[mctils12-arch]

Why

Second half of "fix the condor close … make sure it works so we don't have this issue again" (2026-11-02). The first half, #1582 (v1.0.1251), makes options_manager close a multi-leg strategy as a unit and pursue the close until the legs are gone. This PR stops the Node side from undoing that.

The Tier-1 per-position kill in syncMonitoredPositions judged every option leg by its own premium P&L (−75 % long / −150 % short). On 10-28/29 it read the two long wings of the GOOGL Nov-27 iron condor as "down −99.8 %" and retried their liquidation every minute pre-market (122 audit lines), bought the short 310P back on a "−309 %" reading at $27.60 while its 300P wing was itself submitted for a sell on a zero mark — in the same minutes the options manager's own rules fired on the same legs (held_for_orders rejections). A defined-risk structure's worst case is bounded by its wings; a per-leg percent kill cannot see that and, by closing the legs at different times, pushed the loss past the structure's max loss.

What changes ([RULE-REVIEW]: scope, not threshold)

• shared/positionLevels.ts: OPTIONS_DEFINED_RISK_STRATEGIES = iron_condor, qqq_iron_condor, bull_put_credit_spread, bull_call_spread, bear_put_spread, buy_straddle (a subset of the multi-leg set; short straddles are undefined-risk and stay out).
• server/bot.ts: posKillOptionsStructures() reads voltrade_options_state.json once per sync (60 s cache) through the pure posKillDefinedRiskLegs(); inside the kill branch, a leg whose recorded strategy is defined-risk leaves the branch with one POS-KILL-STRUCTURE-HOLD audit line per ticker per UTC day and no order — the options manager closes the group. The branch opener, the mark guard, the two-tick confirmation, the duplicate guard, the POST and the informational POS-KILL-OPTION-HOLD line are untouched (the hold is one more continue before the mark guard; the sibling harness tests slice on the unchanged opener and still pass).
• Prior value: every option leg judged alone (the 2026-10-13 scope fix). Rollback trigger (experiments.md): a defined-risk structure's realized loss exceeding its max loss (wing width × qty × 100 − net credit) by > 10 % while the manager could not act.

Downstream chain (REASONING STANDARD §1)

Fewer per-leg liquidations on structures → no duplicate orders against the manager's group close → the group closes as a unit at one moment, inside its wings' bound. During a Python-side halt a defined-risk structure is now unmanaged by Node, which is acceptable precisely because its loss is bounded by construction; undefined-risk legs keep the backstop. Single legs (the CSP sleeve) are unchanged.

Tests

• server/posKillStructureHold.test.ts (new, 7): the set is a subset of the multi-leg set without short_straddle; posKillDefinedRiskLegs admits only defined-risk legs (unknown / single / short-straddle / garbage rejected); wiring pins (read once per sync, unchanged opener, hold before the mark guard with continue, option-skip line untouched); the real loop body run tick by tick against stubs — a condor wing at −99 % held with one line per day, the condor's short leg at −309 % held, a standalone sold put at −160 % and a straddle leg still killed on the second valid-mark tick, the informational OPTION-HOLD line unchanged.
• All 117 kill-branch harness tests pass; full suites: server 2945/2945, client 1429/1429; tsc ratchet 6 ≤ 6; counter pins locked (tests 710, assertions 25863).

Closes research/open_questions.md KNOWN BROKEN #45 (b).

---

Generated by Claude Code