Keep shared-runner sell commitments durable and refresh exit pricing - #1170

Scope

The shared runner needs whole-share sell chunks that finish their durable reduction target across ticks, fills and restarts. This PR carries the sanitized #1091 change and keeps commitment strength separate from current exit pricing. A stop or trailing signal now changes the resting order's pricing basis even when an older, stronger commitment still targets zero. A closed-session refusal automatically re-arms when the validated session window opens.

• Base: 9cf1225581ffca6ea42e30076ddd7ac9074f828f.
• Lane: lane:trading.
• This consolidated correction is one commit on reviewed parent 93f34f01057a9eb68dc07d098a8c3755670959a0.
• Split adaptive paper sells within the durable order envelope #1091 remains parked at 7511c8ae350f4e1b868b097fb163284a4822ff12. This replacement PR carries all its sanitized content. CC owns landing; test(trading): qualify lane A OVERNIGHT stage admission #1095 remains gated.
• The fold touches native strategy, refusal classification/transport, recovery and runner wiring, the existing exit/recovery fixtures, a small citation guard, decisions, receipts and derived hashes.

The complete carried behavior includes bounded whole-share sells; durable targets and completion/scale-in handling; refusal pacing and uncertain-submission reconciliation; pinned native-denial policy; type-only foreign diagnostics; and bounded integrity-loss cancellation integrated with landed #1119. The second integrity guard remains after snapshot/refresh work and before rebalance.

Current pricing basis and session rearm

At the reviewed parent, a stale-quote commitment could survive a fresh take-profit at 100.50 and a later stop at 99.70. Both orders inherited the durable quote_stale reason's market rule. At 100 bps replacement tolerance the roughly 80 bps price move requested no cancel, leaving the 100.48 limit above the market. Similar cases involved risk-off, gap/corporate-action commitments and a stop followed by a volatility-scaled trailing signal.

The durable target and strongest reason remain monotone until completion. The separately persisted pricing basis comes from the exit priced on this tick: a session limit rule where applicable, otherwise its current reason's REASON_PRICE_RULE, default market. No newly proposed exit keeps the last basis across ticks and restart. The durable strength reason never supplies an order label or pricing rule.

Any basis change passes the price-change gate regardless of tolerance. Existing replacement enablement, attempt/interval limits, freshness, session, ownership and refusal guards remain operative. A second basis change during cancellation places no second sell. After confirmed cancellation, replacement uses the latest basis and re-reads owned quantity minus the current target before applying the whole-share envelope. It handles both a confirmed partial fill (100 held minus 40 filled gives 60) and a strengthened target (staged 50 becomes the current 100-share residual).

outside_allowed_session now has a session-scoped lifetime. Its named no-HTTP provenance survives the transport bridge. A validated market_open is True window with at least one second before close releases it, including legacy records marked definitive; next-session strategy exits and recovery do not require manual reconciliation. Other permanent or integrity-loss refusals retain their gates.

The CC FULL read requested these P1/P2 changes; GPT full1 ACKed the parent with P3 follow-ups. The CC's subsequent pricing-basis ruling governs this fold. Both families now review the delta from the pinned parent.

SOTA sources

• Maintained native-agent-stack at the reviewed parent: durable strength/action coupling, replacement price/basis gate, refusal lifetime, existing validated-window condition, and typed no-HTTP bridge. The lifetime and pricing policies are explicit local rulings; no upstream adapter or API is replaced.
• Main's reason-to-price-rule mapping and guard precedence. The policy's first-matching-rule order remains unchanged.
• Official NautilusTrader at 1b0a49d2792a9432a3aca3fcb617ce7a630d905e: quantity precision, native risk guard, and denial event contract. Installed native execution uses 2.0.0rc5; the mirror pin is a source citation, not a wheel-build claim.
• The carried coroutine/deadline correction follows CPython v3.12.3 gen_close. Remaining carried citations are preserved in docs/decisions/2026-10-13-adaptive-paper-sell-chunks.md.

