Sydnee nightly — persistence audit — 2026-04-23 P0 findings: 0 P1 findings: 1 Risks: 2 - Area: Persistence - Bugs found (P0 / P1): 0 / 1 - Risks noted: 2 --- Full report (dev branch): https://github.com/kanex1/sydnee.signals/blob/dev/docs/audit_2026-04-23_persistence.md Reply FROM [email protected] to [email protected] to request fixes, e.g.: "code_task on sydnee-signals-dev: apply fix for the P0 about RVOL threshold in bot.py" Sydnee Agent will propose + you APPROVE (or plain 'approve') + auto-push to dev. --- Full audit below (first 12 KB) --- # Nightly Audit 2026-04-23 — PERSISTENCE ## Summary - Area: Persistence - Bugs found (P0 / P1): 0 / 1 - Risks noted: 2 --- ## Findings ### BUG [P1]: `_last_ah_trim_time` not persisted — AH trim cooldown bypassed on restart **File:** `bot.py:2958, 2978` **Evidence:** The EOD trim correctly persists its cooldown timestamp and restores it on startup: ```python # Fire site (bot.py:2909) self._update_trade_field(t.trade_id, last_eod_trim_time=int(_now_ts), eod_trimmed=True) # Load site (bot.py:906) if row.get("last_eod_trim_time") is not None: t._last_eod_trim_time = float(row["last_eod_trim_time"]) ``` The AH trim block (7 PM–8 PM ET, lines 2952–3005) sets its equivalent in-memory only: ```python t._last_ah_trim_time = _now_ts # line 2978 — NO _update_trade_field call ``` No `last_ah_trim_time` column exists in `core/schema.sql` or `ensure_trade_state_columns()`. On restart during the AH window, `getattr(t, '_last_ah_trim_time', 0)` returns 0, so the cooldown check (`_now_ts - 0 < 600`) is False → cooldown bypassed → AH trim fires immediately. Unlike `_eod_trim_count` (which has a lazy DB query fallback at bot.py:2876–2883), `_last_ah_trim_time` has no fallback mechanism at all. **Impact:** A bot restart during Friday 7 PM–8 PM ET fires an extra ~25% AH trim in under 10 minutes. Two restarts could trim 50% of remaining shares in the first 10 minutes (vs. the intended one trim per 10 min). No short-position risk (partial trim only), but accelerated position reduction beyond the intended pacing. **Fix:** ```python # After bot.py:2978, add: self._update_trade_field(t.trade_id, last_ah_trim_time=int(_now_ts)) ``` Add `last_ah_trim_time BIGINT` to `core/schema.sql` (alongside `last_eod_trim_time`) and to `ensure_trade_state_columns()`. Restore in `_load_trades_from_db` analogous to `last_eod_trim_time` (bot.py:906–907). --- ### RISK: FLAT_EXIT leaves 0-share zombie parent open until reconcile **File:** `bot.py:3599, 3632–3633` **Evidence:** When `FLAT_EXIT=true`, trim1 sells 100% of shares via a child trade: ```python trim_shares = t.shares if _flat_exit else t.shares // 2 # line 3599 — 100% ... remaining = t.shares - trim_shares # = 0 self._update_trade_field(t.trade_id, shares=0) # line 3633 ``` The parent trade remains open in the DB (`exit_price IS NULL`). The child (all shares) is closed via the trim path in `_close_trade`, which does not close the parent. On every subsequent 5-minute bar the exit loop evaluates the parent with `t.shares=0`. If the stop fires: - `_close_trade(t, ...)` → `MarketOrder(SELL, 0)` → IBKR rejects (invalid quantity) - Rejection on every bar until the reconcile loop (lines 2063–2053) detects IBKR qty=0 and closes the parent in the DB — typically within one reconcile cycle (~5 min) **Impact:** Nuisance: rejected 0-share SELL orders appear in logs for up to ~5 min after any FLAT_EXIT. No financial harm (IBKR will not execute a 0-share order). Reconcile correctly closes the zombie once it runs. Risk surfaces only when `FLAT_EXIT=true` (currently enabled on dev). **Fix (minimal):** At the trim1 fire site, when `remaining <= 0`, queue a full close for the parent instead of leaving it open: ```python remaining = t.shares - trim_shares self._update_trade_field(t.trade_id, shares=remaining) if remaining <= 0: # All shares sold via child — close parent immediately self._deferred_closes.append((t, f"FLAT_EXIT complete: all {t.shares}sh trimmed")) ``` Or add a guard at the top of the exit loop: `if t.shares <= 0: skip exit evaluation`. --- ### RISK: `_fri_ah_close_queued` not persisted — restart during AH