Schema 7 adds a persisted monitoring heartbeat, the last recorded gap and a gap hold, with deterministic migration from schema 6 that keeps every lock, cycle identity and reservation.
D0 is no longer invented on startup or on a rollover: a trading day is adopted only when its boundary was observed while the EA was executing, or when the equity path across it is provably constant (no position, no pending order, no account deal). Otherwise the previous D0 is preserved, a monitoring-gap hold blocks every new entry and the exact gap is reported; the hold survives restart and clears only at an observed day boundary or an explicit owner cycle. Static, target and daily thresholds keep their priority, so a breach is still locked and liquidated while a day is unverified.
Account scope is now counted and disclosed for owned and unmanaged positions and pending orders; unmanaged pending orders block entries under the external-exposure guard, and the EA states that the account-wide limits cannot be guaranteed while whole-account liquidation stays disabled.
The backup was built from the previous primary before the new primary was installed, so it could lag the newest successful update, and a missing primary was still treated as a candidate fresh installation. Neither an interrupted commit nor a stale mirror was detectable.
B1 state schema 6 (defines UQ_STATE_FORMAT=6, UQ_STATE_IDENTITY_FORMAT=5) adds a monotonic stateRevision plus recoveryHold/recoveryHoldTime. Formats 1..5 keep their own field block, so every published checksum still verifies over exactly the block that produced it, and a migration sets generation 1 without inventing a lock event.
B2 UQStateSave is write-ahead and generation-aware: the next generation is derived from what is proven on disk (primary and backup), the staged file is written and read back, the same verified bytes go to the backup and are read back, the primary is replaced and read back, and primary and backup are finally reconciled on generation and content. A newer verified state is never overwritten by an older instance; a failure at any step returns false, which blocks every new entry.
B3 LoadPersistentState orders primary and backup by generation: newer primary wins, equal generations must agree on content (otherwise fail closed), and a backup exactly one generation ahead is the interrupted-commit window and is adopted. Anything else is refused.
B4 a backup is evidence of a previous initialization, so a missing primary is never a fresh installation and never creates a replacement B0; a verified backup is restored only under explicit owner authorization.
B5 a recovered, reordered or superseded state always starts behind a persisted recovery hold (UQ_BLOCK_RECOVERY) that survives restart and only an explicit owner-authorized recovery risk cycle (UQ_RESET_RECOVERY, fresh nonce, explicit B0, flat scope) can clear. A recovery never clears a permanent lock the recovered state carries, and a cycle without a prior permanent lock records no prior-cycle reference instead of an inconsistent one.
B6 the initialization marker is written and then verified; a marker that cannot be persisted or verified fails the load closed.
B7 the status panel reports the persistence generation and an active recovery hold.
A reservation could be released merely because an unrelated position or pending order existed under the same Magic Number, and an order ticket was treated as a position ticket. An entry whose submission result was lost also released its reserved risk.
- UQ_Defs: state schema 5 adds the reservation identity; ENUM_UQ_SUBMIT_RESULT and a retcode classifier that only accepts proven non-execution.
- UQ_State: reservation id, magic, scope, direction, volume, entry, stop, order/deal/position tickets are persisted, checksummed and strictly validated. A previous-schema reservation migrates to UNRESOLVED with its money preserved, never to NONE.
- UQ_Risk: UQReserveCorrelate links a reservation to the broker only through its own order ticket, a deal whose DEAL_ORDER is that ticket, or the traced POSITION_IDENTIFIER. Ambiguity, a disconnected terminal and a missing record all keep the money reserved as UNRESOLVED and block entries.
- UQ_Exec: UQSendMarket reports the submission outcome; the caller withdraws reserved risk only on a local preflight failure or a proven broker rejection.
- Universal_Quant_EA.mq5: deals and order transactions reconcile the reservation immediately; status and startup diagnostics expose the reservation identity.
The owner-reset writer could record priorLockKind=3 (both permanent locks armed), but the state validator accepted only 0, 1 and 2, so a persisted state written by a partial reset was rejected on the next load and the surviving permanent lock could not be reloaded at all.
- accept the documented bit field 0..3 in the validator and keep the structural checks (prior cycle id, baseline, lock event timestamp); - introduce shared helpers so writer, validator and display cannot diverge again; - record the lock history with those helpers and reject a recorded permanent lock that has no consumed reset nonce; - log and display the recorded prior lock kind, and state explicitly that a partial reset leaves the other permanent lock blocking entries.
