price_decimal_places_is_min_of_precision_and_increment.

Made-with: Cursor
  319. 9343ff7
    reconcile: resolve Kraken-prefixed base balances; periodic dust closes DB
    Mehr im Commit-Body
    - Use balance_cache::resolved_balance_for_base_asset in position_reconcile
  and protection_flow (phantom/uncertain/insufficient-funds paths) so XX*/X*
  keys do not read as zero base.
- run_periodic_reconcile: on dust classification, call close_dust_position
  like reconcile_exposure_at_startup so phantom dust rows do not linger.
- Add unit test reconcile_resolves_prefixed_kraken_balance_key.

Made-with: Cursor
  320. 81dc8a2
    feat(remediation): cl_ord_id UUID wire, balance+universe freshness, NL denylist
    Mehr im Commit-Body
    - Exit/protection/probe: generate_cl_ord_id for Kraken WS (no kbtp/kbprot)
- balance_cache: last_feed_at + max snapshot/feed for reconcile age
- EXECUTION_SYMBOL_DENYLIST env + universe_source filter
- SQL 53 invalid price/rejects window; REJECTS_REMEDIATION_AUDIT + deploy doc
- CHANGELOG unreleased bullets

Made-with: Cursor
  321. 2b443ad
    fix(reconcile): own_orders freshness uses snapshot or delta time
    Mehr im Commit-Body
    - freshness_age_secs = elapsed since max(last_snapshot_at, last_update_at)
- snapshot_age_secs delegates (same call sites)
- tests + mutex for global cache isolation
- CHANGELOG unreleased note

Made-with: Cursor
  322. df13bb2
    fix(execution): quantize order price/qty for Kraken WS wire (instrument decimals)
    Mehr im Commit-Body
    - Add quantize_wire_f64 + limit/qty helpers from InstrumentConstraints
- Apply after normalize_order in prepare_order_for_submit (IEEE754 JSON noise)
- exit_lifecycle maker TP, protection market close, position_monitor TP market, ignition market exit

Made-with: Cursor
  323. a0f3549
    feat(live): path_tape notional scale + doctrine/observability logs
    Mehr im Commit-Body
    - PATH_TAPE_EXIT_ROUTING: exit_doctrine, SL/TP/panic/hold, base_exit_strategy
- PATH_TAPE_NOTIONAL_SCALE: allocator_notional, notional_scale, final_notional
- Apply scale to intent + register_open (both main and exec-only loops)
- IGNITION_EXIT_SUPPRESSED includes exit_doctrine
- CAPITAL_ALLOCATION funnel after scale with path_tape_scale in reason

Made-with: Cursor
  324. c38e1a7
    feat(path_tape): tighten MRH/spiky/thin/fading/illiquid doctrine + notional_scale
    Mehr im Commit-Body
    - Shorter holds for MRH/thin/illiquid; stricter SL/TP/panic per class
- primary_exit_doctrine_label + notional_scale_for_class (no config defaults change)
- Tests: notional scale, MRH static doctrine

Made-with: Cursor
  325. 492518f
    fix(path_tape): suppress ignition exit for fading momentum doctrine
    Mehr im Commit-Body
    Made-with: Cursor
  326. adbf7a7
    feat(live): rolling trade_samples gate + path/tape exit routing
    Mehr im Commit-Body
    - tape_queries::count_trades_since (ingest DB rolling window)
- path_tape: classify + exit_config_for_path_tape + ignition suppress
- TAPE_* env: gate enable, window secs, min trades, soft classify floor
- live_runner: block low-activity entries; PATH_TAPE_EXIT_ROUTING logs
- exec-only loop: same gate + routing

Made-with: Cursor
  327. ae8c3f8
    feat(exit): PrimaryExitStyle + static SL post-fill phase + degraded static routing
    Mehr im Commit-Body
    - ExitConfig.primary_exit_style (TrailingNative | StaticSlLimitTp)
- run_post_fill_static_sl_phase: native stop-loss, optional maker TP, panic/time, BE amend
- pub(crate) CancelOrFill + wait_for_cancel_or_fill for ignition_exit
- apply_degraded_exit_policy sets StaticSlLimitTp

Made-with: Cursor
  328. 7e7bc56
    docs: exit doctrine research, EXIT_PATHS validation, tape policy, Kraken WS ref, rolling trade SQL
    Mehr im Commit-Body
    Made-with: Cursor
  329. 11d6f2f
    fix(oto): omit cl_ord_id on conditional add_order (Kraken WS); tracker symbol bridge
    Mehr im Commit-Body
    Made-with: Cursor
  330. 5c48e75
    fix: deserialize Kraken executions 'reason' on rejects; persist in ORDER_REJECT + events
    Mehr im Commit-Body
    Made-with: Cursor
  331. c63e99c
    chore(rag): script om __pycache__/*.pyc te verwijderen (niet alleen negeren)
    Mehr im Commit-Body
    - clean_rag_python_artifacts.sh: laat .venv intact (runtime)
- README: sectie artefacten opruimen

Made-with: Cursor
  332. 0a67b3b
    chore(gitignore): ignore Python venv, __pycache__, egg-info (rag-backend)
    Mehr im Commit-Body
    Untracked .venv/ on server is expected; deps via requirements.txt + pip install.

Made-with: Cursor
  333. 88738ce
    docs: liquidity/flow entry research 48h + analysis SQL
    Mehr im Commit-Body
    Made-with: Cursor
  334. 423d9c4
    feat: consistency watchdog + recovery (DB flags, PrivateWsHub reconnect)
    Mehr im Commit-Body
    Made-with: Cursor
  335. 620ea24
    fix(l2_feed): do not drop order book on checksum mismatch
    Mehr im Commit-Body
    Removing books on mismatch left the L2 sample loop with nothing to persist,
so l2_snap_metrics stayed empty for the active run → l2_raw_feature_ready
never passed and execution could not refresh state.

Resubscribe path unchanged; CRC warning retained. No change to FEATURE_READY thresholds.

Tests: cargo check; cargo test (104+ ok)
Made-with: Cursor
  336. 5bae3c8
    fix(execution-only): feed price_cache via same USD ticker pool as live
    Mehr im Commit-Body
    Exec-only previously subscribed ticker only for open positions; flat account
→ empty WS subscribe → no price_cache updates → spurious PRICE_CACHE_STALE_SKIP
at precheck (policy unchanged; wiring was wrong).

- preload_all + fetch_usd_ws_symbols(execution_universe_limit) then add positions
- remove duplicate preload_all block
- docs: EXEC_ONLY_EPOCH_BINDING + CHANGELOG_ENGINE

Validation: cargo check; cargo test (104+ tests ok)
Made-with: Cursor
  337. 415b16a
    revert: restore LOW_LIQUIDITY price_cache max age 30s; doc exec-only epoch binding
    Mehr im Commit-Body
    - Undo 120s tier window (no safety loosening without agreement)
- Exec-only: richer skip log (max_epoch_age_secs, preferred_lineage)
- Add docs/EXEC_ONLY_EPOCH_BINDING.md (queries, causes, ops)

Made-with: Cursor
  338. 1d1f98e
    fix(execution): low-liq price_cache window + honest execute_count
    Mehr im Commit-Body
    - LowLiquidity tier: max_price_cache_age 30s -> 120s (quiet tape no longer spurious stale skip)
- submit_and_wait_for_execution_reports returns SubmitAndWaitOutcome; live_runner only increments execute_count when DB order persisted

Made-with: Cursor
  339. f345c9c
    fix(pipeline): V2 liquidity gate taker-only when state row missing — restore maker path
    Mehr im Commit-Body
    Made-with: Cursor
  340. 1c93639
    fix(pipeline): V2 fail-closed when no CurrentRunMarketRow — root cause blind market entries
    Mehr im Commit-Body
    Made-with: Cursor
  341. b8a3fb6
    fix(execution): exchange prevalidation before DB-first — no status=error for sizing/instrument failures
    Mehr im Commit-Body
    Made-with: Cursor
  342. 684949d
    fix(ingest): preload instrument cache before fetch_usd_ws_symbols (run-ingest)
    Mehr im Commit-Body
    Made-with: Cursor
  343. 3aff30f
    fix(exposure): classify dust on notional + cached qty_min — stop false unprotected when constraints Err
    Mehr im Commit-Body
    Made-with: Cursor
  344. cc30e4e
    fix(execution): do not exit emergency protection loop on SLA hard — clears entry_halt when safe
    Mehr im Commit-Body
    Made-with: Cursor
  345. 87100d3
    docs+sql: reconcile submit vs fill, blocker order, log timeline grep
    Mehr im Commit-Body
    Made-with: Cursor
  346. 08c9314
    feat(liquidity): depth_near_mid from l2_snap_metrics + p10 gating
    Mehr im Commit-Body
    - stats_queries::l2_avg_depth_near_mid_by_run: AVG bid/ask top5 depth per symbol
- CurrentRunMarketRow.depth_near_mid; analyze_run + analyze_run_from_state merge
- classify(..., depth_near_mid, depth_p10_run): thin vs run p10 + HIGH tier depth downgrade
- Outcome.liquidity_depth_near_mid; pipeline logs depth + p10

Made-with: Cursor
  347. f91798b
    feat(execution): tiered price_cache gating + liquidity INELIGIBLE pipeline skip
    Mehr im Commit-Body
    - Add liquidity_exec_policy (HIGH/MID/LOW/INELIGIBLE) from trades/s, spread, L3 fill time
- Pipeline: classify symbols, skip Execute when INELIGIBLE, log LIQUIDITY_EXEC_CLASSIFICATION*
- ExecutionIntent carries tier; kraken_adapter uses tier max-age + book spread cap
- runner: precheck before DB insert; PRICE_CACHE_STALE_SKIP / BOOK_SPREAD_UNSAFE_SKIP (no order error)
- run-execution-once + live_runner pass tier from Outcome; exits use default loose max-age

Made-with: Cursor
  348. 3767c6c
    rag-backend: DOCS_EMBEDDING_API_KEY fallback + systemd unit template
    Mehr im Commit-Body
    Made-with: Cursor
  349. 35f5daf
    chore(cleanup): finalize archived doc moves and record classification
    Mehr im Commit-Body
    Finalize the report/research archive migration by committing original-path removals, add a cleanup classification record for auditability, and align one remaining validation-metrics doc pointer with current SSOT docs.

Made-with: Cursor
  350. 01ebbf8
    chore(cleanup): archive report docs and tighten current docs index
    Mehr im Commit-Body
    Move time-bound RAPPORT and research outputs into docs/archive, update references that consume those reports, and rewrite README/DOC_INDEX pointers so root documentation only highlights current authoritative documents.

Made-with: Cursor
  351. c7807fb
    chore(cleanup): add rollback snapshot and fix stale doc references
    Mehr im Commit-Body
    Capture a pre-cleanup rollback checkpoint and update stale runtime/script/docs references so cleanup can proceed with link-consistent, low-risk documentation pointers.

Made-with: Cursor
  352. c81830d
    feat(observability): add risk-adjusted tier2 pnl metrics and lifecycle tests
    Mehr im Commit-Body
    Export Sharpe-like, Sortino-like, and drawdown-duration metrics from 24h realized PnL buckets in Tier2 snapshots, update the observability contract, and add integration tests for critical execution order-state transitions.

Made-with: Cursor
  353. 33be68c
    docs(compliance): add incident/retention policies and env template hardening
    Mehr im Commit-Body
    Add explicit compliance baseline documentation (incident response and data retention/privacy), link it from README and runbook, and provide a complete .env.example for safer onboarding without exposing secrets.

Made-with: Cursor
  354. 064bc22
    feat(economics): persist pre-trade metrics and align drawdown to 24h
    Mehr im Commit-Body
    Carry pipeline pre-trade metrics into execution submit persistence (orders plus submitted event payload), switch drawdown guards to 24h realized PnL, and add best-effort trailing-stop slippage measurement using fill-time orderbook mid reference.

Made-with: Cursor
  355. 5a4efe5
    feat(integrity): add L2 checksum resync and hub lag hard reset
    Mehr im Commit-Body
    Validate Kraken L2 checksums against local top-10 book state with automatic resubscribe on mismatch, and harden private hub message handling with degraded/recovered markers plus forced reconnect on severe lag accumulation.

Made-with: Cursor
  356. 826c1f6
    feat(safety): add private WS dead-man switch and fail-closed sender handling
    Mehr im Commit-Body
    Arm and refresh Kraken cancel_all_orders_after on the shared private WS hub, add reconnect backoff with jitter, and replace hot-path unwraps in execution submission loops to prevent panic during sender/token unavailability.

Made-with: Cursor
  357. 8ce74a6
    fix(ignition): cancel-first exit + balance-based qty + timeout bail
    Mehr im Commit-Body
    Rewrites ignition_exit cancel_protection_and_market_exit to mirror the
cancel-first semantics already in exit_lifecycle (B2):

1. Cancel protection FIRST, wait for cancel-or-fill via shared
   CancelOrFill/wait_for_cancel_or_fill (now pub(crate))
2. Use balance_cache::asset_balance as exit qty source (not tracked
   protected_qty) — prevents partial exits and dust
3. Handle PROTECTION_FILLED_BEFORE_CANCEL (no market needed)
4. Handle zero-balance after cancel (protection likely filled)
5. Handle cancel timeout with balance check
6. ImmediateExit timeout now bails MARKET_FILL_TIMEOUT_EXPOSURE_RISK
   (was silently returning Ok)

Eliminates: double-exit risk, partial-position exits, silent timeout
acceptance on all three ignition exit paths.

Made-with: Cursor
  358. a558f58
    fix(ignition): bail on market fill timeout in panic exit path
    Mehr im Commit-Body
    ignition_exit panic path discarded wait_for_market_fill result with
let _ =, treating a timeout as success and leaving the position open.
Now bails with MARKET_FILL_TIMEOUT_EXPOSURE_RISK, matching the
identical fix already applied in exit_lifecycle.rs.

Made-with: Cursor
  359. 1b39fce
    docs: sync 12 docs met herstelplan-leakage wijzigingen (A1–F3, D4, D5)
    Mehr im Commit-Body
    ENGINE_SSOT, ARCHITECTURE, EXIT_PATHS, LOGGING, DOC_INDEX, LIVE_RUNBOOK,
UNIVERSE_AUDIT, RAPPORT_PINNED, EXIT_SYSTEM_INVENTORY, EXIT_ORCHESTRATION,
EXIT_PROTECTION_RESEARCH, PLAN_ADDENDUM bijgewerkt met:
- cancel-first exit semantiek (B2)
- staleness guards op price_cache (C1/C2)
- RecvResult channel close vs timeout (F2)
- REST eliminatie uit runtime (D1/D5)
- OTO trailing-stop (D4), deadline (D2), qty normalisatie (F3)
- nieuwe log markers (A3, B3, B4, F1, F2, D4)
- HERSTELPLAN_LEAKAGE.md toegevoegd aan DOC_INDEX

Made-with: Cursor
  360. 64757a0
    docs(changelog): herstelplan A1→F3+D4/D5 in CHANGELOG.md en CHANGELOG_ENGINE.md
    Mehr im Commit-Body
    22 commits (werkstromen A–F + D4/D5) gedocumenteerd met commit hashes,
subsystem, trading impact en runtime impact per item.

Made-with: Cursor
  361. c7f9650
    refactor(startup): universe_source leest uit instrument WS cache, geen REST meer (D5)
    Mehr im Commit-Body
    fetch_usd_ws_symbols gebruikt nu instruments::cached_symbols_with_status()
in plaats van REST AssetPairs. Nul REST calls in volledige runtime
inclusief startup. De instrument cache wordt al door preload_all()
gevuld voordat symbol discovery draait.

Made-with: Cursor
  362. 65c726b
    feat(oto): OTO conditional trailing-stop op entry market orders (D4)
    Mehr im Commit-Body
    ConditionalParams struct toegevoegd aan messages.rs voor Kraken OTO.
add_order_with_conditional method in auth_ws.rs voor entry+protection
in één atomic exchange call.

submit_order accepteert nu oto_trail_bps: bij market orders met
trailing-stop config wordt automatisch een conditional trailing-stop
bijgevoegd. De exchange creëert de protection order bij fill —
elimineert 50-200ms onbeschermde exposure.

run_post_fill_exit_phase detecteert OTO trailing-stop via
discover_oto_trailing_stop en skipt handmatige placement. Bij
niet-gevonden OTO: fallback naar bestaande manuele flow.

Made-with: Cursor
  363. c1e1c7f
    feat(exit): normalize_exit_qty ceil-to-step dust tracking (F3)
    Mehr im Commit-Body
    Voegt normalize_exit_qty toe die exit-qty naar boven afrondt op step
increment als balance dit toelaat, anders floor. Voorkomt dust
accumulatie over trades.

Alle exit market orders in cancel_protection_and_market_exit en
ignition cancel_and_exit gebruiken nu normalize_exit_qty.

Made-with: Cursor
  364. fae0c36
    feat(ws): RecvResult enum onderscheidt channel-close van timeout (F2)
    Mehr im Commit-Body
    recv_timeout retourneert nu RecvResult { Message, Timeout, ChannelClosed }
in plaats van Option<PrivateV2Response>.

Kritieke paden (wait_for_market_fill, wait_for_cancel_or_fill,
monitoring loops) escaleren ChannelClosed als expliciete error in plaats
van het stilzwijgend als timeout te behandelen.

Voorkomt dat een WS reconnect-event ten onrechte als "fill timeout"
wordt geïnterpreteerd, wat kon leiden tot onbeschermde posities.

Made-with: Cursor
  365. 16e51dc
    fix(exit): time_stop_secs=0 clamp naar 60s met warning (F1)
    Mehr im Commit-Body
    time_stop_secs=0 werd stilzwijgend geclamped naar 1s, wat een instant
market exit veroorzaakte. Nu clamp naar 60s met expliciete
EXIT_TIME_STOP_MISCONFIGURED warning.

Made-with: Cursor
  366. 4ca8fab
    perf(fills): CTE combineert position read+upsert+read in 1 round-trip (E3)
    Mehr im Commit-Body
    get_position_tx (voor) + upsert_position_tx + get_position_tx (na)
gecombineerd in upsert_position_cte_tx: één CTE query die pos_before,
avg_entry_before en pos_after retourneert.

Reduceert van 3 DB round-trips naar 1 binnen de fill-transactie.
Alle 12 fills_ledger tests passeren ongewijzigd.

Made-with: Cursor
  367. 15e435a
    perf(ws): elimineer dubbele serde deserialisatie execution reports (E2)
    Mehr im Commit-Body
    ExecutionReports worden nu eenmalig geparsed in private_ws_hub en
opgeslagen in parsed_reports veld op PrivateV2Response. De runner
gebruikt de pre-geparsede reports in plaats van opnieuw
from_value + item.clone() per report.

Elimineert: 2x from_value, 1x data.as_array().clone(), N x item.clone()
per executions message. Eén deserialisatie per WS message.

Made-with: Cursor
  368. 84c09a2
    feat(fills): populate orderbook_mid bij fill via price_cache (E1)
    Mehr im Commit-Body
    orderbook_mid was hardcoded None — compute_slippage_bps retourneerde
daardoor altijd None. Nu wordt price_cache::snapshot_fresh(2s) gebruikt
om bid/ask mid-price te lezen bij elke fill-verwerking.

Invariant: orderbook_mid is populated voor elke fill waar price_cache
data beschikbaar is. slippage_bps in fills tabel is niet-null wanneer
mid beschikbaar is.

Made-with: Cursor
  369. 81885e4
    perf(runner): observability DB writes fire-and-forget via tokio::spawn (D3)
    Mehr im Commit-Body
    order_latency::upsert_decision_and_submit en de success-path
trading_funnel_events::insert_event worden nu via tokio::spawn
uitgevoerd — niet meer blocking op het submit critical path.

Safety-kritieke writes blijven sequentieel:
- state_machine::on_submitted (DB-first)
- exposure_reconcile::total_open_notional (safety gate)
- risk_gate::check_global_exposure (safety gate)

Verwachte latency-winst: 2-15ms minder per order submit.

Made-with: Cursor
  370. b76d0b6
    feat(orders): deadline parameter op alle market orders (D2)
    Mehr im Commit-Body
    add_order berekent automatisch deadline = now + 5s voor order_type
"market". Kraken matcht de order niet na deze deadline — bescherming
tegen latency-geïnduceerde negatieve slippage.

EService:Deadline elapsed rejection wordt herkend in runner.rs met
korte quiet-mode (30s) en expliciete ORDER_DEADLINE_ELAPSED log.

Invariant: elke market order heeft een expliciete deadline. Geen
market order kan matchen nadat de markt significant bewogen is.

Made-with: Cursor
  371. b35388e
    fix(adapter): REST best_bid/ask vervangen door price_cache in hot path (D1)
    Mehr im Commit-Body
    Alle drie REST call-sites in kraken_adapter::submit_order vervangen
door price_cache::snapshot_fresh(5s):
- Market order sizing: notional→base qty conversie
- cost_min validatie
- Final notional check na normalisatie

get_best_bid en get_best_ask in instruments.rs gemarkeerd als
#[deprecated] — niet meer gebruikt in het execution hot path.

Invariant: submit_order doet nul await calls naar externe HTTP
endpoints. Alle pricing komt uit price_cache (WS-fed, staleness guard).

Made-with: Cursor
  372. a99ab2f
    fix(exit): fill price fallback gebruikt mid-price met staleness guard (C2)
    Mehr im Commit-Body
    Vervangt adverse-biased fallback (bid voor longs, ask voor shorts)
door neutrale mid-price (bid+ask)/2 met snapshot_fresh(3s) staleness
guard.

Was: bij degraded fill price werd snap.bid gebruikt voor longs
(systematisch te laag) en snap.ask voor shorts (systematisch te hoog),
wat SL/TP levels in de verkeerde richting verschoof.

Nu: mid-price als neutrale fallback, met bail als price_cache stale
(>3s) of leeg is.

Invariant: fill price fallback gebruikt altijd mid-price, nooit de
adverse spread-kant. Fallback is altijd vergezeld van staleness guard.

Made-with: Cursor
  373. 2b89839
    feat(price_cache): staleness guard met last_price_fresh en snapshot_fresh (C1)
    Mehr im Commit-Body
    Voegt freshness-aware functies toe aan price_cache:
- last_price_fresh(symbol, max_age) -> Option<f64>
- snapshot_fresh(symbol, max_age) -> Option<PriceSnapshot>
Retourneert None als data ouder is dan max_age.

Call-sites vervangen in execution/protection paden:
- exit_lifecycle monitoring loop: max_age 5s
- exit_lifecycle est_exit berekening: max_age 5s
- balance_cache equity berekening: max_age 30s

Bestaande last_price() en snapshot() behouden voor non-critical paden.

Invariant: geen execution/protection beslissing op data ouder dan
de geconfigureerde max_age.

Made-with: Cursor
  374. 18fd1a2
    fix(exit): classify_cancel_or_fill verifieert order_id in cancel response (B2-fix)
    Mehr im Commit-Body
    Bug: classify_cancel_or_fill behandelde ELKE succesvolle cancel_order
method response als cancel van de protection order, zonder te checken
welke order daadwerkelijk is gecanceld. Bij panic exit en TP maker
timeout wordt een TP cancel gestuurd vlak voor
cancel_protection_and_market_exit — als die TP cancel response in
wait_for_cancel_or_fill arriveert, wordt het foutief geclassificeerd
als protection cancel, waarna een market exit wordt geplaatst terwijl
de trailing-stop nog live is (dubbele-exit scenario).

Fix: verifieer result.order_id tegen protection_order_id in de
cancel_order method response. Bij mismatch: return None (fall-through
naar executions channel canceled event dat al correct filtert).

Tests: 9 (was 7) — nieuw: cancel response met matching order_id,
cancel response met TP order_id (assert None), cancel response zonder
result (assert None).

Made-with: Cursor
  375. a565504
    fix(ws): broadcast lag recovery met lagged flag en reconciliatie (B4)
    Mehr im Commit-Body
    1. BROADCAST_CAPACITY 512 -> 2048 in private_ws_hub.rs
2. PrivateMsgSource: lagged flag + total_lagged counter bij
   RecvError::Lagged; escalatie naar PRIVATE_WS_HUB_RELIABILITY_DEGRADED
   bij >= 100 verloren berichten
3. exit_lifecycle monitor loop: bij lagged flag -> resubscribe
   executions (snap_orders=true) voor reconciliatie, clear flag
4. PrivateMsgSource enum -> struct met MsgSourceInner; constructors
   dedicated() en hub() op alle call sites

Invariant: broadcast lag is altijd zichtbaar en leidt tot
reconciliatie. Geen stille message loss zonder recovery.

Made-with: Cursor
  376. 4ede196
    fix(exit): panic exit fill-timeout escaleert naar EXPOSURE_RISK bail (B3)
    Mehr im Commit-Body
    Panic exit gooit fill-resultaat niet meer weg. Bij market fill timeout:
- warn met exit_reason=panic_pnl_market_timeout + EXIT_COMPLETED_NO_FILL
- bail met MARKET_FILL_TIMEOUT_EXPOSURE_RISK (identiek aan time-stop)
- geen stille positie-verlating meer bij liquiditeitscrisis

Invariant: elke exit-flow met EXIT_COMPLETED heeft bevestigde fill
OF escaleert met MARKET_FILL_TIMEOUT_EXPOSURE_RISK.

Made-with: Cursor
  377. 0357d8b
    fix(exit): cancel-first met balance-verificatie voor spot-safe exit (B2)
    Mehr im Commit-Body
    Herschrijft cancel_protection_and_market_exit naar cancel-first flow:
- Cancel trailing-stop EERST (beschermt tot cancel-ACK)
- CancelOrFill enum + classify_cancel_or_fill helper voor event-routing
- wait_for_cancel_or_fill async helper met 5s timeout
- Bij cancel-ACK: market exit op actuele balance_cache balance
- Bij fill voor cancel (PROTECTION_FILLED_BEFORE_CANCEL): skip market exit
- Bij timeout + zero balance: assume protection filled, skip market exit
- Bij timeout + balance > 0: market exit op actuele balance

Invariant: nooit meer dan één market sell live per positie.
Exit sizing altijd op actuele balance, niet gecachete qty.

