Paper engine: book realized P&L and gross loss per exact execution (stacked on #350; realized-loss delivery-order major) - #353

What

This is the stacked follow-up to #350, and it closes the pre-existing realized-loss delivery-order major from the retroactive cross-family review. The accounting replay (Ledger._reconcile_execution_accounting, blueprints/us-equities/adaptive-paper/safety.py) summed a status delta's executions into one notional before computing P&L. Take a two-share sell with one fill at a gain and one at a loss inside the same delta: the replay netted the loss away. The resulting gross loss then depended on whether the stream or the REST snapshot arrived first. With two shares bought at $100 and sold at $110 and $90, REST-first delivery booked a gross loss of $0 where stream-first booked $10, so the $5 loss cap did not halt.

Replay now books each exact execution that tiles the delta separately. It falls back to the delta's notional only while the executions are still incomplete, and a later replay over the complete executions corrects it.

• _execution_fills returns exact (qty, notional) pairs; _executions_notional keeps its old contract on top of it.
• Average-cost basis per closing fill; losses accumulate separately from net P&L.

Base: claude/paper-engine-crossfamily-fixes-20260926 (#350). Merge #350 first; GitHub then retargets this PR to main.

Evidence

• Test-first regressions (tests/test_adaptive_paper_safety.py):
  • test_mixed_profit_gross_loss_is_exact_across_delivery_sequences covers stream-first, REST-first, duplicate and restart deliveries. It checks cash, realized P&L, cumulative loss, gross loss, the halt, redelivery after reopening, read_ledger and the blocked intents.
  • test_mixed_profit_replay_preserves_basis_at_each_booking covers a basis change between executions of one sell.
• Mutation check (coordinator): with only safety.py reverted, 4 cases fail: rest_first, duplicates, restart and the basis test. stream_first passes on both versions, as expected.
• Paper suites (coordinator, pinned runtime adaptive-paper-20260921, private TMPDIR): tests.test_adaptive_paper_safety, _runner, _native and _transport ran 407 tests, all OK. tests.test_trading_gates: 26 OK. scripts/validate.py passed.
• Pins: the safety.py entry in adaptive-paper/source-hashes.json moves 72abaaca… → e0ba9233…, and manifests/evidence.json re-registers the 3 files. Historical receipts keep the hashes of the code they ran.
• Authorship and review: GPT-6 (gpt-6-astra, effort max, workspace-write sandbox) implemented it test-first. The coordinator (Claude) reviewed the diff and re-ran every check above. An independent read-only Claude review follows in a comment.

Limitations

• Ledgers that the old implementation already marked reconciled are not repaired automatically. A replay recomputes them only when a new observation triggers reconciliation.
• Synthetic ledger tests only. This PR places no broker order, and paper keys currently return 401.

SOTA sources

• QuantConnect LEAN at 985ef30, Common/Securities/SecurityPortfolioModel.cs: closing P&L per fill. https://github.com/QuantConnect/Lean/blob/985ef30/Common/Securities/SecurityPortfolioModel.cs
• QuantConnect LEAN at 985ef30, Common/Statistics/TradeStatistics.cs: losing P&L accumulated separately from net. https://github.com/QuantConnect/Lean/blob/985ef30/Common/Statistics/TradeStatistics.cs
• Alpaca Trading API order and fill events (trade_updates fill and partial_fill carry per-execution qty and price): https://docs.alpaca.markets/docs/websocket-streaming

🤖 Generated with Claude Code