@coinrithm/mcp-trading 0.7.6 → 0.7.8

package/dist/agent/runner.js

@@ -4,13 +4,14 @@
 // are injected so the loop is fully unit-testable with no network/model calls.
 import { COINRITHM_API } from "./version.js";
 import { spotBuyCost, DEFAULT_TRIGGER_POLICY, } from "./types.js";
+import { usesCapitalSizing, prepareCapitalAction, validateCapitalAction, capitalCashCost, } from "./capitalSizing.js";
 import { decideMechanical } from "./mechanical.js";
 import { evaluateGate, noteLlmCall, estimateCostUsd } from "./gate.js";
-import { baseSymbol } from "./setups.js";
+import { baseSymbol, scanSetups } from "./setups.js";
 import { observe } from "./observe.js";
-import { buildSystemPrompt, buildUserPrompt } from "./prompt.js";
+import { buildDailyRiskBudget, buildSystemPrompt, buildUserPrompt, } from "./prompt.js";
 import { parseDecision } from "./decision.js";
-import { validateAction } from "./decisionValidator.js";
+import { validateAction, isRiskIncreasingAction, } from "./decisionValidator.js";
 import { resolvePmRef } from "./resolvePm.js";
 import { fetchQuote, executeAction } from "./act.js";
 import { makeDecisionId, makeTrace, exportRunEvidence } from "./runEvidence.js";
@@ -18,6 +19,8 @@ import { rollDay, checkKillSwitch, accrueRealized, saveState, isPermanentModelEr
 import { asObj, asNum, asStr } from "./extract.js";
 import { parseCadenceMs, sleep } from "./util.js";
 import { buildObservationReceipt } from "./observationReceipt.js";
+import { buildDecisionInputRecord, sanitizeDecisionInputRecord, unavailableDecisionInputRecord, } from "./decisionReceipt.js";
+import { attachTheses, bindThesis, forgetThesis, rememberThesis, thesisExits, thesisKey, } from "./thesis.js";
 // Independent-forecast kill-switch. Default ON: the fleet elicits + submits its
 // OWN forecastProbability on PM opens. Set HOUSE_AGENT_FORECAST_ENABLED to
 // "false"/"0"/"no"/"off" to ship pm/open requests WITHOUT the field, byte-identical
@@ -132,7 +135,7 @@ function cashConsumed(action, quote) {
 // risk is computable) and the TP is actually missing/wrong-side; a correct TP is
 // left untouched. Systemic fix for the whole free-tier 8B/instruct fleet.
 const DEFAULT_TP_RR = 1.5; // reward:risk of the substituted take-profit
-export function repairFuturesTakeProfit(action, quote) {
+export function repairFuturesTakeProfit(action, quote, capitalMinimumRewardRisk) {
     if (action.type !== "futures_open")
         return { action, repaired: false };
     const entry = quote?.entryPrice;
@@ -154,30 +157,95 @@ export function repairFuturesTakeProfit(action, quote) {
     const risk = isLong ? entry - sl : sl - entry;
     if (!(risk > 0))
         return { action, repaired: false };
-    const target = isLong
+    let target = isLong
         ? entry + DEFAULT_TP_RR * risk
         : entry - DEFAULT_TP_RR * risk;
+    if (capitalMinimumRewardRisk !== undefined) {
+        const bps = quote?.futuresFeeBps, entryFee = quote?.estimatedEntryFeeMusd;
+        if (typeof bps !== "number" ||
+            !Number.isFinite(bps) ||
+            bps < 0 ||
+            typeof entryFee !== "number" ||
+            !Number.isFinite(entryFee) ||
+            entryFee < 0)
+            return { action, repaired: false };
+        const notional = action.marginMusd * action.leverage;
+        const fee = bps / 10_000;
+        const stopRisk = (notional * risk) / entry + entryFee + ((notional * sl) / entry) * fee;
+        const required = (capitalMinimumRewardRisk + 1e-8) * stopRisk;
+        target = isLong
+            ? (entry * (notional + entryFee + required)) / (notional * (1 - fee))
+            : (entry * (notional - entryFee - required)) / (notional * (1 + fee));
+    }
     if (!(target > 0))
         return { action, repaired: false };
     return { action: { ...action, takeProfitPrice: target }, repaired: true };
 }
 // One-line, human-readable summary of an executed action for the agent's journal
 // (slice-3 memory). Compact so a few entries cost almost nothing in the prompt.