Evidence-class table

Fold receipts: evidence/artifacts/adaptive-paper-committed-exit-priority-20261015/fold1/. red-final-parent-replay.txt comes from a detached checkout at exactly 93f34f01, with only the final priority/recovery test modules overlaid. Earlier fail-first outputs, focused GREEN, full runtime results and the receipt are retained beside it. Paths and line-end whitespace are sanitized; assertion text and counts are retained. Fourteen pre-existing temporary-directory ResourceWarnings remain.

The initial correction's receipts remain historical evidence: bare main passes the original exact TP-to-stop tolerance controls and independently fails its pending-cancel variant. This fold's RED baseline is the reviewed #1170 parent.

Local commands run

All native runs use CPython 3.12.3 / NautilusTrader 2.0.0rc5 / alpaca-py 0.44.0, unshare -rn, nice -n 19, explicit source roots and private fixtures. Module groups and commands are retained in fold1/runtime-tests.json and the handoff.

<isolated pinned python> -m unittest -v <nine new methods at exact parent 93f34f01>
rc 1; 9 tests, 29 assertion failures, 0 errors/skips.

<isolated pinned python> -m unittest -v <priority module plus two next-session recovery methods>
rc 0; 16 passed.

<isolated pinned python> -m unittest -v <four groups in fold1/runtime-tests.json>
rc 0 in all groups; 585 passed.

<isolated system python> -m unittest -v <six static/custody/source-hash modules>
rc 0; 56 tests, one expected opt-in skip.

python3 scripts/evidence_manifest.py --check
rc 0; 12,175 sorted records.

python3 scripts/validate.py
rc 0 before commit: 71 components, 12,175 hashed files, four profiles, 240 receipts.

Whitespace checks pass for the fold. The single trailing space in the historical round2/red-tests.txt capture remains byte-identical and is excluded only from the aggregate base-to-head whitespace check.

Decision record and custody

docs/decisions/2026-10-15-shared-runner-committed-exit-priority.md#pricing-basis-and-session-rearm-fold records the current behavior, source pins, tests and adjudication. The older sell-chunk amendment now explicitly marks its permanent closed-session rule superseded.

Review/ruling references are name-only: MICRO-full-93f34f01.md, ruling-cc-20261015T1717Z-pr1170-pricing-basis.md, and GPT-VERDICT-93f34f010.md. No unpublished review/helper digest is bound. All historical receipts and main/parked evidence rows remain retained. Older replaced #1091 commits may remain reachable until GitHub garbage collection; a purge is an owner-only GitHub Support action, and none was performed.

Follow-up disposition

• GPT P3-1 addressed in this fold: a dedicated permanent guard enforces all four name-only review-reference collections and the helper citation. Synthetic forbidden-field/disguised-digest controls contain no protected values.
• CC P3 / GPT P3-3 retained: the two historical host-local review locators in corrections round3/receipt.json at lines 11 and 14 remain a separate portability cleanup. New review references use names only.
• GPT P3-2 retained: broker-stream terminal-rejection release/reconciliation, pre-wire budget accounting, mover residual diagnostics and the resumed-entry deadline wait remain separate work.
• GPT P3-3 retained: old unversioned source comments, including strategies_v1.py:219 and runner.py:780, remain separate cleanup. The continuity-decision locator allegation remains a false positive because it explicitly pins an immutable revision.
• Host guard installation remains co-op scope. test(trading): qualify lane A OVERNIGHT stage admission #1095 starts after the prerequisite landing.

Host evidence

No operating qualification, strategy merit or broker fill is claimed. No live paper unit, keyed/broker call, credential-store read, host runtime lock, live STOP or ISSUER-HOLD is used or changed.

Checklist

• Non-empty SOTA sources, pinned mechanism citations and fail-first evidence.
• Current pricing, residual and next-session cases tested through real policy/Ledger with explicit synthetic boundaries.
• All source/evidence hashes refreshed; historical receipts preserved; name-only citation regression included.
• Configured no-reply author and lease pinned to reviewed parent.
• Peer-owned files and worktrees preserved.
• Both families' delta FRONT reads and CC landing decision.