Description

Six unrelated minor bugs across various subsystems:

1. RollFinder.get_rolls uses sessions.freq (roll_finder.py)

Same sessions.freq returning None issue as in bcolz/continuous_future. Should use tc.day.

2. compute_asset_lifetimes wrong for all-null assets (hdf5_daily_bars.py)

When all dates for an asset are null, np.argmin returns 0 (first index), making the asset appear to span the entire date range. Should detect all-null columns and set start > end.

3. NumericalExpression._compute doesn't apply mask (expression.py)

The mask parameter is received but never applied. numexpr.evaluate writes to the entire output buffer, so masked-out cells get computed values instead of missing_value.

4. _merge_expressions uses set() losing ordering (expression.py)

set(self.inputs).union(other.inputs) doesn't preserve insertion order, making variable bindings non-deterministic across runs.

5. SQL table name interpolation (adjustments.py)

get_adjustments_for_sid() interpolates table_name directly into SQL via %s. While callers pass string literals, there is no validation. Defense-in-depth: add whitelist check.

6. max_leverage is global, not per-period (metric.py)

_ClassicRiskMetrics.risk_metric_period computes algorithm_leverages.max() across the entire simulation rather than filtering to the reporting period.