P0: block Longbridge SG next-session SOXL signals from same-day routing

[Pigbibi]

Confirmed evidence

The live SG reports show broker order events on a run whose strategy signal is only effective on the next trading day:

• 2026-07-10 19:45 UTC: signal_date=2026-07-10, effective_date=2026-07-13, action_done=true, order_events_count=2.
• 2026-07-17 19:45 UTC: signal_date=2026-07-17, effective_date=2026-07-20, action_done=true, order_events_count=1.

This is a timing/routing defect, not a claim about broker fill status or a stop-loss failure. The current direct cycle can route a next-session decision during the signal-day invocation.

Immediate containment completed

• Cloud Run longbridge-quant-sg-service is fail-closed: RUNTIME_TARGET_ENABLED=false on revision longbridge-quant-sg-service-00753-446.
• The matching CLOUD_RUN_SERVICE_TARGETS_JSON deployment target is also disabled, preventing a later configuration sync from reopening it.
• No position was closed, no open order was cancelled, and no allocation/strategy parameter was changed.

Required recovery path

1. Add a paper-only Longbridge adapter for QPK durable execution commands (fix: harden runtime scheduling and notifications #342): persist immutable signal-day command, claim only on its effective trading day, and reconcile through broker evidence.
2. Add deterministic tests for Friday-to-Monday, concurrent invocations, crash after claim, missing command store, and mismatched input/config digests.
3. Demonstrate paper forward observations and reconciliation evidence.
4. Require explicit approval before any live consumer is enabled.

Strict guardrails

• Do not solve this by silently treating the current day as effective, or by recomputing a fresh decision next session.
• Until the durable paper path is verified, no Longbridge SG live order path may be re-enabled.
• SOXL separate stateful cooldown research is tracked in design: gate stateful SOXL risk controls behind a durable strategy-state contract UsEquityStrategies#350 and is not part of this timing incident.

[Pigbibi]

Update (2026-08-24): containment is active. PR #360 is merged and makes the direct live route fail closed whenever effective_date differs from signal_date. PR #361 is also merged and stages a dry-run-only immutable command producer; it cannot claim commands, invoke the broker, or enable live routing. The canonical QuantPlatformKit pin was advanced in QuantStrategyLab/QuantPlatformKit#341 so this stage uses the shared contract. The Cloud Run runtime target remains disabled. Next gate: implement and forward-test a paper-only consumer with reconciliation evidence before any request to resume trading.

[Pigbibi]

Paper forward-test completed on 2026-08-24. The SG runtime remains disabled, while its immutable command producer runs only in dry-run mode. A one-off dry-run reached the service successfully and created paper command cmd-21de4eca0f5b1ca662c915dec4786aad for effective_date 2026-08-25. The persisted report records action_done=false, order_events_count=0, orders_previewed_count=0, and broker_submission_done=false. The command was still enqueued even though ordinary execution dedup recognized the same signal/effective pair; that confirms evidence creation is independent of direct execution. Follow-up: the Invoke Cloud Run workflow cannot currently invoke a paused internal dry-run scheduler, so a narrowly guarded one-shot option is being added. Live routing remains disabled.

[Pigbibi]

Invocation workflow acceptance test passed after PR #363 merge. With explicit allow_paused_dry_run=true and path /dry-run, it temporarily resumed only the paused precheck scheduler, received HTTP 200 from the service, and restored the scheduler to PAUSED. The second paper run was idempotent: the command store still contains one command for 2026-08-25, while the execution report records action_done=false, broker_submission_done=false, order_events_count=0, and orders_previewed_count=0.

[Pigbibi]

Additional platform repair merged: PR #364 restores environment-scoped strategy plugin mounts during per-service sync, and PR #365 scopes traffic/scheduler reconciliation to the current matrix service. This removes the repeat PAPER/HK traffic-reconciliation race while SG remains paper-only and runtime-disabled.