+// The thesis an open was made on, kept in the journal so next cycle's manage
+// step remembers WHY the position exists (slice 2).
+function thesisTail(t) {
+    return t ? ` on thesis: ${t.summary.slice(0, 70)}` : "";
+}
 function summarizeAction(a) {
     switch (a.type) {
         case "futures_open":
-            return `opened ${a.side} ${a.symbol} (x${a.leverage}, ${a.marginMusd}mUSD)`;
+            return `opened ${a.side} ${a.symbol} (x${a.leverage}, ${a.marginMusd}mUSD)${thesisTail(a.thesis)}`;
         case "futures_close":
             return `closed pos#${a.positionId}`;
         case "futures_set_sltp":
             return `trailed stop on pos#${a.positionId}`;
         case "spot_order":
-            return `${a.side} ${a.symbol} (${a.orderType})`;
+            return `${a.side} ${a.symbol} (${a.orderType})${thesisTail(a.thesis)}`;
         case "spot_cancel":
             return `cancelled order#${a.orderId}`;
         case "pm_open":
-            return `bet PM ${a.slug} ${a.stakeMusd}mUSD`;
+            return `bet PM ${a.slug} ${a.stakeMusd}mUSD${thesisTail(a.thesis)}`;
+    }
+}
+// Bind the thesis a successful open was made on to the position the server
+// returned ({ position: { id, entryPrice | entryProbability, side, openedAt } }
+// on both /futures/open and /pm/open, probed 2026-09-02). Returns the key even
+// when the model stated no thesis so the caller can log the gap. Spot orders
+// carry no position id, so a spot thesis is parsed but never bound.
+function bindOpenedThesis(action, responseData, asOf, quote) {
+    const pos = asObj(asObj(responseData).position);
+    const id = asNum(pos.id);
+    if (id == null)
+        return {};
+    const key = thesisKey(action.type === "futures_open" ? "futures" : "pm", id);
+    if (!action.thesis)
+        return { key };
+    const openedAt = asStr(pos.openedAt) ?? asOf;
+    if (action.type === "futures_open") {
+        return {
+            key,
+            bound: bindThesis({
+                thesis: action.thesis,
+                venue: "futures",
+                positionId: id,
+                openedAt,
+                side: action.side,
+                symbol: action.symbol.toUpperCase(),
+                entryPrice: asNum(pos.entryPrice) ?? quote?.entryPrice,
+            }),
+        };
     }
+    return {
+        key,
+        bound: bindThesis({
+            thesis: action.thesis,
+            venue: "pm",
+            positionId: id,
+            openedAt,
+            side: asStr(pos.side) ?? "yes",
+            source: action.source,
+            slug: action.slug,
+            outcomeExternalMarketId: action.outcomeExternalMarketId,
+            entryProbability: asNum(pos.entryProbability),
+        }),
+    };
 }
 // Tokens that identify the MARKET an action is on, for checking a rationale is
 // actually about it. close/sltp/cancel reference a position/order id (not a market
@@ -304,6 +372,45 @@ function blockReasonsOf(data) {
     return reasons.length > 0 ? reasons.join(",") : undefined;
 }
 export async function runCycle(deps) {
+    let record = unavailableDecisionInputRecord();
+    const capture = (input) => {
+        try {
+            record =
+                sanitizeDecisionInputRecord(buildDecisionInputRecord(input)) ??
+                    unavailableDecisionInputRecord();
+        }
+        catch {
+            record = unavailableDecisionInputRecord();
+        }
+    };
+    const notify = () => {
+        try {
+            void Promise.resolve(deps.onDecisionInputRecord?.(JSON.parse(JSON.stringify(record)))).catch(() => { });
+        }
+        catch {
+            /* private evidence must not change inference or execution */
+        }
+    };
+    try {
+        const result = await runCycleCore(deps, capture);
+        record.outcome = "returned";
+        // Non-enumerable on purpose: CLI data/results JSON and object spreads must
+        // not accidentally expose this private account/position snapshot.
+        Object.defineProperty(result, "decisionInputRecord", {
+            value: record,
+            enumerable: false,
+        });
+        notify();
+        return result;
+    }
+    catch (error) {
+        record.outcome = "runtime_error";
+        record.omissions.push("runtime_exception_after_snapshot");
+        notify();
+        throw error;
+    }
+}
+async function runCycleCore(deps, capture) {
     const { client, provider, spec, mergedProse, state, live, stateFile } = deps;
     const log = deps.log ?? (() => { });
     // One flag read per cycle governs BOTH the prompt extension and the submission,
@@ -315,6 +422,10 @@ export async function runCycle(deps) {
     const provenance = buildRunnerProvenance(spec);
     state.cyclesRun += 1;
     rollDay(state);
+    const runId = state.runId;
+    const decisionId = makeDecisionId(state.cyclesRun);
+    const captureBase = { runId, decisionId, spec, mergedProse, state };
+    capture({ ...captureBase, phase: "before_observation" });
     // Kill-switch pre-check: a disabled agent never observes, decides, or acts.
     const tripped = checkKillSwitch(spec, state);
     if (tripped) {
@@ -330,8 +441,6 @@ export async function runCycle(deps) {
             live,
         };
     }
-    const runId = state.runId;
-    const decisionId = makeDecisionId(state.cyclesRun);
     const baseTrace = makeTrace(runId, decisionId, spec);
     // Opportunity capture (kills evaluation selection bias). Post at most ONE
     // non-opened opportunity per cycle, LIVE only (dry-run never writes), best-effort
@@ -372,7 +481,18 @@ export async function runCycle(deps) {
     // OBSERVE
     const obs = await observe(client, spec, state, baseTrace);
     const observation = obs.observation;
-    const observationReceipt = buildObservationReceipt(observation);
+    const nowMs = Date.now();
+    // Slice 2: attach to each open position the thesis it was opened on (from
+    // state.theses), evaluated for THIS cycle, and drop theses whose position is
+    // gone. Before the receipt, so the hash covers exactly what the model sees.
+    // PM theses are pruned only when the pm venue was actually read.
+    const thesisMaint = attachTheses(observation, state, nowMs, {
+        prunePm: spec.venues.includes("pm"),
+    });
+    for (const key of thesisMaint.pruned)
+        log(`thesis dropped: ${key} (position no longer open)`);
+    let observationReceipt = buildObservationReceipt(observation);
+    const preThesisObservationFingerprint = observationReceipt.observationHash;
     // Reads build the observation, so its hash cannot exist before they finish.
     // From this point every durable write carries the exact decision-input receipt.
     Object.assign(baseTrace, observationReceipt);
@@ -405,6 +525,13 @@ export async function runCycle(deps) {
             ].slice(-12);
         }
     }
+    capture({
+        ...captureBase,
+        phase: "observed",
+        observation,
+        observationFingerprint: observationReceipt.observationHash,
+        preThesisObservationFingerprint,
+    });
     // Equity-aware drawdown: open mark-to-market losses trip the kill-switch too,
     // not only realized losses. Includes BOTH futures AND prediction-market books —
     // a PM-only agent (or one with a large PM stake) was previously invisible to the
@@ -464,13 +591,86 @@ export async function runCycle(deps) {
     }
     // A full observation implies /me succeeded — the auth-failure streak is over.
     state.consecutiveAuthFailures = 0;
+    // THESIS EXITS (slice 2, 2026-09-02): a futures position whose STATED
+    // invalidation is breached (price level / time stop) is closed by the runner
+    // now, before the model is asked anything: the exit the trade was designed
+    // with, on top of the server-side stop-loss / take-profit. Runs only after
+    // the kill-switch + drawdown checks above (a disabled agent never gets here)
+    // and never widens a cap: a close is risk-reducing. Dry-run plans the exit
+    // without writing. PM has no close endpoint, so an invalidated PM thesis is
+    // surfaced to the model instead (do not add; let it settle).
