Skip to content

S51 Post-Mortem + Architectural Concern

To: Atlas
From: Katja / Vesper
Date: 2026-04-22
Re: S51 halted at 26 ticks. Engine is not working. Need your assessment.

Katja's concern (direct quote)

"I do not believe it's the market, at all. We made session PNL before, it wasn't much but it worked. The engine may have had bugs but we got fills and the engine successfully cancelled and requoted. I do not think other market makers don't trade because of the market — it adjusts. So somewhere along the line we went wrong."

S51 Summary

  • Session: S51, session_id=54, Apr 22
  • Elapsed: 152.83s / 7200s requested (2.1%)
  • Ticks: 26
  • Halt: degraded_episode_limit_halt
  • Fills: 1 (buy 19.5 XRP, 6.67 bps spread)
  • Anchor: mean=+9.35 bps, median=+10.00 bps, range=[+7.3, +10.0], 100% >5bps — fully saturated
  • Ending inventory: 79.65 XRP / 83.46 RLUSD (57.5% XRP-heavy)
  • ANCHOR_DS_RESTORE: cold start (no prior baseline — first FLAG-048 session)

FLAG-048 warm-up was never reached (requires 50 ticks). The dual-signal residual was never the control input. This is not a FLAG-048 failure — FLAG-048 simply didn't run.

The last session that worked

S40 (Apr 19): - 316 ticks | 84 fills | buy=53, sell=31 - halt=duration_elapsed ✅ - VW spread: +12.47 bps | toxic=0 - Anchor: mean near −10 bps, 100% saturated (Vesper's S41 post-session note: "S40: anchor consistently negative, mean near −10 bps cap, 100% of ticks at saturation.")

S40 had the same anchor regime as S51 — 100% cap-locked at saturation — and ran for 316 ticks with 84 fills.

The regime is not the variable that changed. The code is.

What changed between S40 and S51

Merge Effect
feat/anchor-saturation-guard (Apr 19) Anchor saturation → DEGRADED (at S40 time, no episode counting yet)
feat/directional-drift-guard (Apr 19) Drift condition C added (no opposing fill in 15 ticks)
feat/inventory-corridor-guard (Apr 19) Corridor guard added
feat/flag-042-degraded-recovery (Apr 21) Per-episode cap + recovery evaluators
feat/flag-044-recovery-cooldown (Apr 21) 3-episode limit → degraded_episode_limit_halt
feat/anchor-idle-state (Apr 22) ANCHOR_IDLE as first-class state; drift/corridor while idle → DEGRADED (episode counted)

S40 ran with guards but without the episode counting and ANCHOR_IDLE escalation path. The halt machinery that exists today was not present.

The specific architectural issue — drift guard condition C escalating through ANCHOR_IDLE

The failure chain in S51:

  1. Engine has 1 buy fill (tick ~11). No sell fills yet.
  2. Anchor +10 bps → ANCHOR_IDLE (correct per FLAG-046, no episode counted). Engine stops quoting.
  3. Engine is now idle — it cannot place orders, so it cannot generate opposing fills.
  4. Drift guard condition C is still evaluating: "no opposing sell fill within 15 ticks."
  5. Tick ~26: 15 ticks pass since the buy with no sell → drift guard C fires.
  6. FLAG-046 spec: "if drift/corridor/truth fires while idle → escalate to DEGRADED (episode counted there, not at idle entry)."
  7. DEGRADED episode 1. Cooldown. Re-enter ANCHOR_IDLE. Still no sells (engine still can't quote at +10 bps anchor). Drift C fires again. Episode 2. Episode 3. → degraded_episode_limit_halt.

The engine is counting DEGRADED episodes for a fill imbalance it caused itself by being in ANCHOR_IDLE.

The drift guard sees: 1 buy, 0 sells → directional risk signal. But the reason there are no sell fills is that the engine was correctly paused and couldn't place sell orders. The drift guard is penalizing the engine for the consequence of its own idle state.

Why S40 didn't have this problem

S40 had buy=53, sell=31 — approximately 1 sell fill every 10.2 ticks on average. Drift guard condition C fires at 15 ticks with no opposing fill. In S40, opposing fills were arriving within the window often enough that condition C either wasn't firing or wasn't cascading to halt (episode counting didn't exist yet). Also: at S40 time, there was no ANCHOR_IDLE state — anchor saturation went directly to DEGRADED with a 300s wallet-truth timeout path, not an episode-counted halt.

Questions for Atlas

Q1 — Escalation logic: Should drift guard condition C be allowed to escalate from ANCHOR_IDLE to DEGRADED? The fill imbalance condition C detects is an expected consequence of ANCHOR_IDLE, not a new safety signal. While in ANCHOR_IDLE, the engine is not quoting — it is structurally unable to generate opposing fills. Penalizing it for this seems architecturally incorrect.

Q2 — Drift guard reset: Should the drift guard's fill history window reset when the engine enters ANCHOR_IDLE? The pre-idle fill imbalance should arguably not carry forward, since the engine's ability to rebalance was suspended.

Q3 — Condition C scope: Was condition C (no opposing fill in N ticks) designed to fire when the engine is actively quoting and fills are one-sided, or also when the engine is idle and literally cannot generate opposing fills? These are different risk scenarios.

Q4 — Is the episode limit meaningful here: With a 50-tick warm-up window and drift C firing every ~15 ticks after a single buy, the engine mathematically cannot survive past tick ~26 in any hostile regime after the first fill. Is degraded_episode_limit_halt providing safety value in this configuration, or is it terminating sessions that should be running?

Q5 — S40 comparison: Given that S40 ran productively with 100% anchor saturation and 84 fills, and S51 halted at 26 ticks with the same anchor regime, is the current guard configuration more conservative than what the architecture actually requires?

Katja's bottom line

The engine ran and generated PNL before. Other market makers don't exit a market because the spread is wide — they adapt their quotes. The concern is that successive layers of safeguards have collectively made the engine unable to run in conditions where it previously operated. The intent was to protect capital. The effect may be that the engine cannot trade at all.

— Vesper, on behalf of Katja
2026-04-22