[C] Atlas Ruling — FLAG 030 Boundary + Injection Sequence Locked

To: Orion (he/him) CC: Vesper (she/her), Katja (Captain) From: Atlas (he/him) Date: 2026-04-17

1. Issue 1 — FLAG-030 Boundary Logic¶

Original spec: Apply capital_events WHERE ledger_seq > last_ledger_in_fills

Orion's challenge: Correct.

Final ruling: REVISE SPEC — Orion is correct. USE: apply ALL capital events (no boundary filter).

2. Why the Original Spec Was Wrong¶

Original assumption: inventory_ledger.new_balance already reflects some capital events. That assumption is false.

Reality: - inventory_ledger = fills-only accumulation - capital_events = never applied anywhere

So last_ledger_in_fills is NOT a valid boundary. Capital events before the last fill are not included in the ledger. Filtering them out by boundary would permanently drop them from state.

3. Correct Model (Now Locked)¶

state = (fills-derived ledger state) + (ALL capital deltas)

No filtering. No sequencing condition.

4. Implementation Directive¶

Replace get_capital_delta_since(ledger_seq) with get_capital_delta_total(asset).

Apply AFTER fills reconstruction.

5. Idempotency — Confirmed¶

rebuild() is disk → memory, no mutation of stored ledger. rebuild(rebuild(state)) = state holds naturally.

6. Logging Requirement¶

Only log when delta ≠ 0:

Applied capital delta:
  RLUSD = X
  XRP   = Y

No noise logs.

7. Issue 2a — Sequence Reorder (FLAG-008 First)¶

Orion's proposal: ask=14 → FLAG-008 → FLAG-030 → FLAG-031 → ...

Decision: APPROVED.

FLAG-008 is small (~10 LOC), independent, removes a known silent failure path. Provides a cleaner rebuild baseline before testing FLAG-030/031. No downside.

8. Issue 2b — FLAG-032 Addition¶

Mismatch: capital_events = source of truth (future); valuation_snapshots.net_deposits_rlusd_cum = legacy path (unknown source). Post-injection, UI shows one number, accounting returns another — at the exact moment the first real capital event occurs.

Decision: FLAG-032 = MANDATORY PRE-INJECTION GATE.

9. Scope of FLAG-032 (Keep It Tight)¶

This is NOT a dashboard refactor. This is: trace + align net_deposits source of truth.

Required: 1. Identify where net_deposits_rlusd_cum is written 2. Confirm it derives from capital_events OR will be updated to match 3. Ensure get_net_deposits_rlusd() == displayed NET DEPOSITS

10. Updated Final Sequence (LOCKED)¶

1. ask=14 confirmation session
2. FLAG-008  (WAC hard-fail)
3. FLAG-030  (apply ALL capital events in rebuild)
4. FLAG-031  (basis accounting model)
5. FLAG-032  (net_deposits alignment)
6. dry-run on DB copy
7. inject $50
8. size 10 → 15 RLUSD

11. Orion — Execution Guidance¶

For FLAG-030: - Do NOT introduce partial filters - Do NOT rely on ledger_seq - Treat capital_events as a full-state adjustment layer

For FLAG-032: - Do NOT patch the display - Fix the source path - Confirm single source of truth

12. Vesper — Assessment¶

Your read was correct on both issues. Boundary flaw: real. FLAG-032 importance: high. Escalation timing was exactly right.

13. Final Architecture¶

fills               → reconstruct trading state
capital_events      → adjust total state
basis_delta         → define performance denominator
valuation_snapshots → must align to capital_events

This was a high-quality challenge by Orion. He identified a hidden assumption failure before it became a silent accounting bug. That is exactly the behavior we want in the implementation layer.

Proceed with revised design.

— Atlas (he/him)