# Bytelyst Trading Platform - Holistic Engineering + Trading Audit

Date: 2026-02-15
Scope: `bytelyst-trading-bot-service` + `bytelyst-trading-dashboard-web`
Method: static code review, build/lint checks, lifecycle-path trace (orders -> positions -> history)

## Related Docs

- Product runtime flow and execution logic:
  - `docs/PRODUCT_FLOW_TRADING_LOGIC.md`

## Target Operating Model (Required)

- Auto trading must execute per profile based on profile strategy rules + profile risk config.
- Each profile must be handled identically under the same orchestration model.
- Trade monitor must enforce stop loss / take profit correctly for each open trade.
- Every trade lifecycle must be traceable by `trade_id` per profile across:
  - Active Orders
  - Open Positions
  - Trade History
- Dashboard must stay synchronized with backend runtime state and profile configuration.

## Current Validation Snapshot (2026-02-15)

- Bot build: `PASS` (`npm run build`)
- Dashboard typecheck: `PASS` (`npx tsc -b`)
- Dashboard lint: `PASS` (`npm run lint`)
- Dashboard production build: `FAIL` in this environment (`spawn EPERM` while loading `vite.config.ts`)
- Bot regression suite: `PASS` (`node --loader ts-node/esm scripts/testTradeExecutorLifecycle.ts`, `scripts/testLifecycleRegressions.ts`, `scripts/testOrderStatusSyncRegressions.ts`, `src/scripts/verifyWebsocketContract.ts`)

## Progress Snapshot (Recent)

- [x] Virtual profile position ledger recovery shipped (bot):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/8101a809aae97740fbc0cbc6e3041914c5062f41
- [x] Profile ownership and reconciliation hardening shipped (bot):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/ab19498104c2e4032b10f5539290346e331460a4
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/593b9c8cb825627bbe7f31035df13a4a32bff6e2
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/c9ef7111318c9aa4b304593823feb857ed24a8d7
- [x] Lifecycle trade-id and SL/TP fallback visibility improvements shipped (dashboard):
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/036aba8a9531b50537a160b9817e0da683613fdb
- [x] Bot-side SL/TP sync fallback + `trade_id` normalization shipped:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/141a086ed7733014202adef5966403174d9dee29
- [x] TP zero-guard activation fix shipped (bot):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/406a96ded86a81cf5f56231f8ed00437f923600e
- [x] Partial-exit lifecycle and OrderSync partial-fill handling shipped (bot):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/ca073302ab5906026e4b909895e788d6b80a1549
- [x] Profile-scoped same-symbol entry parity shipped (bot):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1199ea9abaad0bf46244edebf86c39e15fb9209a
- [x] Runtime risk limit enforcement shipped (maxDailyLossUsd + maxConsecutiveLosses):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/606cd3f63171db7e34a5d44c4b77b4c5be7da93c
- [x] Strategy param compatibility + entry-trigger params + AI confidence normalization shipped:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/4aafd9024ce96d868093ba4111a7647ce64a138c
- [x] Strategy config schema normalization shipped (bot read-path + dashboard write/read-path):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/4d20d3c98032b75489ee9ac9a7b499af25bbf37b
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/f75e1b278345eddc81a1f0af134f07db80f12d14
- [x] Deterministic trade-id policy shipped for bot-originated lifecycle IDs:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/453d7b4a984b774d8d26f85a1e242206304042f5
- [x] Legacy `trade_id` backfill tooling shipped (dry-run + apply modes):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/30a257d11fc3c4c67c3097b290b6756ff3162ff8
- [x] Lifecycle reconciliation report tooling shipped (`orders -> positions -> history` per profile):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/e8a461d4a5e060d0ca62653ed09b90a07ffe4965
- [x] Profile-specific symbol signal/rule aggregation shipped (bot + dashboard):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/af5a277b1cc8a665887a91ffce0326fbae9efe0e
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/23639d6d5a04c907c6e82a6bd32dc4757a48e330
- [x] Dashboard lifecycle trace ledger + mismatch diagnostics shipped:
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/db01abac8b6fd873cdcc3e6c815128a6914260bd
- [x] DB lifecycle integrity constraints + rollout plan shipped:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/fc42bc7ff22071e4e34353c3a9cafbb18b09908e
- [x] Websocket bot-state contract verifier shipped (payload shape + lifecycle consistency checks):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/76abca0477fa9f894a726b173e2575d4f8babc5b
- [x] Lifecycle regression suite shipped (zero-TP guard, partial-exit reduction, stale reconciliation, order-sync stale paths):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1322494f3833f98e34c8dbe8687b214d84e83d38
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/d094e8aa155cc103c684ad5883c74092fc17c3c1
- [x] CI smoke gate for dashboard production build shipped:
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/328c32eaabe48632fcaf22c7d9dc69872b83eaae
- [x] JWT issuer/audience claim hardening shipped (env-driven validation on access-token verify path):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1322494f3833f98e34c8dbe8687b214d84e83d38
- [x] Exchange/API flap failure-injection regression shipped (bot):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/9872251399722bb3a80032364e0afa17738e993a
- [x] Auth threat model + executable RLS policy verification shipped:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/86ab06b25f4429eb9c89e738f98cb45b2c865f09
- [x] Dashboard lint debt cleanup + enforced lint gate shipped:
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/139b01c8191d43c24a825ab94475571726cb81fc
- [x] Secret hygiene CI gate + rotation/history-purge runbooks shipped:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/eabc7821332db9b98a7c35f92d8c82aeea10e9a3
- [x] AI resilience shipped: fail-open AI rule + deterministic local chat fallback + AI health endpoint:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/209a731278b5fe59de90138fe51c2fa5d94f4fb3
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/072badbacf92ba149bf9fdd524f48ff8717549c6

