Mover v3 round 17: resolve the cross-family pre-outcome review (5 majors, 2 minors); GPT-6 delta review ready_to_freeze — not frozen

[seathatflowsinourveins]

Status (2026-09-26): cross-family pre-outcome review passed (ready_to_freeze), not frozen

This PR resolves the findings from the 2026-09-26 cross-family (GPT-6) pre-outcome review of the Mover v3 core at main 19092db0. That review returned not_ready with 5 majors and 1 minor. The protocol stays a draft: status: draft_pending_independent_pre_outcome_review, frozen_before_outcomes: false. No outcome dataset, sealed file or result has been opened, and no market data was fetched.

Path to a freeze (unchanged by this PR):

1. Cross-family pre-outcome review passed at 935c32d2 (below).
2. Set the F12 budget values after the native dry run, by a reviewed PR. The dry run needs Alpaca market-data access, which currently returns 401 until the keys are rotated.
3. The freeze commit, once freeze_preconditions hold.

Round 17

Finding	Severity	Resolution	Commit
F1: H3-c counted unadjusted splits as returns	major	h3c_event calls record_exclusion once per overnight leg (t+1..t+5) before counting or valuing any leg	b45f24b
F2: corporate-action exclusions lost issuer identity after a rename	major	Ctx.issuer_records chains the as-known symbol through dated name_change records (same-date chains are independent of row order) before matching split, spin-off and merger records	b45f24b
F3: an exhausted terminal-actions request read as "no actions"	major	terminal_records raises HoldoutRefused; the planner stops expanding past an incomplete terminal request	b45f24b
F4: F12 calibration accepted a dry run with zero timed pages	major	driver._fetch times each transport call; stores carry elapsed_seconds; runner refuses without a valid page calibration	b45f24b
F5: a collector retry could overwrite a sealed snapshot	major	Store.write refuses (SealError) over existing pages or a ledger, and writes the ledger atomically; holdout collection gains recover-if-matching	b45f24b
F6: settlement treated exchange closures as clearing closures	minor	SETTLEMENT_OPEN_EXCHANGE_CLOSED = {2018-12-05, 2025-01-09} from Nasdaq's notices; settlement advances by calendar day in the QuantLib advance(Days) style	b45f24b
Re-review minor: the rename diagnostic still matched old_symbol == sym	minor	Issuer-aware terminal-zero rename diagnostic through Ctx.issuer_records, with a matching protocol rule	935c32d

1961e23 edits protocol-core-draft.json to describe each fixed rule. It also adds seven round-17 review_record entries: six from b45f24b and one from 935c32d.

Evidence

• Study suite (the study's test_command, uv run --no-project --managed-python --python 3.13.15 --with-requirements .../study/runtime-requirements.txt python -m unittest discover ...): 333 tests OK at the base, 358 at 1961e23 and 362 OK at 935c32d. scripts/validate.py passed at 935c32d.
• Test-first fixes: 25 new regressions for the six findings, each failing before its fix. The re-review minor added 4 regressions, 2 of which fail on 1961e23; the other two are boundary guards that pass on both.
• Mutation verification (independent Claude Sonnet, one verifier per finding, each in its own worktree): each verifier reverted its fix's production code. Every finding was fully resolved, with 3 to 8 new tests failing per revert and no regressions.
• Cross-family re-review at 1961e23 (GPT-6 gpt-6-astra, effort max, read-only): F1 and F3 to F6 resolved. F2's original major was resolved, but it found the one wording minor above. 935c32d fixed that in code rather than by narrowing the text.
• Cross-family delta review of 1961e23f..935c32d2 (GPT-6, read-only): VERDICT: ready_to_freeze. It found "no new defect, leak, re-roll path, or analyst degree of freedom". It independently ran the 49 trade tests in the pinned runtime, and running the four new regressions against the pre-fix source reproduced exactly two failures.

Residuals recorded, not blocking (named by the verifiers and judged by the re-review)

• F1: no H3-c test puts the split on the last leg (t+4, t+5], and none mixes a split and a spin-off on different legs. The re-review called these "useful additional coverage, not evidence of an incomplete fix".
• F2: a name_change dated exactly on the event's own asof session is not tested. It follows the stated "after t" rule.
• F3: the exhausted-terminal tests catch HoldoutRefused without asserting its reason.
• F4: runner.py's "no valid page calibration" guard has no direct test.
• F5: after a SealError, count_only dry runs and transport_check refuse a retry into a used directory, and there is no recovery path. This fails closed. Only holdout collection gained recover-if-matching; the others are a follow-up.

SOTA sources

• Nasdaq Trader notice ETA2018-99 (the 2018-12-05 exchange closure; clearing stayed open): https://www.nasdaqtrader.com/TraderNews.aspx?id=ETA2018-99
• Nasdaq Trader notice ECA2024-632 (the 2025-01-09 exchange closure; a settlement day): https://classic.nasdaqtrader.com/TraderNews.aspx?id=ECA2024-632
• Federal Reserve K.8 holiday schedule (bank-only holidays excluded from settlement): https://www.federalreserve.gov/aboutthefed/k8.htm
• QuantLib v1.39 Calendar::advance(Days): https://github.com/lballabio/QuantLib/blob/v1.39/ql/time/calendar.cpp
• Review method: preregistered, code-first pre-outcome review with an independent cross-family reviewer and mutation-verified regressions. This is the repository's docs/acceptance-evidence-policy.md and the protocol's own freeze_preconditions.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.