flat can double-queue **File:** `bot.py:2994–3000` **Evidence:** ```python if getattr(t, '_fri_ah_close_queued', False): continue # dedup guard — in-memory only, NOT persisted t._fri_ah_close_queued = True self._deferred_closes.append((t, f"Friday AH FLAT: closing {t.shares}sh ...")) ``` If the bot restarts after 7:50 PM ET but before the flat order fills, the flag resets to False and the flat close is re-queued. Two close orders are sent to IBKR. The second is caught by the `is_open` guard in `_close_trade` (bot.py:5574) once the first fill closes the trade in memory. **Impact:** Low. The second close is a no-op (guard catches it). A duplicate SELL may reach IBKR for the brief window between the second queue and the first fill's `is_open` state update, but the duplicate is structurally harmless — a rejection or a zero-fill if position already closed. Theoretical: requires a restart in the ≤30-second fill window on Friday after 7:50 PM ET. **Fix:** Add `fri_ah_close_queued BOOLEAN DEFAULT FALSE` to schema and `ensure_trade_state_columns()`; persist via `_update_trade_field(t.trade_id, fri_ah_close_queued=True)`; restore in `_load_trades_from_db`. --- ## OK (checked, working or recently fixed) **Recently fixed since 2026-04-16 persistence audit:** - `ensure_trade_state_columns()` missing classification columns — **FIXED**: `trigger_type`, `trigger_direction`, `rsi_at_entry`, `bias_15m`, `bias_15m_rsi`, `sentiment_agrees`, `size_pct`, `regime_at_entry`, `signal_price`, `signal_time` all added to the idempotent ALTER TABLE migration (database.py:204–215). ✓ - `_eod_trim2`/`_eod_trim3` suffix-strip ordering — **FIXED**: EOD variants (`_eod_trim3`, `_eod_trim2`, `_eod_trim`) now checked before `_trim3`/`_trim2`/`_trim` in the suffix loop (bot.py:5730). ✓ **Working correctly:** - `_trimmed` / `_trimmed_2` / `_trimmed_3` — persisted at fire site via `_update_trade_field`; restored from `row["trimmed_1/2/3"]` in `_load_trades_from_db`. ✓ - `_obv_be_applied` — persisted via `_update_trade_field(obv_be_applied=True)` at bot.py:3209/3211; restored at bot.py:897. ✓ - `_extreme_since_trim` — persisted every bar it updates (bot.py:3656/3665); restored at bot.py:902. ✓ - `_last_eod_trim_time` — persisted immediately at EOD trim fire (bot.py:2909); restored at bot.py:906. ✓ - `_eod_trim_count` — lazy: `None` on restore → rebuilt via DB child trade count query (bot.py:2876–2883). Intentional design, confirmed. ✓ - `_pending_reversal` — persisted at all set/clear sites; restored on load. ✓ - `_rsi_force_trim` / `_rsi_force_trim2` — persisted via `force_trim_pending`/`force_trim2_pending` columns; restored on load. ✓ - `_force_trim_reason` — persisted alongside force-trim flags; restored on load. ✓ - `_trim_price` / `_trim2_price` — derived from `trim1_price`/`trim2_price` (persisted at INSERT); restored at bot.py:921–924. ✓ - `_close_order_kwargs` — ephemeral by design; user resubmits limit-close after restart. ✓ - AH trim `_ah_trim_count` starting at 0 after restart — suffix collision (`_ah_trim1` already in DB) → `ON CONFLICT DO NOTHING` prevents duplicate DB rows; `is_open` guard blocks duplicate IBKR orders if trade already closed. Net: no financial harm from count reset. ✓ - `exit_reason` two-step write — `close_trade()` writes blank `""` then `update_trade(exit_reason=reason)` fills it (bot.py:5778). Small race window if process killed between the two DB calls, but `exit_reason` is analytics-only; no trade logic reads it. ✓ **Carried from prior audits — unfixed, no change since last report:** - `vix_at_entry`/`vix_at_exit` not in schema (no DB columns) — RISK filed 2026-04-16. Analytics-only; not blocking go-live. - `position_size_pct` always 100.0 (parallel `size_pct` INT column holds the real value) — RISK filed 2026-04-16. - `_setup_mode` not persisted — RISK filed 2026-04-16. Push-notification cosmetic only. - `signal_price`/`signal_time` not restored in `_load_trades_from_db` (Trade constructor call at bot.py:871–883 omits these fields despite DB having the columns) — P1 filed 2026-04-17 execution audit. Slippage analytics only; no exit logic depends on in-memory value.