Paper engine: fix the retroactive cross-family review findings on #221, #242 and #284

[seathatflowsinourveins]

Why

This PR fixes the defects from retroactive cross-family reviews of merged paper-engine PRs. GPT-6 (gpt-6-astra, effort max) re-examined main at ca8e37f because those PRs merged while Codex was rate-limited. #243 (margin financing) passed.

PR	Severity	Finding
#221	Major	Activity-based gap recovery booked fills natively without persisting them to the durable ledger (native 3, durable 1).
#221	Major	A continuing LULD pause auto-cleared after 12 minutes, and cancel_expired then cancelled the exit it protected.
#221	Minor	Cash and realized P&L depended on whether the REST snapshot or the stream fills arrived first.
#242	Major	replay_compare silently skipped a named cancel stamped before its submit.
#242	Minor	Cancelling the transport task cleared the cancel identity before the HTTP worker sent the DELETE.
#284	Major	A clean exporter stop released its port before deregistering, which could remove a replacement exporter's target.
#284	Major	configure.py's initialization could overwrite a concurrent registration.
#284	Major	Malformed nested labels passed validation, which would make Prometheus reject the whole target list.

What

cad7faf. GPT-6 implementers fixed each finding test-first in their own worktrees, and every new regression failed before its fix. The coordinator then integrated the fixes:

• refreshed the pins in source-hashes.json and evidence.json;
• replayed the 20260923g sim-paper-compare receipt from its retained pages with the new code. It was identical apart from the run-local fields and runner_sha256, which were updated as in Record which order each paper cancel request was for; pair sim-to-paper cancels exactly #242;
• re-pinned sim-capacity's frozen replay_compare.py source with a dated limitation. An AST check shows the 8 definitions sim-capacity uses are unchanged.

c1539cd (repair round). Independent verification (8 Sonnet verifiers, one per finding, each mutation-checked) found 7 of 8 fully resolved. #221 finding 1 was unresolved in production: the fix persisted fills through port.controller, which only the test SimulatedPort has. The repair:

• persists through sink_observation, the hook every real transport is built with (runner.py fresh_port, mover_runner.py, the native-faults harness);
• makes SimulatedPort expose the same hook, so tests and production share one path;
• adds regressions for a real-shaped port and for incomplete-tiling refusal;
• adds tests for both accounting-replay guards;
• adds build_decisions-level cancel-chronology tests, including the equality boundary.

A second Sonnet mutation check of the repair confirmed the production wiring at every real construction site. Reverting the repair fails 3 of 45 native tests, including Decimal('1') != Decimal('3') on the real-shaped port.

Checks

• Affected modules, on the pinned runtime (nautilus-trader 2.0.0rc5, alpaca-py 0.44.0) with TMPDIR outside /tmp: runner, native, safety, transport, sessions, metrics, the source-hashes manifest, sim-paper-compare and sim-capacity. 761 tests OK, 2 skipped.
• Observability alert tests: tests.test_observability_backends_alerts, 19 OK.
• Full python3 -m unittest at cad7faf: 6,199 tests, 689 skipped. The one failure is test_pre_commit_gate, caused by gitleaks per-user lock contention from another session; it passes when re-run alone (3 OK).
• Validators: validate.py, evidence_manifest.py --check and validate_convergence.py --all-recorded pass.

Cross-family re-review of c1539cd: needs_changes (one pre-existing major, open)

GPT-6 confirmed that every finding above is resolved on the real production paths. It found one more major, which predates these commits: the gross realized loss that the loss caps read still depends on delivery order. For example, two shares at a 100.00 basis, sold as one at 110.00 and one at 90.00:

• stream-first records a loss of 10.00;
• a REST snapshot followed by both executions records 0.

A GPT-6 implementer is fixing it test-first in a stacked follow-up PR, so this PR carries only verified fixes. It stays open until that follow-up is up.

Boundaries

• Startup reconciliation not verified. The separate path that reports adopted open-order fills to NautilusTrader as FillReports is not verified here as durable.
• Stray /tmp/.git on the host. An empty /tmp/.git, probably left by a sandboxed Codex job, makes the credential guard reject temporary fixtures under /tmp in local runs. The checks above set TMPDIR outside /tmp.

SOTA sources

• The reviews and fixes follow the repository's own engine contracts: blueprints/us-equities/adaptive-paper/ (safety.Ledger, native_adapter, transport) and observability/backends/, at base 5008c30.
• Prometheus file_sd target format, and its label-value rules as checked by prometheus/common/model LabelSet. The Paper alert: scrape only registered adaptive-paper exporters, and alert only on a registered silent one #284 label validation follows them.
• Alpaca Trading API account activities (FILL) and trade_updates, as used by the pinned alpaca-py 0.44.0 (alpaca/trading/client.py at cc4cb3b7).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[seathatflowsinourveins]

Foundation ACK from native-agent-stack-9a for observability/backends/configure.py only, at head c1539cd1. The trading changes are outside what I reviewed.

• Initialization now matches metrics.update_file_sd: the same sibling adaptive-paper-targets.json.lock, an exclusive flock, the existence check and publish under the lock, and a same-directory temp file with fsync and os.replace. An existing list is still kept, so a concurrent exporter registration can't be overwritten.
• It is compatible with the --port-overrides flow from Observability renderer: host loopback port overrides that survive a re-render #290: the target list is initialized after the rendered files are written, and the overrides don't touch it.
• Locally at this head, tests/test_observability_backends_alerts.py and tests/test_observability_backends_configure.py give 24 passed, 21 subtests.

The planned hold stands: merge after the stacked follow-up for the open realized-loss major is up.