North-star audit

Status at 2026-08-26 10:40 UTC

• PR #301. P6+P7 merged; migration 20260825130000 applied.
• PR #304. The G0 fix merged; migrations 20260825160000 and 20260825161000 applied.
• Daily lane. Reviewer re-enabled; the first complete daily cycle refused 08-24, and the first evidence root passed 08-21 — three verdicts.
• PR #305. Ingestor pause-classification deployed as generation 577.
• PR #306. P8 merged.
• PR #307. P9+P12 merged; migration 20260825140000 applied; 19 rounds re-keyed.
• PR #303. SIP monitor merged; migration 20260825170000 applied; first closed_standby receipt at 10:28Z.
• PR #308. Touch-and-Turn sealed and refuted; primary record: docs/research/touch-and-turn-primary-2026-08-26.md.
• PRs #309/#310. First-hour wave 1 sealed in 12m26s; null result under the preregistered rule.

Original audit — 2026-08-25

TradeGG · read-only audit · 8 lenses · 2026-08-25 21:00 UTC · main 696c0e6 · prod head 20260825150000

Hundreds of live real-money algo traders. Realtime is the product.

Verdict. Every lane is built and sealed; none is running toward the north star. 0 of 126 forward sessions banked, 0 survivors from 15,047 search attempts, and the only lane that can bank forward evidence structurally burns its positive-return days.

Legend: Exists · Partial · Missing · Blocked

Changed during this audit — verified after the lenses closed

• SIP feed restarted by hand. Machine d89513eb252278 updated 20:53:22Z; receipts resumed 20:56:16Z after a 6h51m outage.
• Feed recovered 20:59:06Z. Heartbeats resumed at source_sequence 262,595; generation 576 active, liveness passing.
• Publisher was disabled, not down. The 18:02 redeploy reset the machine to fly.toml's false; override restored 20:54:11Z.
• Session 2026-08-24 published 20:59:37Z. Manifest ffe46ee1a595ca99…; 08-25 stays unsealable until the gap repair is proven.
• Reviewer lane disabled 21:03Z. Dispatch is eligible_now on 2026-08-24; review jobs queue without burning retries.
• Wave-1 slower than estimated. 23m05s elapsed with no 2,560-unit checkpoint implies ≥6h, not 2.4h.

What shipped today

Ledger

2026-08-25, in order. Four of today's largest work products exist only in /private/tmp with no remote.

Stage summary: 2026-08-25

Evidence · git log main 696c0e6 · gh pr list (only #301 open on the search line) · git ls-remote origin 'claude/*' returns none of the four branches · prod supabasemigrations.schemamigrations max 20260825150000.

Corpora & custody

Stage 01 · Data

Two flagship corpora are byte-exact in two sites each. Everything downstream of them is thinner than the seals suggest.

Stage summary: Partial · 6 packets · 7.75 days

Facts

• Discovery-D sealed twice. 302,915,331 bytes, 40 chunks; all 40 sha256 re-verified server-side in prod.
• Daily corpus/v2 tracked in git. 2,513 sessions, 5 symbols, 120-session holdout 2026-03-02→08-20.
• The holdout has never been read. holdoutView() has zero production callers — only two test call sites.
• Sharadar snapshot complete. 45,324,177 SEP rows, 687,712 actions, census fit-gate true, 0 coverage gaps.
• Exact-40 panel mirrored. 290,550 rows / 149 sessions / root 670179c9, prod plus 251 MB local.
• Backups exist. 8 daily physical backups, 2026-08-18→08-25; database 1,814 MB.
• Custody rows are immutable. Delete, update and truncate triggers fire ALWAYS on the seal tables.

