Mover v3 round 18: pre-freeze residual coverage, seal recovery for dry runs and live samples, ABJK/LPS literature correction — not frozen

[seathatflowsinourveins]

Status (2026-09-26): pre-freeze residuals, not frozen; independent reviews in progress

Round 17 (#351, GPT-6 ready_to_freeze) left residuals: coverage the verifiers named, and one fail-closed usability gap. This PR closes them and makes one literature correction. The protocol stays draft_pending_independent_pre_outcome_review with frozen_before_outcomes: false. No outcome data, sealed file or market data was opened.

Round 18

Item	Kind	Change	Evidence
R1 (F1)	coverage	H3-c split on the last overnight leg; split and spin-off on different legs	pass on unchanged 803bc35
R2 (F2)	coverage	a name_change exactly at asof t, for every Ctx.issuer_records consumer and the terminal-zero rename diagnostic	pass on 803bc35
R3 (F3)	coverage	the exact terminal_actions refusal reason and the planner boundary	pass on 803bc35
R4 (F4)	coverage	a direct test of the no-valid-page-calibration guard	pass on 803bc35
R5 (F5)	production	count_only.dry_run and transport_check.seal_live_samples recover a matching sealed snapshot and refuse partial, mismatched, unbound or altered ones, with no refetch or overwrite (the holdout.collect pattern)	8 tests in test_seal_recovery.py; reverting the two files gives 30 failures and 1 error
Literature	text only	item_set.items[4].why_kept described the LPS 2019 and ABJK 2022 samples together as "large, liquid names"	re-verified from the manuscripts; the test stays two-sided

• LPS 2019 (LSE accepted version): microcaps are always excluded, meaning a price below $5 or the bottom NYSE size quintile. The open is the first-half-hour VWAP.
• ABJK 2022 (JFE 145(3), September 2021 manuscript): CRSP share codes 10 and 11, excluding financials, utilities and stocks at or below $1, May 1993 to December 2017. The effect holds in all but the largest size decile.
• Sweep: a live GPT-6 academic-paper sweep for strategy-research found it (25 verified papers; evidence/artifacts/trading-convergence-20260926/papers-strategy.md, landing in Trading research convergence 2026-09-26: 13 layers, GPT-6 live refutation, verbatim-checked votes (verdict-wave input) #358).

The two new round-18 review_record entries cover R1–R5 and the literature correction.

Checks

• Study test_command: 376 tests OK (359 at 803bc35 plus the new tests).
• R5 revert check: 30 failures and 1 error across the 4 seal-recovery test methods.
• scripts/validate.py passed. The only evidence change is the protocol pin; study code and tests are not hash-listed.
• Authorship: GPT-6 (gpt-6-astra, effort max) implemented R1–R5 test-first. The coordinator verified them and renamed one local variable in dry_run that shadowed the imported core.identity module. The coordinator made the literature correction.
• Reviews in progress: an independent read-only Claude review (Opus) of the whole delta, and a GPT-6 read-only live-search delta review as the pre-outcome reviewer of record.

Path to a freeze (unchanged)

1. F12 budget values, set after the native dry run by a reviewed PR. The dry run needs Alpaca market data; paper keys currently return 401.
2. The freeze commit, once freeze_preconditions hold.

SOTA sources

• ABJK 2022: doi:10.1016/j.jfineco.2021.09.019 (manuscript: Akbas, Boehmer, Jiang and Koch, September 2021)
• LPS 2019, A tug of war: https://eprints.lse.ac.uk/87481/
• core.holdout.collect recover-if-matching at 803bc35 (this repository), the pattern R5 follows

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[seathatflowsinourveins]

GPT-6 cross-family pre-outcome review of af38dce (gpt-6-astra, effort max, read-only, live search): VERDICT: ready_to_freeze.

1. R5 is safe. Recovery validates the seal, the exact binding, the canonical requests and the request/stamp coverage. Matching recovery performs no fetch or write, and mismatches refuse.
2. The literature correction is accurate and text-only. Live searches confirm LPS's microcap exclusions and 9:30–10:00 VWAP open. They also confirm ABJK's rules: common shares with a previous month-end price above $1, financials and utilities excluded, and significant hedge returns outside the largest size decile. No statistical rule, arm, horizon or threshold changed.
3. No new freeze blocker. Its sandbox couldn't run the pinned suite (uv cache lock), so the 376-test result remains the coordinator's evidence.

The independent Claude review is still running.

[seathatflowsinourveins]

The independent Claude review of round 18 was interrupted by a Claude session limit (HTTP 429, resets 22:10Z). R1–R5 were written by GPT-6, so the cross-family review must come from Claude; no other reviewer substitutes. This PR waits for that review before merging. Nothing is time-critical: the freeze is blocked on the market-data dry run in any case.

[seathatflowsinourveins]

Independent pre-outcome reviews and repair (trading lane, 2026-10-01)

Head is now 406ad3c5: four repair commits on af38dced, then a merge of main at 3361b342 under the docs/lanes.md hot-file protocol (fast-forward push, no force). The protocol status stays draft_pending_independent_pre_outcome_review; nothing here reads an outcome.

Reviews of 803bc3514ef0..af38dced

Review	Finding	Severity
Claude Opus, effort max, read-only (2026-09-30)	H1. The dry-run seal binding had no study tree, so a later tree could adopt an earlier tree's sealed snapshot without fetching.	high
	M1. fetch_date was part of the matched identity but came from the current run, so a rerun on a later UTC day was refused for good.	medium
	L1–L5. Attempt-stamp comparison; refusals that escaped SealError; a subTest that never reached its label; a citation of a file that is only on #358's branch; a stale tree and test count in run_discipline.	low
GPT gpt-6.1-sol, effort ultra, native Codex 0.159.2, read-only (2026-10-01 00:03Z)	G-H. Recovery trusted a digest it computed from the files it was checking. In the reviewer's synthetic run, a replaced page with matching ledger digests was adopted and turned passes=false into passes=true.	high
	G-M. Two recovery controls survived the tests as mutants (request-record equality; the source binding in the live digest).	medium

The GPT review also confirmed the literature correction against the primary manuscripts: the LPS 2019 sample definitions (eprints.lse.ac.uk/87481, §3 pp. 9-10) and the ABJK 2022 ones (September 2021 manuscript, §3 p. 10 and §4.2.2 p. 18).

Repair (Claude Opus builder, test-first)

Commit	What
7e07e7ae	Failing-first command tests for H1 and M1.
f693df24	seal.json, written once at seal time before the ledger: ledger sha256, binding, completion stamps, every page sha256, attempt and page counts. core.store.recover_seal reads the ledger under the recorded digest. Each seal binds the study tree, protocol sha256 and runtime-lock sha256. The fetch start is stored and read back, never matched. Every refusal is a SealError.
5a1d4b0e	Protocol text, one review_record entry for both reviews, the #358 citation, the test record.
1e3fd5a1	Follow-up after an independent Opus verification passed the repair with five low findings (four repaired; the fifth was an untracked cache directory).

A GPT builder was not used: the native Codex login reached its usage limit at 2026-10-01T00:04:04Z, before any edit.

Checks at 406ad3c5

Command	Exit	Result
The study's own test command (uv run … python -B -m unittest discover -s blueprints/us-equities/mover-v3/study/tests -t blueprints/us-equities/mover-v3/study)	0	Ran 395 tests, OK (376 before the repair)
python3 scripts/validate.py	0	passed
python3 scripts/evidence_manifest.py --check	0	8655 files

• Study tree: 6cb88f03b45fad24f0fb95568b21e2834b9cdc17, the tree the protocol's run_discipline names.
• Mutants, each killed by a named test (in review_record): study tree removed from the dry-run identity; fetch_date matched again; the plan-change check removed; recovery hashing the current ledger; request-equality checks removed; source binding omitted; page_sha256s emptied in seal_record_of.

Residuals (recorded in review_record, not repaired)

• seal.json is a write-once file inside the snapshot directory, not an external anchor. A consistent rewrite of both the ledger and seal.json that keeps the binding, the request plan and the requests is adopted.
• core.holdout.collect reads its seal under a digest of its own ledger. This predates round 18.
• Orphan-output adoption verifies seals against the sha256 values the output body names, not against seal.json.
• No GPT re-check of the repair. The shared pool is exhausted and native Codex runs are paused for Gate A. The repair's second read is the Opus verification above.
• The round-18 literature entry cites papers-strategy.md at Trading research convergence 2026-09-26: 13 layers, GPT-6 live refutation, verbatim-checked votes (verdict-wave input) #358's commit 7e29448d. Trading research convergence 2026-09-26: 13 layers, GPT-6 live refutation, verbatim-checked votes (verdict-wave input) #358 lands before this PR in the merge train; the citation is updated to the repository path at this PR's slot.

[seathatflowsinourveins]

Cross-family re-check of the repair, second repair and verification (2026-10-01)

Head is now 56bbb2cd: ten commits on 406ad3c5 (fast-forward push), the last re-registering the protocol in manifests/evidence.json. The branch is re-merged with main at its train slot. Protocol status stays draft_pending_independent_pre_outcome_review; nothing reads an outcome.

1. GPT re-check of the first repair

• Reviewer: gpt-6.1-sol, effort max, Codex 0.159.2, read-only, packaged lane on OmniRoute; 03:42–04:18Z.
• Verdict: changes-needed, 4 findings, each reproduced by the reviewer and confirmed by me in source.
• Confirmed by the same read: all seven mutants of the first repair are killed, and its three stated residuals are accurate.

#	Severity	Finding
R2-1	high	A seal record whose ledger_sha256 is JSON null turns ledger verification off (Store.read skips the comparison when the expected digest is None). The reviewer's probe adopted an edited ledger.
R2-2	high	running_tree trusted git status, which hides tracked files marked assume-unchanged or skip-worktree. A changed transport could run under the committed tree's identity and adopt an earlier seal.
R2-3	medium	A regular file at a snapshot path was treated as unused: the run fetched again, then failed with NotADirectoryError, not a SealError.
R2-4	medium	Two stamp controls survived as mutants: the attempt id in the seal record's stamps, and Store.read's second-stamp refusal.

2. Second repair (Claude Opus builder, test-first)

Commits.

Commits	What
28fafe84, f1fcffe1	R2-1: the record's ledger_sha256 must be 64 lowercase hex before any read. R2-2: running_tree refuses index entries marked assume-unchanged or skip-worktree (git ls-files -v) and hashes every tracked study file against HEAD's blob (hash-object --no-filters). R2-3: a non-directory snapshot path is refused before any fetch. R2-4: tests for both stamp controls.
ba106834, 7acb6944	The builder found that a replace ref on HEAD's study tree fooled the content check; tree blobs are now read with --no-replace-objects.
89f64e24, cd36752e, ace56485	Two gaps of the same class, closed on my follow-up. F1: a snapshot path is unused only if it is absent under a directory or is an empty directory; anything else is refused as a SealError before a fetch. F2: one builder, git_command, runs every git command of core/guards.py with --no-replace-objects (including committed_bytes and the transport-deviation diff).
50fd6836, 850a3d9c	After the verification below. T1: the --no-filters test now uses a basename attribute pattern, so git really filters the absolute path running_tree passes. T2: the index-flag refusal says how to clear the bits.
56bbb2cd	Manifest re-registration.

• Final study tree: cc7ecaecfc0207b61bd20fa4178bfa6769bbc857, named by draft_tree_at_this_revision, test_record and freeze_acceptance entry 7.
• Protocol changes: one new review_record entry, sentences appended to run_discipline.study_code.rule, and those pins.

3. Independent verification (Claude Opus, read-only, at ace56485)

• C1–C6 confirmed:
  • full suite 418 OK;
  • pins and scope correct;
  • each GPT finding re-probed and closed: 18 digest cases, 5 index-flag cases, 7 path cases, both stamp mutants;
  • every named mutant killed;
  • one git builder.
• C7, new issues:
  • one medium test gap: no test protected --no-filters. The test's anchored attribute pattern never applies to the absolute paths that hash-object --stdin-paths receives. Fixed as T1, and the mutant is now killed.
  • one low: the core.ignoreStat refusal message was misleading. Fixed as T2; the refusal itself is by design.
  • one informational point.

Checks at the final tree

Command	Exit	Result
The study's own test command (full suite)	0	Ran 419 tests, OK (395 before this repair round)
python3 scripts/validate.py	0	passed
python3 scripts/evidence_manifest.py --check	0	8655 files

Residuals (recorded in review_record)

• No GPT read of the second repair. The OmniRoute pool account read 92 of 100 at 08:09Z, and the remaining points went to closure-synthesis reviews that had no other second-family read. The independent Opus verification re-ran the same probes.
• running_tree checks once per run: a file changed later in the same run is not seen, and the executable bit is not compared.
• A core.worktree pointing at another clean copy hides an extra untracked file from git status. A changed tracked file is still refused in that state.
• An operating-system error while Store.write writes after a fetch is not a SealError.
• .git/info/grafts (deprecated, still read by git 2.43) can alter commit parents for the history guards. Noticed by reading, not probed.
• Line endings depend on the repository root .gitattributes, which is outside the study tree hash. There is no false refusal in this repository's configuration.
• Host hygiene: each full-suite run leaves mover-v3-test-gnupg-* keyrings with running gpg-agents under /var/tmp, because the atexit cleanup in tests/fixture_repo.py does not run in some processes. More than 120 remain on the trading host. This is a test-harness issue for a follow-up, not part of this PR.