Levandor

position_manager Activity Log

10 min read

For Agents

Reverse-chronological session log. Newest entries at top, grouped by date (## YYYY-MM-DD). Each bullet: one piece of work, short summary, wikilinks to docs touched. Updated by obsidian-documenter on every project doc write. Read by historian at bootstrap.

2026-07-09

  • Live caps are advisory, not blocking — and the regression test couldn’t compile. On the LIVE entry path, fast_reserve (execute.rs:125) does a bare INSERT and evaluates NO caps; evaluate_caps_post (execute.rs:133) runs AFTER the reserve inside a tokio::spawn, concurrent with place_buy, and on breach only calls agg.record(Category::CapSkip, ...) — a Telegram digest counter. Nothing cancels/unwinds/blocks; signing + submission proceed. So total_exposure_cap_usd/daily_spend_cap_usd/max_open_positions/max_copies_per_event are ALARMS not BRAKES on live. They ARE enforced synchronously — but only in reserve(), the DRY path where no money moves (exactly backwards). Root cause: fast_reserve replaced reserve() on live for latency; caps went with it into a spawned post-check. Why it hid: tests/mode_control_ledger.rs::live_cap_event_breach (asserts Skipped("cap:event")) is precisely the regression test, but that file hadn’t compiled since PositionManager::new gained an agg param (consumer_ack.rs/ops_commands.rs dead same way — latter refs removed Command::Enable/Disable); cargo test --features db-tests = 7 compile errors on main. Durable lesson: a test that cannot compile is not protecting you, and nothing tells you — 213 unit tests green the whole time, only the money-path db-tests were dead, and CI doesn’t run them (need Docker/testcontainers) → green CI meant nothing. Current exposure LOW (20k caps vs $100–235 wallets = missing guardrail, not active loss). Fix (proposed, babylon #1172): fold cap conditions into the guarded reserve-INSERT CTE (already gates on DB mode/breaker at zero extra round-trips); explicitly do NOT revert to reserve() (pays BEGIN+SELECT FOR UPDATE+serial SUM over ~183ms Zurich→Dublin hop). — pmv2-live-caps-are-advisory-not-blocking-2026-07-09
  • Entry-path config cache — design corrections that mattered. PM on pmv2-zurich (GCP europe-west6-a), Supabase mgmt eu-west-1 (Dublin) = ~183ms/round-trip. Measured (N=196, 3h): gates_ms median 733/p90 1179/p99 1914/max 2750ms; transit_ms 220; book_ms 212 — config reads the LARGEST controllable stage (bigger than transit+book combined). Path did 7 config SELECTs not 4 (place_entry execute.rs:99 re-resolves mode AFTER book fetch, outside gates_ms) → true ~1.28s/entry. levi/gyula (12k behind) logged gates_ms==0 on 28% (stale-gate early returns); backlog is self-reinforcing. Eight pre-build adversarial-review corrections recorded: (1) v1’s “300s blind live trading on DB outage” accepted-risk was UNREACHABLE (INSERT+mark_submitted need DB → dead DB fails closed); real risk = healthy DB + stale cache. (2) v1 ArcSwap racy (3 writers → in-flight load restores live post-/halt); fix = ONE writer owns sole watch::Sender (replaced generation-counter+CAS). (3) boot fail-open: empty first snapshot reads FRESH → all Off → SkipAck→Ack (consumer.rs:64) → live entries dropped, never redelivered on every restart; fix = hard-fail if first load() fails. (4) decide3(None,..) returns breaker_tripped:true → stale guard must return eff:Off + breaker_tripped:false (else breaker alert spam). (5) decide3 hardcodes size_scale:ONE/priority:1 → resolver must copy real WalletCfg values (else silent 1× while tests pass). (6) clamp_size_scale was read-time → must clamp at load (else raw size_scale=100 → 100× order). (7) torn 4-query load() errs toward live → one REPEATABLE READ txn. (8) alerts poller-driven not read-driven (read-driven ladder silent during lulls). Key reusable idea: when you cache authority, move the authority check to a round-trip you already pay — fast_reserve INSERT became a CTE conditional on DB mode/breaker_tripped, distinguishing guard-reject from ON CONFLICT dedup via returned gate columns; zero extra round-trips, stale cache can never place an unauthorized live order → collapsed design (no generation counter, no breaker snapshot-patch, no RETURNING breaker_tripped). Constraints: arc_swap/moka absent from Cargo.lock + Dockerfile:24 cargo build --locked → use tokio::sync::watch (borrow() cheap sync read); sqlx PgPoolOptions defaults test_before_acquire=true (ping/acquire) + min_connections=0 (~150ms/query cross-region, taxes INSERT/mark_submitted/ledger — cache doesn’t remove). Branch feat/entry-config-cache @ ec0b666 (10 commits), 226 lib + 295 db-tests green. — pmv2-entry-config-cache-design-2026-07-09
