Schema 7 adds a persisted monitoring heartbeat, the last recorded gap and a gap hold, with deterministic migration from schema 6 that keeps every lock, cycle identity and reservation.
D0 is no longer invented on startup or on a rollover: a trading day is adopted only when its boundary was observed while the EA was executing, or when the equity path across it is provably constant (no position, no pending order, no account deal). Otherwise the previous D0 is preserved, a monitoring-gap hold blocks every new entry and the exact gap is reported; the hold survives restart and clears only at an observed day boundary or an explicit owner cycle. Static, target and daily thresholds keep their priority, so a breach is still locked and liquidated while a day is unverified.
Account scope is now counted and disclosed for owned and unmanaged positions and pending orders; unmanaged pending orders block entries under the external-exposure guard, and the EA states that the account-wide limits cannot be guaranteed while whole-account liquidation stays disabled.
A reservation could be released merely because an unrelated position or pending order existed under the same Magic Number, and an order ticket was treated as a position ticket. An entry whose submission result was lost also released its reserved risk.
- UQ_Defs: state schema 5 adds the reservation identity; ENUM_UQ_SUBMIT_RESULT and a retcode classifier that only accepts proven non-execution.
- UQ_State: reservation id, magic, scope, direction, volume, entry, stop, order/deal/position tickets are persisted, checksummed and strictly validated. A previous-schema reservation migrates to UNRESOLVED with its money preserved, never to NONE.
- UQ_Risk: UQReserveCorrelate links a reservation to the broker only through its own order ticket, a deal whose DEAL_ORDER is that ticket, or the traced POSITION_IDENTIFIER. Ambiguity, a disconnected terminal and a missing record all keep the money reserved as UNRESOLVED and block entries.
- UQ_Exec: UQSendMarket reports the submission outcome; the caller withdraws reserved risk only on a local preflight failure or a proven broker rejection.
- Universal_Quant_EA.mq5: deals and order transactions reconcile the reservation immediately; status and startup diagnostics expose the reservation identity.
UQExposureFromPools() no longer converts an unusable OrderCalcProfit() result into a plausible risk with MathAbs().
Every owned position and pending order is now validated: direction, instrument pricing, volume, entry/reference price, protective stop, stop side, OrderCalcProfit success, finiteness and a strictly adverse monetary result. A zero, positive, non-finite or inconsistent result marks the aggregate exposure unbounded, records the symbol, ticket and reason, and refuses new entries instead of counting the item as zero risk.
The conservative worse-of opening/current reference rule is unchanged, the aggregate formula (1.0% of live equity) is unchanged, and unquantifiable exposure is never represented as zero. The volume sizing and the reserved entry risk in UQ_Exec.mqh require the same adverse result, so a fabricated amount can never enter the reservation or the ceiling.
One authoritative exposure calculation (UQExposureFromPools) replaces the positions-only aggregate: owned positions, owned pending orders and money reserved by an accepted but unreconciled entry all count, and a stop-less or non-convertible exposure is reported as unbounded so entries are refused.
An entry now reserves its monetary risk and persists the reservation before the request leaves the terminal (state schema 4). The reservation keeps blocking entries until the broker state proves the position or the pending order it produced; a verified rejection or a connected re-query that finds no exposure releases it. An unreconciled reservation survives a restart.
Position risk is measured from the worse of the entry and current price down to the stop, so the bid/ask spread cannot release aggregate budget right after an entry.
Sizing and risk now use the tick-size normalised stop that is actually submitted, the final volume is re-checked against the budget and the remaining aggregate budget, and OrderCheck validates the exact request. Adds the optional InpRiskBufferPct withholding for costs and slippage (default 0).
A permanent static-drawdown or equity-target lock is no longer cleared in place. Every accepted reset now closes the current cycle and opens a new one with an owner-declared positive baseline, a new daily baseline, a new cycle identifier, a new creation timestamp and a consumed nonce, and it is persisted and re-verified before entries may resume.
State schema moves to format 3 (cycle identity, consumed nonce history, prior-cycle reference). Formats 1 and 2 remain loadable: the checksum is verified over the field set that produced it and the state is then migrated deterministically.
A rejected reset fails closed - the lock stays active and entries stay blocked - instead of aborting risk management, and a nonce consumed by an earlier cycle is acknowledged but never re-applied after a restart.
Also fixes an unreachable state: the two permanent locks are independent and may both be active, so the loader no longer refuses such a state (which previously made it unwritable).
* UQ_Exec: pending orders are cancelled by ticket and every targeted order is re-queried; a successful request is never treated as proof of deletion
* UQ_Exec: positions are closed against live quotes and verified in the position pool; a partially closed position is never counted as closed and its remainder is retried
* UQ_Exec: EA-only scope is preserved for both order and position inventory, so unrelated orders are never cancelled and unrelated positions never closed
* UQ_Exec: CUQLiquidator state machine (CANCEL_PENDING, CLOSE_POSITIONS, VERIFY_FLAT, RETRY_REQUIRED, MANUAL_INTERVENTION, COMPLETE) with an authoritative flat verification each cycle
* UQ_Exec: exhausting the bounded attempt budget enters MANUAL_INTERVENTION and keeps retrying at a slower interval; it never reports completion while exposure remains and never re-enables entries
* UQ_Exec: a disconnected terminal makes the account state UNVERIFIED rather than complete
* UQ_Exec: liquidation no longer blocks the terminal thread with Sleep and no longer depends on local clock time
* UQ_Defs: liquidation state enumeration and bounded retry policy
* Universal_Quant_EA: liquidation is armed by the active risk lock from both OnTick and OnTimer, including after a restart, and the status panel reports the liquidation state