7 unit tests voor classify_cancel_or_fill (fill/filled/canceled/method
response/wrong order_id/non-fill exec_type/unrelated message).

Made-with: Cursor
  378. d1e8317
    fix(execution): exec_type/order_status naar strikte Kraken WS v2 semantiek (B1)
    Mehr im Commit-Body
    Alle exec_type en order_status matching in de execution-laag is nu
strikt conform de officiële Kraken Spot WS v2 specificatie:

- trade = individueel fill-event (partial of final), verwerk in ledger
- filled = order volledig afgerond, markeer als completed
- triggers.status = "triggered" = tussenstatus, apart gedetecteerd

Verwijderd uit match-patronen:
- "fill" (niet-officieel)
- "partial_fill" (niet-officieel exec_type)
- "done" (niet-officieel order_status)
- "triggered" als exec_type (was foutief; triggers.status is correct)

Twee pub(crate) helpers: is_fill_exec_type, is_order_completed_status.
Alle vier consumer-bestanden (ws_handler, exit_lifecycle, ignition_exit,
position_monitor) zijn consistent via dezelfde helpers.

2 tests: exhaustive exec_type en order_status classificatie.

Made-with: Cursor
  379. 667c7e0
    fix(ws_handler): fill price zero-guard voor ledger (A3)
    Mehr im Commit-Body
    compute_fill_price kan Decimal::ZERO retourneren als alle fallbacks
falen. Een fill met prijs 0 corrumpeert positions en realized_pnl.

Guard toegevoegd direct na compute_fill_price: als prijs 0 is, wordt
de fill gelogd als FILL_PRICE_ZERO_REJECTED en teruggestuurd als
HandleResult::Unknown voor reconciliatie. De ledger wordt niet geraakt.

Made-with: Cursor
  380. 9abc22c
    fix(ledger): fee-aftrek in realized PnL berekening (A2)
    Mehr im Commit-Body
    realized_pnl_quote was gross (fees niet meegenomen). Bij Kraken taker
fee ~26 bps round-trip accumuleert dit ~$2.60 per $1000 positie dat
niet werd meegerekend, waardoor drawdown-guards te optimistisch stuurden.

Nieuwe compute_realized_pnl functie: gross_pnl - proportionele fee.
Bij sign-flips wordt de fee geprorateerd op closed_qty/fill_qty_base.

5 tests toegevoegd: long close met/zonder fee, short close met fee,
flip met prorated fee, None bij ontbrekende avg_entry.

Made-with: Cursor
  381. e2d08e5
    fix(ledger): VWAP-corruptie bij positiereductie elimineren (A1)
    Mehr im Commit-Body
    De SQL CASE in upsert_position_tx blendde exit-prijzen in
avg_entry_price_quote bij partial closes, wat cost-basis kunstmatig
verlaagde en drawdown-guards te optimistisch maakte.

Herschreven met vier expliciete, auditbare branches:
  1. close to zero          → NULL
  2. same-side add          → VWAP blend
  3. reduce without flip    → behoud bestaande avg_entry
  4. sign flip / fresh pos  → fill_price als nieuwe cost basis

Pure Rust mirror-functie compute_new_avg_entry toegevoegd met 7 tests:
long add, long reduce, long close, long flip, short add, short reduce,
short flip.

Fix pre-bestaande test-compilatiefout in protection_flow.rs (missing
success field op PrivateV2Response initialisaties).

Made-with: Cursor
  382. 7381ba1
    docs: volledig herstelplan economische leakage eliminatie
    Mehr im Commit-Body
    Kraken-geverifieerd plan met 6 werkstromen (A-F), 20 concrete fixes,
implementatievolgorde, REST-eliminatieplan, eind-invarianten en bewijsplan.

Bron: leakage audit op fills_ledger, exit_lifecycle, ws_handler,
kraken_adapter, price_cache, private_msg_source. Alle exec_type/
order_status waarden geverifieerd tegen live Kraken Spot WS v2 docs.

Made-with: Cursor
  383. c2d485a
    docs: flow/liquidity research results from 2026-03-16 cutoff
    Mehr im Commit-Body
    Made-with: Cursor
  384. b576844
    fix(research): remove stale BATCH_SIZE echo
    Mehr im Commit-Body
    Made-with: Cursor
  385. e6719c9
    perf(research): single ingest query with bounded trade_samples slice
    Mehr im Commit-Body
    Made-with: Cursor
  386. c2eee8b
    perf(research): drop heavy 5m L2 window; spread from snapshot only
    Mehr im Commit-Body
    Made-with: Cursor
  387. 011f1b2
    fix(research): argv parsing for flow/liquidity scripts
    Mehr im Commit-Body
    Made-with: Cursor
  388. b3c729e
    chore(research): dual-DB flow/liquidity analysis from 2026-03-16 (script+report)
    Mehr im Commit-Body
    Made-with: Cursor
  389. 4b76d52
    chore(env): remove REWRITE_ENV/rewrite.env; SSOT /srv/krakenbot/.env
    Mehr im Commit-Body
    - trading_env: only KRAKENBOT_ENV_FILE or /srv/krakenbot/.env; rename to trading_env_load_config
- Docs: SERVER_RUNTIME_ENV_AND_READINESS.md; delete old rewrite-titled doc
- Scripts/systemd: no legacy hints; lifecycle proof uses server .env

Made-with: Cursor
  390. 7d4e152
    chore(env): default to /srv/krakenbot/.env; rewrite.env legacy only
    Mehr im Commit-Body
    - trading_env: KRAKENBOT_ENV_FILE > REWRITE_ENV > /srv/krakenbot/.env
- Remove default REWRITE_ENV exports from validation/capacity scripts
- systemd: drop EnvironmentFile for /etc/trading/rewrite.env
- Docs/runbooks: SSOT for KapitaalBot .env; note migration path

Made-with: Cursor
  391. d8e3ac5
    feat(runtime): trading_env, check-execution-readiness, no half-green execution validation
    Mehr im Commit-Body
    - Add scripts/trading_env.sh: DB_* / DECISION_DB_* → URLs + assert distinct dual-DB
- Add krakenbot check-execution-readiness + scripts/validate_execution_readiness.sh
- validate_execution_on_server / validate_live_engine_server: require dual-DB + readiness before run (SKIP_RUN stays build-only, labeled)
- start_live_validation_engine_server: trading_env + readiness preflight
- run_l3_capacity_test, validate_epoch_contract_fase1, run_400_symbol_scaling_test: dual-DB gate
- health_check_after_start: assert dual-DB + readiness
- systemd: optional EnvironmentFile rewrite.env; README + LIVE_RUNBOOK + SERVER_RUNTIME_REWRITE_AND_READINESS.md
- Log markers: EXECUTION_RUNTIME_DB_BOUND, EXECUTION_LIVE_RUNNER_START

Made-with: Cursor
  392. be6c0d3
    fix(scripts): allow validate_live_engine_server SKIP_RUN without DECISION_DATABASE_URL
    Mehr im Commit-Body
    Made-with: Cursor
  393. 7f0887b
    feat: mandatory dual-DB, trailing ledger truth, CLI/script DB routing
    Mehr im Commit-Body
    - Require distinct DATABASE_URL + DECISION_DATABASE_URL; log sanitized DB identity
- create_pools only; retention purges both; replay/compare without ingest-as-replay
- CLI analysis: decision pool for safety/latency/exit-realism/invariants-v2 + explicit labels
- Trailing-stop: trail bps validation on persist; ws_handler treats triggered as fill; no slippage from trail bps
- Scripts: hard-fail or decision-only where execution stats; SEV0 requires both URLs
- Docs: DB_AND_TRAILING_TRUTH_HARDENING.md matrices; track .env.example via gitignore exception

Made-with: Cursor
  394. 51a4429
    feat(execution): trail_bps v1 — fee floor, horizon α, regime, cap
    Mehr im Commit-Body
    - Add trail_bps_v1 (deterministic formula + constants)
- trail_atr: raw ATR15m bps fetch only (no clamp)
- exit_lifecycle + ignition: v1 + taker_fee from runner tier
- submit_and_wait_for_execution_reports: fee_provider for taker bps
- protect_exposure: optional fee_provider; v1 when prefer_trailing (300s horizon)
- Docs: TRAIL_BPS_V1.md, EXIT_PATHS update

Made-with: Cursor
  395. 206d76c
    feat(execution): 15m ATR trail, 50bps fallback, mid-trade adoption
    Mehr im Commit-Body
    - Add trail_atr module (900s bars, 6h lookback, top-14 TR)
- exit_lifecycle + ignition_exit: replace 5m SQL; adopt ATR when DB fills later
- Partial-fill replace: sync awaiting_atr_replacement with ATR flag
- protection_flow: prefer_trailing uses estimate_atr15m_trail_bps + DEFAULT 50 bps
- Docs: EXIT_PATHS_AND_PROTECTION_RUNTIME aligned with implementation

Made-with: Cursor
  396. e915683
    web: add lightweight GA4 consent bundle (nl/en/de/fr)
    Mehr im Commit-Body
    Made-with: Cursor
  397. 9ebe2c2
    fix(exit): trailing pct amend, gapless replace, monitor shorts + runbook
    Mehr im Commit-Body
    Made-with: Cursor
  398. 77a4d7b
    docs: exit paths and protection runtime behavior (read-only)
    Mehr im Commit-Body
    Made-with: Cursor
  399. f3f8198
    fix(exit-protection): enforce trailing-first protection with ATR-based distance and deterministic recovery
    Mehr im Commit-Body
    Switch protection to trailing-first semantics with 5m ATR-based trail sizing, harden add_order ACK correlation, add bounded emergency retry with market-close escalation, and extend reconnect/exec-only reconcile gates to prevent unprotected exposure windows.

Made-with: Cursor
  400. 28d7ec4
    fix(exit-capability): degrade fill-price dependent exits to market-anchor fallback
    Mehr im Commit-Body
    Prevent SL/TSL exit phases from failing when fill_price is missing by anchoring from live price cache, and pass avg_entry only when valid in emergency fallback so protection remains non-fragile.

Made-with: Cursor
  401. af8d640
    fix(safety): halt new entries while unprotected exposure remains pending
    Mehr im Commit-Body
    Prevent new entry submissions when periodic reconcile still reports unprotected exposure after an immediate protection attempt, and keep the emergency retry loop active until protection is confirmed.

Made-with: Cursor
  402. 8a0899f
    fix(protection): enforce protect-on-balance invariant with expectancy-based exit choice
    Mehr im Commit-Body
    When reconcile is uncertain but exchange balance proves real exposure, force immediate protection submit instead of staying pending. Prefer trailing stop when expectancy is better (favorable excursion) while retaining stop-loss/market fallback for guaranteed coverage.

Made-with: Cursor
  403. 8246ebd
    fix(reconcile): treat close-side open orders as protective reduce evidence
    Mehr im Commit-Body
    Normalize order_type variants and infer reduce coverage for close-side open orders even when reduce_only/order_type metadata is imperfect. This enforces the invariant that existing exchange exit orders prevent unnecessary protection stalls.

Made-with: Cursor
  404. 48552ed
    fix(balance-cache): reject empty balance snapshots as freshness signals
    Mehr im Commit-Body
    Do not mark balance snapshots fresh when balances payload contains no assets, and require non-empty assets for has_snapshot. This prevents false-fresh zero-balance states that can trigger phantom flat corrections and block protection.

Made-with: Cursor
  405. f94ba26
    fix(reconcile): relax snapshot freshness gate for protection path
    Mehr im Commit-Body
    Increase balance and own-orders snapshot freshness windows so protection does not stall in pending loops when snapshots are a few seconds old. This keeps submit gating safety while allowing timely protection under normal WS cadence.

Made-with: Cursor
  406. 8445ef3
    fix(exposure): include live balance cache in startup and periodic reconcile
    Mehr im Commit-Body
    Merge live balance-derived positions into reconciliation before DB-only holdings so exchange-held symbols cannot be missed when persistence lags or is empty. This closes the gap where real balances (e.g. MIM) were invisible to protection orchestration.

Made-with: Cursor
  407. 1ff99fd
    fix(exit): throttle and dedupe trailing-stop placement attempts
    Mehr im Commit-Body
    Add a backoff between TSL submit attempts and detect existing open trailing stops for the same entry before submitting again. This prevents duplicate trailing-stop send storms when lifecycle re-enters during delayed acknowledgements.

Made-with: Cursor
  408. e4f9ffc
    fix(execution): verify protection via exchange reconcile before normal state
    Mehr im Commit-Body
    Use durable symbol reconcile as the source of truth for ProtectionAcked transitions. Keep symbols pending when success outcomes cannot yet be verified by exchange-side coverage to prevent false-safe state flips.

Made-with: Cursor
  409. 632e63e
    fix(execution): enforce spot-exit safety and verified protection state
    Mehr im Commit-Body
    Remove reduce_only from spot market/exit submissions and require post-outcome verification before marking symbols as ProtectionAcked. Keep symbols pending until DB protection coverage confirms protected-or-flat state so unprotected exposure cannot be acknowledged as safe.

Made-with: Cursor
  410. 93c09c7
    fix(execution): enforce protect-first recovery for unprotected exposure
    Mehr im Commit-Body
    Make protection bootstrap entry-independent by using degraded trailing-stop placement first and fall back to stop-loss/market paths when needed. Add hard execution gates via symbol safety state and strengthen emergency retry orchestration with explicit protection-state transitions and unprotected exposure SLO telemetry.

Made-with: Cursor
  411. 96d1473
    feat(execution): position truth model + balance recovery wiring
    Mehr im Commit-Body
    - Migration: positions truth columns (fills_confirmed / execution_confirmed / balance_recovery)
- position_truth: reconcile on load, coherence after fill, execution ACK note, degraded exit policy
- exposure: reconcile before load_open_positions; remove duplicate balance repair; lock on degraded truth
- ws_handler/fills_ledger/exit_lifecycle/ignition_exit: integrate truth + protect-first behavior

Made-with: Cursor
  412. bcdfe65
    docs(changelog): fix garbled commit hash for aae7e60 entry
    Mehr im Commit-Body
    Made-with: Cursor
  413. aae7e60
    fix(execution): order_qty from exchange + balance-led long position repair
    Mehr im Commit-Body
    - Sync execution_orders.quantity_base upward on ACK and fills from report.order_qty
- OrderTracker::bump_quantity_base for OOO / understated DB qty
- balance_cache::resolved_balance_for_base_asset; repair long base_position when
  balances snapshot is fresh (exposure load_open_positions)
- Funnel POSITION_BASE_REPAIRED_FROM_BALANCE; LOGGING.md note

Fills remain audit trail; exchange order_qty + balances reduce missed-fill gaps.

Made-with: Cursor
  414. 46854f5
    docs(changelog): SEV0 protection fixes (0a79e25–d08e9ba)
    Mehr im Commit-Body
    Root CHANGELOG + CHANGELOG_ENGINE: spot reduce_only, precancel on
insufficient funds, remediation script bounds, prior protection/desync hardening.

Made-with: Cursor
  415. d08e9ba
    fix(sev0): precancel exit-side orders on SL insufficient funds
    Mehr im Commit-Body
    When Kraken ACK-rejects emergency stop-loss with Insufficient funds, skip
hard_block, cancel open ownOrders on the exit side, wait for snapshot refresh,
and retry SL once before market fallback. Adds open_order_ids_on_side helper.

Made-with: Cursor
  416. 7a99fa5
    fix(sev0): avoid spot reduce_only rejects for protective orders
    Mehr im Commit-Body
    Stop-loss and trailing-stop WS helpers now omit reduce_only to prevent Kraken spot ACK errors that were blocking live protection for open exposure.

Made-with: Cursor
  417. cb98e09
    fix(sev0): make remediation check pack bounded and fast
    Mehr im Commit-Body
    Add statement timeouts and switch ingest raw-feed checks to fast approximate row metrics so dual-db remediation audits complete reliably during incidents.

Made-with: Cursor
  418. 0a79e25
    fix(sev0): harden protection flow and dual-db remediation checks
    Mehr im Commit-Body
    Close protection gaps by acking market exit before SL cancel, auto-repair non-zero closed positions during exposure reconcile, and add dual-database-aware remediation/report scripts for reliable runtime audits.

Made-with: Cursor
  419. ae2fab4
    docs(changelog): keep 697ba05/9d9c2ee only; drop meta changelog commit lines
    Mehr im Commit-Body
    Made-with: Cursor
  420. 8bbb33e
    docs(changelog): note e33d917 changelog-format commit
    Mehr im Commit-Body
    Made-with: Cursor
  421. e33d917
    docs(changelog): hash-prefixed entries for observability bundle (9d9c2ee, 697ba05)
    Mehr im Commit-Body
    Made-with: Cursor
  422. 697ba05
    docs(changelog): reference 9d9c2ee for observability/export commit
    Mehr im Commit-Body
    Made-with: Cursor
  423. 9d9c2ee
    feat(observability): 24h export window + fill context; fix fills ledger; ignition lease await; rag-backend; docs
    Mehr im Commit-Body
    - observability_queries: strategy_counts + recent orders/fills use 24h window,
  COALESCE(strategy, strategy_context), fills join execution_orders for regime/strategy
- export/snapshots: cap 250, truncation flags, RecentPublicFillRow extra fields
- ws_handler: persist fee_quote to fills; prefer Kraken trade_id for idempotency key
- ignition_exit: await symbol_exit_lease upsert/clear
- docs: EXIT_ORCHESTRATION_DESIGN_SPEC, INVESTIGATION_ENJ_UNPROTECTED, DOC_INDEX
- rag-backend: pgvector FAQ RAG service (README, app, indexer, SQL init)
- gitignore: deep_trade_autopsy_12h_output.txt

Made-with: Cursor
  424. 9967a44
    chore(docs): drop IDE vendor naming; rename dev rules to DEVELOPMENT_RULES.md
    Mehr im Commit-Body
    Made-with: Cursor
  425. 417da01
    fix(execution): await symbol_exit_lease upsert/clear; TP maker lease outside pool guard
    Mehr im Commit-Body
    Made-with: Cursor
  426. 5217e10
    fix(deterministic_proof): fill ExecutionReport fields for WS fee/trade shape
    Mehr im Commit-Body
    Made-with: Cursor
  427. 872379f
    feat(execution): exit lease table, reduce_only, TSL overlap, TP bps guard
    Mehr im Commit-Body
    Made-with: Cursor
  428. 2616b16
    fix(observability): 24h counts use exchange fill time + order activity
    Mehr im Commit-Body
    - Fills: window and ordering on COALESCE(ts_exchange, ts_local)
- Orders/regime/strategy/status 24h: GREATEST(created_at, updated_at)
- Regime switches 1h: filter/order by activity time
- RecentFillDbRow: fill_ts for export bucketing
- Document contract semantics

Made-with: Cursor
  429. f027874
    fix(observability): export uses ingest + decision pools for dual-DB
    Mehr im Commit-Body
    - run_export(DbPools): raw/run/market/epoch from ingest; execution/fills/safety/latency from decision
- CLI export-observability-snapshots passes full DbPools
- Document in OBSERVABILITY_EXPORT_SETUP

Made-with: Cursor
  430. 9ef7110
    observability: export last 10 execution orders and fills to public_trading_snapshot
    Mehr im Commit-Body
    - SQL: recent_execution_orders, recent_fills (newest first)
- PublicTradingSnapshot: recent_orders, recent_fills (15m bucketed ts, short order_ref)
- Document contract update for Tier 1 summary tables

Made-with: Cursor
  431. c277248
    changelog: TSL exit overhaul + stale reconcile (6040fe9..328ed8d)
    Mehr im Commit-Body
    Made-with: Cursor
  432. 328ed8d
    exit_lifecycle TSL: SL first, at breakeven cancel SL and place Kraken trailing-stop; no TP
    Mehr im Commit-Body
    Made-with: Cursor
  433. 0cda8cd
    ExitConfig use_trailing_stop; TSL time_stop_secs=900 use_maker_tp=false no TP
    Mehr im Commit-Body
    Made-with: Cursor
  434. fb49917
    Add add_trailing_stop_order in auth_ws (trailing-stop, pct trigger)
    Mehr im Commit-Body
    Made-with: Cursor
  435. 90bf2a8
    ATR-based sl_bps and trail_distance_bps=sl_bps in strategy_selector; vol_at_hold from ignition
    Mehr im Commit-Body
    Made-with: Cursor
  436. 1045e40
    Add rolling_vol_15m_bps to IgnitionMetrics and vol_at_hold_bps(max_hold_secs)
    Mehr im Commit-Body
    Made-with: Cursor
  437. 6040fe9
    Startup stale-order reconcile in live_runner (exec + full run)
    Mehr im Commit-Body
    Made-with: Cursor
  438. c0e45dd
    fix: add Kraken application-level ping keepalive to public WS feeds
    Mehr im Commit-Body
    WS protocol Ping/Pong alone is insufficient with tokio-tungstenite
split streams. Add periodic {"method":"ping"} every 30s per Kraken
WS v2 docs to keep connections alive and flush queued protocol pongs.

Made-with: Cursor
  439. 9c99d61
    fix: three blocking issues — regime, ping/pong, ownOrders
    Mehr im Commit-Body
    1. Remove global CHAOS regime from system_live_ready gate.
   Per-pair regime already blocks individual chaotic symbols; the global
   mean over 629 symbols (most illiquid) was a broken systemic blocker.

2. Respond to WS Ping with Pong in ticker, trade, and L2 feeds.
   After ws.split() the write half was never used, so Pong was never
   sent. Kraken timed out connections after ~60s.

3. Remove invalid ownOrders subscribe on ws-auth (not a WS v2 channel).
   Feed own_orders_cache from executions channel with snap_orders=true,
   which is the v2 replacement per Kraken docs.

Made-with: Cursor
  440. dab68ea
    fix: clear pending list after successful L3 subscribe retry
    Mehr im Commit-Body
    Minor: pending wasn't cleared after final retry where all symbols
were acked, causing false L3_SUBSCRIBE_INCOMPLETE warning.

Made-with: Cursor
  441. d22d24d
    fix: L3 single subscribe per connection + retry rate-limited symbols
    Mehr im Commit-Body
    Per Kraken WS v2 docs: one subscribe request per connection (up to
200 symbols), rate counter 200/s standard. Rate-limited symbols get
automatic retry with 2s backoff (max 5 retries). Connections spaced
6s apart to let account-wide rate counter recover.

No dataset reduction. All 638 symbols across 4 connections.

Made-with: Cursor
  442. aaf10ad
    fix: L3 sequential connection startup + slower pacing for rate limits
    Mehr im Commit-Body
    Kraken L3 snapshot rate limit is account-wide, not per-connection.
Previous parallel startup exhausted the rate budget immediately.

Changes:
- Connections started sequentially (wait for subscribe to complete)
- 5s delay between connection setups
- L3 subscribe batch: 25→10 symbols (reduce per-batch credit usage)
- L3 batch delay: 200ms→1000ms (respect snapshot rate limit)
- 200 symbols × 10/batch × 1s = 20s per connection, ~80s total setup

Made-with: Cursor
  443. 2199990
    fix: L3 multi-connection for full symbol coverage (revert universe cap)
    Mehr im Commit-Body
    The previous approach wrongly capped L3 to 200 symbols. The correct
fix: keep all symbols, split across multiple ws-l3 connections
(max 200 per connection per Kraken docs). Each connection gets its own
fresh auth token + paced batched subscribe. All events fan into a
single processing loop.

638 symbols → 4 connections × ≤200 symbols each → full L3 coverage.

Made-with: Cursor
  444. 188a91e
    fix: L3 subscribe rate limiting + universe cap at 200 symbols
    Mehr im Commit-Body
    Root cause: L3 client subscribed 638 symbols in a single message,
exceeding Kraken's 200-symbol-per-connection limit. Only ~44 symbols
received data, causing frac_l3=0.365.

Changes:
- L3 client: paced batched subscribe (25 symbols/batch, 200ms delay)
  with ACK/error accounting per batch
- Universe: hard default l3_limit=200 (Kraken documented max)
- ingest_runner + live_runner: apply 200 cap when no env override set

Made-with: Cursor
  445. e0f38b8
    fix: process book messages during subscribe drain loop
    Mehr im Commit-Body
    The subscribe phase drain loop consumed book snapshot messages from
the WS stream without processing them into books/stats, causing
symbols_with_snapshot=0 in the health log despite books being active.
Now book messages are also processed during ACK draining.

Made-with: Cursor
  446. b66fcac
    fix: L2 subscribe rate limiting + full subscribe observability
    Mehr im Commit-Body
    Root cause: L2 book feed sent 64 subscribe batches (638 symbols/10 per batch)
in a tight loop without delay, exceeding Kraken WS rate limit. ~134 symbols
(biased U-Z) never received snapshots, causing frac_l2=0.884 < 0.90 threshold,
all epochs degraded, engine locked in ExitOnly.

Changes:
- Paced subscribe: 25 symbols/batch with 100ms inter-batch delay (26 msgs)
- Subscribe ACK/error accounting: parse WsSubscribeResponse, log per-batch
- Snapshot wait window (15s) + missing-snapshot repair with retry
- Execution-universe-first validation: log exec L2 coverage, error if incomplete
- Reconnect: full paced resubscribe, coverage re-measurement
- Per-symbol observability: snapshot/delta/write tracking, 60s health summary

Made-with: Cursor
  447. 420dca4
    phantom position auto-correction: exchange balance is truth
    Mehr im Commit-Body
    When fresh WS snapshots confirm exchange_base_total=0 and no open
reduce orders exist, the reconcile layer now automatically corrects
the DB position to flat (RECONCILED_FLAT) instead of halting forever.