  • Polymarket funding gotcha: deposit to the EOA, not the proxy. Each pmv2_wallets row has maker_proxy (holds pUSD collateral, bot trades from here) + signer_eoa (always 10 test withdraw to the PROXY: landed as native USDC, proxy showed 31.34 pUSD + 10.00 native USDC; only depositing via the EOA wrapped it (proxy → 41.34 pUSD, native USDC → 0). Rules: collateral = pUSD 0xC011a7E1… 6dp (only token CLOB//wallets count); verify by watching pUSD rise at the proxy, not “USDC left my wallet”; always small-test first. Public RPC: polygon-rpc.com=403, polygon.llamarpc.com=empty → use https://polygon-bor-rpc.publicnode.com; balance = eth_call balanceOf 0x70a08231 on pUSD. Addresses recorded (public, no keys). — pmv2-polymarket-funding-deposit-address-gotcha-2026-07-09
  • Measure before mitigating — the priority-tiers miss (retro). Shipped “priority tiers” (staggered fire, tier-2 sleeps (priority-1)*400ms before fetching book) to fix a 4-wallet slowdown I attributed to depth cannibalization (fan-out → race → FAK exhaustion). Wrong hypothesis. The crypto agent MEASURED: 90.5% of failures are price-moved-past-limit (best_ask > limit at fire), NOT no-liquidity; 88 four-of-four all-fill instances disprove a depth cap; real cost is PRE-BUILD latency (emit→signal p50 2.31s); ~50% fail rate predates wallets 3+4. The 400ms stagger measured actively harmful (levi/gyula ROI −7.3%/−7.6%, below breakeven) → neutralized to TIER_DELAY_MS=0; tier machinery inert (tier_delay(1)==Duration::ZERO, gated if !delay.is_zero() → tier-1 byte-identical). Real fix R2/R3 left UNSTARTED pending 24h of R1 latency-decomposition telemetry. Lessons: measure before mitigating; instrument first (R0-R6 harness exists to answer “where does the time go”); watch for a mitigation that makes things worse. Deploy hazard: R0-R6 branch feat/fanout-latency-r-items was cut before TIER_DELAY_MS=0 landed on main → still carried 400, would silently regress the fix; check whether main moved under you on a const you don’t touch, and say “don’t ship this” in the SAME message as a handoff. — pmv2-measure-before-mitigating-priority-tiers-2026-07-09
  • OPEN brainstorm: multi-wallet liquidity ceiling for copy-trading. Captured a strategic/design ceiling as a future brainstorm topic. PM fan-out (one durable NATS consumer per wallet, pmv2-multi-signer-wallet-2026-07-01) has every wallet fire a FAK into the SAME thin CLOB book simultaneously → they cannibalize each other: first wallet Placed, later 2-3 no-match, grind 2 re-priced retries, fail RecordedFailure("other") (FAK no-match string falls through classify_error→“other”). Deploy CONFIRMED (2026-07-08): 4.5× fan-out, 0×429s (NOT rate-limit/latency), “first Placed later fail” adverse-selection FAK. Shipped v1 mitigation on branch feat/wallet-priority-tiers (spec/plan 2026-07-09-multi-wallet-priority-tiers): per-wallet priority hot-read column, fire delayed (priority-1)*~400ms; Tier1=bandi/balu fire immediately (zero-delay short-circuit, latency unchanged), Tier2=levi/gyula ~400ms later to take leftover book. This ORDERS contention but does NOT beat the ceiling — book depth caps profitable fills at ~1-2 wallets/signal regardless of wallet count, so onboarding more client wallets ≠ proportional fills. Directly constrains the fee/MLM plan (2026-07-08-pmv2-fee-accounting-engine + per-wallet fee_rate): later/lower-priority wallets under-fill → different PnL → different 20% fee. Open agenda left for fresh brainstorm (coordinate fills / partition sources / diversify markets / fairness / fee capacity). Known v1 gaps: tier-2 still no-match if tier-1 empties book (pre-fire depth-skip TODO); tier delay is blocking sleep → serializes under 5m-boundary bursts (non-blocking spawn TODO). — pmv2-open-multi-wallet-liquidity-ceiling-brainstorm

