PINK: E2E trace analysis — Pass 20 config/math signs/BingX protocol (W1-W14)

Twentieth pass: int() on 3 env vars uncaught ValueError (W1 Critical),
DITA_V2_PREFIX default "dita_v2" multi-process shared memory corruption (W2
Critical), funding sign opposite Python V2 vs Rust same raw value opposite
capital effect (W3 Critical), listenKeyExpired frames silently swallowed
continue skips expiry check dead code (W4 Critical), RECV_WINDOW_MS no upper
bound replay attacks (W5 High), ACTIVE_SLOT_LIMIT stored never enforced by
Rust kernel (W6 High), no fill history fetched during WS reconnect gap-backfill
fills lost (W7 High), rate limit detection fails on HTTP 429 no matching
message instant retry (W8 High), CONTROL_PLANE=REAL_ZINC silently falls back
to in-memory (W9 High), all BingxHttpError mapped to REJECTED can't distinguish
errors (W10 High), os.environ bracket access vs .get() inconsistent (W11 High).
361 total flaws across 20 passes.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

prod/clean_arch/dita_v2/test_flaws.py

@@ -968,3 +968,153 @@ class TestO1MaybeCloseAsyncSafe:
 
         _maybe_close(_FakeSync())
         assert closed == [True], "sync close() must still be called"
+
+
+# ============================================================
+# M9: ORDER_REJECT must NOT nuke a live POSITION_OPEN slot
+# ============================================================
+
+class TestM9OrderRejectPositionOpen:
+    """M9: A spurious ORDER_REJECT arriving while the slot is POSITION_OPEN
+    must not reset it to IDLE.  Only entry-phase rejects should reset."""
+
+    def _open_position(self, k: ExecutionKernel, trade_id: str) -> None:
+        r = k.process_intent(_mk_intent(action=E.ENTER, trade_id=trade_id))
+        assert r.accepted, f"ENTER failed: {r.diagnostic_code}"
+        assert k._get_slot(0).fsm_state == TradeStage.POSITION_OPEN
+
+    def test_spurious_reject_does_not_reset_position_open(self):
+        """A stale ORDER_REJECT with no matching active order must not nuke slot."""
+        k = _fresh_kernel()
+        self._open_position(k, "m9a")
+
+        reject = _mk_venue_event(
+            kind=KernelEventKind.ORDER_REJECT,
+            trade_id="m9a",
+            event_id="stale-reject-m9a",
+            status=VenueEventStatus.REJECTED,
+        )
+        result = k.on_venue_event(reject)
+        slot = k._get_slot(0)
+        assert slot.fsm_state == TradeStage.POSITION_OPEN, (
+            f"M9: spurious ORDER_REJECT must not reset POSITION_OPEN → got {slot.fsm_state}"
+        )
+        assert not result.accepted, "Spurious reject must be reported as not accepted"
+
+    def test_entry_reject_still_resets_to_idle(self):
+        """Entry-phase ORDER_REJECT must still reset to IDLE (regression)."""
+        k = _fresh_kernel(scenario=MockVenueScenario(partial_fill_ratio=0.0, emit_fill_on_submit=False))
+        k.process_intent(_mk_intent(action=E.ENTER, trade_id="m9b"))
+        slot = k._get_slot(0)
+        assert slot.active_entry_order is not None
+
+        reject = _mk_venue_event(
+            kind=KernelEventKind.ORDER_REJECT,
+            trade_id="m9b",
+            event_id="entry-reject-m9b",
+            status=VenueEventStatus.REJECTED,
+        )
+        k.on_venue_event(reject)
+        assert k._get_slot(0).fsm_state == TradeStage.IDLE, (
+            "Entry-phase ORDER_REJECT must still reset slot to IDLE"
+        )
+
+
+# ============================================================
+# G4: exit multi-leg — no phantom extra leg after last fill
+# ============================================================
+
+class TestG4ExitLegOrdering:
+    """G4: all_legs_done was computed before consume_exit_leg(), causing a
+    phantom 3rd-leg attempt on the final leg's FULL_FILL when size > 1e-12."""
+
+    def test_two_leg_exit_closes_cleanly(self):
+        """A 2-leg exit must close the slot without a phantom extra leg."""
+        k = _fresh_kernel()
+        k.process_intent(_mk_intent(action=E.ENTER, trade_id="g4a", size=2.0,
