fix(rails): let rail 9 see a protective bracket's own stop

[eaitbrahim]

Closes #206. Surfaced while fixing #195.

The gap

place_bracket carries the bracket's trigger price in entry and leaves stop=None:

intent = OrderIntent(
    side=Side.SELL,
    entry=stop,   # the trigger price
    stop=None,    # -> rail 9 has nothing to check
    ...
)

That shape is correct — the order is the stop, not an entry protected by one somewhere else. But rail 9 (no stop-loss widening) is guarded by intent.stop is not None, so it skipped every bracket keel has ever placed.

The ratchet-only invariant was still enforced, but only inside _roll_stop — which has no production caller (tests/execution/test_executor.py:1415 is an explicit tripwire asserting that). So on the live path, the only thing checking that a bracket's stop had not moved against the position was code that never runs.

The fix

OrderIntent.protective_stop, set by place_bracket and _roll_stop, read by rail 9 when stop is absent:

proposed_stop = intent.stop if intent.stop is not None else intent.protective_stop

Why a separate field and not just stop — this is the part worth reviewing. Rail 7 (min-move/anti-scalping) measures abs(entry - stop) / entry, and a bracket's entry and stop are the same price by construction. Populating stop would compute a 0% move and veto every protective order keel places on the anti-scalping floor. Two rails asking two different questions need two fields. test_a_protective_bracket_is_not_vetoed_by_the_min_move_floor pins this.

Rail 7 remains inert on brackets by design — there is no entry-to-stop distance to measure. The module docstring now says so rather than implying coverage that was never there, which was the original complaint in #206.

The comparison stays strictly <, never <=. Re-placing at the same level is exactly how _rebracket_or_escalate and reconcile_unbracketed_positions recover a dead or rejected bracket — an off-by-one to <= would veto every recovery and strand the position naked, reintroducing the failure #195 just closed. test_rail9_allows_re_placing_a_bracket_at_the_SAME_stop guards it.

Tests

5 new (4 written failing first; the fifth passes already as a regression guard that protective_stop does not shadow the entry path). Covers: a widening bracket now vetoed, a ratcheting one allowed, re-placement at the same stop allowed, min-move not triggered on a bracket, and entries still using their own stop.

ruff check keel tests packages clean, mypy clean on both changed modules, 2293 passed / 1 skipped.

Scope note

No behaviour change on any path exercised today: the first bracket after an entry sees open_stop unset (it is written only after a successful placement), and both recovery paths re-place at the recorded level, which passes. This closes the gap ahead of stop rolls ever being wired up — at which point rail 9 becomes the un-overridable backstop behind _roll_stop's own local check.

🤖 Generated with Claude Code