+    const exitPlanned = [];
+    const closedByThesis = [];
+    for (const pos of thesisExits(observation)) {
+        const why = pos.thesis?.invalidatedBy ?? "thesis invalidated";
+        const label = `${pos.side ?? ""} ${pos.symbol ?? ""} pos#${pos.id}`.trim();
+        const action = {
+            type: "futures_close",
+            positionId: pos.id,
+            rationaleSummary: `Thesis exit: ${why}`,
+        };
+        if (!live) {
+            exitPlanned.push({
+                action,
+                accepted: true,
+                code: "thesis_invalidated",
+                reason: why,
+                executed: false,
+            });
+            log(`DRY-RUN: would close ${label} (thesis exit: ${why})`);
+            continue;
+        }
+        const intentKey = intentKeyOf(action);
+        const seq = state.intentSeq[intentKey] ?? 0;
+        const idem = `${runId}:${intentKey}:${seq}`;
+        const trace = {
+            ...makeTrace(runId, decisionId, spec, undefined, `Thesis exit: ${why}`),
+            ...observationReceipt,
+        };
+        const r = await executeAction(client, action, observation, trace, idem, provenance);
+        exitPlanned.push({
+            action,
+            accepted: true,
+            code: "thesis_invalidated",
+            reason: why,
+            executed: r.ok,
+            result: r.data,
+        });
+        if (r.ok) {
+            state.intentSeq[intentKey] = seq + 1;
+            state.writesToday += 1;
+            forgetThesis(state, thesisKey("futures", pos.id));
+            closedByThesis.push(pos.id);
+            state.journal = [
+                ...(state.journal ?? []),
+                { at: observation.asOf, did: `thesis exit: closed ${label} (${why})` },
+            ].slice(-12);
+        }
+        log(`${r.ok ? "executed" : "FAILED"} thesis exit on ${label} (HTTP ${r.status}): ${why}`);
+    }
+    if (closedByThesis.length > 0) {
+        // The model must see the book as it IS now: drop the closed positions,
+        // re-scan setups (an exited symbol is no longer "held") and re-issue the
+        // receipt over the observation the model actually decides on. The exit
+        // traces above keep the pre-exit receipt they were decided on.
+        observation.openPositions = observation.openPositions.filter((p) => !closedByThesis.includes(p.id));
+        observation.setups = scanSetups(observation.watch, observation.openPositions);
+        observationReceipt = buildObservationReceipt(observation);
+        Object.assign(baseTrace, observationReceipt);
+    }
     // GATE (slice 2): only SPEND an LLM call when a deterministic trigger fires — a
     // flagged entry setup or an open position to manage. No trigger => a cheap
     // heartbeat (zero tokens). A heartbeat is neither a model reject nor a failure,
     // so it touches NO kill-switch counter; it just records the cheap cycle.
     const policy = spec.triggerPolicy ?? DEFAULT_TRIGGER_POLICY;
-    const nowMs = Date.now();
     const gate = evaluateGate(observation, state, policy, nowMs);
+    capture({
+        ...captureBase,
+        phase: "decision_input",
+        observation,
+        observationFingerprint: observationReceipt.observationHash,
+        preThesisObservationFingerprint,
+    });
     const providerName = spec.model?.provider ?? "nvidia";
     if (!gate.fire) {
         saveState(stateFile, state);
@@ -478,7 +678,7 @@ export async function runCycle(deps) {
         return {
             decision: "skip",
             skipReason: gate.reason,
-            planned: [],
+            planned: exitPlanned,
             live,
             triggerCodes: gate.codes,
             llmCallMade: false,
@@ -518,55 +718,115 @@ export async function runCycle(deps) {
         };
     }
     else {
-        noteLlmCall(state, gate.codes, nowMs);
         const system = buildSystemPrompt(spec, mergedProse, {
             includeForecast: forecastEnabled,
         });
-        const user = buildUserPrompt(observation, state.journal);
+        const user = buildUserPrompt(observation, state.journal, {
+            venues: spec.venues,
+            dailyRiskBudget: buildDailyRiskBudget(spec, state),
+            ...(usesCapitalSizing(spec) ? { capitalSizing: spec.capitalSizing } : {}),
+        });
         const tokensInEst = Math.round((system.length + user.length) / 4);
         // Prompt-size + trigger visibility in the live terminal.
         log(`prompt ~${tokensInEst} tok ` +
             `(pm ${observation.pmMarkets.length}, trades ${observation.newClosedTrades.length}, watch ${observation.watch.length}, setups ${observation.setups.length}, triggers ${gate.codes.join("|") || "none"})`);
         const res = await provider.decide({ system, user });
+        const route = res.route;
+        const actualCallMade = route
+            ? route.attempts.some((attempt) => attempt.outcome !== "deferred")
+            : res.ok || !res.deferred;
+        // Capacity deferral made no provider call, so it must not consume the
+        // runner's debounce/LLM budget or delay recovery after capacity returns.
+        if (actualCallMade)
+            noteLlmCall(state, gate.codes, nowMs);
+        const effectiveProvider = actualCallMade
+            ? (route?.effectiveProvider ?? providerName)
+            : undefined;
         // Metering: prefer provider-reported usage; fall back to a chars/4 estimate.
