chore(QUAL-006): adopt pandas-stubs across the checked application code

[DoRmAmMu1997]

Ticket scope (QUAL-006 — pandas-stubs, big-bang per user decision)

Goal: stop treating pandas as Any in the checked application code. The June review declined this as "hundreds of errors"; the user chose the big-bang, one-PR route for this wave. With stubs matched to the pinned pandas minor version (pandas-stubs==2.3.3.260113 for pandas==2.3.3), the actual surface was 22 errors in 12 files — all mechanical narrowing, fixed here.

⚠️ This PR contains the wave's one sanctioned, deliberate constraints.txt + pyproject.toml change (per AGENTS.md §7's "deliberate, reviewed bump" clause): pandas-stubs and its declared dependency types-pytz are pinned; "pandas.*" leaves the mypy ignore list; required_names in tests/test_supply_chain_policy.py and requirements-dev.txt are co-updated. Every other PR in this wave keeps that diff empty.

In scope

• pyproject: "pandas.*" removed from the stub-less override list (dhanhq/pandas_ta/pyarrow/pypdf/talib stay — they genuinely ship no stubs).
• Pins: pandas-stubs==2.3.3.260113, types-pytz==2026.2.0.20260518 in constraints.txt (dev-tools section, same pattern as types-requests); names added to requirements-dev.txt + the supply-chain policy lock.
• All 22 errors fixed, zero behavior change — every edit is an annotation or a cast() (the house narrowing convention, AGENTS.md §5):
  • infer_epoch_unit now returns the exact Literal["s","ms","us"] set that pd.to_datetime(unit=) accepts — annotation only, the returned values were already those literals (2 errors, dhan_client).
  • to_dict("records") keys type as Hashable; narrowed to dict[str, ...] where columns are known-string: scoring/model (the records list feeding all four component builders — also dissolved two cascade errors), scanning/service, ui/common, technical_agent, ipo_manual_page (9 errors).
  • .loc[scalar] → Series|DataFrame, Series.name → Hashable, itertuples fields → broad scalar union: cast() at the six sites in indicators, heikin_ashi_supertrend, envelope_knoxville_buy, technical_agent (8 errors).
  • Odds and ends: resample .agg mapping keyed dict[Hashable, str] (the stubs' mapping overload is key-invariant), np.log(Series) narrowed back from numpy's ndarray typing, one var-annotated in cpr_yearly, pd.notna(cast(Any, ...)) in the data-quality boundary helper (3 errors).

Proof of zero behavior change

• Goldens pass byte-identical — no UPDATE_GOLDEN regeneration was needed or performed.
• Full suite passes at exactly main's baseline count (1,386 passed, 1 skipped).
• The diff contains no new statements — only annotations, casts, one Literal return type, and comments.

Out of scope (deliberate)

• tests/ typing stays at its current QUAL-004 scope — extending mypy to the test tree is QUAL-007, sequenced after this PR merges (it needs these stubs to type pandas-using tests).
• No disallow_untyped_defs escalation; per-module strictness remains a future step.

This is ticket 8 of a 10-ticket second improvement wave (TEST-007 #98, REF-003 #99, AI-006 #100, IPO-006 #101, TEST-006 #102, PERF-002 #103, DEPLOY-004 #104, QUAL-006, QUAL-007, DOC-003), each shipped as its own PR off main.

Gates (all green, local, Python 3.13)

Gate	Result
mypy	clean at full scope, pandas typed (119 files)
pytest -q --cov=... --cov-fail-under=87	1,386 passed, 1 skipped; coverage 88.13%
Golden screener outputs	10 passed, byte-identical
pre_commit validate-config / compileall / ruff / bandit	clean
pip_audit -r constraints.txt (including the two new pins)	no known vulnerabilities

Review

/code-review: Approve — every fix was checked against runtime reality before casting (records keys are string column names; .loc labels are scalar ints; OHLC itertuples fields are numeric post-boundary-coercion; the Literal return values were already exactly those strings). /security-review: no findings — typing-only diff; the two new dev-dependencies are exact-pinned and pass pip-audit.

