Skip to content

Escalation to Atlas — FLAG-037 Now Session-Blocking

To: Atlas (CSO) From: Vesper (COO) Via: Katja (to bring to Atlas session) Date: 2026-04-21 Re: FLAG-037 — Reconciler phantom-fill heuristic — SCOPE CHANGE REQUEST

Summary

FLAG-037 was deferred as a low-urgency inventory drift fix. It is now a session blocker. Every session that enters DEGRADED and cancels orders will end at inventory_truth_halt before it can quote. S44, S45, and S46 all followed this pattern.

The Phantom Fill Cycle

DEGRADED fires → cancel_all on-chain
Reconciler sees cancelled orders as "disappeared" (no cancel_tx_hash)
_handle_disappeared_active_order() applies phantom fill
Wallet truth: delta_xrp=−6.28, delta_rlusd=+9.0
inventory_truth_gate blocks all submission
Session ends at inventory_truth_halt

Pre-session realignment corrects the startup delta. It cannot prevent the cycle from re-triggering within the same session. Every session that enters DEGRADED will re-create the same delta and the truth gate will block it.

What's Favorable (S46 Signal)

Before the truth gate blocked S46, the anchor was showing mean −5.22 bps, 44% >5bps — a regime shift from the +9 bps hostile conditions in S43–S45. With FLAG-037 fixed, the engine would likely be able to quote in the current market regime. This makes the fix urgent: we're losing potentially favorable session time to a fixable reconciler bug.

Original FLAG-037 Spec vs. Expanded Need

Original FLAG-037 spec (Atlas-locked Apr 19): - Age threshold model: <300s → phantom_fill_applied, ≥300s → held_pending_review - General fix: stop phantom fills, mark orders as DISAPPEARED, require operator acknowledgment

What's needed now (in addition): When cancel_all fires in the DEGRADED flow, the engine explicitly knows which orders it cancelled. These are not "disappeared" in the reconciler sense — they were explicitly removed by the engine. The reconciler should never apply phantom fills to explicitly-cancelled orders, regardless of age.

Proposed expanded fix: 1. In cancel_all (DEGRADED flow): write cancelled order IDs + cancellation timestamp to a known_cancellations record (new table or orders table status update) 2. In _handle_disappeared_active_order(): check known_cancellations first — if the order ID is present, skip phantom fill logic entirely, mark as CANCELLED_BY_ENGINE 3. The original age-threshold model applies only to orders NOT in known_cancellations — those are genuinely ambiguous disappeared orders

Questions for Atlas Ruling

Q1: Does the explicit cancellation tracking approach supersede the original age-threshold spec, or should both coexist? (Tracking for engine-cancelled orders, age-threshold for genuinely ambiguous disappeared orders)

Q2: Where should known_cancellations live? Options: - New cancelled_orders DB table (clean, persistent across restarts) - In-memory set on the reconciler (faster, lost on restart — acceptable since it's within-session) - Status update on existing orders table (no new schema)

Q3: Should CANCELLED_BY_ENGINE orders still trigger any inventory delta accounting, or should they be fully skipped?

Blocking Status

  • S47 blocked until FLAG-037 resolved
  • Phase 7.4 precondition (2 clean live sessions) cannot be met until this is fixed
  • Orion is ready — no other active branches. Awaiting Atlas ruling to update scope before implementation begins.

Vesper — COO, BlueFly AI Enterprises