Gaps

• Renewable SIP lane near-empty. 1 sealed snapshot ever; 4 publication attempts total.
• Validation panels absent. 0 of 3 exist; the code throws "remain pending correction/reseal".
• Sharadar has no prod binding. No %sharadar% table; 0 Storage buckets, 0 objects.
• G-DATA-2 and G-DATA-3 have no code path. SHARADAR_TABLES is a closed three-table union.
• 2018 SIP reach unproven. Only a pull back to 2025-03-04 is documented anywhere.
• Three universes in play. Only NVDA is common to Discovery-D, exact-40 and daily corpus/v2.
• No downloader, no credential. The prod copy has an uploader only; the custodian URL is not on this machine.

Next packets

Risks

• 10.6 GB is single-site. Time Machine destination will not mount; last stable snapshot 2026-07-09 predates Sharadar.
• The prod copy is write-only today. Grants are postgres-only; no downloader exists, so it is not a recovery path.
• Refreshing the daily corpus rotates the holdout. The only refresh path rebuilds from Yahoo with a new 120-session window.
• index.json bytes ≠ sealed raw bytes. SPY records 60,386,759 against a sealed 60,376,866 — a verifier tuned to it fails closed.

Evidence · prod research.firsthourcorpuschunksv1 40 rows, sha256 verified · supabase/migrations/20260823260000firsthourcorpuscustody_v1.sql:78-95 · lib/paper/corpus/index.ts:311-368 · scripts/build-paper-corpus.mjs:305 · lib/data-sharadar/types.ts:3

Search factory

Stage 02 · Search

Switched off for seven days. The gate is not what stopped it — every scored candidate failed buy-and-hold.

Stage summary: Partial · 8 packets · 14.6 days

Facts

• Off since 2026-08-18 22:02Z. 19 rounds ever; the cron route is a 410 tombstone.
• Lifetime output re-verified at 21:00Z. 15,047 attempts, 367 scored, 0 survivors.
• Every rejection is BELOW_BENCHMARK. Round 19: 20 of 20 scored failed the excess gate.
• genome/v2 merged. 48 proposals, 32 elite + 16 novelty slots, seen-filter wired.
• Runner fully written, never deployed. No Fly app tradegg-orchestrator-runtime exists.
• The image strips the holdout physically. Build asserts 2,393 sessions and writes holdoutSessions 0.
• Composite-PK migration unapplied. Prod PK is still round_number alone; all 19 rows are SPY.

Gaps

• P14 is not on main. Main still runs the dimensionally-broken attempts-vs-this-round gate.
• P14b is unwritten. The lane is a hard-coded stub returning 'discovery', so promotable is false by construction.
• ~2,600 lines live in /private/tmp. P8 and P9+P12 have no remote branch, no PR, no CI, no panel.
• No throughput measured on Fly. Every attempts/day figure derives from a local Mac-core probe.
• daily-genome-v2 has no registry row. The migration seeds it inactive; promoting it is the on switch.
• Forward machinery is shape-locked to 40. A multi-family winner has nowhere to land.

Next packets

Risks

• Sequencing is the danger. Deploying P12 before P14 grows the pooled denominator ~62,500/day against ≤2.4 survivors/round.
• A running factory reads as failure. Lane is hardwired to discovery, so every record says promotable:false by design.
• Idle looks identical to crashed. No alert distinguishes "no eligible policy" from a dead supervisor.
• Nothing is edge. 15,047 attempts measure throughput and gates only — not markets.

Evidence · prod public.orchestratorrounds 19 rows, Σ candidatesScored 367, Σ ranked 0, round-19 rejected {BELOWBENCHMARK:20,NOTRADE:3,INSUFFICIENTTRADES:1} · lib/paper/orchestrator/round.ts:568-570 · score.ts:124,177,187-195 · app/api/cron/orchestrator-round/route.ts:31-33

Daily research lane

Stage 03 · Daily

Not wedged at the dispatcher. It rejects positive-return sessions and completes losing ones — and 08-24 is now published.

