trex-core/docs/releases/rel-012_20260717_cost-basis-safe-sync-seed-hotfix.md

REL-012: cost-basis canonical parse 및 안전 sync seed 긴급 핫픽스

• Status: Released
• Profile: app-service
• Priority: urgent
• Owner: 팀장 / 운영팀
• Included batch: BAT-058 (REQ-123)
• Source discovery: dcy-038
• Batch verification: BAT-058 verification — lead confirm-batch-verification, QC-7 PASS-WITH-NOTES
• Operations handoff: REL-012 deployment request

Release intent

portfolio-hub의 기존 cost-basis 응답에서 canonical cost_basis_per_unit을 우선 해석하고, broker quantity가 양수인 inactive-slot onboarding에서 WAC/avg_price를 얻지 못하면 live sync가 slot status/qty/avg_price/warning을 쓰지 않은 채 non-zero로 fail-closed하도록 한다. dry-run은 sanitized source/reason과 no-write preview를 제공한다.

Source publication boundary

Item	Current evidence	Release constraint
Remote origin/main	869e07f	BAT-058 source and immutable REL/runbook manifest are included; this is the recorded release-manifest revision.
BAT-058 candidate	81a853a, reachable from origin/main	Reviewed code payload was deployed; operational evidence is recorded in the REL-012 execution record.
Immutable deploy payload	81a853a	Immutable code/test payload checked out for the daemon rollout.
Authoritative release manifest	869e07f	Immutable REL/runbook manifest recorded with the operational evidence.

The immutable daemon deploy payload and the release manifest have distinct roles: 81a853a is the verified code/test payload; 869e07f is the immutable release/runbook manifest. Operations recorded both revisions in the REL-012 execution evidence. The pre-execution authorization boundary is historical: the approved daemon restart and read/dry-run smoke completed without a release-scope stop condition. sync --live remains a separately authorized per-target operational action and is not deployment smoke.

Included scope

1. cost_basis_per_unit canonical priority parsing and approved legacy compatibility chain (avg_cost → wac → cost_basis) only when canonical is absent.
2. Canonical invalid/null/non-numeric/zero/negative values are not silently masked by a legacy value; diagnostic reasons remain sanitized.
3. Inactive slot + positive broker quantity + unavailable WAC: dry-run no-write preview; live non-zero fail-closed with no slot/warning mutation.
4. Existing HOLDING reconciliation remains compatible; sanitized CLI/operator diagnostics preserve seeded_avg_price, source, and absence reason.

Explicit exclusions / no-go

• portfolio-hub API/schema/auth changes, token/config changes, dependency upgrade, DB migration, direct DB edit/delete, AMQP wire/topology change.
• Any sync --live, --yes live write, automatic remediation, order action (enter/exit/cancel), or target portfolio selection.
• Changing credential_fetch_enabled, break-glass mode, instance configuration, endpoint, or secrets.
• Strategy daemon deployment.

A single-target sync --live --yes remains a separately approved post-release action even after this source rollout. It must not be used as a deployment smoke shortcut.

Draft verification evidence

Check	Result	Evidence / limitation
Independent QC-7	PASS-WITH-NOTES	Legacy-invalid focused 8 passed, 19 deselected; affected suite 113 passed; full suite 833 passed, 47 skipped; Ruff/compileall/diff hygiene pass.
Release-prep full regression	PASS	2026-07-17 delivery worktree: 833 passed, 47 skipped in 1.88s.
Focused Ruff	PASS	Changed adapter/reconcile/CLI and relevant tests: All checks passed!.
Focused compile check	PASS	Six changed source/test paths, compileall -q, exit 0.
Live broker, live PostgreSQL, production deploy	PASS	Operations returned secret-free primary evidence: pinned daemon rollout, startup acceptance, and permitted dry-run / verify smoke all PASS; see execution evidence.
Source publication	PUBLISHED / DEPLOYED	Immutable daemon payload 81a853a is reachable from origin/main; manifest 869e07f and both revisions are recorded in the execution evidence.

Release approval gates

All release gates are recorded as satisfied in the REL-012 execution evidence:

• Reviewed source and REL/runbook manifest are published and immutable.
• Operations verified payload 81a853a, recorded manifest 869e07f, and captured ROLLBACK_REVISION.
• User explicitly authorized production execution; off-market window is recorded.
• Operations confirmed clean checkout and unchanged runtime configuration / credential / break-glass modes.
• Operations confirmed no dependency or migration delta.
• Operations used the approved supervisor, recorded startup acceptance, and completed permitted dry-run / verify smoke with no write indication.

Rollout and rollback policy

1. Use the pinned immutable source only; use the host’s existing approved supervisor to restart the same daemon with unchanged approved configuration.
2. After startup acceptance, run only the read/dry-run commands in the REL-012 runbook.
3. Stop and roll back on startup failure, traceback/error regression, unexpected credential/source-mode behavior, unexpected mutation indication, or smoke output that violates the no-write/fail-closed contract.
4. Roll back by restoring the actual captured ROLLBACK_REVISION and restarting with unchanged configuration. Do not run database rollback commands, direct DB edits, or live sync.

Release Decision Evidence

• Released Decision: Released — lead confirm-release recorded after reviewing the release-specific execution record.
• Rationale: immutable payload 81a853a was deployed with manifest 869e07f; clean preflight, unchanged safety-sensitive configuration, daemon restart/startup, read-only dry-run/verify acceptance, and no rollback trigger are all documented as PASS.
• Recorded by: 팀장, based on secret-free trex-op evidence received 2026-07-17 13:42:37 KST.
• Primary record: REL-012 execution evidence.
• Boundary: sync --live is not daemon rollout smoke; any later per-target use remains an independent approved operational action.

Feedback Handoff

• Observation summary: post-restart sync --all --dry-run exited 0 with 145 skipped broker_qty_zero results and no write indication; verify exited 0 with no C-warned slots. No release-scope failure was reported.
• Discovery / REQ input: none from this rollout evidence.
• Train boundary: REL-012 is released, but M5 is not reclassified as Train Released because REL-011 still lacks a separate execution-evidence decision.