feat(db): record the stop a tranche was sized against (#520, #502 stage 2)

[eaitbrahim]

Closes #520. First piece of #502 stage 2 — the named prerequisite for the live break-even arm.

The gap

exit_policy.next_stop's break-even arm computes its threshold from the trade's original per-unit risk:

entry + be_roll_rr × (entry − initial_stop)

Live state carried entry_fill (the ledger) and open_stop:<product_id> (the current, already-ratcheted stop) — and nothing else. The number the threshold is most sensitive to was simply absent.

Why substituting the current stop is wrong, not merely imprecise

The current stop rises on every ratchet, shrinking (entry − stop). So the threshold creeps toward entry and the arm fires earlier each time, drifting further from the measured policy the longer a trade runs.

Live and sim would then encode two different break-even rules while appearing to share exit_policy's functions — the exact failure that sharing them was meant to prevent.

What ships

• v12 migration adding positions.initial_stop, idempotent by the v8/v11 PRAGMA table_info guard (a database stamped at v11 got positions from v4's DDL, and CREATE TABLE IF NOT EXISTS never adds a column).
• Written at tranche open by agent._open_tranche from the entry setup's stop, and never rewritten — that separation from the ratcheting open_stop: is the fix.
• Repository.open_position takes it; _position_row_to_dict decodes it nullable.

The nullable handling is load-bearing

None means UNKNOWN, and readers must switch the break-even arm off for that tranche rather than guess.

Zero would be a real number — a stop 100% below entry — and a catastrophic one to compute a threshold from. So _position_row_to_dict is careful not to let _text_to_dec invent one, and there's a test named for it.

The trailing arm is unaffected either way: it needs no original risk, so a tranche without one keeps trailing and simply never break-even-rolls.

No backfill, deliberately. The honest value for every pre-v12 tranche is NULL. Inventing one would fabricate the single input the policy is most sensitive to.

DCA passes None, and that is legitimate rather than degraded — it carries no stop by design, and requiring one would refuse a real tranche.

Tests

Six, in tests/data/test_initial_stop.py:

• round-trips as a Decimal;
• unrecorded reads as None, not zero (the load-bearing one);
• DCA-style open with no stop is accepted, not rejected;
• the column exists on a fresh migrate;
• the migration is idempotent and does not backfill;
• initial_stop is not rewritten when the live stop ratchets.

The three schema-version tripwires were bumped 11 → 12 consciously, which is what they exist to force.

Verification

• pytest -q — 4,559 passed, 3 skipped
• ruff check keel tests packages — clean
• mypy — clean, 354 source files

Not in this PR

The rest of stage 2: idempotency keys on bracket placement, the roll protocol's pre-flight guards and materiality floor, the executor constructing BracketGTC values, and the scale_out rebuild. The crash-ledger half of the roll protocol already shipped as #522.

There is no live consumer of this column yet — the break-even arm itself is stage 3. Same shape as stage 1: the data exists and is correct before anything depends on it.