Recovery exits each held symbol on its own fresh quote (#215 part 1)

[seathatflowsinourveins]

Summary

This fixes issue #215, part 1. Before this change, one stale or sparse held symbol could stop recovery from exiting any other symbol. It does not close #215: part 2 (the ambiguous GRML intent with no broker record) and the trial C run-loop stall stay open.

• recovery.py: each exit gates on its own symbol's quote.
  • The exit takes the alphabetically first held symbol whose own quote is fresh at that turn.
  • A symbol without a fresh quote is deferred, never priced from a stale mark, and never holds back another symbol's exit.
  • Before every exit, recovery checks that a whole exit (2 × order_timeout) still fits before the deadline. Otherwise it ends with recovery_quote_not_fresh if a held symbol is still unquoted, else recovery_deadline_reached.
  • The result reports stale_symbols, which is meaningful only together with recovery_quote_not_fresh.
• mover_runner.py: the recovery ports' readiness waits on the benchmark quotes only, as the trial port's already does.
  • This covers the forced-recovery port in command_paper and the port in command_recover.
  • recover_mover fails closed with held_symbol_not_subscribed unless every held and unresolved symbol is subscribed.
• What stays binding: the 3 s quote-age rule for every order, exits included; the kill switch; the loss and drawdown caps; and stale held marks still block entries.
• Not touched: transport.py, runner.py, safety.py, native_adapter.py and order_contract.py, so the native-fault gate's bound sources do not move.
• Adaptive lane: runner.py's recovery port still gates start() on every held symbol, until the F1 follow-up. README-recovery.md states this.

Tests (failing-first)

Test	On the pre-fix code
PerSymbolRecoveryExits (5 cases): a stale symbol doesn't hold back a fresh one; a stale symbol is exited once it quotes; all-stale waits to the deadline and sends nothing; a late quote starts no exit; no exit starts once a whole exit no longer fits	4 of 5 fail (the late-quote guard passes by design)
MoverPaperCommandWiring.test_recovery_ports_require_only_the_benchmark_quotes	[['SPY'],['SPY'],['BBB'],['BBB']] != [['SPY']]*4
RecoveryPortSubscription.test_a_held_or_unresolved_symbol_the_port_does_not_subscribe_fails_closed	SafetyError not raised
3 transport guards: an owned exit with a fresh quote reaches the wire under an admission freeze; an exit without one is refused before the wire; start waits on the required basket only	pass before and after

Checks at 9d6b873b (rebased on main b0fb65b4)

• All 20 adaptive-paper modules: 1,203 tests OK, with the pinned runtime (Python 3.12, nautilus-trader 2.0.0rc5, alpaca-py 0.44.0).
• Source-hash test OK; evidence_manifest --check passed; validate.py passed.
• trading_gates.py --check passed: native-fault-behaviour stays at bound 6, stale 3 (runner, safety, transport), unchanged from base.
• git diff --check clean; the three registry tests OK.
• Review history:
  • an Opus 5.5 evidence-reviewer returned changes-needed on the first revision (1 must-fix, 1 should-fix, 4 nits), and all were repaired;
  • an independent stack-verifier returned pass twice.
• GPT-6 cross-family review follows before merge.

Evidence class

Local synthetic tests with fake ports and streams only. No broker run, and no paper acceptance for this path. The mover recovery start now depends on a SPY quote within start_timeout (15 s), which is unmeasured on the broker after hours.

SOTA sources

• alpaca-py v0.44.0 (tag cc4cb3b7, transport.py SDK_COMMIT), alpaca/data/live/websocket.py:
  • :93-99: data_timeout is off by default for legitimately quiet subscriptions;
  • :239-276: staleness is judged per connection, not per symbol.
• nautilus_trader v2.0.0rc5, crates/risk/src/engine/mod.rs:
  • :434-437 and :2281-2345: a global Halted or Reducing state still admits reduce-only exits, and no quote-age kill condition exists.
  • No upstream Alpaca adapter exists; the engine's native_adapter.py is the adapter.
• The engine's own rules: README-safety.md (every order needs a quote at most 3 s old); README-transport.md:123-128 (the readiness contract).

🤖 Generated with Claude Code

[seathatflowsinourveins]

Cross-family review round. GPT-6 (gpt-6-astra, effort max, read-only) reviewed head 9d6b873b and returned changes-needed: 1 must-fix and 3 should-fix. All four are repaired in 88536ec1 (rebased on main 1b8d6334). GPT-6 implemented the repair test-first through codex exec in the owned worktree, and the coordinator re-ran the acceptance before committing.

1. Must-fix: the whole-exit budget is rechecked after position preparation and pre-wire authorization, immediately before submit(). New tests: test_position_preparation_cannot_spend_the_whole_exit_budget, test_pre_wire_authorization_cannot_spend_the_whole_exit_budget and test_pre_wire_authorization_preserves_the_unquoted_error. All three fail on 9d6b873b: the base sends an exit with 0.75 s left against 0.8 s required.
2. Distinct per-symbol prices: PFSA 10.00/10.01 and SRZN 20.00/20.01. The review's quotes[held[0]] mutant now fails (['9.98'] != ['19.98']).
3. All-stale then timely arrival: an independent task delivers the quotes before the cutoff. The removed-quote-wait mutant now fails.
4. Deadline decisions run on a controlled monotonic clock, injected into the recovery module only. The hang watchdog stays on real time. It passes under the reviewer's 550 ms scheduler delay, which failed the old test.

Coordinator acceptance on the pre-rebase tree:

• all 20 adaptive-paper modules OK, and the recovery module OK 3 times in a row;
• the source-hash test OK; evidence_manifest --check and validate.py passed;
• trading_gates.py --check passed, with native-fault bound 6 and stale 3, unchanged;
• git diff --check clean; the registry tests OK.
  The hot files were re-checked after the rebase. transport.py, runner.py, safety.py, native_adapter.py and order_contract.py are untouched.

That completes one review and one repair per reviewer family. Guarded auto-merge is set at 88536ec1.