# Adopt — carry a held leg across a wake with `ARM … foreach held leg`

Two rules make the book honest, and together they can feel like a trap the first time you
hit them:

- **Never naked.** A plan may only sell what *it* holds — the runtime refuses an uncovered
  sell (`uncovered sell refused: never naked`), so a plan can never write risk it isn't long.
- **A position outlives the plan that opened it.** When you supersede a document, a plan still
  holding inventory keeps managing it under its own record (names are lineage — you can't
  re-declare its name). So a *new* replacement plan starts with zero inventory and, by "never
  naked," cannot sell the leg the old plan is sitting on.

The escape hatch is **`ARM … foreach held leg`**. It transfers management authority for the
exact held leg from the superseded plan to the replacement — an explicit adoption, never
inferred from a matching strike. The adopter then manages and exits the leg like any position
it opened itself. This page walks the whole loop, end to end, with the two example files the
package ships.

## The loop has three beats

**① Morning — the fill.** You stage the opening document as `plans-0.kestrel`. `acquire`
crosses its trigger and fills a 100C; that leg is now Book inventory, riding under `acquire`'s
own record. This is the shipped `examples/plan-acquire-open.kestrel`:

```text
PLAN acquire
  WHEN spot crosses above 100
  DO buy 1 100 C @ 1.0
```

**② The wake — the adopter revision.** At the wake the runtime hands you a Frame and waits for
`revision-0.kestrel`. You reply with the `manage` plan — a *new* name, because names are
lineage. It **supersedes**: `acquire` is de-armed, `manage` arms, and the `ARM … foreach held
leg` binding transfers the held 100C to `manage` at basis 0.90. This is the shipped
`examples/plan-manage-adopt.kestrel`:

```text
PLAN manage
  ARM basis 0.9 foreach held leg
  EXIT spot crosses above 114 @ 2
```

**③ Afternoon — the exit.** `manage` now holds the leg, so its `EXIT` is a *covered* sell. When
spot crosses 114 it rests the out and the leg is closed — the exact escape hatch the one-way-door
trap used to swallow.

## Drive it with the stepped-day handshake

The loop needs three files in a fresh directory: the two plan documents and a short bus whose
spot crosses **100** in the morning (so `acquire` fills) and **114** in the afternoon (so the
adopted `EXIT` rests). Copy-paste this whole block — it is self-contained (no package paths to
resolve), runs unattended, and terminates:

```bash
mkdir -p ./run

# ① the opener — staged as the day's plan document `plans-0.kestrel`.
cat > ./run/plans-0.kestrel <<'EOF'
PLAN acquire
  WHEN spot crosses above 100
  DO buy 1 100 C @ 1.0
EOF

# ② the adopter — staged as your wake reply `revision-0.kestrel`. In a live session you author
# this AT the 12:00 wake; staging it up front lets the whole loop run in one command.
cat > ./run/revision-0.kestrel <<'EOF'
PLAN manage
  ARM basis 0.9 foreach held leg
  EXIT spot crosses above 114 @ 2
EOF

# ③ a bus whose spot crosses 100 then 114 — the same fixture ships at examples/adopt-cross.jsonl.
cat > ./adopt-cross.jsonl <<'EOF'
{"seq":0,"ts":1783690200000,"stream":"META","type":"session","session_date":"2026-07-10","instruments":[{"symbol":"SPY","assetClass":"option-underlier","role":"exec"}],"mode":"sim","bus_schema":6}
{"seq":1,"ts":1783690200000,"stream":"TICK","type":"HEARTBEAT","phase":"open"}
{"seq":2,"ts":1783690260000,"stream":"TICK","type":"SPOT","instrument":"SPY","px":99}
{"seq":3,"ts":1783690320000,"stream":"TICK","type":"SPOT","instrument":"SPY","px":101}
{"seq":4,"ts":1783690380000,"stream":"TICK","type":"BOOK","instrument":"SPY","underlier_px":101,"legs":[{"strike":100,"right":"C","bid":0.5,"ask":0.9,"bsz":5,"asz":5}]}
{"seq":5,"ts":1783702800000,"stream":"TICK","type":"SPOT","instrument":"SPY","px":108}
{"seq":6,"ts":1783704600000,"stream":"TICK","type":"SPOT","instrument":"SPY","px":116}
{"seq":7,"ts":1783704660000,"stream":"TICK","type":"BOOK","instrument":"SPY","underlier_px":116,"legs":[{"strike":100,"right":"C","bid":2.5,"ask":3,"bsz":5,"asz":5}]}
{"seq":8,"ts":1783713540000,"stream":"TICK","type":"SPOT","instrument":"SPY","px":117}
EOF

kestrel day --bus ./adopt-cross.jsonl --dir ./run --fill strict-cross-v1 --r-usd 1000 --wakes 12:00
```

The stepped day opens on `plans-0.kestrel`, drives to the 12:00 wake and reads your staged
`revision-0.kestrel` (the supersede + `foreach held leg` adoption), then drives to settle. The
graded report shows `acquire` filling one 100C, `manage` adopting it at basis 0.90, and the
covered sell closing the leg — `plans_armed=2 … orders_filled=2`, fill → adopt → exit, with no
naked hole opened at any step.

> **The `kestrel` binary** comes from `npx kestrel.markets` (or a global / local install); the
> heredocs above make the run self-contained from any empty directory, so there is no package
> path to resolve. From a checkout of this repo the same bus already ships — skip the third
> heredoc and pass `--bus examples/adopt-cross.jsonl`.
>
> **Interactive variant:** add `--await-author` and the day BLOCKS at the wake instead of reading
> a pre-staged reply, so you can author `revision-0.kestrel` live after watching the morning fill.

## The runtime stops you before you can bind nothing

Adoption is the one place the "never naked" and "names are lineage" rules combine into a trap,
so the runtime refuses every way of *almost* adopting rather than let one silently bind nothing:

- **A bare `ARM`** (or `ARM basis <px>` with no leg) is **refused at parse** with a did-you-mean
  naming `ARM foreach held leg` — an adopter that would adopt nothing can't ship.
- **An `EXIT`/`TP`-only revision** that forgot the `ARM … foreach held leg` binding is **refused
  at arm**: it carries a covered sell but can never hold inventory, so it manages nothing and is
  rejected outright (it never arms, and the standing book is never torn down for it).
- **A valid adopter that finds nothing to adopt** — a well-formed `ARM … foreach held leg` armed
  when no superseded, inventory-holding plan is in place — still arms (a different session would
  bind), but the report carries a loud **`ARM bound nothing`** notice on the plan's own line, so a
  zero-leg bind is never mistaken for a working adoption.
- **A `DO sell` naming the same strike** is still refused as naked — acquisition and adoption are
  different verbs.

The binding only ever attaches to a leg that is genuinely held, and only up to the held quantity,
so the handshake opens no naked hole. Want a blunt "flatten this now" instead of an authored
`EXIT`? That is the agent-level `flatten` action, which crosses a covered close for every managing
plan.

## See also

- `kestrel card first-plan` — a plan clause by clause.
- `kestrel card first-wake` — the standing subscription that decides *when to look*.
- `kestrel card first-frame` — the Frame the runtime hands you at each wake.