## Critical Findings (P0)

1. Take-profit guard can activate incorrectly when `takeProfit` is `0`
- Risk: unintended trailing-guard activation and premature exits.
- Evidence:
  - `bytelyst-trading-bot-service/src/services/tradeMonitor.ts:117`
  - `bytelyst-trading-bot-service/src/services/tradeMonitor.ts:118`

2. Partial exit fills are treated as full lifecycle completion
- Risk: bot marks trade closed while residual exchange position remains open.
- Evidence:
  - `bytelyst-trading-bot-service/src/services/TradeExecutor.ts:414`
  - `bytelyst-trading-bot-service/src/services/TradeExecutor.ts:442`
  - `bytelyst-trading-bot-service/src/services/TradeExecutor.ts:461`
  - `bytelyst-trading-bot-service/src/index.ts:69`
  - `bytelyst-trading-bot-service/src/index.ts:76`

3. Per-profile identity model is still constrained by account-level symbol lock in auto-entry
- Risk: profiles on shared account are not handled identically; second profile is blocked if net position exists for symbol.
- Evidence:
  - `bytelyst-trading-bot-service/src/services/AutoTrader.ts:110`
  - `bytelyst-trading-bot-service/src/services/AutoTrader.ts:112`

## High Findings (P1)

1. Profile rule parameter contract mismatch for session config
- Risk: some saved profile configs do not apply as intended.
- Evidence:
  - `bytelyst-trading-bot-service/src/strategies/rules/SessionRule.ts:18` expects `params.sessions`
  - default profile schemas/examples commonly use `allowedSessions`

2. Entry trigger rule ignores profile parameters
- Risk: strategy config UI implies control that runtime does not execute.
- Evidence:
  - `bytelyst-trading-bot-service/src/strategies/rules/EntryTriggerRule.ts:11`

3. AI confidence threshold scale mismatch (0-1 vs 0-100)
- Risk: AI rule can pass too easily for some profile configs.
- Evidence:
  - `bytelyst-trading-dashboard-web/src/components/TradeProfileManager.tsx:62` (`minConfidence: 0.7`)
  - `bytelyst-trading-bot-service/src/strategies/rules/AIAnalysisRule.ts:54` (compares against 0-100 confidence)

4. AI prompt hardcodes BTC/USD in generic rule
- Risk: reduced quality for non-BTC symbols.
- Evidence:
  - `bytelyst-trading-bot-service/src/strategies/rules/AIAnalysisRule.ts:83`

5. Risk limits from profile config are only partially enforced
- Risk: `maxDailyLossUsd` and `maxConsecutiveLosses` are configured but not enforced in execution path.
- Evidence:
  - configured in UI/schema but no enforcement path in `AutoTrader` / runtime guards except max open trades.
  - `bytelyst-trading-bot-service/src/services/AutoTrader.ts:94`

6. Mixed-side virtual ledger collapses to dominant side
- Risk: hidden state inconsistency when both sides exist due data anomalies.
- Evidence:
  - `bytelyst-trading-bot-service/src/services/SupabaseService.ts:610`

7. Symbol-level dashboard signal shows first profile result only
- Risk: dashboard can misrepresent profile-specific strategy states.
- Evidence:
  - `bytelyst-trading-bot-service/src/index.ts:382`
  - `bytelyst-trading-bot-service/src/index.ts:400`
  - `bytelyst-trading-bot-service/src/index.ts:444`

## Medium Findings (P2)

1. Dashboard quality gate still failing (43 lint errors, 5 warnings)
- Risk: reduced maintainability and higher regression probability.

2. Bot package test command still not wired
- Risk: script-based regression suite exists, but `npm test` is still not standardized.
- Evidence:
  - `bytelyst-trading-bot-service/package.json` (`"test": "echo \"Error: no test specified\" && exit 1"`)

3. Vite build environment instability (`spawn EPERM`)
- Risk: release pipeline confidence gap for frontend bundle.

4. Remaining type hygiene issues (`any`, `@ts-ignore`)
- Risk: unsafe refactors and runtime regressions.
- Evidence:
  - `bytelyst-trading-dashboard-web/src/tabs/EntriesTab.tsx:82`

## Security and Compliance Residuals

- [ ] Rotate credentials and enforce secret hygiene policy.
  - Secret hygiene enforcement + rotation runbook shipped:
    - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/eabc7821332db9b98a7c35f92d8c82aeea10e9a3
- [ ] Purge secret-bearing history before production release.
  - Purge runbook shipped:
    - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/eabc7821332db9b98a7c35f92d8c82aeea10e9a3
- [x] Add explicit RLS policy test suite for core tables.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/86ab06b25f4429eb9c89e738f98cb45b2c865f09

## Phased Remediation Roadmap

### Phase 0 - Lifecycle Safety Hotfixes (Immediate)

- [x] Guard TP logic with explicit positive threshold check before target evaluation.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/406a96ded86a81cf5f56231f8ed00437f923600e
- [x] Treat `partially_filled` exits as partial reduction, not full trade finalization.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/ca073302ab5906026e4b909895e788d6b80a1549
- [x] Update order-sync callback to avoid full finalize on partial exits.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/ca073302ab5906026e4b909895e788d6b80a1549
- [x] Add regression tests for: zero-TP position, partial exit fill, stale reconciliation.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1322494f3833f98e34c8dbe8687b214d84e83d38
- [x] Normalize trade-id payload propagation (`trade_id` / `tradeId`) across bot/dashboard.

### Phase 1 - Per-Profile Strategy and Risk Parity

- [x] Replace account-level symbol pre-check with profile-aware exposure policy (virtual sub-positioning model).
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1199ea9abaad0bf46244edebf86c39e15fb9209a
- [x] Enforce `maxDailyLossUsd` and `maxConsecutiveLosses` in runtime guard path.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/606cd3f63171db7e34a5d44c4b77b4c5be7da93c
- [x] Unify and validate rule param schema (`sessions` vs `allowedSessions`, confidence units).
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/4aafd9024ce96d868093ba4111a7647ce64a138c
- [x] Implement profile parameter support in `EntryTriggerRule`.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/4aafd9024ce96d868093ba4111a7647ce64a138c
- [x] Add strict schema validation for `strategy_config` at write/read time.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/4d20d3c98032b75489ee9ac9a7b499af25bbf37b
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/f75e1b278345eddc81a1f0af134f07db80f12d14
- [x] Add profile-level execution direction control (`entryMode`: `both` | `long_only`) and enforce long-only entry guard.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/7bcfe97285910d7c759993704d5ebcdec872a0ad
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/0832ffcced1905343371dc301c7f1f81c808f666

### Phase 2 - Trade Lifecycle Determinism

- [x] Require deterministic `trade_id` generation for all bot-originated orders.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/453d7b4a984b774d8d26f85a1e242206304042f5
- [x] Add DB constraint strategy and migration plan for lifecycle integrity (`profile_id + trade_id` indexing, null handling policy).
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/fc42bc7ff22071e4e34353c3a9cafbb18b09908e
- [x] Add deterministic backfill tool for legacy rows missing `trade_id`.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/30a257d11fc3c4c67c3097b290b6756ff3162ff8
- [x] Add lifecycle reconciliation report (`orders -> positions -> history`) per profile.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/e8a461d4a5e060d0ca62653ed09b90a07ffe4965

### Phase 3 - Dashboard/Backend Synchronization

- [x] Render profile-specific signal/rule state (remove first-profile shortcut for shared symbols).
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/af5a277b1cc8a665887a91ffce0326fbae9efe0e
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/23639d6d5a04c907c6e82a6bd32dc4757a48e330
- [x] Add lifecycle trace view grouping by `trade_id` with explicit ENTRY/EXIT chain.
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/db01abac8b6fd873cdcc3e6c815128a6914260bd
- [x] Show mismatch diagnostics when position exists without matching entry order.
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/db01abac8b6fd873cdcc3e6c815128a6914260bd
- [x] Add websocket contract tests for payload shape and lifecycle consistency.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/76abca0477fa9f894a726b173e2575d4f8babc5b

### Phase 4 - Quality Gates and Reliability

- [x] Burn down dashboard lint debt to zero and enforce in CI.
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/139b01c8191d43c24a825ab94475571726cb81fc
- [x] Add bot unit/integration tests (TradeExecutor, TradeMonitor, OrderStatusSyncService, profile fan-out).
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1322494f3833f98e34c8dbe8687b214d84e83d38
- [x] Add smoke tests for dashboard runtime build in CI environment matching deployment.
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/328c32eaabe48632fcaf22c7d9dc69872b83eaae
- [x] Add failure-injection tests for exchange/API flaps and stale orders.
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/9872251399722bb3a80032364e0afa17738e993a
- [x] Add AI degradation controls and observability (`AI_FAIL_OPEN`, `/api/ai/health`, chat local fallback).
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/209a731278b5fe59de90138fe51c2fa5d94f4fb3
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/072badbacf92ba149bf9fdd524f48ff8717549c6