-        const tokensIn = res.ok
-            ? (res.usage?.promptTokens ?? tokensInEst)
-            : tokensInEst;
+        const tokensIn = !actualCallMade
+            ? 0
+            : res.ok
+                ? (res.usage?.promptTokens ?? tokensInEst)
+                : tokensInEst;
         const tokensOut = res.ok
             ? (res.usage?.completionTokens ?? Math.round(res.text.length / 4))
             : 0;
-        const estimatedCostUsd = estimateCostUsd(providerName, tokensIn, tokensOut);
+        const estimatedCostUsd = estimateCostUsd(effectiveProvider ?? providerName, tokensIn, tokensOut);
         meter = {
             triggerCodes: gate.codes,
-            llmCallMade: true,
+            llmCallMade: actualCallMade,
             tokensIn,
             tokensOut,
             estimatedCostUsd,
+            effectiveProvider,
+            effectiveModel: actualCallMade
+                ? (route?.effectiveModel ?? spec.model?.name)
+                : undefined,
+            // Direct is not necessarily BYO: the self-host runner and a non-routed
+            // hosted shared provider use this same path. Attribute only actual calls.
+            routeReason: route?.reason ?? (actualCallMade ? "configured_direct" : undefined),
+            routeAttempts: route?.attempts,
         };
         if (!res.ok) {
+            // Upstream 429s are expected provider backpressure, not evidence that the
+            // model is broken. A routed/BYO call may have reached the provider (so we
+            // retain the exact attempted model + usage receipt) and still finish with
+            // only capacity failures. Treat that exactly like a local capacity defer:
+            // no action, no fallback invented here, and no model-failure streak that
+            // could stop an otherwise healthy agent after repeated quota pressure.
+            const capacityOnlyFailure = (!route && res.status === 429) ||
+                (!!route?.attempts?.length &&
+                    route.attempts.every((attempt) => attempt.failureClass === "capacity"));
+            if (res.deferred || !actualCallMade || capacityOnlyFailure) {
+                saveState(stateFile, state);
+                log(`capacity deferred: ${res.error}`);
+                return {
+                    decision: "skip",
+                    skipReason: actualCallMade
+                        ? "provider rate-limited; retry next cycle"
+                        : "provider capacity deferred",
+                    planned: exitPlanned,
+                    modelFailed: false,
+                    live,
+                    ...meter,
+                    decisionType: "gate_skip",
+                    writeAttempted: 0,
+                    writeAccepted: 0,
+                    ...observationReceipt,
+                };
+            }
             state.consecutiveModelFailures += 1;
-            // Permanent-failure classification: a 404/model_not_found is a
+            // Permanent-failure classification: a 404/410/model_not_found is a
             // DECOMMISSIONED or misconfigured model that will fail every cycle
-            // forever (live-measured: 93% of one agent's cycles for days, revived
-            // 7x in 3h). Three consecutive occurrences rules out a routing fluke;
-            // then disable with the 'model_unavailable' prefix the scheduler's
-            // self-heal exempts. Transient errors reset the permanent streak.
+            // until something changes (live-measured 2026-08-26: NVIDIA EOL'd the
+            // whole Llama 3.x line and 35 agents died on the old disable path).
+            // Reliability slice 1: this class must NEVER disable the agent —
+            // provider failures are the PLATFORM's problem, not the user's. Three
+            // consecutive occurrences (rules out a routing fluke) now emit a
+            // providerHold: hosted, the scheduler folds holds into a fleet-wide
+            // (provider, model) circuit that skip-claims matching agents with
+            // backoff probes; self-host, the runner simply keeps retrying each
+            // cadence and recovers the moment the provider does. Disables remain
+            // for what deserves them: revoked credentials, drawdown, kill-switch,
+            // user action. Transient errors reset the permanent streak.
