the machine room
the engine is now switched off for new risk on both sleeves — and the audit that got it there found that a switch named for a chat app had also been silently disarming the exits on positions already open.
what it did this week
The engine trades on its own and grades itself nightly. Here is the closed-out week in one look, then the thing that worked, the thing that didn't, and the number the ledger has been carrying for eleven weeks without anyone reading it correctly.
the win closed by a clock — which is exactly what is wrong with it
The Coherent scalp opened and closed on Aug 26 for +$2.92, exited by scalp_eod_flatten: the rule that closes any short-term position before the bell so nothing is carried overnight. No judgment, no discretion, a clock and a rule — and on the stock side that machinery is the part that reliably works. Now put the two trades of the week side by side. The winner was closed for being late in the day at +0.42R. The loser was closed for being wrong at −2.47R. One exit was a time limit, the other a stop; the time limit fires no matter where the position is. Look further back and it is not an accident. The energy trade closed +0.82R on eod_squareup_stale_laggard, the rule that flattens a carried position that hasn't gone anywhere. The chip trade closed +0.28R on a stop that had been trailed just above cost. Four of the five stock winners in the ledger were ended by a rule about the clock or about cost, not one about the idea being finished — and the fifth is the tell. The Aug 5 cyber trade closed +1.96R on vwap_trail_break, a genuine trailing exit that let the position run until the market said stop. It is the sleeve's largest winner by a factor of two, and it is the only one that was allowed to find its own end. That is a defensible way to build an engine — it is how the sleeve survived a 17-trade losing record with a total loss under two hundred dollars — but it caps the right side of the distribution at roughly one unit of risk while leaving the left side open to whatever the stop lets through. The win block is where that shows first, so it belongs here rather than buried in the diagnosis.
the dollars were known in advance — the switch that turns off the exits was not
The $295 was written down before it happened: a bet with an earnings report sitting inside the option's life, taken because the volatility check couldn't read a field and skipped itself, closed Aug 24 on the price at which the engine had recorded that its read was wrong. The machinery did what it said. The entry was the error and it was already on the record. The week's real finding is a control, not a trade. Going through the halt logic line by line turned up this: step 0 of both trading runs, and the first line of the between-tick stop monitor, read [KILLED] and EXIT — no work, no trading on the presence of a file named .kill_all_discord_posts. A flag named for turning off chat messages. Touching it disarmed every exit, trail, scale-out and synthetic stop on every live position. The stop monitor is the worst case, because a long option has no protective order resting at the broker — the stop is software or it does not exist. So the switch a person would reach for to quiet the notifications was, on that path, the switch that removed the only protection an open contract had. A second version of the same mistake sat next to it: the stock run treated a failed rhx doctor filesystem check as "place no order at all, including protective ones" — turning a warning about whether a local ledger file survives a power cut into an unhedged position at the broker. Nothing was lost to either one. Nobody touched the file in a week with open puts; that is luck wearing the costume of a result. The contract is now stated identically in five places — both trading runs, the stop monitor, the execution gateway, and the order gate at the broker edge: a halt blocks new risk and never blocks reconciliation, protective placement, cancelling a conflicting protective order, or a risk-reducing exit. The gate classifies buy-versus-sell before it applies any switch, so under a halt it denies the buy and allows the sell, the protective stop, and the cancellation that has to precede an exit. Every new test is a pair — the entry is refused and the exit on the same tick still fires — because asserting only that no entries happened would stay green if a change froze the whole engine, which is the exact bug. And the second loss, the Intel put, is where the grading caught itself. The tracker computed −$207 from the price the exit order was sent at. The broker's execution record says it filled five cents better, at $2.58: −$202. The post-mortem's instruction had been to "fill in any P&L the tracker missed" — populate-if-absent wording, which would have accepted the wrong number, written it into the trade ledger, and from there into next week's conviction map. It now reads: the broker fill is authoritative and overrides the tracker, with the slippage recorded beside it rather than absorbed. Five dollars on one trade is nothing. Five dollars biased the same direction on every exit, feeding the thing that decides how much to bet next time, is not.
