programgarden 2.7.2__tar.gz → 3.0.0__tar.gz

{programgarden-2.7.2 → programgarden-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: programgarden
-Version: 2.7.2
+Version: 3.0.0
 Summary: ProgramGarden - 노드 기반 자동매매 DSL 실행 엔진
 License-Expression: AGPL-3.0-or-later
 Author: 프로그램동산
@@ -15,9 +15,9 @@ Requires-Dist: aiosqlite (>=0.20.0,<0.21.0)
 Requires-Dist: croniter (>=6.0.0,<7.0.0)
 Requires-Dist: litellm (>=1.40.0)
 Requires-Dist: lxml (>=6.0.2,<7.0.0)
-Requires-Dist: programgarden-community (>=2.3.2,<3.0.0)
-Requires-Dist: programgarden-core (>=2.7.0,<3.0.0)
-Requires-Dist: programgarden-finance (>=2.0.6,<3.0.0)
+Requires-Dist: programgarden-community (==3.0.0)
+Requires-Dist: programgarden-core (==3.0.0)
+Requires-Dist: programgarden-finance (==3.0.0)
 Requires-Dist: psutil (>=6.0.0,<7.0.0)
 Requires-Dist: psycopg2-binary (>=2.9.11,<3.0.0)
 Requires-Dist: pydantic (>=2.0.1,<3.0.0)
@@ -27,58 +27,8 @@ Requires-Dist: tzdata (>=2025.2,<2026.0)
 Requires-Dist: yfinance (>=0.2.0,<0.3.0)
 Description-Content-Type: text/markdown
 
-The 2.6.2 release candidate [futures minute alias correction](../../docs/futures-minute-alias-contract.md) aligns canonical minute periods with the existing one-page o3103 path and rejects unsupported hourly/adjustment claims. Complete-range coverage and consumer adoption are not implied.
-
 # ProgramGarden
 
-The 2.6.7 release [futures TC2 confirmation handling](../../docs/release-2.6.7-validation.md)
-requires programgarden-finance 2.0.5, which reads overseas futures modify and
-cancel confirmations (TC2) as LS sends them and re-registers account events
-after a reconnect. The engine finds the workflow's order through
-`orgn_ordr_no`, uses the guide's side codes and skips frames the SDK could
-not read.
-
-The 2.6.6 release candidate [ranking nodes and runtime-values-as-data correction](../../docs/release-2.6.6-validation.md)
-adds KoreaStockRankingNode and OverseasStockRankingNode, evaluates only
-expression templates authored in the workflow, routes Gemini and DeepSeek
-credentials to their own APIs, and reads an unresolved futures position
-exchange again at most once per 5 minutes per contract instead of keeping it
-empty for the whole run.
-
-The 2.6.5 release candidate [futures position exchange correction](../../docs/futures-position-exchange.md)
-reads each futures position's and pending order's exchange from o3105 instead
-of a fixed `HKEX`; an unconfirmed exchange stays empty.
-
-The 2.6.4 release candidate [paper futures account correction](../../docs/paper-futures-business-date.md#account-node-and-rejection-messages-264-candidate)
-returns an empty futures account for the paper empty-account answer and names
-the broker message in unaccepted response errors. Live behavior is unchanged.
-
-The 2.6.3 release candidate [paper futures business-date correction](../../docs/paper-futures-business-date.md)
-uses a fresh account-scoped broker date for startup pending orders, OpenOrdersNode
-and legacy fill observation. Missing or mismatched evidence remains unavailable.
-
-An unreleased [stock history interval correction](../../docs/stock-history-interval-contract.md)
-rejects unsupported intraday periods instead of silently querying daily bars.
-Supported g3204 periods retain their existing requests and output contract.
-
-An unreleased [futures detail and durable state candidate](../../docs/futures-contract-details-and-rollover-state.md)
-adds exact o3105 metadata, opt-in execution-scoped SQLite and XHKG calendar
-intersection. Missing evidence remains explicit; this does not authorize orders.
-
-An unreleased [offline temporal replay extension](../../docs/offline-temporal-replay.md)
-supports explicit bounded multi-day acceptance without changing the default
-32-event worker/save path. Public package release remains pending; the server
-team has validated a private DEV candidate with the same runtime changes.
-
-The REST overseas-stock account output preserves broker-reported `sellable_qty`
-separately from holdings; absent capacity remains null. See
-[the sell-capacity contract](../../docs/overseas-stock-sellable-quantity.md).
-
-Unreleased execution reconciliation work is documented in
-[execution-reconciliation.md](../../docs/execution-reconciliation.md). Its
-optional host storage identity is not yet enabled in deployed worker/tray hosts;
-historical recovery policy and host migration remain open.
-
 ProgramGarden은 AI 시대에 맞춰 파이썬을 모르는 투자자도 개인화된 시스템 트레이딩을 자동으로 수행할 수 있게 돕는 노드 기반 자동매매 DSL(Domain Specific Language) 오픈소스입니다.
 