             if (isPermanentModelError(res.error)) {
                 state.consecutivePermanentModelErrors =
                     (state.consecutivePermanentModelErrors ?? 0) + 1;
                 if (state.consecutivePermanentModelErrors >=
                     PERMANENT_MODEL_ERROR_THRESHOLD) {
-                    state.disabled = true;
-                    state.disabledReason = `model_unavailable: ${res.error.slice(0, 160)}`;
+                    const hold = {
+                        provider: route?.effectiveProvider ?? spec.model?.provider ?? "unknown",
+                        model: route?.effectiveModel ?? spec.model?.name ?? "unknown",
+                        error: res.error.slice(0, 200),
+                    };
                     saveState(stateFile, state);
-                    log(`disabled: ${state.disabledReason}`);
+                    log(`provider hold: ${hold.provider}/${hold.model} — ${res.error.slice(0, 120)}`);
                     return {
                         decision: "skip",
-                        skipReason: `model error: ${res.error}`,
-                        planned: [],
+                        skipReason: `provider hold: ${res.error}`,
+                        planned: exitPlanned,
                         modelFailed: true,
-                        disabled: true,
-                        disabledReason: state.disabledReason,
+                        providerHold: hold,
                         live,
                         ...meter,
                         decisionType: "model_error",
@@ -584,7 +844,7 @@ export async function runCycle(deps) {
             return {
                 decision: "skip",
                 skipReason: `model error: ${res.error}`,
-                planned: [],
+                planned: exitPlanned,
                 modelFailed: true,
                 live,
                 ...meter,
@@ -605,7 +865,7 @@ export async function runCycle(deps) {
                 // Never persist raw model text (no-CoT privacy policy) — the parse error
                 // in skipReason is the diagnostic; the malformed output is not stored.
                 rawModelOutput: undefined,
-                planned: [],
+                planned: exitPlanned,
                 modelFailed: true,
                 live,
                 ...meter,
@@ -646,7 +906,7 @@ export async function runCycle(deps) {
             rationale,
             confidence,
             rawModelOutput,
-            planned: [],
+            planned: exitPlanned,
             live,
             ...meter,
             decisionType: "skip",
@@ -658,13 +918,22 @@ export async function runCycle(deps) {
     }
     // VALIDATE (+ ACT when live). Quote evidence is fetched by the runner.
     const planned = [];
-    let writesThisCycle = 0;
+    let riskIncreasesThisCycle = 0;
     let openCount = observation.openPositions.length;
     // RUNNING totals so multiple opens in one cycle accumulate correctly.
     let openMarginMusd = observation.openPositions
         .filter((p) => p.venue === "futures")
         .reduce((s, p) => s + (p.marginMusd ?? 0), 0);
     let cashAvailableMusd = observation.cashAvailableMusd;
+    const capitalSizingEnabled = usesCapitalSizing(spec, providerName === "mechanical");
+    let committedCapitalMusd = observation.capitalBook?.status === "ready"
+        ? observation.capitalBook.committedCapitalMusd
+        : 0;
+    const capitalBudget = () => ({
+        cashAvailableMusd: cashAvailableMusd ?? Number.NaN,
+        committedCapitalMusd,
+        openMarginMusd,
+    });
     const realizedLossTodayMusd = Math.max(0, -state.realizedPnlTodayMusd);
     const targetedPositionIds = [];
     const targetedOrderIds = [];
@@ -672,6 +941,7 @@ export async function runCycle(deps) {
     let anyExecuted = false;
     let anyExecFailed = false;
     for (let action of decision.actions) {
+        let capitalSizing;
         // Resolve a short PM ref (pm1…pmN) to the canonical {source,slug,outcome} BEFORE
         // any quote/validation. Small models copy a 3-char ref reliably but mis-copy the
         // long outcomeExternalMarketId; an unknown/missing ref is rejected here with a
@@ -724,16 +994,19 @@ export async function runCycle(deps) {
                         Number.isFinite(mkt.probability)
                         ? Math.round(mkt.probability * 100)
                         : undefined;
-                    // Anti-echo: an EXACT match on the market's integer probability is still
-                    // submitted (a forecast can legitimately agree) — but we LOG it so echo
-                    // rates stay observable; we never silently mutate the value. NOTE: the
+                    // Anti-echo: an exact match on the market's integer probability is
+                    // LOGGED here so echo rates stay observable, and the value is never
+                    // silently mutated. The open itself no longer proceeds on it: an
+                    // echo is a zero-edge trade by the model's own numbers, so the
+                    // forecast-edge gate in decisionValidator rejects it downstream
+                    // (forecast_no_positive_edge). NOTE: the
                     // market-implied BENCHMARK agent (provider "mechanical", model.name
                     // "market-implied") echoes the market probability BY DESIGN — it IS the
                     // baseline definition — so a 100% echo rate there is expected, not a
                     // defect. Its agentModel/description say BENCHMARK so this log line is
                     // never mistaken for a mispriced skill agent.