the sleeve does not have a hit-rate problem — it has a payoff problem, and the exits are the cause
The number that reframes eleven weeks of stock trading is one line in the nightly grader. Across 17 graded trades: average win +0.726R, average loss −1.431R. That is a realized payoff ratio of 0.507 — every winner pays about half of what every loser costs. The engine was designed for 3.0, and the gap is the whole story, because payoff and hit rate are two ends of the same requirement. At a 3-to-1 payoff the sleeve needs to be right about 25% of the time to break even. At the 0.51 it is actually getting, it needs 66.3%. It is running 31.2%. Read that in the right order: the hit rate is roughly what a 3-to-1 design would need, and the sleeve is losing anyway because the payoff never arrived. Chasing a better hit rate here is optimising the variable that is already fine. The cause is in the win block above. Winners are ended by time rules — the end-of-day flatten, the stale-laggard square-up — which close a position for being old regardless of where it is. Losers are ended by stop rules, which close a position at the full distance the risk model allowed, and occasionally further: the Meta scalp came in at −2.47R because the entry filled between runs, no resting broker stop was ever attached, and the position sat 3 hours 16 minutes past its own stop before a software check caught it. Asymmetric exits produce an asymmetric payoff. There is no mystery in it. What the counterfactuals say, and why they don't get a vote yet. The engine now grades 102 trades it declined to take. Two of the seven blocking reasons stand out: positions refused for lack of budget would have won 56% of the time at +0.92R average, and positions refused by the setup-quality gate would have won 53% at +0.88R. Every other gate's rejects lose money, which is what a working filter looks like. The tempting conclusion is that the sleeve is too tight and too poor. It was tested and it is wrong. Last week's replay of three months at looser limits produced ten trades and −$3,580 against twelve trades and +$468 at the current settings — loosening produced fewer trades, because bigger positions eat the budget faster, and much worse ones. Counterfactual fills carry no slippage, no queue and no size, which is exactly why they never feed the conviction map. They are a question, not an answer. So the fix is on the exit side, and it is specific: a position that is beyond +1R when a time rule comes due should convert to a trailing exit rather than a market close, so the right tail is bounded by the market rather than by the clock — which is precisely what the +1.96R trade already demonstrates, on a sample of one. That goes in as a logged counterfactual first — trail-versus-flatten written to the shadow ledger on every time-based exit — because the same replay discipline that killed the loosening argument applies to this one.
what changed in its head this week
it marked down every bucket it trades, and then noticed it has only ever traded one kind of tape
Three things it logged. One — the stock grader now docks five categories, and they are the whole engine. Each is a point off the confidence assigned next time: the swing profile (hit rate 0.231, average −0.723R over 14), chips and AI (0.600 / −0.552 over 5 — note the hit rate is fine and the average is not, which is the payoff problem again), cybersecurity (0.200 / −0.227 over 6), its most common signal stack, gap-plus-relative-strength-plus-VWAP (0.333 / −0.375 over 7), and trading in a risk-off tape (0.312 / −0.707 over 17). That last one is not really a category. All 17 graded trades happened in a risk-off reading — the sleeve has never traded any other regime, so "risk-off is weak" is arithmetically identical to "the sleeve is weak," and it should not be allowed to act like an independent finding. It is flagged as such rather than quietly divided out. Two — the options grader agrees from the other side. Its four penalties are buying calls, the swing profile, the convergence-plus-flow-plus-sector-rotation stack and tier-2 regime — the same operating style, reached independently by a different ledger. When two graders that share no code converge on the same list, the list is probably right. Three — the counterfactual exits stopped disappearing at the worst moment. The shadow grader pairs a would-have-been exit against what actually happened, and it had a blind window: a position that closes at the broker on Friday is not written into the ledger until Monday's post-mortem, so over the weekend it exists in neither the ledger nor the open book, and the observation was simply dropped. Intel would have been the first casualty. It now falls back to the tracker's own closed record, tagged with where the price came from and held provisional, so an approximate observation is never counted toward a promotion threshold. Losing the evidence is worse than approximating it — these rows are the only argument a shadow rule will ever have.
fix the right tail, close the stop latency, and build the spread that has now been promised four times
One — the payoff, not the hit rate. The trail-on-time-rule change goes in as an observation only: every time-based exit logs what a trailing stop would have returned against what the flatten actually returned. At roughly two stock trades a week that evidence accumulates slowly, and slowly is the honest answer. It graduates on live rows or it does not graduate. Two — close the gap that made −2.47R possible. Two things left the Meta position unprotected: a passive buy order that rested past the end of the run that placed it, and a between-tick monitor that is blind in the final thirty minutes of every session. The first is now structurally fixed — an entry must be priced at least ten basis points through the offer, checked before anything durable is written, refusing outright when no live quote is available, so a fill is immediate or there is no order. The second is still open and is the more valuable of the two, because the last half hour is when a position most needs watching. Three — defined risk instead of naked directional bets. Ten of the sleeve's twelve graded trades were single long calls: an instrument that loses value every day it exists and pays for volatility twice, once buying it rich and again when it collapses. The structural answer is a two-leg spread, where the second leg is sold to fund part of the first, cutting both the daily bleed and the volatility exposure. It has now been named in four consecutive logs and remains unbuilt, because the live order path can only place single legs. It gets built in September or it comes out of the plan — a fix scheduled four times and started zero times is not a plan, it is a sentence that makes a log feel finished. Alongside it, the