Use calendar-complete runtime for scheduled paper trials - #1009

Scope

Scheduled trials use the canonical calendar-complete runtime and refuse
incomplete metadata or invalid interpreter paths before reserving a run. This
round also closes an installer/trial race: a marker check could pass immediately
before reinstall removed completion and synchronized the environment underneath
ingestion or the runner.

The second lock correction resolves runtime directory identity before any
lock selection in installer, scheduler, acceptance, direct sync and manual
Python readers. The physical parent determines the shared lock inode, so a
trailing slash, /. or directory symlink cannot create a different lock domain.

Codex P1 at 1264603 also exposed a failed standalone sync retaining completion.
The helper now removes completion under exclusive before its first uv command.
Failure leaves it absent. Only a fully successful standalone call atomically
restores an already valid prior completion; missing/stale prior state cannot
become certified. Nested installer sync never republishes completion early.
The installer remains responsible for its broader final certification.

All current managed-runtime callers now coordinate on one stable file,
$HOME/projects/.us-equities-runtime.lock, outside the project, venv and OUT_DIR.
Installer and direct canonical sync use exclusive; scheduler, offline acceptance
and manual runner/mover entries use shared. Scheduler acquires before its marker
check and OUT_DIR/.run-once and retains the descriptor through all three stages.
Installer waits at most one second, then refuses with exit 69 before removing
completion or mutating the venv. Scheduler contention exits 2 without OUT_DIR.

The installer retains exclusive through final completion publication. A nested
sync reuses that descriptor; standalone sync releases its own on function return,
including failure. Manual CLI readers lock before runtime-package imports;
decorated main calls also protect programmatic paper/recovery entries until
return or exception. Exit/signal closes the owning descriptors. The lock file
is never deleted or replaced. Alternate interpreter overrides remain supported;
file aliases of the canonical interpreter in either PY or GATE_PY coordinate too.

Current review parent: 12646036786790cc8fb821671f424a53c51d8d8f. One further forward commit,
no rebase. Lane: lane:trading. The CC explicitly authorized the installer,
acceptance, sync and manual-reader scope in its 2026-10-11 ruling. No live unit,
frozen engine or host installation is changed by this source publication.

SOTA sources

• uutils coreutils 0.10.0 realpath.rs
  implements the installed realpath --canonicalize-missing operation used for
  existing aliases and fresh install paths; full capture SHA256
  c11dd7cab62a754dcc95e10c9bb553659b5095bed136400e72628963e265c8f8.
  Installed help SHA256 36aba4645edee8d2727fef544f1d493afe4d205f35d282e92a770660b5fcc9c1
  and version capture are retained. Bash help test documents directory -ef
  identity; the final implementation uses explicit canonicalization.
• CPython v3.12.3 pathlib.resolve
  documents resolving symlinks and removing path components before selecting
  the physical parent lock; capture SHA256
  1eb64284f142028c3338da705d2a9e1c640bf115c189b27787301bf7ff3fc6de.
• util-linux flock(1) v2.41.3:
  descriptor form :52, exclusive :65-66, nonblocking :68, shared :74-75,
  close lifetime :77-78 and bounded timeout :80-81; :125 gives the shell fd form.
  Full unmodified man source SHA256
  13befe29fb26539e05251a6352d08984f54ea82c02ba5166173909038cfb6e97.
  Installed flock --version is util-linux 2.41.3; its version/help captures are
  retained. flock.c at the same tag
  SHA256 f303ab0c5c14299e3d0891f5b9731317e87081546c1b0b2e2e1bf6d7613c224b.
  The scripts use flock(2) semantics, not the independent --fcntl lock mode.
• CPython v3.12.3 fcntlmodule.c:273-299
  exposes the same native flock(2) operation to manual Python readers;
  SHA256 16977bccf1e6146ebe7d1a0301741722a288279afed90b97fa0d1612b3e0af05.
  Scratch interoperation tests show Python's shared lock excludes the shell
  writer and closing the descriptor releases it. No custom locking protocol.
• install-trading-2604.sh at the review parent:
  :76 declares the canonical project, :136 removes completion and :246-249
  synchronizes its venv; :323-325 publishes completion. These retained source
  boundaries identify the write window now protected by the exclusive lock.
• accept-trading-2604.sh:14-15,60-72
  supplies the unchanged owner/completion and published metadata contract.
  Canonical pyproject SHA256 is
  aa370e42e29dc2419e586358254ff2e821df48a693aa9a3ee16b65d30036ee0b;
  uv.lock is f451ef979cdb1ae3686a30df1c883c257402b32753478c1f9c686c057e9c3989.
• runtime pyproject.toml:10,
  uv.lock:602-603,
  install-trading-2604.sh:148
  and sessions.py:36
  retain the canonical interpreter/dependency chain: Python 3.12.3,
  exchange-calendars 4.13.2, alpaca-py 0.44.0 and NautilusTrader 2.0.0rc5.
  Host/repository project and lock byte identities were measured in the earlier
  packet; this round makes no host package installation or metadata change.
• exchange_calendars 4.13.2
  is a lightweight tag targeting dbe38b1f6887434bbdd1a7d2df6ff8f1742a048a.
  The primary tag-ref/commit JSON capture and its manifest remain attached.
• Native Bash 5.3.9 help test (-f/-x) and uutils coreutils 0.10.0 timeout
  help/version (126/127) captures remain unchanged in the prior source packet.
  File symlinks work; directories and dangling/directory symlinks refuse before
  output reservation, as established by the prior fail-before checks.

