AI Market Maker v6.1.4

Release Date: July 29, 2026 Tags: ORDER-FLOW, MONEY-PATH, BINARY-AUTHORITY, RISK

Overview

v6.1.3 removed the legacy bot subsystem on the grounds that everything it did already existed elsewhere. Two of those grounds did not survive review: trade cadence and order size shaping genuinely did not exist anywhere in the live engine.

v6.1.4 rebuilds both as an order-flow layer, and fixes the defects found while wiring it — including one that created funds out of nothing.

---

Upgrade Notes

A backend rebuild and a database sync are required

• Changed: two model changes ship here — the moment a bot's cooldown expires, and a closing-order reference plus a new CLOSING status on copy-trading trades.

---

Added

Order flow

The order-flow layer decides when a trade prints, how big it is, and which bot takes each side.

It does not decide price. The price process remains the sole price authority. The removed personality classes each computed their own limit prices, which would have put a second, uncalibrated hand on the series that binary options settle against.

• Added pacing across the day: Max Daily Trades is now a daily budget, not a fuse. Previously a wall — six bots against caps of 50/100/200 and a flat once-a-second coin flip exhausted every tier 33-50 minutes into each UTC day, after which the market printed nothing until midnight. The allowance is now paced along a 24-hour UTC activity curve, so it lasts.
• Added intraday shape. Peak hours (13-15 UTC) run about 3.3× the overnight rate. The old cadence was a single constant, identical at 03:00 and 14:00.
• Added a realistic size distribution — mostly small, occasionally large, snapped to round lots, with an occasional block — replacing a uniform band of ±20% around the configured average, which was the most obvious synthetic-tape tell in the addon.
• Added deterministic order flow. Every draw comes from the engine's own counter-based streams, on ids disjoint from every price stream, so order flow is exactly replayable for audit and statistically independent of the price path. No timers, and no wall-clock randomness.

---

Fixed

Copy trading closed positions by minting funds

• Fixed a follower's stop-loss crediting their wallet directly, with no order, no counterparty, and no offsetting debit anywhere. Two details made it worse: the credit went to the ECO wallet while the position sat in COPY_TRADING, so the follower kept the real position and received a minted copy of it in an on-chain-withdrawable wallet; and the exit price came from the AI market maker's synthetic book levels, which expire, have no backing order, and can never be matched against.
• Fixed settlement to place a real opposite MARKET order from the COPY_TRADING wallet and record the actual fill. If the book cannot fill the exit, the position correctly stays open rather than being settled at a price that does not exist. See Upgrade Notes for the new CLOSING state.
• Fixed an unrelated database fault in the allocation release, which was the only thing blocking this payout on strict-mode MySQL. It is fixed in the same change, never separately.

A second mint: the leader profit share

• Fixed the leader's profit share being credited with no offsetting debit — created from nothing rather than taken from the follower who earned the profit. It also paid the leader into ECO while the binary copy path pays SPOT, so the same product had two divergent payout destinations. The share is now a transfer out of the follower's COPY_TRADING wallet into the leader's SPOT wallet, mirroring the binary path exactly.
• Fixed the platform fee being written as a fee record and never actually collected — no debit, no admin credit. Spot copy-trading platform revenue was reporting money nobody had taken. It is now debited from the follower and credited through the shared platform-fee path.

Two more mints, and the root cause

Auditing the wallet lookup turned up two further unfunded credits, both with the same origin:

• Fixed cancelling a COPY_TRADING order refunding into ECO. The ecosystem refund path assumed the wallet type, so a copy order left its hold stranded in the COPY_TRADING wallet's in-order balance and credited an equal amount into ECO — losing the follower's locked funds and creating the same amount from nothing. It now reads the wallet type the order row already carried.
• Fixed deleting a leader doubling every follower's unused allocation. The binary branch used a balanced COPY_TRADING to SPOT transfer; the spot branch credited ECO with no debit, so followers kept the balance in COPY_TRADING and received a second copy in ECO. A comment on the binary branch had already named this defect — only half of it was ever fixed.

Other money-path corrections

• Fixed under-holding on copies. MARKET orders held funds at top-of-book while filling across the AI ladder (0.1%-0.5%), so settlement's locked-funds guard rolled the fill back and stranded the follower's funds as held-in-order. Both copy paths now walk the book.
• Fixed money being priced against synthetic depth. Anything pricing money now reads a book of order-backed levels only; the display book is unchanged and still shows AI depth.
• Fixed the AI orderbook rebuild deleting real orders. It previously wiped every level for the symbol on each AI trade — including users' and followers' resting orders — with repair only on a five-minute reconciliation pass.
• Fixed SELL return being wrong by a factor of the entry price: a 1% move on a $60,000 asset rendered as 60,000%.

Binary engine authority

Binary RISE_FALL settles on the 1-minute candle close of the expiry minute. Three writers touch that row, and only one of them may own it.

