fix(uta): preserve approved writes and partial outcomes across restart

[luokerenx4]

A multi-operation push can place a real order and then fail its account snapshot, leaving the accepted order absent from the durable ledger (#1680). Prepared approvals also disappear on restart (#1313). This draft makes the existing TradingGit owner persist prepared approvals and dispatch progress, and exposes recovery in the existing review panel and agent status.

sequenceDiagram
  participant User
  participant Wallet as Existing wallet owner
  participant Disk as Pending file and commit ledger
  participant Broker
  Note over Wallet,Broker: Before: results stay in memory until every call and snapshot finishes
  Wallet->>Broker: First order
  Broker-->>Wallet: Accepted order ID
  Wallet->>Broker: Second operation and account snapshot
  Broker--xWallet: Failure
  Note over Wallet,Disk: Failure: accepted ID never reaches the ledger
  Note over Wallet,Disk: After: checkpoint each boundary in the existing owner
  User->>Wallet: Prepare approval
  Wallet->>Disk: Save hash and operations
  Wallet->>Disk: Save marker before broker call
  Wallet->>Broker: Submit operation once
  alt Response received
    Broker-->>Wallet: Outcome and order IDs
    Wallet->>Disk: Save outcome before another call or snapshot
    Note over Wallet,Disk: Restart restores known IDs for existing order sync
    Wallet->>Disk: Save final commit, then remove pending file
  else Process stops before outcome is saved
    Note over Wallet,Disk: Restore uncertain marker and block replay
    Wallet-->>User: Reconciliation required, with saved outcomes visible
  end

Loading

Minimal ownership change. pending.json sits beside commit.json under the existing account directory. Preparation saves the existing hash/message/operations. Before each broker call, the wallet saves the active operation index; before any next call or snapshot it saves the returned outcome and bracket IDs. The ledger remains the history owner. Atomic replacement, file flush and POSIX directory flush replace direct ledger truncation. A saved ledger hash wins over a stale pending file after interrupted cleanup. No old commit schema conversion or replay is added; this is a new file for previously volatile state.

On restart or retry, execution checkpoints never send more orders. Known outcomes can finish recording through wallet push or existing order sync; undispatched operations are marked not executed. Accepted IDs remain visible to sync and external-order observation, even while the final snapshot is unavailable. Reconciliation does not book uncommitted execution fills again as unexplained balance changes. Prepared, unexecuted approvals retain their exact hash and Decimal order terms and remain approvable. Uncommitted staging remains transient; preparation first stamps the existing sub-account audit message.

Review interaction. Reuses the current review detail, warning styling and shared Button. Saved parent/child IDs are visible. An uncertain call has no approve/reject action. Known results offer “Record saved results,” which sends no new orders. Agent status calls this execution recovery rather than awaiting approval. Desktop and mobile retain the existing queue/detail navigation and wrapping IDs. This conservative design is proposed for review, not represented as prior maintainer approval.

Candidate overlap inspected. #1644 at e693949c27cdd06c5b7487a0d05677cc244b51c1 owns deadlines, transport-uncertainty classification and snapshot fallback. Its exact diff persists only after the dispatch loop/snapshot; it does not checkpoint before/between broker calls. #1364 at 4e812c2ecc3b0c381430495136a212079e2a7b9b owns IBKR liveness and adapter behavior. This independent dev-based draft adds the uncovered durability boundary, not their classifier, timeout or adapter implementation. Their changes overlap TradingGit textually and require deliberate integration: retain pre-call/result checkpoints around their bounded dispatcher and persist a final ledger record before retiring the pending file. #1744 separately owns mock broker holdings. The two #1313 portions share no duplicate state.

Precise remaining decision. When a process dies after a request may have reached the broker but before its response is saved, local state cannot prove acceptance or rejection. This draft preserves that uncertainty and blocks further dispatch. It does not offer a force-retry or a discard action. Clearing that marker needs an explicit evidence contract: broker-native correlation that proves the outcome, or an operator acknowledgement that records how the broker was reconciled. Neither is invented here. Existing thrown-error classification is left for #1644; this is not a claim that all network errors are definite rejections. Broker/snapshot timeout behavior also remains with that candidate. Windows directory-flush/power-loss acceptance has not run; native Windows does not support the POSIX directory-fsync path. Synchronous file writes trade small local latency for ordering; no background persistence queue is introduced.

Verification completed:

• Twelve isolated file-backed recovery tests: approval restart, partial execution plus snapshot failure, crash during a later call, pre-call disk failure, result-save failure, interruption between calls, final-save failure/retry, stale-file cleanup, sync ordering, rejected approvals, and corrupt-file refusal.
• Existing TradingGit tests and focused agent/UI tests passed.
• UTA integration suite passed: 14 files / 291 tests.
• UTA/protocol/root/UI typechecks passed (UI locale completeness corrected during validation).
• Chromium on the real demo review route, with isolated execution-status fixtures: known and uncertain states at 1280px and 390px; IDs visible, unsafe approval actions absent, mobile width 390px. No broker writes.
• Complete UTA owner suite: 60 files / 1,062 tests passed.
• Full monorepo suite: 891 files / 7,605 tests passed; 9 files failed (49 test failures plus 5 suite-load failures) because skipped dependency lifecycle scripts left Electron, node-pty and Dugite binaries unavailable, and npm cache was outside the sandbox. The npm suite passed all four tests with a temporary cache. No unrelated product files changed to mask environment failures.
• Pushed SHA d5afff3d50c711cced0d82d0841c60f56eed6484 verified; GitHub clean-build completed successfully at that SHA, and Vercel checks passed.
• No live trades, user-data cleanup, security-permission change or hedge-position abstraction.

Included increment: durable prepared approvals and execution checkpoints, with existing sync and review consumers.

This is a Draft proposal. Do not merge or close #1680/#1313 merely because local or remote checks pass.

Final published head after the verification-plan update: 0bfef326adaa6e82d417253e41df7f2999e37daa. Exact-head clean-build run 36998990149 completed successfully; Vercel checks passed. Implementation tests above apply unchanged.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openalice-demo	Ready	Preview	Oct 2, 2026 11:04am UTC