 노드를 조합하여 워크플로우를 정의하고, 실행 엔진이 이를 자동으로 처리합니다. LS증권 OpenAPI를 메인으로 해외 주식/선물 거래 자동화를 지원합니다.
@@ -155,14 +105,6 @@ pending count and cancels those tasks, allowing another 0.25 seconds for cancell
 A listener that suppresses cancellation is reported and remains tracked; it cannot
 hold job shutdown indefinitely. Delivery beyond this bounded grace is not guaranteed.
 
-Overseas-stock OpenOrdersNode treats the observed terminal COSAQ00102 `02679`
-empty envelope as `open_orders=[]` / `count=0` without an error. The echoed date,
-market and filters must match its current-day pending query, the empty detail
-array must be explicitly present, and continuation must be terminal. This follows
-the finance package's observed-response reference and StockAccountTracker;
-`02679` is not a generic success code. Missing, malformed, mismatched and failed
-reads retain `error` / `reason=fetch_failed` so workflows can block new entries.
-
 Overseas-stock historical queries preserve the exchange supplied by each symbol,
 including when the account has no holdings. Item-bound consumers of an explicitly
 empty selected upstream list are skipped before expression evaluation; this also
@@ -185,7 +127,7 @@ the catalog's `result` port as a list of outcome rows: `{{ nodes.order.result }}
 can feed TableDisplayNode directly. Each row copies the final `order_result`
 and includes `order_id` from the existing top-level or nested order number.
 Legacy `order_result` and `order_id` outputs are unchanged. The projection occurs
-after fill confirmation, fractional-remainder annotation, and replay marking;
+after fill confirmation, and fractional-remainder annotation;
 an accepted order is not promoted to a fill without confirmation. Rejections and
 `no_signal` keep their original diagnostics/reason as an outcome row, with no
 fabricated order number. Dry runs add a `simulated` row while retaining the legacy
@@ -195,73 +137,6 @@ of a new-order result retains its legacy `order_result` row shape; explicit
 `nodes.order.result` bindings always read the list. Modify/cancel nodes retain their
 separately declared `modify_result`/`cancel_result` ports and are outside this change.
 
-## Explicit execution identities in local ledgers
-
-`WorkflowPositionTracker.record_fill(..., execution_id=...)` can preserve a
-broker-provided execution identity. Within one ledger/product/provider/mode,
-order date and normalized order number, an identical replay returns the first
-classification without changing FIFO or history. Conflicting facts raise
-`ExecutionIdentityConflictError`. Positive numeric identifiers ignore padding;
-opaque identifiers retain case. Missing, blank and zero identifiers retain legacy
-behavior and are never inferred from time, price or quantity. Every pending
-partial fill is retained while its order acknowledgement is being recorded.
-
-The migration is additive and does not invent identities for existing rows.
-Callers must establish consistent identifier and timestamp semantics first;
-exchange execution numbers and broker execution numbers are not interchangeable.
-This ledger API alone does not reconcile finite workflows after their shutdown.
-
-Standalone futures TC3 callbacks interpret `s_b_ccd="1"` as sell and `"2"` as buy,
-matching the SDK contract. TC2 confirmations use the same codes and find the
-workflow's order through `orgn_ordr_no`: a futures modify or cancel gets its own
-new order number (LS paper, 2026-10-15), so the cancel confirmation cancels the
-original order in the ledger and a modify confirmation updates the successor row
-recorded by ModifyOrderNodeExecutor. Unknown or blank side codes are logged and skipped
-before any inventory write is scheduled. With an app order lifecycle handler,
-TC3 still bypasses this legacy fill path: canonical REST reconciliation remains
-the sole writer. This side correction does not establish an alias between TC3
-and REST execution identities, dates, or times.
-
-## Futures monetary evidence
-
-Futures workflow PnL events preserve native gross estimates separately from
-accounting results. `workflow_*`, `other_*`, `total_*`, account and competition
-monetary/rate scalars remain null when accounting evidence is unavailable.
-`pnl_by_currency` contains gross price-change subtotals by contract currency;
-`monetary_positions` retains their basis/status and unmodified, unconfirmed
-`broker_pnl_amount`. No fee, FX, margin/equity return or verified contest score
-is inferred from these estimates. Actual zero and negative amounts are retained.
-`currency` is null for mixed or unavailable currencies. Consumers must handle
-nullable monetary fields and must not coerce them to zero.
-
-## Personal workflow execution metrics
-
-`WorkflowPositionTracker.personal_metrics()` reads retained SQLite `trade_history`
-for the current product, provider and paper/live mode. Its independent
-`WorkflowPnLEvent.personal_metrics` envelope retains stock realized PnL after all
-positions close and counts distinct positive executed orders by valid stored
-order date and normalized order number. Partial fills of one dated order count
-once. This is the reporting runtime's retained workflow ledger, not a complete
-account history or verified contest score. No credential/account generation is
-claimed by this legacy local storage.
-
-Stored stock realized PnL is gross long-only FIFO before fees. The reader
-validates sufficient recorded buys and consistency with stored results; mixed
-manual/product/provider/exchange FIFO ownership makes the affected symbol
-unavailable. Amounts remain separate by symbol/exchange, with currency null
-because the historical table has no currency evidence. No FX conversion or return
-denominator is invented. Futures executed-order counts are available under the
-same identity rules, but futures monetary results and portfolio MDD remain null:
-the retained FIFO lacks contract accounting and risk price windows are not equity
-curves. Invalid order identities also yield a null count with its reason.
-
-The listener refreshes this evidence at most once per 10 seconds to avoid scanning
-retained history on every price tick; reused observations retain their original
-`as_of`. The cache is isolated to the actual tracker/product/provider/mode, and
-other broker-node callbacks do not receive it. A newly recorded fill may appear
-at the next refresh. Existing open-position PnL fields are unchanged. Core and
-engine consumers must ship together to support the additive event field.
-
 ## Stock read failures
 
