Trade placed before its thesis

A trader reads a headline and buys before writing down why. Trading has the problem the model starts from in its sharpest form. A thesis written after the trade is written by someone who has watched the price move, and it fits the trade for that reason. The field’s usual fix is the one preregistration uses: no order goes in without a thesis. That rule is a gate, and removing gates is what the model is for.

The system

A long-only equity portfolio run by one trader.

Artifact-set	Holds
`{mandate}`	The investment policy: position and sector limits, and what every thesis must state
`{theses}`	One document per holding: why it is held, and the condition that would prove it wrong
`{orders}`	Every order sent to the broker: ticker, side, size, and time
`{portfolio}`	The positions at the broker, as the fills of `{orders}` leave them
`{market data}`	Prices, company announcements, and analyst notes, each with a timestamp

{orders} and {portfolio} do not live in git. They are the broker’s records. The model does not require an artifact to be a file, and the workflow catalog already includes a ledger.

An order, once it fills, cannot be recalled. A later order can offset it, and nothing can revise it. That makes {orders} an output wherever a workflow writes it. {portfolio} is state: the broker’s fills are its controller, and a workflow changes it only by emitting an order.

{market data} is written by a feed job, its controller. No workflow writes it. It is inside the system only because it is declared here, and once declared, a new announcement is a change like any other.

Connections:

{mandate} to {portfolio}: no position above 5% of the portfolio, and no sector above 25%.
{mandate} to {theses}: every thesis states an invalidation condition.
{theses} to {portfolio}: every position has a thesis, and no position is held past its invalidation.
{orders} to {portfolio}: every position is the net of the orders that filled.
{market data} to {theses}: no thesis stands while market data meets its invalidation condition, and the data is no older than one trading day.

Before the change, semiconductors are 22% of the portfolio.

Workflows

Workflow	Input	Owned	Output	Shape
Thesis-first trade	`{market data}`	`{theses}`, `{portfolio}`	`{orders}`	chain
Rebalance	`{mandate}`	`{portfolio}`	`{orders}`	one link
Thesis review	`{mandate}`	`{theses}`	none	one link

Thesis-first trade reads the market, writes a thesis, decides a position, and emits the order that reaches it. It never writes its inputs, so no replay can keep a thesis alive by amending the data it is tested against. A trade does not change the policy, so rebalance and thesis review read {mandate} and never write it.

All three workflows keep the default leash. A write to {theses} or {portfolio} that only adds proceeds when the criteria pass. A write that removes or reverses part of a set’s standing specification needs approval. So does emitting an order, because an order cannot be taken back. Approval comes from an approver, and on a one-person desk the approver is the trader.

The desk does not loosen the leash on {theses}. A thesis rewritten or dropped after the price has moved is the failure a thesis exists to prevent. Every change to what a thesis says, including closing it, reaches the trader. The desk pays for that with one more approval, which in practice arrives next to an order the trader approves anyway.

The change

Orrin Micro announces a recall of its flagship chip. Within minutes the trader buys shares of its competitor, Kessler Semi, in the broker’s app. No thesis is written. Variants A and B differ in the size of the order. Variant C is a later announcement, and only the market data changes.

Variant A: the trade breaks the mandate

The order takes Kessler Semi to 8% of the portfolio and semiconductors to 30%.

