risk.hpp

#pragma once
 
#include "./event.hpp"
#include "./portfolio.hpp"
#include "./reconcile.hpp"
 
#include <algotradelib/core>
 
#include <array>
#include <chrono>
#include <cstddef>
#include <deque>
#include <optional>
#include <string>
#include <string_view>
#include <utility>
#include <vector>
 
namespace algotradelib {
namespace strategy {

enum class HaltReason {
  OPERATOR,
  LOCAL_FAILURE,
  STOPPING,
  ORDER_LIST_UNREAD,
  PORTFOLIO_ABSENT,
  PORTFOLIO_STALE,
  BUYING_POWER_UNREAD,
  POLL_FAILING,
};

inline constexpr std::array<HaltReason, 8> all_halt_reasons{
  HaltReason::OPERATOR,
  HaltReason::LOCAL_FAILURE,
  HaltReason::STOPPING,
  HaltReason::ORDER_LIST_UNREAD,
  HaltReason::PORTFOLIO_ABSENT,
  HaltReason::PORTFOLIO_STALE,
  HaltReason::BUYING_POWER_UNREAD,
  HaltReason::POLL_FAILING,
};

inline constexpr std::size_t halt_reason_count = all_halt_reasons.size();

enum class InstructionClass {
  OPENING,
  WITHDRAWAL,
};

inline constexpr bool halt_blocks(HaltReason reason, InstructionClass klass) noexcept {
  switch (klass) {
    case InstructionClass::OPENING:
      return true;
    case InstructionClass::WITHDRAWAL:
      break;
  }
  switch (reason) {
    case HaltReason::OPERATOR:
    case HaltReason::LOCAL_FAILURE:
    case HaltReason::STOPPING:
      return true;
    // Guards against an opening order duplicating a predecessor's; a named withdrawal duplicates nothing.
    case HaltReason::ORDER_LIST_UNREAD:
    // None of these says anything about a row the caller already named.
    case HaltReason::PORTFOLIO_ABSENT:
    case HaltReason::PORTFOLIO_STALE:
    case HaltReason::BUYING_POWER_UNREAD:
    // A known resting order is still safe to withdraw when polling is abandoned.
    case HaltReason::POLL_FAILING:
      return false;
  }
  return true;
}

inline constexpr std::string_view halt_reason_name(HaltReason reason) noexcept {
  switch (reason) {
    case HaltReason::OPERATOR:
      return "operator";
    case HaltReason::LOCAL_FAILURE:
      return "local_failure";
    case HaltReason::STOPPING:
      return "stopping";
    case HaltReason::ORDER_LIST_UNREAD:
      return "order_list_unread";
    case HaltReason::PORTFOLIO_ABSENT:
      return "portfolio_absent";
    case HaltReason::PORTFOLIO_STALE:
      return "portfolio_stale";
    case HaltReason::BUYING_POWER_UNREAD:
      return "buying_power_unread";
    case HaltReason::POLL_FAILING:
      return "poll_failing";
  }
  return "";
}
 
static_assert(
  lists_every_value(all_halt_reasons, [](HaltReason reason) { return !halt_reason_name(reason).empty(); }),
  "all_halt_reasons must list every HaltReason"
);
 
/*
 * Operator limits, checked before anything is sent. A guard refuses an order; it never resizes one.
 */

enum class GuardReason {
  TRADING_HALTED,
  INSTRUMENT_NOT_PERMITTED,
  PHASE_NOT_PERMITTED,
  ORDER_NOTIONAL_TOO_LARGE,
  POSITION_LIMIT_EXCEEDED,
  GROSS_EXPOSURE_EXCEEDED,
  ORDER_RATE_EXCEEDED,
  VALUE_NOT_KNOWN,
  QUANTITY_NOT_SELLABLE,
  SELLABLE_BASIS_UNESTABLISHED,
  INSUFFICIENT_BUYING_POWER,
};

