feat(execution): reconcile timed-out orders safely

trex_core/runtime/config.py

@@ -170,9 +170,8 @@ class DaemonInstanceConfig:
     # admission capacity cap. BAT-030: asset-centric is the only model; absent
     # means no cap (operators are expected to set it in production).
     max_active_slots: Optional[int] = None
-    # dcy-022 / REQ-068: default order timeout in seconds (opt-in per instance).
-    # None = OFF = indefinite wait (legacy behavior). Per-intent timeout_sec overrides.
-    default_order_timeout_sec: Optional[int] = None
+    # Per-instance override; omission uses the hard 3,600-second fallback.
+    default_order_timeout_sec: int = 3600
     # dcy-024 / REQ-048 CHG-20260611-01: disable autonomous safety-sell worker.
     # Absent = True (safe default). False → trex-safety-sell thread not started.
     safety_sell_enabled: bool = True
@@ -202,11 +201,17 @@ class DaemonInstanceConfig:
             raise RuntimeError(
                 f"instance TOML 'max_active_slots' must be > 0, got {raw_max}: {path}"
             )
-        raw_timeout = data.get("default_order_timeout_sec")
-        default_timeout = int(raw_timeout) if raw_timeout is not None else None
-        if default_timeout is not None and default_timeout <= 0:
+        raw_timeout = data.get("default_order_timeout_sec", 3600)
+        if not isinstance(raw_timeout, int) or isinstance(raw_timeout, bool):
             raise RuntimeError(
-                f"instance TOML 'default_order_timeout_sec' must be > 0, got {raw_timeout}: {path}"
+                f"instance TOML 'default_order_timeout_sec' must be an integer in 1..3600, "
+                f"got {raw_timeout}: {path}"
+            )
+        default_timeout = raw_timeout
+        if not 1 <= default_timeout <= 3600:
+            raise RuntimeError(
+                f"instance TOML 'default_order_timeout_sec' must be in 1..3600, "
+                f"got {raw_timeout}: {path}"
             )
         raw_wd = data.get("watchdog_timeout_sec")
         watchdog_timeout = int(raw_wd) if raw_wd is not None else None
@@ -258,9 +263,8 @@ class DaemonConfig:
     # threshold in seconds. 0 disables (default). When >0, dispatched-pending
     # slots older than this are surfaced (WARN + counter) without state change.
     pending_stale_threshold_sec: int = 0
-    # dcy-022 / REQ-068: default order timeout (seconds). None = OFF = indefinite.
-    # Per-intent timeout_sec overrides. Passed to IntentService at wiring time.
-    default_order_timeout_sec: Optional[int] = None
+    # Effective fallback passed to IntentService; never disabled by omission.
+    default_order_timeout_sec: int = 3600
     # dcy-014 / REQ-048: operator-local timezone (CLI date display etc.). The
     # daily preallocation trigger was removed with the pool model (BAT-030).
     trading_timezone: str = "Asia/Seoul"
@@ -417,4 +421,5 @@ class DaemonConfig:
             safety_sell_enabled=inst.safety_sell_enabled,
             safety_sell=safety_sell,
             credential_fetch_enabled=inst.credential_fetch_enabled,
+            default_order_timeout_sec=inst.default_order_timeout_sec,
         )