Resiliency + risk + monitoring: SIP backfill, freshness watchdog, gross cap, naked alarm

From the multi-agent audit (ship-now, low-overfit-risk cluster):

INGESTION RESILIENCY
- client._request: 429/5xx now retry with Retry-After + exponential backoff
  (previously hard-failed, feeding silent-stale ingest).
- SIP backfill feed (settings.backfill_feed='sip'): live realtime stays IEX, but
  backtest/backfill ingestion uses the full consolidated tape — IEX sees only
  ~2-5% of true volume (verified: AAPL 22,797 vs 452,704), which was silently
  corrupting every rvol/$-volume decision and backtest. eod_replay wired to it.
- step_ingest freshness watchdog: emits a STALE event + board note when the
  newest bar is older than INGEST_STALE_SECONDS during RTH (45% of passes
  historically returned 0 rows with no error). Optional hard arm-block
  (INGEST_STALE_BLOCK, off by default).

RISK
- Portfolio gross-notional cap (TRADING_MAX_GROSS_NOTIONAL_PCT=0.60): both sizing
  paths now cap each entry to the remaining gross budget, so 6 x 16% can't pile
  the book into ~96% gross of correlated small-caps. Blocks/shrinks late entries.
- Fixed the duplicate TRADING_MAX_CONCURRENT_POSITIONS in .env.example.

MONITORING (UI)
- Naked/unprotected-position alarm: _unprotected_positions joins the latest
  position + order snapshots (order sync now flattens legs) and the TUI board
  shows a red UNPROTECTED banner the instant a held long lacks stop coverage —
  the exact blind spot when APWC/NOWL went naked. Verified it flags today's
  3 overnight positions.

Tests: gross-notional cap blocks when budget full; 50 pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -49,7 +49,7 @@ TRADING_EXECUTION_ENABLED=1
 TRADING_EXECUTION_INTERVAL_SECONDS=30
 TRADING_AUTO_APPROVE=0          # 0 = manual approval in the dashboard, 1 = auto-arm (no approval)
 TRADING_MAX_ORDERS_PER_TICK=1
-TRADING_MAX_CONCURRENT_POSITIONS=3
+# NOTE: concurrency is set ONCE in the risk section below (was duplicated here).
 TRADING_RISK_PER_TRADE_PCT=0.01 # fraction of equity risked per trade
 # --- entry mechanism (Ross-Cameron-style auto-arm; all tunable) ---
 TRADING_REWARD_MULTIPLE=2.0     # target = entry + this * (entry - stop); 2R default
@@ -80,6 +80,16 @@ STRATEGY_SETUPS=opening_range_break
 LIVE_BARS_ENABLED=1
 LIVE_BARS_INTERVAL_SECONDS=60
 LIVE_BARS_LOOKBACK_MINUTES=120
+# Data feed: live realtime uses iex (free, realtime, but ~2-5% of true volume).
+# Backfill/backtest uses sip (full consolidated tape) so rvol/$-volume reflect
+# REAL volume — the iex thinness silently corrupts every volume-based decision.
+ALPACA_DATA_FEED=iex
+ALPACA_BACKFILL_FEED=sip
+# Freshness watchdog: warn (emit + display) when the newest bar is older than
+# this during RTH. INGEST_STALE_BLOCK=1 also refuses to ARM on stale data
+# (off by default so a mis-tuned threshold can't silently halt trading).
+INGEST_STALE_SECONDS=180
+INGEST_STALE_BLOCK=0
 
 # Broker state sync
 ALPACA_PAPER_SYNC_ENABLED=1
@@ -109,6 +119,10 @@ ORB_BARS=5                        # opening range = first N regular-hours minute
 TRADING_TRIGGER_SLIP_PCT=0.004    # cap the chase above the trigger on the fill
 # Account-aware sizing (matters most on a small REAL account):
 TRADING_MAX_POSITION_PCT=0.16     # one position's $ value <= this fraction of equity
+# PORTFOLIO gross-notional cap: total $ across ALL open+pending positions stays
+# under this fraction of equity. Without it, 6 concurrent x 16% = ~96% gross in
+# correlated small-cap gappers. With it, later entries shrink/blocked to fit.
+TRADING_MAX_GROSS_NOTIONAL_PCT=0.60
 # Liquidity-aware sizing: shares <= this fraction of the name's volume, so a
 # thin name is sized DOWN automatically instead of taking a full position it
 # can't absorb. 0 = off (fine at tiny size).