Stage summary: Blocked · 7 packets · 4.5 days

Facts

• One cycle ever, and it failed. Dispatched 20:05:35Z, terminal 20:34:59Z, three identical store CONFLICTs.
• Steps 1–4 were clean. 40 bot outcomes and 40 verifications, all verdict verified.
• Root cause is a forbidden key read. The gate function reads verified_outcomes_hash from a 4-key tool output that never carries it.
• So the hash is always NULL and the coverage guard raises P0001 unconditionally.
• The defect is sign-conditioned. Excess ≤ 0 refuses and completes; excess > 0 passes the gate and burns.
• This session was positive. Exact equal-weight excess +0.0095184216.
• A second defect is latent. The pass path selects a receipt nothing inserts — fixing one alone yields P0002.
• 2026-08-21 is unrecoverable. Unique index, absorbing failed status, append-only failed job.
• Forward evidence stands at 0 of 126.

Gaps

• The lane cannot explain itself. Every assertion failure collapses to the token CONFLICT — no SQLSTATE, no function name.
• The test fixture is not contract-legal. It writes a 5-key verify output directly, bypassing the assertion.
• Backfill status is unruled. Whether a late-dispatched session counts as forward evidence is undecided.
• Dispatch cadence is 2-hourly while the lane ticks every 5 minutes — catch-up drains at ≤12 sessions/day.

Next packets

Risks

• Anti-survivorship ledger. Left running, the forward record accumulates only flat and losing sessions and looks honest.
• 08-24 is published, the burn deferred. Reviewer lane disabled 21:03Z; jobs queue without consuming retries.
• Every burned session is permanent and pushes the 126-session floor out one trading day.
• A partial fix looks like progress and converts CONFLICT into UNAVAILABLE while still burning days.

Evidence · prod research.workflowjobhardfailures retrybudgetexhausted 20:34:59.644861Z · research.dailyresearchcycles 1 row, status failed · getdailyresearchdispatchhealth() 21:00Z policy daily-five-stock-sip-v3, candidate 2026-08-24, eligiblenow, lagging 1, stalled [2026-08-21] ·supabase/migrations/20260822150000graduationgate_g0.sql:994-999 · lib/paper/research/capabilities/fixed-tools.ts:1545

First-hour lane

Stage 04 · Realtime

The stated product. The adapter that blocked it works, wave-1 is executing, and none of it is on a remote.

Stage summary: Partial · 8 packets · 7.6 days

Facts

• ACTIONS adapter is real. 32 rows admitted, independently re-counted — all dividends, zero splits.
• Wave-1 is running now. PID 59162, 80 cells, 40,960 units, started 20:35Z.
• Its work domain matches prod exactly. 14ca4d1f… equals the sealed operational manifest hash.
• The fleet finished 81,920 receipts. Integrity hashes only — no scored outcomes, no returns, discovery:false.
• The scientific boundary is in code. Claim status is no-claim/selection-data-only, not just a log line.
• Family frozen at G0 since 2026-08-23 02:35Z. One receipt row, no transition ever written.
• orders_allowed=false is a DB CHECK across six migrations, not a runtime flag.

Gaps

• Nothing is pushed. Both branches and 5 untracked files exist only under /private/tmp.
• acquisitionof is unmapped. Four such rows sit in the validation windows; the adapter throws UNSUPPORTED_ACTION.
• Split handling is untested. Discovery-D has zero splits; the five real splits land in the promotion panels.
• P4, P5 and P6 are untouched. No v2 selection, no panels, no family-transition writer, zero callers of the graduation RPCs.
• Panels need ~900 MB of new bars. 1,536 sessions × 5 symbols, and the raw index is ragged (GOOGL: 2 sessions in 2020–22).
• No forward runtime, no owner-arming step. The forward-v3 app is suspended and knows nothing of first-hour.

Next packets

Risks

• Custody is the highest risk here. One tmp reap destroys ~1,300 lines plus the in-flight run.
• The run has no checkpointing. Artifact then manifest are written at the very end; a kill at 90% loses everything.
• P5 is bigger than one day. It is corpus import, session resolution, three seals and a vocabulary fix before any science.
• 81,920 receipts are a laundering hazard. They prove determinism, not positive-return evidence, and read as progress.
• Committed config says the fleet is off while it demonstrably ran — the same drift that enabled the 9-day freeze.

Evidence · lib/paper/reference/sharadar-actions-corporate-action-source.ts:216,230,244 · FIRST-HOUR-PREREGISTRATION-DRAFT.md:73-80 · prod research.firsthouroperationalunitreceiptsv3 81,920 rows · research.researchfamilystatusreceipts 1 row · first-hour-continuation-v1.ts:41-43,132-134

Broker path & guardrails

Stage 05 · Broker

Fully built, schema applied, never run. The approved arming quantity is the one case with no pre-trade check.

Stage summary: Blocked · 6 packets · 10.5 days

Facts

• Code merged, schema live. 3,123 LOC; prod holds 12 tables, 30 functions, 2 roles.
• Neither gateway can log in. Both roles have rolpassword NULL.
• The Fly app has never been created. No boot receipt, no account snapshot, no attestation.
• Every evidence table is empty. Roster, intents, orders, receipts, refusals: 0 rows.
• Arming is structurally impossible. forward_deployments_v3 is empty, so any roster insert refuses UNKNOWN_DEPLOYMENT.
• Live-endpoint pinning is defended in six layers and no live-money order code exists anywhere.
• Halt has two channels and both cancel-and-flatten, escalating to a position delete.

Gaps

• qty === 1 skips the only pre-trade gate. That is exactly the owner-approved arming quantity.
• No notional cap anywhere. The forward layer's max_notional_minor is dropped at the mirror boundary.
• No daily-loss cap, no drawdown breaker. Nothing halts on producing negative returns — only on structural anomalies.
• Share bound is a detector, not a limiter. It runs on a 60-second reconcile sweep.
• Multi-account is schema-blocked. account_slot CHECK = 1, one roster row per symbol: 5 deployments maximum.
• The realtime lane has no broker path. The mirror is CHECK-pinned to t+1 replay.
• No liveness surface. fly.toml exposes no health endpoint; restart policy would mask a crash loop.

Next packets

Risks

• Arming today means zero pre-trade risk evaluation. Acceptable on paper; unacceptable as the pattern promoted to real money.
• The schema implies a cap that is not honoured. A reader of forwarddeploymentsv3 will assume end-to-end enforcement.
• Panic-flatten uses market orders with no slippage bound and no limit ladder.
• The keypair is shared with the SIP ingestor. Rotating it on the mirror path takes down the price feed.
• Nothing here scales. Honest capacity is 5 deployments on 1 account — a schema redesign, not an increment.

Evidence · services/alpaca-paper-mirror/src/scheduler.ts:115 · supabase/migrations/20260824030000brokermirrorv1.sql:346,347,353,391,977-985 · prod pgauthid two papermirror roles, rolpassword NULL · fly apps list — no tradegg-alpaca-paper-mirror · prod brokermirror evidence tables 0 rows

Lab UI & honesty

Stage 06 · Surface

The design track shipped and lhr1 is live. The largest, greenest number on the site is a best-of-40 backtest.

Stage summary: Partial · 7 packets · 8 days

Facts

• All 20 probed routes return 200 signed-out, and the signed-out gate leaks no counts or names.
• lhr1 is genuinely live. Edge and function both London; 62–80 ms warm gate.
• Board is DB-driven. 29 tracked: 21 idea, 5 noedge, 1 quickcheck, 1 readytotest, 1 parked.
• Zero in testing, zero survivors — and the registry trigger makes that structurally true.
• Absence discipline is real. Empty states render dashes with an explicit "never zero, never an example" note.
• The owner record is source-bound. 455 of 455 numeric tokens verified verbatim.

