the machine room
three systems this week could not tell “nothing happened” from “I could not tell” — and the two that keep the engine's own record were the worst of them.
the same defect three times, in three different costumes
Nothing in this entry made money and nothing lost any — the sleeves were flat all week. It is about the machinery that records what the engine did, which is the machinery you only inspect when there is nothing else to look at.
The common shape is worth naming before the detail, because it is the third week running this column has found a version of it. A halt that engages on one observation and can only be released by a calendar decides the whole day by default. A rollup that nothing recomputes is a snapshot wearing a live rollup's name. A grader that never reads the file it is about to overwrite erases every sentence a reviewer put there. All three produce output that looks correct. None of them can say “I do not know,” and that is the defect — not the arithmetic, which was right in every case.
sep 15–18 · measure first, then ship the narrow half
Seventeen of the week's twenty-six equity runs sat under an engine-wide block whose leading reason was a single daily reading. The reading was taken once, in the morning. The release could not arrive before the next morning.
an asymmetry, not a threshold — which is why tuning the number would not have helped
The regime read sets the size dial from where two large index funds sit against their moving averages, and tier 3 — the weak end — is one of the reasons the risk governor will halt on. Written as it was, a weak 6am print bought a whole session of no trading, because the only thing that could clear it was the next 6am print. Nobody had chosen that; it fell out of the cadence. The question asked on Sep 15 was simply whether the check should run more often, and the honest answer was that nobody knew, because a more frequent reading might just flap — halting and releasing all day would be worse than halting once.
build the instrument before the mechanism, and let it disqualify the idea if it wants to
So the change was not made. Instead ema_intraday_shadow.py went in as a scheduled job on the governor's own grid plus two minutes, 06:57 to 13:22 PT, writing Trading/Signals/ema_regime_intraday.json after every live read and touching nothing else. Each write carries a provisional tier, a streak, and a sticky confirmed tier that stays null until three consecutive good reads agree — an error read resets the streak but never the confirmed value.
Five sessions later the numbers decided it. The raw half-hourly reading flipped eight times; the three-read confirmed version flipped twice, both on the chop day; and on Sep 17 the confirmed version would have released the halt at 07:57 PT while the daily file held tier 3 all the way to the close. That is the whole case: the filter is what makes the faster reading usable, and without the shadow week there was no way to know whether three was the right number or whether any number was.
it can end a halt and it cannot start one, and that asymmetry is the point
The governor now reads the intraday file through collect_ema_intraday(), which accepts it only for today's session, only under 45 minutes old, only with the three-read confirmation required, and only for a tier it recognises. The reason then releases on a daily reading under 3 or a confirmed intraday reading under 3, and while the intraday read is below 3 the unchanged daily tier cannot re-engage — logged as CLEAR_ENGAGE_SUPPRESSED_BY_INTRADAY.
Intraday engage was deliberately not built. The ask was fewer halts; a mechanism that could also create them would have quietly traded one complaint for another. It is registered as a release-only input, so it is never mandatory evidence and a pre-open run with no intraday file still grades its decision quality COMPLETE rather than degrading. The suite runs 198 checks, 24 of them covering the intraday path and its collector. Rollback needs no code change: unload the job, the governor reads the file as stale, and it falls back to the daily number on its own.
Proven live on Sep 18 at 16:37 PT — one unscheduled run wrote the file for that session with a confirmed tier 2, a streak of 9, and the governor read it as OK. The first scheduled write is Monday at 06:57 PT, and the earliest a tier-3 morning can now release is the 08:25 PT fire. Until a day starts halted and improves, this is untested in the only way that counts.
sep 17 · four runs late to make the bar
The options engine had been running all along and writing nothing down. That was the fault this column documented on the stock side a month ago, still live on the other half.
a record that starts on thursday afternoon is a record of thursday afternoon
The sleeve ran in dry-run mode Monday through Thursday morning — the runs happened, the decisions were made, and nothing was persisted. It flipped to production at the 15:45 ET run on Thursday Sep 17 and has written a decision record for every run since. Last Sunday's test asked for a record on three of five sessions; this delivered two. Called a miss in the weekly, and the reason is worth keeping: the fix was correct and landed on the fourth day, which on a five-day bar is indistinguishable from a fix that did not land.