Evidence and one step wider

The scratch fixtures preserve HOME and virtualize only runtime/projects prefixes.
They execute the actual installer ownership/marker/lock slice and final marker
slice, with installation replaced by a scratch file write. The acceptance slice
stops before Docker/namespace checks. uv calls are shell stubs. Scheduler timeout
calls are intercepted before Python, and the credential path never exists.
FIFO rendezvous establishes ordering without a timing-only race assumption.

Every new regression method fails on the old source. Candidate results are
19 scheduler/protocol methods plus three manual methods, zero failures/skips.
Three lock mutants fail with 3/3/1 intended assertions: scheduler shared lock
removed, installer writer changed to shared, and trial lock closed before runner.
An initial fixture-only run failed because its blocked stub had reversed
arguments and lacked a data directory; that log remains a failed run, separate
from the corrected baseline and candidate measurements.

Current repository caller/mutator checks cover installer -> sync, acceptance,
all three scheduler stages, both manual CLI prefixes and decorated runner/mover
main calls. The graph generation predates this change and lacks the new helper;
current source/AST checks and executed native locks substantiate these paths.
Three touched native caller modules also pass 296 tests, zero skips, rerun on
the final directory-identity helper bytes. Final canonical lock tests cover the
resulting helper and shell protocol. Earlier acceptance receipts stay
dated evidence; this change establishes no new acceptance or strategy promotion.

Validation and publication

The new four-method matrix fails at exact 1264603 with 12 intended
assertion failures and zero errors/skips, then passes on the correction. It
exercises three aliases per shell lock selector and manual directory reader,
actual standalone sync aliases with zero uv calls while a writer is held, and
valid/missing/stale completion across success and failure. Earlier installer,
scheduler, acceptance and manual readers already refused/shared some aliases;
their missing early canonical-selection assertion is a source contract gap,
not an invented behavioral failure. The standalone alias bypass and failed
sync marker retention are separately reproduced behavioral failures. This
distinction is retained in FAIL-BEFORE.json and the read packet.

An initial scratch caller accidentally replaced its own sourced sync helper,
causing recursion, and the first source-slice fixture retained an incomplete
shell error block. Those failed diagnostics are retained, corrected before the
final green results, and never counted as passing evidence.

FULL python3 scripts/validate.py: 70 components, 11,482 hashed files, four
profiles and 239 receipts. Final targeted checks, canonical lock checks, all
four shell syntax checks, evidence integrity, whitespace and tracked privacy
pass. Current source/evidence registrations and the embedded installer sync-
vector pin are generated from actual bytes through the native registry APIs.

All cited captures, source snapshots, fail-before/control/mutant logs and exact
command receipts are retained unmodified under lane coordination state in
reviews/pr1009-dir-identity-20261011T114446Z/ (with the prior runtime-lock packet), with MANIFEST.sha256 excluding
itself. It includes the earlier source packet needed by the unchanged citations.
Any masked read export must carry its own manifest and original-to-copy hash map.

The prior gate-venv creation remains a separately authorized, dated host step;
this source publication changes no live unit, credential, STOP, frozen bundle or
host environment. Existing frozen callers are not edited. Shared-lock protection
requires cooperating published callers; arbitrary external package commands
are outside this source change. The old credential-mutation driver and
README-mover/native-faults interpreter documentation remain follow-ups, together
with #999's transport P3s.

Follow-ups

• Replace the older credential-mutation driver under the existing paper-lane authorization and recorded go conditions.
• Update README-mover and native-faults interpreter documentation to use the managed runtime.
• Address the transport P3 items tracked by fix(paper): refuse malformed preflight collections #999 in their owning follow-up.

Draft held for the complete same-head Codex, Astra and Claude wave. Codex reported
no major issues at c7fb9fb1 on 2026-10-11T13:35:04Z; Astra and Claude results
remain pending. The CC owns adjudication and landing. Any source-fix commit
waits for all three verdicts, and any push waits for the co-op's wave-complete
relay or the CC's explicit release.