Changes:
- position_reconcile: add CorrectedPhantomToFlat decision variant
- reconcile_symbol_durable: auto-correct phantom via close_dust_position
- protection_flow: handle CorrectedPhantomToFlat as dust (no exit)
- position_monitor: treat CorrectedPhantomToFlat same as SkipNoRealPosition

Made-with: Cursor
  448. 11dd384
    harden exit lifecycle status-event persistence
    Mehr im Commit-Body
    Made-with: Cursor
  449. 5d02191
    fix schema approx_row_estimate correlation alias
    Mehr im Commit-Body
    Made-with: Cursor
  450. db75658
    fix evidence query column qualification
    Mehr im Commit-Body
    Made-with: Cursor
  451. 6a65fd0
    db inventory source sanity check probe
    Mehr im Commit-Body
    Made-with: Cursor
  452. 44a4dd3
    fix bot activity probe: remove CTE scope
    Mehr im Commit-Body
    Made-with: Cursor
  453. cf36992
    fix bot activity probe CTE name
    Mehr im Commit-Body
    Made-with: Cursor
  454. ba730a5
    bot activity last 24h (execution_orders/fills/realized_pnl)
    Mehr im Commit-Body
    Made-with: Cursor
  455. ef2ea35
    duty cycle last24h on krakenbot ticker/trade samples
    Mehr im Commit-Body
    Made-with: Cursor
  456. 7b7ecec
    introspect ticker_samples columns
    Mehr im Commit-Body
    Made-with: Cursor
  457. 3d0b73c
    check ticker_samples presence 2026-03-18
    Mehr im Commit-Body
    Made-with: Cursor
  458. 7963538
    check trade_samples presence 2026-03-18
    Mehr im Commit-Body
    Made-with: Cursor
  459. 1c9079c
    introspect trade_samples columns
    Mehr im Commit-Body
    Made-with: Cursor
  460. f7c6319
    check DB has 2026-03-18 market/execution rows
    Mehr im Commit-Body
    Made-with: Cursor
  461. 8d681c7
    check execution fills/order timestamps last 24h
    Mehr im Commit-Body
    Made-with: Cursor
  462. 5275f27
    timestamp unit check v2 (ms vs seconds)
    Mehr im Commit-Body
    Made-with: Cursor
  463. dcf7f46
    timestamp unit check for ingest
    Mehr im Commit-Body
    Made-with: Cursor
  464. 38c6264
    data plane integrity probe v4
    Mehr im Commit-Body
    Made-with: Cursor
  465. e16028a
    add data plane integrity probe v3
    Mehr im Commit-Body
    Made-with: Cursor
  466. 427d4fd
    fix duty cycle in data plane integrity v2
    Mehr im Commit-Body
    Made-with: Cursor
  467. b528ecb
    add data plane integrity probe last 24h
    Mehr im Commit-Body
    Made-with: Cursor
  468. 1f2740a
    introspect public.trades columns
    Mehr im Commit-Body
    Made-with: Cursor
  469. 5fbba0c
    list potential trade tables
    Mehr im Commit-Body
    Made-with: Cursor
  470. 8292676
    fix v2 multi-run window anchored to latest data
    Mehr im Commit-Body
    Made-with: Cursor
  471. 01252f4
    fix v2 multi-run median calc
    Mehr im Commit-Body
    Made-with: Cursor
  472. 496305d
    fix v2 data_period FROM clause
    Mehr im Commit-Body
    Made-with: Cursor
  473. 7653a56
    v2 multi-run blocker context validation
    Mehr im Commit-Body
    Made-with: Cursor
  474. 936d0d2
    add multi-run context validation probe
    Mehr im Commit-Body
    Made-with: Cursor
  475. 9c4de56
    add confidence/recommended to join coverage probe
    Mehr im Commit-Body
    Made-with: Cursor
  476. d0a2d98
    fix order-join probe: count per candidate id
    Mehr im Commit-Body
    Made-with: Cursor
  477. d6e197d
    feat(alerts): pushover on ingest degraded + snapshot insert failures
    Mehr im Commit-Body
    Made-with: Cursor
  478. 87388e2
    probe v2: broaden exit-regime search
    Mehr im Commit-Body
    Made-with: Cursor
  479. ea248f7
    fix probe 35: single union query
    Mehr im Commit-Body
    Made-with: Cursor
  480. 0fc8370
    probe exit_regime_not_allowed string in candidates json
    Mehr im Commit-Body
    Made-with: Cursor
  481. 078b65e
    feat(alerts): add pushover +/-3% realized PnL triggers
    Mehr im Commit-Body
    Made-with: Cursor
  482. d7a2d7e
    fix exit-regime probe example query
    Mehr im Commit-Body
    Made-with: Cursor
  483. f2fee69
    feat(alerts): send pushover on data_stale/readiness/hard-blocked
    Mehr im Commit-Body
    Made-with: Cursor
  484. 85398ab
    add exit-regime and order-join probes
    Mehr im Commit-Body
    Made-with: Cursor
  485. f88dbc4
    introspect trading_funnel_events columns
    Mehr im Commit-Body
    Made-with: Cursor
  486. e107b4c
    fix 04: replace fill_probability with fill_flag proxy
    Mehr im Commit-Body
    Made-with: Cursor
  487. 5d5f00b
    feat(alerts): add Pushover client and config
    Mehr im Commit-Body
    Made-with: Cursor
  488. a8e5255
    fix spread/edge analyses: use public.fee_tiers
    Mehr im Commit-Body
    Made-with: Cursor
  489. 4db0cb0
    fix fees join to public.fee_tiers
    Mehr im Commit-Body
    Made-with: Cursor
  490. 3a4e909
    introspect public.fee_tiers columns
    Mehr im Commit-Body
    Made-with: Cursor
  491. 9dad3e2
    list fee tables
    Mehr im Commit-Body
    Made-with: Cursor
  492. c1aeea4
    rewrite candidate_decision_chain with real sources
    Mehr im Commit-Body
    Made-with: Cursor
  493. ace49fd
    introspect market snapshot columns
    Mehr im Commit-Body
    Made-with: Cursor
  494. cdc6a59
    list price/outcome tables
    Mehr im Commit-Body
    Made-with: Cursor
  495. d904c07
    probe overlap orders with fills vs candidates
    Mehr im Commit-Body
    Made-with: Cursor
  496. f4152ed
    fix probe semicolon
    Mehr im Commit-Body
    Made-with: Cursor
  497. 995d606
    fix probe: add FROM joined
    Mehr im Commit-Body
    Made-with: Cursor
  498. b8b378d
    probe candidate->order->fills join on eval+symbol
    Mehr im Commit-Body
    Made-with: Cursor
  499. e892689
    find latest run with candidates and fills
    Mehr im Commit-Body
    Made-with: Cursor
  500. 1b75ff5
    count rows for run_id=57
    Mehr im Commit-Body
    Made-with: Cursor
  501. 18329dd
    join coverage probe run_id=57
    Mehr im Commit-Body
    Made-with: Cursor
  502. 911ba12
    find latest run with fills
    Mehr im Commit-Body
    Made-with: Cursor
  503. f1c685c
    check fills join keys
    Mehr im Commit-Body
    Made-with: Cursor
  504. 121603c
    fix join probe: align run_id
    Mehr im Commit-Body
    Made-with: Cursor
  505. 51b763e
    probe candidate->order join keys
    Mehr im Commit-Body
    Made-with: Cursor
  506. c750e37
    fix join probe: remove taker_fee
    Mehr im Commit-Body
    Made-with: Cursor
  507. ab9d16f
    probe join coverage candidate->order->fills->pnl
    Mehr im Commit-Body
    Made-with: Cursor
  508. 8f4a1ee
    probe shadow_trades exit_reason
    Mehr im Commit-Body
    Made-with: Cursor
  509. 62f47c4
    introspect shadow_trades columns
    Mehr im Commit-Body
    Made-with: Cursor
  510. d769080
    introspect shadow_exit_analysis columns
    Mehr im Commit-Body
    Made-with: Cursor
  511. 4cc8649
    probe runtime_notrade_state samples
    Mehr im Commit-Body
    Made-with: Cursor
  512. 4dfe6da
    probe runtime_market_data_state non-numeric run_id
    Mehr im Commit-Body
    Made-with: Cursor
  513. 95e3419
    fix runtime_market_data_state probe cast
    Mehr im Commit-Body
    Made-with: Cursor
  514. 232090f
    fix runtime_market_data_state probe regex
    Mehr im Commit-Body
    Made-with: Cursor
  515. 43b6e1d
    probe runtime_market_data_state dominant reasons
    Mehr im Commit-Body
    Made-with: Cursor
  516. 4004c19
    probe execute candidate exit plan json
    Mehr im Commit-Body
    Made-with: Cursor
  517. b142df5
    probe runtime_notrade_events details_json
    Mehr im Commit-Body
    Made-with: Cursor
  518. 46bf1e8
    add extra introspection for readiness sources
    Mehr im Commit-Body
    Made-with: Cursor
  519. 565eb9d
    probe candidate rejection reasons
    Mehr im Commit-Body
    Made-with: Cursor
  520. 9d696c6
    add DB source introspection SQL
    Mehr im Commit-Body
    Made-with: Cursor
  521. 4a6cd0c
    add DB tuning analysis pipeline (SQL + runner + docs)
    Mehr im Commit-Body
    Made-with: Cursor
  522. 34669fc
    docs(changelog): record Phase A observability snapshots commit
    Mehr im Commit-Body
    Made-with: Cursor
  523. 0143d40
    feat(observability): complete Tier2/Admin read-model snapshot exports
    Mehr im Commit-Body
    Made-with: Cursor
  524. 6398d72
    refine invariant B classification and wire v2 safety report
    Mehr im Commit-Body
    Made-with: Cursor
  525. 3203f79
    Add safety invariants v2 read-only analysis and CLI report
    Mehr im Commit-Body
    Introduce InvariantKind/InvariantStatus classification SSOT in safety_invariants_v2 and a CLI report to render per-symbol A/B invariant statuses without changing runtime behavior.

Made-with: Cursor
  526. a158ede
    Add low-cardinality observability for reconcile, remediation, and ACK
    Mehr im Commit-Body
    Log RECONCILE_DECISION, REMEDIATION_* events, and ACK_* lifecycle around the new authority/remediation layer without changing correctness.

Made-with: Cursor
  527. 7634745
    Cover reserved-funds replacement ACK timeout path in tests
    Mehr im Commit-Body
    Add a dedicated test that simulates replacement ACK timeout, asserting evidence write, symbol hard block, and error outcome.

Made-with: Cursor
  528. 3172823
    Add tests for reserved-funds replacement ACK success/failure
    Mehr im Commit-Body
    Introduce minimal ACK source and hard-block hooks to unit-test cancel→update→submit→ACK behavior. Prove replacement happens in the same remediation cycle and that ACK failure triggers evidence + hard block.

Made-with: Cursor
  529. 3d3df36
    Relax readiness log test for blocked path
    Mehr im Commit-Body
    Allow blocked readiness tests to pass when only READINESS_GATE_DECISION is logged, keeping assertions stable across environments.

Made-with: Cursor
  530. 9564b11
    Route all exit/amend paths through reserved-funds remediation
    Mehr im Commit-Body
    Unify reserved-funds cancel→ownOrders update→re-reconcile gating across protection, position monitor, and ignition exit. Add tests for remediation sequencing and uncertainty hard-block semantics, and document the reconcile/remediation authority.

Made-with: Cursor
  531. 9855097
    feat(execution): remediate reserved-funds conflicts via cancel+reconcile
    Mehr im Commit-Body
    Infer reduce classification when reduce_only is missing, add ownOrders update sequencing, and perform deterministic cancel cleanup for duplicate/conflicting orders before retrying protection submits.

Made-with: Cursor
  532. e23f09f
    chore(git): ignore observability_export artifacts
    Mehr im Commit-Body
    Prevent generated observability exports from dirtying the working tree on local and server checkouts.

Made-with: Cursor
  533. 8b8a829
    feat(execution): gate exits/protection on fresh balances+ownOrders
    Mehr im Commit-Body
    Introduce a central position/order reconcile choke point with safety-first freshness rules (balances/ownOrders <= 5s) and fail-closed HALT decisions. Wire all exit/protection submit paths to respect reconcile, allowing only cancel-only cleanup without fresh snapshots.

Made-with: Cursor
  534. 88cdeb4
    feat(exchange): add WS ownOrders inventory cache
    Mehr im Commit-Body
    Subscribe to private WS v2 ownOrders on the shared hub and maintain an in-memory open-orders snapshot for reconcile.

Made-with: Cursor
  535. 20eaaf1
    fix(execution): bound execution-only ticker bootstrap to open positions
    Mehr im Commit-Body
    Limit the execution-only ticker WS subscription set to symbols with open positions so price_cache warms quickly for emergency protection without subscribing to the full USD universe.

Made-with: Cursor
  536. 3a56086
    fix(execution): retry emergency protection with SLA and market escalation
    Mehr im Commit-Body
    Add a background emergency retry loop with warn/escalate/hard SLA thresholds, and introduce a market-close escalation path to avoid leaving exposure pending when price_cache prerequisites do not arrive in time.

Made-with: Cursor
  537. 95a252d
    fix(execution): add global entry halt when emergency protection pending
    Mehr im Commit-Body
    Introduce a fail-closed entry_halt gate in live runner loops and set it at startup when unprotected exposure cannot be immediately protected (Pending/HardFail/CriticalInvariantBreach).

Made-with: Cursor
  538. b89e6b9
    fix(execution): classify protection prereqs and insufficient-funds breaches
    Mehr im Commit-Body
    Introduce Pending/HardFail/CriticalInvariantBreach outcomes for emergency protection, fail-closed when the private WS hub is not ready, and classify Insufficient funds into explicit invariant breach types.

Made-with: Cursor
  539. 41b76fa
    fix(exchange): add disconnect-safe readiness for private WS hub
    Mehr im Commit-Body
    Expose is_ready()/wait_ready() and a generation counter so execution paths can fail-closed when the shared ws-auth sender is not yet usable or has disconnected.

Made-with: Cursor
  540. 89bb7b8
    fix(execution): correct closed_qty on position sign flips
    Mehr im Commit-Body
    Cap realized close quantity at the pre-fill position when a fill crosses through zero, and decode nullable parent_order_id as Option<i64> to prevent NULL decode crashes during fill processing.

Made-with: Cursor
  541. fd3733a
    fix(cli): run report-safety-invariants on decision DB
    Mehr im Commit-Body
    The invariants audit reads execution tables (positions/execution_orders), so dispatch it via the decision pool instead of ingest.

Made-with: Cursor
  542. 44e5328
    fix(cli): expose report-safety-invariants mode
    Mehr im Commit-Body
    Include report-safety-invariants in cli_mode detection so the audit report runs without starting other long-running modes.

Made-with: Cursor
  543. 911dcc8
    feat(analysis): add hard safety invariants audit report
    Mehr im Commit-Body
    Add `krakenbot report-safety-invariants [hours]` to correlate DB exposure/exit coverage with journalctl evidence and print Invariant A/B breach rows including min_order_size from the instrument cache.

Made-with: Cursor
  544. 2e59baa
    fix(execution): preserve partial fills and correct realized pnl
    Mehr im Commit-Body
    Use a deterministic per-fill idempotency key (not exchange order_id) so partial fills are not dropped, treat any order with parent_order_id as an exit order, and persist realized PnL only on position reductions (linked to the root entry order).

Made-with: Cursor
  545. 11b7152
    diag: log exchange_balances persist success
    Mehr im Commit-Body
    Logs EXCHANGE_BALANCES_PERSIST_OK with row count and ENJ presence so we can
prove DB-first holdings are being written from the balances snapshot.

Made-with: Cursor
  546. f140b2d
    diag: log private WS subscribe acks and balances snapshots
    Mehr im Commit-Body
    - Log subscribe ACK/result/error for balances + executions
- Log first balances snapshot (asset count + ENJ presence)
- Log first executions batch size

Purpose: prove why balances snapshot is missing and enable DB-first holdings.
Made-with: Cursor
  547. 942bb12
    fix: do not drop early balances/executions snapshots on subscribe
    Mehr im Commit-Body
    The private WS hub previously drained two messages after subscribe, which could
silently discard the initial balances snapshot. We now drain for up to 3s while
still processing/broadcasting balances and executions messages.

Made-with: Cursor
  548. 4501f03
    fix: persist exchange_balances from balance_cache
    Mehr im Commit-Body
    Use the balance_cache (already fed by the shared private WS hub) as the
source for writing krakenbot.exchange_balances. This avoids relying on
broadcast message delivery timing and keeps holdings DB-first.

Made-with: Cursor
  549. 06012e8
    feat: persist exchange balances for DB-first exposure discovery
    Mehr im Commit-Body
    - Add krakenbot.exchange_balances table (additive migration)
- Persist private WS balances snapshots into DB via existing PrivateWsHub (no new WS)
- Use exchange_balances as primary holdings source in exposure_reconcile; executions remains supplemental

Made-with: Cursor
  550. 39b19ab
    feat: add Kraken WS v2 implementation checklist rule
    Mehr im Commit-Body
    Made-with: Cursor
  551. 07d9243
    feat: infer holdings from executions channel
    Mehr im Commit-Body
    - Add execution_holdings_cache (net per symbol) updated from private WS executions
- Use executions-derived holdings for exposure reconciliation (no balances required)
- Feed holdings cache in private_ws_hub

Made-with: Cursor
  552. 9772946
    chore: log ENJ balance sync skips
    Mehr im Commit-Body
    Adds targeted diagnostic log when an ENJ-like balance asset cannot be mapped
into a tradable symbol during balance-driven reconcile.

Made-with: Cursor
  553. 0206e76
    fix: allow emergency protection without ticker price cache
    Mehr im Commit-Body
    - When avg_entry_price is known, compute stop from entry only (no price_cache needed)
- For balance-discovered positions, recover avg_entry_price from positions table when available

This enables protecting manual/external holdings (e.g. ENJ) even in execution-only mode.

Made-with: Cursor
  554. cd9b14a
    fix: protect manual positions without REST
    Mehr im Commit-Body
    - Revert REST usage in protection flow (strictly forbidden)
- Normalize balance asset codes (X*/Z*/XX*/XZ*) to AAA/USD symbols for balance-driven reconcile
- Delay startup protection briefly so price_cache has snapshots before computing stops

Made-with: Cursor
  555. 996ad39
    fix: autopsy script use DECISION_DATABASE_URL when set
    Mehr im Commit-Body
    Execution data (orders, fills, positions) lives in DECISION DB when
physical separation is configured; ingest DB has no execution data.

Made-with: Cursor
  556. f128b05
    fix: do not close positions from stale balance check
    Mehr im Commit-Body
    The total_open_notional stale check (balance < 1% of DB position) was
calling close_dust_position, which incorrectly zeroed open positions
when balance_cache was stale (race with fill, or asset not in snapshot).

Root cause of ENJ showing base_position=0 in DB while 349 ENJ on Kraken:
fill processed -> position 244.72; balance_cache not yet updated ->
stale check triggered -> close_dust_position -> position zeroed.

Fix: only exclude from exposure total, do not mutate positions table.
Made-with: Cursor
  557. b17709c
    feat: balance-driven position discovery — protect manual/external positions
    Mehr im Commit-Body
    - Add load_positions_from_balance() to discover positions on Kraken not in DB
- Merge balance positions into reconcile_exposure_at_startup and run_periodic_reconcile
- Extend check_symbol_execution_lock to block entry when balance > 0 and no DB position
- Fixes unprotected positions from manual trades (e.g. ENJ)

Made-with: Cursor
  558. 94b9883
    feat: add Deep Trade Autopsy script (12h live execution analysis)
    Mehr im Commit-Body
    Made-with: Cursor
  559. 5b523fa
    fix: handle Kraken exec_type filled/partial_fill in ws_handler (was falling through to UNHANDLED)
    Mehr im Commit-Body
    Made-with: Cursor
  560. df50ed8
    docs: EXIT_SYSTEM_INVENTORY + exit strategy debug/diagnose scripts
    Mehr im Commit-Body
    Made-with: Cursor
  561. fa5b54c
    scripts: add exit_strategy_inference.sql for SL-based strategy counts
    Mehr im Commit-Body
    Made-with: Cursor
  562. aa5f9f9
    changelog: add entry for 7e9ca71 (doc sync)
    Mehr im Commit-Body
    Made-with: Cursor
  563. 7e9ca71
    docs: alle leidende docs up-to-date (exit, compounding, markers)
    Mehr im Commit-Body
    - CHANGELOG_ENGINE: exit runtime, sectie 2025-03-17
- DOC_CONSISTENCY_REPORT: exit, portfolio, compounding sync met SSOT
- LIVE_RUNBOOK: exit lifecycle markers, order→exit flow
- LOGGING: EXIT_PLAN_CREATED, EXIT_ORDER_ACKED, POSITION_MONITOR_*

Made-with: Cursor
  564. 35071f9
    docs: ENGINE_SSOT + ARCHITECTURE — exit, compounding, capital up-to-date
    Mehr im Commit-Body
    - Exit: post-fill exit_lifecycle (SL+TP) + position_monitor (trail, TP) in live runner
- Compounding: capital_allocator.update_equity(live_eq) per evaluation
- Portfolio allocation: live equity; allocated_quote nog niet uit positions
- Persistent ingest, execution attach: server bewezen

Made-with: Cursor
  565. 5b48b3f
    changelog: add entry for 9bd11b1 (L2/L3 epoch validity)
    Mehr im Commit-Body
    Made-with: Cursor
  566. 9bd11b1
    fix: L2 cold-start + L3 partial (70%) for epoch validity
    Mehr im Commit-Body
    - L2 cold-start: criteria_l2_ok=true when >50% l2=0 (warmup)
- L3 partial: criteria_l3_ok=true when frac_l3>=70% (Kraken rate limits)
- EPOCH_VALIDITY_COMPUTED: add l2_cold_start, frac_l2 to log

Made-with: Cursor
  567. 6738335
    changelog: add entries for 967d1c6, 97cf3d3
    Mehr im Commit-Body
    Made-with: Cursor
  568. 967d1c6
    fix: L3 cold-start relaxation + shadow persistence for engine_mode_blocked
    Mehr im Commit-Body
    - ingest_epoch: criteria_l3_ok=true when >50% l3_count=0 (systemic cold start)
- ingest_epoch: EPOCH_VALIDITY_COMPUTED logging (ok_*, frac_*, l3_cold_start)
- strategy_pipeline: insert_shadow_trades_engine_mode_blocked()
- docs/BOTTLENECK_FIXES_2025-03-17.md

Made-with: Cursor
  569. 97cf3d3
    changelog: add entry for 764eebe (restart doctrine)
    Mehr im Commit-Body
    Made-with: Cursor
  570. 764eebe
    feat(restart): unbounded execution + lineage_break NoNewEntries + RESTART_DOCTRINE
    Mehr im Commit-Body
    - LIVE_VALIDATION_RUNTIME_MINUTES=0: unbounded loop (100y deadline)
- lineage_break: NoNewEntries i.p.v. ExitOnly (1 cycle milder)
- LINEAGE_BREAK_GRACE + LINEAGE_POST_SWITCH_CYCLE logging voor meetmethode
- docs/RESTART_DOCTRINE.md: doctrine, productiebeleid, meetmethode
- L3_SCHAALBEPERKINGEN: incremental refresh + RESTART_DOCTRINE ref
- systemd: comment LIVE_VALIDATION_RUNTIME_MINUTES=0 voor productie

Made-with: Cursor
  571. 9637371
    fix: partial fill SL — cancel+replace for full cum_qty, balance-based market exit
    Mehr im Commit-Body
    - Add get_open_sl_exchange_id_for_entry to cancel prior SL before placing new
- Replace amend with cancel+replace on additional partial (amend unreliable, leaves dust)
- Use balance_cache for TP internal market exit (was qty_f64)
- Trailing amend and time stop use protected_qty

Made-with: Cursor
  572. 6e8e634
    fix: exposure reconciliation + L3 hard block bottleneck
    Mehr im Commit-Body
    Exposure (phantom positions):
- total_open_notional now reconciles DB positions with exchange balance
- If balance_cache says base asset < 1% of DB position, treat as stale
- Exclude from exposure and close in DB (base_position=0)
- Fixes GLOBAL_EXPOSURE_BLOCK when DB has positions not on exchange

L3 hard blocks (589/642 symbols blocked after restart):
- clear_l3_resync_blocks at startup: reset all l3_resync_limit_reached
  blocks so we start fresh (previous blocks were from rate-limited sessions)
- Global cold-start: when >50% of L3 symbols have 0 rows, skip per-symbol
  blocks (Kraken rate-limiting, not symbol-specific failure)
- Reset prev_count when hard_block_until expired: symbol gets fresh chance
  instead of immediate re-block
- Applied in ingest_runner, live_runner (combined), run_execution_only

Made-with: Cursor
  573. 69da0df
    perf: persistent instrument WS — single connection, live updates
    Mehr im Commit-Body
    Replace the open/snapshot/close pattern with a single persistent WS
connection to Kraken's instrument channel:

- preload_all() connects once, receives the full snapshot (1490 pairs),
  populates the cache, then hands off the read stream to a background
  tokio task
- The background task keeps the connection alive and processes `update`
  messages, so the cache stays fresh when Kraken changes instrument
  rules (qty_min, price_increment, status, etc.)
- On disconnect: automatic reconnect after 10s with full re-snapshot
- get_instrument_constraints() reads from cache only — zero WS calls
- Removed the legacy per-symbol fetch_instruments_v2 (no callers left)

Net result: exactly 1 WS connection for instruments (kept alive),
down from N connections (opened and closed per symbol per call).

Made-with: Cursor
  574. b9f69a0
    perf: cache instrument constraints — single WS connection at startup
    Mehr im Commit-Body
    get_instrument_constraints opened a new WebSocket per call, fetching
the full 600+ pair snapshot each time only to extract one symbol.
During startup reconcile this meant 5+ concurrent WS connections for
the same data, triggering Kraken rate limits.

Now: preload_all() fetches all pairs once via a single WS connection
and caches them in-memory. Runtime callers read from cache with zero
network overhead. Cache-miss falls back to single-symbol WS fetch and
backfills the cache.

Called at both startup paths (run_execution_live + run_execution_only)
before exposure reconciliation, so protection_flow and dust detection
have constraints available immediately.

Made-with: Cursor
  575. d8c099d
    fix: use notional-based dust threshold instead of per-symbol WS call
    Mehr im Commit-Body
    get_instrument_constraints opens a WS per symbol — too expensive for
the hot path (total_open_notional runs every evaluation cycle). Replace
with a simple $5 notional threshold: positions below this are untradeable
dust regardless of exchange-specific minimums.