Symbol resolution is now deterministic and fail-closed: an exact catalogue name wins, a broker prefix/suffix variant is accepted only when the inferred convention is verified and exactly one eligible FX instrument remains, and every other outcome is reported as EMPTY, NOT_FOUND, AMBIGUOUS or INELIGIBLE instead of silently choosing the shortest match. Eligibility rejects non-FX calculation modes, invalid volume constraints and unusable tick data.
A single centralised scheduler now walks every managed symbol from both OnTick and OnTimer, so a multi-symbol portfolio no longer depends on ticks arriving on the attached chart. The duplicate-entry guard, the account risk gate and the direction-permission gate are shared by both event paths.
One authoritative exposure calculation (UQExposureFromPools) replaces the positions-only aggregate: owned positions, owned pending orders and money reserved by an accepted but unreconciled entry all count, and a stop-less or non-convertible exposure is reported as unbounded so entries are refused.
An entry now reserves its monetary risk and persists the reservation before the request leaves the terminal (state schema 4). The reservation keeps blocking entries until the broker state proves the position or the pending order it produced; a verified rejection or a connected re-query that finds no exposure releases it. An unreconciled reservation survives a restart.
Position risk is measured from the worse of the entry and current price down to the stop, so the bid/ask spread cannot release aggregate budget right after an entry.
Sizing and risk now use the tick-size normalised stop that is actually submitted, the final volume is re-checked against the budget and the remaining aggregate budget, and OrderCheck validates the exact request. Adds the optional InpRiskBufferPct withholding for costs and slippage (default 0).
A permanent static-drawdown or equity-target lock is no longer cleared in place. Every accepted reset now closes the current cycle and opens a new one with an owner-declared positive baseline, a new daily baseline, a new cycle identifier, a new creation timestamp and a consumed nonce, and it is persisted and re-verified before entries may resume.
State schema moves to format 3 (cycle identity, consumed nonce history, prior-cycle reference). Formats 1 and 2 remain loadable: the checksum is verified over the field set that produced it and the state is then migrated deterministically.
A rejected reset fails closed - the lock stays active and entries stay blocked - instead of aborting risk management, and a nonce consumed by an earlier cycle is acknowledged but never re-applied after a restart.
Also fixes an unreachable state: the two permanent locks are independent and may both be active, so the loader no longer refuses such a state (which previously made it unwritable).
* UQ_Exec: pending orders are cancelled by ticket and every targeted order is re-queried; a successful request is never treated as proof of deletion
* UQ_Exec: positions are closed against live quotes and verified in the position pool; a partially closed position is never counted as closed and its remainder is retried
* UQ_Exec: EA-only scope is preserved for both order and position inventory, so unrelated orders are never cancelled and unrelated positions never closed
* UQ_Exec: CUQLiquidator state machine (CANCEL_PENDING, CLOSE_POSITIONS, VERIFY_FLAT, RETRY_REQUIRED, MANUAL_INTERVENTION, COMPLETE) with an authoritative flat verification each cycle
* UQ_Exec: exhausting the bounded attempt budget enters MANUAL_INTERVENTION and keeps retrying at a slower interval; it never reports completion while exposure remains and never re-enables entries
* UQ_Exec: a disconnected terminal makes the account state UNVERIFIED rather than complete
* UQ_Exec: liquidation no longer blocks the terminal thread with Sleep and no longer depends on local clock time
* UQ_Defs: liquidation state enumeration and bounded retry policy
* Universal_Quant_EA: liquidation is armed by the active risk lock from both OnTick and OnTimer, including after a restart, and the status panel reports the liquidation state
* UQ_State: checksummed schema v2 with strict typed parsing, duplicate/unknown-field rejection and semantic validation of every mandatory field; legacy v1 files are validated and migrated on load
* UQ_State: verified backup retention, staged-file verification before commit and post-commit re-verification
* UQ_State: redundant identity-scoped initialization marker reconciled against the persisted state
* UQ_Risk: a new risk cycle requires an explicit owner authorization and a deliberately declared positive B0; the current account balance is never used as a substitute
* UQ_Risk: missing, empty, corrupt, foreign, version-unsupported or schema-invalid state fails closed; backup recovery only under explicit owner authorization
* UQ_Risk: a failed state write degrades the controller to unhealthy, blocks all new entries, preserves the in-memory lock and retries at a bounded interval
* UQ_Risk: daily rollover keeps permanent locks and reports unmonitored intervals explicitly
* UQ_Defs: state schema constants, marker global-variable prefix and the STATE PERSISTENCE FAILED block reason
* Universal_Quant_EA: first-initialization and backup-restore authorization inputs, input validation and state-health status line
