Order-throughput harness: user-gated live capacity mode (never runs without the user's live key and go file) - #191

…edence, journal mode, headroom

Review findings on f4d505a, each with a test that fails on that commit:

1. Live probes use SPY, QQQ, IWM or DIA only (config gate
   live_symbol_not_allowed before any request; the live port refuses any
   other symbol at construction and at submit). A probe is priced only from
   a quote at most 10 s old: live max_quote_age_seconds <= 10 and a refresh
   at least every 5 s are enforced; once the price's quote is older than
   10 s, submissions hold and the refresh repeats at most once a second; a
   stale refresh is refused and counted, and the first fresh quote reprices
   and resumes submissions. The REST worker re-checks the age immediately
   before each submit. Probes stay >= 500 bps below that fresh bid.
2. SIGHUP (closed terminal or WSL session) and SIGQUIT now take the same
   request_stop path as SIGINT/SIGTERM, in every command
   (install_stop_signals), so cleanup, reconciliation, the receipt and the
   journal end record still run.
3. In live, any fill or position change ends needs_attention even when a
   port error was recorded (error_type stays in the receipt). live.fills has
   probe_fill, other_order_fill (symbol, side, quantity, average price from
   the stream and the listing; never ids) and position_change entries.
4. Journal start records carry mode and trading_origin. Paper recover/audit
   read the journal before any credential and refuse a live run's journal
   (also one without the new fields, judged by config.base_url); the engine's
   recover checks it too. A run refuses any file at its journal path before
   any request, naming another mode's journal.
5. Live headroom is held at 0.9 (live_headroom_must_be_0_9), so the budget is
   floor(min(--cap, observed limit) * 0.9).

Also: the periodic position check now fails closed on any failed read, which
makes its docstring true (the native port raises on 429/5xx; there is no
retry), and the README evidence table no longer contradicts itself about
alpaca-py 0.44.0: SDK objects are built under the pinned venv, while the
order request, the SDK-client calls and a running stream are not exercised.

Offline receipts are unchanged apart from provenance and the random prefix.
No broker, network or credential was used.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

1. Quote age at the wire: LiveCapacityRun passes the price's quote wall time
   to the live port, whose final submit boundary (_before_request) re-checks
   age <= 10 s next to the STOP files and go expiry, after pool.get() and
   immediately before the POST. A refusal is not sent and is counted
   (live.quote_freshness.stale_at_wire).
2. SIGHUP exit code: a summary print that fails with OSError (EIO on a closed
   terminal) no longer raises; stdout's descriptor is pointed at /dev/null so
   the interpreter's final flush cannot turn the status into 120, and main
   returns the run's own exit code.
3. Clock skew: the live preflight brackets GET /v2/clock with host wall times
   and refuses (host_clock_skew) when |host - broker| plus half the round trip
   exceeds 1 s; an unreadable timestamp refuses (broker_clock_unreadable). The
   measurement is in live.host_clock.
4. 429 on the position read: the native port's positions() raises ReadFailed
   carrying its sanitized Response; the periodic check and _sync feed it to
   the rate governor before freezing, so cleanup cancels honour Retry-After.
5. Journal guards: read_journal reuses the lstat/S_ISREG/64 MiB guard of
   existing_journal_refusal, opens with O_NOFOLLOW|O_NONBLOCK, re-checks the
   opened inode and reads at most 64 MiB, so recover/audit refuse a FIFO,
   symlink or oversized journal (journal_not_regular_file, journal_too_large).

Offline tests only (fake broker, stub SDK client, temp files); no network,
broker call or credential read.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…mode-20260924

# Conflicts:
#	blueprints/us-equities/order-throughput/README.md
#	tests/test_order_throughput.py