The month-end signal arrives and an order is submitted, but the screen keeps spinning. You request a pause, then cancellation. More shares subsequently appear in the account. How can risk keep growing after you asked the system to stop?
A request, an acknowledgment, and a fill are different events. Operational readiness requires evidence of what happened when information was incomplete, not merely a visible stop button. We will reconstruct two complete synthetic incident records and identify which activities their recovery evidence permits.
Keep three decisions separate
By the end, you should distinguish research acceptance, forward simulation, and real implementation readiness; reconcile partial fills, fees, cash, and open orders; and save both a data interruption and an order incident in T09. All evidence is supplied. You need no code or real orders to complete the exercises.
A research conclusion concerns rules and evidence. Forward simulation observes frozen rules as new information arrives. Real implementation additionally requires a particular account's permissions, charges, data, and order channels to be checked. Correctly resolving an incident on paper does not establish that any software passed those checks.
There is no universal rule that one month of simulation authorizes live use. A monthly strategy might make one decision, place no order, and experience neither a partial fill nor a connection failure. Observation must cover relevant decisions and failure conditions. Profitable observations cannot substitute for recoverability.
G80's separate teaching policy reviews an 8% month-end drawdown and pauses new risk while submitting a reduction request at 12%; a fault can block additions at any time. We introduce no new intraday stop-loss here and grant no additional capital. G57 addresses psychological preparation; this chapter examines operating facts and recovery evidence.
Freeze a checkable fact card
This is C3-52-v1, an independent synthetic operating exercise, not a real C2 backtest or CoTrading feature test. Dollar simulation account SIM-A begins with $1,000 cash, no holdings, and no external flows. Fictional asset X trades in shares. Purchase commission is $0.10 per share, without a minimum, taxes, other costs, or leverage.
After D0's month-end close, a price strictly above $20 creates a target of ten X shares; otherwise the target is zero. D1's specified window handles new purchase orders with a $20 limit. D0 and D1 are consecutive supplied normal trading days. All times are UTC: D0 closes at 21:00 and D1's window begins at 14:30. These are exercise inputs, not a year-round U.S. exchange schedule.
The internal check accepts only SIM-A, asset X, the unit “shares,” and quantity ten. Maximum reserved cash is $201. Read and trading permissions are separate; transfers are not permitted. Revoking the original automated channel's trading credential does not remove a separately authorized read-only reconciliation route. These are stated facts, not a broker's default behavior.
The target has a stable identifier, V1-D0-X. On retry, first inspect the original order for that target rather than sending a new identifier immediately. An identifier helps reconciliation. Whether a tool actually prevents duplicate submission requires its own test; naming an object does not prove a safeguard works.
Incident one: the value arrives with the wrong timestamp
At D0 21:05, the data interface returns an X close of $19 stamped D−1 21:00. This decision requires D0's close. Record stale data, no new target generated, and zero orders, preserving the raw response. Do not treat the old $19 as the current close and conclude that this month's valid target is cash.
Pause new decisions dependent on the faulty batch. The initially empty account remains at $1,000 cash; no sale has just occurred. An account with existing shares would retain those shares and their risk. An error state cannot erase them. Missing data, mixed time zones, and changed units similarly need checks before signal generation.
At 21:20, the exercise supplies a verified D0 close of $22 with a 21:00 timestamp, matching account and units. Preserve the corrected batch and its connection to the stale response. Recalculation produces the ten-share target, still eligible only for D1's window. Do not backfill a D0 trade or imply the value arrived before it actually did.
Close this exercise incident as stale data reconciled and target calculation restored. It proves neither real vendor recovery nor restored live permissions. The evidence consists of both batches, time checks, a target version, and the zero-order ledger, not an unsupported message saying the retry succeeded.
Incident two: a fill follows the pause request
The supplied D1 window price is $20. Reject two drafts before submission: one names SIM-B; the other expresses quantity in dollars instead of shares. Only SIM-A, ten shares, and the $20 limit pass, producing order O1. Its maximum cash requirement is ten times $20 plus $1 commission, or $201.
The following are supplied synthetic confirmations, not actual broker responses obtained by the author.
| D1 time | Given event | Recorded state |
|---|---|---|
| 14:30 | O1 accepted; four shares fill at $20, commission $0.40 | Cash $919.60, four shares, six open |
| 14:31 | Original interface disconnects; fills cannot refresh | Block additions; O1 requires reconciliation; do not resubmit |
| 14:32 | Same target triggers again and proposes O2 | Duplicate rejected in this exercise; O2 not submitted |
| 14:35 | Separate authorized channel requests cancellation of O1; request receipt arrives | Cancellation pending; open quantity still reserves cash |
| 14:36 | Original automated channel's trading permission confirmed revoked | No new orders through it; O1 not confirmed terminal |
| 14:37 | Independent read-only fill record shows two more O1 shares, commission $0.20 | Six filled in total, four still open |
| 14:40 | Independent order record confirms remaining four canceled; cumulative fills remain six | Open quantity zero; six-share simulated holding reconciled |
At 14:35, receipt of a cancellation request does not establish that the remaining shares cannot fill. SEC guidance tells investors to confirm actual cancellation and warns that resubmitting an uncertain order can duplicate a trade.[1] Include the later two shares in O1's record rather than deleting them as a supposed ghost order.
