feat(engine): resume a crashed flatten without sending a second close

[MarcosACH]

Closes #474

A crash mid-flatten must still book every fill and never send a second close for the same size. Before this change, every close used seq 1. So a second flatten on the same store sent no close for a symbol that an earlier flatten had closed. It exited 1.

What changed

• Each close takes the next __operator__ seq. The seq high-water fold moved from StrategyHost to Cache.seq_high_water(), so strategies and flatten start from the same number.
• Before it closes a symbol, flatten waits for the verdict on any __operator__ close the boot left open in that symbol. Then it reads the size again, because the old close may have filled.
• If that close is still open after the wait, flatten sends nothing for the symbol. The final read reports its size, and the next boot resumes the saga. So a symbol never has two closes open.
• The wait runs after the replay has played, because its reconcile passes move the replay clock.

Tests

tests/engine/test_flatten_e2e.py covers paper with the in-memory bus:

• A second flatten uses a seq above every earlier one.
• A crash after the send and before the booking: the next flatten books the fill by split, closes the rest, and exits 0.
• A close the boot left open makes flatten wait. If it is still open, flatten sends nothing.
• cancel-all after a crashed flatten books the open close at boot.

Every test builds AppConfig. The full suite, ruff, mypy, and lint-imports pass.

Follow-up

Flatten now keeps its own seq counter beside SignalEmitter. #473 moves it onto the emitter, so a fix for #442 covers flatten too.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[MarcosACH]

Review of ralph/issue-474 @ a5b92b7

Reviewer: code-review skill
Reviewed: 2026-10-12
Optimization axis: correctness

Mechanical

• ruff format: pass
• ruff check: pass
• mypy: pass
• lint-imports: pass (7 kept, 0 broken)
• pytest: pass (2020 passed, 49 skipped, coverage gate met)

Findings

[BLOCKING] R001 — src/tickwright/engine/exit_run.py:150 — No test covers a failed position read after the wait

Category: testing
Why: Lines 151 and 178 are the only new lines with no coverage. This branch stops the whole run and skips every symbol after it, and nothing proves it.
Fix: Add an e2e test. Leave a close open, let the wait decide it, then fail the next fetch_positions. Assert exit 1, left starts with read_failed, and no __operator__ seq 2 is placed.
Status: open

[WARN] R002 — src/tickwright/engine/exit_run.py:176 — Nothing proves the size is read again after the wait

Category: testing
Why: The re-read exists because the old close may have filled during the wait. If line 179 returned size instead, every test would stay green, since the ghost test keeps the same size.
Fix: Add a test where the close left open fills (fully or partly) during the wait. Assert the next close is sized to what the venue holds after that fill.
Status: open

[WARN] R003 — src/tickwright/engine/cache.py:63 — Cache.all_orders lost its only caller, and its docstring is now wrong

Category: docs
Why: The docstring says it exists for the seq high-water fold. The fold now reads self._orders directly, and nothing in src/ calls all_orders any more.
Fix: Remove all_orders and its tests in tests/engine/test_cache.py. If you keep it, make seq_high_water read through it, or fix the docstring.
Status: open

Notes (no action)

• ADR-0056 resume order holds. The boot resolves the open saga by cloid, then the job runs from the top. The cancel-all test proves the boot does it for any exit run.
• Seq high-water for __operator__ comes from the same fold as strategies. mark_operator_cancel sets no cancel_signal_id, so operator cancels never move a strategy's seq.
• Kafka seq reuse (#442) stays out of scope, as the PRD says.

Summary

• BLOCKING: 1 open
• WARN: 2 open
• NIT: 0 open
• Merge: BLOCKED

Ralph-State: changes-requested

[MarcosACH]

Review fixes for a5b92b7. Each new test was checked against a mutation of _resume_closes. Each one went red, then green on the real code.

• R001 Status: resolved — 8fb8dd5. test_a_failed_read_after_the_wait_stops_flatten_with_no_second_close fails the position read after the wait. It asserts exit 1, left=read_failed: ..., and no seq 2 close.
• R002 Status: resolved — 205c94b, b961e9d. test_a_close_left_open_that_fills_during_the_wait_leaves_only_the_rest_to_close fills the old close after flatten's first read. The next close must be 0.01 and FILLED. b961e9d fixes a mypy error in that test.
• R003 Status: resolved — f27904d. seq_high_water folds over self.all_orders() again. ADR-0016, ADR-0024, and the docstring all say the fold reads it, so I kept the method instead of deleting it.

Gate: ruff, mypy, lint-imports pass. 2022 passed, coverage 97.18%.

[MarcosACH]

Review of ralph/issue-474 @ f27904d

Reviewer: code-review skill
Reviewed: 2026-10-12
Optimization axis: correctness

Mechanical

• ruff format: pass
• ruff check: pass
• mypy: pass
• lint-imports: pass (7 kept, 0 broken)
• pytest: pass (2022 passed, 49 skipped, coverage 97.18%)

Findings

[BLOCKING] R001 — src/tickwright/engine/exit_run.py:150 — No test covers a failed position read after the wait

Category: testing
Status: resolved — 8fb8dd5 (verified)
The test fails the second positions read. The ghost wait decides the old close first, so that read is the re-read, not the final read. If the failure were ignored, the final read would report BTC=0.02 and the test would go red.

[WARN] R002 — src/tickwright/engine/exit_run.py:176 — Nothing proves the size is read again after the wait

Category: testing
Status: resolved — 205c94b, b961e9d (verified)
I checked this with a mutation in a detached worktree. I made _resume_closes return size instead of reading again. Both new tests went red. They pass on the real code.

[WARN] R003 — src/tickwright/engine/cache.py:63 — Cache.all_orders lost its only caller, and its docstring is now wrong

Category: docs
Status: resolved — f27904d (verified)
seq_high_water now reads through all_orders(). The docstring and ADR-0016 match the code again.

New findings

None. The fix commits touch only the fold and the tests. _left_open now stores split_basis as the manager does at place (ADR-0054), so the fill can be booked.

Summary

• BLOCKING: 0 open
• WARN: 0 open
• NIT: 0 open
• Merge: READY

Ralph-State: ready