fix(ledger): carry the owning rules.id on a position so exits are attributed (#803)

[eaitbrahim]

Closes #803.

The bug

SELL   PAXG-USD   rejected   unattributed   0.01320427

OrderIntent carries two different facts in two fields (guards.py:194-200): rule_kind, a
KIND ("dca", "turtle_breakout"), and rule_id, the rules.id row. Entries thread the id
from signal.rule_id. Both exit paths build their intent from a POSITION, not a signal — and
positions stored only the kind, so there was no id to thread and every protective SELL was
written with orders.rule_id NULL.

Not cosmetic: per-rule accounting reading orders.rule_id sees entries attributed and exits
anonymous, which for a trend rule drops precisely the leg the outcome lands on.

Not caused by the demotion, which is the natural first guess — rule 3 went live -> paper
shortly before this order, which looks exactly like a lookup that stopped resolving. The id was
never on the intent; the row would read unattributed with the rule live. The migration
docstring records that, so the next reader doesn't re-derive it.

The change

• v21: positions.rule_id INTEGER, nullable.
• _open_tranche inherits it from the ENTRY order rather than taking a new argument. That
  order was already written with signal.rule_id, so every caller gets the attribution without
  one more parameter to forget.
• place_bracket and scale_out take an optional rule_id and put it on the intent; the four
  call sites pass position["rule_id"] or signal.rule_id.

No backfill

The call v12 made for initial_stop. A tranche records its bracket order, never its
entry order, so there is no join back to the id. Matching on (product_id, rule_name) would
re-attribute by guess and be wrong wherever a rule row was replaced. NULL means "nobody recorded
it", and there is a test asserting a pre-v21 row reads NULL rather than acquiring an owner.

rule_id is optional everywhere, deliberately

There is a test for that on its own: a missing id must never cost a position its stop. A
pre-v21 tranche has none, and refusing to protect it because the bookkeeping is incomplete would
trade a reporting gap for an unprotected position.

Verification

Mutation: dropping rule_id=rule_id from place_bracket's intent — which puts live order id 5
back in exactly the state that prompted this — fails the end-to-end test and nothing else.

Nine hardcoded SCHEMA_VERSION == 20 pins across three test files moved to 21, and three new
migration tests cover the fresh schema, the no-backfill path, and idempotency.

ruff check keel tests packages   -> All checks passed!
mypy                             -> clean (465 files; pre-existing PyYAML stub note only)
pytest                           -> 6643 passed, 3 skipped

Note for the deployment

This is a schema change: keel migrate must run on all four databases before the new build
trades. The ALTER is guarded by PRAGMA table_info and adds a nullable column, so it is
non-destructive and idempotent.

Stacked behind #804 (#802) in spirit but independent in code — they touch different files and can
land in either order.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AoGRoExgHVCsWDHT3ej8mD