                     if (marketPct != null && Math.round(fc) === marketPct) {
-                        log(`pm_open forecast ${fc} == market prob ${marketPct}% (echo) — submitting as-is`);
+                        log(`pm_open forecast ${fc} == market prob ${marketPct}% (echo) — zero claimed edge`);
                     }
                     action = { ...pm, forecastProbability: fc };
                 }
@@ -747,6 +1020,24 @@ export async function runCycle(deps) {
                 action = { ...pm, forecastProbability: undefined };
             }
         }
+        if (capitalSizingEnabled) {
+            const sized = prepareCapitalAction(action, spec, observation, capitalBudget());
+            capitalSizing = sized.adjustment;
+            if (sized.rejection) {
+                planned.push({
+                    action,
+                    accepted: false,
+                    code: "capital_sizing_unavailable",
+                    reason: sized.rejection,
+                    capitalSizing,
+                });
+                log(`reject ${action.type}: capital sizing (${sized.rejection})`);
+                continue;
+            }
+            action = sized.action;
+            if (capitalSizing?.sizedAmountMusd !== undefined)
+                log(`paper capital ${capitalSizing.version}: ${capitalSizing.proposedAmountMusd} -> ${capitalSizing.sizedAmountMusd}mUSD (${capitalSizing.basis})`);
+        }
         // Anti-churn critic: block re-opening a futures position we ALREADY hold unless
         // it's a confirmed WINNER with room (a legit scale-in). Stops the re-open-a-
         // loser / re-open-into-the-cap churn deterministically — before we even spend a
@@ -771,6 +1062,7 @@ export async function runCycle(deps) {
                         action,
                         accepted: false,
                         code: "duplicate_intent",
+                        ...(capitalSizing ? { capitalSizing } : {}),
                         reason: `already hold ${fo.symbol} ${fo.side}${winning ? " (no margin room to add)" : " — manage it, do not average down or re-open"}`,
                     });
                     log(`reject ${action.type}: duplicate_intent (hold ${fo.symbol} ${fo.side})`);
@@ -791,6 +1083,7 @@ export async function runCycle(deps) {
                 action,
                 accepted: false,
                 code: "pm_open_blocked",
+                ...(capitalSizing ? { capitalSizing } : {}),
                 reason: `open-time quality gate would reject this (422): ${JSON.stringify(reasons)}`,
                 quote,
             });
@@ -801,7 +1094,7 @@ export async function runCycle(deps) {
         // off the stop, so the open isn't silently rejected server-side (the runner
         // owns trigger orientation; weak models routinely mis-sign it).
         {
-            const fixed = repairFuturesTakeProfit(action, quote);
+            const fixed = repairFuturesTakeProfit(action, quote, capitalSizingEnabled ? spec.capitalSizing?.minRewardRisk : undefined);
             if (fixed.repaired) {
                 action = fixed.action;
                 log(`repaired ${action.type} take-profit -> ${action.takeProfitPrice} (R:R off stop; model TP was missing/wrong-side)`);
@@ -809,14 +1102,16 @@ export async function runCycle(deps) {
         }
         const ctx = {
             spec,
+            // Benchmarks submit a known forecast on purpose (see DecisionContext).
+            mechanical: providerName === "mechanical",
             // Inherit the decision-level confidence so the per-action abstention gate
             // doesn't reject a model that reports conviction on the decision (the
             // output contract) rather than on each action.
             decisionConfidence: decision.confidence,
             observation,
             quote,
-            writesThisCycle,
-            writesToday: state.writesToday,
+            riskIncreasesThisCycle,
+            riskIncreasesToday: state.riskIncreasesToday,
             openCount,
             cashAvailableMusd,
             openMarginMusd,
@@ -832,10 +1127,26 @@ export async function runCycle(deps) {
                 code: v.code,
                 reason: v.reason,
                 quote,
+                ...(capitalSizing ? { capitalSizing } : {}),
             });
             log(`reject ${action.type}: ${v.code} (${v.reason})`);
             continue;
         }
+        const capitalRejection = capitalSizingEnabled
+            ? validateCapitalAction(action, spec, observation, capitalBudget(), quote)
+            : undefined;
+        if (capitalRejection) {
+            planned.push({
+                action,
+                accepted: false,
+                code: capitalRejection,
+                reason: "paper capital policy rejected quoted economics",
+                quote,
+                capitalSizing,
+            });
+            log(`reject ${action.type}: ${capitalRejection}`);
+            continue;
+        }
         anyAccepted = true;
         if (action.type === "futures_close" || action.type === "futures_set_sltp") {
             targetedPositionIds.push(action.positionId);
@@ -844,7 +1155,25 @@ export async function runCycle(deps) {
             targetedOrderIds.push(action.orderId);
         }
         if (!live) {
-            planned.push({ action, accepted: true, quote, executed: false });
+            planned.push({
+                action,
+                accepted: true,
+                quote,
+                executed: false,
+                ...(capitalSizing ? { capitalSizing } : {}),
+            });
+            // Opt-in simulations reserve the same accepted capital as paper-live.