Gaps and honesty defects

• Hero is survivorship-selected. Best of 40 bots, green, 30px; the "no edge" family verdict sits at 10.5px muted.
• Board tells the owner to build a built thing. "next: evaluator build" renders from a 2026-08-23 row.
• Two screens contradict each other. Forward shows 1,283 verified batches; strategies shows 0/80 attempts.
• Changelog stamps 2026-08-24 over a 22 Aug entry; docs say "Seven ideas tested" against 29 tracked.
• /docs/record is ungated. 313,698 bytes of realised broker results, edge-cached, no auth call.
• No member tier. Access is binary; 4 approved readers see a disabled Ask card.
• No per-trader anything. No scored outcomes, no exposure, no kill state on any lab screen.

Next packets

Risks

• The front page implies edge. A green best-bot figure at 30px is the most-seen number on the site.
• Hand-typed strings cannot fail a test. Three live contradictions exist today with no gate to catch a fourth.
• The realised result is public by omission, not by a recorded decision.
• Nothing in the shell fits a second trader. Five nav pills describe a single-operator instrument.

Evidence · lib/lab-v3/data.ts:586-602,1077-1082,1139 · app/lab-docs/record/page.tsx (no gate) · lib/auth/middleware-tiers.ts:26,122 · prod research.labregistrystrategies 29 rows · live x-vercel-id lhr1::lhr1

Infra & ops

Stage 07 · Ops

Well instrumented and completely blind. Every receipt surface worked today; nothing reached a human.

Stage summary: Blocked · 8 packets · 6.5 days

Facts

• SIP feed died 14:04:59Z, restarted by hand 20:53:22Z. A 6h51m mid-market outage.
• Pause never exits the process. The run loop returns, so the always-restart policy can never fire.
• Recovered 20:59:06Z. Generation 576 active, heartbeats resumed at source_sequence 262,595.
• Zero alerting exists. No pager, no webhook, no Sentry; one Vercel integration, and it is Redis.
• The dead-man's switch worked. 2,213 degraded receipts against 175 healthy, all unheard.
• First-hour workers are 96 commits and 8 migrations behind the schema they write to.
• CI is one self-hosted runner. Main queued 35m47s behind a PR during the audit.
• Prod head matches main. 85 migrations, max 20260825150000, no drift.
• Secrets hygiene is clean. Mode 600 env files, three app-scoped tokens, no org-wide Fly token.

Gaps and memory corrections

• Correction: Actions billing works. 58 runs completed today — the "BROKEN" note in memory is stale.
• Correction: the stream watchdog is shipped — but it covers stalls, not the terminal paused state that killed the feed.
• CI migration list is hand-curated. 56 entries against 85 files; today's migration is in neither array.
• Two migrations are explicitly skipped. 70 DDL statements live in prod that CI has never executed.
• Node 20 → 24 in 37 days with no .nvmrc, no engines field, six jobs on 20 and three on 22.
• vitest sizes by cores, not RAM. 8 forks on a 24 GB box — the direct mechanism behind the RAM incidents.
• idleintransactionsessiontimeout = 0 against 60 connections.

Next packets

Risks

• The next outage lasts until Sam looks. The fix is not shipped; today's recovery was manual.
• Workers write to a schema their binary never saw — unexercised by CI and unknown to the running image.
• One runner is a throughput ceiling and a single point of failure for every science leg.
• lhr1 moved the ingest sink across the Atlantic. Not today's cause — the pause preceded it by four hours — but a forward re-pause risk.
• All ten Fly apps share one personal org: one billing failure takes down the feed and the ability to fix it.

Evidence · alpaca-data-ingestor/src/ingestor.ts:78 · fly machines list d89513eb252278 updated 2026-08-25T20:53:22Z · prod paper.alpacaruntimeingestionreceipts max 20:58:06Z, 1,527 rows since 20:56:16Z; heartbeats resumed 20:59:06Z, sourcesequence 262,595, generation 576 ·.github/workflows/ci.yml:177,259-261,472 · gh api actions/runners total_count 1

Gates & statistical honesty

Stage 08 · Gates

The multiplicity gate is not what blocks promotion. Two previously unflagged honesty defects sit under the approved change.