Made-with: Cursor
  576. 47eacfd
    fix: unblock execution — dust exposure exclusion, protection retry, shadow persistence
    Mehr im Commit-Body
    Proven bottlenecks from live data (100% order block rate):
1. Dust positions (CFG, RARI, XPL) below exchange min order qty consumed
   ~$9 of $51 exposure budget despite being untradeable. Now excluded
   from total_open_notional, consistent with EXPOSURE_DUST_SKIP.
2. Protection flow failed with "Insufficient funds" for NPC + TRIA
   because DB qty exceeded actual exchange balance. Added balance-cache
   retry: on Insufficient funds, fetches real available qty and retries.
3. Dust positions in DB kept status=open forever. Now auto-closed to
   base_position=0 during startup reconciliation when below min order.
4. V2 pipeline shadow trades were only logged, not persisted. Added
   insert_v2_shadow_trade for edge_floor_block and risk_gate skips.

Made-with: Cursor
  577. 58a821c
    observability: no-trade reason tracing — per-symbol, per-strategy, shadow-equivalent logs + CLI
    Mehr im Commit-Body
    5 observability additions (no strategy logic changes):

1. V2_PIPELINE_SCOPE log: tradable_in_report, exec_allowed_count, tradable_in_scope,
   filtered_by_universe at pipeline entry (strategy_pipeline.rs)

2. NO_TRADE_DOMINANT_REASON log per evaluation when no Execute outcomes: single
   dominant reason (data_runtime_not_ready / no_positive_edge_any_symbol /
   tradable_filtered_by_universe_or_freshness / all_candidates_skip_economics)
   with tradable_in_report, exec_allowed count, skip count (live_runner.rs)

3. SYMBOL_ROUTE_DECISION log per symbol after route analysis: outcome (TRADABLE
   with route details or NO_TRADE with reason), edge, score, valid/total candidates,
   top 3 reject reasons (route_selector.rs + route_selector_v2.rs)

4. report-no-trade-reasons CLI: per-symbol decision table, per-strategy funnel
   (in_scope, tradable, no_trade, top 3 reasons), aggregate reject histogram,
   near-miss symbols (analysis_commands.rs + commands.rs)

5. V2_SHADOW_BLOCKED log for every pipeline Skip (edge_floor or risk_gate):
   symbol, blocker_reason, route_family, edge, confidence, spread, expected_move
   (strategy_pipeline.rs)

Made-with: Cursor
  578. 742db2f
    cursor rules: expliciet dat alle wijzigingen ook op de server moeten staan
    Mehr im Commit-Body
    Made-with: Cursor
  579. e18fba6
    changelog: volgorde nieuwste bovenaan; bf87455 toegevoegd aan lijst
    Mehr im Commit-Body
    Made-with: Cursor
  580. bf87455
    changelog: add entry for d003854
    Mehr im Commit-Body
    Made-with: Cursor
  581. d003854
    changelog: volledig chronologisch (oudste eerst), alle 264 commits herleidbaar vanaf e4182b3
    Mehr im Commit-Body
    Made-with: Cursor
  582. e8a8486
    changelog: add entry for 20f2f4c
    Mehr im Commit-Body
    Made-with: Cursor
  583. 20f2f4c
    changelog: add entry for 51abf53
    Mehr im Commit-Body
    Made-with: Cursor
  584. 51abf53
    changelog: add entry for d9734b9
    Mehr im Commit-Body
    Made-with: Cursor
  585. d9734b9
    changelog: add entry for bfadca3
    Mehr im Commit-Body
    Made-with: Cursor
  586. bfadca3
    changelog: add entry for ea94e6e (changelog + RAG spec)
    Mehr im Commit-Body
    Made-with: Cursor
  587. ea94e6e
    changelog: document commits 8dceb90..8a4261a (execution, exit, hub, recv_timeout); add RAG backend spec doc
    Mehr im Commit-Body
    Made-with: Cursor
  588. 8a4261a
    fix: recv_timeout Hub use remaining time on Lagged retry
    Mehr im Commit-Body
    Track deadline once and use saturating_duration_since(Instant::now())
for each retry so total wait never exceeds requested timeout. Prevents
nearly-doubled wait for exit monitor (250ms) and SL trailing under load.

Made-with: Cursor
  589. 157c238
    feat: hub-aware protect_exposure and ignition_exit via PrivateMsgSource
    Mehr im Commit-Body
    protection_flow: accept hub: Option<&PrivateWsHub> — when provided reuses the
shared private WS connection instead of opening a new one.
ignition_exit: switch from UnboundedReceiver to PrivateMsgSource so the hub
broadcast path is supported and WS disconnect no longer hard-fails (logged, not
bailed).
live_runner: pass Some(&private_hub) to protect_exposure and ignition_exit at
all four call sites.

Made-with: Cursor
  590. 6d91c91
    execution: protection after exit fill + exit_lifecycle on PrivateMsgSource
    Mehr im Commit-Body
    - exposure_reconcile: load_open_exit_qty_per_symbol uses remaining qty
  (quantity_base - cum_qty_base) so partial fills on exit orders are
  reflected; add ensure_protection_after_exit_fill() and call
  protect_exposure for remainder when needed (skip dust).
- ws_handler: HandleResult::Applied gains exit_fill_symbol for exit-order
  fills so runner can trigger protection for remainder.
- runner: on exit_fill_symbol set, call ensure_protection_after_exit_fill
  (pool, run_id, symbol, api_key, api_secret, hub).
- exit_lifecycle: take PrivateMsgSource instead of UnboundedReceiver,
  use recv_timeout() throughout so hub and dedicated paths both work.
- Add private_msg_source module and wire in mod.rs.
- deterministic_proof: match HandleResult::Applied with exit_fill_symbol.

Made-with: Cursor
  591. 5ce3547
    fix: use UnboundedReceiver directly in exit_lifecycle (no PrivateMsgSource)
    Mehr im Commit-Body
    Replace PrivateMsgSource abstraction with tokio::sync::mpsc::UnboundedReceiver<PrivateV2Response>
directly — matches the server's runner.rs call sites and avoids the untracked
private_msg_source.rs dependency. All recv calls use tokio::time::timeout wrapping.

Made-with: Cursor
  592. 20bd5a9
    feat: maker TP exit — dual-order monitoring with 30s fill-check
    Mehr im Commit-Body
    Place a post_only limit order at TP price alongside the SL on exchange.
WS executions channel determines which order fills first:
- TP fill: cancel SL, exit_reason=tp_maker
- SL fill: cancel TP limit (cleanup)
- 30s fill timeout or time_stop/panic: cancel TP + cancel SL, market exit
  on balance-size from WS balance_cache (no REST)

Activated for TSL and MakerLadder strategies; graceful degradation to
internal TP check on post_only rejection. All via WS only; no REST calls.

Made-with: Cursor
  593. 730e7a5
    feat: model maker TP exit in fee and route expectancy
    Mehr im Commit-Body
    Add use_maker_tp to ExitConfig; model exit fee as maker_bps when TP is
placed as a post_only limit order. Update fee_realism.rs, route_selector_v2.rs,
and route_expectancy.rs so TakeProfit routes reflect the lower exit cost
in expected_net_edge_bps, reducing taker fee drain and improving tier economics.

Made-with: Cursor
  594. da16a5c
    observability: demo_trades uit echte fills, tier2_* + admin snapshots (100% oplevering)
    Mehr im Commit-Body
    Made-with: Cursor
  595. 1fedf48
    feat: single persistent private WS hub — 1 connection for all consumers
    Mehr im Commit-Body
    Architecture:
  Auth WS (1 connection, stays open hours/days)
    ├── subscribe: executions + balances
    ├── order submit / amend / cancel (via shared Arc<sender>)
    ├── execution reports → broadcast to position_monitor + others
    ├── balance updates → balance_cache (live equity)
    └── auto-reconnect on disconnect

Before: 3 separate private WS connections (balance_feed, position_monitor,
main execution). Each consumed a Kraken connection slot, causing persistent
429 rate limit errors.

After: 1 shared connection. PrivateWsSender uses interior mutability
(parking_lot::RwLock) for hot-swap on reconnect. Broadcast channel
distributes incoming messages to all consumers.

Also includes: breakeven floor + 0.7% trail for exit management.

Made-with: Cursor
  596. 8a5f5ee
    fix: breakeven floor, tighter trail, staggered WS startup
    Mehr im Commit-Body
    Exit management:
- Trail distance capped at 0.7% from high watermark (was 1.5%)
- Breakeven floor at 30bps: SL never goes below entry once in profit
- TP lowered to 200bps (was 250) for faster capture
- Applied to all three exit paths (monitor, lifecycle, ignition)

WS reliability:
- Staggered WS connections at startup (3s delays) to avoid 429
- Initial backoff raised to 5s (was 1s), max to 120s (was 60s)

Made-with: Cursor
  597. c1b67e9
    fix: breakeven floor + 0.7% trail — stop giving back profit
    Mehr im Commit-Body
    All three exit paths (position_monitor, exit_lifecycle, ignition_exit)
now enforce:
- Trail distance capped at 0.7% from high watermark (was 1.5%)
- Breakeven floor: once peak profit exceeds 30 bps, SL is floored
  at entry price — profit move is never fully surrendered
- TP lowered to 200 bps (was 250) for faster profit capture

Before: TRIA peaked +121 bps but SL trailed to 0.03122 (below entry
0.03131). Profit was surrendered entirely.
After: SL would be max(0.03169*0.993, 0.03131) = 0.03147 = +0.5%
above entry, locking in profit.

Made-with: Cursor
  598. 9f79b88
    fix: feed position symbols through main ticker WS, remove separate WS
    Mehr im Commit-Body
    The separate position ticker WS was hitting Kraken's 429 rate limit
(too many concurrent WS connections). Now position symbols are added
to the main ticker WS subscription at startup, ensuring price_cache
always has data for open positions without an extra connection.

Made-with: Cursor
  599. a6cb13c
    fix: tighten position monitor trail — 1.5% distance, immediate activation
    Mehr im Commit-Body
    Was: 3% trail distance, only activates after 1.2% profit (40% of 300bps).
Now: 1.5% trail distance from high watermark, activates immediately
when position is in any profit. Much tighter risk control — SL stays
close to current price instead of sitting far below entry.

For TRIA at +0.25%: SL moves from 0.03057 (-2.4%) to ~0.03092 (-1.5%).

Made-with: Cursor
  600. d2940d8
    fix: add periodic status logging to position monitor
    Mehr im Commit-Body
    Logs PnL, current price, SL price, and highest price for each
monitored position every 60s for diagnostics.

Made-with: Cursor
  601. c42357a
    fix: position monitor gets own ticker WS for position symbols
    Mehr im Commit-Body
    The main ticker WS only subscribes to evaluation-universe symbols,
leaving active position symbols (TRIA, NPC, etc.) without price data
in the price_cache. The monitor now spawns a dedicated public ticker
WS that subscribes specifically to symbols with open positions,
feeding price_cache so trail/TP evaluation actually works.

Made-with: Cursor
  602. 247194a
    feat: active position monitor — trail SL + TP for all open positions
    Mehr im Commit-Body
    Background task that actively manages ALL positions (not just current-run trades):
- Persistent private WS for order amendments
- Reads prices from price_cache (no REST)
- Trails SL when price moves >40% of SL distance in favorable direction
- Takes profit at market when unrealized PnL exceeds 250 bps
- Detects SL triggers/fills via executions channel
- Refreshes position list from DB every 30s
- Auto-reconnects on WS disconnect

Fixes the gap where reconciled/legacy positions only got a static
emergency SL with no trailing, TP, or active management.

Made-with: Cursor
  603. 6bbffb6
    fix: live equity, dust detection, SL trigger detection, exposure calc
    Mehr im Commit-Body
    - Live equity via WS balances channel (balance_cache + balance_feed):
  replaces static EXECUTION_EQUITY_QUOTE, enables compounding.
  CapitalAllocator and exposure gate use live equity each cycle.
- Dust detection: positions below exchange min_order_size are marked
  as dust and skipped in protection_flow (no more failed SL attempts).
- protection_flow uses price_cache instead of REST for bid/ask.
- Exposure calculation uses positions × live prices instead of stale
  execution_orders records that can strand in non-terminal status.
- Critical: SL trigger detection now recognizes "triggered" status
  and exec_type from Kraken WS — stop-loss orders transition to
  "triggered" (not "filled") when the trigger price is hit.
  This was causing the bot to miss SL executions and fall through
  to time_stop, wasting hold time and creating orphan exposure.

Made-with: Cursor
  604. e9e7a80
    feat: 24h blocklist for NL-restricted symbols
    Mehr im Commit-Body
    Symbols rejected with "restricted for NL" or "Invalid permissions" now
enter quiet mode for 24 hours instead of the default ~2 minutes. Stops
wasting evaluation cycles on permanently unavailable pairs.

Made-with: Cursor
  605. 504f430
    fix(critical): SL order ID mismatch — match on cl_ord_id, not first ACK
    Mehr im Commit-Body
    wait_for_next_add_order_result was picking up stale entry-order ACK
instead of the SL order response, causing the exit lifecycle to monitor
the wrong exchange order. Fixed by matching on result.cl_ord_id.

Also: amend_stop_loss_trigger now passes order_qty (Kraken API requires
it), and add_stop_loss_order now logs the sent JSON.

Made-with: Cursor
  606. 6baef85
    fix: start ticker WS in execution-only mode for price_cache
    Mehr im Commit-Body
    The SL-only exit model needs live prices from price_cache for trailing
and internal TP checks. The execution-only loop was missing the ticker
WS that feeds this cache.

Made-with: Cursor
  607. 8dceb90
    refactor: SL-only exit model — no TP on exchange, trail SL trigger_price
    Mehr im Commit-Body
    Eliminates double-execution risk by keeping only the stop-loss on Kraken.
TP decisions are made internally using in-memory price cache (no REST).
SL is trailed via amend_order trigger_price (max 1/sec).
Both exit_lifecycle.rs and ignition_exit.rs converged to same model.

Made-with: Cursor
  608. ba47407
    docs: add exit lifecycle horizon-aware SL/TP fix to changelogs
    Mehr im Commit-Body
    Made-with: Cursor
  609. 64a9dd9
    fix: use horizon max_hold_secs for TSL routes instead of 0
    Mehr im Commit-Body
    Trailing stop routes set max_hold_secs=0 in the route candidate (no fixed
time limit). The exit config builder needs the horizon's actual hold time to
set a proper time_stop, so use horizon.max_hold_secs() from the pipeline
and guard against 0 as fallback.

Made-with: Cursor
  610. 1fe5f03
    fix: make exit SL/TP/time_stop horizon-aware instead of fixed values
    Mehr im Commit-Body
    The TSL exit config had SL=-60bps and time_stop=30s, which for breakout
continuation/medium routes (expected hold: 600s, expected move: 100-300bps)
meant the stop loss was inside the spread and positions were dumped after
30 seconds before the breakout could develop.

Changes:
- Add max_hold_secs and expected_move_bps to Outcome, wire from V2 pipeline
- Scale SL to 50% of expected_move (min 100, max 500 bps)
- Scale TP to 150% of expected_move (min 150, max 1000 bps)
- Set time_stop from route horizon instead of fixed 30s
- Fix direction bug: SL/TP now correctly flip for short positions

Made-with: Cursor
  611. 3b9cf89
    fix: restore TSL capital protection gating for BreakoutContinuation
    Mehr im Commit-Body
    VolatilityTrailingStop was unconditionally allowed for breakout routes,
contradicting the exit regime's capital protection doctrine which
restricts TSL in volatile/reversal-prone markets.

Root cause: the V2 regime matrix generates TSL candidates for
VolatilitySpike breakouts, but the V2 admission override only handled
EdgeNegative and MoveBelowFees — not ExitRegimeNotAllowed. This
caused every VolatilitySpike breakout to be permanently blocked,
which prompted the unconditional TSL workaround.

Proper fix:
1. Restore TSL gating for BreakoutContinuation (TSL only in non-
   volatile conditions, consistent with PullbackContinuation)
2. Add ExitRegimeNotAllowed to V2 admission override conditions

Now V1 capital protection is the default (TSL blocked in explosive
markets), while V2 can override with quantitative justification
when multi-scenario tail math is positive.

Made-with: Cursor
  612. 1708761
    fix: add 1% tolerance to final notional check for step-size rounding
    Mehr im Commit-Body
    After instrument step-size normalization, the final qty*price can
be fractionally below the minimum notional (e.g., $9.9999 < $10.00)
due to floating point truncation. This blocked orders that were
effectively at minimum. Adding 1% tolerance prevents false rejections
while still catching genuinely undersized orders.

Made-with: Cursor
  613. 0ab6a7e
    fix: use Kraken-compliant Short UUID for cl_ord_id
    Mehr im Commit-Body
    Kraken WS v2 accepts cl_ord_id in three formats: Long UUID (36
chars with hyphens), Short UUID (32 hex chars), or Free text (max
18 chars). The previous format "kb" + prefix + UUID simple = 35
chars didn't match any valid format, causing
EGeneral:Invalid arguments:cl_ord_id rejections on every order.

Now generates pure UUIDv4 simple (32 lowercase hex chars) which is
a valid Short UUID format. Also fixes the same issue in probe
modules and intent.rs fallback path.

Made-with: Cursor
  614. 436a072
    fix: recalibrate exit regime thresholds for enriched vol_proxy
    Mehr im Commit-Body
    The exit regime selector used HIGH_VOL_THRESHOLD=2.5 and
ORDERLY_VOL_MAX=2.0, calibrated for legacy microprice deviation
(0-10 bps). With ignition-enriched vol_proxy (rolling realized vol,
10-100 bps), every pair was classified as "volatile", blocking
VolatilityTrailingStop for BreakoutContinuation and PullbackContinuation.

This contradicted the regime route matrix which specifies TSL for
vol_spike routes, causing all candidates to get ExitRegimeNotAllowed.

Recalibrated to: HIGH_VOL=50, IMPULSE=3.0, ORDERLY_VOL_MAX=40.
Also: TSL is now always allowed for BreakoutContinuation (natural fit).

Made-with: Cursor
  615. c4b5bef
    fix: add medium-horizon routes for vol_spike and trend regimes
    Mehr im Commit-Body
    VolatilitySpike previously only had Short routes where sqrt(3)=1.73x
time factor couldn't produce moves that clear the 70 bps taker fee
threshold. Medium horizon with sqrt(10)=3.16x enables breakout
continuation to reach 95+ bps expected moves for vol_proxy >= 20 bps.

Also adds medium BreakoutContinuation/MakerFirst to TrendContinuation
and medium PumpFade/MakerFirst to VolatilitySpike for better fee
efficiency (55 bps maker vs 70 bps taker roundtrip).

Made-with: Cursor
  616. a9ff78c
    fix: momentum routes use sqrt-time scaling + reactive vol_proxy
    Mehr im Commit-Body
    Two critical fixes for the edge calculation chain:

1. enrich_with_ignition now uses max(rolling_vol_5m, rolling_vol_30m)
   instead of only 30m — reactive to recent spikes while keeping
   the longer-window floor.

2. Momentum path builders (pullback, breakout, pump_fade, dump_reversal)
   now use sqrt(hold_minutes) as time factor instead of the fixed
   horizon_factor (0.4/1.0/2.2). vol_proxy is a per-minute metric;
   expected cumulative moves scale as sqrt(time) per volatility theory.
   This produces realistic 40-120 bps expected moves for active markets
   instead of the previous 10-15 bps that could never clear fees.

PSC (spread capture) keeps its existing horizon_factor logic unchanged.

Made-with: Cursor
  617. c1a6f3d
    fix: V2 adaptive engine now uses ignition-enriched vol_proxy
    Mehr im Commit-Body
    The V2 engine was using raw microprice_deviation_bps (~2-5 bps) as
vol_proxy instead of rolling_vol_30m_bps (50-500 bps in active markets).
This made expected_move_bps perpetually too low to clear the 55 bps fee
threshold, resulting in tradable=0 even during high-volatility markets.

Now bootstraps ignition metrics and enriches features (vol_proxy,
trend_strength, impulse_magnitude) before regime classification and
expected path building, matching V1 behaviour.

Made-with: Cursor
  618. 96ab18b
    throughput: fix execution reliability + unlock trade frequency
    Mehr im Commit-Body
    - Fix critical bug: Kraken add_order WS method response errors were
  only logged (warn) but never handled — order stayed in PendingSubmit
  for 60s timeout instead of immediately transitioning to Rejected.
  Now: on_reject + tracker update + funnel event + quiet mode + break.

- Widen route map: Quiet state adds PullbackContinuation, Compression
  adds BreakoutContinuation. All existing edge/confidence/economics
  gates still apply — only the candidate pool expands.

- Wire EDGE_ENGINE_V2 config flag into live pipeline. When enabled,
  run_adaptive_route_analysis (V2 admissibility with tail-positive
  and best-scenario gates) replaces static V1 route analysis.

- Allow up to 2 executes per evaluation cycle (was 1). Each candidate
  individually passes symbol lock, capital allocator, exposure gate,
  and choke. No risk gates bypassed.

Made-with: Cursor
  619. 88c3db6
    fix: align observability snapshot contract with L3 availability semantics
    Mehr im Commit-Body
    Add l3_symbol_count alongside total l3_count and propagate it through stats queries, export generation, and the snapshot schema. This makes L3 availability percentage derivation explicit and consistent with the documented contract.

Made-with: Cursor
  620. 14ed8d6
    fix: unblock execution sizing and surface signal blocker reasons
    Mehr im Commit-Body
    Always derive market-order quantity from intended quote notional and upscale to satisfy min notional/cost constraints, reducing submit rejections like FINAL_NOTIONAL_TOO_SMALL and MARKET_ORDER_COST_MIN. Also persist signal-stage reason on discovered outcomes so funnel blocker attribution no longer falls back to unknown.

Made-with: Cursor
  621. daf8ecf
    fix: classify no-outcome blockers and expose signal reasons
    Mehr im Commit-Body
    Classify empty pipeline cycles into explicit funnel blocker reasons (no_tradable_routes, no_feature_complete_symbols, no_pipeline_outcomes) and print signal blocker reason counts in report-trading-throughput. This makes throughput bottlenecks visible before admission/sizing stages.

Made-with: Cursor
  622. f91ac7d
    fix: add run-id fallback for V2 unlock section
    Mehr im Commit-Body
    Use run_symbol_state as fallback when freshest active run_id is unavailable on the decision DB so report-trading-throughput can still compute V2 unlock metrics.

Made-with: Cursor
  623. 12fd7ba
    fix: ensure funnel telemetry flows during no-trade cycles
    Mehr im Commit-Body
    Emit signal/admission funnel events for no-outcome and skip-only evaluation cycles in execution-only mode, so throughput reporting no longer stays empty when no order is submitted. Also extend V2 unlock reporting with regime/route-family edge distribution splits.

Made-with: Cursor
  624. 41d2efa
    feat: add throughput funnel telemetry and report-trading-throughput
    Mehr im Commit-Body
    Build a DB-backed trading funnel telemetry layer across signal, admission,
capital, execution, and fill stages. Add structured events and persistence via
trading_funnel_events, and introduce report-trading-throughput with 2h funnel
metrics, drop-off analysis, regime/route-family breakdowns, and V2 unlock
estimates (extra trades/hour, extra fills/hour, edge distribution).

Also wire route_family through pipeline outcomes and use a combined
priority score (ignition + tail asymmetry + freshness bonus) for V2 ranking.

Made-with: Cursor
  625. acd92f3
    docs: align doctrine docs with live ignition trading
    Mehr im Commit-Body
    - Document event-driven evaluation wake (EVAL_WAKE_IGNITION)
- Document mid-trade exit re-routing via ExitMode switching
- Document capital allocation gate and log evidence

Made-with: Cursor
  626. 27199f5
    feat: doctrine-level trading architecture — 3 critical categories
    Mehr im Commit-Body
    1. Mid-trade re-routing: exit lifecycle is now a state-driven decision
   loop. ExitMode (Trailing, AggressiveTrail, ContinuationHold,
   ExhaustionExit, ImmediateExit) is re-evaluated every 250ms based on
   live ignition state. Mode transitions trigger trail tightening,
   time-stop extension (Continuation +120s), or immediate market exit
   (state regression to Quiet). All mode changes are logged as
   EXIT_MODE_REROUTED events.

2. Event-driven evaluation: IgnitionMetricsStore now fires
   transition_notify when metrics cross ignition thresholds on minute
   boundaries. The evaluation loop uses tokio::select! to wake
   immediately on ignition events instead of waiting for the full
   sleep interval. This captures alpha from state transitions without
   latency loss.

3. Capital allocation doctrine: new CapitalAllocator with per-regime
   slot limits (Ignition:2, Expansion:2, Continuation:2, Other:1),
   regime-bucketed capital budgets (30/25/25/10%), edge-weighted
   sigmoid sizing, liquidity-aware scoring, drawdown throttling, and
   symbol deduplication. Wired into both live and execution-only loops
   with register/release lifecycle.

Made-with: Cursor
  627. 1e7fbc6
    fix: comprehensive trading execution fixes — 8 critical bugs resolved
    Mehr im Commit-Body
    1. Pass live IgnitionMetricsStore to exit context (was empty/new store)
2. Fix market order qty: notional→base conversion via best bid/ask
3. Fix cost_min bypass for market orders (price=None skipped check)
4. Add minimum notional gate ($10) in submit_order pre-submission
5. Make equity configurable via EXECUTION_EQUITY_QUOTE (was hardcoded 1000)
6. Persist IgnitionStateMachine across exit loop iterations (hysteresis)
7. Persist panic exit orders to DB + update SL/TP status on panic
8. Track last_known_price for accurate EXIT_COMPLETED realized PnL

Made-with: Cursor
  628. bedf58c
    doctrine compliance audit: observability, structural fixes, validation report
    Mehr im Commit-Body
    Phase 1 — Observability:
- Add IGNITION_STATE_TRANSITION per-symbol event with metrics (state.rs)
- Add TRADING_ENTRY_DECISION event before order submission (live_runner.rs)
- Replace ORDER_SUBMITTED_TO_EXCHANGE with ORDER_LIVE_SUBMIT including
  all required fields: side, price, qty, strategy_context, ignition_state
- Add EXIT_PLAN_CREATED with exit_mode, sl_price, tp_price, trailing_enabled,
  trail_distance_bps to both ignition_exit and exit_lifecycle
- Add TRAIL_UPDATE event with highest_price, new_tp, amend_success, retry_count
- Add EXIT_COMPLETED to all exit paths (panic_pnl, market_fill_timeout)

Phase 3 — Structural fixes:
- Log exit order insertion failures instead of silent discard (7 sites)
- Conservative fallback on symbol_lock_check failure (block instead of allow)
- Consolidate symbol execution lock: check ALL open orders regardless of side
- Full EXIT_COMPLETED coverage on all termination paths

Phase 4 — Validation CLI:
- New report-trading-doctrine-alignment command with 10 diagnostic sections:
  trades per state/strategy, edge capture, exit reasons, exit order persistence,
  trail efficiency, re-entry violations, position check, safety state, compliance

Made-with: Cursor
  629. 4686ad6
    production safety: implement ignition trading architecture v1
    Mehr im Commit-Body
    14 structural risks identified in audit, all addressed across 5 phases:

Phase 1 - Safety Foundation (R1-R7, R9):
- Persist exit orders (SL/TP/trail/time-stop) to execution_orders with parent_order_id
- Enforce MAX_OPEN_NOTIONAL_PCT_OF_EQUITY (10%) as hard gate before submission
- Enable circuit breakers: drawdown $50 default, 10 orders/min rate limit
- Wire panic PnL exit (-200bps) in ignition trailing loop
- Re-enable cl_ord_id in kraken_adapter for order correlation
- Fix partial fill under-protection: track cum_qty and amend SL qty
- Sync symbol_safety_state hard_block from ingest to decision pool
- Market fill timeout returns Err and triggers protect_exposure

Phase 2 - Exit Robustness (R8, R10):
- amend_order retry (3x, 500ms backoff) with cancel+replace fallback
- WS disconnect during exit marks orders suspect and returns Err

Phase 3 - Latency Reduction (R12):
- Adaptive evaluation interval: 60s when ignition-active, base otherwise
- IGNITION_ADAPTIVE_INTERVAL_ENABLED env var (default true)

Phase 4 - Telemetry (R13, R14):
- Unified LIVE_DATA_MAX_AGE_SECS via env var across all freshness checks
- Structured EXIT_COMPLETED event with hold_secs, pnl_bps, exit_reason

Phase 5 - Edge Optimization:
- Reduce trail check interval from 1000ms to 250ms

Made-with: Cursor
  630. 4f1e3d8
    contract: all CLI reads use ingest pool + freshest_active_run_id
    Mehr im Commit-Body
    Structural audit fix: CLI analysis/report commands now use
pools.ingest() instead of pools.decision() for raw data reads.
All 25 latest_run_id() calls in analysis_commands.rs replaced with
resolve_run_id() which prefers freshest_active_run_id (active ingest
data within 5 min) and falls back to latest_run_id.

Contract: ingest pool for market data, decision pool for execution,
freshest_active_run_id for current run resolution.

Made-with: Cursor
  631. 1a0b244
    fix: propagate correct run_id through entire readiness/pipeline chain
    Mehr im Commit-Body
    run_readiness_analysis now prefers freshest_active_run_id over
latest_run_id. run_strategy_pipeline uses run_readiness_analysis_for_run
with the caller-provided run_id instead of re-querying latest_run_id.
This ensures the entire one-shot chain uses the same fresh run_id
from the active ingest, not the highest-ID execution_live run.

Made-with: Cursor
  632. 49ca7be
    fix: use freshest active run_id for one-shot commands instead of MAX(id)
    Mehr im Commit-Body
    latest_run_id() returns the highest run ID, which may be an
execution_live run with no fresh data. The active ingest runner
writes to an older run_id. New freshest_active_run_id() finds
the run with ticker data within the last 5 minutes. Falls back
to latest_run_id() when no fresh run exists.

Made-with: Cursor
  633. d99bcf9
    fix: use ingest pool for readiness/pipeline in one-shot commands (physical separation fix)
    Mehr im Commit-Body
    run_execution_once and run_proof were passing the decision pool to
run_readiness_analysis and run_strategy_pipeline, which query
ticker_samples/trade_samples/pair_summary_24h — tables that only
exist in the ingest database under physical separation. This caused
data_stale=true and tradable_count=0 for all one-shot CLI commands.

Now: ingest pool for data reading, decision pool for execution writes.
Made-with: Cursor
  634. 0db331d
    docs+scripts: classify SSOT/current/background, update DOC_INDEX, mark legacy scripts
    Mehr im Commit-Body
    Made-with: Cursor
  635. 82f4494
    fix: persist ignition metadata (state, edge_before/after, trail_mode) to execution_orders
    Mehr im Commit-Body
    Added update_ignition_metadata() to stamp ignition columns right after
order creation. The trade flow report now correctly identifies ignition
trades. Extended IgnitionExitContext with edge_before/after_boost fields.

Made-with: Cursor
  636. 980f361
    diag: add ignition state distribution + trading summary logging
    Mehr im Commit-Body
    Logs per-state counts (Quiet/Compression/Ignition/Expansion/etc.) and
a summary of how many symbols were boosted and admitted by ignition
trading logic per evaluation cycle.

Made-with: Cursor
  637. 5c17fbf
    fix: pass ingest pool to ignition bootstrap (physical separation fix)
    Mehr im Commit-Body
    The ignition bootstrap queries trade_samples_p_default which lives in
the ingest database, but the live runner was passing pools.decision().
With physical separation active this yielded 0 trades and no ignition
state classifications. Now passes pools.ingest() via a new
run_v2_route_analysis_with_ingest() function.

Made-with: Cursor
  638. 8b6bad3
    feat: enable ignition trade flow — candidate boost, edge relaxation, trailing exit, telemetry
    Mehr im Commit-Body
    Translate validated Ignition state signals into actual trade flow:
- IGNITION_TRADING_ENABLED flag (default false) controls all new behavior
- Post-evaluation candidate-level expected_move boost (factor 1.35, not feature-level)
- Negative-edge gate relaxed to -5 bps for Ignition/Expansion states only
- Ignition-aware entry prioritization (ignition_admitted candidates ranked higher)
- Event-driven trailing-stop exit (ignition_exit.rs) with state-aware time stops
  (Ignition: 120s, Expansion: 180s, Continuation: 300s)
- Trail activation at +25 bps, tightens at +50 bps, exhaustion detection
- amend_order integration with instrument price normalization
- report-ignition-trade-flow CLI report (trades per state, edge distribution, MFE/MAE, winrate)
- Migration: ignition_state + metadata columns on execution_orders
- All 59 tests pass

Made-with: Cursor
  639. f25ebde
    feat: add report-ignition-followthrough — distribution, MFE/MAE, time-to-move
    Mehr im Commit-Body
    New CLI command shows for symbols in Ignition/Expansion state:
- Follow-through distribution per window (1m/5m/10m/15m) with p50/p75/p90/max
- Directional MFE/MAE (max favorable/adverse excursion) per symbol
- Time-to-move analysis (+25/+50/+100 bps thresholds with hit rates)
- Route relevance hint based on where p90 edge concentrates

Made-with: Cursor
  640. 63dfe4d
    feat: add ignition/state-transition engine with rolling metrics, state machine, and route filtering
    Mehr im Commit-Body
    New module src/ignition/ implements:
- Per-symbol 1m candle ring buffer (IgnitionMetricsStore) with on_trade delta-update
- Rolling metrics: vol acceleration, range expansion, signed persistence, density shift
- Explicit state machine (Quiet/Compression/Ignition/Expansion/Continuation/Exhaustion)
  with hysteresis (min 2m state duration, 1m cooldown, confidence floor 0.6)
- State → route family mapping (e.g. Ignition → breakout+fade, Quiet → passive only)
- Feature repair: when IGNITION_ENABLED, vol_proxy and trend_strength are replaced by
  rolling realized values from trade-derived candles
- Diagnostic CLI: report-ignition-state with state distribution, top movers, route
  activation, active vs quiet metric comparison, avg move after ignition trigger

All behind IGNITION_ENABLED feature flag (default off = zero behaviour change).
8 unit tests covering metrics computation, state classification, and hysteresis.

Made-with: Cursor
  641. 278a40e
    fix: use Krakenbot's own trade_samples for realized vol, not external candles
    Mehr im Commit-Body
    The public.candles table was populated by the old KapitaalBot Python
service which is no longer running (73h stale). Switch to synthesizing
1-minute close prices from krakenbot.trade_samples_p_default which has
live data (637 symbols, sub-second freshness).

Made-with: Cursor
  642. 8c9a3c0
    fix: anchor candle window on latest available data, not now()
    Mehr im Commit-Body
    Candle data may be hours old; using now() as anchor yields empty
results. Use max(timestamp_ms) from candles table instead.

Made-with: Cursor
  643. a2ebd96
    fix: route realized-vol-diagnostic to ingest pool (candles in public schema)
    Mehr im Commit-Body
    The candles table lives on the ingest DB, not the decision DB.
Route the report-realized-vol-diagnostic command through pools.ingest()
so the public.candles query resolves correctly.

Made-with: Cursor
  644. 948aa84
    feat: add realized-vol diagnostic CLI (Phase 1 what-if analysis)
    Mehr im Commit-Body
    New command `report-realized-vol-diagnostic [run_id]` computes realized
volatility (median c2c 1m returns) and trend strength from candle data,
substitutes into MarketFeatures in-memory, re-runs V1 route analysis,
and reports the tradable frontier delta with full risk checks (R1-R4).

No production code modified — diagnostic only.

Made-with: Cursor
  645. e144335
    feat(diagnostics): enhance report-adaptive-edge with full decision output
    Mehr im Commit-Body
    - Make evaluate_pair_adaptive/AdaptivePairResult public for diagnostics
- Add optional run_id CLI argument (report-adaptive-edge [run_id])
- Report sections: regime distribution, candidate stats with admission
  reason breakdown, profitability map, top-20 admitted candidates table
- Auto-conclusion logic based on frontier quality

Made-with: Cursor
  646. 5046f2e
    feat(edge_engine): adaptive edge extraction architecture (EDGE_ENGINE_V2)
    Mehr im Commit-Body
    Implement regime-based adaptive trade engine that classifies market
state per symbol and conditionally selects routes, fee models, exit
paths, and admissibility logic — all feature-flagged behind
EDGE_ENGINE_V2 (default false, zero behaviour change when off).

Modules:
- market_regime: 4-regime classifier (SpreadFarming/VolatilitySpike/
  TrendContinuation/MeanReversion) from MarketFeatures
- route_selector_v2: regime-filtered candidate matrix + orchestration
- move_distribution: probabilistic edge (p50/p75/p90/tail) +
  AdaptiveEdgeTrace explainability per candidate
- fee_realism: maker fill probability blended fees + inventory unwind
- exit_path: component exit drag (latency/adverse/sweep/timeout) +
  trailing stop path simulator with ATR bands
- admissibility: tail-aware gate allowing median-negative but
  tail-positive trades in asymmetric regimes
- diagnostics: report-adaptive-edge CLI command
- shadow_compare: V1 vs V2 side-by-side comparison CLI

Integration: minimal hooks in 4 existing files (main.rs mod decl,
config bool, cli string match, analysis_commands handler).
No edits to route_engine, analysis, execution, or edge modules.
17 unit tests, all passing.

Made-with: Cursor
  647. 13c1427
    fix(script): remove set -e so background job and kill do not abort script
    Mehr im Commit-Body
    Made-with: Cursor
  648. 769b2ac
    revert: remove stdin redirect and debug; use plain background run
    Mehr im Commit-Body
    Made-with: Cursor
  649. 35da3e2
    debug: log REPORT_PID to .debug file
    Mehr im Commit-Body
    Made-with: Cursor
  650. ec416ca
    fix(script): rm stale no_progress at start; start report with stdin from /dev/null
    Mehr im Commit-Body
    Made-with: Cursor
  651. 114ac64
    fix(build): add stats_queries::realized_exit_durations_for_run, RouteCandidate.trace, exit_feasibility/route_selector for guarded reports
    Mehr im Commit-Body
    Made-with: Cursor
  652. a443da0
    feat(cli): guarded report runner — file-based, fail-fast 2min, heartbeat, PHASE_* markers, diagnostic+strace
    Mehr im Commit-Body
    Made-with: Cursor
  653. 83bc640
    feat(observability): systemd timer for snapshot export for website
    Mehr im Commit-Body
    - krakenbot-observability-export.service: oneshot export to OBSERVABILITY_EXPORT_DIR
- krakenbot-observability-export.timer: every 2 min
- OBSERVABILITY_EXPORT_SETUP.md: install and deploy instructions

Made-with: Cursor
  654. ab2bb52
    feat(cli): report-edge-chain — edge decomposition, stage comparison, lane classification, decision stage-fix vs lane-split
    Mehr im Commit-Body
    Made-with: Cursor
  655. 4b88b0e
    feat(cli): report-edge-forensic for selected symbols — market context, candidate trace, kill-point, verdict
    Mehr im Commit-Body
    Made-with: Cursor
  656. 45086a6
    feat(route): net_edge_before_l3_penalty + report-edge-autopsy sample trace (gross_move, fee, exit_drag, wait_risk, capture, net_raw, net_final, zero_reason, invalid_shortcut)
    Mehr im Commit-Body
    Made-with: Cursor
  657. 32d965c
    fix(cli): economics reports use live fee provider; log maker_bps/taker_bps/source; warn on bootstrap
    Mehr im Commit-Body
    Made-with: Cursor
  658. 2e724a0
    feat(cli): report-edge-autopsy — funnel, component-kill, distribution, exact-zero, top 20 near-tradable
    Mehr im Commit-Body
    Made-with: Cursor
  659. b080c7a
    feat(cli): report-confidence-threshold-sensitivity — edge>0 only, MIN_CONFIDENCE, tradable at current/-10%/-20%/-30%, per route_type/horizon
    Mehr im Commit-Body
    Made-with: Cursor
  660. 1c214e8
    feat(cli): report-edge-reject-split — edge≥0 reject split by reason, route_type, horizon, top 10
    Mehr im Commit-Body
    Made-with: Cursor
  661. f727f04
    feat(cli): report-feature-incompleteness + economics-run (universe, near-miss, hard conclusion)
    Mehr im Commit-Body
    - report-feature-incompleteness [run_id]: cause split (no_l2, spread_null, micro_null, insufficient_snapshots, pipeline_state), top 50 incomplete, oorzaakverdeling
- report-route-economics: Universe section, Near-miss frontier (edge bands), Harde conclusie
- CHANGELOG: Model input kwaliteit + economics-run section

Made-with: Cursor
  662. 7d6cb5d
    fix(exec): add STATE_SYNC_OK/REQUIRED gate in execution-only loop for formal log proof
    Mehr im Commit-Body
    Made-with: Cursor
  663. f7ac5cc
    feat(route): bind execution universe to feature-complete symbols
    Mehr im Commit-Body
    - CurrentRunMarketRow: l2_count, is_feature_complete (spread+micro NOT NULL, l2_count>=50)
- Route analysis: filter to feature-complete only; FEATURE_FILTER_APPLIED, FEATURE_INCOMPLETE_SYMBOLS
- CLI report-feature-completeness [run_id]; docs/FEATURE_COMPLETENESS_CONTRACT.md
- CHANGELOG + CHANGELOG_ENGINE updated

Made-with: Cursor
  664. a6b18aa
    feat(exec): STATE_SYNC_REQUIRED/STATE_SYNC_OK gate + check-decision-state CLI + STATE_SYNC_CONTRACT.md
    Mehr im Commit-Body
    Made-with: Cursor
  665. 14a0f38
    fix(observability): always log FEATURE_COVERAGE_L2 for proof (including status=no_state)
    Mehr im Commit-Body
    Made-with: Cursor
  666. 6ee5dbc
    fix(dual-DB): schema sync, spread_std_bps sanitization, sync proof, gen_mismatch in logs
    Mehr im Commit-Body
    - run_symbol_state: explicit column list (19 cols), SELECT numerics as ::text, parse_decimal_for_sync (NaN/Inf→NULL), post-sync rowcount ingest vs decision
- full/incremental refresh: spread_std_bps CASE to NULL when NaN/Inf/non-finite
- migration 20260314100000: ADD COLUMN IF NOT EXISTS for generation_id, l3_n_* on run_symbol_state (run on both DBs)
- live_runner: INGEST_DECISION_SYNC_VISIBLE logs visible_generation_id and gen_mismatch=0|1

Made-with: Cursor
  667. 584b256
    feat(observability): add FEATURE_READY_SIGNAL and FEATURE_COVERAGE_L2 to execution-only evaluation loop
    Mehr im Commit-Body
    - execution-only path had no feature readiness gate
- added l2_raw_feature_ready check before refresh
- log FEATURE_READY_SIGNAL ready=true/false
- after sync log FEATURE_COVERAGE_L2
- skip evaluation cycle if L2 coverage < threshold
- aligns execution-only behaviour with combined runtime path

Made-with: Cursor
  668. 2229057
    fix(universe): only status online/limit_only in pool; no status = exclude
    Mehr im Commit-Body
    Made-with: Cursor
  669. dbd2b01
    feat(pipeline): Model Input Pipeline Hardening + L2 feature lineage CLI
    Mehr im Commit-Body
    - DEEL 1: FEATURE_COVERAGE_L2 log + ROUTE_ENGINE_SKIP if coverage_pct_spread < 60%
- DEEL 2: FEATURE_READY_SIGNAL + refresh gate (l2_raw_feature_ready) before refresh
- DEEL 3: MarketFeatures l2_spread_missing/l2_micro_missing; path fallback confidence*0.6, move*0.5; ROUTE_FEATURE_FALLBACK_USED
- DEEL 4: Direction fallback (density-based confidence 0.05..0.45) when micro missing; DIRECTION_FALLBACK_USED
- DEEL 5: Telemetry FEATURE_COVERAGE_L2, FEATURE_READY_SIGNAL, ROUTE_FEATURE_FALLBACK_USED, DIRECTION_FALLBACK_USED, MISSING_FEATURE_SYMBOL_COUNT
- DEEL 6: report-route-economics / report-direction-signal exit(2) when coverage < 60% (ECONOMICS INVALID)
- CLI: report-l2-feature-lineage for raw L2 vs run_symbol_state diff
- Docs: MODEL_INPUT_PIPELINE_HARDENING.md, L2_FEATURE_LINEAGE_DEBUGGING.md
- CHANGELOG.md + docs/CHANGELOG_ENGINE.md updated

Made-with: Cursor
  670. 2298649
    fix: add l2_raw_feature_ready and l2_feature_coverage_from_state to stats_queries (required by live_runner)
    Mehr im Commit-Body
    Made-with: Cursor
  671. 88b7cf4
    feat(universe): override-only caps, unbounded default, FX excluded, explicit logging
    Mehr im Commit-Body
    - Config: *_OVERRIDE env only; Option<usize> limits; no default 200/50
- UniverseManagerConfig + select_layer: cap only when Some(n)
- universe_source: exclude FX pairs (EUR/USD, GBP/USD, etc.); USD crypto only
- Observe: select_l2/l3_subset take Option<usize>; None = all
- Startup logs: UNIVERSE_SCOPE usd_only fx_pairs_excluded; UNIVERSE_LIMIT_OVERRIDE_ACTIVE/INACTIVE
- docs/UNIVERSE_CAPS_AND_CONFIG.md, LOGGING.md updated

Made-with: Cursor
  672. e826ebe
    fix(dual-DB): read run_symbol_state from ingest after refresh when physical separation; log sync result
    Mehr im Commit-Body
    - After refresh, universe state (per_symbol_counts, l2/l3_stats, raw_counts) now read from ingest pool when pools.is_physical_separation(), so symbol_count is correct regardless of sync.
- Sync result logged: RUN_SYMBOL_STATE_SYNC ingest→decision (synced_rows) or RUN_SYMBOL_STATE_SYNC failed.
- Applied in: initial warmup, periodic universe refresh, L3 resync block, pinned/exit-only L3 checks.
- Fixes symbol_count=0 in UNIVERSE_REFRESH_STATE_TIMING when using separated ingest/decision DBs.

Made-with: Cursor
  673. 34936e4
    cli: report-path-source-inspect for expected_move_bps/confidence source inspection
    Mehr im Commit-Body
    - Add report-path-source-inspect CLI: upstream counts (micro/spread) and per-candidate path inputs -> output sample.
- Doc: RAPPORT_EXPECTED_MOVE_BPS_SOURCE_INSPECTION.md with trace per route and fix direction.

Made-with: Cursor
  674. 1ca5b9d
    chore: CHANGELOG + CHANGELOG_ENGINE for LIVE_USE_OWN_RUN_ONLY warmup poll (capacity-test)
    Mehr im Commit-Body
    Made-with: Cursor
  675. c460ac7
    cli: add report-direction-signal (continuation/reversal/confidence, expected_move_bps, by route_type and horizon)
    Mehr im Commit-Body
    Made-with: Cursor
  676. 8c862fe
    db: run_symbol_state VerifyMode, detailed_differences, debug_refresh_diff, run_replay_compare for CLI verify/debug/replay
    Mehr im Commit-Body
    Made-with: Cursor
  677. e69d0c0
    cli: add report-route-economics for V2 candidate frontier and economics tuning
    Mehr im Commit-Body
    Made-with: Cursor
  678. a9778a1
    live_runner: LIVE_USE_OWN_RUN_ONLY poll raw tables after flush (max 90s) for sufficient warmup data
    Mehr im Commit-Body
    Made-with: Cursor
  679. 6c72ab5
    live_runner: flush writer before warmup check when LIVE_USE_OWN_RUN_ONLY (ensure symbol_count > 0)
    Mehr im Commit-Body
    Made-with: Cursor
  680. 7cc7201
    docs: risk 3 dicht — verify-refresh-equivalence 114 WithinTolerance; controleplan + correctness-proof updated
    Mehr im Commit-Body
    Made-with: Cursor
  681. 4f10b00
    verify: allow WithinTolerance with up to 30 symbol differences when max diffs within relative tolerance (e.g. ingest growth between full and inc)
    Mehr im Commit-Body
    Made-with: Cursor
  682. a777f9d
    verify: use watermarks -1 so id > -1 includes all rows (incl. id=0 if any)
    Mehr im Commit-Body
    Made-with: Cursor
  683. 0f27b96
    LIVE_USE_OWN_RUN_ONLY: integrated run for clean 400-symbol capacity test
    Mehr im Commit-Body
    - Config LIVE_USE_OWN_RUN_ONLY: warmup uses data_run_id=run_id, 60s warmup; epoch binding only to own run.
- epoch_queries: select_valid_epoch_for_run, current_epoch_for_exit_only_for_run; EpochBindingReason::OwnRunOnly.
- run_l3_capacity_test.sh: EXECUTION_UNIVERSE_LIMIT, LIVE_USE_OWN_RUN_ONLY; doc integrated run usage.

Made-with: Cursor
  684. ceba7a4
    verify: relative tolerance (10%) for large numerics; NULL vs value no longer as 0 vs value for diff
    Mehr im Commit-Body
    Made-with: Cursor
  685. e5c878d
    fix: incremental refresh match full — STDDEV sample (n-1), L3 per-metric counts for AVG
    Mehr im Commit-Body
    - STDDEV: use sample variance (n-1) and NULL when n<=1 to match PostgreSQL STDDEV()
- L3 averages: add l3_n_efit, l3_n_refill, l3_n_cancel, l3_n_qt so merge uses COUNT(column)
  and matches AVG() (which ignores NULLs); migration + full/incremental/sync updated

Made-with: Cursor
  686. f520537
    fix: verify-refresh-equivalence snapshot via float8 to avoid Decimal decode errors
    Mehr im Commit-Body
    Made-with: Cursor
  687. 81fa498
    EXECUTION_UNIVERSE_LIMIT, evaluation scaling metrics, pair_summary_24h FK fix
    Mehr im Commit-Body
    - Config: EXECUTION_UNIVERSE_LIMIT (env, default 200); use for pool/fetch in live + ingest. Test 200/300/400 without rebuild.
- Live runner: EVALUATION_SCALING log (evaluation_symbol_count, evaluation_duration_ms, route_build_duration_ms, pipeline_duration_ms); route vs pipeline timing split.
- pair_summary_24h FK: ensure_observation_run_on_pool(ingest, run_id) before persist when run created on decision DB.
- LOGGING.md: EVALUATION_SCALING, EXECUTION_UNIVERSE_LIMIT.

Made-with: Cursor
  688. 58c9692
    scripts: L3 capacity test usage 5/50/400, target scale 400
    Mehr im Commit-Body
    Made-with: Cursor
  689. c13576a
    chore: CHANGELOG + CHANGELOG_ENGINE for incremental refresh (9863d64)
    Mehr im Commit-Body
    Made-with: Cursor
  690. 9863d64
    feat(refresh): incremental/watermark refresh for run_symbol_state (risk 3 closure)
    Mehr im Commit-Body
    - Add refresh_watermarks table (run_id, table_name, last_id); migration 20260313160000.
- First refresh per run_id = full scan; subsequent = only id > watermark per raw table.
- Merge deltas (counts + running avg/var for L2/L3) in SQL; set generation_id on all rows.
- Log REFRESH_INCREMENTAL with delta_ticker_rows, delta_trade_rows, delta_l2_rows, delta_l3_rows.
- Doc: REFRESH_INCREMENTAL_DESIGN (design + proof); CONTROLEPLAN risk 3 dicht on incremental.

Made-with: Cursor
  691. 927b1de
    fix: add BufRead import for resource_telemetry (Linux reader.lines())
    Mehr im Commit-Body
    Made-with: Cursor
  692. 9b3de1a
    Docs: refresh bounded-proof, writer metrics, telemetry, L3 scale and multi-WS design
    Mehr im Commit-Body
    - REFRESH_COMPLEXITY, L3_SCHAALBEPERKINGEN: cap required, REFRESH_MAX_DURATION_SECS
- REFRESH_INCREMENTAL_DESIGN.md: incremental refresh options (watermark/delta)
- WRITER_PARALLEL_DESIGN.md: optional dedicated L3 / sharded writer
- L3_MULTI_WS_INGEST_DESIGN.md: multi-WS ingest when Kraken symbol limit applies
- LOGGING: WRITER_METRICS, resource telemetry and event-loop proxy

Made-with: Cursor
  693. 1f8c671
    Bottleneck work: refresh cap+timeout, writer metrics+L3 batch, telemetry, l3-subscribe-test
    Mehr im Commit-Body
    - Refresh: REQUIRE_INGEST_MAX_RUN_DURATION, REFRESH_MAX_DURATION_SECS (60s), ingest_runner exit when required and cap missing
- Writer: WriterSender with pending count, WRITER_METRICS every 10s, L3 batching (flush at 50 or interval)
- Telemetry: RESOURCE_TELEMETRY_INTERVAL_SECS, observability/resource_telemetry (RSS on Linux), spawn in ingest + live_runner
- L3: l3-subscribe-test CLI (L3_SUBSCRIBE_TEST_SYMBOLS, L3_SUBSCRIBE_TEST_DURATION_SECS)

Made-with: Cursor
  694. e2288b3
    controleplan: fix-or-prove-close uitkomst na 15-min run (server 2d1cd83)
    Mehr im Commit-Body
    Beslistabel ingevuld: 1 dicht, 3 blocker (cap niet gezet), 4 dicht, 5 dicht, 11 dicht.
Conclusie: Blocker(s) eerst — INGEST_MAX_RUN_DURATION_HOURS op server zetten.

Made-with: Cursor
  695. 2d1cd83
    fix-or-prove-close: env logging, ingest cap warn, evaluation/sync timing, controleplan
    Mehr im Commit-Body
    - main: log DECISION_DATABASE_URL and INGEST_MAX_RUN_DURATION_HOURS at startup (no silent default)
- ingest_runner: warn when INGEST_MAX_RUN_DURATION_HOURS not set
- REFRESH_COMPLEXITY: recommend cap 6/24h for production
- live_runner: EVALUATION_CYCLE_DURATION_MS and SYNC_LAG_MS for contention/sync-lag measurement
- CONTROLEPLAN_SYSTEEMRISICOS: add Fix-or-prove-close uitkomst (drempels, beslistabel, conclusie)
- scripts/check_stale_decision_logs.sh: check gen_mismatch and ROUTE_FRESHNESS in logs (risico 1)

Made-with: Cursor
  696. 8e48016
    Docs: dual-DB epoch dual-write fix + 15min validation passed (section E)
    Mehr im Commit-Body
    Made-with: Cursor
  697. 70f4c25
    Dual-DB gate: use synced cycle for gate (avoid ingest overwrite race); log visible=cycle for validation
    Mehr im Commit-Body
    Made-with: Cursor
  698. 7f31d23
    Generation gate: use visible_gen from right after sync (avoid ingest overwrite race)
    Mehr im Commit-Body
    Made-with: Cursor
  699. a75c126
    Fix dual-write epoch/snapshot: ensure observation_run on decision DB (FK); log dual-write errors
    Mehr im Commit-Body
    Made-with: Cursor
  700. b3b1a4e
    Rapport: dual-DB uitvoering — tweede instance gebouwd, 15min validatie, resultaat
    Mehr im Commit-Body
    Made-with: Cursor
  701. e380072
    Script: set decision instance password from DATABASE_URL (server-side)
    Mehr im Commit-Body
    Made-with: Cursor
  702. 857f458
    Dual-DB: plan tweede instance, doc-definitie, validatiescript sync/generation checks
    Mehr im Commit-Body
    Made-with: Cursor
  703. 4b23919
    Docs: validatierapport single/dual-DB; DOC_INDEX, CHANGELOG, README bijgewerkt
    Mehr im Commit-Body
    Made-with: Cursor
  704. a653d6f
    Validatie: deprecated-check alleen bij groei tussentijds; rapport B/C ingevuld; scriptfix
    Mehr im Commit-Body
    Made-with: Cursor
  705. edb24d7
    Refresh-schaalbaarheid: run-duur cap (INGEST_MAX_RUN_DURATION_HOURS) + 15min validatiescript + db_full_reset_ingest
    Mehr im Commit-Body
    Made-with: Cursor
  706. 1a845a0
    Docs: flow schema's tonen dubbele DB (DB Ingest vs DB Decision) expliciet
    Mehr im Commit-Body
    Made-with: Cursor
  707. b3dfee8
    Docs SSOT: state-first, partition, generation in ENGINE_SSOT, DOC_INDEX, ARCHITECTURE, CHANGELOG_ENGINE, LIVE_RUNBOOK, LOGGING, README
    Mehr im Commit-Body
    Made-with: Cursor
  708. 5cc8322
    DB architecture: partition cutover, generation contract, sync gate, refresh O(rows) doc
    Mehr im Commit-Body
    - Raw ingest: L3 + ticker/trade/l2 cutover to partitioned tables (migrations 20260313120000–40000)
- run_symbol_state: generation_id + sequence; RefreshOutcome; state_generation_id; sync copies gen
- live_runner: cycle_generation_id, INGEST_DECISION_SYNC_VISIBLE log, EXECUTION_BLOCKED_GENERATION_MISMATCH gate
- docs: REFRESH_COMPLEXITY_AND_GENERATION (O(rows) proof), EXECUTION_REPORT/DB_ARCHITECTURE updated
- CHANGELOG: 2025-03-13 partition cutover, generation contract, sync gate

Made-with: Cursor
  709. a240cc0
    docs: add PG DBA autovacuum proposal (table settings, l3 policy, refactor block)
    Mehr im Commit-Body
    Made-with: Cursor
  710. 813ad46
    refactor(db): state-first query boundary + SQL type safety in live paths
    Mehr im Commit-Body
    - Explicit SQL casts: ::bigint for COUNT/MAX(epoch_id); ::text for aggregates
  mapped to Decimal (ingest_epoch, proof_runner, exposure_reconcile,
  deterministic_proof, stats_queries).
- Remove direct NUMERIC→Decimal in critical/live paths: use ::text + parse
  in exposure_reconcile, fills_ledger, positions, stats_queries.realized_pnl,
  proof_runner MAX(expected_edge_bps).
- Add STATE_FIRST_AND_SQL_TYPE_SAFETY_DELIVERABLE.md (live paths, casts,
  Decimal fixes, error-family confirmation).

Made-with: Cursor
  711. 94397fa
    fix(db): run_symbol_state NUMERIC decode — read as text, parse to Decimal (avoid NaN/overflow)
    Mehr im Commit-Body
    Made-with: Cursor
  712. 38e263f
    chore(dba): add PostgreSQL DBA health scan script and report template
    Mehr im Commit-Body
    Made-with: Cursor
  713. 7b7b36e
    fix(db): cast SUM() to bigint in run_raw_counts_from_state (Option<i64> vs NUMERIC)
    Mehr im Commit-Body
    Made-with: Cursor
  714. bef764e
    feat(execution): L3 soft at system level — l3_integrity out of system_live_ready AND
    Mehr im Commit-Body
    Deel 2: L3 no longer systemically blocks execution; symbol-level safety unchanged.

- data_integrity: system_live_ready() no longer ANDs l3_integrity
- l3_integrity still computed and logged in DATA_INTEGRITY_MATRIX
- hard_blocked symbols still filtered from exec_allowed (symbol-level)
- Verified: no second systemic L3 choke in codebase

See docs/ROUTE_HOT_PATH_STATE_PROOF.md (Deel 2 section).

Made-with: Cursor
  715. 1675ff9
    feat(route): hot path state-only — analyze_run_from_state, no raw/legacy readers
    Mehr im Commit-Body
    Deel 1: Route hot path depends only on run_symbol_state + run_by_id.

- stats_queries: RunSymbolStateRow + run_symbol_state_rows_for_run (single SELECT)
- current_run_analysis: analyze_run_from_state (state rows + run_by_id only; same formulas as provisional)
- route_selector: run_v2_route_analysis uses analyze_run_from_state (no fallback to analyze_run)

Readers no longer in route hot path:
  pair_summaries_for_run, l2_symbol_stats_for_run, l3_symbol_stats_for_run,
  symbol_trade_counts, symbol_avg_spread_l2

See docs/ROUTE_HOT_PATH_STATE_PROOF.md.

Made-with: Cursor
  716. 0679f49
    feat(route_engine): exit regime architecture — kapitaalbescherming primair
    Mehr im Commit-Body
    - ExitRegime enum + exit_mode_to_regime; select_allowed_exit_regimes(route,horizon,features,path)
- RouteCandidate: exit_regime, capture_factor; filter matrix on allowed regimes
- EXIT_REGIME_ALLOWED/REJECTED/CHOSEN/EXPECTANCY_APPLIED logging
- Pipeline: v2_exit_strategy_from_route(..., exit_regime); no legacy fallback
- docs/EXIT_REGIME_ARCHITECTURE.md + CHANGELOG

Made-with: Cursor
  717. 28fc6e7
    docs: CHANGELOG 2025-03-13 Route Engine Evolution (Live Edge Machine)
    Mehr im Commit-Body
    - Added/Changed/Internal per module (l3_quality, run_metrics, fill_probability,
  route_expectancy, expected_path, route_selector, sizing, strategy_pipeline,
  universe, ingest_runner, live_runner, readiness_gate, run_symbol_state, data_integrity)
- Validatie: cargo check + cargo test (29 passed)

Made-with: Cursor
  718. 6b47325
    feat(route): Fase 5 run metrics, ROUTE_RUN_METRICS log, cost/ROI stubs, run_symbol_state refresh log
    Mehr im Commit-Body
    - run_metrics: RouteRunMetrics, market_cost_from_counts/edge_roi stubs
- route_selector: aggregate and log ROUTE_RUN_METRICS (valid_route_count, avg_edge_velocity, neutral_path_ratio, l3_quality_avg)
- run_symbol_state: RUN_SYMBOL_STATE_REFRESH duration log; l2 CTE filter spread_bps IS NOT NULL

Made-with: Cursor
  719. 5a66d1e
    feat(route): Fase 4 opportunity_score in universe, refresh timing logs
    Mehr im Commit-Body
    - SymbolQualityInputs.opportunity_score; L3Ingest/Execution layer boost
- ingest_runner/live_runner: opportunity_score: None in quality map
- UNIVERSE_REFRESH_STATE_TIMING logs (refresh_ms, state_reads_ms, total_ms, symbol_count)

Made-with: Cursor
  720. 5a3c006
    feat(route): Fase 3 dynamic sizing (size_quote_v2), edge velocity in pipeline
    Mehr im Commit-Body
    - sizing: size_quote_v2 with sigmoid(edge) * confidence * liquidity_score * capital_availability
- strategy_pipeline v2: use size_quote_v2 for route sizing (expected_net_edge_bps, confidence, spread_bps)

Made-with: Cursor
  721. 0fb9229
    feat(route): Fase 1 L3 soft + Fase 2 path model
    Mehr im Commit-Body
    Fase 1 — L3 economisch veilig:
- l3_quality module: compute_l3_quality_score (floor when no L3)
- MarketFeatures.l3_quality_score, fill_prob Hybrid/Fallback, floor 0.05
- route_expectancy: confidence *= l3_quality_score, edge lerp penalty, no L3 hard block
- validate_candidate: confidence/fill_prob soft gate (no reject)
- data_integrity doc: L3 does not invalidate routes

Fase 2 — Direction & path:
- DirectionalBias enum, ExpectedPath base_move/upside_tail/downside_tail/move_confidence
- expected_path: directional_bias_from_features, horizon elasticity (no PathNotHorizonConsistent reject)
- route_expectancy: time_efficiency = move/sqrt(duration), edge_velocity_bps_per_sec

Made-with: Cursor
  722. 4dd0228
    fix: L2 count in run_symbol_state includes all rows (remove spread_bps IS NOT NULL filter)
    Mehr im Commit-Body
    Made-with: Cursor
  723. e2be75d
    fix: refresh run_symbol_state before L3 safety checks (resync, hard-block, ExitOnly)
    Mehr im Commit-Body
    Made-with: Cursor
  724. 873f915
    db: add run_symbol_state to retention cleanup and CLI output
    Mehr im Commit-Body
    Made-with: Cursor
  725. 334f9fb
    execution: wire run_symbol_state refresh and state reads in live and ingest runners
    Mehr im Commit-Body
    Made-with: Cursor
  726. 608d3bc
    db: add refresh_run_symbol_state and from_state read functions
    Mehr im Commit-Body
    Made-with: Cursor
  727. 6082039
    db: add run_symbol_state table and index (hot-path state)
    Mehr im Commit-Body
    Made-with: Cursor
  728. af6ec1f
    DB optimization: raw table indexes, retention cleanup, drop execution_event_buffer, truncate script
    Mehr im Commit-Body
    Made-with: Cursor
  729. 11e40f8
    Add L3 netto edge report: SQL queries, shell script, rapport template
    Mehr im Commit-Body
    Made-with: Cursor
  730. 0e4cb70
    route-engine: economic calibration — move distribution, relative move, vol-scale, momentum, capital velocity
    Mehr im Commit-Body
    - ROUTE_MOVE_DISTRIBUTION: per (route_type, horizon) p50/p75/p90/p95/p99/avg (confidence>0.10)
- Relative move: move_valid = expected_move_bps/fee_bps > 0.85; path MIN_MOVE_BPS check removed
- Vol-scaled move: vol_reference = run p75 vol_proxy; vol_scale clamp(0.7,2.5); all builders
- Momentum boost 1.15–1.35 for Breakout/Pullback when trend_strength/vol_expansion/trade_density above thresholds
- time_adjusted_score *= sqrt(capital_velocity_norm); capital_velocity = move_bps/hold_secs
- ROUTE_ECONOMIC_PRESSURE_STATS: valid_move_ratio, avg_relative_move_score, top_relative_move_symbol

Made-with: Cursor
  731. 900cdb2
    route-engine: Breakout fallback-band confidence uplift
    Mehr im Commit-Body
    - When 0.20 < vol_expansion <= 0.35, trend_strength > 0.20 and direction set:
  add BREAKOUT_FALLBACK_CONFIDENCE_UPLIFT (0.10) so confidence reaches
  MIN_CONFIDENCE and paths pass path_confidence_too_low -> move_below_fees or valid
- No move/other routes/MIN_MOVE_BPS/safety changes

Made-with: Cursor
  732. 483786a
    route-engine: BREAKOUT direction trace (guarded) + direction fallback
    Mehr im Commit-Body
    - BREAKOUT_DIRECTION_TRACE: log symbol, micro_bps, trend_strength, vol_expansion,
  builder/validated direction, rejection (guarded by ROUTE_V2_PATH_DIAG, max 8 per run)
- reset_breakout_trace_count() at start of run_v2_route_analysis when diag on
- Breakout direction fallback: vol_expansion in (0.20, 0.35] and trend_strength > 0.20
  -> set direction from micro_direction/micro_bps (breakout_direction_from_features)
- No move/confidence/safety changes; only Breakout direction

Made-with: Cursor
  733. 0dcdb8d
    tune(route_engine): Breakout mid-band (0.35–0.5) base_move +20% (0.9 -> 1.08)
    Mehr im Commit-Body
    Single small step: more paths clear move_below_fees. Diag stays on for calibration.

Made-with: Cursor
  734. 41e837f
    fix(route_engine): Breakout vol_expansion threshold 0.5 -> 0.35 for direction/move/confidence
    Mehr im Commit-Body
    So more pairs get Up/Down instead of Neutral; diag showed 100% Neutral for breakout.

Made-with: Cursor
  735. 8765fbd
    feat(route_engine): v2 path diag guard + direction stats + almost-tradable ranking + route_family impact
    Mehr im Commit-Body
    - ROUTE_V2_PATH_DIAG env guard: ROUTE_PATH_DIRECTION_STATS and
  ROUTE_ALMOST_TRADABLE_RANKING (top 20) only when guard set
- V2_ROUTE_ANALYSIS_COMPLETE extended with route_family counts
  (pullback, breakout, pump_fade, passive) for impact reporting
- Path heuristic: micro_direction band 0.5 -> 0.25 bps so more
  paths get Up/Down, fewer path_not_directional

Made-with: Cursor
  736. ea159d1
    feat(route_engine): Route Decision Engine v2 — market-first, path-first
    Mehr im Commit-Body
    Replace strategy-first economic decisioning with market-first route
engine. Per pair: market features → expected path per horizon → route
candidates (route × horizon × entry × exit) → expectancy → winner or
explicit NoTrade.

New modules (src/route_engine/, 7 files, 1282 LOC total):
- types.rs: RouteType, EntryMode, ExitMode, RouteHorizon, ExpectedPath,
  RouteCandidate, RouteSelection, V2RouteReport
- market_features.rs: MarketFeatures from CurrentRunMarketRow
- expected_path.rs: first-class ExpectedPath with path_source,
  heuristic builders per (route_type, horizon), validation
- route_expectancy.rs: expected_net_edge_bps, time_adjusted_score,
  full cost decomposition, max_hold_secs invariant
- route_selector.rs: candidate matrix, winner selection, orchestration
- shadow.rs: mandatory counterfactual logging with numeric why_lost
  deltas (alt vs winner edge/confidence/score)
- mod.rs: module wiring

Integration:
- live_runner.rs: v2 route analysis replaces readiness+v1 pipeline
- strategy_pipeline.rs: run_strategy_pipeline_v2 bridges v2 routes
  to existing execution layer via legacy strategy mapping

Shadow output shows winner + all alternatives with concrete numeric
differences explaining why each alternative lost.

Docs: design document + 12 investigation reports + changelog updates.
Made-with: Cursor
  737. 650a909
    fix(readiness): Volume strategy EdgeNegative bypass + check_entry_readiness lookup
    Mehr im Commit-Body
    - readiness_gate: Volume strategy was blocked by general EdgeNegative
  check before its own -5 bps floor could apply. Now excluded from
  general EdgeNegative (mirrors existing SurplusBelowFloor exemption).
- check_entry_readiness: lookup found first PairReadinessRow for symbol
  regardless of strategy, causing StrategyMismatch. Now matches both
  symbol AND selected_strategy.

Made-with: Cursor
  738. 939d1fd
    fix(execution): max_epoch_age_secs race with evaluation_interval_secs
    Mehr im Commit-Body
    max_epoch_age_secs was (freshness*2).max(300) which equals the 300s evaluation
interval — leaving zero margin for processing jitter. Epochs produced every 300s
are 300-310s old at evaluation time, causing global_liveness=false permanently.

Changed to (freshness*2).max(evaluation_interval + 120), giving 420s with default
config. This applies to both the normal and execution-only loops.

Made-with: Cursor
  739. a25b35c
    epoch validity: exclude hard_blocked symbols from entry-validity set
    Mehr im Commit-Body
    Analogous to the earlier pinned exclusion: symbols that are hard_blocked
(permanently lacking L3 data because the exchange does not provide L3 for them)
are already excluded from trading by the per-symbol safety mechanism. They should
not count against the 90% entry-validity threshold.

Entry-validity set is now: execution_symbols \ (pinned ∪ hard_blocked).

Without this fix, 4/23 non-pinned execution symbols with permanent l3_count=0
(ATH/USD, AVNT/USD, CC/USD, DOT/USD — Kraken does not provide L3 for them)
caused every epoch to be degraded (17.4% > 10% tolerance), keeping the engine
permanently in ExitOnly mode even though system_live_ready=true.

EPOCH_VALIDITY_COMPUTED now logs hard_blocked_excluded_count alongside
pinned_excluded_count and entry_validity_count.

Made-with: Cursor
  740. f47cac4
    fix(execution): l3_integrity checked global hard_blocked list instead of exec-set intersection
    Mehr im Commit-Body
    Two bugs fixed:

1. `list_hard_blocked_symbols()` returns ALL globally hard_blocked symbols (from all
   runs/processes). The code passed `!hard_blocked.is_empty()` as `hard_blocked_any_exec_symbol`,
   meaning any hard_blocked symbol anywhere — even outside the execution set — made
   l3_integrity=false and blocked the entire engine. Fixed: only count symbols actually
   present in the execution set (BTreeSet::remove returns true only if present).

2. l3_integrity was binary: any single hard_blocked exec symbol → system down.
   This is overly aggressive when a minority of symbols permanently lack L3 data on
   the exchange (Kraken does not provide L3 for all pairs). Hard_blocked symbols are
   already removed from exec_allowed and will not trade; universe_viability separately
   checks if enough symbols remain. Changed to fraction-based: l3_integrity=false only
   when >50% of exec symbols are hard_blocked (systemic L3 failure), not when a few
   illiquid symbols lack L3.

Observability: DATA_INTEGRITY_MATRIX now logs hard_blocked_exec_count and
total_exec_before_filter. EXECUTION_SYMBOL_FILTERED only logged for symbols
actually in the execution set.

Made-with: Cursor
  741. cea8bcc
    docs: CHANGELOG_ENGINE correct commit hash for observability export
    Mehr im Commit-Body
    Made-with: Cursor
  742. 61f96fa
    Observability read-model export voor KapitaalBot-Website
    Mehr im Commit-Body
    - docs/OBSERVABILITY_SNAPSHOT_CONTRACT.md: versioned contract 1.0
- src/db/read/observability_queries: order/fill/regime/strategy counts, latest_epoch_summary
- src/observability: snapshot DTOs + export naar JSON (public_* families)
- CLI: export-observability-snapshots (OBSERVABILITY_EXPORT_DIR)
- CHANGELOG + CHANGELOG_ENGINE bijgewerkt

Website BFF leest alleen deze snapshots; geen directe DB-queries.

Made-with: Cursor
  743. a6fa319
    epoch validity: entry-validity set = execution \ pinned (pinned excluded from 90% rule)
    Mehr im Commit-Body
    - compute_epoch_criteria_and_status uses only non-pinned execution symbols for 90% check
- Pinned stay in scope/snapshot/universe; illiquid pinned no longer block entry gate
- EPOCH_VALIDITY_COMPUTED log: entry_validity_count, pinned_excluded_count, status
- symbol_count in EpochCriteria = entry-validity set size
- docs/EPOCH_ENTRY_VALIDITY_SET.md: design + live validation checklist

Made-with: Cursor
  744. 70857f2
    feat(execution): explicit epoch binding policy (LatestValid / PreferCurrentLineage) + EXECUTION_EPOCH_BOUND logging
    Mehr im Commit-Body
    Made-with: Cursor
  745. 5086221
    docs: TRADABLE_COUNT_NEXT_STEPS + run71 degraded symbols diagnostic script
    Mehr im Commit-Body
    Made-with: Cursor
  746. f6a603b
    feat(epoch): valid epoch when ≥90% symbols meet criteria (fix run 71 degraded)
    Mehr im Commit-Body
    Made-with: Cursor
  747. 29e4117
    chore: CHANGELOG_ENGINE commit hash for execution-only fix
    Mehr im Commit-Body
    Made-with: Cursor
  748. 2e525b4
    fix(config+execution): EXECUTION_ONLY=1 parse + first-binding lineage break
    Mehr im Commit-Body
    - config: parse_bool_env() accepts 1/0/true/false so systemd EXECUTION_ONLY=1
  enables split mode (no own ingest, bind to ingest epochs).
- live_runner: lineage_break_detected only when previous lineage differs from
  current; set last_bound_lineage_id after every binding. Fixes spurious
  ExitOnly on first epoch binding.

CHANGELOG + CHANGELOG_ENGINE updated.

Made-with: Cursor
  749. 158d285
    chore: correct commit hash in CHANGELOG_ENGINE
    Mehr im Commit-Body
    Made-with: Cursor
  750. 9a1a48c
    fix(analysis): capturable move strategy-aware in readiness report
    Mehr im Commit-Body
    CapturableMoveInputs used pre-loop maker-oriented expected_move_bps for
all strategies; Momentum received systematically underestimated capturable
move -> SurplusBelowFloor/EdgeNegative. Now: capturable move computed per
strategy with strategy_move_bps inside the loop; NoTrading branch keeps
maker expected_move_bps.

CHANGELOG + CHANGELOG_ENGINE updated.

Made-with: Cursor
  751. 13781a8
    fix(fill_prob): calibrate for Kraken liquidity levels
    Mehr im Commit-Body
    The fill probability model was calibrated for high-volume exchanges
(5 trades/sec normalization, 40s fill reference). On Kraken, even
liquid pairs like EUR/USD only do 0.5 trades/sec, giving fill_prob
of 7% — making edge permanently negative.

Changes:
- Fallback density normalization: 5.0 → 0.5 (Kraken-realistic)
- L3 fill time reference: 40s → 300s (maker orders rest for minutes)

EUR/USD expected fill_prob: 0.07 → 0.70 (with trade_density=0.53)

Made-with: Cursor
  752. 0dcd344
    fix(edge): strategy-aware edge and expected_move calculations
    Mehr im Commit-Body
    The economic model was originally built for market making (maker) and
applied fill_probability uniformly to all strategies. This penalized
momentum/taker strategies where fill is instant (market order).

Changes:
- Momentum edge: no fill_prob discount, costs = 2*taker_fee + slippage
- Maker edge: fill_prob * (move - maker_fee - taker_fee - slippage)
- Momentum expected_move: vol*1.2 + micro*1.0 + spread*0.1 (directional)
- Maker expected_move: spread*0.8 + vol*0.4 + micro*0.6 (spread capture)

Made-with: Cursor
  753. 8693309
    feat(warmup): skip 60s warmup when ingest is already producing epochs
    Mehr im Commit-Body
    If a valid ingest epoch exists in the DB, the execution runner now
reduces warmup from 60s to 5s (WS connect only) and uses the ingest
run_id for initial universe selection data. This avoids redundant
waiting when run-ingest is already running continuously.

