Hardening release: safer executor, safer deploys, sturdier data

What changed for you

• Stops keep being watched through hiccups. If the broker connection breaks, the desk now retries on its own after a minute, tells you loudly while protection cannot run ("guards unwatched"), and re-arms stops on positions that briefly vanished from a broker read instead of forgetting them.
• A vendor outage no longer cancels a session. When Alpaca's snapshot endpoint fails (as it did on 09-11), planning falls back to the live stream / last stored prices and says so, instead of cancelling the desk's session.
• Tight stops are widened, not refused. When the PM's stop is closer than the market's normal noise, the order is placed with the stop widened to 1.5 × the name's typical daily range at the same dollars-at-risk (smaller size), and the card says so. The separate "Trader agent" stays off: a live head-to-head showed it added nothing over this rule.
• Sign-in and safety fixes from the independent code review: step-up required where it was missing, cleaner lockout, idempotent retries across instances, alerts that fold instead of paging every tick, nightly report no longer fails on a read-only role.
• Quant evals ran live and passed; the Quant's proposals now carry their evidence.

What you may notice

• New alert kinds in the inbox if something goes wrong: "guards unwatched", "quote stale for guard", clearer scan-failure text.
• Deploys: a release can no longer roll back onto code that cannot run the current database (the 09-11 incident); the system prefers "forward-only" and says so.

Switched on in this release

No new switches; behaviour changes are in code. Consult's per-turn budget was raised separately ($0.75 → $2.00) after a first-question failure on a new book.

Known gaps / coming next

Console batches (new landing page, illustrated desk, mind card v3, trade ticket + refusal overrides, admin/onboarding polish incl. the invite default, waitlist modal and ultrawide sign-up fix) land next; error messages get their own surface; releases move to a one-command job inside GCP.