Stage summary: Blocked · 8 packets · 19.5 days

Facts

• Multiplicity has never been binding. 367 of 367 scored candidates failed BELOW_BENCHMARK.
• Option C changes no historical verdict. 367 × 0.025 = 9.175 expected against 0 observed.
• Measured denominator shrink is 41.0× — 15,047 attempts over 367 scored, matching the spec.
• New defect: the null model does not match the survivor definition. Admission is a point estimate, ~0.5 under the null; the rate used is 0.025.
• New defect: promotable ignores the champion's own lower-95. Lower-95 orders candidates; it never admits them.
• No floor is hashed. 126 / 60 / 30 are absent from the series contract — a floor edit moves no hash.
• The registry refuses testing and survivor unconditionally. No path exists past readytotest.
• The only working graduation path is shape-locked to exactly 40 in seven places.

Gaps

• The confirmation lane has no design. Who preregisters, where the budget lives, what makes a lane label unforgeable.
• The holdout has no consumer. Even a correct promotable has nowhere to go.
• The orchestrator is the only lane with no preregistered budget — against the registry's own variant-discipline note.
• No first-hour paper-stage floor constant exists anywhere in the tree.

Next packets

Risks

• Option C as approved opens the gate on the wrong statistic. Combined with the null mismatch it is far larger than the 41× shown.
• "P14 unblocks testing" is false on the record. Zero of 367 ever cleared the benchmark gate.
• The site implies lower-95 is an admission bar. In the orchestrator lane it is only a sort key.
• Unhashed floors apply retroactively. A relaxation silently reclassifies artifacts made before the change.

Evidence · verified in-session: lib/paper/orchestrator/score.ts:124 (BELOWBENCHMARK on point-estimate meanExcess), score.ts:177,187-195, round.ts:564,568-570 · first-hour-continuation-v1.ts:41-43,116-157 · 20260823090000labstrategyregistry.sql:673-675 · 20260820040000dailysipv2graduation_candidate.sql:56,60-61,338-339

Critical path to the north star

Sequence

Order matters here and only here. Dates are earliest-honest, assuming one repo editor at a time and no further outages.

Stage summary: 10 steps · to Q1 2027

1. Preserve the work, then stop the burn — Tonight, 25 Aug Push four local branches to GitHub. Fix and apply the G0 migration 20260825160000, re-enable the reviewer lane, then let 08-24 complete. The publish already landed at 20:59:37Z.
   • Gates Owner go for a prod DB apply. Nothing else blocks the pushes.

1. Fix and restore the daily lane — 26–28 Aug Three SQL functions, contract-faithful fixtures, prod apply. 08-24 is published; 08-25 stays unsealable until the gap repair is proven. Then watch one cycle complete on a positive day.
   • Gates Receipt-write ordering decision · backfill-counts-as-evidence ruling · fate of 2026-08-21.

1. Land wave-1 and make the board true — 26–28 Aug Finish the ~6h run, write the artifact hash into the registry row, extend the ACTIONS vocabulary before it hard-stops the panels.
   • Gates How the board counts attempts · whether acquirer-side rows are ignored or excluded.

1. Close the gate honestly, then turn the factory on — 27 Aug – 2 Sep Merge #301, ship P14 with P14b and the survivor-definition fix, then deploy P9+P12. Never the other order — running first makes promotion permanently harder.
   • Gates Re-consent on option C · Fly secrets · promoting daily-genome-v2 to quick_check is literally the on switch.

1. Off-machine custody, watchdogs, one alert channel — 26–30 Aug, parallel Copy 10.6 GB off this Mac. Make ingestor pause exit. Wire one channel to the three dead-man's switches that already fire.
   • Gates Backup destination · Sharadar cloud-copy licence · alert channel and threshold.

1. Acquire and seal the validation corpora — 29 Aug – 5 Sep Probe SIP reach to 2018 first. Then ~900 MB of M1 bars, 512 common sessions per window, three custody seals.
   • Gates Owner funding for the corpus-admission gate · what happens if a window cannot reach 512 common sessions.

1. First sealable claim: v2 selection plus validation panels — 5–10 Sep P4 then P5b. This is the only path to a non-null validation evidence hash, and the first real test of split handling.
   • Gates Validation alpha allocation, 5–20 bp of the sealed 100 bp · split-correctness panel before, not after.

1. Broker guardrails, then first paper forward session — 1–12 Sep Caps and the qty===1 fix ship before any arming. First-hour paper forward plausibly starts the week of 7 Sep.
   • Gates Three cap numbers · G2 credential write · paper-stage session floor.

1. Accumulate forward evidence — Sep 2026 – Apr 2027 Daily lane: 126th complete session 23 Feb 2027 if 08-24 counts. First-hour from 7 Sep: 126 on 9 Mar 2027, the binding 160-session regime gate on 27 Apr 2027. A 60-session paper floor lands ~Dec 2026.
   • Gates Paper-stage floor decision · every burned or missed session moves these dates.

1. Real money, at scale — No defensible date Blocked on four independent things, none of them the calendar: no validation-backed claim, no first-hour order path, no loss caps, and a broker schema capped at 5 deployments on 1 account.
   • Gates Real-money architecture spike · multi-account schema · per-trader allocation and risk limits.

Decisions only Sam can make

Owner

Ten open. Each carries a recommendation; none can be resolved by engineering judgement alone.

Stage summary: 10 decisions · 3 hard stops

1 · Re-consent on the multiplicity gate

Option C was approved on the premise that 0.025 is P(lower-95 > 0). The code admits survivors on a point estimate — roughly a 0.5 null rate — so the relaxation is far larger than the 41× shown.

Recommendation Approve option C only bundled with a survivor-definition change requiring lower-95 > 0 for admission. That keeps the rate honest and the relaxation exactly what was shown.

2 · Prod DB apply of the gate-pass fix — hard stop

Three SQL functions must change before the daily lane can record a positive-return session. Session 2026-08-24 published at 20:59:37Z and is eligible now.

Recommendation Approve tonight, apply before the reviewer lane re-enables, confirm backups first. The disabled reviewer only defers the burn; it does not prevent it.

3 · Do backfilled sessions count as forward evidence?

The runbook forbids backdating; the daily lane's catch-up design is explicitly a backfill. 08-24 and 08-25 hang on this.

Recommendation Rule explicitly and record it in the lane contract. Counting them is defensible only if the session's own tape was sealed before the cycle ran.

4 · Fate of session 2026-08-21

It cannot be repaired in place. Recovery requires forking program lineage, which changes program identity in the evidence chain.

Recommendation Accept a permanent one-session hole. One session is not worth a lineage fork in the record.

5 · Paper-stage session floor

126 sessions is ~6 months. 30 buys five months and fails the 60-fill floor anyway. The floor is currently an unhashed TypeScript constant.

Recommendation Introduce a separate 60-session paper constant, never mutate the shared 126, and hash it into the series contract. The hashing part is non-negotiable.

6 · Three broker cap numbers

Per-order notional, account-gross notional, daily-loss halt threshold. None exists today, and the approved arming quantity skips the only pre-trade check.

Recommendation Block all arming until caps ship. Derive the first two from the forward layer's existing maxnotionalminor rather than inventing new numbers.

7 · Turning the search factory on — hard stop

Two acts: setting Fly secrets, and promoting daily-genome-v2 from idea to quick_check. Neither the migration nor the runtime will do the second.

Recommendation Approve only after P14 and P14b land. Turning it on first makes a promotable verdict monotonically harder forever.