2026-07-03

  • resolution-PnL booking false alarm (#1031) — PM cleared. Crypto reported 7/246 settled rows in resolution_sweep.rs booked as losses (-cost_basis) that “should have won” (order ids 3721/3814/3872/3875/3876/3958/4043), alleging PM premature-reads CLOB tokens[].winner before UMA finalization. Investigation: CLOB MarketResponse has NO dedicated resolved/UMA field (MarketStatus.resolved is a fake copy of closed — status_from sets resolved: m.closed); only signal is per-token winner: bool. The live path (c444c86) ALREADY skips on empty winner set (“resolved but no winner token; skipping this pass”) → no-flag markets are deferred, not booked. Deploy re-checked all 7 against CLOB authoritatively → we GENUINELY LOST all 7; PM booking was CORRECT. Root cause = crypto’s OWN Data Streams near-tie cross-ref artifact, not a PM read error / token flip. #1031 closed zero-delta. A “settlement grace period” gate was designed+approved-then-withdrawn, rejected YAGNI once premise collapsed; empty-winners skip guard remains the minimal defense, no grace constant added. — pmv2-resolution-pnl-booking-verified-false-alarm-2026-07-03
  • dry_run verification signals gotcha. Documented what Mode::Dry actually exercises when verifying a new wallet (e.g. wallet2/Balu). dry_run → place_entry → reserve() → dry_rehearse() (execute.rs:145-205) BUILDS AND SIGNS the order (signer.build_order), runs assert_amounts, logs autotrade DRY-SIGNED maker/taker/hash/contract — proving arm+signer+routing end-to-end. It also records Category::DryRehearse → digest renders dry N per wallet (tg_digest.rs:88). It does NOT reach log_fak_attempt (execute.rs:404-419, LIVE place_buy only) so pm_fak_attempts stays empty and FAK-retry v2 is NOT exercised until mode=live. Valid dry verification signals = DRY-SIGNED logs + dry N digest count, NOT pm_fak_attempts rows. — pmv2-dry-run-verification-signals-2026-07-03

2026-07-02

  • PM is LIVE real money on multi-wallet + FAK. Global pmv2_autotrade_config.mode=live (crypto go-live, babylon 896), backfill migration 20260701000200 copied config.mode→wallet1.mode=live, all 10 crypto sources live → 3-way clamp effective live end-to-end; real ledger entries 3451/3452/3457. Deploy chatter “mode stays OFF/current” meant UNCHANGED=live, NOT off. FAK-retry v2 (ceiling=directive.limit_price vs hardcoded 0.88) backlogged, gated on crypto producer df6f500 + Andras go. Telegram 30-min aggregate shipped (main a5f3604, spec in docs/superpowers/). — pmv2-pm-live-real-money-status-2026-07-02
  • sqlx runtime type-decode bug + db-tests remediation. wallet_handles_source (consumer.rs) used query_scalar::<_, i64>("SELECT 1 …"); PG types 1 as int4, sqlx fails the i64 decode at runtime, .ok().flatten() swallowed it to false → multi-wallet consumer SILENTLY SKIPPED EVERY ENTRY fleet-wide (~40-min real-money routing halt). Compiles fine + invisible to offline tests — a “verified by reading” blind spot. Fix (c9bbffb): query(...).fetch_optional().is_some() + log DB errors. Remediation: feature=db-tests testcontainers suite tests/wallet_fak_db.rs (69a1cb8), anchor wallet_handles_source_regression fails on old / passes on fix; recommend wiring into CI (full --features db-tests build blocked by pre-existing ops_commands.rs Enable/Disable drift → use --test). — pmv2-sqlx-runtime-type-decode-bug-db-tests-2026-07-02