### Phase 5 - Security Hardening

- [ ] Complete key rotation and remove plaintext secrets from tracked artifacts.
- [ ] Execute repo history purge plan before production cut.
- [x] Harden JWT validation policy (issuer/audience checks) and formalize auth threat model.
  - Issuer/audience validation shipped:
    - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1322494f3833f98e34c8dbe8687b214d84e83d38
  - Threat model shipped:
    - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/86ab06b25f4429eb9c89e738f98cb45b2c865f09

## Prioritized Task List (Execution Order)

### Trading Correctness First
- [x] P0.1 TP zero-guard bug fix + tests
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/406a96ded86a81cf5f56231f8ed00437f923600e
- [x] P0.2 Partial-fill lifecycle correctness fix + tests
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/ca073302ab5906026e4b909895e788d6b80a1549
- [x] P0.3 OrderSync partial-fill handling fix
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/ca073302ab5906026e4b909895e788d6b80a1549

### Profile Parity
- [x] P1.1 Remove account-level symbol lock behavior for profile-isolated strategy flow
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1199ea9abaad0bf46244edebf86c39e15fb9209a
- [x] P1.2 Enforce profile riskLimits (`maxDailyLossUsd`, `maxConsecutiveLosses`)
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/606cd3f63171db7e34a5d44c4b77b4c5be7da93c
- [x] P1.3 Normalize strategy param contract and validation
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/4aafd9024ce96d868093ba4111a7647ce64a138c
- [x] P1.4 Add profile-level long-only entry mode (`strategy_config.execution.entryMode`)
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/7bcfe97285910d7c759993704d5ebcdec872a0ad
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/0832ffcced1905343371dc301c7f1f81c808f666

### Lifecycle Traceability
- [x] P2.1 Deterministic trade-id policy for all order states
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/453d7b4a984b774d8d26f85a1e242206304042f5
- [x] P2.2 Legacy backfill and reconciliation tooling
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/30a257d11fc3c4c67c3097b290b6756ff3162ff8
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/e8a461d4a5e060d0ca62653ed09b90a07ffe4965
- [x] P2.3 Dashboard lifecycle ledger by `trade_id`
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/db01abac8b6fd873cdcc3e6c815128a6914260bd

### Platform Quality
- [x] P3.1 Dashboard lint/type debt to zero
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/139b01c8191d43c24a825ab94475571726cb81fc
- [x] P3.2 Bot automated test suite bootstrap
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1322494f3833f98e34c8dbe8687b214d84e83d38
- [x] P3.3 CI release gates (bot + dashboard)
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/1322494f3833f98e34c8dbe8687b214d84e83d38
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/328c32eaabe48632fcaf22c7d9dc69872b83eaae

## Definition of Done (Release Gate)

- [x] Every profile executes strategy/risk deterministically under the same runtime model.
- [x] SL/TP monitoring behaves correctly for BUY/SELL and zero-risk-field edge cases.
- [x] Partial fills (entry and exit) are represented accurately in orders, positions, and history.
- [x] Every active order, open position, and history row is traceable via a deterministic `trade_id`.
- [x] Dashboard state is consistent with backend reconciliation without profile leakage.
- [ ] Build/type/lint/test gates pass in CI.
- [ ] Security residuals (secrets/RLS/auth hardening) are closed for production release.

## Appended Questions (Non-Blocking)

- [x] Should multi-profile on the same broker account support simultaneous same-symbol exposure (virtual sub-positions), or enforce one-symbol-per-account policy?  
  Decision: Implemented virtual sub-positions simultaneous same-symbol exposure.
- [x] For partial exit fills, do you want immediate quantity reduction with continued monitoring, or full close retry loop before state mutation?  
  Decision: Implemented immediate quantity reduction with continued monitoring.
- [x] Do you want strict rejection of profile configs that use legacy param keys (`allowedSessions`, confidence in 0-1), or auto-migration on read?  
  Decision: Implemented auto-migration/compatibility on runtime read path.

## Incremental Fix Log (2026-02-15)

- [x] Overview win-rate window controls shipped (24H/7D/30D/All) with profile-scoped and global win-rate metrics in selected time range.
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/b73b3a84ee4bb8f07fcf4ef5534da5d8e794eb2a

- [x] Overview UX refinement shipped: removed `P&L Capital Used` from status bar to avoid user confusion; kept `P&L Duration` for contextual clarity.
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/d6134a85ccdfb451f4ed2f70b4a4f6b6373bba76

- [x] Overview P&L context extension shipped (P&L duration window + P&L capital used with realized/open breakdown next to Net P&L):
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/68d8330ab3be19af074f39880232e1df9e35910a

- [x] Unified P&L ledger parity shipped across Overview, Audit Logs, and Strategy Clusters (single deduped history aggregation path + realized-vs-net labeling clarity):
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/b547a810d877ebf44ceccbd688233ae8ad48633e

- [x] Overview/History P&L parity fix shipped (Overview now uses the same merged + exact-event deduped lifecycle ledger as Audit Logs for realized and per-profile net P&L):
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/e91022c22125aedbc1446ea83132b4effa7e87ae
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/de90c7d1e90d89386097adba7e1241363e8bd4cf


- [x] Audit Logs (History tab) integrity fix shipped (exact-event dedupe key prevents partial-exit row collapse by shared trade_id; safer timestamp and side normalization):
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/2ec91a5dda2770702345da646a70398ac99775fd
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/4e74f95d49e5a448430ff01ab19d13f36edd08f5
- [x] Pending EXIT ghost-order lifecycle fix shipped (serialized order-write path + stale `pending_new` EXIT auto-resolution when lifecycle is already closed):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/9ec1e70911ef28f00b5ed5d8d5dbe50200a67cc6
- [x] Lifecycle trace dashboard hardening shipped (profile+trade scoped grouping, deterministic ENTRY/EXIT inference, stale-status merge guards, trace-level entry capital used, explicit state reasons):
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/911f7d1267fdadb6e4a1b769d199fa8b03ae763b
- [x] Order sync not-found exception reconciliation shipped (stale pending_new orders with closed trade_id lifecycle are auto-resolved to canceled, including legacy rows without action):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/20adbf8911faaf2d847bf368bfc1b9e5d5ad668f

- [x] Dashboard capital/overview accuracy update shipped (numeric-safe realized/net P&L aggregation, per-profile win rate + net P&L in Capital Scope, runtime profile state labeling):
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/b58e8760d114dec944518e494a89f601183ec7fa
- [x] Overview runtime-state UX clarity shipped for zero-utilization running profiles (monitoring vs signal-active-waiting-entry vs cooldown vs in-position):
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/cb5cbda09f112828565762fa4d11b6ce95cd185f

- [x] Bot trade_history source-column fallback hardening shipped (legacy-schema safe insert path):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/ed511008f1fc2c5833cdfe7924f35f605a4874cd

- [x] Manual entry capital guard shipped (scale-to-remaining capital with wait-for-release behavior):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/d934e3b88dbec5b417c04789cd37df88a1016353

- [x] Dashboard capital panel baseline shipped (allocated/used/remaining profile breakdown):
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/4a8476846553fc3b5dadc186d037dda7c11bb604

- [x] Dashboard history lifecycle cleanup, capital-used, and loss-highlighting shipped:
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/fa0898e18cb71afba0347c63ead8b3e93e0254bb
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/334a0ba3c056bdf1a9b34733b493747d67c74839
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/a773bfab1eb33071a8e4ab2e1c0f2eaa8ece65bb




- [x] Trade lifecycle parity hardening shipped (legacy `action=null` ENTRY fallback + canonical history reconciliation tool + targeted live chain cleanup):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/d56d6ea91534cd788fe837d1b56ea2f42b7cd7d1
- [x] Reconciliation report signal cleanup shipped (formula mismatch diagnostics now ignore quarantined lifecycle rows already neutralized for audit safety):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/d03a0e07b2e2c2f72235e0fd61b0c6c38e413960
- [x] Alpaca reconciliation carry-in baseline shipped (paged Alpaca fetch, pre-window position bootstrap, flat-vs-carry dual metrics, auto primary-mode fallback when Supabase pre-window coverage is insufficient):
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/ae8bd1b0549faa663e06cb35f063a6dbfa0335e9

