fix(typing): scope mypy strict to the brokers, and check keel.* for real

[eaitbrahim]

What this is

An assessment of the codebase turned up no active bugs — the tree is healthy (2721 tests green, ruff clean). The one real gap was the mypy config itself, plus the 45 default-mode errors it was hiding on keel.*.

The config bug

strict = true is not a per-module setting. Written inside a [[tool.mypy.overrides]] block it enables strict globally, whatever module pattern the section carries. Verified directly — a section naming a module that does not exist produces the identical error count:

config	errors
broker block with strict = true	131
same block targeting nonexistent_module_xyz.*	131
block removed entirely	45

So pyproject.toml read as "brokers strict, everything else default" but did not do that. It was invisible because keel.*, keel_core.* and tests.* all carry ignore_errors, so strict had nothing left to shout at. Ungating keel.* is exactly the action that exposes it.

The bundle is now spelled out flag by flag, scoping it to the four broker packages for real. Broker strictness is preserved — confirmed by injecting an untyped def and a bare dict into a broker module and watching no-untyped-def / type-arg still fire.

keel.* is now checked, not yet strict — that stays the next tightening step, per the existing "one package at a time, never all at once" policy. keel_core.* and tests.* remain gated.

The 45 errors

Almost all annotation debt guarded by real invariants rather than live defects. Fixed at the root instead of silenced:

• sum() over Decimal with no start value picks the int overload and widens to Decimal | float (stats.py, levels.py).
• Trade.pnl/exit_ts are optional because an OPEN trade has none; the aggregates run only over closed trades. Stated via _closed_pnl and an explicit filter, so a violation names the offending trade instead of raising from inside a generator.
• TurtleBreakout tracked entry and stop as two independently-optional locals though they are set and cleared together — now one optional pair, making "stopped without an entry" unrepresentable rather than merely unreachable.
• _effective_mode returns exactly "confirm"/"autonomous" but was typed str, so both executor.execute call sites passed an unchecked value into a Literal parameter.
• product_id was already a de-facto part of the Rule interface (every concrete rule takes and stores it; sim reads it off the base type) — declared.
• rules seed built rules via RULE_REGISTRY[kind](...), reaching around build_rule_from_params, the documented (kind, params) -> Rule boundary.
• _decline's 8 errors are a documented idiom (one-line declines so the reason cannot drift from its branch). Idiom kept; annotation corrected.

Real findings

One genuine defect — _process_rule_signals declared held: dict[str, _Held] while every other declaration, its only caller, and its own body use (asset, rule_name) tuple keys.

Two silent TUI bugs — _human_dt(None) does not raise: time.localtime(None) means now, so a missing timestamp rendered as a lapse that happened this instant. Both guarded.

A guardrail this broke, and its repair

The config change silently gutted an existing test. test_strictly_typed_packages_ship_a_py_typed_marker discovers its packages by reading strict = true, so the expanded flag list collapsed four passing cases into one skipped [NOTSET] — the PEP 561 rule stopped being enforced without anything going red. It surfaced only from diffing collected tests against baseline, not from the summary line.

Discovery now keys off the flag block, plus two new guards:

• the strict-module list can never be empty;
• the expanded list must still equal what the installed mypy's --strict actually turns on, derived from mypy's own option parser rather than hard-coded — a copy of someone else's bundle drifts. Confirmed to fail correctly by deleting a flag.

Verification

• mypy — clean, 224 source files
• ruff check keel tests packages — clean
• keel --help — imports fine (the ci.yml smoke check)
• pytest — 2723 passed, 1 skipped; collection diffed against baseline is exactly +2, the two new tests

No runtime behaviour changes.

🤖 Generated with Claude Code