[Pigbibi]

What changed

Native account snapshots dropped peak/drawdown facts before account admission. Carrying those facts into the old target scaler could turn a matching holding target into a liquidation plan while the portfolio stop-loss switch was off.

Preserve whole-account equity and native drawdown facts through the strategy projection, and restore/persist a drawdown OPEN in the existing physical-account submission journal before execution or a no-target return. With PORTFOLIO_LOSS_STOPLOSS_ENABLED off, a drawdown brake preserves the supplied targets and blocks new positions/adds without creating reduction targets. With it on, the existing scaling/reduction path remains available. Recovery, CLOSED projections and untrusted reset flags cannot clear the latch. Real buys bind new_risk=True into PREPARED and are checked again at dispatch.

How verified

Validation used synthetic inputs, local journals, an allowlisted environment and inherited seccomp network denial:

• Original two switch-off invariant assertions: reproduced red before editing, then both green unchanged.
• New boundary/projection/persistence regressions: 21 passed, including TQQQ/SOXL holding and add cases, both ten-share holdings together, ON reductions, recovered cycles, unavailable storage and no-target persistence.
• Full IBKR offline suite: 5,834 tests and 348 subtests passed; 6 existing skips.
• Original selected IBKR risk path: 240 passed; QPK risk/journal selection: 249 tests and 455 subtests passed; UES entrypoint selection: 32 passed.
• Repository Ruff, documentation style, offline deployment-workflow contract and diff checks passed. Existing assertions were retained; notification expectations add the independently preserved account NAV, and the existing reduction-positive fixture explicitly enables the switch.

Companion library draft: QuantStrategyLab/QuantPlatformKit#768. Consumer dependency pins, switch defaults, risk parameters and production configuration are unchanged. Missing QPK latch capability fails closed for real new risk; this draft is not independently deployable with an older pin. Inner dry-run previews without a session explicitly report persistence as NOT_PROVEN. Authentic initial state, old-writer quiescence, deployed consumer identity, real store readback and real orders/fills remain NOT_PROVEN. No broker/cloud access, deployment or live enablement was performed.

Hosted readback: test completed with FAILURE at its unit-test step; tqqq-offline-risk completed with SUCCESS. The unchanged QPK pin 6136b1c667a60d484f500c6d6046c0585c75305d has AccountSubmissionSession but lacks both the new latch API and the new_risk reserve keyword (verified from the exact pinned source). Full hosted failure-log retrieval timed out, so this source comparison is not a claim to have classified every CI failure. No assertion was skipped or relaxed, and pins remain unchanged as required. The risk gate remains failed pending the established approval/review process; the template check now passes.

AI assistance

Authored with OpenAI Codex (job configuration: gpt-6.1-sol, high). Independent review and hosted-CI acceptance belong to the established code-review-and-merge bot; no independent review is claimed here. Keep this PR in draft.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn