fix(trading): enforce Alpaca paper admission and recovery guards

[seathatflowsinourveins]

Scope

The mover could begin another trial without reconciling cash, and its final order guard could use the stream watchdog instead of the frozen three-second quote limit. This change enforces cash reconciliation and recovery binding, reserves request capacity for control operations, and checks integer nanosecond quote age immediately before both BUY and SELL requests.

• Base merged: cac8700ba914950266272347468bff7ad630a4bf.
• Reviewed owned-source basis: dcae68bd08a191f37ba564eceda9fc4a9d6d4a6e.
• Published head: 90ff7dfac155983ba010608d6f484dfd243d731b.
• Lane: lane:trading.
• Owned paths: blueprints/us-equities/adaptive-paper/{safety,mover_runner,transport,runner}.py, tests/test_adaptive_paper_mover_native.py, and tests/test_alpaca_admission_regressions.py.

The main merge completed without conflicts. The six owned files remain byte identical to the independent Astra/max source acceptance. The diff against merged main is six files, 492 additions and 19 deletions.

Independent Astra/max has also renewed the source ACK on this exact published combined head. Recorded review. Registry HOLD remains; the resulting registered head still needs normal validation and exact-head review before a new freeze.

SOTA sources

This bounded repair follows the selected maintained implementation, rather than adding a broker interface or dependency:

• Existing mover admission at dca821cca85dce3647fa7b488d5a23fbe5b85d4a, strict cash baseline, and recovery binding.
• Existing atomic budget and last wire guard.
• Alpaca SDK REST implementation, cc4cb3b7ba50ae250e621983c2779047fb16bb28 and Python 3.12 integer nanosecond clock.

Installed runtime pins remain Python 3.12.3, alpaca-py 0.44.0 and NautilusTrader 2.0.0rc5.

Evidence-class table

Claim	Evidence class	Evidence
Cash mismatch refuses the next trial; recovery checks configuration binding under the account mutex	source_review / synthetic	Independent Astra/max review and dedicated offline cases
Atomic submission capacity is min(submit_cap, total_cap - 20) with no attempt mutation on deferral	source_review / synthetic	Independent budget judgment and offline transaction cases
Final BUY/SELL wire admission uses the unchanged three-second quote age and 250 ms future allowance	source_review / synthetic	Boundary and late-aging cases; PRE/EXT stream watchdog remains 30 seconds
Six owned files preserve accepted bytes after merging main	local_integration	SHA256 and byte comparisons, all six matched
Earlier affected suites passed 512 methods, plus 15 dedicated methods and 38 case artifacts	synthetic	Retained offline receipts; unchanged owned inputs, not a new broker run
Repository publication validation (2026-10-03, prior attempt): blocked by five stale registry rows, and the new test was unregistered	local_integration	Native scripts/validate.py, exit code 1 before and after the cac8700ba merge
Repository publication validation at the registered custody head (2026-10-04)	local_integration	scripts/validate.py exit 0, scripts/evidence_manifest.py --check exit 0, merge-tree landing check exit 0 at 9ca3fc7a5 (merge base 780bf5d05)

Local commands run

On 2026-10-03, before the custody registration, python3 scripts/validate.py returned exit code 1 for SHA256/byte bindings on the four production files and the existing mover test. The new test has no pre-existing row. The shared manifest remains unchanged; its custodian must register the final combined source before merge acceptance.

git diff --check returned exit code 0. The native pre-push hook passed its three registry/security coverage tests, exit code 0.

A host-Python discovery command returned exit code 0 with all 15 cases skipped because that interpreter lacks the pinned combined runtime. That attempt is INCONCLUSIVE and is retained separately from the passing pinned-runtime evidence.

After the merge, the pinned runtime ran -m unittest -v tests.test_alpaca_admission_regressions: 15 methods, zero skips, exit code 0, and 38 retained case observations. Output SHA256: 7619b7fc591115843c41ded23c48264a8911237c9bf2843689c2cdb8f131f13f. Source hashes remained unchanged during execution. This is fresh offline synthetic integration evidence, not paper broker qualification.

Decision record

Frozen bounded design and independent handoff are recorded in CODEX-ALPACA-PAPER-ADMISSION-DESIGN-20261003.md and CODEX-ALPACA-ADMISSION-SOURCE-HANDOFF-20261003.md in the private coordination lane. The final combined head still needs review and corrected registry bindings. This PR remains a draft until those gates are satisfied.

Host evidence

No host receipt or broker acceptance is added. These tests use independent fake broker observations. Full native fees, fills, kill/restart recovery and cash acceptance remain unqualified. The ledger's float timestamp limitation and account-discovery GET before recovery binding remain disclosed.

Monday's order writers remain held. A reviewed combined head and a new freeze are required before any broker request and before 2026-10-05T11:00:00Z. The old Account 2 numeric risk halt and all original journals/results remain intact.

Checklist

• No credentials or authentication files were read, printed or copied.
• No live endpoint, paid service, dependency change or broker request was introduced.
• Peer-owned worktrees and shared manifest paths were preserved.
• Shared registry bindings corrected by their custodian (2026-10-04: all six owned files registered in the last commit).
• Combined head reviewed and a new Monday freeze recorded before writer release.

Custody refresh, 2026-10-04

• Registered. 9ca3fc7a5 merges main 780bf5d05 cleanly and registers all six owned files in manifests/evidence.json, in the last commit. The diff against main is now seven files, the six owned files plus the registry; their content is unchanged from the reviewed head 90ff7dfa (non-registry patch-ids equal).
• Cross-family read. Claude Opus returned ACCEPT with four P2s.
• Repair round. GPT-6.1 Sol, commit 27281f5d3, then registry-last commits:
  • a missing or null stored baseline now refuses as next_trial_baseline_missing, and a malformed one as next_trial_baseline_invalid. Both are receipted not_started, with tests.
  • README-mover.md and README-safety.md describe the kept lineage baseline, the next_trial_cash_mismatch refusal, its shared-account consequence, and that recover must receive the trial's exact --config bytes.
  • Recorded decision: recovery stays bound to the whole frozen config, which fails closed. A trial that needs a longer stream watchdog for recovery is frozen with that value from the start, and the recover30 copy stays as dated history.
• Tests. The two test modules ran 44 tests: 3 passed and 41 were skipped without the pinned combined native runtime. That runtime is absent on this host and in hosted CI, so the native regression tests remain unexecuted here.

[seathatflowsinourveins]

PR #667 combined-head source ACK

Independent Astra/max renews source acceptance at exact head 90ff7dfac155983ba010608d6f484dfd243d731b, after the clean merge of main cac8700ba914950266272347468bff7ad630a4bf. Consequential judgment trigger: preserving deterministic cash, recovery, request capacity and quote guards in the combined Monday candidate.

All six owned files match the previously accepted handoff hashes and sizes; the diff against merged main is six files, 492 additions and 19 deletions. Main introduced no interaction in the adaptive-paper runtime or existing mover test paths since the original acceptance base. The reviewer ran no tests.

The accepted source preserves cash continuity and the original baseline, frozen recovery binding under the account mutex before Ledger initialization and durable reservations, twenty control request slots, and integer nanosecond quote admission at the last BUY/SELL guard. Read-only recovery preflight precedes configuration binding; there is no before-all-broker-reads claim. Trial rollover still refuses the old Account 2 halt and exhausted numeric budgets.

Fresh pinned-runtime offline evidence: 15 tests, zero skips, 38 observations, exit code 0, output SHA256 7619b7fc591115843c41ded23c48264a8911237c9bf2843689c2cdb8f131f13f. Prior 512-test evidence is reused with unchanged source inputs. The host-Python 15-skipped attempt is retained as inconclusive.

Registry HOLD remains: normal validation returned exit code 1 before and after the merge, with five stale existing SHA256/byte bindings. The shared manifest is byte-identical to merged main. Its custodian must register the four production files, existing mover test and new regression test, and return actual normal validation at the resulting exact head. This source ACK supplies no whole-PR acceptance, broker qualification, new freeze, Account 2 halt reset or Monday writer release. Ledger timestamp precision and full native fault-matrix acceptance remain open.

Primary immutable sources: cash continuity, recovery binding, submission budget, last wire guard, and halt preservation.

[seathatflowsinourveins]

Exact-head FINDINGS / registry HOLD at 90ff7dfac155983ba010608d6f484dfd243d731b. PR667 is DRAFT. The source ACK preserves this hold; it does not establish broker readiness, a new freeze, Account2 reset or writer release.

Root independently verified the six complete current sources and their byte/SHA identities against the declared sanitized handoff. Five existing baseline files are Git-identical across engine dca821cca85dce3647fa7b488d5a23fbe5b85d4a, prior accepted base dcae68bd08a191f37ba564eceda9fc4a9d6d4a6e and CAC. This supports bounded source identity, without authenticating private review/test executions.

The actual validate job, bound to this head, failed python3 scripts/validate.py with exit 1. Original log763–778 reports SHA256 and byte-count mismatches for mover_runner.py, runner.py, safety.py, transport.py and tests/test_adaptive_paper_mover_native.py. Root independently derives the same five stale registrations from the complete public bodies and registry. New tests/test_alpaca_admission_regressions.py is also unregistered. This is publication/evidence integrity failure; the trace shows no upstream test failure. The pinned validator defines these checks.

The custodian’s concrete repair is to register those six owned current files and preserve the actual current-main composition before rerunning the required validator. The head registry equals CAC; captured main 1f5a791b02a230aced670c88bab3d3d0ebcf401a has a newer dashboard tuple. The later posting guard sees main 463a57b983eec540ae90eb45c2b1a7c6fc469aed. Preserve all newer main additions, every foreign row/order and existing receipt/convergence records. Raw branch staleness does not prove a future three-way merge deletes a newer row, and this finding does not require a rebase. Root has made no Claude-lane or trading edit.

Source manifest SHA256 58009288884de8470457ab4e1b4f3836d063568d9de08470e0fe138576d03ec0; actual CI log103014B SHA256 b3bc902cdc2ac7050d91b5e1dfdac74de10e77776e55c0beebcacca0f388fea5. Root verified 86 original bindings, 18 full Git bodies and all six registrations. Captures retain initial native escape-guard1 and supported recovery0; 34 other source calls0. No validator/test, model/provider, broker, freeze, account reset, writer or credential operation was run by this review.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head d2e446f63f2ee8d3d502b8db803b3f04da0fc46e. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at 9ca3fc7a5b97; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with no P1 item.

Observed main ba1f6876cf43ece4cbaae3a940df8c4f3698c60b. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main ba1f6876cf43ece4cbaae3a940df8c4f3698c60b head d2e446f63f2ee8d3d502b8db803b3f04da0fc46e base 780bf5d0508760b2494995493d9246efd74d614d merged-tree e9e60fbad2eb9e7bf81d5d1a5aaa01172d307203 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 10, outside PR-owned 0 []
ok   3: main drift 178 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 9, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (9980 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree e9e60fbad2eb9e7bf81d5d1a5aaa01172d307203)

Required checks at this head: 8 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as 2fea42376d282463f935f13c6c1b356419df0ed0 (parent ba1f6876cf43ece4cbaae3a940df8c4f3698c60b), tree e9e60fbad2eb9e7bf81d5d1a5aaa01172d307203. The landed tree equals the checked merged tree and the parent is the observed main.