trex/trex-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(broker): dcy-013 KIS 외부 취소 감지 + 부분 체결 회계 + stale 워치독 (BAT-017)

Browse Source 
KIS 계좌에서 직접 매도 주문을 취소하면 poll_fill 이 cncl_yn 을 파싱하지 않아
슬롯이 pending_sell 에 영구히 갇히고 죽은 주문을 무한 폴링하던 버그(issue #9)
정정.

거버넌스: 전부 change-req (신규 REQ 없음, dcy-013 OQ-3).
- REQ-012: KIS poll_fill cncl_yn 파싱 → 외부 취소 감지. FillStatus.cancelled
  /is_partial_cancel 추가. 체결 0 취소→cancelled, 부분 체결 후 취소→partial+cancelled
- REQ-013: 집행 _on_partial_cancel — 체결분 원장 1회 + qty 차감(매도 잔여/매수 체결분)
  + holding 복귀 (OQ-1 A안). 전량 취소는 기존 롤백 경로 재사용
- REQ-018: 부분 체결분 원장 1회 기록 (_record_ledger 재사용)
- REQ-031: 잔여 포지션 정합 연계 (slot.qty ↔ 실 잔고, 과매도 방지)
- REQ-014: pending stale 워치독 Alert-only (TREX_PENDING_STALE_THRESHOLD,
  WARN+카운터, 상태 미변경) — 취소 감지 누락 backstop
- REQ-015: interface-contract/runtime-flows 정합

전량 취소는 holding 자동 복구(limit_price clear→재매도 시장가, dcy-012 연계).
KIS cncl_yn 실 규약은 운영 검증(미지 값 보수 처리 + 워치독 backstop).

검증: 단위 294 passed/32 skipped, 인프라 게이트(PG+RabbitMQ) 326 passed, ruff clean.
신규 test_kis_cancel(httpx stub) + test_execution_cancel(programmable broker).
BAT-017 release-candidate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
genichin
2026-06-08 14:11:49 +09:00
co-authored by Claude Opus 4.8
parent cc28e1fba5
commit 4746f74aae
24 changed files with 1063 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
trex_core/application/execution.py
+73 -1
View File
@@ -46,6 +46,7 @@ class ExecutionResult:
rolled_back: int = 0
ledger_enqueued: int = 0 # REQ-019: ledger work items appended this tick
ledger_skipped: int = 0 # REQ-018 AC-4: fills without portfolio_id
stale_pending: int = 0 # dcy-013 / REQ-014 FR-3: pending orders over threshold
class ExecutionService:
@@ -56,12 +57,22 @@ class ExecutionService:
broker: BrokerPort,
ledger_outbox: Optional[LedgerOutbox] = None,
event_emitter: Optional[SlotEventEmitter] = None,
stale_pending_threshold_sec: Optional[int] = None,
) -> None:
self._svc = slot_service
self._repo = repo
self._broker = broker
self._ledger_outbox = ledger_outbox
self._event_emitter = event_emitter
# dcy-013 / REQ-014 (issue #9): Alert-only pending-order stale watchdog.
# <=0 or None disables it. When set, a dispatched-pending slot whose
# last update is older than the threshold is surfaced (WARN + counter)
# without changing its state — the backstop for a cancel-detection miss.
self._stale_threshold_sec = (
stale_pending_threshold_sec
if stale_pending_threshold_sec and stale_pending_threshold_sec > 0
else None
)
# ------------------------------------------------------------
def run_once(self) -> ExecutionResult:
@@ -111,16 +122,25 @@ class ExecutionService:
r.rolled_back += 1
def _poll(self, r: ExecutionResult) -> None:
now = datetime.now(tz=timezone.utc)
for slot in self._repo.list_dispatched_pending():
side = "buy" if slot.status is SlotState.PENDING_BUY else "sell"
fs = self._broker.poll_fill(slot.broker_order_id, side=side, symbol=slot.symbol or "")
if fs.is_filled:
self._on_filled(slot, fs, side, r)
r.filled += 1
elif fs.is_partial_cancel:
# dcy-013 / REQ-013 FR-2: partial fill then external cancel.
self._on_partial_cancel(slot, fs, side, r)
r.filled += 1
elif fs.is_terminal_reject:
# rejected or full external cancel (dcy-013 FR-1) -> rollback.
self._rollback(slot, reason=f"order_{fs.state}")
r.rolled_back += 1
# accepted / partially_filled -> leave for next tick
else:
# accepted / partially_filled (not cancelled) -> leave for next
# tick, but surface if it has been stuck too long (FR-3).
self._check_stale_pending(slot, now, r)
# ------------------------------------------------------------
def _on_filled(self, slot, fs, side: str, r: ExecutionResult) -> None:
@@ -149,6 +169,58 @@ class ExecutionService:
self._emit_event(event_type, updated)
self._repo.clear_dispatch(slot.slot_id) # done with this order
def _on_partial_cancel(self, slot, fs, side: str, r: ExecutionResult) -> None:
"""Partial fill then external cancel (dcy-013 / REQ-013 FR-2, OQ-1 A).
Record the filled portion to the ledger ONCE, decrement the held qty,
and return the slot to holding with the remainder — so the remaining
position can be re-sold and no over-sell / double-record occurs (NFR-3).
avg_price (cost basis) is preserved on a sell; a buy keeps only the
portion that actually filled.
"""
broker_order_id = slot.broker_order_id # captured BEFORE clear_dispatch
filled = float(fs.filled_qty)
try:
if slot.status is SlotState.PENDING_BUY:
# Only the filled portion is held; avg_price = fill price.
updated = self._svc.transit_slot(
slot.slot_id, SlotState.PENDING_BUY, SlotState.HOLDING,
reason="buy_partial_cancel", actor="execution_loop",
avg_price=fs.avg_price, qty=filled,
)
event_type = "slot_filled_buy"
else: # PENDING_SELL: remainder stays held, cost basis unchanged.
remaining = max(0.0, float(slot.qty or 0) - filled)
updated = self._svc.transit_slot(
slot.slot_id, SlotState.PENDING_SELL, SlotState.HOLDING,
reason="sell_partial_cancel", actor="execution_loop",
qty=remaining,
)
event_type = "slot_filled_sell"
except SlotStateMismatchError:
return # slot moved concurrently; next tick reconciles
self._record_ledger(slot, fs, side, broker_order_id, r)
self._emit_event(event_type, updated)
self._repo.clear_dispatch(slot.slot_id)
def _check_stale_pending(self, slot, now: datetime, r: ExecutionResult) -> None:
"""Alert-only: surface a dispatched-pending slot stuck past the threshold.
dcy-013 / REQ-014 FR-3 — state is NOT changed (auto-remediation is a
follow-up). This is the backstop for a cancel-detection miss (R-1).
"""
if self._stale_threshold_sec is None or slot.updated_at is None:
return
age = (now - slot.updated_at).total_seconds()
if age >= self._stale_threshold_sec:
r.stale_pending += 1
_log.warning(
"pending order stale: slot=%s status=%s broker_order_id=%s "
"age_sec=%.0f threshold_sec=%d (no state change — ops attention)",
slot.slot_id, slot.status.value, slot.broker_order_id,
age, self._stale_threshold_sec,
)
def _emit_event(self, event_type: str, slot) -> None:
if self._event_emitter is None:
return