## Incremental Fix Log (2026-02-16)

- [x] Profile-symbol scoped runtime sync hardening shipped (bootstrap sync, profile hot-reload resync, reconcile loop symbol scope, dynamic monitored-symbol loop wiring):
  - `bytelyst-trading-bot-service/src/index.ts`
- [x] Legacy virtual-position reconstruction hardened for rows missing both `action` and `trade_id` (deterministic ENTRY/EXIT inference + synthetic trade-id handling):
  - `bytelyst-trading-bot-service/src/services/SupabaseService.ts`
- [x] Dedicated-profile symbol mismatch recovery hardened (`USD`/`USDT` candidate lookup for virtual-position sync):
  - `bytelyst-trading-bot-service/src/services/TradeExecutor.ts`
- [x] Stale `pending_new` EXIT cleanup hardened for legacy rows without `trade_id` (profile+symbol virtual lifecycle flat check -> auto-cancel):
  - `bytelyst-trading-bot-service/src/services/OrderStatusSyncService.ts`
  - `bytelyst-trading-bot-service/scripts/testOrderStatusSyncRegressions.ts`
- [x] Startup pending-order recovery hardened to auto-resolve closed EXIT-like stale rows before dashboard broadcast:
  - `bytelyst-trading-bot-service/src/services/TradeExecutor.ts`
- [x] Position merge architecture hardened to preserve stable per-trade lifecycle visibility (owner+profile+trade keyed merge instead of collapsing all same-symbol positions):
  - `bytelyst-trading-bot-service/src/services/apiServer.ts`
- [x] Profile symbol parsing hardened for array/string compatibility in entry gating:
  - `bytelyst-trading-bot-service/src/services/AutoTrader.ts`

## Coverage Status (2026-02-16)

- Bot service (`npm run coverage:full`):
  - Statements: `24.65%` (`1875/7606`)
  - Branches: `41.20%` (`178/432`)
  - Functions: `35.66%` (`56/157`)
  - Lines: `24.65%` (`1875/7606`)
- Dashboard (`npm run coverage:full`):
  - Statements: `5.65%` (`106/1874`)
  - Branches: `6.09%` (`128/2101`)
  - Functions: `3.35%` (`16/477`)
  - Lines: `5.48%` (`93/1697`)

## Open Enterprise Gaps (Pending)

- [ ] True same-profile same-symbol concurrent trade support is still structurally limited by `TradeExecutor` in-memory `Map<symbol, PositionState>`.
  - Impact: multiple active lifecycles on one symbol inside one profile cannot be represented independently in runtime state.
- [ ] Coverage is still far from 100% in both repos; current suites are regression-focused, not exhaustive component/service coverage.
- [ ] Live Alpaca-vs-Supabase reconciliation is still script-driven, not continuously enforced as a scheduled runtime guard.
- [ ] Legacy data quality can still introduce ambiguous lifecycle chains until historical rows are fully backfilled (`trade_id`, `action`) and constrained at DB level.

### 2026-02-16 Commit References

- [x] Lifecycle/profile sync hardening implementation batch:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/78be9e63f4e3e2a0c550e467c4cb4f66c7c2b2df
- [x] Roadmap + product-flow documentation update:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/bb739a0cad9c06ae591ccd95b7f2135f23261170

## Gap Closure Update (2026-02-16, Cycle 2)

- [x] Same-profile same-symbol concurrent lifecycle support implemented in runtime state model.
  - TradeExecutor now stores active positions by trade identity (symbol + trade_id) instead of one-position-per-symbol collapse.
  - AutoTrader can manage/exit multiple active lifecycles per symbol and supports controlled pyramiding (`strategy_config.execution.allowPyramiding`, default enabled).
  - TradeMonitor now enforces SL/TP/trailing and exchange-missing finalization per trade lifecycle (trade_id aware).

- [x] Runtime parity guard implemented (continuous scheduled check, not script-only).
  - Reconciliation loop now compares recent profile orders against exchange order statuses and auto-corrects safe terminal mismatches.
  - Runtime health now tracks `parityMismatchCount`.

- [x] Legacy lifecycle recovery further hardened for per-trade reconstruction.
  - Added profile/symbol/trade_id scoped virtual open-position reconstruction (`getVirtualOpenPositionForTrade`).
  - Dedicated profile sync now reconstructs multiple open slices per symbol when multiple trade_ids remain open.

- [x] Manual square-off updated to close all active sub-positions for a symbol (trade_id aware), not just one selected row.

- [ ] Coverage remains below enterprise target.
  - Bot (`npm run coverage:full`): Statements `24.60%`, Branches `41.72%`, Functions `36.09%`, Lines `24.60%`.
  - Dashboard (`npm run coverage:full`): Statements `5.65%`, Branches `6.09%`, Functions `3.35%`, Lines `5.48%`.

### Residual Open Gap

- [ ] Expand automated tests toward enterprise target coverage (module-level + integration-level) across both repos.

### Cycle 2 Commit Link

- [x] Multi-lifecycle runtime + parity guard implementation:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/abb6dd5e1fa1b3f12104c9205d2a9efcd7d668cb

## Gap Closure Update (2026-02-16, Cycle 3)

- [x] Fixed dedicated-profile sync gap that could drop valid local lifecycle positions when exchange remained open but virtual reconstruction was temporarily empty.
  - TradeExecutor.syncPositions now retains existing local symbol lifecycles when exchange position exists and virtual lookup returns empty.
  - Local symbol state is only cleared when exchange is flat and no virtual lifecycle remains.