• Fixed the market maker being able to un-publish a steered close. The engine's published close is now pinned for the rest of its minute, and the claim is shared across every process the backend runs. Previously the market maker overwrote it within 1-10 seconds, leaving the settled order permanently disagreeing with the chart — the single provable signature of manipulation.
• Fixed a real user's trade being able to do the same. The matching engine now consults the same authority.
• Fixed late settlements being non-deterministic. The containing candle keeps being rewritten for the rest of its minute, so a settlement running even seconds late priced on drift the contract never saw, varying with queue latency. Late settlements now use the sealed preceding candle. The on-time path is unchanged.
• Fixed the steering lever disabling itself. It abandoned the nudge whenever the distance to target exceeded the maximum allowed adjustment — that is, it gave up precisely when furthest from target, and the settlement seam shares that band, so both levers were lost exactly as exposure peaked. It now clamps to the allowed step instead, with guards against an unresolved (zero) price and against steering back toward an already-cleared barrier.
• Fixed entry prices being up to 120 seconds stale. The checkpointed price is only written every two minutes; entry now prefers the current candle close — the same series settlement reads.
• Fixed the audit recording the price that was asked for rather than what was achieved, so an investigation read a price the market was never steered toward. It now records requested against achieved, and which layer clamped.
• Fixed per-order exposure caps not working on every thread. The cap read an in-memory map filled by a main-thread-only scheduled job while orders are placed on every thread — so on a worker it reported "no cap" for a capped symbol, failing open on the path that spends user money. It now falls back to the database behind a 5-second cache, re-reading the global pause on the same path.
• Fixed steering being attempted without a live market maker. A binary engine can be ACTIVE while its market maker is stopped, because restart recovery skipped the liveness check the interactive path enforces. In that state nothing else writes the tape: entries read the last candle close and settlements publish into it, both numbers the engine itself last wrote — it would be settling against its own prints. It now fails safe to a fair settlement.

Risk limits that nothing called

The entire trade-level risk layer — trade result reporting, the circuit breaker and the stop-trading check — had zero callers. Nothing accumulated the global daily loss, so the breaker could never fire, and the only live part of the global risk check was three settings kill-switches.

It was never wired because AI-to-AI trades genuinely have no profit or loss — both sides are the house. But real-liquidity fills do, and the matching engine already records each bot's running realised total. A new reconciler carries it back as per-market deltas, computed per bot so that adding or deleting a bot cannot fabricate one.

• Fixed risk never being assessed. It is now assessed before every trade, making the volatility-proportional size reduction and the per-market loss limits live.
• Fixed a single market's losses tripping the global breaker. They now pause that market; only a global loss limit trips the breaker.
• Fixed the stop-trading check measuring a losing streak rather than drawdown against capital.
• Fixed the global loss percentage, which was a currency amount divided by 100 and called a percent.

Engine correctness

• Fixed both auto-pause branches in the risk monitor being dead. The volatility branch read a setting that does not exist on a market, so it never ran once; the loss branch summed a value nothing writes, so it was always exactly 0. Both read as working safety limits.
• Fixed the pool profit-and-loss subtree being unreachable, so a pool's unrealised figure had no writer and sat at 0 forever while the analytics page reported it as measured. It is now registered per running market and fed the live price. Its database write also hardcoded realised profit to 0, which would have destroyed the real figure once wired; it is written from each bot's running realised total instead — as is the weekly rollup, which previously overwrote the pool's realised profit with a zero every week.
• Fixed analytics reporting the market's target price as "Current Price" — the number an operator asked for, labelled as the one the market reached. They disagree exactly when someone looks.
• Fixed measured volatility being frozen at 0 on every synthetic market, because it was only sampled on the exchange-ticker path such markets return from early. Both consumers — the high-volatility pause and the dynamic spread — were therefore inert. It is now fed from the tick and scaled to a daily percentage, so the documented 0-100 threshold means something.
• Fixed auto-pause never reaching the running engine: PAUSED was unhandled in the status sync, so tripping a risk limit changed a badge and nothing else.
• Fixed the ecosystem orderbook cache not being invalidated after AI writes, so clients rendered a ladder that no longer existed.
• Fixed a failed publish still advancing the reference price, which corrupted the next tick's direction. No trade advances the reference now unless it published.
• Fixed quiet markets losing their depth. With cadence bot-driven, "no trade this tick" is the normal case, so the heartbeat had to move off the gated branch or a healthy market's expiring book would run out under it.

Operator surface

• Fixed the bot configuration form being able to save only two of its five fields. The risk slider ran 1-10 while the server accepts 0.1-1, so nine of ten positions returned a refusal — taking the one working field down with them. The three engine-relevant knobs — trade frequency, average order size and order size variance — posted names the server does not read and were dropped silently, with a success message.
• Fixed bot edits never reaching the running engine. Changes waited for the daily reset — up to 24 hours.
• Fixed cooldown being a one-way door. A cooldown now has an expiry and a bot returns on its own.
• Fixed per-bot activate being a no-op on a running market: the engine loaded only active bots, so a paused bot had no presence to flip.
• Fixed preferred spread and risk tolerance being persisted, validated, documented and read by nothing. Both are live.
• Fixed invented statistics presented as measurements — a 65% win rate, profitable trades derived from it, and a 50% success rate. Success rate is now real, or blank when there is nothing to measure.
• Fixed a full trade-history scan running on every bot-list request to feed three debug log lines. It is gone.