Daily-trend veto on M15 + lot-size / already-open lines (campaign 2026-09-30), and the 2026-10-01 whole-codebase bug review

Two bodies of work that touch the same files, so one commit.

Direction and setup-size campaign (2026-09-30 → 10-01, owner's RISK-FIRST rule,
written before the runs):
- SIGNAL: M15 daily-trend veto (factory override 7, xau_strategy.daily_trend_veto
  "both"). A finished setup against a clear daily trend (closed D1 bars, Sunday
  stubs dropped; close vs its 50-bar EMA AND vs the close 60 kept days earlier)
  is removed as the last step of the core. One definition
  (signal_aggregator.daily_trend_series) for live, the bar replay and the twin's
  host side; D1 is a required frame of the M15 scan; mirrored in
  cuda_signal_kernels.py K2. W3 824 / +205.12R / PF 1.73 / max DD 12.4R vs
  1105 / +195.79R / 1.49 / 20.9R; 2019 → 2026 1473 / +223.33R / 1.42 / 41.5R vs
  2091 / +192.53R / 1.24 / 64.8R; unseen holdout −4.62R vs −6.63R.
- FAILED, not shipped: the veto on M5 (W3 drawdown 10.1R → 15.2R) and on H1
  (−9.7R), buy-only and sell-only on M15, the wide-stop cap
  (xau_strategy.wide_stop_cap_atr stays 0.0, a research knob).
- New M15 pins: W2 dfc647ee…, OOS e87b6de1…, W3 ad3b0dbd…. M5 / H1 / H4 pins
  unchanged. --set xau_strategy.daily_trend_veto=off reproduces the previous M15
  pins byte for byte. Twin and reference script MD5-equal on every window;
  recorder and feature-export parity re-proved; base-rate table rebuilt.
- DISPLAY (books byte-identical): exposure.py — the lot size for
  trade_size.risk_per_trade (new config.json block, off by default, private to
  the owner) and the count of alerted same-direction plans still open
  (signals.alerted_at, read-only open_alerted_setups); the daily trend in words
  on Telegram, the CLI and the dashboard; signals.daily_trend logged.
- providers/oanda: a date window with no bars is an empty page, not an error
  (a D1 pad starting on a Saturday could not be fetched).
- Reports only, nothing shipped: seven context screens (no state nominated) and
  eight outside data sources (none adds a forecast to gold's own daily trend).
- Independent verification (report section 5.13): every figure reproduced on
  both scripts, scoring identical to the previous commit on all four
  timeframes, no look-ahead. Caveats recorded there: this is a risk filter, not
  a more accurate direction call; nine tenths of the 2019 → 2026 gain is 2022;
  the neighbour clause is thin (a simple 100-day average misses the R line by
  1.2R); "never adds a trade" is an observation, not a guarantee.

Bug review of the whole codebase (2026-10-01). Signal path clean. 17 defects
elsewhere, plus 4 found by an independent review of the fixes; all fixed, each
with a test; no trade book changed:
- telegram_bot: one _deliver_alert for the candle scan and the level break. The
  row is stamped alerted_at BEFORE the send, on a one-worker alert-db pool, and
  un-stamped when no chat received it or the task is cancelled mid-stamp, so
  two alerts at one candle close count each other and no SQLite write runs on
  the event loop. The 5-bar cooldown counts bars of the scan's own frame
  (== gpu_backtest._apply_cooldown; clock time released the 22:00 UTC bar after
  the settlement pause) and is restored from signals.db at start-up. The
  lot-size line goes to the owner's own chat only (a group the owner ran
  /autoscan in used to receive it). /status gains a news-model line and escapes
  failure details.
- signal_log: mark_alerted returns the stamp it wrote; unmark_alerted;
  last_alerted_bars (read-only).
- advisory_outcome: candle continuity is judged bar by bar inside the walk; a
  hole after a trade's exit no longer voids it. The stored-candle replay
  resolves 108 of 111 logged setups instead of 99, all equal to the live
  resolver's R.
- providers/oanda: an empty date window is accepted only when it is 5 days or
  shorter and no malformed candle was skipped; a longer one is retried, then
  refused, instead of being cached as history with a hole.
- news_engine: blank RSS titles skipped; one unreadable headline no longer
  costs the local model its whole batch (checked on the real bundle); model
  health recorded; no DeepSeek audit call in a process that does not archive;
  event-direction cache keyed per release; peek_week_events never fetches.
- llm_client: chat_json never raises and never logs the API key (requests
  quotes the Authorization value in InvalidHeader; error bodies are redacted).
- signal_aggregator: the scan's news block is guarded; the replay path
  (use_news=False) assigns exactly the values it did before.
- agent_panel: PANEL_PROMPT_VERSION v2.2 — same prompt text, corrected input
  (event timing over the cached calendar week, headlines newest first).
  scripts/panel_replay.py replays the logged payload per persona;
  scripts/label_scan_outcomes.py counts with an ISO cutoff.
- test_all.py: no ALTER TABLE … DROP COLUMN (the live box has SQLite 3.34);
  tests that write Parquet print a notice and return without pyarrow.

Verification after the last code change: suite 632 passed, 0 failed (also with
both Parquet engines blocked and FB2_BACKEND=cpu, the live box's view); the
five reference MD5s reproduce on both backtesters, 0 cache fallbacks; Module 37
green; static Python 3.9 / SQLite 3.34 check clean on every touched file.