Made-with: Cursor
  754. 6ba5998
    fix(fees): parse Kraken TradeVolume nested fee object correctly
    Mehr im Commit-Body
    The TradeVolume API returns fees as nested objects:
  fees["XETHZUSD"]["fee"] = "0.3500" (percentage)

The code called as_str() on the object directly, which returned
None, silently falling back to hardcoded defaults (20/26 bps).
Actual account fees (18/35 bps) were never read from the API.

Fix: navigate into nested object with .get("fee"), parse the
percentage string, convert to bps with * 100 (not * 10_000).

Made-with: Cursor
  755. 1a3909e
    fix: readiness gate economic model bugs + complete exposure protection logging
    Mehr im Commit-Body
    Root cause fixes for 0/200 tradable pairs:

1. Regime metric mapping: spread_stability measured width not stability
   (divisor 20→80), midprice_volatility threshold too aggressive (divisor
   10→40). Most altcoins falsely tagged CHAOS.

2. Slippage volatility multiplier: vol_proxy * 5.0 used raw bps input
   (e.g. 15 bps → 75 bps slippage). Changed to * 0.3 for sane values.

3. Edge formula: fill_prob * move - costs → fill_prob * (move - costs).
   Costs only incurred when filled, not every attempt.

4. Capturable move: removed fill_probability discount (double-counted
   with edge formula). Capturable move = execution quality given fill.

5. Bootstrap fees: 35/35 → 25/40 bps (match Kraken base tier).

Also includes previously uncommitted exposure protection causal logging
(exit_lifecycle, exposure_reconcile, runner, ws_handler).

DB cleanup: zeroed phantom positions (ETH/USD, EUR/USD) and expired
stale orders that caused "Insufficient funds" protection failures.

Made-with: Cursor
  756. 475f5ab
    feat: causal exposure validation + maker/taker route evaluation
    Mehr im Commit-Body
    - Exposure: validate per-symbol UNPROTECTED→STARTED→outcome chain in validate script
- Maker/taker: evaluate both execution modes per route, choose on net edge
- Logging: ROUTE_MAKER_EVALUATED, ROUTE_TAKER_EVALUATED, ROUTE_EXECUTION_MODE_CHOSEN
- slippage_estimator: estimate_slippage_for_entry_mode(maker)
- readiness_gate: slippage_for_entry_mode()
- EDGE_NEGATIVE_HARD_BLOCK uses chosen_edge_bps (max of maker/taker)

Made-with: Cursor
  757. e3554fe
    feat(fees): live fee model via Kraken TradeVolume API
    Mehr im Commit-Body
    STAP 1 — Live fee source:
- auth_rest: get_trade_volume() via POST /0/private/TradeVolume
- LiveFeeProvider: fetch maker/taker fees, volume_30d from account
- Refresh at startup + periodiek (24h)
- Fallback: cached of bootstrap met expliciete FEE_MODEL_FALLBACK_USED log

STAP 2 — Fees als pure input:
- FeeTier.fee_source (live|cached|bootstrap)
- ROUTE_FEE_PROFILE: fee_entry_bps, fee_exit_bps, total_fee_bps, fee_source
- ROUTE_EDGE_BREAKDOWN: fee_source toegevoegd
- tier_from_provider_or_bootstrap() i.p.v. hardcoded current_fee_tier

STAP 4 — Traceability:
- FEE_MODEL_REFRESH_STARTED, FEE_MODEL_REFRESHED, FEE_MODEL_REFRESH_FAILED
- FEE_STATE_ACTIVE, FEE_DIFFERENTIAL
- log_fee_state_active() bij startup

STAP 5 — Geen hardcoded defaults als waarheid:
- Bootstrap (35 bps) alleen bij no prior fetch, met expliciete log
- Alle fee-consumers via LiveFeeProvider of tier_from_provider_or_bootstrap

STAP 6 — Server validatie:
- validate_live_engine_server.sh: FEE_STATE_ACTIVE vereist
- Fee model counters in output

Made-with: Cursor
  758. 1d8155a
    feat: auto-protect unprotected exposure with real stop/market orders
    Mehr im Commit-Body
    - Add protection_flow.rs: places emergency stop-loss (with market fallback)
  for any unprotected position; persists order to execution_orders so
  symbol-execution lock detects it immediately.
- Startup reconcile (both live and execution-only paths) now calls
  protect_exposure() for each unprotected position instead of only logging.
- Periodic reconcile returns unprotected records; live_runner triggers
  protect_exposure() for any newly detected unprotected positions.
- detect_partial_fill_protection updated: checks for existing exit orders
  and logs EXPOSURE_PROTECTION_CONFIRMED or EXPOSURE_PROTECTION_STARTED
  (reason=exit_lifecycle_triggered) accurately.
- New log markers: EXPOSURE_PROTECTION_STARTED, EXPOSURE_PROTECTION_CONFIRMED,
  EXPOSURE_PROTECTION_FAILED, EXPOSURE_PROTECTION_FALLBACK_MARKET,
  EXIT_PLAN_RECONCILED, EMERGENCY_STOP_PERSISTED.

Made-with: Cursor
  759. 3db29f2
    feat(safety): proof mode isolation + exposure auto-protection + symbol lock
    Mehr im Commit-Body
    STAP A — Proof mode isolation:
- PROOF_MODE_STATE log at start of every pipeline run (active=true/false)
- PROOF_MODE_BYPASS_APPLIED at system gate and per-pair gate
- EDGE_NEGATIVE_HARD_BLOCK: hard guard — when proof_mode=false, any route with
  expected_edge_bps < 0 is blocked before plan_execution; log + Skip outcome

STAP B — Exposure auto-protection:
- exposure_reconcile.rs: new module
  - reconcile_exposure_at_startup(): load positions, check exit orders,
    log EXPOSURE_DETECTED / EXPOSURE_UNPROTECTED / EXPOSURE_PROTECTION_CONFIRMED
    / RECONCILE_POSITION_STATE
  - check_symbol_execution_lock(): per-symbol guard before new entry;
    blocks if active exit orders, open entry orders, or unprotected net position;
    logs SYMBOL_EXECUTION_LOCK_ACQUIRED / SYMBOL_EXECUTION_LOCK_RELEASED
  - detect_partial_fill_protection(): called on every fill (incl. partial);
    logs PARTIAL_FILL_PROTECTION_UPDATE, EXPOSURE_UNPROTECTED if no exit orders
  - run_periodic_reconcile(): lightweight periodic position/exit order mismatch check

- live_runner.rs:
  - reconcile_exposure_at_startup() called at startup before evaluation loop
  - check_symbol_execution_lock() called before every order submit
  - run_periodic_reconcile() called every 10 evaluations

- ws_handler.rs:
  - detect_partial_fill_protection() called on every entry fill (partial + full)
  - ORDER_FILL log extended with partial=true/false

Logging additions:
  PROOF_MODE_STATE, PROOF_MODE_BYPASS_APPLIED, EDGE_NEGATIVE_HARD_BLOCK
  EXPOSURE_DETECTED, EXPOSURE_UNPROTECTED, EXPOSURE_PROTECTION_STARTED
  EXPOSURE_PROTECTION_CONFIRMED, PARTIAL_FILL_PROTECTION_UPDATE
  RECONCILE_POSITION_STATE, SYMBOL_EXECUTION_LOCK_ACQUIRED, SYMBOL_EXECUTION_LOCK_RELEASED

Made-with: Cursor
  760. 3eb3a81
    fix(pipeline): ROUTE_SELECTED shows effective proof-capped size and proof_mode flag
    Mehr im Commit-Body
    Made-with: Cursor
  761. 457c92f
    fix(pipeline): cap proof mode trade size + log ROUTE_PROOF_ENTRY_FORCED on normal path
    Mehr im Commit-Body
    Previously, when proof mode bypassed readiness checks and the normal risk+queue
path returned Execute, the full sizing (e.g. 20 EUR) was used instead of the
proof cap (ROUTE_PROOF_MAX_ORDER_QUOTE). The ROUTE_PROOF_ENTRY_FORCED log was
only emitted in the fallback Skip→Execute conversion, not here.

Fix:
- Introduce `proof_mode_active` flag in execution loop (proof.enabled && execute_count==0)
- Cap `effective_size_dec` to `route_proof.max_order_quote` when proof_mode_active
- Emit ROUTE_PROOF_ENTRY_FORCED immediately when Execute is produced with proof cap
- This ensures ROUTE_PROOF_MAX_ORDER_QUOTE=5 is always respected regardless of path

Made-with: Cursor
  762. a1cc39d
    feat(engine): PAIR_FILTER_RESULT, INGEST_WARMUP_STATE, proof auto-disable, latency split
    Mehr im Commit-Body
    strategy_pipeline.rs:
- PAIR_FILTER_RESULT log for every pair entering/failing pair_allowed_for_ranking
  (result=allowed|blocked, fill_time_ms, spread_bps, strategy)
- RouteRecord: add spread_net_bps field (pre-computed per strategy)
- ROUTE_EDGE_BREAKDOWN: add spread_net_bps, spread_role, break_even_shortfall_bps
  per route (enables spread attribution in no-trade forensics)

ingest_runner.rs:
- INGEST_WARMUP_STATE state=warming_up logged at WS start
- INGEST_WARMUP_STATE state=live_ready|degraded_warmup logged after warmup period
- INGEST_WARMUP_STATE repeated in heartbeat when valid_epochs=0
  (explicitly distinguishes warming-up from stream_unhealthy)
- INGEST_STREAM_HEALTH extended with warmup_state field

live_runner.rs:
- ROUTE_PROOF_DISABLED: auto-disable proof mode after first successful order submit
  (proof_lifecycle_proven flag; subsequent cycles run without forcing)
- PIPELINE_LATENCY_PROFILE: log pipeline logic latency (ms) per evaluation
  (splits pure logic cost from DB/IO; complement to ROUTE_LATENCY_PROFILE)
- proof_total_forced_trades counter for diagnostic reporting

Made-with: Cursor
  763. 30df0f6
    feat(ingest): IngestStreamHealth with gap detection and lineage recovery
    Mehr im Commit-Body
    - Add IngestStreamHealth struct tracking:
  - last_message_ts: most recent ticker/trade timestamp
  - consecutive_valid_epochs: epoch continuity counter
  - gap_detected: boolean flag for active gap state
  - gap_start_ts: timestamp when gap started
  - reconnect_count: reconnect event counter

- At each heartbeat, query DB for last ticker/trade timestamp
  and compute last_msg_age_secs to assess stream liveness

- Log INGEST_STREAM_HEALTH every heartbeat:
  healthy, last_message_age_secs, valid_epochs, gap, reconnects

- Log INGEST_GAP_DETECTED when last_msg_age_secs > 120
- Log INGEST_LINEAGE_RECOVERED when stream recovers after gap
- Track consecutive_valid_epochs in stream_health (reset to 0 on EPOCH_DEGRADED)

DATA_FRESHNESS_STATE can now rely on INGEST_STREAM_HEALTH markers
instead of arbitrary time-window heuristics

Made-with: Cursor
  764. 027e9b9
    feat(engine): route transparency, pair classifier, ORDER_ID_CORRELATION_FALLBACK
    Mehr im Commit-Body
    pair_classifier.rs (new):
- PairClass enum: MajorFx, CryptoMajor, CryptoMid, Altcoin, Unknown
- classify_pair(): categorizes symbols by base asset
- edge_model_justification(): regime+strategy context for each pair class

strategy_pipeline.rs:
- PAIR_CLASSIFICATION log per selected route
- EDGE_MODEL_JUSTIFICATION log per selected route
- ROUTE_DECISION_SUMMARY: full economics (edge, fill_prob, fees, spread_net, slippage)
- ROUTE_PARAMETER_PROFILE: SL/TP/time_stop, maker_or_taker, spread breakdown per route
- COUNTERFACTUAL_BEST_ROUTE: top 5 non-executed routes when execute_count=0
- RouteRecord extended with entry_strategy, exit_strategy, spread_bps fields

runner.rs:
- ORDER_ID_CORRELATION_FALLBACK_USED logged when exchange bridge not found
  (HandleResult::Unknown → bridge correlation failed → event was unroutable)

Made-with: Cursor
  765. 1022953
    fix(engine): pair filter removed spread gate, instrument-driven exit price precision
    Mehr im Commit-Body
    pair_allowed_for_ranking refactored:
- Remove spread_bps > 2.0 global gate (spread is route feature, not global blocker)
- Remove fill_time=None blocking (None = no L3 data = not technically blocked)
- Only hard blocker: fill_time >= 60s when explicitly known
- All 42 L3 symbols including EUR/USD and crypto-majors now pass this filter

exit_lifecycle.rs precision fix:
- Replace hardcoded 5-decimal rounding with get_instrument_constraints() per symbol
- normalize_order() uses price_increment from Kraken instrument metadata
- InstrumentConstraints::fallback_5dp() added for resilience when API call fails
- Log PRECISION_SOURCE=instrument_metadata and PRECISION_NORMALIZATION_APPLIED per exit

Made-with: Cursor
  766. 576dfea
    fix(engine): structural data freshness, blocker masking fix, spread strategy-aware
    Mehr im Commit-Body
    Data freshness (structural, not workaround):
- Remove MAX_RUN_AGE_FOR_READINESS_SECS (48h run-age logic removed)
- Add LIVE_DATA_MAX_AGE_SECS=60 based on actual last_ticker_ts/last_trade_ts
- Remove live_freshness_secs parameter from run_readiness_analysis_for_run
- Log DATA_FRESHNESS_STATE with mode=live/historical on every readiness check

Blocker masking fix (check_entry_readiness):
- Return actual primary_blockers.first() instead of hardcoded DataStale
- Fallback to DataStale only when report.data_stale=true or primary_blockers is empty
- Prevents economic blockers (RegimeChaos, EdgeNegative) from showing as DataStale

Spread strategy-aware (cost_breakdown.rs):
- Rename spread_cost_bps → spread_net_bps in CostBreakdown
- Add spread_net_for_strategy(): Liquidity/Volume=-spread*0.5 (income), Momentum=+spread*0.5 (cost)
- strategy_readiness_report uses spread_net_for_strategy per candidate
- Log SPREAD_ROLE with spread_bps, spread_net_bps, role per evaluation

live_runner.rs updated to call run_readiness_analysis_for_run without freshness parameter.

Made-with: Cursor
  767. df17f9e
    fix(engine): strategy-aware entry filter, slippage maker/taker split, sizing ratios
    Mehr im Commit-Body
    entry_filter.rs:
- Add max_spread_bps and spread_is_income fields to EntryFilterConfig
- Add entry_filter_for_strategy(): Momentum uses spread as UPPER bound (taker cost),
  Liquidity/Volume use it as LOWER bound (maker income)
- Momentum: max_spread=30bps, max_fill_time=5s; Liquidity: max_fill_time=40s; Volume: default

slippage_estimator.rs:
- MAKER_SPREAD_FACTOR=0.05 (posting costs no spread crossing)
- TAKER_SPREAD_FACTOR=0.50 (taker pays half-spread)
- base_slippage_for_strategy(): Momentum=3-4bps, Liquidity=0.8-1.2bps, Volume=2.0bps

sizing.rs:
- equity_ratio_for_strategy(): Liquidity=0.05, Momentum=0.10, Volume=0.08
- max_trade_ratio_for_strategy(): Liquidity=0.20, Momentum=0.25, Volume=0.40
- size_quote_from_edge() now takes SelectedStrategy parameter

Pipeline uses per-strategy entry filter and sizing ratios at both ranking and execution stages.

Made-with: Cursor
  768. 666fec4
    fix(engine): wire exit_config_for_exit_strategy and per-strategy SL/TP/time_stop
    Mehr im Commit-Body
    Three dead-code wiring gaps fixed:
1. runner.rs: call exit_config_for_exit_strategy(selected_exit_strategy) instead of
   ExitConfig::default(); add ORDER_ID_CORRELATION_MODE log
2. exit_lifecycle.rs: use config.time_stop_secs instead of hardcoded WAIT_TP_OR_TIMESTOP_SECS=90
3. strategy_pipeline.rs: call momentum_execution_mode() for Momentum candidates to determine
   OrderIntent::TakerEntry vs MakerEntry; pass exit_strategy through Outcome

Per-strategy ExitConfig values in strategy_selector.rs:
- Liquidity→MakerLadder: SL=-20, TP=30, time=120s
- Momentum→TSL: SL=-60, TP=150, time=30s
- Volume→TimeDecay: SL=-25, TP=50, time=60s

New OrderIntent::TakerEntry variant added; ExecutionIntent::TakerEntry matched accordingly.
Outcome struct extended with exit_strategy field; live_runner.rs wired accordingly.

Made-with: Cursor
  769. 5107b39
    docs: full lifecycle proof report (EXIT_LIFECYCLE_COMPLETED confirmed live)
    Mehr im Commit-Body
    Full lifecycle proven on commit 6c14a4b, run_id=55, order_id=23:
- ROUTE_SELECTED → ORDER_ACK → FILL_LEDGER_COMMITTED
- EXIT_PLAN_CREATED → EXIT_RUNTIME_PLAN_ARMED
- EXIT_REASON_TRIGGERED (time_stop) → EXIT_ORDER_SUBMITTED (market)
- EXIT_LIFECYCLE_COMPLETED (market exit filled)
- signal_to_submit=361ms, fill_to_exit_submit=7ms

Made-with: Cursor
  770. 6c14a4b
    fix: round SL/TP prices to 5 decimals + alphanumeric cl_ord_id for exit orders
    Mehr im Commit-Body
    Kraken rejects exit orders with too many decimal places (EOrder:Invalid price).
Round stop_trigger_price and tp_price to 5 decimal places before submission.
Also fix cl_prot/cl_tp id format to alphanumeric (no hyphens) for Kraken WS v2.

Made-with: Cursor
  771. 30c0b61
    fix: replay buffered execution events after add_order ACK populates bridge
    Mehr im Commit-Body
    Buffered events (pending_new, new, trade, filled) were released but not
replayed through handle_execution_report. After ACK populates the
exchange_bridge, replay each buffered event. If a fill is detected during
replay, immediately trigger the exit phase (EXIT_PLAN_CREATED, etc.).

This completes the full lifecycle: ORDER_ACK → FILL_LEDGER_COMMITTED →
EXIT_PLAN_CREATED → EXIT_RUNTIME_PLAN_ARMED → EXIT_ORDER_SUBMITTED.

Made-with: Cursor
  772. abbfd5d
    fix: populate tracker bridge from add_order WS ACK + use exchange order_id for fills
    Mehr im Commit-Body
    Three combined fixes:
1. Skip cl_ord_id in add_order (Kraken WS v2: not supported for this account type)
2. On WS_METHOD_ACK for add_order: extract exchange order_id, call tracker.on_ack()
   and state_machine::on_ack() to populate the exchange_bridge for fill correlation
3. Release buffered events for the exchange order_id after bridge is populated
4. Keep WS_ADD_ORDER_SENT debug log and WS_METHOD_* logging for diagnostics

Made-with: Cursor
  773. 0fafab9
    test: temporarily remove cl_ord_id to test base order validity
    Mehr im Commit-Body
    Made-with: Cursor
  774. cdba3c9
    debug: log WS_ADD_ORDER_SENT JSON for cl_ord_id invalid arguments diagnosis
    Mehr im Commit-Body
    Made-with: Cursor
  775. 5f15fdc
    fix: cl_ord_id alphanumeric-only format for Kraken WS v2 compliance
    Mehr im Commit-Body
    Kraken WS v2 rejects cl_ord_id with hyphens (EGeneral:Invalid arguments:cl_ord_id).
New format: "kb" + first char of prefix + UUID simple (32 hex) = 35 chars total.
All alphanumeric, no hyphens, satisfies Kraken's character and length requirements.

Made-with: Cursor
  776. 89387c7
    fix: truncate cl_ord_id to 36 chars (Kraken EGeneral:Field cl_ord_id max)
    Mehr im Commit-Body
    Kraken WS v2 rejects add_order with cl_ord_id longer than 36 chars.
Format "kb-strat-{uuid32}" = 41 chars exceeds limit.
Now truncates to 36 chars while keeping kb-prefix and UUID entropy (≥27 hex chars).

Made-with: Cursor
  777. 6f431ed
    fix: log WS method responses (add_order ack/error) to diagnose silent order rejection
    Mehr im Commit-Body
    Previously all non-executions/non-ownOrders WS messages were silently
dropped in `_ => {}`. This made it impossible to see Kraken error
responses (e.g. EOrder:Unknown symbol) to add_order requests.

Now logs WS_METHOD_ACK for successful method responses and
WS_METHOD_ERROR for error responses.

Made-with: Cursor
  778. 4b3f63b
    fix: skip shadow_trade insert for NoEntry direction (LONG/SHORT constraint)
    Mehr im Commit-Body
    EntryDirection::NoEntry previously mapped to "UNKNOWN" which violates
the shadow_trades_direction_check constraint (LONG/SHORT only).
Skip shadow trade inserts entirely when direction is NoEntry.

Also updates lifecycle proof report with session 9 evidence.

Made-with: Cursor
  779. 48dbc9e
    fix: bypass choke system_live_ready gate in ROUTE_PROOF_MODE
    Mehr im Commit-Body
    The choke_decide call in run_execution_once used system_live_ready
(which is false in proof mode) as readiness_allows, causing Halt.

In proof mode with ignore_regime_block, readiness_allows is set to true
so the choke allows the order through.

Made-with: Cursor
  780. 4b8df30
    fix: proof mode bypasses pair_allowed_for_ranking and entry_filter gates
    Mehr im Commit-Body
    Track proof_candidate_forced flag; bypass all per-pair gates (readiness,
pair_allowed_for_ranking, entry_filter) for exactly one candidate when
ROUTE_PROOF_MODE=true && ROUTE_PROOF_IGNORE_REGIME_BLOCK=true.

Made-with: Cursor
  781. 0a232fc
    fix: ROUTE_PROOF_MODE bypasses per-pair readiness gate for first candidate
    Mehr im Commit-Body
    When route_proof.enabled && ignore_regime_block, the readiness-drop for
non-StrategyMismatch blockers is bypassed for the very first candidate.
This allows one proof candidate to reach the ROUTE_PROOF_ENTRY_FORCED logic.

Logs ROUTE_PROOF_READINESS_BYPASSED when bypass applies.

Made-with: Cursor
  782. 3f4e780
    fix: wire route_proof_config_from_env() into run_execution_once pipeline config
    Mehr im Commit-Body
    run_execution_once used StrategyPipelineConfig::default() which has
route_proof.enabled=false. Now reads ROUTE_PROOF_MODE env at startup so
run-proof and run-execution-once both honour the env-based proof config.

Made-with: Cursor
  783. 1ca9868
    fix: ROUTE_PROOF_MODE bypasses system_live_ready gate (ignore_regime_block)
    Mehr im Commit-Body
    When ROUTE_PROOF_MODE=true and ROUTE_PROOF_IGNORE_REGIME_BLOCK=true, the
readiness_system_block early-return is skipped so the pipeline can evaluate
routes and force one micro trade for lifecycle proof.

Logs readiness_system_block_bypassed instead of readiness_system_block when
bypassed, so the blocker reason is still visible in logs.

Made-with: Cursor
  784. d0c6b93
    fix: pass live_freshness_secs=120 in run_readiness_analysis
    Mehr im Commit-Body
    A persistent ingest run never sets ended_at. With live_freshness_secs=None
the data_stale gate always returned true for running ingest runs, blocking
execution despite fresh data being available.

Now: if last_ticker_ts or last_trade_ts is within 120s → data_stale=false.
Ended runs still gated by MAX_RUN_AGE_FOR_READINESS_SECS (48h).

Made-with: Cursor
  785. 5f36350
    feat: persistent ingest service + economic forensics + foreground proof runner
    Mehr im Commit-Body
    Ingest (FASE 1):
- heartbeat interval 300s → 60s
- add INGEST_READY_FOR_EXECUTION_ATTACH after first valid epoch
- systemd services: Restart=always, RestartSec=5/10

Economic forensics (FASE 3/4):
- collect RouteRecord during strategy pipeline loop
- dump_route_forensics() when execute_count=0: ROUTE_EDGE_BREAKDOWN (top 5),
  ROUTE_FRONTIER, EDGE_ATTRIBUTION, BREAK_EVEN_THRESHOLD
- write /tmp/edge_frontier_<run_id>.json artifact

Foreground proof runner (FASE 2):
- new run-proof command: loops run-execution-once with 20min timeout
- prints PROOF_STATUS every 2s (eval_count, routes_evaluated, execute_count,
  highest_edge_bps, dominant_blocker)
- auto-stops: lifecycle proven / ECONOMICALLY_BLOCKED / DATA_BLOCKED / timeout
- dumps /tmp/route_analysis_<run_id>.log on exit

Made-with: Cursor
  786. ffa99bf
    fix: self-managed fail-fast migrations + fix duplicate version 20260310120000
    Mehr im Commit-Body
    - rename 20260310120000_execution_schema.sql → 20240308200000_execution_schema.sql
  to resolve duplicate version collision (two files sharing version 20260310120000)
- db::create_pool now runs sqlx::migrate!() on every startup and aborts if it fails
- removed warn-and-continue behavior; startup is blocked on DB_MIGRATIONS_FAILED
- removed SKIP_MIGRATIONS escape hatch
- logs: DB_MIGRATIONS_STARTED, DB_MIGRATIONS_APPLIED, DB_MIGRATIONS_UP_TO_DATE, DB_MIGRATIONS_FAILED

Made-with: Cursor
  787. acde7ca
    Docs: server migration + proof-run (EXECUTION_ENABLE + ROUTE_PROOF_MODE) sectie 8
    Mehr im Commit-Body
    - Migratie 20260311100000 handmatig toegepast op server (exit latency kolommen)
- Proof-run uitgevoerd: commit 23e1396, run_id 54, no order (system_live_ready=false)
- Rapport sectie 8: commando, uitkomst, conclusie

Made-with: Cursor
  788. 23e1396
    Docs: add multiregime route proof (Fase 6) and server validation checklist
    Mehr im Commit-Body
    Made-with: Cursor
  789. 8348ff6
    Fase 2-5: Route discovery, proof mode, latency KPI, equity markers
    Mehr im Commit-Body
    Fase 2: Route discovery proof (multiregime)
- ROUTE_DISCOVERY_STARTED, ROUTE_EVALUATED (per candidate), ROUTE_SELECTED, ROUTE_UNIVERSE_EMPTY
- Track route_highest_edge_bps and route_blocker_counts for empty-universe log

Fase 3: ROUTE_PROOF_MODE lifecycle force
- RouteProofConfig + route_proof_config_from_env() (ROUTE_PROOF_MODE, MIN_EDGE_BPS, MAX_ORDER_QUOTE, etc.)
- Pipeline: force one Execute with capped size when proof mode and no execute
- ROUTE_PROOF_ENTRY_SUBMITTED, ROUTE_PROOF_FILL_DETECTED in runner; EXIT_LIFECYCLE_COMPLETED in exit_lifecycle
- live_runner: pipeline_config.route_proof from env

Fase 4: Latency KPI gates
- log_route_latency_profile() in db/order_latency: signal→submit, submit→ack, fill→exit_submit
- ROUTE_LATENCY_PROFILE and LATENCY_EDGE_PENALTY_APPLIED; called after exit phase in runner

Fase 5: Balance/compounding markers
- SIZE_FROM_NEW_EQUITY at pipeline sizing; EQUITY_UPDATED_AFTER_TRADE on exit completion (tp_filled + market exit)

Made-with: Cursor
  790. 030518c
    Fase 1: Universe/pinned state hard fix + recovery expand
    Mehr im Commit-Body
    - UniverseValidationError (PinnedSymbolMismatch + Other) in universe crate
- validate_snapshot returns Result<(), UniverseValidationError> for downcast
- L2 layer: force-include pinned symbols (same as L3/Execution) so pinned in pool get into L2
- live_runner: UNIVERSE_VALIDATION_STARTED, UNIVERSE_VALIDATION_OK, UNIVERSE_PINNED_SYMBOL_MISMATCH, UNIVERSE_RECOVERY_EXPAND
- On PinnedSymbolMismatch: extend pool_candidates with missing pinned, retry build_snapshot once
- Initial snapshot and loop refresh both use recovery; no more hard abort on pinned symbol missing from L3/execution

Made-with: Cursor
  791. bf5de99
    docs: lifecycle proof report 2026-03-11 (server a347ae4, chain not yet proven; blockers external)
    Mehr im Commit-Body
    Made-with: Cursor
  792. a347ae4
    Route-based engine: exit loop, timing instrumentation, route model, balance sizing, allocator, ingest heartbeat, lifecycle proof markers
    Mehr im Commit-Body
    - Exit loop in live runner: run_post_fill_exit_phase (SL+TP+time_stop/market)
- Timing: execution_order_latency exit columns, update_on_exit_phase, exit latency report
- Route model: SelectedExitStrategy, TradeRoute, candidate_routes_for_regime, PairReadinessRow.exit_strategy
- Route-based edge: readiness per route; exit_config_for_exit_strategy
- Balance-based sizing: EquitySource (Fixed/FromBalance), resolve_equity_quote
- Capital allocator: next_equity_after_pnl, MAX_TRADE_PCT/MAX_OPEN_NOTIONAL caps
- Ingest: INGEST_HEARTBEAT every 300s
- Lifecycle proof markers: EXIT_PLAN_CREATED, EXIT_RUNTIME_PLAN_ARMED, EXIT_REASON_TRIGGERED, EXIT_ORDER_SUBMITTED, EXIT_MAKER_FALLBACK_TO_MARKET

Made-with: Cursor
  793. cbdc451
    docs: single source of truth, centralise and clean documentation
    Mehr im Commit-Body
    - Add ENGINE_SSOT.md as single source of truth (status matrix, references)
- Add ARCHITECTURE_ENGINE_CURRENT.md with Mermaid diagrams
- Add LIVE_RUNBOOK_CURRENT.md (ingest, execution attach, markers)
- Add VALIDATION_MODEL_CURRENT.md (proof types, economic vs data/attach blocked)
- Add CHANGELOG_ENGINE.md (git-based, per subsystem)
- Add DOC_INDEX.md (lead vs historical docs)
- Add DOC_AUDIT_RESULT.md and DOC_CONSISTENCY_REPORT.md
- Move superseded docs to docs/superseded/ with SUPERSEDED banner
- Update README to point to SSOT and DOC_INDEX; remove broken doc refs
- Add systemd/README.md for ingest and execution units
- Remove DEPLOY_REPORT_*.md (time-bound, no SSOT value)
- Update CHANGELOG.md with 2025-03-11 entry

No runtime or strategy changes; git-only codeflow.

Made-with: Cursor
  794. 5cb496b
    fix(scripts): handle unset SKIP_RUN in live validation
    Mehr im Commit-Body
    Keep the hardened validation script compatible with set -u by guarding the optional SKIP_RUN flag explicitly. This preserves fail-fast proof checks without crashing before runtime validation starts.

Made-with: Cursor
  795. cff7b72
    fix(scripts): fail validation when proof target is unmet
    Mehr im Commit-Body
    Require warmup, minimum evaluation counts, and proof-target-specific runtime evidence before the live server validation script can report success. Label blocked runs explicitly as DATA_BLOCKED or ECONOMICALLY_EMPTY so short or empty runs no longer masquerade as proof.

Made-with: Cursor
  796. dcdf2de
    docs: add live validation runs analysis (run_id=32-34, commit b4ad93b)
    Mehr im Commit-Body
    Documents the complete live validation attempt with findings:
- Epoch contract proven: status=valid from epoch 3 onward (run_id=34)
- Universe selection bug fixed (two commits: 128f314, b4ad93b)
- DATA_INTEGRITY_MATRIX system_live_ready=true proven
- ENGINE_MODE transitions: ExitOnly→NoNewEntries (correct)
- NO_ORDER diagnosis: ECONOMIC_GATING (EdgeNegative/RegimeChaos) vs DATA_RUNTIME
- Live order lifecycle pending: requires non-CHAOS market window for Execute decision

Made-with: Cursor
  797. 0715310
    fix(execution): restore multistrategy live candidate flow
    Mehr im Commit-Body
    Infer maker direction from microstructure inputs, fan out regime-driven strategy candidates, and carry the winning strategy into execution. Lower the default risk floor so pipeline-sized orders can pass the risk gate and emit runtime logs that prove candidate fan-out and sizing decisions.

Made-with: Cursor
  798. b4ad93b
    fix(universe): lower MIN_EXECUTION_TICKER_ACTIVITY to 10 (= epoch minimum)
    Mehr im Commit-Body
    Threshold of 20 was too strict for the 60-second warmup window, resulting
in only 2 symbols qualifying for execution (run_id=33, symbol_count=2).

10 = MIN_TICKER_PER_SYMBOL matches the epoch completion criterion exactly.
Liquid symbols (ETH/USD, EUR/USD, ADA/USD etc.) accumulate 10+ tickers in
the 60s warmup; structurally illiquid symbols (1INCH/USD: 1 ticker/25 min,
AIXBT/USD: 1 ticker/25 min) remain filtered out.

Made-with: Cursor
  799. 128f314
    fix(universe): filter illiquid symbols from Execution layer selection
    Mehr im Commit-Body
    Symbols with ticker_samples < MIN_EXECUTION_TICKER_ACTIVITY (20) are
now excluded from the Execution universe layer, unless they are pinned.

Root cause: the execution universe was selecting symbols like 1INCH/USD
(1 ticker per 25 min), ACH/USD (0.08/min), AIXBT/USD (0.17/min) that
can never satisfy the epoch completion criterion of MIN_TICKER_PER_SYMBOL=10
per epoch window (5 min). This caused epochs to remain perpetually degraded
→ ENGINE_MODE=ExitOnly → no Execute decisions possible.

The threshold (20) = 2× the epoch minimum to account for the warmup-to-epoch
timing gap. Pinned symbols always bypass this filter.

Run_id=32 diagnosis (5 eval cycles, 0 orders, all epochs degraded):
  criteria_ticker_ok=false for epochs 1-5 due to 8 illiquid execution symbols
  EdgeNegative + RegimeChaos as secondary economic blockers

Made-with: Cursor
  800. f646c2e
    docs: label run-deterministic-proof as internal exerciser, distinguish from live validation
    Mehr im Commit-Body
    Made-with: Cursor
  801. 3112cbd
    Add run-deterministic-proof: live edge-case validation
    Mehr im Commit-Body
    Exercises three deterministic lifecycle paths against the real DB
without requiring exchange connectivity:

CASE 1 (OOO): Fill arrives before ACK
  - ORDER_EVENT_BUFFERED (fill buffered, bridge not yet populated)
  - ACK arrives → bridge populated → ORDER_EVENT_OUT_OF_ORDER
  - Buffered fill released; buffer empty after ACK

CASE 2 (Idempotency): Duplicate fill
  - fills_ledger::process_fill called twice, same exchange_trade_id
  - Second call: was_duplicate=true, FILL_DUPLICATE_IGNORED
  - DB verified: exactly 1 fill row per exchange_trade_id

CASE 3 (Reconcile): WS disconnect → Suspect → ReconcileRequired → Recovered
  - handle_ws_disconnect → ORDER_SUSPECT in tracker + DB
  - start_reconcile → ORDER_RECONCILE_REQUIRED in tracker + DB
  - reconcile_from_snapshot (status=open) → ORDER_RECONCILED, AckedOpen
  - RECONCILE_COMPLETE

All proof orders cleaned up from DB after run.
CLI: krakenbot run-deterministic-proof

Made-with: Cursor
  802. 32aae98
    docs: update deterministic engine deliverable with OrderTracker wiring status
    Mehr im Commit-Body
    Made-with: Cursor
  803. c4edd1c
    Wire OrderTracker + ws_handler into live execution loop
    Mehr im Commit-Body
    Replaces all direct DB-correlation bypasses in submit_and_wait_for_execution_reports
with the deterministic OrderTracker/ws_handler flow:

- DB-first: order persisted (PendingSubmit) before exchange submit
- OrderTracker registered immediately after DB persist
- All WS events (ACK/FILL/CANCEL/REJECT) routed through ws_handler::handle_execution_report
- cum_qty_before looked up from tracker state (no local HashMap)
- order_qty_base read from tracker (no caller-passed param)
- FILL -> fills_ledger::process_fill (atomic tx: fill + position + PnL)
- WS disconnect -> ws_handler::handle_ws_disconnect -> orders -> Suspect
- Reconnect -> order_reconcile::start_reconcile -> ReconcileRequired
- ownOrders snapshot -> reconcile_from_snapshot
- Out-of-order events buffered by exchange_order_id, released on ACK
- Duplicate events idempotently ignored (fills: ON CONFLICT DO NOTHING)

Removes: pending_ack_order_id hack, cum_qty_per_order local map,
inline ACK/FILL/CANCEL/REJECT handlers, direct DB-correlation in loop.

Made-with: Cursor
  804. 3b98ea8
    feat(execution): deterministic execution engine
    Mehr im Commit-Body
    DB-first order lifecycle, 13-state machine, thread-safe OrderTracker,
ledger-based fill accounting, reconnect/reconcile, no f64 for price/qty.

New modules:
- order_state.rs: 13 states (Created, PendingSubmit, AckedOpen,
  PartiallyFilled, Filled, Canceled, Rejected, Suspect,
  ReconcileRequired, UnknownExchangeOrder, LostOrRejected, Error, Reconcile)
- order_tracker.rs: DashMap primary + bridge; parking_lot event buffer
- order_buffer.rs: BufferedEvent for out-of-order WS events
- fills_ledger.rs: single-transaction fill+position+PnL+micro-alpha
- order_reconcile.rs: WS disconnect → Suspect → ReconcileRequired → recovered
- ws_handler.rs: cl_ord_id-first correlation; never symbol/side matching

Key fixes:
- cl_ord_id uses UUID v4 (not timestamp_nanos)
- on_ack/on_amend/execution_report_to_event: Decimal not f64
- PartialFill → PartiallyFilled state rename + backward-compat from_str
- runner.rs fill loop: Decimal throughout
- UNIQUE(order_id, exchange_trade_id) on fills for idempotency

New migration: 20260310140000_deterministic_execution_engine.sql
- +21 pre-trade audit + lifecycle fields on execution_orders
- +6 micro-alpha fields on fills
- execution_event_buffer table for buffered/unknown events
- Dedupe indexes on fills + order_events

Deps: dashmap = "5", parking_lot = "0.12" added to Cargo.toml
Made-with: Cursor
  805. 0d29b83
    fix(db): correct query_scalar return type from (i64,) to i64
    Mehr im Commit-Body
    query_scalar returns a single scalar value (i64), not a tuple (i64,).
The (i64,) type caused a RECORD/INT8 mismatch at decode time, silently
failing create_epoch and insert_execution_universe_snapshot on every
call → all epochs stuck at 'pending', INGEST_EPOCH_STARTED never logged.

Fix both create_epoch and insert_execution_universe_snapshot.

Made-with: Cursor
  806. 8de7afe
    fix(epoch): add sqlx json feature for JSONB binding; surface create_epoch errors
    Mehr im Commit-Body
    - Cargo.toml: add 'json' feature to sqlx (required for serde_json::Value → JSONB)
- live_runner.rs: convert both `if let Ok(create_epoch)` to match arms with
  ERROR-level INGEST_EPOCH_CREATE_FAILED logging on failure
- live_runner.rs: Err arm already present for snapshot insert (kept)

Root cause: without sqlx json feature, serde_json::Value binding to JSONB
columns silently fails at runtime; create_epoch itself likely OK but snapshot
insert fails → epoch stays pending → execution always skips evaluation.

Made-with: Cursor
  807. 9c460d6
    fix(execution): log EXECUTION_UNIVERSE_SNAPSHOT_INSERT_FAILED when snapshot insert fails
    Mehr im Commit-Body
    Made-with: Cursor
  808. 571d1d4
    fix(db): bind JSONB for execution_universe_snapshots via sqlx::types::Json
    Mehr im Commit-Body
    Made-with: Cursor
  809. cae54c1
    feat(epoch+split): FASE 1 validation script/runbook, FASE 2 ingest/execution split
    Mehr im Commit-Body
    FASE 1:
- scripts/validate_epoch_contract_fase1.sh: server validation of epoch contract (clean tree, run live N min, grep evidence)
- docs/EPOCH_CONTRACT_FASE1_VALIDATION_RUNBOOK.md: runbook + hard conclusion template
- live_runner: NO_ORDER_ECONOMIC_GATING / NO_ORDER_DATA_RUNTIME logging for no-order diagnosis

FASE 2:
- config: execution_only (EXECUTION_ONLY) for split mode
- run_execution_only_loop: execution without ingest; binds to ingest epochs/snapshots only
- run-execution-live when EXECUTION_ONLY=1: no run/lineage/WS ingest; only epoch reader + evaluation loop
- run-ingest: new CLI mode; ingest_runner.rs (public WS, universe, epoch/snapshot, L3 health; no execution)
- systemd: krakenbot-ingest.service, krakenbot-execution.service (EXECUTION_ONLY=1)
- docs/EPOCH_SPLIT_DELIVERABLE.md: commits, paths, validation proof, systemd install

Git-only deployment; no scp. Server: run validate_epoch_contract_fase1.sh for FASE 1 proof; then deploy split.

Made-with: Cursor
  810. 0d433c3
    feat(epoch): hard ingest/execution epoch contract — migration, lineage, epochs, snapshots, data-integrity matrix, engine modes, lineage break, STRATEGY_REJECTED/BLOCKER_DISTRIBUTION/NO_ORDER_SYMBOL_DROP
    Mehr im Commit-Body
    - Migration: ingest_lineage, ingest_epochs, execution_universe_snapshots
- Epoch lifecycle: create_lineage at start, create_epoch + update_epoch_status on universe refresh, execution-centric criteria (valid = exec+pinned ok)
- Epoch reader: current_valid_epoch_id (entries), current_epoch_for_exit_only (exit-only), execution_universe_snapshot_by_id
- Live runner: bind cycle to one epoch, load snapshot, EXECUTION_UNIVERSE_BOUND, DATA_INTEGRITY_VERIFIED
- Data integrity matrix: global_liveness, snapshot_coherence, market_freshness, l3_integrity, universe_viability (EXECUTION_MIN_UNIVERSE_SIZE)
- Engine modes: Normal/NoNewEntries/ExitOnly/Halt, ENGINE_MODE_ENTER/EXIT, no new entries when degraded/lineage break
- Lineage break: last_bound_lineage_id, INGEST_LINEAGE_CHANGED, EXECUTION_INGEST_LINEAGE_BREAK, EXECUTION_EMERGENCY_EXIT_ONLY
- No-order diagnose: STRATEGY_REJECTED, BLOCKER_DISTRIBUTION, NO_ORDER_SYMBOL_DROP (Outcome.symbol)
- Docs: docs/INGEST_EXECUTION_EPOCH_CONTRACT.md with contract, validation checklist, no-order reporting

Made-with: Cursor
  811. 778b788
    Safety: pinned invariants, WS reconcile logs, latency heatmap
    Mehr im Commit-Body
    Made-with: Cursor
  812. e57a816
    Docs: universe audit current state (200/60/50/30); Cursor rule remote-execution-ssh; config/live_runner/runner safety and runtime fixes
    Mehr im Commit-Body
    Made-with: Cursor
  813. f805468
    Docs: reference Cursor rules and Rust development mode in CURSOR_RULES.md
    Mehr im Commit-Body
    Made-with: Cursor
  814. 1286f1e
    Add Cursor rule: Rust development mode (one change, cargo check, focused commits)
    Mehr im Commit-Body
    Made-with: Cursor
  815. ca3b504
    Fix duplicate Decimal import and unwrap_or in stats_queries
    Mehr im Commit-Body
    Made-with: Cursor
  816. c0ae3a4
    Allow skipping/failing migrations gracefully via env
    Mehr im Commit-Body
    Made-with: Cursor
  817. 8c99445
    Fix shadow evaluator dependencies (uuid + FromRow) for server builds
    Mehr im Commit-Body
    Made-with: Cursor
  818. e534f54
    Add shadow trade evaluator and blocker matrix
    Mehr im Commit-Body
    Made-with: Cursor
  819. 0b44fea
    Fix ws_safety_report parsing (strip ANSI, avoid duplicate zero output)
    Mehr im Commit-Body
    Made-with: Cursor
  820. a248b17
    Make ws_safety_report.sh executable for server proof bundle
    Mehr im Commit-Body
    Made-with: Cursor
  821. c8b471c
    Fix run-execution-live shutdown timing by capping sleep to deadline
    Mehr im Commit-Body
    Ensure evaluation loop sleeps never overshoot the runtime deadline, so runtime window shutdown logs and post-run proof bundle steps reliably execute within configured runtime.

Made-with: Cursor
  822. c12d026
    Add safety integrity report CLI over symbol_safety_state and latency
    Mehr im Commit-Body
    Introduce report-safety-integrity command that summarizes symbol safety modes and submit->ack latency from execution_order_latency over the last 24h.

Made-with: Cursor
  823. 52262e9
    Document WS-native safety stack and add ws_safety_report script
    Mehr im Commit-Body
    Extend logging and server validation docs with ORDER_LATENCY, PRIVATE_STREAM_SILENT, QUIET_MODE, EXIT_ONLY and HARD_BLOCK events, and add a ws_safety_report.sh helper to summarise WS safety signals from logs and DB.

Made-with: Cursor
  824. dd48798
    Add WS-native safety extensions (latency, watchdog, exit-only, hard-block)
    Mehr im Commit-Body
    Introduce T0–T3 order latency persistence + ORDER_LATENCY logs, add private WS silent watchdog with reconnect, and persist per-symbol safety state for quiet-mode, exit-only (pinned + invalid L3), and L3 resync hard-blocking.

Made-with: Cursor
  825. c182d4e
    Fix universe pinning: use base_position in positions table
    Mehr im Commit-Body
    Made-with: Cursor
  826. 068b67b
    Add dynamic universe manager with atomic snapshot rotation
    Mehr im Commit-Body
    - Add UniverseManager: atomic snapshot build/validate/swap, two-phase apply overlap, pinned symbols, rotation diff logs
- Fetch pool symbols from Kraken AssetPairs (/USD) for 150–200 pool
- Live runner: ticker/trade on pool, select L2/L3/exec after warmup, periodic refresh with rollback guard
- Pipeline: optional execution-universe filter
- Config: UNIVERSE_* limits and refresh controls

Made-with: Cursor
  827. 5d897ad
    L3 capacity test: plan, run script, report script
    Mehr im Commit-Body
    - docs/L3_CAPACITY_TEST_PLAN.md: degradation metrics, acceptance criteria, test matrix (L3=5/15/25/50), capacity table template, advice
- scripts/run_l3_capacity_test.sh: one run with OBSERVE_SYMBOL_LIMIT_L3, fixed runtime/interval; optional MONITOR_RESOURCES=1
- scripts/l3_capacity_report.sh: parse log + DB for run_id report (warmup, eval cycles, drift, samples)

Made-with: Cursor
  828. 985ff06
    TDD gaps + server validation + universe audit (git-only codeflow)
    Mehr im Commit-Body
    - live_runner: DATA_WARMUP_START/COMPLETE/INSUFFICIENT, min data requirements, execute_count/skip_count/primary_blockers in LIVE_EVALUATION_COMPLETED
- state_machine: ORDER_SUBMIT/ACK/FILL/REJECT/CANCEL in logs for lifecycle proof
- pipeline: UNIVERSE_VALIDATION log (symbols_seen, symbols_with_l3, funnel counts)
- docs: ENGINE_TARGET_STATE, MODEL_CALIBRATION, SERVER_VALIDATION_LIVE_ENGINE, UNIVERSE_AND_DIVERSITY_AUDIT
- scripts: validate_live_engine_server.sh (clean tree, build, run-execution-live 2+ cycles)
- runbook: server validation section

Made-with: Cursor
  829. fa69932
    fix: live execution scheduling guard + min one evaluation; LIVE_EVALUATION_SCHEDULED/STARTED/COMPLETED/SKIPPED; runbook config
    Mehr im Commit-Body
    Made-with: Cursor
  830. 838c8c3
    feat: run-execution-live — long-running live validation with WS data + periodic pipeline
    Mehr im Commit-Body
    Made-with: Cursor
  831. a5f367a
    log primary_blockers in readiness_system_block root cause
    Mehr im Commit-Body
    Made-with: Cursor
  832. fd73aec
    fix: root cause of system_live_ready=false — log tradable_count/data_stale/regime; add end-current-run to set ended_at for execution
    Mehr im Commit-Body
    Made-with: Cursor
  833. 82d88a8
    fix: multiregime execution pipeline — per-pair strategy in readiness check, funnel drop counts, no_pair guard
    Mehr im Commit-Body
    Made-with: Cursor
  834. b183ae9
    audit: instrument constraints (execution layer) + execution pipeline funnel + EXECUTION_ENABLE
    Mehr im Commit-Body
    - docs/EXECUTION_INSTRUMENT_CONSTRAINTS_AUDIT.md: where constraints live (runtime Kraken only), submit_order normalizes, amend_order/stop-loss gaps
- docs/EXECUTION_PIPELINE_AUDIT.md: funnel logging, no test-forcing, lifecycle checks
- Pipeline: EXECUTION_PIPELINE_FUNNEL + EXECUTION_PIPELINE_CANDIDATE logging
- Config: execution_enable (EXECUTION_ENABLE); runner gate; main EXECUTION_ENGINE_START
- git-only-codeflow + EXECUTION_AUDIT: EXECUTION_ENABLE for run-execution-once

Made-with: Cursor
  835. c2e5c8b
    chore: make start_live_validation_engine_server.sh executable
    Mehr im Commit-Body
    Made-with: Cursor
  836. 212beee
    fix: validate_execution_on_server.sh load ~/.cargo/env when cargo not in PATH (ssh non-interactive)
    Mehr im Commit-Body
    Made-with: Cursor
  837. a30e38c
    fix: execution_report_to_event use incremental fill (cum_qty_before); AmendOrderParams skip order_id when None
    Mehr im Commit-Body
    Made-with: Cursor
  838. 5191d7c
    Doc: server validation steps for execution in git-only-codeflow rule
    Mehr im Commit-Body
    Made-with: Cursor
  839. 00ea2f5
    Validate script: fail on dirty tree, add SKIP_RUN, server instructions
    Mehr im Commit-Body
    Made-with: Cursor
  840. b793739
    Execution layer: migration, execution/*, db execution tables, runner, audit fixes, server validation script
    Mehr im Commit-Body
    - migrations/20260310120000_execution_schema.sql (orders, events, fills, positions, realized_pnl)
- src/execution: intent, choke, order_state, kraken_adapter, state_machine, runner, exit (submit_exit_order)
- src/db: execution_orders, order_events, fills, positions, realized_pnl
- exchange: amend_order (messages + auth_ws), ExecutionReport.cl_ord_id
- CLI run-execution-once; correlation by cl_ord_id/exchange_order_id; data array or object; reconcile path
- positions: avg_entry only when increasing; realized_pnl on partial/full close
- logging: order_ack cl_ord_id, order_submit queue_decision
- docs/EXECUTION_AUDIT.md; scripts/validate_execution_on_server.sh (git-only codeflow)

Made-with: Cursor
  841. fd9c0cb
    fix: decode AVG(a) as Decimal, PERCENTILE_CONT p50/p95 as f64 in persist_pair_summary_24h
    Mehr im Commit-Body
    Made-with: Cursor
  842. 5d2bc17
    fix: decode p50/p95/a as f64 in persist_pair_summary_24h (PostgreSQL PERCENTILE_CONT returns FLOAT8)
    Mehr im Commit-Body
    Made-with: Cursor
  843. e64ed78
    fix: observe lifecycle — fractional OBSERVE_DURATION_HOURS + SIGTERM for clean ended_at
    Mehr im Commit-Body
    Made-with: Cursor
  844. e157c5a
    Pro engine: readiness, cost/surplus, live validation, post-trade layers, deploy /srv/krakenbot
    Mehr im Commit-Body
    Made-with: Cursor
  845. e4182b3
    Initial Kraken bot implementation
    Mehr im Commit-Body
    Made-with: Cursor

Vollständiger Website-Changelog: docs/CHANGELOG_FINALISATIE.md