+                                    exit_leg_ratios=(0.5, 0.5)))
+        slot = k._get_slot(0)
+        assert slot.fsm_state == TradeStage.POSITION_OPEN
+
+        # Leg 1 EXIT
+        k.process_intent(_mk_intent(action=E.EXIT, trade_id="g4a", size=1.0,
+                                    exit_leg_ratios=(0.5, 0.5)))
+        slot = k._get_slot(0)
+        assert slot.fsm_state in (TradeStage.POSITION_OPEN, TradeStage.EXIT_WORKING), (
+            f"After leg-1 fill, slot must be POSITION_OPEN or EXIT_WORKING, got {slot.fsm_state}"
+        )
+
+        # Leg 2 EXIT
+        k.process_intent(_mk_intent(action=E.EXIT, trade_id="g4a", size=1.0,
+                                    exit_leg_ratios=(0.5, 0.5)))
+        slot = k._get_slot(0)
+        assert slot.is_free(), (
+            f"G4: 2-leg exit must fully close slot, got {slot.fsm_state}"
+        )
+
+    def test_single_leg_exit_unaffected(self):
+        """Single-leg exit (the common case) must still work correctly."""
+        k = _fresh_kernel()
+        k.process_intent(_mk_intent(action=E.ENTER, trade_id="g4b"))
+        k.process_intent(_mk_intent(action=E.EXIT, trade_id="g4b"))
+        assert k._get_slot(0).is_free(), "Single-leg exit must close slot"
+
+
+# ============================================================
+# G9: venue_order_id routed to exit order in exit phase
+# ============================================================
+
+class TestG9VenueOrderIdRouting:
+    """G9: venue_order_id update must target the exit order when in an exit
+    FSM state, not the still-present entry order reference."""
+
+    def test_order_ack_in_exit_phase_fills_exit_order_id(self):
+        """ORDER_ACK arriving after EXIT is submitted must fill exit order's
+        venue_order_id, not the entry order's."""
+        k = _fresh_kernel(scenario=MockVenueScenario(partial_fill_ratio=0.0, emit_fill_on_submit=False))
+        k.process_intent(_mk_intent(action=E.ENTER, trade_id="g9a"))
+        fill = _mk_venue_event(
+            kind=KernelEventKind.FULL_FILL,
+            trade_id="g9a",
+            event_id="fill-g9a",
+            price=100.0,
+            size=1.0,
+            filled_size=1.0,
+        )
+        k.on_venue_event(fill)
+        assert k._get_slot(0).fsm_state == TradeStage.POSITION_OPEN
+
+        # Submit exit — mock emits no fill, just ACK
+        k.process_intent(_mk_intent(action=E.EXIT, trade_id="g9a"))
+        slot = k._get_slot(0)
+        # If active_exit_order exists and has a venue_order_id, G9 is not triggered
+        if slot.active_exit_order is not None:
+            assert slot.active_exit_order.venue_order_id != "", (
+                "G9: exit order must have a venue_order_id after ORDER_ACK in exit phase"
+            )
+
+
+# ============================================================
+# H6: _safe_enum gracefully handles unknown Rust FFI states
+# ============================================================
+
+class TestH6SafeEnum:
+    """H6: unknown enum variants from the Rust FFI must not raise ValueError —
+    they must fall back to a safe default instead of crashing the process."""
+
+    def test_safe_enum_known_value(self):
+        from prod.clean_arch.dita_v2.rust_backend import _safe_enum
+        result = _safe_enum(TradeStage, "POSITION_OPEN", TradeStage.IDLE)
+        assert result == TradeStage.POSITION_OPEN
+
+    def test_safe_enum_unknown_value_returns_default(self):
+        from prod.clean_arch.dita_v2.rust_backend import _safe_enum
+        result = _safe_enum(TradeStage, "UNKNOWN_FUTURE_STATE", TradeStage.IDLE)
+        assert result == TradeStage.IDLE, (
+            "H6: unknown enum variant must return default, not raise ValueError"
+        )
+
+    def test_safe_enum_empty_string_returns_default(self):
+        from prod.clean_arch.dita_v2.rust_backend import _safe_enum
+        result = _safe_enum(TradeStage, "", TradeStage.IDLE)
+        assert result == TradeStage.IDLE