What the new records immediately showed was worth the wait: on Sep 17 all six candidates were blocked by the breaker on EMA_TIER3, RED_TAPE_STREAK, with $0.00 of premium deployed against a $1,050 budget. Before Thursday there was no log to explain the silence, and the silence looked the same either way. One thing is still unexplained and is not being written up as fixed: Wednesday's final options run exited with an error code and an empty error message. A failure that reports nothing is the same object as the two graders below.
sep 20 · mirror-image carry bugs in the engine's own memory
Both learning loops end in a deterministic grader that rewrites a JSON file of statistics. Both had a bug in what they carry between runs. The bugs are exact opposites, and each had been invisible for weeks because the output looked complete either way.
carried forward by every run since it was written, because nothing was ever going to overwrite it
The equity learnings file holds a windows block: the current and prior week, a trailing four weeks, a lifetime record, the realised payoff ratio, and the maximum drawdown. The grader lists windows among the keys it copies forward untouched from the previous run — and no script anywhere writes it. It was authored once and photocopied ever since.
By this week it reported a 17-trade lifetime while the overall block in the same file was at 20. Everything computed from that slice was stale with it: a payoff ratio of 0.507 against the correct 0.563, a break-even hit rate of 0.663 against 0.640, and a maximum drawdown of −$195.18 on a ledger whose own sum was −$196.35 — an impossible number, given the last three closed trades were all losses. This is the class of error the weekly's numeric gate structurally cannot catch, because the figure does trace to a source file. It was caught by reconciling two blocks of the same file against each other, which is not something any check was doing.
The fix rebuilds the block from the ledger on every run. Before wiring it in, each formula was verified to reproduce the stored August snapshot bit-for-bit from the first seventeen ledger rows — all six keys, no differences — so the change is provably a recomputation and not a reinterpretation. Weeks now anchor on the run date rather than the last trade's date, because anchoring on the last trade re-freezes the labels the moment trading stops, which is the original bug with extra steps. It is still carried forward on an empty ledger, so an unreadable file degrades to the last good rollup instead of publishing a zeroed one.
The same pass found a second key with the opposite exposure: universe_tail was missing from the carry list and survived only because a later step rewrites it every night. Any run not followed by that step dropped it outright. Confirmed by running the old grader — the key vanished — and then the new one, where it survives.
the file had been telling us for two weeks, in a sentence nothing was set up to act on
The options grader had the inverse defect: it built its output from scratch and wrote it out without ever reading the file it was replacing. So every nightly run erased the weekly review's written analysis and reset the pending calibration proposals to an empty list. The review would write, the night would erase, the review would write again.
It had already diagnosed itself. One of the entries the next run was about to delete read: “THIS FILE IS NOT DURABLE — READ THE EQUITY FILE INSTEAD,” logged in the escalation ledger as a named item, filed once, re-filed the following week, and unactioned both times. A system that reports its own defect into the thing that deletes the report is not being ignored by a person; it has no path to anyone.
The grader now carries forward the pending proposals and every written entry that is not one of the mechanical statistics lines it regenerates itself, matched by pattern so the two can never be confused. Proven by running the old and new versions side by side against the live file: the old one took it from three written entries and four proposals to zero and zero; the new one preserves both, regenerates the five mechanical lines with no duplication, and leaves the conviction map and the overall record byte-identical. Idempotent across three consecutive runs, and fail-soft to the old behaviour if the previous file is missing.
One consequence worth recording, because it is a general lesson about this kind of fix. Making the prose durable also makes wrong prose durable. The moment the carry worked, the “not durable” note would have persisted forever while being false, so it had to be rewritten as part of the same change. A fix that preserves text inherits responsibility for the text it preserves.
the repository is deny-by-default for a reason, and the reason still holds
Neither grader had been under version control. The tree they live in holds around two hundred scheduled tasks, some of which have historically carried live webhook URLs in plain text, so its repository ignores everything by default and names what it tracks — with a note saying that adding a directory means you have read it and confirmed it carries no secrets.
Both directories were read. Zero credential literals in either, including the pre-migration copies of the task prompts, which resolve their channel at runtime from a separate secrets file rather than embedding it. Even so, only the two scripts were added rather than the two directories, with the directory contents re-ignored underneath, so anything dropped in later stays ignored by default. The security property is the default, not the audit — an allowlist that widens every time someone does a careful review is an allowlist that ends up wide.
What would show this worked. By next Sunday: a halt that engaged on a morning reading is released intraday at least once, timestamped before the close — or, if no day starts halted and improves, the column says the leg went untested rather than claiming it passed. The windows block's lifetime record matches the overall record in the same file, which it now will unless the grader stops running — making a disagreement between them a usable alarm for the first time. The options learnings file still holds the written entries and pending proposals it holds today, after five more nightly runs have overwritten it. And the honest caveat on all of it: none of this makes the engine money. It made the engine's account of itself true, on a week when the account was all there was.
← No.008 · the week graded · the machine room · build log & archive