- [x] Improved dashboard state freshness for lifecycle transitions.
  - TradeExecutor.openPosition now pushes updated active positions immediately after confirmed entry fill.
  - TradeExecutor.finalizeTrade now pushes updated active positions immediately after local lifecycle removal.

- [x] Added regression coverage for the above lifecycle-sync protections.
  - Extended scripts/testTradeExecutorLifecycle.ts to assert:
    - immediate position snapshot propagation after filled entry
    - local lifecycle retention on exchange-open plus virtual-empty sync window

### Residual Open Gap

- [ ] Coverage remains below enterprise target across full repository scope.

### Cycle 3 Commit Link

- [x] Lifecycle retention plus immediate position push plus regression tests:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/9c53222939b73fba4ab95f83c7df5d57f9b46683
## Gap Closure Update (2026-02-16, Cycle 4)

- [x] Hardened order persistence to be idempotent on order_id so duplicate lifecycle rows are not inserted on retries.
  - Existing order rows are merged/updated, and terminal statuses are not downgraded by late pending writes.

- [x] Hardened stale-order detection and reconciliation cadence to reduce stale pending_new artifacts.
  - Added configurable runtime controls: ORDER_SYNC_INTERVAL_MS, STALE_ORDER_THRESHOLD_MINUTES.
  - Expanded stale-pending scope to include pending_new, pending, accepted, and new.

- [x] Added regression guardrail for order persistence and stale status scope.
  - New suite: scripts/testSupabaseOrderPersistenceRegressions.ts.
  - Included in regression/coverage execution paths.

- [x] Dashboard lifecycle table hardening shipped.
  - Bot positions are deduped by profile_id plus trade_id before rendering.
  - Pending EXIT rows are normalized to closed when lifecycle is already closed in history for the same trade_id scope.

- [x] Coverage progress (full-scope baseline run on 2026-02-16).
  - Bot (npm run coverage:full): Statements 28.29%, Branches 40.59%, Functions 41.04%, Lines 28.29%.
  - Dashboard (npm run coverage:full): Statements 5.58%, Branches 5.98%, Functions 3.34%, Lines 5.40%.

### Residual Open Gap

- [ ] Full enterprise target coverage is still pending; broad module/component test expansion is still required across both repos.

### Cycle 4 Commit Links

- [x] Bot lifecycle dedupe plus stale sync cadence plus persistence regression:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/0d3409a48ac60dfb76e84c75be3f4b12c2f98a18
- [x] Dashboard lifecycle table stabilization:
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/e9422a3e330161bde0f32c9275f8f7dea30cdee5
## Gap Closure Update (2026-02-16, Cycle 5)

- [x] Expanded dashboard enterprise coverage across tabs/components/hooks with deterministic runtime-safe tests.
  - Added coverage suites for:
    - `App`
    - `OverviewTab`, `PositionsTab`, `SignalsTab`, `EntriesTab`, `SettingsTab`, `AdminTab`, `HistoryTab`, `ConfigTab`
    - `AuthContext`, `TradeProfileManager` config normalization, `PriceChart`, `AlertFeed`, `MarketTicker`, market-opportunity widgets, `EntryForm`, `SymbolCard`
    - `useWebSocket`, `supabaseClient`, `const` module
- [x] Added deterministic lifecycle-branch assertions in dashboard tab coverage:
  - Lifecycle states: `OPEN`, `PARTIAL_EXIT`, `CLOSED`, `ORPHAN_EXIT`, `EXIT_PENDING`
  - Stale pending-order banner behavior and mismatch diagnostics rendering
- [x] Kept strategy-config normalization logic testable by exporting `normalizeStrategyConfig` and validating legacy compatibility paths.
- [x] Re-ran quality gates for both repos after coverage expansion:
  - Dashboard: `npm run check` -> PASS
  - Dashboard: `npm run coverage:full` -> PASS
  - Bot: `npm run check` -> PASS
  - Bot: `npm run coverage:full` -> PASS

## Coverage Status (2026-02-16, Post Cycle 5)

- Bot service (`npm run coverage:full`):
  - Statements: `28.19%` (`2278/8080`)
  - Branches: `40.73%` (`233/572`)
  - Functions: `40.46%` (`70/173`)
  - Lines: `28.19%` (`2278/8080`)
- Dashboard (`npm run coverage:full`):
  - Statements: `42.46%` (`806/1898`)
  - Branches: `34.71%` (`743/2140`)
  - Functions: `33.26%` (`159/478`)
  - Lines: `44.25%` (`762/1722`)

### Residual Open Gap

- [ ] Enterprise coverage target is not yet complete for both repos; remaining work is deeper branch-path and service-level integration coverage expansion.
- [ ] Existing workspace still contains unrelated pending file changes; only targeted coverage/test files were committed in this cycle.