+            // No close/sell proceeds are credited until a future observed wallet read.
+            if (capitalSizingEnabled && isRiskIncreasingAction(action)) {
+                riskIncreasesThisCycle += 1;
+                const spent = capitalCashCost(action, quote);
+                cashAvailableMusd = (cashAvailableMusd ?? 0) - spent;
+                committedCapitalMusd += spent;
+                if (action.type === "futures_open") {
+                    openCount += 1;
+                    openMarginMusd += action.marginMusd;
+                }
+            }
             log(`DRY-RUN: would ${action.type}`);
             continue;
         }
@@ -871,23 +1200,65 @@ export async function runCycle(deps) {
             quote,
             executed: r.ok,
             result: r.data,
+            ...(capitalSizing ? { capitalSizing } : {}),
         });
         if (r.ok) {
             anyExecuted = true;
             state.intentSeq[intentKey] = seq + 1;
-            writesThisCycle += 1;
             state.writesToday += 1;
+            if (isRiskIncreasingAction(action)) {
+                riskIncreasesThisCycle += 1;
+                state.riskIncreasesToday += 1;
+            }
             if (action.type === "futures_open") {
                 openCount += 1;
                 openMarginMusd += action.marginMusd;
             }
+            // Slice 2: persist the thesis this open was made on, keyed to the position
+            // the server returned and sanitized side-aware (a wrong-side level would
+            // fire on the next tick). An add to a held position keeps the ORIGINAL
+            // thesis: restating a looser one on a loser is the churn this ends.
+            if (action.type === "futures_open" || action.type === "pm_open") {
+                const { key, bound } = bindOpenedThesis(action, r.data, observation.asOf, quote);
+                if (key && state.theses?.[key]) {
+                    log(`thesis: ${key} keeps its original thesis (add)`);
+                }
+                else if (key && bound) {
+                    rememberThesis(state, bound.thesis);
+                    log(`thesis bound to ${key}: "${bound.thesis.summary}"` +
+                        (bound.notes.length > 0 ? ` (${bound.notes.join("; ")})` : ""));
+                }
+                else if (key) {
+                    log(`thesis: none stated for ${key}; only its stop/target will exit it`);
+                }
+            }
             // Decrement running cash by what this action consumed (futures margin /
             // spot buy notional / PM stake) so a later action this cycle sees it spent.
             if (cashAvailableMusd != null)
-                cashAvailableMusd -= cashConsumed(action, quote);
+                cashAvailableMusd -= capitalSizingEnabled
+                    ? capitalCashCost(action, quote)
+                    : cashConsumed(action, quote);
+            if (capitalSizingEnabled)
+                committedCapitalMusd += capitalCashCost(action, quote);
         }
         else {
             anyExecFailed = true;
+            // A transport/server failure does not prove an entry stayed unfilled.
+            // Reserve its possible spend for subsequent actions this cycle, without
+            // recording a confirmed trade or advancing its idempotency sequence.
+            if (capitalSizingEnabled &&
+                isRiskIncreasingAction(action) &&
+                (r.status <= 0 || r.status >= 500)) {
+                riskIncreasesThisCycle += 1;
+                const spent = capitalCashCost(action, quote);
+                cashAvailableMusd = (cashAvailableMusd ?? 0) - spent;
+                committedCapitalMusd += spent;
+                if (action.type === "futures_open") {
+                    openCount += 1;
+                    openMarginMusd += action.marginMusd;
+                }
+                log(`paper capital reserved after ambiguous ${action.type} response`);
+            }
             // Quote-expiry capture: a validated pm_open the SERVER rejected at act time
             // with a 422 mock_entry_blocked — the eligibility/quality/pricing state moved
             // between the quote we validated and the act, so the quote expired. Report it
@@ -940,7 +1311,7 @@ export async function runCycle(deps) {
         rationale,
         confidence,
         rawModelOutput,
-        planned,
+        planned: [...exitPlanned, ...planned],
         live,
         ...meter,
         decisionType: "act",