# FOS-3 — the new exit-4 escalation can be masked by yesterday's failed BUY, and its only test reads the source as text: the one exposure-left-on alarm has two ways to stay silent

status: open · raised panel run 21 (2026-09-11, change-review catch on PR #154 — does NOT count toward the frontier cadence) · class: loudness & safety (G2, but the exit-4 path is trading-contract, not observability) · effort ~0.75 pd · horizon: live daily — the AVB streak proves failed de-risking orders are not hypothetical

---

**Plain-language summary for an owner reading one paragraph.** Last week's
IGD-1 leg-3 ruling built the escalation this shop had been missing: `thales
run` now exits 4 — redding CI — when a de-risking sell fails for a symbol
that was NOT already failing, so a NEW stuck exit pages instead of joining
the furniture. Two defects in the build, found by this run's change review.
First, "already failing" is side-blind: if symbol X had a failed **BUY**
yesterday (a symbol halt or one broker-wide buying-power rejection day
poisons every symbol at once) and X's **SELL** fails today for the first
time, today's exposure-left-on event exits 0 and lands only in the digest —
the ruling's letter is met, its rationale (a failed buy leaves no exposure;
the sell does) is not. Second, the only test pinning the escalation reads
`cli.py` AS TEXT and asserts substrings — it fails if the code is deleted,
but passes if the code is present and neutered (an exception before the
raise, a later try-wrap, reordering that makes it unreachable). The single
alarm for "the book cannot get out of a name" is guarded by a detector that
cannot fail in its primary failure mode.

## Mechanism — ground truth verified this run at HEAD `fa55f0d`

- `src/thales/execution/failed_streaks.py:73-78` — `failed_symbols_on`
  returns every failed symbol for the prior session with **no side
  condition**; `fresh_derisking_failures` (:111-116) filters today's
  de-risking failures on `symbol not in failed_prev_session`. A prior-day
  failed buy therefore suppresses a first-ever failed sell. The existing
  test (:71 region) only exercises a sell-history `prev_failed` — the
  buy-masking case was never considered. Contrast: the unreadable-history
  fallback (`cli.py:1152-1156`) correctly fails safe (unknown → all NEW),
  so the side-blindness is an oversight in otherwise fail-safe-aware code.
- `tests/test_execution/test_failed_streaks.py:83-92` — reads
  `src/thales/cli.py` as a string and asserts substrings between
  `"Orders FAILED:"` and `"Exit 4: state is persisted"`. Its own docstring
  admits why ("the run command builds a live broker"). A blanket
  `try/except` around `cli.py:1143-1176`, an exception between computing
  `fresh` (:1157) and `raise typer.Exit(4)` (:1176), or reordering all
  pass green. The behavioral pieces of `failed_streaks.py` ARE tested;
  the escalation wiring is not.
- The converse defect direction errs loud, not silent — a HALT day (no
  orders attempted) resets `prev_failed`, so a standing streak
  re-escalates as NEW after any halt — and is accepted as-is.

## Fix shape (propose-only)

Make the masking set side-aware: only prior **de-risking** failures mask
(at `failed_symbols_on` or its call site). Build a thin injectable-broker
harness for `cli.run` (SimulatedBroker + tmp state dir + Typer CliRunner —
`src/thales/execution/simulated.py` already exists, so this is real work,
not a wish) and **delete** the text-grep test.

## Pre-registered kill criterion / done-when

Two behavioral tests, both red today:
1. Symbol X fails a BUY on session N−1 and a first-ever SELL on session N
   → run exits **4** (currently 0).
2. CliRunner-invoked `thales run` with an injected broker exits 4 on a
   fresh de-risking failure, 0 on a standing one, and treats unreadable
   history as all-NEW — verified by mutation: wrapping the escalation
   block in `try/except` or removing the raise must red the suite.

Done when the text-grep test **no longer exists** and the behavioral tests
run in the pre-trade gate (exit-4 is the run command's contract, not
observability). Keeping the grep test "alongside" does not satisfy this
row.