Expected run

Lift. The change touches {orders}, and the fill touches {portfolio}.
Find candidates. Thesis-first trade and rebalance both own {portfolio} and output {orders}, so the order bypassed both. They are upstream candidates. No workflow reads {orders} or {portfolio} as an input, so there are no downstream candidates.
Distill. Each workflow reads the change within its own span. Thesis-first trade spans {market data} as it stood when the order went in, which holds Orrin’s recall announcement. Its intent: hold Kessler Semi for the market share it gains from Orrin’s recall. The size is expression. It records how sure the trader felt in the minute after the headline. Rebalance spans only {mandate} and {portfolio}, so the recall is outside its reading. Its intent is narrower and consistent with the first: hold a position in Kessler Semi.
Ask the controllers above.
- Thesis-first trade asks {theses} first. Its controller derives a thesis that states the market-share mechanism and a condition that would prove it wrong: Orrin ships a replacement chip within one quarter. {theses} holds nothing for Kessler Semi, so it is affected, with missing strain. Above it, {market data} holds the announcement.
- Rebalance asks {mandate}. Its controller derives the limits every position meets: at most 5% of the portfolio, and semiconductors at most 25%. The mandate already states them, so it holds, and rebalance has nothing above the source to replay.
Replay from the highest affected set. Thesis-first trade replays from {theses}, and the theses controller writes the Kessler Semi thesis.
Reconcile at the source. The change landed in two sets, and neither can be revised the way a document can.
- Both workflows send {portfolio} the intent and references to the criteria of the sets above. Its controller joins them: every position has a thesis, which now holds, and both limits, which the 8% position and the 30% sector weight break. The portfolio’s controller is the broker’s fills, so the only way to change it is an order.
- {orders} is an output. The arriving order has filled and the price has moved, so the state before the trade no longer exists, and reconciliation cannot change the order. It keeps it and adds a superseding one: a sell order. Until that order fills, the strain on the arriving order is held as obligation.
The builder lens reports holes: no thesis, and two limits broken. Bringing the sector to 25% means selling 5 points of semiconductors, and the sale can come all from Kessler Semi or be split with the other chip holdings. Both meet the criteria, and the choice is recorded.
Leash. The thesis is an owned write and the criteria pass. {theses} held nothing for Kessler Semi, so the write only adds, and it proceeds. The fill changes positions in {portfolio}, not the criteria it is checked against, so nothing in any standing specification is removed or reversed. The sell order is an output, so it goes to the trader for approval. Once approved and filled, it supersedes the arriving order, and the obligation clears.
Propagate. The new thesis is a change of its own. Thesis review owns {theses} and asks {mandate}, which holds, because the thesis states an invalidation condition. Market data does not meet that condition, so {market data} to {theses} holds. Nothing else is strained.

Settled state

{mandate} is unchanged.
{theses} holds a Kessler Semi thesis with its invalidation condition.
{orders} holds the arriving buy and the approved sell that offsets part of it.
{portfolio} is within both limits.

Status: Holds

The run reaches a state that meets the criteria, and it passes the leash: the one irreversible write it makes waits for a person. The criteria are stated over the outcome, and a later sale meets them as well as a smaller first order would have.

Reconciliation at an output is thinner than at a document. It can keep what landed and add to it, and it cannot change anything. The model’s reconciliation names three outcomes, kept, changed, and added, and at an output a change is always a superseding emission added after the one that landed.

The roles now explain the breach window rather than only recording it. The arriving order is an output, so no run can undo it. Its strain is held as obligation from the moment it fills until a superseding order fills, and the window is that obligation’s lifetime. It includes the time the sell order waits for approval.

What the model still does not say is how long that obligation may be carried. The proposed boundary blocks carried strain at a merge, and a broker order has no merge. The workflow’s strain policy is where a limit belongs, such as mandate strain on an order is cleared within one trading session. This instance does not state one, and the only earlier point a block could act is the order ticket, which is the gate this example set out to remove.

Variant B: the thesis is written afterwards

The order takes Kessler Semi to 3%, within both limits. The run is out of band and reaches the change two days later. By then the stock is up 12%, and analysts credit the rise to a rumoured data-centre contract.

Expected run

Lift. The change touches {orders} and {portfolio}.
Find candidates. Thesis-first trade and rebalance, as upstream candidates.
Distill. The order carries a ticker, a size, and a time. Thesis-first trade reads it within its span, and distillation is bounded in time: it reads {market data} as it stood when the order went in. At that minute the data holds Orrin’s recall announcement. The rise and the analysts’ account of it come two days later, so they are outside the bound. Intent: hold Kessler Semi for the market share it gains from Orrin’s recall. Rebalance’s narrower reading is the same as in variant A.
Ask the controllers above. The theses controller derives the recall thesis and its invalidation condition, Orrin ships a replacement chip within one quarter, and answers that {theses} is affected. The mandate controller answers that {mandate} holds.
Replay from the highest affected set. Thesis-first trade replays from {theses}, and the recall thesis is written.
Reconcile at the source. The 3% position has a thesis and is within both limits, so the portfolio’s controller keeps it, changes nothing, and adds nothing. No order is emitted, and the arriving order carries no strain. The builder lens reports a match.
Leash. The thesis is an owned write that only adds, so it proceeds. No order is emitted, so nothing waits for approval.

