28. v0.12.1 — Paper trading reliability

Release candidate prepared 2026-09-01. This patch release hardens the paper broker introduced in v0.12.0: execution and buying-power accounting, executable market-data provenance, replay branching, local persistence, AI authorization, telemetry privacy, accessibility, and release gates. It does not connect to a broker or introduce real-money trading.

Fixed

Execution and accounting

• Filled long and short exposure now consumes no-margin buying power. Working buy and sell reservations are independent, modifications replace the original reservation in place, and opening or reversing fills are checked again at the actual fill price.
• Callers cannot label an order isClose or reduceOnly to bypass capital checks. Restored partial orders fill only their remaining quantity; malformed partial state is rejected.
• Same-bar entries, activated brackets, and older working orders execute in simulated path order. MFE/MAE begins after the fill, never from prices touched before the position existed.
• IOC and FOK resolve during their first eligible evaluation, including quote-only placement. Triggered stop-limit edits, nonpositive ticks, and large off-grid quantities are validated correctly.
• Retention caps preserve equity-curve continuity and lifetime trade totals even after detailed rows roll off.

Market data and replay

• Provider timestamps and source provenance reach the broker unchanged. Historical, reconnect, hydration, and timeframe snapshots remain display-only and cannot execute orders.
• Per-pane, instrument, timeframe, replay-domain, and socket generations prevent delayed callbacks or old snapshots from replacing newer executable trades. Pane/timeframe/replay transitions invalidate quote caches.
• Massive and Alpaca ignore stale socket callbacks; backend EventSource keeps native reconnection and marks its first post-reconnect bar as a snapshot.
• Moving a replay cursor backward now archives the current replay branch and starts a fresh replay session/account at the older cursor. Forward movement stays in the current branch, and one broker instance cannot execute another instance's replay account.

Persistence, recovery, and exports

• Revisioned three-way component merging preserves independent account and settings changes from multiple tabs. A divergent edit to the same component keeps the newer saved state, reports a conflict, and remains retryable.
• Post-write verification failures retain local state. Reset, import, delete, replay, and settings operations report persistence failures instead of claiming success.
• Destructive operations require a successfully written and verified recovery backup before changing state. Imports validate every supplied nested record and explicitly migrate legacy v1 exports.
• Live and active replay accounts are protected from the soft account cap; archived records are evicted first.
• CSV history includes complete order/execution audit fields, including feed source and user/AI origin. User-controlled formula-like text is neutralized without turning negative numeric values into text.

Authorization and AI

• Order previews are broker-authoritative, single-use, and expire after 60 seconds. They bind the account, validated order, settings/state, and executable quote; changes require a new preview.
• AI approvals are volatile, single-use, expire after 60 seconds, and bind the exact action/account/state/quote. Restored chat history cannot recreate an approval or replay an action.
• User and AI origin now flows through orders, executions, journal entries, persistence, AI snapshots, CSV, and Account Manager tables.
• AI proxy requests enforce body, attachment-count, and decoded-byte budgets. Persisted history omits attachment names/content and replayable actions.

UI and accessibility

• Position drafts reset with their target, only the top dialog handles Escape, destructive dialogs focus Cancel, and pointer cancellation aborts line/dialog drags instead of committing them.
• Account Manager sorting uses keyboard-accessible buttons and aria-sort.
• The bottom-dock shortcut moved from Ctrl/⌘ + U to Ctrl/⌘ + Shift + U, preserving browser/editor behavior. It is ignored while focus is in an editable control.

Telemetry and privacy

• Server error telemetry never captures raw headers, cookies, authorization values, or request bodies.
• The in-product telemetry control remains available after opt-in. Withdrawing consent clears queued events, cancels generation-bound retries, and disables adapters.
• GPC and DNT override stored consent for browser adapters, automatic Sentry behavior, server telemetry, and EventSource error capture. A minimal same-site consent cookie carries only the granted/denied gate needed by same-site server requests.

Dependencies and quality gates

• Alpaca's server integration now uses @alpacahq/alpaca-trade-api 4.0.1, removing the vulnerable 3.x Axios chain.
• Security CI uses a frozen, script-free Bun 1.4.0 install and fails on high-severity advisories; quality CI enforces the exact ESLint bulk-suppression baseline with zero unsuppressed warnings.
• The supported Node range is ^22.22.2 || ^24.15.0 || >=26.0.0.

Verification

• Five high-risk test groups passed three consecutive runs each: 15 targeted Vitest runs.
• The Alpaca stream lifecycle passed 20/20 shuffled seeds after randomized execution exposed and closed a test-fixture isolation leak.
• Default and shuffled full suites each passed 293 files / 2,332 tests, with one file / four tests intentionally skipped.
• TypeScript, zero-warning lint and suppression pruning, the optimized Next.js build (117/117 static pages), the pinned Bun high-severity audit, and diff/whitespace checks passed.
• Pull-request dependency audit, secret scan, ESLint baseline, and Vercel deployment checks passed.

Manual release gate

The public Vercel preview is access-protected and redirects the Browser panel to Vercel login. An authenticated BTCUSDT visual smoke remains required before tagging v0.12.1; automated regressions cover the affected browser behavior, but no interactive preview verification is claimed here.

Next steps

Back to the release list.

Next: Release Notes