inline constexpr std::string_view guard_reason_name(GuardReason reason) noexcept {
  switch (reason) {
    case GuardReason::TRADING_HALTED:
      return "trading_halted";
    case GuardReason::INSTRUMENT_NOT_PERMITTED:
      return "instrument_not_permitted";
    case GuardReason::PHASE_NOT_PERMITTED:
      return "phase_not_permitted";
    case GuardReason::ORDER_NOTIONAL_TOO_LARGE:
      return "order_notional_too_large";
    case GuardReason::POSITION_LIMIT_EXCEEDED:
      return "position_limit_exceeded";
    case GuardReason::GROSS_EXPOSURE_EXCEEDED:
      return "gross_exposure_exceeded";
    case GuardReason::ORDER_RATE_EXCEEDED:
      return "order_rate_exceeded";
    case GuardReason::VALUE_NOT_KNOWN:
      return "value_not_known";
    case GuardReason::QUANTITY_NOT_SELLABLE:
      return "quantity_not_sellable";
    case GuardReason::SELLABLE_BASIS_UNESTABLISHED:
      return "sellable_basis_unestablished";
    case GuardReason::INSUFFICIENT_BUYING_POWER:
      return "insufficient_buying_power";
  }
  return "unknown";
}

struct GuardRejection {
  GuardReason reason_{GuardReason::TRADING_HALTED};
  InstrumentId instrument_;
  std::string tag_;
  std::optional<HaltReason> halt_reason_;
  std::optional<Decimal64> limit_;
  std::optional<Decimal64> attempted_;
};

struct RiskLimits {
  std::optional<Decimal64> max_order_notional_;
  std::optional<Decimal64> max_position_quantity_;
  std::optional<Decimal64> max_gross_exposure_;
  std::optional<std::size_t> max_orders_per_window_;
  std::chrono::seconds rate_window_{60};
  bool enforce_sellable_quantity_{true};
  bool enforce_buying_power_{false};
  std::optional<std::vector<InstrumentId>> permitted_universe_;
  std::optional<std::vector<MarketPhase>> permitted_phases_{
    std::vector<MarketPhase>{MarketPhase::OPEN}
  };
};

struct InstrumentBasis {
  InstrumentId instrument_;
  Currency currency_;
  Decimal64 price_;
};

struct GuardInputs {
  std::chrono::system_clock::time_point now_{};
  MarketPhase phase_{MarketPhase::UNKNOWN};
  std::optional<Decimal64> reference_price_;
  std::vector<InstrumentBasis> exposure_basis_;
  std::optional<Currency> order_currency_;
};
 
namespace risk_detail {

inline Decimal64 decimal_max(const Decimal64& lhs, const Decimal64& rhs) {
  return decimal_less(lhs, rhs) ? rhs : lhs;
}

inline std::optional<Decimal64> decimal_magnitude(const Decimal64& value) {
  const auto zero = Decimal64::parse("0");
  if (!decimal_less(value, zero)) {
    return value;
  }
  return decimal_subtract(zero, value);
}
 
} // namespace risk_detail

enum class CandidateContribution {
  QUANTITY_AND_PRICE,
  PRICE_ONLY,
};

template <typename Broker>
std::optional<Decimal64> projected_gross_exposure(
  const Portfolio<Broker>& portfolio,
  const std::vector<InstrumentBasis>& basis,
  const Currency& currency,
  const PlannedOrder* candidate,
  const std::optional<Decimal64>& candidate_price,
  CandidateContribution contribution
) {
  const auto zero = Decimal64::parse("0");
 