 Stock open-order queries include current-day orders (`ThdayBnsAppYn="1"`).
@@ -365,7 +240,3 @@ job = await pg.run_async(
 
 자세한 변경 사항은 `CHANGELOG.md`를 참고하세요.
 
-See [Session gates and guarded Split](../../docs/session-gates-and-guarded-split.md)
-for immediate timezone decisions, per-item conditional routing, effective sequential
-execution of guarded/order branches, and finite CodeNode input bindings.
-

{programgarden-2.7.2 → programgarden-3.0.0}/README.md

@@ -1,55 +1,5 @@
-The 2.6.2 release candidate [futures minute alias correction](../../docs/futures-minute-alias-contract.md) aligns canonical minute periods with the existing one-page o3103 path and rejects unsupported hourly/adjustment claims. Complete-range coverage and consumer adoption are not implied.
-
 # ProgramGarden
 
-The 2.6.7 release [futures TC2 confirmation handling](../../docs/release-2.6.7-validation.md)
-requires programgarden-finance 2.0.5, which reads overseas futures modify and
-cancel confirmations (TC2) as LS sends them and re-registers account events
-after a reconnect. The engine finds the workflow's order through
-`orgn_ordr_no`, uses the guide's side codes and skips frames the SDK could
-not read.
-
-The 2.6.6 release candidate [ranking nodes and runtime-values-as-data correction](../../docs/release-2.6.6-validation.md)
-adds KoreaStockRankingNode and OverseasStockRankingNode, evaluates only
-expression templates authored in the workflow, routes Gemini and DeepSeek
-credentials to their own APIs, and reads an unresolved futures position
-exchange again at most once per 5 minutes per contract instead of keeping it
-empty for the whole run.
-
-The 2.6.5 release candidate [futures position exchange correction](../../docs/futures-position-exchange.md)
-reads each futures position's and pending order's exchange from o3105 instead
-of a fixed `HKEX`; an unconfirmed exchange stays empty.
-
-The 2.6.4 release candidate [paper futures account correction](../../docs/paper-futures-business-date.md#account-node-and-rejection-messages-264-candidate)
-returns an empty futures account for the paper empty-account answer and names
-the broker message in unaccepted response errors. Live behavior is unchanged.
-
-The 2.6.3 release candidate [paper futures business-date correction](../../docs/paper-futures-business-date.md)
-uses a fresh account-scoped broker date for startup pending orders, OpenOrdersNode
-and legacy fill observation. Missing or mismatched evidence remains unavailable.
-
-An unreleased [stock history interval correction](../../docs/stock-history-interval-contract.md)
-rejects unsupported intraday periods instead of silently querying daily bars.
-Supported g3204 periods retain their existing requests and output contract.
-
-An unreleased [futures detail and durable state candidate](../../docs/futures-contract-details-and-rollover-state.md)
-adds exact o3105 metadata, opt-in execution-scoped SQLite and XHKG calendar
-intersection. Missing evidence remains explicit; this does not authorize orders.
-
-An unreleased [offline temporal replay extension](../../docs/offline-temporal-replay.md)
-supports explicit bounded multi-day acceptance without changing the default
-32-event worker/save path. Public package release remains pending; the server
-team has validated a private DEV candidate with the same runtime changes.
-
-The REST overseas-stock account output preserves broker-reported `sellable_qty`
-separately from holdings; absent capacity remains null. See
-[the sell-capacity contract](../../docs/overseas-stock-sellable-quantity.md).
-
-Unreleased execution reconciliation work is documented in
-[execution-reconciliation.md](../../docs/execution-reconciliation.md). Its
-optional host storage identity is not yet enabled in deployed worker/tray hosts;
-historical recovery policy and host migration remain open.
-
 ProgramGarden은 AI 시대에 맞춰 파이썬을 모르는 투자자도 개인화된 시스템 트레이딩을 자동으로 수행할 수 있게 돕는 노드 기반 자동매매 DSL(Domain Specific Language) 오픈소스입니다.
 
 노드를 조합하여 워크플로우를 정의하고, 실행 엔진이 이를 자동으로 처리합니다. LS증권 OpenAPI를 메인으로 해외 주식/선물 거래 자동화를 지원합니다.
@@ -126,14 +76,6 @@ pending count and cancels those tasks, allowing another 0.25 seconds for cancell
 A listener that suppresses cancellation is reported and remains tracked; it cannot
 hold job shutdown indefinitely. Delivery beyond this bounded grace is not guaranteed.
 
-Overseas-stock OpenOrdersNode treats the observed terminal COSAQ00102 `02679`
-empty envelope as `open_orders=[]` / `count=0` without an error. The echoed date,
-market and filters must match its current-day pending query, the empty detail
-array must be explicitly present, and continuation must be terminal. This follows
-the finance package's observed-response reference and StockAccountTracker;
-`02679` is not a generic success code. Missing, malformed, mismatched and failed
-reads retain `error` / `reason=fetch_failed` so workflows can block new entries.
-
 Overseas-stock historical queries preserve the exchange supplied by each symbol,
 including when the account has no holdings. Item-bound consumers of an explicitly
 empty selected upstream list are skipped before expression evaluation; this also
@@ -156,7 +98,7 @@ the catalog's `result` port as a list of outcome rows: `{{ nodes.order.result }}
 can feed TableDisplayNode directly. Each row copies the final `order_result`
 and includes `order_id` from the existing top-level or nested order number.
 Legacy `order_result` and `order_id` outputs are unchanged. The projection occurs
-after fill confirmation, fractional-remainder annotation, and replay marking;
+after fill confirmation, and fractional-remainder annotation;
 an accepted order is not promoted to a fill without confirmation. Rejections and
 `no_signal` keep their original diagnostics/reason as an outcome row, with no
 fabricated order number. Dry runs add a `simulated` row while retaining the legacy
@@ -166,73 +108,6 @@ of a new-order result retains its legacy `order_result` row shape; explicit
 `nodes.order.result` bindings always read the list. Modify/cancel nodes retain their
 separately declared `modify_result`/`cancel_result` ports and are outside this change.
 
-## Explicit execution identities in local ledgers
-
-`WorkflowPositionTracker.record_fill(..., execution_id=...)` can preserve a
-broker-provided execution identity. Within one ledger/product/provider/mode,
-order date and normalized order number, an identical replay returns the first
-classification without changing FIFO or history. Conflicting facts raise
-`ExecutionIdentityConflictError`. Positive numeric identifiers ignore padding;
-opaque identifiers retain case. Missing, blank and zero identifiers retain legacy
-behavior and are never inferred from time, price or quantity. Every pending
-partial fill is retained while its order acknowledgement is being recorded.
-
-The migration is additive and does not invent identities for existing rows.
-Callers must establish consistent identifier and timestamp semantics first;
-exchange execution numbers and broker execution numbers are not interchangeable.
-This ledger API alone does not reconcile finite workflows after their shutdown.
-
-Standalone futures TC3 callbacks interpret `s_b_ccd="1"` as sell and `"2"` as buy,
-matching the SDK contract. TC2 confirmations use the same codes and find the
-workflow's order through `orgn_ordr_no`: a futures modify or cancel gets its own
-new order number (LS paper, 2026-10-15), so the cancel confirmation cancels the
-original order in the ledger and a modify confirmation updates the successor row
-recorded by ModifyOrderNodeExecutor. Unknown or blank side codes are logged and skipped
-before any inventory write is scheduled. With an app order lifecycle handler,
-TC3 still bypasses this legacy fill path: canonical REST reconciliation remains
-the sole writer. This side correction does not establish an alias between TC3
-and REST execution identities, dates, or times.
-
-## Futures monetary evidence
-
-Futures workflow PnL events preserve native gross estimates separately from
-accounting results. `workflow_*`, `other_*`, `total_*`, account and competition
-monetary/rate scalars remain null when accounting evidence is unavailable.
-`pnl_by_currency` contains gross price-change subtotals by contract currency;
-`monetary_positions` retains their basis/status and unmodified, unconfirmed
-`broker_pnl_amount`. No fee, FX, margin/equity return or verified contest score
-is inferred from these estimates. Actual zero and negative amounts are retained.
-`currency` is null for mixed or unavailable currencies. Consumers must handle
-nullable monetary fields and must not coerce them to zero.
-
-## Personal workflow execution metrics
-
-`WorkflowPositionTracker.personal_metrics()` reads retained SQLite `trade_history`
-for the current product, provider and paper/live mode. Its independent
-`WorkflowPnLEvent.personal_metrics` envelope retains stock realized PnL after all
-positions close and counts distinct positive executed orders by valid stored
-order date and normalized order number. Partial fills of one dated order count
-once. This is the reporting runtime's retained workflow ledger, not a complete
-account history or verified contest score. No credential/account generation is
-claimed by this legacy local storage.
-
-Stored stock realized PnL is gross long-only FIFO before fees. The reader
-validates sufficient recorded buys and consistency with stored results; mixed
-manual/product/provider/exchange FIFO ownership makes the affected symbol
-unavailable. Amounts remain separate by symbol/exchange, with currency null
-because the historical table has no currency evidence. No FX conversion or return
-denominator is invented. Futures executed-order counts are available under the
-same identity rules, but futures monetary results and portfolio MDD remain null:
-the retained FIFO lacks contract accounting and risk price windows are not equity
-curves. Invalid order identities also yield a null count with its reason.
-
-The listener refreshes this evidence at most once per 10 seconds to avoid scanning
-retained history on every price tick; reused observations retain their original
-`as_of`. The cache is isolated to the actual tracker/product/provider/mode, and
-other broker-node callbacks do not receive it. A newly recorded fill may appear
-at the next refresh. Existing open-position PnL fields are unchanged. Core and
-engine consumers must ship together to support the additive event field.
-
 ## Stock read failures
 
 Stock open-order queries include current-day orders (`ThdayBnsAppYn="1"`).
@@ -335,7 +210,3 @@ job = await pg.run_async(
 ## 변경 로그
 
 자세한 변경 사항은 `CHANGELOG.md`를 참고하세요.
-
-See [Session gates and guarded Split](../../docs/session-gates-and-guarded-split.md)
-for immediate timezone decisions, per-item conditional routing, effective sequential
-execution of guarded/order branches, and finite CodeNode input bindings.

{programgarden-2.7.2 → programgarden-3.0.0}/programgarden/__init__.py

@@ -99,7 +99,12 @@ try:  # 설치된 배포판
     __version__ = _pkg_version("programgarden")
 except Exception:  # 소스 트리에서 직접 import (미설치)
     __version__ = "0.0.0+source"
+
+from programgarden._build_info import build_info  # noqa: E402
+
 __all__ = [
+    # Build provenance
+    "build_info",
     # Core
     "ProgramGarden",
     "WorkflowResolver",

programgarden-3.0.0/programgarden/_build_info.py

@@ -0,0 +1,3 @@
+"""Public stub of the build-provenance module (no internal build stamp)."""
+def build_info():
+    return {"version": "3.0.0", "build": "public"}

programgarden-3.0.0/programgarden/code_worker.py

@@ -0,0 +1,3 @@
+"""Public stub: the CodeNode sandbox worker is platform-only."""
+def run_code_node_sandboxed(*args, **kwargs):
+    raise RuntimeError("CodeNode runs on the ProgramGarden platform only.")

{programgarden-2.7.2 → programgarden-3.0.0}/programgarden/context.py

@@ -48,7 +48,7 @@ logger = logging.getLogger("programgarden.context")
 # 체결시각을 브로커 프레임이 싣지 않았을 때 **원장에만** 쓰는 표식.
 #
 # 서버로 나가는 OrderFillEvent.fill_time 은 이때 빈 문자열이어야 한다 — 소비자
-# (pg-worker app/order_fill_updates.py)가 `order_date + fill_time` 을 시장 세션
+# (호스팅 플랫폼의 체결 소비자)가 `order_date + fill_time` 을 시장 세션
 # 타임존으로 읽어 executed_at 을 **계산된 체결시각**으로 확정하기 때문이다. 값이
 # 없는데 무언가를 채우면 그게 체결시각으로 승격된다(엔진 <= v1.36.0 이
 # `datetime.now().strftime('%H%M%S000')` 를 합성하던 자리가 정확히 그 사고였다).
@@ -209,10 +209,12 @@ class ExecutionContext:
         )
         self._startup_reconciled = False
         self._startup_broker_snapshot = None
+        # Paper futures "no business date" waiting notice (informational only).
+        self._business_day_notice = None
         self.position_adjustments: List[Dict[str, Any]] = []
         self.context_params = context_params or {}
 
-        # Opt-in LS token provider (Verified League §3.2.3). When set, broker
+        # Opt-in LS token provider. When set, broker
         # logins consume a server-issued token instead of self-issuing.
         self.ls_token_provider = ls_token_provider
         # Runtime-only capabilities and acceptance guards never enter DSL state
@@ -1886,6 +1888,13 @@ class ExecutionContext:
             except Exception as e:
                 logger.warning(f"Listener error on_risk_event: {e}")
 
+        # Informational broker facts (the paper futures waiting notice) are not
+        # risk alerts: screens get them through on_risk_event above, but they
+        # never become a RISK_ALERT notification (telegram/kakao/AI consumers).
+        from programgarden.paper_futures_business_date import INFORMATIONAL_BROKER_EVENT_TYPES
+        if event.event_type in INFORMATIONAL_BROKER_EVENT_TYPES:
+            return
+
         # RISK_ALERT 자동 래핑: risk_event → notification
         try:
             risk_sev = NotificationSeverity.CRITICAL if event.severity == "critical" else (
@@ -2949,7 +2958,7 @@ class ExecutionContext:
             quantity: 체결 수량
             price: 체결 가격
             fill_time: 체결시각 (HHMMSSsss). 프레임이 체결시각을 싣지 않았으면
-                **빈 문자열**을 넘긴다 — 값을 합성하면 하류(pg-worker)가 그걸
+                **빈 문자열**을 넘긴다 — 값을 합성하면 하류(호스팅 플랫폼)가 그걸
                 거래소 체결시각으로 승격시킨다. 원장 쪽 표기는 이 메서드가
                 UNKNOWN_FILL_TIME 으로 바꿔 넣고, 서버로 나가는 이벤트에서는
                 다시 빈 문자열로 되돌린다(_on_tracker_fill_classified).
@@ -3128,7 +3137,7 @@ class ExecutionContext:
             quantity=fill.quantity,
             price=fill.price,
             # 원장 전용 표식은 서버로 내보내지 않는다 — 빈 fill_time 이어야
-            # pg-worker 의 `and fill_time` 가드가 걸려 executed_at 이 정직한
+            # 호스팅 플랫폼의 `and fill_time` 가드가 걸려 executed_at 이 정직한
             # received_at 폴백(+ executed_at_source 태그)이 된다.
             fill_time=("" if fill.fill_time == UNKNOWN_FILL_TIME else fill.fill_time),
             product=tracker.product,

programgarden-3.0.0/programgarden/database/broker_evidence.py

@@ -0,0 +1,52 @@
+"""Public skeleton of the broker startup-evidence gate. Performs the generic checks
+only: transport success, a complete (not continued) response, and a standard success
+response code. The platform's hardened evidence checks and its special-case handling of
+edge responses are not part of the open-source build; such responses fall back to the
+generic startup-evidence error."""
+import inspect
+
+PAPER_FUTURES_NO_RESULT_MESSAGES = frozenset()
+ORDDT_ECHO_WINDOW_DAYS = 7
+_SUCCESS_CODES = frozenset({"00000", "00136"})
+
+
+class StartupEvidenceUnavailable(RuntimeError):
+    pass
+
+
+class StartupQueryDateMismatch(StartupEvidenceUnavailable):
+    pass
+
+
+def broker_message(value):
+    return "" if value is None else str(value)[:80]
+
+
+def unverified_response_code(tr, code, message):
+    return f"{tr}: unverified_response_code {code} {broker_message(message)}".rstrip()
+
+
+def _header_matches(tr, tr_cd):
+    tr_cd = str(tr_cd or "")
+    return tr_cd == tr or (len(tr_cd) >= 5 and tr.startswith(tr_cd))
+
+
+async def checked_body(response, tr, request=None, *, paper_trading=False):
+    if getattr(response, "status_code", None) != 200 or getattr(response, "error_msg", None):
+        raise StartupEvidenceUnavailable(f"{tr}: transport_failure")
+    header = getattr(response, "header", None)
+    if (header is None or not _header_matches(tr, getattr(header, "tr_cd", None))
+            or getattr(header, "tr_cont", None) not in {"N", "0"}
+            or str(getattr(header, "tr_cont_key", "") or "").strip()):
+        raise StartupEvidenceUnavailable(f"{tr}: incomplete_continuation")
+    raw = getattr(response, "raw_data", None)
+    body = raw.json() if raw is not None else None
+    if inspect.isawaitable(body):
+        body = await body
+    if not isinstance(body, dict):
+        raise StartupEvidenceUnavailable(f"{tr}: missing_response_blocks")
+    code = getattr(response, "rsp_cd", None)
+    if code not in _SUCCESS_CODES:
+        raise StartupEvidenceUnavailable(
+            unverified_response_code(tr, code, getattr(response, "rsp_msg", None)))
+    return body

