design: durable next-session execution commands with reconciliation

[Pigbibi]

Problem

Platform reports can state signal_date to effective_date next trading day while the same invocation submits broker orders. A simple date gate would discard each freshly generated signal on the next run.

Required design

• immutable ExecutionCommand v1 persisted before broker routing
• producer stores the target, effective date, strategy and immutable decision digest
• consumer claims only due commands with create-if-absent semantics
• broker submission, accepted, partial fill, fill, cancel and reject are separate states
• incomplete claims stay blocked and alert operators instead of retrying blindly
• reconciliation is idempotent by broker order id and command id
• staged adapters for Longbridge, IBKR, Schwab and Firstrade

Guardrails

• no parameter or allocation change in this work
• no broker order is treated as filled without broker evidence
• migration must read existing marker formats safely and default to fail closed

Validation

• deterministic crash and retry tests
• concurrent consumer claim test
• broker reconciliation state-machine tests
• paper-only migration before enabling any live consumer

[Pigbibi]

Foundation PR #343 implements the immutable command/event contract, due-date single-winner claims, explicit broker-outcome states, and fail-closed recovery behavior. It deliberately enables no adapter. The remaining work is staged paper integrations plus broker lookup/reconciliation before any live consumer.

[Pigbibi]

Architecture follow-up: SOXL's proposed two-day re-entry cooldown needs a distinct durable strategy-risk state contract. The execution command module in #343 remains correctly scoped to next-session routing, claims, and broker reconciliation; it must not be used as a cooldown-state store. The strategy-layer design and paper-first gate are tracked in QuantStrategyLab/UsEquityStrategies#. No current SOXL config or Longbridge live consumer is enabled.