🤖 Generated with Claude Code

[DoRmAmMu1997]

Self-review (posted as COMMENT — the bot runs as the PR author and cannot APPROVE). Verdict: Approve.

The review question for a typing big-bang is "did any cast paper over a real bug?" — each was checked against runtime reality:

1. cast(list[dict[str, Any]], frame.to_dict("records")) (5 sites) — sound where column names are strings by construction: screener result frames go through the result contract's normalizer (which itself enforces string keys downstream), candle frames come from the loader's fixed boundary columns, and the peer editor's columns are configured string names in the same function. No frame with non-string columns can reach these sites.
2. .loc[scalar-int] casts (indicators, 2 sites) — the labels come from pivot_rows.index coerced through int() immediately above; a scalar label on a unique integer index returns a Series. The union type exists because .loc can also take slices/lists — not possible here.
3. Series.name casts (3 sites) — all three frames are reset_index(drop=True)'d before the rows are taken, so .name is always the integer positional index. The pre-existing int(...) coercion is retained around every cast (runtime behavior unchanged).
4. infer_epoch_unit Literal return — the function body returns exactly "s", "ms", or "us"; the annotation now says so. This is the one fix that improves an API rather than narrowing at a call site.
5. itertuples OHLC casts — the loader's normalize_daily_payload coerces open/high/low/close through pd.to_numeric at the boundary, so the numeric assumption is enforced upstream, not hoped for.
6. No error was suppressed — zero # type: ignore comments added; the diff is annotations, casts, one Literal, and comments (73 insertions, 29 deletions, no new statements).
7. Behavior locks — goldens byte-identical without regeneration; full suite at exactly main's baseline (1,386); the deterministic-screener output contract cannot have drifted.
8. Supply-chain hygiene — both new pins are exact, listed in required_names, present in requirements-dev.txt, and pass pip-audit; the stubs version tracks the pinned pandas 2.3.3 series (not the 3.x stubs line, which would type APIs the pinned runtime doesn't have).

Gates: mypy clean at full scope (119 files, pandas typed); 1,386 passed + 1 skipped, coverage 88.13% (floor 87); ruff/bandit/pip-audit/pre-commit/compileall clean. Security review: no findings (typing-only).

Sequencing note: QUAL-007 (mypy over tests/) waits for this to merge — it needs pandas-stubs to type pandas-using test modules and would conflict on pyproject.toml otherwise. No stacking; it will branch off main after this lands.

[DoRmAmMu1997]

Codex review plan:

I found no actionable standalone issue in QUAL-006. I will retain pandas-stubs and the current casts, rerun the typing and repository gates, and perform the final diff-security review. This PR will be evaluated last in the temporary eight-PR integration tree so its mypy gate covers the preceding changes.

[DoRmAmMu1997]

QUAL-006 completion review (current-main reconciliation):

The original pandas-stubs adoption had no actionable standalone defect. I reconciled this branch with current main in merge commit 8778b66, so the pandas typing gate is now evaluated against the final #98-#104 runtime and test changes instead of the older stack base. No QUAL-006 runtime behavior or public API was changed.

Fresh verification on the composed head:

• python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=87 -> 1,515 passed, 1 skipped, 89.31% coverage
• python -m mypy -> no issues in 123 source files
• compileall, Ruff, Bandit, pinned pip-audit, pre-commit validation/all hooks, and git diff --check -> passed
• Codex Security diff scan against current origin/main -> 13/13 files reviewed, 0 candidates, 0 findings, 0 deferred
• GitHub Actions -> Python 3.11, Python 3.12, and Docker image build all passed

Verdict: QUAL-006 remains a runtime-neutral pandas-stubs/type-narrowing change, is current with main, and is clean and mergeable. Per the batch plan, it should remain the final merge candidate after the other reviewed PRs; no merge was performed here.