{programgarden-2.7.2 → programgarden-3.0.0}/programgarden/database/broker_snapshot.py

@@ -1,9 +1,10 @@
 """Read scoped startup evidence using existing SDK example query parameters."""
 
 import asyncio
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import datetime, timedelta, timezone
 from decimal import Decimal
+from typing import Any, Optional
 
 from .broker_evidence import checked_body, StartupQueryDateMismatch
 from .position_reconciliation import (
@@ -15,6 +16,10 @@ from .position_reconciliation import (
 class BrokerStartupSnapshot:
     positions: VerifiedPositionSnapshot
     pending_orders: tuple[dict, ...]
+    # Paper overseas futures only: the validated CIDBQ01500 observation
+    # (PaperFuturesBusinessDate; ``day`` is "" when the server gave no business
+    # date). None for live accounts and other products.
+    paper_business_date: Optional[Any] = field(default=None, repr=False, compare=False)
 
 
 def required(row, field):
@@ -57,6 +62,7 @@ async def read_broker_snapshot(ls, *, execution_key, product, provider, trading_
     observed_at = datetime.now(timezone.utc)
     day = observed_at.astimezone(timezone(timedelta(hours=9))).strftime("%Y%m%d")
     positions, pending = {}, []
+    paper_day = None
     if product == "korea_stock":
         from programgarden_finance.ls.korea_stock.extension.valuation import collect_domestic_trading_positions
         from programgarden_finance.ls.korea_stock.extension.account_queries import collect_domestic_open_orders
@@ -156,4 +162,5 @@ async def read_broker_snapshot(ls, *, execution_key, product, provider, trading_
         raise ReconciliationUnavailable("ambiguous_pending_orders")
     return BrokerStartupSnapshot(
         VerifiedPositionSnapshot(execution_key, product, provider, trading_mode, observed_at,
-                                 positions, source, True, True, tuple(pending)), tuple(pending))
+                                 positions, source, True, True, tuple(pending)), tuple(pending),
+        paper_business_date=paper_day)

{programgarden-2.7.2 → programgarden-3.0.0}/programgarden/database/position_reconciliation.py

@@ -81,6 +81,27 @@ def assert_order_evidence(conn, tracker, snapshot):
     whole quantity. Absence from a pending list does not prove cancellation.
     In particular a partially filled order must not disappear from this check
     merely because one trade_history row already exists.
+
+    Order-date matching mirrors the fill tracker. The tracker records a fill
+    under *its own* execution date and associates it with an order whose
+    recorded date differs by at most one day (``_order_date_window``): a
+    futures order placed on D fills on D+1 at the paper night session and the
+    07:00 KST business-day roll, and an overseas-stock order straddling KST
+    midnight fills on D-1. Matching the recorded fills to the order on the
+    exact ``order_date`` alone counted those real fills as missing, so a
+    futures run — which has no missing-fill recovery path — stayed held at the
+    broker node on every restart forever (``owned_fills_require_reconciliation``).
+
+    This now claims exact-date fills first across every order, then widens to
+    the same D-1/D+1 window. The window is a heuristic (the daily-reset order
+    number can be reissued on an adjacent day), so a windowed fill is counted
+    only when its symbol, side and workflow classification match the order and
+    it carries — or is a known legacy of — a stable execution identity; a
+    mismatch is skipped, not raised, because it is a different order that merely
+    reused the number. A consumed-id set spans the whole loop, so one fill is
+    evidence for at most one order even when adjacent-day orders share a number.
+    An exact-date fill keeps the strict identity guard it always had. Fill
+    storage is unchanged.
     """
     pending = {}
     for row in snapshot.pending_orders:
@@ -100,43 +121,83 @@ def assert_order_evidence(conn, tracker, snapshot):
         SELECT order_date, order_no, symbol, side, quantity FROM workflow_orders
         WHERE product=? AND provider=? AND trading_mode=?
     """, scope).fetchall()
+    from .order_recovery import recovery_for_order
+    from .order_cancellation import cancellation_quantity
+
+    entries = []
     for day, number, symbol, side, raw_qty in orders:
-        key = day, str(number).lstrip("0")
-        fills = conn.execute("""
+        norm_number = str(number).lstrip("0")
+        recovery = recovery_for_order(conn, tracker, day, norm_number)
+        entries.append({
+            "day": day,
+            "number": norm_number,
+            "symbol": normalized_symbol(symbol, tracker.product),
+            "side": side,
+            "raw_qty": raw_qty,
+            "recovery": recovery,
+            "legacy_ids": set(json.loads(recovery["legacy_fill_ids"])) if recovery else set(),
+            "total": Decimal(0),
+        })
+
+    def fills_on(dates, number):
+        placeholders = ",".join("?" for _ in dates)
+        return conn.execute(f"""
             SELECT symbol, side, quantity, classification, execution_id, id FROM trade_history
-            WHERE product=? AND provider=? AND trading_mode=? AND order_date=?
-              AND ltrim(order_no, '0')=?
-        """, (*scope, *key)).fetchall()
-        symbol = normalized_symbol(symbol, tracker.product)
-        total = Decimal(0)
-        from .order_recovery import recovery_for_order
-        recovery = recovery_for_order(conn, tracker, *key)
-        legacy_ids = set(json.loads(recovery["legacy_fill_ids"])) if recovery else set()
-        for fill_symbol, fill_side, fill_qty, classification, execution_id, fill_id in fills:
-            if (normalized_symbol(fill_symbol, tracker.product) != symbol or fill_side != side
-                    or classification != "workflow"):
+            WHERE product=? AND provider=? AND trading_mode=?
+              AND order_date IN ({placeholders}) AND ltrim(order_no, '0')=?
+        """, (*scope, *dates, number)).fetchall()
+
+    consumed: set = set()
+
+    # Pass 1 — exact order-date fills, strict identity (behaviour unchanged).
+    for e in entries:
+        for fill_symbol, fill_side, fill_qty, classification, execution_id, fill_id in \
+                fills_on([e["day"]], e["number"]):
+            if (normalized_symbol(fill_symbol, tracker.product) != e["symbol"]
+                    or fill_side != e["side"] or classification != "workflow"):
                 raise ReconciliationUnavailable("ambiguous_order_fill_identity")
-            if not execution_id and fill_id not in legacy_ids:
+            if not execution_id and fill_id not in e["legacy_ids"]:
                 raise ReconciliationUnavailable("historical_execution_identity_unavailable")
-            total += quantity(fill_qty)
-        remainder = Decimal(0)
+            e["total"] += quantity(fill_qty)
+            consumed.add(fill_id)
+
+    # Pass 2 — the D-1/D+1 window; additive, every per-fill guard a skip condition.
+    for e in entries:
+        window = tracker._order_date_window(e["day"])
+        if not window:
+            continue
+        for fill_symbol, fill_side, fill_qty, classification, execution_id, fill_id in \
+                fills_on(window, e["number"]):
+            if fill_id in consumed:
+                continue
+            if (normalized_symbol(fill_symbol, tracker.product) != e["symbol"]
+                    or fill_side != e["side"] or classification != "workflow"):
+                continue
+            if not execution_id and fill_id not in e["legacy_ids"]:
+                continue
+            e["total"] += quantity(fill_qty)
+            consumed.add(fill_id)
+
+    # Per-order terminal evidence: pending, recovery, cancellation, equality.
+    for e in entries:
+        key = e["day"], e["number"]
+        symbol, side, total = e["symbol"], e["side"], e["total"]
         if key in pending:
             row = pending[key]
             if normalized_symbol(row["symbol"], tracker.product) != symbol or row["side"] != side:
                 raise ReconciliationUnavailable("pending_order_identity_mismatch")
-            remainder = quantity(row["remaining_quantity"])
             # A still executable order could fill between the two REST reads.
             # Wait for terminal evidence before changing any owned lots.
-            if remainder:
+            if quantity(row["remaining_quantity"]):
                 raise ReconciliationUnavailable("owned_order_still_pending")
+        recovery = e["recovery"]
         if recovery:
             if (recovery["symbol"] != symbol or recovery["side"] != side
-                    or quantity(recovery["total_quantity"]) != quantity(raw_qty)):
+                    or quantity(recovery["total_quantity"]) != quantity(e["raw_qty"])):
                 raise ReconciliationUnavailable("conflicting_recovered_order")
             total += quantity(recovery["recovered_quantity"])
-        from .order_cancellation import cancellation_quantity
         total += cancellation_quantity(conn, tracker, *key, symbol, side)
-        if total != quantity(raw_qty):
+        if total != quantity(e["raw_qty"]):
             raise ReconciliationUnavailable("owned_fills_require_reconciliation")