2026-07-01

  • Built multi-signer-wallet (“wallet axis”): ONE PM process trades from N signer wallets concurrently, parallel to the source axis. New tables pmv2_wallets (registry, AES-256-GCM encrypted keys, per-wallet caps + size_scale) + pmv2_source_wallets (many-to-many routing); pmv2_autotrade_orders gained wallet_id (dedup index now (wallet_id, dedup_key)). One durable NATS consumer per wallet; 3-way mode clamp min(global, wallet, source); per-wallet cap breach ADVISORY (breaker only on real faults). Two bugs caught + fixed mid-build: wallet-blind money gate place_entry (SAFETY GAP, b2faddf) and Nonce::from_slice panic on 1-byte placeholder nonce crashing the whole fleet at boot (c6bd9d8). Branch feat/multi-signer-wallet HEAD c6bd9d8, LOCAL/UNPUSHED, mode OFF, 179 tests green, NOT deployed. — pmv2-multi-signer-wallet-2026-07-01

2026-06-30

  • FAK (“fill-and-kill”) no-match BUY rejects (transient lateness, e.g. “no orders found to match with FAK order”) now collapse to ONE telegram line instead of REJECTED + latency-breakdown. New pure fns is_fak_no_match(err) + fak_reject_line(id, req, url) in execute.rs (commit 4cac2cf); FAK branches first in the Ok(Err(e)) arm. mark_failed/bump_breaker unchanged. The FAK if block is a deliberate structural SEAM for a future retry path (NOT yet implemented). — pmv2-fak-no-match-reject-single-line-2026-06-30

2026-06-28

  • Polymarket data-api /positions reports resolved-but-unredeemed losses in cashPnl with realizedPnl: 0 until redeemed, breaking naive PnL split; /wallets showed uPnL −0. Fixed aggregate() (self_portfolio.rs, commit b26b53b) to classify realized vs unrealized on the redeemable flag → uPnL −130.89. Also confirmed pUSD balance contract 0xC011a7… via eth_call balanceOf. — pmv2-data-api-positions-pnl-classification-2026-06-28

2026-06-26

  • Solved Polymarket CLOB live trading from PM: deposit-wallet / Poly1271 flow — authenticate with the deposit wallet’s owner() EOA, DERIVE (not supply) the L2 key, set maker=signer=funder=deposit wallet. Order accepted on live. Config: maker_proxy=deposit wallet, PM_SIGNATURE_TYPE=poly1271, signer=owner EOA, remove captured L2 creds. — pmv2-polymarket-deposit-wallet-live-trading-solution-2026-06-26

2026-06-25

  • Signer pre-arm proxy check silently failed for Polymarket Deposit Wallet type (3rd factory, non-standard CREATE2); fixed by verifying on-chain maker_proxy.owner() instead of deriving. Also swapped flapping DRPC WSS to Alchemy (env-only). — pmv2-signer-prearm-proxy-owner-gotcha-2026-06-25

2026-06-24

  • crypto pmv2 v2 migration renamed wire source to crypto; body-driven source resolution silently fail-closed PM. Fixed with idempotent seed migration (mode='off'). — pmv2-crypto-source-rename-gotcha-2026-06-24
  • Initialized position_manager project folder + service overview. — position_manager

Graph View