  // Every instrument the answer depends on: held, working, or about to be ordered. Collected first
  // so each one is valued exactly once however many rows mention it.
  std::vector<InstrumentId> instruments;
  const auto note = [&instruments](const InstrumentId& id) {
    for (const auto& seen : instruments) {
      if (seen == id) {
        return;
      }
    }
    instruments.push_back(id);
  };
  for (const auto& position : portfolio.positions_) {
    // A flat row (a closed position a broker or the replay ledger still lists) is not exposure and
    // needs no basis; if it also has a working order, the loop below collects it.
    if (position.quantity_.coefficient() == 0) {
      continue;
    }
    note(position.instrument_);
  }
  for (const auto& working : portfolio.working_) {
    if (order_is_open(working.order_.status_)) {
      note(working.order_.instrument_);
    }
  }
  if (candidate != nullptr) {
    note(candidate->instrument_);
  }
 
  auto total = zero;
  for (const auto& id : instruments) {
    const InstrumentBasis* resolved = nullptr;
    for (const auto& entry : basis) {
      if (!(entry.instrument_ == id)) {
        continue;
      }
      if (resolved != nullptr) {
        // Two answers for one instrument. Picking either would be picking one of two currencies or
        // two marks, and the caller resolved it twice for a reason this cannot see.
        return std::nullopt;
      }
      resolved = &entry;
    }
    if (resolved == nullptr) {
      return std::nullopt;
    }
    if (!(resolved->currency_ == currency)) {
      continue;
    }
    // A mark must be positive: zero would omit the position, and a negative one (from bad market
    // data) would offset real holdings.
    if (!decimal_less(zero, resolved->price_)) {
      return std::nullopt;
    }
 
    // Summed over every row: a holding can be split across lots.
    auto held = zero;
    for (const auto& position : portfolio.positions_) {
      if (!(position.instrument_ == id)) {
        continue;
      }
      const auto sum = decimal_add(held, position.quantity_);
      if (!sum) {
        return std::nullopt;
      }
      held = *sum;
    }
    auto buys = zero;
    auto sells = zero;
    auto price = resolved->price_;
    for (const auto& working : portfolio.working_) {
      if (!(working.order_.instrument_ == id) || !order_is_open(working.order_.status_)) {
        continue;
      }
      const auto remaining = decimal_subtract(
        working.order_.quantity_, working.order_.execution_.filled_quantity_
      );
      if (!remaining) {
        return std::nullopt;
      }
      // A row filled beyond its quantity refuses (`working_quantity` skips it): a limit cannot infer
      // from an inconsistent snapshot that nothing is outstanding.
      if (decimal_less(*remaining, zero)) {
        return std::nullopt;
      }
      const auto sum = decimal_add(
        working.order_.side_ == OrderSide::BUY ? buys : sells, *remaining
      );
      if (!sum) {
        return std::nullopt;
      }
      (working.order_.side_ == OrderSide::BUY ? buys : sells) = *sum;
      if (working.order_.price_) {
        // A non-positive price would silently lose to the mark in `max`; refuse instead.
        if (!decimal_less(zero, *working.order_.price_)) {
          return std::nullopt;
        }
        price = risk_detail::decimal_max(price, *working.order_.price_);
      }
    }
 
    if (candidate != nullptr && candidate->instrument_ == id) {
      // The candidate's price applies under both contributions, its quantity only under one, so the
      // two projections differ only by the quantity.
      const auto stated = candidate->price_ ? candidate->price_ : candidate_price;
      if (stated) {
        // Validated, not just offered to `max`: a negative price would vanish into the mark here and
        // pass `max_order_notional_` as a negative value. Nothing upstream rules it out.
        if (!decimal_less(zero, *stated)) {
          return std::nullopt;
        }
        price = risk_detail::decimal_max(price, *stated);
      }
      bool adds_quantity = false;
      switch (contribution) {
        case CandidateContribution::QUANTITY_AND_PRICE:
          adds_quantity = true;
          break;
        case CandidateContribution::PRICE_ONLY:
          break;
      }
      if (adds_quantity) {
        const auto sum = decimal_add(
          candidate->side_ == OrderSide::BUY ? buys : sells, candidate->quantity_
        );
        if (!sum) {
          return std::nullopt;
        }
        (candidate->side_ == OrderSide::BUY ? buys : sells) = *sum;
      }
    }
 