entry filter the twelve trades keep pointing at is tenor. Sorted by how many days the option had left to live when it was bought: 0–7 days, zero wins in two. 8–20 days, zero in two. 21–32 days, zero in four. 33 days or more: three trades, two wins. No option bought with fewer than 33 days of life has ever won, and both winners had 35 and 37. Energy is the control case because it traded both ends — a short-dated call lost, a 29-day call lost, and the only two winners in the sleeve's history were the 37-day and 35-day trades in the same sector on the same signal family. The mechanism is unglamorous: an option loses value every day it exists, faster the closer it gets to expiry, and the entry logic is a swing thesis that needs days or weeks to be right. The floor allowed contracts with as little as two days left, so it was buying a two-day instrument to express a two-week idea. The 30-day floor is in observation mode — it tags every entry with whether it would have been excluded and blocks nothing. It would have excluded eight of the nine losers and kept both winners, which is exactly the shape of a result fitted to its own sample, so it earns its way in on live trades or not at all. Four — the gates. Three of six are closed with machine-checked criteria; the fourth cannot be closed from a keyboard, because it requires placing real orders in a rehearsal that needs explicit per-drill approval. The freeze holds until then, and the freeze is the right posture: an engine losing on structure should not be adding structureless positions while the structure is being rebuilt. How we'll know it worked next Sunday: (a) the shadow-exit ledger carries at least one non-provisional row; (b) the trail-versus-flatten counterfactual is logged on every time-based stock exit that occurs; (c) the scheduled job that has never fired once since it was created either runs or is deleted — a task with a null last-run date is not a task; (d) no scheduled job still describes itself as taking live entries while both sleeves are frozen; and (e) the PDD put either exits on a written rule or is still held with the reason on the record.
the week's system changes
Three days spent reading the machinery instead of adding to it: a safety net that had been unplugged for weeks, a switch that never existed, a gate that was half a switch pretending to be a process, and a Sunday audit that reads the whole estate for statements that contradict each other.
the safety net was reading an empty room
A long option has no protective order sitting at the broker — the stop is software, re-checked on a schedule, and between the main trading runs that job belongs to one small exit-only monitor that wakes every thirty minutes. To do its work it needs one number per position: what was paid for the option. It reads that from the day's position file. It was reading the wrong folder. The path in the live copy of that job pointed at a directory that exists but holds three orphaned files from , 6th and 18th; every real position file lives one level up. The lookup found nothing, every option arrived with no purchase price, and the monitor logged — correctly and uselessly — "premium stop NOT evaluated this run." It failed safe rather than inventing a stop, but for weeks the between-run safety net on every option the account held was doing nothing at all. The cause was two copies of the same file disagreeing: the scheduler keeps its own copy of each job, the working copy lives in the main folder, and on this job they had drifted with the broken one being the one that runs. It was fixed Thursday and it paid on Friday morning. At 10:03:57 ET on Aug 28 the monitor closed the Intel put — not on the premium stop, but on the underlying invalidation, a check that runs only when it can read the price at which the trade is declared wrong. That number, 92.13, sits in the file it could not open 24 hours earlier. Intel had traded to 92.62. Before the fix that branch was skipped entirely and the position would still be open.
one sleeve was contained and the other only looked like it
The stock engine has had a single master flag since late July, enforced in three independent places on the entry path. The options engine had nothing of the kind — only per-candidate quality gates, every one of which is designed to sometimes pass. The two sleeves were not equally contained and no test said so, which is the harder half of the problem: an absence does not fail anything. The new flag defaults off, is off in the always-merged safety block of the settings file, and is checked at three points including the broker edge. It fails closed by construction — it accepts only an explicit true, so a missing key, an unreadable settings file, an empty string, a zero, the word "maybe", a list, or a half-merged settings block all freeze. That last case is the one worth naming: a partially written block is a non-empty dictionary, and a non-empty dictionary is true in Python, so the obvious one-line check would have gone live on a corrupted file. Exits, trails, take-profits, stop deferral, holds and reconciliation are untouched, and a frozen session now reports itself as MANAGE_ONLY in its own decision row, so it cannot be mistaken for a quiet one. The open PDD put stays fully sellable.
a setting that had been switched on since the file was written, and read by nothing
The third of six entry gates says: no entry order may still be resting when the run that placed it ends — the exact failure that left the Meta fill unprotected for three hours. Half of it was built, tested and working: any unfilled remainder was cancelled at sixty seconds and the condition raised if an order was still live at return. The other half did not exist. A setting named ENTRY_MUST_BE_MARKETABLE had been declared true since the module was first written and was read by no code anywhere in the repository. Its only test asserted that the setting said true — which tests the flag, not the behaviour, an off switch wearing a process's clothes. And it was the half that mattered more: cancelling after sixty seconds bounds how long a resting entry can outlive its run; a marketable entry is why it never rests. Meta rested 8m35s on a passive limit; Coherent rested 4m38s. It is enforced now, before the durable write, so a passive entry never becomes an intent at all. Closing the gate does not close the residual, and the test that documented the residual was rewritten rather than deleted — a fill landing in the final seconds of a dying run is still uncovered, because no observer exists in that window, and what actually bounds it is the size cap: one whole share, six hundred dollars maximum. The rewritten test pins those, with a message saying that if a persistent broker process ever appears in this codebase, that claim is stale and has to be rewritten.
