Accept paper MOC orders IBKR holds as PendingSubmit; stop retrying after the order window

On 2026-10-13 the 09:53 ET run placed six MOC orders and failed: the paper
account reports MOC orders as PendingSubmit until the closing auction and sent
no acknowledgement within 30 s, so confirm_orders treated them as rejected.
IBKR listed all six with permanent ids and filled them at the close, as it did
the 14 PendingSubmit orders of 2026-09-29. Every retry then stopped at "6 open
orders already exist", and after 15:45 ET at the order window, and the start
limit's 6-hour window reset at 15:50 ET, so the job restarted every 10 minutes
into the evening (42 restarts by 17:28 ET).

- confirm_orders accepts a PendingSubmit order once IBKR lists it with a
  permanent id, re-reading this client's open orders every 5 s for up to 60 s.
- rebalance --submit succeeds without sending anything when every open order
  comes from today's runs and IBKR still holds every order those runs sent;
  a missing one still fails.
- The trade unit skips starts after 15:45 ET (ExecCondition), which systemd
  does not restart.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/ibkr-quant-trade.service

@@ -3,10 +3,11 @@ Description=ibkr-quant daily run: today's bars, then MOC orders on rebalance ses
 After=ibgateway.service
 # make gateway restarts a Gateway that has lost IBKR or its historical data
 # farm. Retries cover today's bar arriving late (delayed data) and Gateway
-# restarts; make submit refuses to double-submit while orders are open.
-# Every 10 minutes from 09:50 until about 15:30 ET (34 starts), inside the
-# 09:31-15:45 order window: on 2026-10-12 six retries 5 minutes apart gave up
-# after 35 minutes while the data farm was down.
+# restarts; make submit refuses to double-submit while orders are open and
+# succeeds once IBKR holds every order an earlier run sent.
+# Every 10 minutes from 09:50 ET until the 15:45 end of the order window: on
+# 2026-10-12 six retries 5 minutes apart gave up after 35 minutes while the
+# data farm was down. The start limit is a backstop; ExecCondition ends the day.
 StartLimitIntervalSec=21600
 StartLimitBurst=34
 
@@ -14,6 +15,9 @@ StartLimitBurst=34
 Type=oneshot
 WorkingDirectory=%h/projects/ibkr-quant
 Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
+# Past 15:45 ET make submit cannot send orders; a failed condition skips the
+# start without counting as a failure, so it is not restarted.
+ExecCondition=/bin/sh -c 'test "$(TZ=America/New_York date +%%H%%M)" -lt 1545'
 ExecStartPre=/usr/bin/make gateway GATEWAY_ARGS=--history
 ExecStart=/usr/bin/make bars submit
 Restart=on-failure