Revoking permission is neither canceling an accepted order nor liquidating holdings. In this example it prevents new actions through the original channel, while O1 continues under the supplied events until 14:40. Verify each real service's permission scope and order behavior separately. If querying also becomes unavailable, a previously verified manual or read-only reconciliation route is needed. An unreachable interface does not establish that nothing happened.
Reconcile six shares and every dollar
The first fill costs $80 plus $0.40, reducing cash from $1,000 to $919.60. The second costs another $40 plus $0.20, leaving $879.40. Six shares marked at $20 are worth $120. Equity is therefore $999.40, exactly the original $1,000 less $0.60 total commission. There is no price profit or external flow, and fees are not deducted a second time from equity.
After the first fill, reserve $120 plus $0.60 for the six open shares: $120.60. Cash available for another commitment is $919.60 minus $120.60, or $799. After two additional shares fill, the four remaining require $80.40. Cash of $879.40 minus that reserve is still $799.
Only confirmed cancellation at 14:40 releases the $80.40, raising cash available for commitments to $879.40. A reserve is not an incurred fee, and releasing it is not profit. Do not treat the entire remainder as already filled while also reserving cash for those same shares.
Six filled plus four canceled must reconcile to the original ten-share order. If quantities or cash do not match, preserve the discrepancy and continue blocking additions. AI cannot supply an invented fill to make the account balance.
Recovery evidence determines the next permitted state
At 14:50, the exercise supplies the corrected data batch, O1's individual fills and final state, a zero-open-order list, SIM-A cash and holdings, confirmation of revoked original trading permissions, the wrong-account and wrong-unit rejections, and the unsent duplicate record. These materials independently reconstruct $999.40 equity.
The recovery decision permits read-only observation and further simulated diagnosis. Original automated trading remains revoked, and the six shares remain held. No evidence establishes repair of the original fault, restored order protections, a new funding review, or acceptance of an actual tool. Do not upgrade the result to live-ready. A target of ten shares does not itself authorize immediately buying the other four.
NIST's cybersecurity framework includes least-privilege authorization and verification and documentation during recovery.[2] Those general principles help organize the evidence sequence. They do not certify a trading system or establish that CoTrading implemented these synthetic controls.
Actual-tool testing would require a verified isolated simulation environment, identified tool and rule versions, and observable import, trigger, fault, query, export, and recovery states. Inability to export orders or distinguish a cancellation request from confirmation leaves that operating capability unverified. A screenshot cannot supply missing account evidence.
Change one fill report
First explain why a 14:37 fill after the 14:36 permission revocation is not automatically an erroneous ledger. Address permission scope, O1's earlier acceptance, pending cancellation, and the independent fill record. If the actual service's behavior is unknown, identify that gap rather than assuming revocation ended old orders.
For an independent variant, keep the initial four-share fill. During the disconnection, three more shares fill at $20 with commission of $0.10 per share, followed by confirmed cancellation of the remaining three. No other events occur. Calculate final cash, holdings, equity, and the reserve before cancellation confirmation.
Reference answers · reveal
Answer guide: The additional purchase costs $60.30, reducing $919.60 to $859.30. Seven shares are worth $140, so equity is $999.30. The three open shares reserve $60.30, leaving $799 available for other commitments until confirmed cancellation releases it. Reusing the base case's $879.40 and six shares would omit one share and its $0.10 fee. Return to the event records instead of adjusting a final cell.
For the explanation, permission changes apply to a specified channel and activity; O1 had already been accepted and its cancellation was not yet final. The given later fill is separate evidence that must enter the account. A general assumption about a stop request cannot overrule the supplied order history.
Save a T09 record another person can replay
Keep strategy and funding-policy versions, account identity and permission scope, data batches and usable times, signals and targets, order and fill identifiers, fault discovery, each request and confirmation, filled and open quantities, fees, cash, recovery evidence, and the allowed next state. Save both incidents and the variant separately without overwriting original records.
Check that stale data generated no valid new signal, that AI did not repair a wrong account or unit into an unverified order, that permission revocation did not replace cancellation confirmation, and that a pause did not pretend to liquidate the position. Cover the answers and rebuild both variants from $1,000. Every discrepancy should point to an event.
Preserve requests, confirmations, and existing risk
Monitoring connects signals, permissions, orders, and accounts on one timeline. A research result does not establish reliable channels, and an uneventful simulation does not demonstrate fault recovery. A pause still leaves old risks to reconcile.
Save what was requested, what was confirmed, and what remains permitted separately. Those records provide the basis for discussing recovery rather than assuming that a stopped interface means a stopped account.
References
- SEC Investor.gov: Online Investing. Confirm fills and actual cancellation; avoid duplicate orders.
- NIST: The NIST Cybersecurity Framework 2.0, February 26, 2024, PR.AA-05 and RC.RP-05/06. General authorization and recovery principles; the order states and reservations are independent teaching assumptions.
Sources inspected October 30, 2026. AI-assisted draft; independent AI full-text and bilingual review is complete. Human financial review and target-reader testing have not been performed. The account, incidents, and controls are synthetic; no real order, platform test, or live-readiness acceptance is claimed.