fix: fail-closed concentration/margin debt + activity id dedupe

[cursor]

Summary

• Fail closed on hard concentration when post-deployment NAV is non-positive (previously skipped the 30% cap and accepted 100% single-ticker tickets)
• Refuse null marks when deriving SnapTrade margin debt (previously treated missing prices as $0 and understated the loan)
• Preserve SnapTrade activity id and update TransactionSyncing dedupe to prefer id / include symbol (prevents same-day same-size BUY collisions)
• Exit 0 on notification_failed after draft write so SimpleFIN does not retry into duplicate smoke drafts
• Link to related issue(s): n/a (critical-bug automation)

Test Plan

• Targeted tests pass (uv run pytest tests/test_guardrails.py tests/python/test_snaptrade_integration.py tests/python/test_buy_ticket_agent_smoke.py tests/python/test_margin_metrics.py --no-cov)
• Lint is clean (uv run ruff check on touched files)
• Types are clean (uv run mypy src/integrations/snaptrade/client.py src/analysis/margin_metrics.py)
• Compliance scan staged: PASS

Review Checklist

• No secrets or PII committed
• Documentation updated (TransactionSyncing skill/workflow dedupe)
• Test coverage maintained or improved

Concrete triggers

1. portfolio_value=0 + cash-funded 100% TSLA ticket → was accepted, now concentration_uncomputable
2. Open holding with price=null → derive_margin_debt raises instead of understating debt
3. Two same-day −$2000 BUY activities (different tickers) → can now dedupe by id / symbol
4. ntfy failure after draft write → CLI exits 0 so watcher marks deposit seen

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: 35a2d71

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR