Broker port has no bracket/OCO order kind — live trailing stops, BE-rolls and scale_out are blocked on it

[eaitbrahim]

The finding

Split out of #442. keel's live exits ride ONE native Coinbase trigger-bracket placed at entry (keel/execution/executor.py::_bracket_order_configuration → trigger_bracket_gtc, built as a raw dict against the pre-port CoinbaseClient). Moving a stop means cancel-and-replace of that bracket (_roll_stop), and a partial exit means resizing it.

The broker port has no bracket/OCO order kind at all: OrderSpec is MarketIOCByQuote / MarketIOCByBase / LimitGTC / StopLimitGTC (packages/keel-broker-coinbase/keel_broker_coinbase/translate.py::to_order_configuration, assert_never on anything else). The bracket reaches the venue only because the executor bypasses the port with a raw configuration dict — so the three live exit primitives (trail_stop_atr, roll_to_break_even, scale_out) have no port-clean path to production. #442 wired the exit POLICY (ratchet-only ATR trailing, break-even roll) on the sim/backtest engines only and left the live primitives deliberately unwired pending this issue.

scale_out additionally carries its own prerequisites, pinned by the tripwire test tests/execution/test_executor.py::test_scale_out_has_no_production_caller: before it may be wired it must (1) cancel/resize the resting bracket that commits the FULL position (a partial SELL against it is rejected, or fills and leaves an oversized bracket able to sell more than is held), and (2) record a trade_outcomes row for the partial exit — otherwise rail 16 counts a net winner as a loss.

Why it matters

Reading executor.py in isolation still overstates what keel does live: the module implements and unit-tests stop management that nothing in the agent cycle calls. The honest docstring now says so, but the honest FIX is a port that can express the orders a managed position needs.

Scope

• Add a bracket/OCO OrderSpec kind to keel-broker-api + the Coinbase adapter's to_order_configuration translation (and the other adapters' explicit refusal, where they cannot support it).
• A live per-cycle stop-management step in agent.run_once that calls trail_stop_atr/roll_to_break_even per rule family — the per-family params (trail_atr_mult, be_roll_rr on pullback_continuation/rsi_meanrev) already exist and are wired through the sim/backtest engines; turtle stays on its Donchian exit by choice.
• scale_out: bracket resize + trade_outcomes recording, then remove the tripwire test.

[eaitbrahim]

Split out of #446's bracket-policy scope, with the decision input this PR established (branch fix-446-partial-fills, PR to follow).

What #446 landed (no port work needed): partial fills are now a distinct non-terminal partially_filled state in reconciliation (filled_quantity column, venue's quantity-weighted average in actual_fill), the entry-side observation (_upgrade_to_observed_economics) records the observed fill on market IOC entries, rail 8's basis counts partially-filled BUYs at their FILLED quantity, and doctor surfaces the condition as a fill.partial WARN with the manual remedy.

The decision this issue now owns — amend vs cancel-and-replace on a partially-filled entry. When a market IOC entry fills short, the native trigger_bracket_gtc placed by executor.execute was sized for the ordered quantity, i.e. it can sell more than is held. Options as they actually stand:

1. Initial-sizing to the observed fill (place the bracket for filled_quantity, not intent.qty, when the post-placement get_order snapshot reports a short fill). Cheapest — no cancel, no amend — but it acts on a snapshot that may still be settling, and place_bracket runs before the row's economics are final.
2. Cancel-and-replace via the existing raw-dict path (_cancel_at_exchange + re-place). Implementable today without the port, but it auto-cancels a live protective order on the strength of that same snapshot; if the cancel lands and the re-place is vetoed/rejected, the position is left naked — the exact state reconcile.position_unprotected exists to escalate.
3. Deferred replace — let the oversized bracket be rejected by the venue for insufficient base (spot will refuse a SELL committing more than held), let unbracketed: retry next cycle, and size the retry from the ledger. Least code, but relies on the venue rejection and burns a cycle naked.

#446 deliberately took detect-and-surface over all three: a wrong auto-action on live money is worse than a loud warning. Whichever option this issue picks should also cover the exit-side sibling — a partially-filled SELL exit currently books exit_qty=position.qty in agent._close_tranches, which over-books a short market exit.

One more note for the port design: the observation shape reconciliation depends on (filled_size / average_filled_price / total_fees, cumulative) is already what keel_broker_api.results.OrderStatus carries and what the alpaca (filled_qty/filled_avg_price) and robinhood (filled_asset_quantity/average_price) adapters normalize to — so a bracket/OCO OrderSpec kind plus a resize/replace primitive on the port closes this without any new observation plumbing.