the estate now gets read for sentences that contradict each other
The weekly health run checks 148 scheduled tasks — 116 enabled, 32 deliberately off — and this week 113 were on schedule with zero stale, weekend and market-hours idleness correctly excused. One failure, and it is a good kind: a weekly merge job has a valid schedule and a null last-run date. It has never fired, not once, since it was created. A task that has never run is indistinguishable from a task that does not exist, except that it still appears in every count. The more useful half is the prompt audit, which reads all 235 registered tools against each other and reports statements that cannot both be true. 22 open high-severity findings, and the top one is this week's own change catching up with its documentation: two trading jobs still describe themselves as taking active entries while both sleeves are frozen. That is the same shape as every defect in last week's log — two copies of one truth, drifting apart, with nothing comparing them — except this time the thing comparing them is a scheduled job rather than a loss. One honest caveat on the numbers. The report claims 106 findings resolved and 51 new. Most of that is not real: the model-generated findings are identified by a hash of their own wording, so a finding that is still perfectly true but phrased differently this week reads as resolved and reappears as new. The deterministic findings, which have stable identifiers, carried across unchanged at 105. The audit flagged its own counting method as a defect, which is the behaviour that makes the rest of it worth reading.
the three verticals, in brief
The newsletter's demand-and-credit read on semiconductors, cyber, and construction — this week's headline, and the dated checkpoint that would confirm it or crack it.
the price increases are decelerating, and the reason is the one this pipeline has been waiting a year for
Conventional DRAM contract prices are still forecast up 13–18% quarter on quarter in 3Q26, with NAND up 10–15% and Samsung reported to be seeking as much as 20%. Read against the roughly 60% jump recorded in the second quarter, that is a sharp deceleration inside a still-rising price. The reason given is the important part. The slowdown is being attributed not to supply improving — it has not; suppliers describe third-quarter conditions as extremely tight, and mainstream DDR4 spot set a record $42.45 per chip on Aug 7 — but to consumer-electronics makers being unwilling and unable to absorb another round of increases. That is demand refusing a price, which is the mechanism the call in the scorecard was built on and the thing this column has been looking for since. It arrives, awkwardly, while that call sits ungraded.
the question set two weeks ago got answered, and the answer was no
This column asked whether the Aug 19 selloff — a roughly 30% Zscaler drawdown that dragged CrowdStrike −7% and Palo Alto −5% — was a company-specific problem or a re-rating of the whole group. CrowdStrike reported on Aug 26 and the group answered: revenue $1.47B, up 26%; subscription revenue $1.40B, up 27%; annual recurring revenue $5.84B, up 25%, with $332.8M of net new ARR in the quarter; the full-year net-new-ARR growth outlook raised to 34% at the midpoint and full-year revenue guided to $5.991–6.011B. CNBC recorded the stock's best single day on record and a sector-wide rally the following session. A group trading on a broken multiple does not do that on one company's print. The de-rating thesis is dead; the dispersion thesis replaces it — the same tape rewarded the accelerating name and punished the decelerating one within a week.
the freeze got an end date, which finally turns a moratorium into a measurable test
The Texas data-center audit ordered on Aug 3 — under which no new project advances through the ERCOT interconnection process — now has a stated timeline: officials expect to complete it by the end of 2026, covering up to about 300 proposed data centers. The denominator is unchanged and still remarkable: ERCOT is holding roughly 474 gigawatts of interconnection requests, more than five times its record peak demand, of which data centers are about 90%. An end date is what makes this gradeable. A freeze without one is a queue of unknown length; a freeze with a completion target converts into an arithmetic question — how much of the 474 GW is still in the queue when the audit reports, and how much quietly left while it ran.
And the newsletter, on itself: three calls sit open. The DRAM settlement call was due and is now 46 days overdue — the fifth consecutive log to carry the same debt, and this week the evidence it was reaching for showed up in the price data while the call itself stayed ungraded. The construction working-capital call comes due tomorrow, and there is no version of the house rule under which it survives another week unresolved. The Dell margin call resolves on the September print, inside its Sept 15 horizon. By the rule — if you only ever see the wins, that's a highlight reel — this log leads with a −$505.59 week and a halt switch that would have turned off the only stop a long option has. It cannot also be the log that lets a July deadline pass for the fifth time without a verdict. Next week that line either says graded or this column is running exactly the asymmetry it exists to refuse.