### Cycle 5 Commit Links

- [x] Dashboard coverage expansion suite:
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/3be473d882018d1cd88f7473dbbc24ee5f0be662

## Coverage Status (2026-02-16, Latest Refresh)

- [x] Re-ran broad coverage snapshots (`npm run coverage:full`) for both repos and updated the dedicated report:
  - `docs/COVERAGE_BEFORE_AFTER_2026-02-16.md`
- [x] Re-ran enforced 80% gate coverage (`npm run coverage`) for both repos.

### Broad Coverage (Latest)

- Bot service (`npm run coverage:full`):
  - Statements: `55.68%` (`4499/8080`)
  - Branches: `55.76%` (`629/1128`)
  - Functions: `64.51%` (`160/248`)
  - Lines: `55.68%` (`4499/8080`)
- Dashboard (`npm run coverage:full`):
  - Statements: `90.53%` (`1760/1944`)
  - Branches: `75.61%` (`1619/2141`)
  - Functions: `88.24%` (`443/502`)
  - Lines: `92.11%` (`1624/1763`)

### Gate Coverage (Latest)

- Bot service (`npm run coverage`):
  - Statements: `97.87%` (`92/94`)
  - Branches: `93.02%` (`40/43`)
  - Functions: `92.30%` (`12/13`)
  - Lines: `97.87%` (`92/94`)
- Dashboard (`npm run coverage`):
  - Statements: `99.06%` (`106/107`)
  - Branches: `94.16%` (`129/137`)
  - Functions: `100%` (`16/16`)
  - Lines: `98.93%` (`93/94`)

### Focus Coverage

- Dashboard `PositionsTab` (`src/tabs/PositionsTab.tsx`):
  - Statements: `98.61%` (`498/505`)
  - Branches: `78.86%` (`500/634`)
  - Functions: `100%` (`112/112`)
  - Lines: `100%` (`459/459`)
## Gap Closure Update (2026-02-16, Cycle 6)

- [x] Fixed runtime duplicate position/order artifacts by introducing canonical snapshot merge logic in backend state updates.
  - Positions are merged by stable `trade_id` first; fallback merges are owner+symbol+side scoped.
  - Orders are merged by `order_id` with terminal-status precedence to prevent stale status downgrade.
- [x] Fixed lifecycle linkage and aggregate math drift in dashboard history/overview.
  - Trade-history aggregation now runs by lifecycle (`profile_id + trade_id`) instead of raw row count.
  - Duplicate lifecycle events with reason formatting differences are normalized and collapsed.
  - Win rate and realized P&L now reflect lifecycle outcomes, not duplicated sync rows.
- [x] Fixed profile/trade distinction drift in open positions view.
  - Runtime position dedupe now prefers `trade_id` keyed identity and preserves richer profile metadata.
  - Overview capital utilization and unrealized P&L now compute from deduped runtime positions.
- [x] Added/updated regression coverage for merge and lifecycle aggregation paths.
- [x] Re-ran quality gates and coverage baselines across both repos after fixes.

### Coverage Status (Cycle 6 Snapshot)

- Full scope (`npm run coverage:full`):
  - Bot service: Statements `57.05%` (`4738/8304`), Branches `55.24%` (`685/1240`), Functions `66.53%` (`175/263`), Lines `57.05%` (`4738/8304`)
  - Dashboard: Statements `90.72%` (`1809/1994`), Branches `75.40%` (`1662/2204`), Functions `88.38%` (`449/508`), Lines `92.37%` (`1673/1811`)
- Gate scope (`npm run coverage`):
  - Bot service: Statements `97.87%`, Branches `93.02%`, Functions `92.30%`, Lines `97.87%`
  - Dashboard: Statements `97.70%`, Branches `88.75%`, Functions `94.44%`, Lines `100%`

### Root Cause (Closed)

- Primary architecture gap was non-canonical merge and aggregation.
  - Runtime sources were merged without lifecycle-first identity guarantees.
  - Dashboard aggregate paths mixed row-level and lifecycle-level counting.
- Primary coding bug was metadata-poor row overwrite during dedupe, which dropped profile context and inflated/fragmented position and P&L views.

### Remaining Enterprise Gaps

- [ ] 100% full-repo coverage target is not yet reached; current full-scope coverage is materially improved but not complete.
- [ ] Add continuous reconciliation alerting for lifecycle chain anomalies (`orphan_exit`, `unclassified`) at API and UI health surfaces.

### Cycle 6 Commit Links

- [x] Bot runtime merge hardening + regression suite:
  - https://github.com/saravanakumardb/bytelyst-trading-bot-service/commit/af772b265a348f2c47440c5f41c74144156b54f4
- [x] Dashboard lifecycle aggregation + runtime dedupe hardening:
  - https://github.com/saravanakumardb/bytelyst-trading-dashboard-web/commit/ad9afd7537f8ae8bf805d7a10a6cb4ffad5e9abf