Settled state

{theses} holds the recall thesis, with the condition that would prove it wrong.
{orders} and {portfolio} are unchanged.

Without the bound, thesis-first trade would read the data as it is two days on, distill a data-centre thesis the trader never had, and reconciliation would still report a match. That is the backfill the problem statement describes: a specification that fits the implementation because it was written from the implementation’s outcome. Deriving criteria before the replay does not prevent it, because the leak is in distillation, before the criteria exist.

Status: Unresolved

The run settles in the state the desk wanted, and it depends on three things the model has not closed.

The bound’s form is open. Market data makes it mechanical here, since every price and every note has a timestamp. Declaring {market data} in thesis-first trade’s span is also what puts the recall headline in its reading at all. The order alone does not carry it.
The bound is stated for distillation, not for the controllers after it. The theses controller writes against {market data} as it now stands, rumour included. What keeps the rise out of the thesis is that the controller derived its criteria from the bounded intent. A write that adds a data-centre angle beyond those criteria is reported, and nothing in the model says whether that report is enough. The leash does not catch it either. {theses} held no Kessler Semi thesis before the run, so the angle removes nothing from the standing specification, and a write that only adds proceeds.
The bound covers artifacts, not people. A distiller that asks the trader two days later gets an answer shaped by the rise, because no bound restricts what a person remembers. Deferring the ceremony, which is half the guarantee, widens that window, and a position keeps collecting results while it waits.

Variant C: the thesis is invalidated by the market

Take the portfolio settled by variant A. In week ten Orrin ships a replacement chip, the condition the Kessler Semi thesis names. The feed job records the announcement in {market data}. Nobody touches the mandate, the theses, the orders, or the portfolio.

Expected run

Lift. The change touches {market data}.
Find candidates. No workflow owns or outputs {market data}. Its controller is the feed job, so there are no upstream candidates. Thesis-first trade reads {market data} as an input, so it is a downstream candidate.
Distill. The intent is the change’s own, and it is thin: market data is current as of week ten. A press release carries no intent of the portfolio’s owner, and the run does not need one. The criteria the specifications already state take part in the join, and the thesis states its own invalidation condition.
Ask the controllers above. Nothing is asked. The change landed in thesis-first trade’s input, so the workflow reads it, diff included, and runs from {market data} downward. No job writes {market data}, so nothing waits.
Replay. At {theses} the controller finds that the data now meets the Kessler Semi thesis’s invalidation condition, and closes the thesis as invalidated. At {portfolio} no position may outlive its thesis, and the only way to reach that is a sell order.
Reconcile. Nothing is reconciled. The workflow reads the source as an input, so the arriving data is not a prediction to check, and the run never writes it.
Leash. Closing the thesis is an owned write, and the criteria pass. It also removes the Kessler Semi thesis, its reason and its invalidation condition, from the standing specification of {theses}. The theses controller reports the contradiction, and the leash stops the write for approval. The check runs at every write to the set, so it catches this one although the workflow is a downstream candidate that asked nothing. The change came from a feed job, so there is no requester to ask. The stop reaches the trader, the only approver on this desk. The sell order is an output and waits for the same person. The trader can approve both at once, or approve the closure and pre-approve the rest of the run’s gates, which covers the sell order if its criteria pass. Either way the closure is recorded as a decision.
Propagate. Once the order fills, semiconductors fall further under 25%, so {mandate} to {portfolio} holds. {theses} to {portfolio} holds, because no position outlives its thesis.

