[Pigbibi]

What changed

Account drawdown admission previously had no durable OPEN record, so a recovered observation could admit new risk without an audited reset. Persist CIRCUIT_BREAKER_OPEN in the existing physical-account submission journal, retain it across profiles and restarts, and reject explicitly classified new risk at reservation and final dispatch. OPEN grants no reduction authority, produces no targets or sell plans, and never clears automatically or changes UNKNOWN outcomes. Existing unclassified callers retain their API contract; IBKR is the bounded adopting consumer.

When an invalid explicit drawdown accompanies an independently valid equity/peak breach, preserve the valid facts and store a null drawdown. Replay derives and validates the breach from those facts. Original risk-input errors remain visible to the admission gate. After order/account validation, final dispatch re-reads the grant and breaker under a lock shared by sessions on the same account journal. Keep that lock through submit and its observation append, preventing an OPEN writer from racing either the final check or the outcome sequence.

How verified

Latest local verification used synthetic identities, temporary journals, a clean allowlisted environment and inherited seccomp network denial:

• Full QPK suite: 3,589 tests and 1,277 subtests passed; 2 skipped (opt-in broker API probe and unavailable optional calendar dependency).
• Added 14 regressions: invalid-drawdown peak breach with independent-process restart, OPEN completed during order validation, local/memory-ObjectStore two-session serialization, and failed final readback. The complete breaker file now has 24 passing cases in the full suite.
• The unchanged reviewer reproductions failed five cases on the original head and pass all six on the corrected source.
• Both original switch-off safety assertions pass against the companion IBKR candidate with the corrected QPK source. No original assertion or test function was removed or relaxed.
• Repository Ruff, documentation style and diff checks pass. Public class/method signatures and the existing journal event fields are unchanged by this correction.

The shared lock coordinates sessions in one process on the same journal location; it is not a distributed lock. Exclusive journal creation and the existing owner fence remain required. Older readers reject the added OPEN event. Review the companion IBKR draft together with this library change, then coordinate consumer pins and old-writer quiescence separately. No dependency pin, production setting, threshold, switch default or deployment changes here. Authentic initial state, cross-process/host writer coordination and runtime/full risk acceptance remain NOT_PROVEN. Hosted CI must be evaluated for the corrected head; earlier green checks are not evidence for that head. No approval label is changed. Companion consumer draft: QuantStrategyLab/InteractiveBrokersPlatform#956.

AI assistance

Authored with OpenAI Codex (gpt-6.1-sol, high). Independent review and hosted-CI acceptance belong to the established code-review-and-merge bot. Keep this PR in draft.

Cross-process dispatch correction (r2)

Final dispatch now takes shared cross-process exclusion and re-reads the grant
and OPEN state inside that exclusion before calling submit. Local journals use
a kernel file lock shared by OPEN writers and dispatch through outcome append.
ObjectStore OPEN and dispatch require create-only exclusive process ownership;
unknown ownership denies dispatch. Ownership has no lease, expiry or automatic
takeover, so a process restart remains blocked pending a separate approved
recovery design. This supersedes the prior process-local-only limitation.

The supplied independent two-process reproduction is included unchanged and
passes. Four additional regressions cover an OPEN writer during submit,
ObjectStore same-owner restart denial, ownership readback failure and unavailable
local locking. All 219 existing test files and public method signatures remain
unchanged. Full offline suite: 3,594 tests and 1,277 subtests passed, 2 skipped.
Ruff, documentation style and both original switch-OFF assertions pass.

No consumer pin, risk switch, label, deployment or other PR changed. Runtime/full
RC-01, authentic state, old-writer quiescence and consumer adoption remain
NOT_PROVEN. Local locking requires the same file-lock domain; no cross-host
filesystem guarantee is claimed. Existing unclassified and reduction semantics
remain unchanged. Developed with OpenAI Codex (GPT-6.1 Sol).

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b6a18bdf-d244-4e69-9de5-bf5046506a2b

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn