Mover coverage asof re-collection (R-NOW-1): frozen plan, runner, E2 totals; E1 blocked on pinned private inputs

[seathatflowsinourveins]

Summary

This is roadmap move R-NOW-1. The 2026-09-28 mover research (#463, merged as 11648f9a) found that the v1/v2 candidate set covers 498 of 594 verified +20% events, 83.8% against the protocol's 95% bar. The suspected cause is that bars were keyed by today's symbol, so a reused ticker resolves to its current holder.

Commits (not rebased; see Evidence reachability):

1. 6fb6ddb2 freezes plan.json before any fetch.
2. 291c9909 adds the runner, README and synthetic tests under the frozen plan.
3. 2f32494f adds the post-hoc F2 identity totals outside N2 (labelled post hoc; no estimand changes).
4. 99dfec7c keeps classify outputs independent of the git revision.
5. 7e749b63 adds the E2 run totals, the E1 gate refusal and the manifest registration.

Results

E1, the primary estimand: NOT RUN. It would give covered/594 and a reason class for each of the 96 misses. The gate refused with inputs_missing and sent 0 requests, because the three pinned private inputs (sha256 7e8b6999…, afe22552…, e8ea2dc3…) are not on this host. They are probably on the host that ran the 2026-09-24 study, which is unverified. The runner documents the exact E1 procedure once the inputs are copied in with sha256 checks.

E2, the secondary estimand: RAN. All validity conditions held: the KOD/LFCR positive control passed, the classify re-run was byte-identical, and no row fell in the holdout. Record: blueprints/us-equities/mover-coverage-asof/evidence/summary-asof-20260929.json.

• The 715 package events are dated 2021-01-04 to 2025-12-31. N2 = 594, and it equals the committed tier counts exactly in every tier.
• The frozen candidate rule on the as-of F1 bars passes for 594 of 594 N2 events.
• F2 (each event's own symbol as of 2026-09-21) returns the same issuer's row for 594 of 594; another issuer 0, no row 0.
• What this means: on the re-derived set, neither the touch rule on as-of data nor a reused ticker accounts for any event. That is consistent with the as-of route recovering the misses. But E2 cannot identify the 96, cannot show that N2 is the same event set as the committed 594, and does not substitute for E1.

Evidence reachability

• The evidence cites commit revisions, so this PR is not rebased.
• 6fb6ddb2, 291c9909 and 99dfec7c are protected by annotated receipt-revision/<sha8> tags, pushed 2026-09-29 following the repository's existing convention. They stay reachable after the squash merge deletes the head branch.
• If manifests/evidence.json conflicts, it is resolved by merging origin/main under the docs/lanes.md hot-file protocol (the merge path), not by a rebase.

SOTA sources

• Alpaca historical stock bars: the asof, feed=sip and adjustment parameters, at https://docs.alpaca.markets/reference/stockbars. The pinned client is alpaca-py 0.44.0 (catalogs/us-equities/runtime-target.json).
• The frozen v1 study code reused unchanged: blueprints/us-equities/mover-early-entry/ (candidate rule and coverage), and the Mover v3 publication guard (totals only; no sealed file opened).

Checks

• Independent stack-verifier: approve. It confirmed that plan.json was committed before the runner and results, that the tests pass, that validate.py exits 0, that the committed totals equal a recount of the private outputs, and that nothing per-event or private is in git.
• Run as a systemd-run --user unit (CPUWeight 20, nice 10, MemoryMax 8G), with read-only market data on key pair 1.

Residuals

• (a) E1 is blocked on the pinned inputs. (b) E1's fetch() has never run live. (c) The 1016 KB memory peak systemd reported is implausible and is not a measurement. (g) An upstream evaluate.coverage() leaves file handles open (a ResourceWarning); it is unchanged.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Repair round for the GPT-6 review (gpt-6-astra, effort max, read-only, head 7e749b63, changes-needed with 2 must-fix, 2 should-fix and 1 nit). All of it is fixed in 28a611b3, as one new commit. Nothing was rebased, and the tagged evidence commits 6fb6ddb2, 291c9909 and 99dfec7c are unchanged ancestors.

1. A failed raw, split or auction leg can no longer qualify an event for N2. A shared new_vintage_gain helper applies assess()'s check; such an event becomes fetch_error, outside N2.
2. verify.json is accepted only when it matches. Its kind, plan sha256, estimand, byte_identical and the recorded output and snapshot hashes must all equal the files on disk; a stale or unrelated file is refused.
3. scan_public enforces an explicit aggregate-only schema and rejects symbol-like keys. The review's {"labels":{"ZZQA":…}} probe is now refused.
4. E1 refusal tests cover mismatched candidate hashes and a failed coverage reproduction. In both, the credentials are never read and 0 requests are sent.
5. README now says "Every price request"; the corporate-actions call is named.

Checks:

• tests.test_mover_coverage_asof: 51 OK under the pinned interpreter, 51 OK (6 NumPy tests skipped) under the default one. 34 failures, counting subtests, on 7e749b6.
• validate.py passed.
• The committed E2 totals are unchanged: the repaired classify, recomputed offline from the retained snapshots, reproduces summary-asof-20260929.json byte-for-byte (1258bd04…), and validity.stands stays true. 0 legs in the committed run were non-ok.
• Independent stack-verifier: pass.

Under the bounded-review rule there is one review and one repair, with no second review round.