    const auto if_bought = decimal_add(held, buys);
    const auto if_sold = decimal_subtract(held, sells);
    if (!if_bought || !if_sold) {
      return std::nullopt;
    }
    const auto long_side = risk_detail::decimal_magnitude(*if_bought);
    const auto short_side = risk_detail::decimal_magnitude(*if_sold);
    if (!long_side || !short_side) {
      return std::nullopt;
    }
    const auto projected = risk_detail::decimal_max(*long_side, *short_side);
 
    const auto value = decimal_multiply(projected, price);
    if (!value) {
      return std::nullopt;
    }
    const auto running = decimal_add(total, *value);
    if (!running) {
      return std::nullopt;
    }
    total = *running;
  }
  return total;
}

template <typename Broker>
std::optional<bool> closes_toward_flat(
  const Portfolio<Broker>& portfolio, const PlannedOrder& order
) {
  const auto zero = Decimal64::parse("0");
 
  // Net across every row; a split holding must not understate `held`.
  const auto net = portfolio.net_quantity_of(order.instrument_);
  if (!net) {
    return std::nullopt;
  }
  const auto held = *net;
  // No row and a row of zero both mean nothing to close.
  if (held.coefficient() == 0) {
    return false;
  }
 
  // A non-positive quantity closes nothing; a negative one would otherwise satisfy the bound below.
  if (!decimal_less(zero, order.quantity_)) {
    return false;
  }
 
  const auto closing = decimal_less(zero, held) ? OrderSide::SELL : OrderSide::BUY;
  if (order.side_ != closing) {
    return false;
  }
 
  auto resting = zero;
  for (const auto& working : portfolio.working_) {
    if (!(working.order_.instrument_ == order.instrument_) || working.order_.side_ != closing) {
      continue;
    }
    if (!order_is_open(working.order_.status_)) {
      continue;
    }
    const auto remaining = decimal_subtract(
      working.order_.quantity_, working.order_.execution_.filled_quantity_
    );
    // A row filled beyond its quantity is a contradiction; refuse rather than count zero.
    if (!remaining || decimal_less(*remaining, zero)) {
      return std::nullopt;
    }
    const auto sum = decimal_add(resting, *remaining);
    if (!sum) {
      return std::nullopt;
    }
    resting = *sum;
  }
 
  const auto committed = decimal_add(resting, order.quantity_);
  if (!committed) {
    return std::nullopt;
  }
  const auto magnitude = risk_detail::decimal_magnitude(held);
  if (!magnitude) {
    return std::nullopt;
  }
  // `<=`: an order that reaches flat exactly is a close (the usual liquidation case).
  return !decimal_less(*magnitude, *committed);
}

struct GuardDecision {
  std::optional<GuardRejection> rejection_;
  bool admitted_outside_phase_{false};
};

class RiskGuard {
public:
  explicit RiskGuard(RiskLimits limits = {}) : limits_(std::move(limits)) {}

  const RiskLimits& limits() const noexcept { return limits_; }

  bool permits_phase(MarketPhase phase) const noexcept {
    if (!limits_.permitted_phases_) {
      return true;
    }
    for (const auto allowed : *limits_.permitted_phases_) {
      if (allowed == phase) {
        return true;
      }
    }
    return false;
  }

  void halt() noexcept { held_[index_of(HaltReason::OPERATOR)] = true; }

  void halt(HaltReason reason, std::string detail) {
    held_[index_of(reason)] = true;
    details_[index_of(reason)] = std::move(detail);
  }

  void halt(HaltReason reason) { halt(reason, std::string()); }

  void resume() noexcept { resume(HaltReason::OPERATOR); }

  void resume(HaltReason reason) noexcept {
    held_[index_of(reason)] = false;
    details_[index_of(reason)].clear();
  }

  bool halted() const noexcept {
    for (const auto held : held_) {
      if (held) {
        return true;
      }
    }
    return false;
  }

  bool halted(HaltReason reason) const noexcept { return held_[index_of(reason)]; }

  std::optional<HaltReason> blocking_reason() const noexcept {
    return blocking_reason_for(InstructionClass::OPENING);
  }

  std::optional<HaltReason> blocking_reason_for(InstructionClass klass) const noexcept {
    for (std::size_t index = 0; index < halt_reason_count; ++index) {
      const auto reason = static_cast<HaltReason>(index);
      if (held_[index] && halt_blocks(reason, klass)) {
        return reason;
      }
    }
    return std::nullopt;
  }

  const std::string& hold_detail(HaltReason reason) const noexcept {
    return details_[index_of(reason)];
  }

  std::vector<HaltReason> holds() const {
    std::vector<HaltReason> held;
    for (std::size_t index = 0; index < halt_reason_count; ++index) {
      if (held_[index]) {
        held.push_back(static_cast<HaltReason>(index));
      }
    }
    return held;
  }

  void note_sent(std::chrono::system_clock::time_point when) {
    sent_.push_back(when);
    ++total_sent_;
  }

  std::size_t total_sent() const noexcept { return total_sent_; }

  std::size_t recent_orders(std::chrono::system_clock::time_point now) const {
    std::size_t count = 0;
    for (const auto when : sent_) {
      if (now - when < limits_.rate_window_) {
        ++count;
      }
    }
    return count;
  }

  void forget_before(std::chrono::system_clock::time_point cutoff) {
    while (!sent_.empty() && sent_.front() < cutoff) {
      sent_.pop_front();
    }
  }

  template <typename Broker>
  std::optional<GuardRejection> check(
    const PlannedOrder& order,
    const Portfolio<Broker>& portfolio,
    const GuardInputs& inputs
  ) const {
    return evaluate(order, portfolio, inputs).rejection_;
  }

  template <typename Broker>
  GuardDecision evaluate(
    const PlannedOrder& order,
    const Portfolio<Broker>& portfolio,
    const GuardInputs& inputs
  ) const {
    const auto refuse = [&order](GuardReason reason) {
      GuardRejection rejection;
      rejection.reason_ = reason;
      rejection.instrument_ = order.instrument_;
      rejection.tag_ = order.tag_;
      return GuardDecision{std::optional<GuardRejection>(rejection), false};
    };
    const auto refuse_with =
      [&order](GuardReason reason, Decimal64 limit, Decimal64 attempted) {
        GuardRejection rejection;
        rejection.reason_ = reason;
        rejection.instrument_ = order.instrument_;
        rejection.tag_ = order.tag_;
        rejection.limit_ = std::move(limit);
        rejection.attempted_ = std::move(attempted);
        return GuardDecision{std::optional<GuardRejection>(rejection), false};
      };
    // Set by the phase check and reported only if the order survives every later limit, since
    // `refuse` and `refuse_with` both build a decision with it false. An order the exception
    // admitted and a ceiling then refused was not admitted.
    bool admitted_outside_phase = false;
 
    if (const auto holding = blocking_reason()) {
      auto decision = refuse(GuardReason::TRADING_HALTED);
      decision.rejection_->halt_reason_ = *holding;
      return decision;
    }
 
    if (limits_.permitted_universe_) {
      bool permitted = false;
      for (const auto& allowed : *limits_.permitted_universe_) {
        if (allowed == order.instrument_) {
          permitted = true;
          break;
        }
      }
      if (!permitted) {
        return refuse(GuardReason::INSTRUMENT_NOT_PERMITTED);
      }
    }
 
    if (limits_.permitted_phases_) {
      bool permitted = false;
      for (const auto phase : *limits_.permitted_phases_) {
        if (phase == inputs.phase_) {
          permitted = true;
          break;
        }
      }
      if (!permitted) {
        // The phase restricts what an order opens, not what it closes: an exit must stay expressible
        // after the session. `closes_toward_flat` is narrower than the exposure rule, which would
        // admit a sell that opens a short against a resting buy.
        const auto closing = closes_toward_flat(portfolio, order);
        // Unknown refuses: this branch only relaxes a restriction.
        if (!closing || !*closing) {
          return refuse(GuardReason::PHASE_NOT_PERMITTED);
        }
        admitted_outside_phase = true;
      }
    }
 
    if (limits_.max_orders_per_window_ &&
        recent_orders(inputs.now_) >= *limits_.max_orders_per_window_) {
      return refuse_with(
        GuardReason::ORDER_RATE_EXCEEDED,
        Decimal64(static_cast<std::int64_t>(*limits_.max_orders_per_window_), 0),
        Decimal64(static_cast<std::int64_t>(recent_orders(inputs.now_) + 1), 0)
      );
    }
 
    // A market order carries no price, so its value has to come from the runner's last quote.
    // Without one, a notional or exposure limit cannot be evaluated, and a limit that cannot be
    // evaluated must refuse rather than wave the order through.
    const auto price = order.price_ ? order.price_ : inputs.reference_price_;
    const bool needs_value =
      limits_.max_order_notional_.has_value() || limits_.max_gross_exposure_.has_value() ||
      (limits_.enforce_buying_power_ && order.side_ == OrderSide::BUY);
    if (needs_value && !price) {
      return refuse(GuardReason::VALUE_NOT_KNOWN);
    }
 
    std::optional<Decimal64> value;
    if (price) {
      value = decimal_multiply(order.quantity_, *price);
      if (needs_value && !value) {
        return refuse(GuardReason::VALUE_NOT_KNOWN);
      }
    }
 
    if (limits_.max_order_notional_ && value &&
        decimal_less(*limits_.max_order_notional_, *value)) {
      return refuse_with(
        GuardReason::ORDER_NOTIONAL_TOO_LARGE, *limits_.max_order_notional_, *value
      );
    }
 
    if (limits_.enforce_sellable_quantity_ && order.side_ == OrderSide::SELL) {
      // One read, so the figure and its basis come from the same row.
      const auto reading = portfolio.sellable_reading_for(order.instrument_);
      const auto& sellable = reading.quantity_;
      if (!sellable) {
        // Absent is unknown, and unknown refuses; the held quantity is not substituted.
        return refuse(GuardReason::QUANTITY_NOT_SELLABLE);
      }
      // A figure whose basis is not established refuses even though present; this fails closed for
      // an adapter the library has never seen.
      if (!reading.basis_.is_enforceable()) {
        return refuse(GuardReason::SELLABLE_BASIS_UNESTABLISHED);
      }
      // Every open sell (the broker's rows and this library's reservations) counts against the
      // figure. That over-refuses where the broker already deducted them and never under-refuses;
      // see `SellableBasis::DEDUCT`.
      const auto resting = portfolio.working_quantity(order.instrument_, OrderSide::SELL);
      const auto committed = decimal_add(resting, order.quantity_);
      if (!committed) {
        return refuse(GuardReason::QUANTITY_NOT_SELLABLE);
      }
      if (decimal_less(*sellable, *committed)) {
        return refuse_with(GuardReason::QUANTITY_NOT_SELLABLE, *sellable, *committed);
      }
    }
 
    if (limits_.enforce_buying_power_ && order.side_ == OrderSide::BUY) {
      if (!value) {
        // A price is present (`needs_value`), so the multiplication itself failed.
        return refuse(GuardReason::VALUE_NOT_KNOWN);
      }
      if (!inputs.order_currency_) {
        return refuse(GuardReason::INSUFFICIENT_BUYING_POWER);
      }
      const auto available = portfolio.buying_power_in(*inputs.order_currency_);
      if (!available) {
        // Absent is unknown, and unknown refuses. (`cash_in` is empty live, so no fallback.)
        return refuse(GuardReason::INSUFFICIENT_BUYING_POWER);
      }
      if (decimal_less(*available, *value)) {
        return refuse_with(GuardReason::INSUFFICIENT_BUYING_POWER, *available, *value);
      }
    }
 