8 · Backup destination and Sharadar licence

8.7 GB of Sharadar has never been backed off-machine. A cloud copy may need a licence review; an encrypted disk does not.

Recommendation Encrypted external disk tonight. Answer the licence question later, on a copy that already exists.

9 · Data purchases for G-DATA-2 and G-DATA-3

Fundamentals and point-in-time earnings unlock four registry ranks. No vendor is named for G-DATA-3 anywhere in the repo.

Recommendation Do not buy yet. A purchase now buys inventory for a lane that cannot issue a claim. Confirm the Sharadar tier first — SF1 may already be licensed.

10 · Public realised results on /docs/record

£132,124 realised on £171,870, per-position, ungated and edge-cached. This may be intentional editorial publishing; nobody has written that down.

Recommendation Decide and pin it with a test either way. Silence is currently doing the deciding.

Open risks

Ranked

Ordered by how much irreversible damage they do if nobody acts this week.

Stage summary: 8 ranked

1. The evidence ledger selects against positive-return days Sessions with excess ≤ 0 complete and record; sessions with excess > 0 raise and burn permanently. Session 2026-08-24 published at 20:59:37Z and is eligible now; the reviewer lane is disabled until the fix ships. A ledger built this way looks like honest evidence.

1. Roughly 3,900 lines of today's work have no remote P8 families, P9 pooled gate, P12 Fly runtime, the first-hour ACTIONS adapter, the wave-1 runner and the corpus downloader all live only under /private/tmp, whose git origin is the local repo. A tmp reap or reboot destroys them and the in-flight run.

1. 10.6 GB of irreplaceable data is single-site Sharadar 8.7 GB, admitted corpora 1.9 GB, exact-40 251 MB. The Time Machine destination will not mount and the last stable snapshot is 2026-07-09 — 47 days old and predating the Sharadar store entirely.

1. Deploying the runtime before the gate change is self-defeating Pooled multiplicity uses the attempts denominator. At ~2.5M attempts/day the expected-by-chance count grows ~62,500/day while obtainable survivors grow by at most ~2.4 per round. Running first pushes promotion permanently out of reach.

1. Operations are blind by construction The price feed's terminal pause needed a human at 20:53Z after 6h51m; the process never exits, so Fly's restart policy cannot fire. There is no alerting anywhere — 2,213 degraded receipts went unread, and the fix is still unshipped.

1. The site's biggest number implies edge it does not have The dashboard hero is the best of 40 backtested bots, rendered green at 30px, while the family's "no edge" verdict sits at 10.5px muted. Separately, promotable can be true with a champion whose own lower-95 is negative.

1. The broker path would arm with no risk evaluation qty === 1 skips the only pre-trade check, and that is the approved arming quantity. No notional cap, no daily-loss cap, and the forward layer's maxnotionalminor is silently dropped at the mirror boundary.

1. Running workers do not match the schema they write The three first-hour Fly machines run an image 96 commits and 8 migrations behind prod. Two of those migrations — 70 DDL statements — are explicitly skipped by CI, so nothing has ever exercised them.

Corrections 21:05 UTC — operations moved while this page was being written

• SIP ingestor recovered. Self-paused 14:04, restarted 20:53:19Z, heartbeats resumed 20:59:06Z. The blind-outage finding stands.
• Publisher re-enabled 20:54:11Z. Session 2026-08-24 published 20:59:37Z; 08-25 waits on the 14:05–20:00 gap repair.
• Dispatch health at 21:00Z. Policy daily-five-stock-sip-v3, candidate 2026-08-24, eligible_now, lagging 1, stalled [2026-08-21].
• Reviewer lane disabled 21:03Z. Review jobs queue without consuming retries until the G0 migration 20260825160000 is applied.

Generated 2026-08-25 21:02 UTC · corrected 21:05 UTC · read-only · no writes performed 8 lenses · main 696c0e6 · prod vjxyctukncfwqkoztgnj