Evidence: backtest/research/daily_trend_campaign_2026-09-30.md,
context_screens_2026-10.md, new_inputs_2026-10.md; CLAUDE.md sections 2, 4, 6,
8, 9, 10 and 11; pair_signals/xauusd.py docstring (M15 override 7).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

agent_panel_base_rates.json

@@ -1,6 +1,6 @@
 {
  "schema": "agent-panel-base-rates-v1",
- "generated_at": "2026-09-27T00:45:18+00:00",
+ "generated_at": "2026-10-01T05:49:09+00:00",
  "key": "timeframe|strategy|grade|direction ('*' = any)",
  "min_n_for_exact_class": 30,
  "books": {
@@ -13,8 +13,8 @@
   },
   "15min": {
    "file": "m15_w2.csv",
-   "md5": "5b65ecf6fad9a8da412749066fd50d36",
-   "trades": 813,
+   "md5": "dfc647ee02afd179dd9e031f344ed380",
+   "trades": 597,
    "first_entry": "2024-09-05 06:15:00+00:00",
    "last_entry": "2026-09-04 08:00:00+00:00"
   },
@@ -35,27 +35,27 @@
  },
  "classes": {
   "15min|*|*|*": {
-   "n": 813,
-   "win_rate": 62.24,
-   "mean_r": 0.1896,
-   "tp1_reach_rate": 50.43,
-   "median_bars_held": 32,
+   "n": 597,
+   "win_rate": 64.32,
+   "mean_r": 0.2611,
+   "tp1_reach_rate": 53.6,
+   "median_bars_held": 34,
    "book": "m15_w2.csv"
   },
   "15min|*|*|BUY": {
-   "n": 635,
-   "win_rate": 63.31,
-   "mean_r": 0.2309,
-   "tp1_reach_rate": 51.65,
-   "median_bars_held": 33,
+   "n": 540,
+   "win_rate": 64.44,
+   "mean_r": 0.2725,
+   "tp1_reach_rate": 53.52,
+   "median_bars_held": 35,
    "book": "m15_w2.csv"
   },
   "15min|*|*|SELL": {
-   "n": 178,
-   "win_rate": 58.43,
-   "mean_r": 0.0424,
-   "tp1_reach_rate": 46.07,
-   "median_bars_held": 28,
+   "n": 57,
+   "win_rate": 63.16,
+   "mean_r": 0.1536,
+   "tp1_reach_rate": 54.39,
+   "median_bars_held": 27,
    "book": "m15_w2.csv"
   },
   "15min|GENERIC|A+|BUY": {
@@ -66,68 +66,60 @@
    "median_bars_held": 32,
    "book": "m15_w2.csv"
   },
-  "15min|GENERIC|A+|SELL": {
-   "n": 1,
-   "win_rate": 0.0,
-   "mean_r": -1.0276,
-   "tp1_reach_rate": 0.0,
-   "median_bars_held": 34,
-   "book": "m15_w2.csv"
-  },
   "15min|GENERIC|A|BUY": {
-   "n": 208,
-   "win_rate": 67.31,
-   "mean_r": 0.3158,
-   "tp1_reach_rate": 59.13,
-   "median_bars_held": 44,
+   "n": 191,
+   "win_rate": 67.02,
+   "mean_r": 0.3152,
+   "tp1_reach_rate": 59.16,
+   "median_bars_held": 45,
    "book": "m15_w2.csv"
   },
   "15min|GENERIC|B|BUY": {
-   "n": 282,
-   "win_rate": 62.41,
-   "mean_r": 0.1869,
-   "tp1_reach_rate": 46.1,
+   "n": 238,
+   "win_rate": 62.18,
+   "mean_r": 0.2096,
+   "tp1_reach_rate": 47.06,
    "median_bars_held": 38,
    "book": "m15_w2.csv"
   },
   "15min|GENERIC|B|SELL": {
-   "n": 161,
-   "win_rate": 58.39,
-   "mean_r": 0.0273,
-   "tp1_reach_rate": 45.34,
-   "median_bars_held": 32,
+   "n": 52,
+   "win_rate": 63.46,
+   "mean_r": 0.1569,
+   "tp1_reach_rate": 53.85,
+   "median_bars_held": 28,
    "book": "m15_w2.csv"
   },
   "15min|GENERIC|C|BUY": {
-   "n": 60,
-   "win_rate": 65.0,
-   "mean_r": 0.395,
-   "tp1_reach_rate": 60.0,
-   "median_bars_held": 24,
+   "n": 49,
+   "win_rate": 71.43,
+   "mean_r": 0.5518,
+   "tp1_reach_rate": 67.35,
+   "median_bars_held": 27,
    "book": "m15_w2.csv"
   },
   "15min|XAU_ATR|A+|BUY": {
-   "n": 3,
-   "win_rate": 66.67,
-   "mean_r": 0.2684,
-   "tp1_reach_rate": 33.33,
-   "median_bars_held": 13,
+   "n": 2,
+   "win_rate": 50.0,
+   "mean_r": -0.4203,
+   "tp1_reach_rate": 0.0,
+   "median_bars_held": 12,
    "book": "m15_w2.csv"
   },
   "15min|XAU_ATR|A+|SELL": {
-   "n": 16,
-   "win_rate": 62.5,
-   "mean_r": 0.2612,
-   "tp1_reach_rate": 56.25,
-   "median_bars_held": 5,
+   "n": 5,
+   "win_rate": 60.0,
+   "mean_r": 0.1192,
+   "tp1_reach_rate": 60.0,
+   "median_bars_held": 6,
    "book": "m15_w2.csv"
   },
   "15min|XAU_ATR|A|BUY": {
-   "n": 80,
-   "win_rate": 56.25,
-   "mean_r": 0.06,
-   "tp1_reach_rate": 47.5,
-   "median_bars_held": 10,
+   "n": 58,
+   "win_rate": 62.07,
+   "mean_r": 0.2058,
+   "tp1_reach_rate": 53.45,
+   "median_bars_held": 11,
    "book": "m15_w2.csv"
   },
   "1h|*|*|*": {