The previous post explained why contract expiry is a problem worth solving. This one is the machine that solves it: four states, three triggers, one five-minute timeout, and a recovery branch that refuses to be clever.

Where this fits

In GenServer as a Living Order Book I deferred the contract-roll details: "four states, three triggers, a five-minute safety timeout. A later post walks the full machine." The setup — what a contract roll is, why automation can't ignore expiry — is in the previous post. What happens after the roll — P&L on positions whose entry and exit land in different sessions — is the next one.