Settled state

{theses} records the Kessler Semi thesis as invalidated in week ten, with the trader’s approval of the closure.
{orders} holds the approved sell.
{portfolio} no longer holds Kessler Semi.
{mandate} and {market data} are unchanged by the run.

Status: Holds

The loop starts only from a change, and declaring {market data} gives the announcement one. The trading workflow is found by a lookup over its declared input, not by noticing a stale thesis first. The earlier objection, that a press release carries no intent of the portfolio’s owner, is true and does not matter. The intent the run needs is the thesis’s, and the thesis states it as a criterion.

The leash stops the closure, and that is what the desk wants. Passing the criteria is not enough to drop a thesis, so a feed job’s write cannot close one with no person involved. Removing a thesis reaches the trader like any other change to what the desk believes.

The stop fires on a removal the standing specification itself requires. {market data} to {theses} says no thesis stands while the data meets its invalidation condition, and the closure carries out that criterion. The leash compares the write with the standing specification and asks only whether it removes or reverses part of it. It does not ask whether another standing criterion demands the removal. Here that costs nothing, because the sell order waits for the same person at the same moment, and one answer can cover both.

Pre-approval does not reach the closure itself. A feed job starts this run, so no approver is present at its start, and the closure is the run’s first stop. Pre-approval widens the leash for the rest of the run, after a person has spoken, so it can spare the second ask and not the first. On a set with no output next to it, the closure would be the only stop, and it would be ceremony. The remedy there is loosening the set’s leash for every run, which is the wider tool, and this desk declines it for {theses}.

Two things remain outside the settled state.

How fast the sale happens. Between the announcement and the fill, {theses} to {portfolio} is strained: a position is held past its invalidation. The closure and the sell order both wait for approval, and nothing in this instance limits how long. That is the workflow’s strain policy to state, as in variant A.
A feed that stops. The freshness criterion on {market data} to {theses} goes false when the job fails, and the strain says so. A job that fails on every run starts a run on every tick, and what bounds that sequence is open.

What it tests

Outputs that cannot be revised. An order is emitted, so strain on it clears only by a superseding order, and variant A’s breach window is the lifetime of that obligation.
The leash on an irreversible write. Every order the runs produce waits for the trader. A new thesis only adds, so it proceeds on the criteria alone.
The leash against the standing specification. Variant C closes a thesis from a downstream run that asked nothing and has no requester, and the stop still reaches the trader. It fires even though another standing criterion requires the closure, and pre-approval can cover only the sell order after it. Variant B shows the other side: an angle added beyond the derived criteria only adds, so the leash lets it through.
The approver on a one-person desk. The trader approves every stop, whoever or whatever made the change.
Criteria over the outcome where the earlier state cannot be restored. Variant A settles by a new order rather than by undoing the old one, and the criteria do not tell the two apart.
The window between a change and its settled state, when the change acts on the world at once. The roles explain it. How long it may last is the strain policy’s to state, and this instance states nothing.
Reconciliation at a source that is an output. Variant A keeps the arriving order and adds a superseding one, because nothing can change what was emitted.
The time bound on distillation against hindsight. Variant B shows that criteria derived above the source protect reconciliation and leave distillation exposed, that the bound closes the leak from data but not the leak from people, and that controllers writing after distillation read the data unbounded.
A change with almost no expression. An order is a ticker, a size, and a time. Thesis-first trade finds the intent only because {market data} is in its span, and it is there because the workflow declares the data as an input. Rebalance, without the data, reads a narrower intent that joins with it.
Downstream candidates. Variant C reaches the trade workflow by a lookup over its input, from a feed job’s write that carries no owner intent, and runs from the input down with nothing to reconcile.
Declared roles as a guard. Thesis-first trade reads {market data} and owns the thesis, so no replay can rewrite the data to keep a thesis alive.
A source brought inside the boundary. The market is outside the system until {market data} is declared, and its freshness is a criterion over time.
An artifact outside the repository. The broker holds {orders} and {portfolio}, and nothing in the model needs git to reason about them. Lifting does: a trade log has to be raised into artifact-set vocabulary the same way a diff is.