    if (limits_.max_position_quantity_) {
      const auto zero = Decimal64::parse("0");
      // Net across every position row, as reconciliation sizes: a split holding read from its first
      // row would refuse an exit to flat and pass a buy that both lots together put over the ceiling.
      const auto net = portfolio.net_quantity_of(order.instrument_);
      if (!net) {
        return refuse(GuardReason::POSITION_LIMIT_EXCEEDED);
      }
      const auto held = *net;
      // Orders already working on this side count, so two buys that each fit cannot together exceed
      // the ceiling. A resting opposite-side order is not counted as relief.
      const auto pending = portfolio.working_quantity(order.instrument_, order.side_);
      const auto committed = decimal_add(pending, order.quantity_);
      if (!committed) {
        return refuse(GuardReason::POSITION_LIMIT_EXCEEDED);
      }
      const auto signed_quantity = order.side_ == OrderSide::BUY ?
        std::optional<Decimal64>(*committed) :
        decimal_subtract(zero, *committed);
      if (!signed_quantity) {
        return refuse(GuardReason::POSITION_LIMIT_EXCEEDED);
      }
      const auto resulting = decimal_add(held, *signed_quantity);
      if (!resulting) {
        return refuse(GuardReason::POSITION_LIMIT_EXCEEDED);
      }
      // The ceiling is on magnitude, so a short of the same size is limited as a long is.
      const auto magnitude = decimal_less(*resulting, zero) ?
        decimal_subtract(zero, *resulting) :
        std::optional<Decimal64>(*resulting);
      if (!magnitude) {
        return refuse(GuardReason::POSITION_LIMIT_EXCEEDED);
      }
      if (decimal_less(*limits_.max_position_quantity_, *magnitude)) {
        return refuse_with(
          GuardReason::POSITION_LIMIT_EXCEEDED, *limits_.max_position_quantity_, *magnitude
        );
      }
    }
 
    if (limits_.max_gross_exposure_) {
      // Per currency: an unresolved order currency refuses.
      if (!inputs.order_currency_) {
        return refuse(GuardReason::VALUE_NOT_KNOWN);
      }
      const auto resulting = projected_gross_exposure(
        portfolio, inputs.exposure_basis_, *inputs.order_currency_, &order, price,
        CandidateContribution::QUANTITY_AND_PRICE
      );
      if (!resulting) {
        // The basis does not describe the portfolio, or the arithmetic did not fit.
        return refuse(GuardReason::VALUE_NOT_KNOWN);
      }
      if (decimal_less(*limits_.max_gross_exposure_, *resulting)) {
        // Over the ceiling, refuse only an order that raises the projection, so an account already
        // over it can still sell out. Compare against `PRICE_ONLY` (same prices, no quantity), not
        // `nullptr`, so the difference is the order's quantity and not its limit price.
        const auto without = projected_gross_exposure(
          portfolio, inputs.exposure_basis_, *inputs.order_currency_, &order, price,
          CandidateContribution::PRICE_ONLY
        );
        if (!without) {
          return refuse(GuardReason::VALUE_NOT_KNOWN);
        }
        if (decimal_less(*without, *resulting)) {
          return refuse_with(
            GuardReason::GROSS_EXPOSURE_EXCEEDED, *limits_.max_gross_exposure_, *resulting
          );
        }
      }
    }
 
    return GuardDecision{std::nullopt, admitted_outside_phase};
  }
 
private:
  // `reason`'s slot in the hold arrays.
  static constexpr std::size_t index_of(HaltReason reason) noexcept {
    return static_cast<std::size_t>(reason);
  }
 
  RiskLimits limits_;
  // Which holds are in force, indexed by `HaltReason`; declaration order is priority order.
  std::array<bool, halt_reason_count> held_{};
  // Each hold's detail, empty where none or not held.
  std::array<std::string, halt_reason_count> details_;
  // Timestamps of orders sent, oldest first; a sliding window, not a counter reset on a boundary.
  std::deque<std::chrono::system_clock::time_point> sent_;
  std::size_t total_sent_{0};
};
 
} // namespace strategy
} // namespace algotradelib