fix: full-codebase audit — 25 defects (1 critical: stops expired at the close, positions naked overnight)

[yebof]

Full-codebase audit: 25 defects found and fixed (1 critical, 6 major, 18 minor)

A 20-unit audit workflow over the whole repo (src 24k lines / tests 31k / prompts 2.7k) — 15 subsystem finders + 5 cross-cutting lenses (money-arithmetic consistency, concurrency/crash-safety, time/timezone, tests-as-spec, prompt↔code drift, dead guards). 102 raw findings → adversarially verified one-by-one → 25 confirmed and fixed, 16 refuted.

🔴 CRITICAL — every BUY-attached stop expired at the close; positions were naked overnight

alpaca-py's StopLossRequest has no time_in_force field, so an OTO child leg inherits the parent's tif. The entry parent is (correctly) DAY — an unfilled entry limit must die at the close rather than fill into a stale thesis — which silently made every BUY-attached protective stop a DAY order too. Alpaca expired it at 16:00 ET the same session. Any position bought in the morning and not later handed a midday/close TRAIL_STOP (the only path that used the GTC _submit_stop_limit_order) sat completely unprotected overnight — exactly when the gap risk the stop exists for happens.

Production proof: VST bought 2026-06-26 09:47 ET with SL=$158.75; the same evening's coverage reconcile logged VST held=31.0000 but only 0.0000 covered; the gap persisted until an LLM SELL exited at $152.77 on 07-01 — ~$185 worse than the stop would have capped. Control: GTC trail-stops on GE survived day boundaries in the same account. Live check: all 3 open stops today are GTC stop-limits from the trail path; not one BUY-attached stop exists.

It also contradicted the close-session prompt, which tells the reviewer to hold overnight because a broker stop is standing watch.

Fix (the leg's tif can't be set independently, so decouple): the entry stays a plain DAY limit; broker.place_entry_protection() waits for terminal, reads the actual fill, and places a GTC stop-limit for exactly that qty (this also fixes a latent bug — the OTO leg was sized to the requested qty, so a partial fill over-covered). Belt: _reconcile_stop_coverage now repairs a naked long from the stop recorded on its last BUY (the level PM/RM approved — no longer "unknown", which was the original objection to auto-repair), refusing to place at/above the live price. This retroactively protects anything the old bug left naked.

MAJOR

Defect	Effect
finalize persisted the post-sell residual into the position_qty_before_sell column	The drain re-derives pre − fill from the same order → fill subtracted twice → for an exact fill the residual hit 0, took the "full exit, nothing to protect" path, reported success and deleted the WAL row. The residual stayed naked forever.
get_session_close() always returned None	Calendar.close is a naive datetime, not a time, so datetime.combine() raised TypeError on every call → the early-close guard was dead code and midday/close ran against a shut market on half-days. The test that should have caught it built a MagicMock with a time.
_get_sector() returned "Unknown" for every ETF	yfinance .info has no sector for ETFs → max_sector_pct was skipped entirely on an ETF BUY, and a held XLV contributed $0 to Healthcare for an LLY BUY. Both directions of the cap dead, on a ~20%-ETF universe.
Constructor emitted a gross weight delta as allocation_pct	Every consumer spends it as raw notional: a 6% SQQQ (3x) target deployed $6k = 18% gross, then the next session saw 18 vs target 6 and SOLD 67% of the hedge PM wanted held, repeating until raw ≈2%.
A single NaN market_value silently disabled max_total_position_pct + max_sector_pct	NaN comparisons are all False → the caps switched off for the whole session, on exactly the broken-snapshot day they matter most.
macro sector_guidance was never persisted	Every macro_sector_stance / macro_sector_tailwind was permanently "unknown" — the evening thesis-health step and every missed-opportunity snapshot rendered "Macro sector stance: unknown" nightly while macro was emitting OW/UW calls. Three stacked breaks (not persisted; reader wants a dict, model carries a list; overweight vs bullish).
parse_json scored a top-level list as 0	tech_analyst returns an array of per-symbol analyses; whenever the model wrapped it in prose the scan returned only the last element — a 25-symbol chunk could silently collapse to 1 with 24 discarded and no error. Reproduced.
ma_200 was unconditionally None in production	lookback_days is calendar days → 120 yielded ~82 bars and len(df) >= 200 never held. The tech_analyst prompt rendered MA200=None for every symbol every day.
compute_trade_calibration ignored filled TRAIL_STOP exits	Every stop-out left a phantom open lot and closed nothing (LLY read as 14 shares held while flat). The 8 real stop-outs move win_rate 22.2%→30.0%, avg_return −2.79%→−2.18% — these feed PM as facts and the reviewer as calibration_note.
earnings record_failure() marked the filing seen	After the first transient LLM failure the filing was never re-queued, the 3-strike budget never reached abandoned, and PM was served the prior quarter's analysis labelled "[from cache]" as if current. Hit every symbol with a same-form analysis on disk — the whole universe in steady state.

MINOR (18)

Ex-div stop adjustment could never fire for a Monday ex-div (calendar +1 day is never a Monday for a Mon–Fri session; Friday computed Saturday) · _force_delever booked proceeds only after insert_trade, so a DB hiccup on a live SELL force-sold the next position to cover a deficit already covered · cancel_snapshotted_stops discarded the rollback's failed_specs · correlation cluster omitted the BUY symbol's own existing position (40k NVDA + 10k AVGO + 5k add scored 15%, not 55%) · target_weight_pct=0 (CLOSE) swallowed by the churn filter into a permanent HOLD · stop validated unrounded but shipped rounded (could round up to exactly the entry) · ExecutionStage discarded the fresh price_map (the 5% entry-staleness guard compared against research-time prices) · position_reviewer given raw cash while the sweep vehicle was stripped from its positions · the evening Telegram snapshot counted parked SGOV as deployed capital · reviewer prompt says "think in ATRs" but build_user_message never rendered atr_pct/stop_distance_atrs · the same SELL re-graded 2–3 nights running counted as independent sells · the same-day trim guard failed open on a partially-filled-then-canceled sell · queued-earnings cap bounded the delta, not the resulting weight · change_30d_bps measured ~57–60 days (sign-flipped on live data today) · plus the tests that pinned two of these bugs.

Three of these were regressions from today's own PR #101 (reviewer cash, ATR rendering, and the emergency×park interaction), caught by the same audit.

Notable refutations (16)

Verification earned its keep: news symbol matching already uses word boundaries; every _locked_write caller passes a single statement; the Anthropic cache accounting is correct despite a stale comment; the FIFO lot matcher handles partial exits correctly; the stuck-WAL scenario is mechanically unreachable; the retry-deadline ordering is fine given the 300s HTTP timeout.

Test plan

• Full suite: 1351 passed (was 1310 on main; +41 regression tests, each naming the bug it locks out)
• SDK-level verification of the critical bug (StopLossRequest field list) + reproduction of parse_json, get_session_close, and the ma_200 gap
• Read-only live-account check confirming the naked-overnight mechanism
• Watch the first live morning: entries followed by a GTC stop per fill, and any coverage repair on the existing book

🤖 Generated with Claude Code

https://claude.ai/code/session_01PQkESoSTYx2bCy7WYnTPXR