Entries of unknown outcome hold the account until settled; wipes keep their guards

Fifth review round (1eb0736):

- An entry now has three outcomes. Filled (confirmed): one-and-done is done
  for the day. Never placed: leg taken back, free to retry. Unknown (an ack
  or fill that never came back): the account — any mode — is held until a
  good sync at least 90s later shows it flat with realized P&L unchanged,
  then the leg is taken back and it may retry. Stop-after-all counts it in
  play meanwhile. This closes both the day-long bench of 52ed9c7 and the
  stacked re-entries of 1eb0736.
- Tradovate cancels an acked order whose fill didn't come within 30s (as
  TopstepX already does), so a retry can't sit beside a still-working one.
- A wipe keeps the rebuild's guards: wipeAccountData leaves the Cash History
  baseline, roll base, wipe hold, pre-wipe fund signature and the
  resolver's inferred size in account_meta; the routes forget history
  before wiping (so the stored rows are still there to read), and a wipe
  hold restored after a restart keeps its pre-wipe yardstick.
- Wipe routes take the set of typed accounts before wiping, so an account
  the resolver un-assigns mid-rebuild still counts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/db.ts

@@ -377,11 +377,19 @@ export function loadEndedCycleStart(accountId: number): { fundDate: string; incl
  *  meta — so the next report fetch rebuilds it from scratch. Rows older than
  *  the report's 28-day window are gone for good; that is the point (stale
  *  pre-roll dates), but it is why callers confirm first. */
+/** account_meta keys a wipe leaves in place (see wipeAccountData). */
+const WIPE_KEEPS = ['cash_baseline', 'roll_base', 'history_hold', 'wipe_fund_sig', 'inferred_account_size'];
+
 export function wipeAccountData(accountId: number): void {
     const txn = db.transaction(() => {
         db.prepare('DELETE FROM daily_pnl WHERE account_id = ?').run(accountId);
         db.prepare('DELETE FROM fund_transactions WHERE account_id = ?').run(accountId);
-        db.prepare('DELETE FROM account_meta WHERE account_id = ?').run(accountId);
+        // History goes; what guards the rebuild stays — the balance baseline
+        // and roll base a Cash History vouched for, the wipe's own hold and
+        // pre-wipe fund signature — and the resolver's inferred size, which
+        // nothing in the rebuilt history can infer again.
+        db.prepare(`DELETE FROM account_meta WHERE account_id = ? AND key NOT IN (${WIPE_KEEPS.map(() => '?').join(', ')})`)
+            .run(accountId, ...WIPE_KEEPS);
     });
     txn();
 }