[Richard-LZ-Zhang]

Summary

A routed bucket parent previously inherited the first enabled member's venue/account even when its children executed elsewhere. Parents now belong to the existing user, have null execution venue/account and save the exact eligible execution_accounts map; children retain concrete venue/accounts.

Authorization, conservative full-quantity admission and execution use one captured bucket/account scope. Parent snapshot, indexed membership, readable projection and related events commit atomically. Parent reads/actions/reports, HTTP audit history and live/replayed events enforce saved-scope permissions. Recovery and cleanup refuse changed configured or adapter accounts before venue I/O; ambiguous legacy retries cannot duplicate execution.

Logical schema 11 / Alembic 0006_routed_execution_scope preserves IDs and fills, rekeys parent projections and refuses missing/conflicting historical account evidence unless a reviewed explicit mapping supplies missing identities. Order-list cursor format is v2 and old cursors are rejected. Existing lifecycle status semantics remain unchanged.

Targets only codex/order-lifecycle-storage. No public-main merge, release, production pin change or actual trades.

Test Coverage and Verification

• Full offline native suite: 3,506 passed, 3 skipped, 141 live/demo deselected.
• Full offline pure-Python suite: 3,009 passed, 488 skipped, 141 live/demo deselected.
• PostgreSQL 18 and SQLite transaction/migration tests run against actual disposable databases.
• Fifteen added regression cases cover post-write rollback/task cancellation, migrated Engine restore/cancel, WebSocket partial/full-account replay/live delivery, filtered pagination, old cursor rejection and index eligibility. Twenty-four page/filter checks require one SELECT per page across sizes 1/3/20.
• Rust formatting/Clippy and 26 core tests pass. CI tests Python 3.10/3.12/3.13 and PostgreSQL.
• Installed consumer closes a simulated order on the cheaper non-first venue and retries without duplication. Current terminal backend 192 tests and frontend 36 tests pass; contracts/build pass. Companion fixes nullable identity, captured account membership and event refresh; screenshots cover current normal/reversed/flipped previews and venue-filtered parents.

Full suites ran at 7bfb56f; subsequent bounded-query assertions and the locale-portable pagination check pass at final 148ea2e, including the full Python 3.10/3.12/3.13 and PostgreSQL CI matrix.

Final-commit CI checks

Pre-Landing Review

Independent security/storage reviews cleared their findings after fixes. Completion audit's four coverage gaps are closed; no material implementation gaps remain. The external review CLI could not initialize, so fresh-context agent reviews supplied the independent review. No frontend changes; no design review or model evals required.

Plan Completion

Approved T1–T3 and D6/D7 audit-route/recovery safeguards are implemented and verified offline. Merged into the designated experimental branch at 708415477a0d999db09bb742fd539d062456d7db. Normal workspace setup and installed-consumer verification pass against that clean merged branch tip; workspace CI gates its companion landing.

Documentation

Engine/lifecycle and migration guides document the new contract, historical-account mapping, backup/restore and downgrade limits. Broader uncertain-send/resynchronization limitations remain explicit.

Companion workspace PR #114 includes the verification report, actual inputs/outputs and screenshots. The workspace repository requires access.

Related: https://linear.app/synpath/issue/PRE-6/remove-arbitrary-nominal-venue-from-cross-venue-smart-order-parents