fix: harden position coexistence safeguards

Author: Henry

backend_api_python/app/routes/strategy_position_ownership_routes.py

@@ -107,6 +107,8 @@ def get_position_ownership():
     if not strategy_id:
         return jsonify({"code": 0, "msg": "positionOwnership.missingStrategyId", "data": {"items": []}}), 400
     try:
+        from app.services.live_trading.position_ownership import supports_position_coexistence
+
         rows, context = _load_ownership_rows(int(strategy_id), int(g.user_id))
         status = "drift_blocked" if any(row.get("status") == "drift_blocked" for row in rows) else "ok"
         return jsonify({
@@ -117,7 +119,10 @@ def get_position_ownership():
                 "status": status,
                 "market_type": context["market_type"],
                 "credential_id": context["credential_id"],
-                "advanced_coexistence_available": context["market_type"] in {"swap", "spot"},
+                "advanced_coexistence_available": supports_position_coexistence(
+                    context["market_type"],
+                    str(context["exchange"].get("exchange_id") or ""),
+                ),
             },
         })
     except LookupError:

backend_api_python/app/services/grid/engine.py

@@ -26,6 +26,10 @@
 ADVANCED_MODE = "advanced"
 STATUS_OK = "ok"
 STATUS_BLOCKED = "drift_blocked"
+COEXISTENCE_MARKET_TYPES = frozenset({"spot", "swap"})
+CRYPTO_COEXISTENCE_EXCHANGES = frozenset({
+    "binance", "bitget", "bybit", "gate", "htx", "okx",
+})
 
 
 def normalize_market_type(value: str) -> str:
@@ -35,6 +39,15 @@ def normalize_market_type(value: str) -> str:
     return market
 
 
+def supports_position_coexistence(value: str, exchange_id: str = "") -> bool:
+    """Return whether account/strategy inventory can share one Crypto market leg."""
+    market = normalize_market_type(value)
+    if market not in COEXISTENCE_MARKET_TYPES:
+        return False
+    exchange = str(exchange_id or "").strip().lower()
+    return market == "swap" or not exchange or exchange in CRYPTO_COEXISTENCE_EXCHANGES
+
+
 def normalize_side(value: str) -> str:
     side = str(value or "").strip().lower()
     return side if side in {"long", "short"} else ""
@@ -283,6 +296,10 @@ def repair_position_ownership(
     action_name = str(action or "").strip().lower()
     if action_name not in {"protect_manual", "strict_mode", "recheck"}:
         raise ValueError("positionOwnership.invalidRepairAction")
+    if action_name == "protect_manual" and not supports_position_coexistence(
+        market_type, exchange_id
+    ):
+        raise ValueError("positionOwnership.coexistenceMarketUnsupported")
     existing = _fetch_reservation(
         user_id=user_id,
         credential_id=credential_id,

backend_api_python/app/services/live_trading/position_ownership.py

@@ -56,18 +56,29 @@ def query_exchange_position_size(
     cfg = exchange_config if isinstance(exchange_config, dict) else {}
     sym = str(symbol or "").strip()
 
-    # Spot long close = sell base balance.
+    # Spot ownership is the complete base inventory.  Sell sizing has a
+    # separate free/available clamp because locked balances are still owned.
     if mt == "spot":
         if side != "long":
             return 0.0
         try:
-            from app.services.live_trading.spot_sizing import get_spot_free_base_balance
-
-            return max(0.0, float(get_spot_free_base_balance(client, symbol=sym) or 0.0))
+            from app.services.live_trading.spot_sizing import get_spot_total_base_balance
+
+            return max(
+                0.0,
+                float(
+                    get_spot_total_base_balance(
+                        client,
+                        symbol=sym,
+                        strict=strict,
+                    )
+                    or 0.0
+                ),
+            )
         except Exception as e:
             if strict:
                 raise
-            logger.debug("spot free balance query failed symbol=%s: %s", sym, e)
+            logger.debug("spot total balance query failed symbol=%s: %s", sym, e)
             return 0.0
 
     try:
@@ -317,24 +328,23 @@ def resolve_reduce_only_quantity(
     # In advanced coexistence mode the manual baseline is a hard floor.  Even
     # a reduce-only strategy exit may use only quantity above that floor.
     if int(user_id or 0) > 0 and int(credential_id or 0) > 0:
-        try:
-            from app.services.live_trading.position_ownership import protected_quantity
-
-            protected = protected_quantity(
-                user_id=int(user_id),
-                credential_id=int(credential_id),
-                market_type=market_type,
-                symbol=symbol,
-                side=pos_side,
-            )
-            available = max(0.0, float(exch_size or 0.0) - float(protected or 0.0))
-            meta["protected_manual_qty"] = protected
-            meta["exchange_strategy_available"] = available
-            if amount > available:
-                amount = available
-                meta["capped_by"] = "protected_manual_position"
-        except Exception as exc:
-            meta["protected_position_check_error"] = str(exc)
+        from app.services.live_trading.position_ownership import protected_quantity
+
+        # Deliberately fail closed.  If the protection ledger cannot be read,
+        # the caller must reject the exit instead of risking manual inventory.
+        protected = protected_quantity(
+            user_id=int(user_id),
+            credential_id=int(credential_id),
+            market_type=market_type,
+            symbol=symbol,
+            side=pos_side,
+        )
+        available = max(0.0, float(exch_size or 0.0) - float(protected or 0.0))
+        meta["protected_manual_qty"] = protected
+        meta["exchange_strategy_available"] = available
+        if amount > available:
+            amount = available
+            meta["capped_by"] = "protected_manual_position"
 
     meta["resolved"] = amount
     return amount, meta

backend_api_python/app/services/live_trading/position_query.py

@@ -73,23 +73,32 @@ def _pick_cost_from_row(row: Dict[str, Any], *keys: str) -> float:
     return 0.0
 
 
-def _spot_holding(total: float, available: float, avg_cost: float = 0.0) -> Dict[str, float]:
+def _spot_holding(
+    total: float,
+    available: Optional[float],
+    avg_cost: float = 0.0,
+) -> Dict[str, float]:
     t = max(0.0, float(total or 0.0))
-    a = max(0.0, float(available or 0.0))
+    # ``0`` is a valid available balance when the whole holding is locked.
+    # Only a genuinely absent value may fall back to total.
+    a = t if available is None else max(0.0, float(available or 0.0))
     if t <= 0 and a <= 0:
         return {"total": 0.0, "available": 0.0, "avg_cost": 0.0}
     if t <= 0:
         t = a
-    if a <= 0:
-        a = t
     return {
         "total": t,
         "available": a,
         "avg_cost": max(0.0, float(avg_cost or 0.0)),
     }
 
 
-def get_spot_base_holding(client: BaseRestClient, *, symbol: str) -> Dict[str, float]:
+def get_spot_base_holding(
+    client: BaseRestClient,
+    *,
+    symbol: str,
+    strict: bool = False,
+) -> Dict[str, float]:
     """
     Best-effort spot base-asset holding (total + available/free).
 
@@ -113,6 +122,8 @@ def get_spot_base_holding(client: BaseRestClient, *, symbol: str) -> Dict[str, f
                     locked = _pick_free_from_row(b, "locked")
                     return _spot_holding(free + locked, free)
     except Exception as e:
+        if strict:
+            raise
         logger.warning("spot base holding (binance): %s", e)
 
     try:
@@ -137,6 +148,8 @@ def get_spot_base_holding(client: BaseRestClient, *, symbol: str) -> Dict[str, f
                         )
                         return _spot_holding(total, avail, avg_cost)
     except Exception as e:
+        if strict:
+            raise
         logger.warning("spot base holding (okx): %s", e)
 
     try:
@@ -155,6 +168,8 @@ def get_spot_base_holding(client: BaseRestClient, *, symbol: str) -> Dict[str, f
                     locked = _pick_free_from_row(row, "locked", "freeze")
                     return _spot_holding(avail + locked, avail)
     except Exception as e:
+        if strict:
+            raise
         logger.warning("spot base holding (gate): %s", e)
 
