feat(sl-hunting): v4d knowledge and crash-durable recovery

[DoRmAmMu1997]

What this PR now delivers

This PR combines the SL Hunting v4d knowledge update from the 10 Aug 2026 Intraday Hunter session with the crash-recovery work that the same trading day proved necessary.

SL Hunting v4d knowledge

Source: Intraday Hunter live session, 10 Aug 2026 (flhHzz87Of0, around 10:50).

• Treat opening type as a participation/inventory read, not merely a momentum label.
• Book just before a crowded round-number target rather than assuming the exact level will fill.
• Include entry quality as a fourth target-sizing input.
• Pre-commit the adverse move the thesis can tolerate before the thesis is invalid.
• Clarify that the flat-open fade is the default, while the already-documented multi-day-down Variant B remains an explicit seller-hunt long exception.
• Preserve the 11 Aug premarket context and existing prompt-size/schema guards.

Crash-durable session recovery

The 10 Aug machine hang exposed a separate runtime defect: the killed process had realized -?5,195.25, but its replacement process started with a fresh zero ledger and later produced the only EOD summary. This PR now prevents that class of loss-accounting reset.

• Atomically persist trade events, realized-P&L rollups, and periodic open-position snapshots.
• Archive the exact previous state file before a replacement run writes anything.
• Always restore compatible same-day realized P&L and trade counts into matching workers, even when open-position resume is disabled, so a restart cannot reset a daily max-loss budget.
• Keep open-position resume opt-in, paper-only, same-day, unclean-session-only, and restricted to a fully validated single-leg contract with valid direction, option right, quantity/lot geometry, entry, stop, target, expiry, segment, and identifiers.
• Mark failed worker snapshots explicitly as unsafe so stale open-position data cannot become a ghost resume.
• Preserve the last durable state for forensics if a fresh snapshot fails.
• Record clean_shutdown separately from results_published; an orderly flat shutdown is not claimed as exported unless a real Google Sheet cell batch succeeds.
• Keep local fsync durability explicit and warn if a state write takes at least 250 ms.
• Gitignore timestamped recovery archives because they contain operational position and P&L data.

Safety boundaries

• Live broker exposure is never reconstructed from the JSON file; the broker account and execution ledger remain authoritative.
• Resume defaults to off and can only reconstruct eligible paper single-leg positions.
• Corrupt, stale, incomplete, live, unsupported, or geometrically invalid position records fail closed and leave the worker flat.
• Persistence failures are isolated from the trading loop and logged; no broker or model call was made during verification.

Review trail

The initial findings and rationale are recorded in this review comment. Commit c16e142 implements and tests the resolution.

Verification

• python -m unittest Tests.test_nifty_multi_strategy_master ? 508 passed, 52 skipped
• python -m unittest Tests.test_market_data_health ? 26 passed
• python -m pytest "Tests/Signal Generators" "Tests/Dependencies" "Tests/Data Extractors" -q ? 1126 passed
• Focused session-state suite ? 35 passed
• Branch coverage ? 70.0%, all safety/broker module thresholds passed
• Ruff, mypy (54 source files), compileall, exact CI Bandit, pre-commit, repository policy, and all four pinned dependency audits ? passed

Attribution

SL Hunting source research and original v4d prose were generated with Claude Code. The crash-recovery review, hardening, tests, and PR enhancement were completed with Codex; the implementation commit includes the Codex co-author trailer.

[DoRmAmMu1997]

Codex review — crash-state hardening required

I reviewed the current PR head (947a77d) against its stated crash-durability and live-money safety contracts. The knowledge and focused tests are useful, but I found the following issues that should be fixed before merge:

1. P1 — startup destroys the previous unclean recovery file. SessionStateStore starts with an empty document, then the forced startup snapshot replaces the old file. With resume off (the default), the first restart erases the trade journal and recorded P&L the feature exists to preserve. Even with resume on, the new store discards the old journal after restoring positions.
2. P1 — same-day realized losses are not reliably restored. _resume_open_positions() returns when no open position is resumable and copies realized_pnl only inside a successful single-leg paper restore. Flat, live, unsupported, or disabled strategies therefore receive a fresh max-loss budget. The more current event-derived recorded_pnl is calculated but never applied.
3. P1 — clean_shutdown=true does not prove results reached Sheets. Non-EOD shutdowns skip publication, and Sheet failures are non-fatal, but both paths are still marked clean. That makes unpublished P&L ineligible for recovery and vulnerable to the next startup overwrite.
4. P2 — a failed worker snapshot can preserve a stale open_position. The worker is omitted, while incremental state updates leave its old position untouched; a later resume can invent a ghost paper position.
5. P2 — resume validation accepts non-functional positions. Direction, symbol, segment, right, expiry, lot size, entry underlying, stop/target and directional geometry are not validated before an active position is created.
6. P2 — publish_trade_event() is documented as non-blocking but synchronously performs JSON serialization, fsync, and os.replace on the trading worker. A slow filesystem can pause risk management; the durability/latency contract must be made explicit and bounded or moved to a dedicated writer.
7. P2 — the v4d flat-open rule is phrased categorically, then the same section permits the existing flat-open seller-hunt long. Phrase the first as the default and name the exception so the agent does not nondeterministically prioritize contradictory instructions.
8. CI — both quality jobs fail Bandit B112 at _position_leg_marks; the existing Ruff suppression does not suppress Bandit.

I reproduced the overwrite independently: an unclean file containing one -₹1,250 exit became an empty trade list with no recorded_pnl after the next store's startup snapshot. Current focused suites pass because they do not cover these lifecycle transitions.

I’m following this review with regression tests and a hardening commit on this PR branch. No broker or model call will be made during verification.

[DoRmAmMu1997]

Implemented the follow-up hardening in c16e142 and pushed it directly onto this PR.

Resolution against the eight review findings:

1. Prior crash evidence overwritten ? fixed by atomically rotating the exact old file to a timestamped *.recovery.json archive before creating the replacement session.
2. Realized loss reset after restart ? fixed by restoring same-day event-derived P&L/trade counts into matching workers independently of the open-position resume switch.
3. Clean shutdown conflated with Sheet publication ? fixed with separate clean_shutdown and results_published facts; publication is true only after a real Sheet cell batch succeeds.
4. Stale snapshot could become a ghost resume ? fixed by persisting an explicit invalid-snapshot marker, retaining the old record for forensics, and making it ineligible for resume.
5. Weak position validation ? fixed with fail-closed validation of direction/right pairing, symbol, quantity and lot geometry, entry/stop/target geometry, option identifiers, segment, strike, expiry, and price fields.
6. fsync behavior contradicted the non-blocking contract ? corrected the contract/documentation and added a warning when a durable write takes at least 250 ms. Telegram remains non-blocking; local crash durability is intentionally synchronous.
7. Flat-open prompt ambiguity ? clarified the ordinary flat-open fade as the default and explicitly preserved the separately scoped multi-day-down Variant B seller-hunt long exception.
8. Bandit CI failure ? replaced the silent reporting exception with a DEBUG breadcrumb; the exact CI Bandit command now passes.

Additional regression coverage proves archive rollover, same-day bookkeeping carry, clean-vs-published state, invalid snapshot refusal, complete paper-position validation, Google Sheet result semantics, and both flat/live bookkeeping restoration.

Local publication evidence: 508 master tests + 52 skipped, 26 market-health tests, 1126 mirrored pytest tests, 35 focused session-state tests, 70.0% branch coverage with all safety thresholds green, Ruff, mypy, compileall, Bandit, pre-commit, policy checks, and four pinned dependency audits all passed. No broker or model call was made.

[DoRmAmMu1997]

Hosted verification is now complete on commit c16e142:

• Python 3.12 quality checks ? ? passed
• Python 3.13 quality checks ? ? passed
• Python 3.12 broker dependency validation ? ? passed
• Python 3.13 broker dependency validation ? ? passed

Workflow run: https://github.com/DoRmAmMu1997/My-Algo-Trading-Code/actions/runs/31423992393