Vesper Review — fix/reconciler-disappeared-order-conservative¶

To: Orion (he/him), Katja (Captain) From: Vesper (she/her) CC: Atlas (he/him) Date: 2026-04-19 Status: APPROVED — apply and merge

Verdict: APPROVED¶

10/10 tests green. 87/87 regression green (10 pre-existing test_reconciler_anomaly_log.py teardown errors, not introduced by this branch). Spec compliance confirmed on all critical points. HOLD resolved by C4. One apply instruction correction required (below) — do not use Orion's apply command as written.

Spec Compliance¶

Age gate placement: After cancel-race short-circuit, before _apply_full_fill. Young orders use the pre-FLAG-037 path byte-for-byte. Old orders are gated before any side effects. Correct.

Fail-closed on age_seconds=None: Parse failure → held_pending_review. Atlas invariant applied correctly. Correct.

held_pending_review discriminator (Pattern A): Additive field on ReconciliationResult. Main loop checks recon_result.held_pending_review > 0 and calls _enter_degraded_mode("reconciler_held_pending_review"). Correct per Q4 ruling.

WARNING log split: Three distinct messages (phantom / held / age-unknown) with structured extras including order_id, age_seconds, age_threshold_seconds. Correct per D3 ruling.

Boundary (age == threshold → held): >= inclusive per spec. Verified by test #7. Correct.

Cancel-race short-circuit unchanged: Age gate does not run when cancel_tx_hash is not None. Verified by test #8. Correct.

enabled: false escape hatch: Old orders take phantom path when disabled. Verified by test #6. Correct.

_enter_degraded_mode idempotency: Re-entry preserves degraded_since, suppresses repeat cancel-all. Correct.

Defaults: enabled: true, age_threshold_seconds: 300.0 per Atlas lock. Correct.

Deviation Rulings¶

D1 — Top-level Config placement (new deviation, not pre-approved).

Note on labeling: In the investigation memo, D1 referred to the held_pending_review field on ReconciliationResult — that was approved in Q4. The delivery's D1 is a different deviation: reconciler_conservative placed as a top-level Config field rather than under StrategyConfig as specified in Q5.

One claim is inaccurate: this does NOT match anchor/drift guard precedent — those guards live under StrategyConfig and under strategy: in YAML. Orion appears to have made a different architectural choice than was specified.

Ruling: APPROVED. The deviation is architecturally defensible. The reconciler is infrastructure, not strategy — placing its config at the top level of Config alongside other infrastructure concerns is reasonable and is internally consistent throughout the implementation (all references use config.reconciler_conservative). Functionally correct. For the record: future reconciler-related config blocks belong at the top level, not under strategy:.

D2 — Fail-closed on age_seconds=None: Applied per ruling. Correct.

D3 — WARNING log split: Applied per ruling. Correct.

D4 — Branch base: Orion stacked on drift-guard commits (2277176). The drift guard is now merged to main — main at bef819e includes those commits. No rebase needed. Functionally equivalent to branching off main as ruled.

Test #10 — `inspect.getsource`¶

The source-inspection approach is unusual but acceptable here. The escalation wiring is short literal code whose only realistic failure mode is accidental removal or reason-token drift — exactly what a source check catches. Orion's point about the _tick fixture complexity is valid. The approach is consistent with the narrow scope of the wiring check. Accepted as-is.

HOLD Resolution — C4 teardown fix¶

C4 (0114101) applies the correct LIFO teardown pattern: try/finally with explicit sm.close() before tmpdir.cleanup(). This releases the SQLite file handle before rmtree runs, eliminating the Windows PermissionError. Functionally identical to the addCleanup(sm.close) form from anchor guard C5a. test_reconciler_anomaly_log.py correctly left untouched — those errors are pre-existing debt. HOLD resolved.

Expected on Windows: 87 passed, 10 errors (anomaly log only). Zero errors from test_reconciler_conservative.py.

Apply Instructions — CORRECTED¶

Do not use Orion's apply command. The *.patch glob does not expand in PowerShell. Use the following instead:

cd C:\Users\Katja\Documents\NEO GitHub\neo-2026
git checkout main
git checkout -b fix/reconciler-disappeared-order-conservative
Get-ChildItem "C:\Users\Katja\Documents\Claude Homebase Neo\02 Projects\NEO Trading Engine\patches\fix-reconciler-disappeared-order-conservative\" -Filter "*.patch" | Sort-Object Name | ForEach-Object { git am $_.FullName }
python -m pytest tests/test_reconciler_conservative.py tests/test_reconciler_anomaly_log.py tests/test_ledger_reconciler.py tests/test_config.py -q

Expected: 87 passed, 10 errors (pre-existing anomaly log teardown only).

What This Means¶

FLAG-037 is resolved. The reconciler now fails closed on stale-order ambiguity — old disappeared orders trigger DEGRADED and operator review rather than silent auto-fill.

Atlas priority order (updated): - (1) feat/wallet-truth-reconciliation ✅ - (2) feat/reconciler-disappeared-order-audit-log ✅ - (3) Anchor Saturation Guard ✅ - (4) Directional Drift Guard ✅ - (5) FLAG-037 fix/reconciler-disappeared-order-conservative ✅ - (6) Inventory Corridor Guard ← next - (7) Anchor Error Telemetry - (8) Cancellation Invariant

— Vesper