     try:
@@ -177,6 +192,8 @@ def get_spot_base_holding(client: BaseRestClient, *, symbol: str) -> Dict[str, f
                     )
                     return _spot_holding(total, avail, avg_cost)
     except Exception as e:
+        if strict:
+            raise
         logger.warning("spot base holding (bitget): %s", e)
 
     try:
@@ -201,6 +218,8 @@ def get_spot_base_holding(client: BaseRestClient, *, symbol: str) -> Dict[str, f
                         )
                         return _spot_holding(total, avail, avg_cost)
     except Exception as e:
+        if strict:
+            raise
         logger.warning("spot base holding (bybit): %s", e)
 
     try:
@@ -217,6 +236,8 @@ def get_spot_base_holding(client: BaseRestClient, *, symbol: str) -> Dict[str, f
                     avail = _pick_free_from_row(item, "available", "balance")
                     return _spot_holding(total, avail)
     except Exception as e:
+        if strict:
+            raise
         logger.warning("spot base holding (htx): %s", e)
 
     return {"total": 0.0, "available": 0.0, "avg_cost": 0.0}
@@ -231,6 +252,23 @@ def get_spot_free_base_balance(client: BaseRestClient, *, symbol: str) -> float:
     return max(0.0, float(holding.get("available") or 0.0))
 
 
+def get_spot_total_base_balance(
+    client: BaseRestClient,
+    *,
+    symbol: str,
+    strict: bool = False,
+) -> float:
+    """Best-effort total base inventory, including exchange-locked quantity.
+
+    Ownership and drift checks must use the whole account inventory.  Open
+    limit orders can move quantity from ``available`` to ``locked`` without
+    changing ownership, so using the sellable balance here would create a
+    false negative drift.
+    """
+    holding = get_spot_base_holding(client, symbol=symbol, strict=strict)
+    return max(0.0, float(holding.get("total") or 0.0))
+
+
 def fetch_spot_last_price(client: BaseRestClient, *, symbol: str) -> float:
     """Best-effort last price for USDT -> base conversion (supports Bitget ``lastPr``)."""
     if not hasattr(client, "get_ticker"):

backend_api_python/app/services/live_trading/spot_sizing.py

@@ -45,6 +45,7 @@
     credential_id_from_exchange_config,
 )
 from app.services.live_trading.position_query import resolve_reduce_only_quantity
+from app.services.live_trading.position_ownership import supports_position_coexistence
 from app.utils.pnl import calc_notional_value
 from app.services.live_trading.base import LiveTradingError, is_file_descriptor_exhausted
 from app.services.pending_orders.fill_records import (
@@ -1788,7 +1789,8 @@ def _execute_live_order(self, *, order_id: int, order_row: Dict[str, Any], paylo
             append_strategy_log(strategy_id, "error", f"Order rejected because the exchange position snapshot failed: {symbol}")
             return
 
-        if not reduce_only and market_type == "swap":
+        ownership_enabled = supports_position_coexistence(market_type, exchange_id)
+        if not reduce_only and ownership_enabled:
             credential_id = credential_id_from_exchange_config(exchange_config)
             guard = evaluate_entry_position_guard(
                 client=client,
@@ -1813,7 +1815,7 @@ def _execute_live_order(self, *, order_id: int, order_row: Dict[str, Any], paylo
 
         # Collect raw exchange interactions / intermediate states for debugging & persistence.
         phases: Dict[str, Any] = {"pre_position_qty": pre_position_qty}
-        if not reduce_only and market_type == "swap":
+        if not reduce_only and ownership_enabled:
             phases["position_ownership"] = phases_ownership
 
         if not reduce_only and market_type == "swap":
@@ -1874,8 +1876,17 @@ def _execute_live_order(self, *, order_id: int, order_row: Dict[str, Any], paylo
                 if close_meta:
                     phases["close_size_resolve"] = close_meta
             except Exception as e:
+                error = f"protected_position_check_failed:{e}"
                 logger.error(f"[RiskControl] Failed to resolve close quantity: {e}")
                 phases["close_size_resolve_error"] = str(e)
+                self._mark_failed(order_id=order_id, error=error)
+                _notify_live_best_effort(status="failed", error=error)
+                append_strategy_log(
+                    strategy_id,
+                    "error",
+                    f"Close rejected because protected inventory could not be verified: {symbol}",
+                )
+                return
 
         # Ensure ref price exists (used by maker pricing, fallbacks, and local DB snapshots).
         if ref_price <= 0:

backend_api_python/app/services/pending_order_worker.py

@@ -7,6 +7,7 @@
 
 from app.services.live_trading.position_ownership import (
     evaluate_and_record_ownership,
+    normalize_market_type,
     ownership_log_message,
 )
 from app.services.live_trading.position_query import query_exchange_position_size
@@ -79,6 +80,12 @@ def evaluate_entry_position_guard(
             log_message=ownership_log_message(snapshot) if snapshot.should_log else "",
         )
 
+    # Spot has only the long inventory lane.  Its ownership baseline and drift
+    # rules are identical to swap, but there is no opposite exchange leg to
+    # inspect before an entry.
+    if normalize_market_type(market_type) == "spot":
+        return EntryPositionGuardResult(ownership=metadata)
+
     if strategy_allows_simultaneous_legs(strategy_config):
         return EntryPositionGuardResult(ownership=metadata)
 

backend_api_python/app/services/pending_orders/entry_position_guard.py

@@ -999,19 +999,22 @@ def _execute_signal(self, **values: Any) -> bool:
                 return False
             action = str(values.get("signal_type") or "").strip().lower()
             market_type = str(values.get("market_type") or "swap").strip().lower()
-            if action in {"open_long", "add_long", "open_short", "add_short"} and market_type in {
-                "swap", "future", "futures", "perp", "perpetual",
-            }:
+            if action in {"open_long", "add_long", "open_short", "add_short"}:
                 try:
                     from app.services.exchange_execution import resolve_exchange_config
                     from app.services.live_trading.leg_context import credential_id_from_exchange_config
-                    from app.services.live_trading.position_ownership import is_position_leg_blocked
+                    from app.services.live_trading.position_ownership import (
+                        is_position_leg_blocked,
+                        supports_position_coexistence,
+                    )
 
                     resolved_exchange = resolve_exchange_config(
                         _json_object(strategy.get("exchange_config")),
                         user_id=int(strategy.get("user_id") or 0),
                     )
-                    if is_position_leg_blocked(
+                    if supports_position_coexistence(
+                        market_type, str(resolved_exchange.get("exchange_id") or "")
+                    ) and is_position_leg_blocked(
                         user_id=int(strategy.get("user_id") or 0),
                         credential_id=int(credential_id_from_exchange_config(resolved_exchange) or 0),
                         market_type=market_type,

backend_api_python/app/services/trading_executor.py

@@ -69,7 +69,10 @@ def _create_client():
 
     with patch("app.services.grid.engine.place_grid_limit_order") as place:
         place.return_value = MagicMock(exchange_order_id="ex1")
-        with patch("app.services.grid.engine.GridRestingOrderRepository") as repo_cls:
+        with patch(
+            "app.services.grid.engine.GridEngine._grid_entry_ownership_allowed",
+            return_value=(True, {}),
+        ), patch("app.services.grid.engine.GridRestingOrderRepository") as repo_cls:
             repo = repo_cls.return_value
             repo.has_open_for_cell.return_value = False
             repo.insert.return_value = 1
@@ -89,7 +92,13 @@ def _create_client():
                         "initialPositionPct": 0,
                     },
                 },
-                {"exchange_id": "okx", "api_key": "k", "secret_key": "s", "passphrase": "p"},
+                {
+                    "exchange_id": "okx",
+                    "credential_id": 9,
+                    "api_key": "k",
+                    "secret_key": "s",
+                    "passphrase": "p",
+                },
                 user_id=1,
                 initial_capital=1000,
                 enqueue_market_fn=_enqueue,