Bound paper sell quote age independently of entry freshness - #1015

Scope

Owned paper exits currently share the entry's 3-second quote-freshness budget. Add optional exit_quote_max_age_seconds, bounded at 30 seconds from the measured pull, through the ledger, mover exit pricing, recovery and final pre-POST guard. Its effective default is the entry bound; entries and held-entry marks retain their <=3-second ceiling.

• Current head: 5dea1e2452e3cc950dd709444cecfb342eb2e4ce (four commits: original sell bound, adaptive propagation, CC B1/F5 correction, and the FINAL docs-only clarification). All four commits were rebased without patch changes outside manifests/evidence.json; all four full trees match trading-cc's reference rebase.
• Base commit: c735e8b2e7d096475ceed380ce956b9191af508c, fetched main selected for the conflict-only rebase. The original research/source baseline below remains pinned to branch-creation main.
• Lane: lane:trading; rule-7 paper-path priority, with CC-owned review and landing.
• Owned paths: source under blueprints/us-equities/adaptive-paper/ (safety.py, mover.py, mover_runner.py, native_strategy.py, strategies_v1.py, runner.py, recovery.py, transport.py, source-hashes.json); focused tests and aggregate-only fixture; the dated decision and explicit file registrations.

SOTA sources

• Existing deterministic paper contract at native-agent-stack 99e72aeff932fce30069092b1763736cb9e64c1b: RiskLimits and frozen_json, quote validation at safety.py:692-704 and reservation/revalidation at :819-940; mover entry/exit pricing; final wire guard and recovery.py:171-174. The existing optional-leverage omission pattern supplies the ledger compatibility mechanism.

• Official alpacahq/alpaca-py v0.44.0 mirror at cc4cb3b7ba50ae250e621983c2779047fb16bb28: alpaca/data/models/quotes.py:28 (quote timestamp) and alpaca/trading/requests.py:509-536 (supported limit-order request). The new age value stays in the local policy/guard; broker payloads retain the supported limit/DAY contract.

• Hone's candidate-conditional profile receipt ee99f0d2308d9502e4c549562049c3c620000073b4e8ac76a6b1a5b860e9da03 and aggregate 57eda3a309aad567bf95a8c6678a1deb8827e94b168cdffee8a96c69b2541bb7, verified/read directly from the minute-profile-with-active-dates packet; registered grid amendment 2f67ad1c0ecd6b09df3bb098e43ef769310f29c5568aebca2c25da0f0ab06738 and preregistration 70faa88e575bc313f80fdda4fbdd765f5980a578892a063ae94bd4f9336984bc are declared by the receipt.

• Read-only released aggregate inputs: minute-aggregates.csv b7223642951bda11cbfe725e9ee69a4e6b1ef8477fd42e951b1db7093b9a96b1; pooled-minute-aggregates.csv c093f0ec70eee8fd527fce2e05f78669b67a4b61bcd0e482992cbf771d99b016; recorded-date-minute-aggregates.csv 31ffe1595ae4c2ee38227d111ecd406ed0f0816eb6d0af10519e25dc75c94ead; pull-summary.json f43fda7829f1ac47392f5bc922f785806404b09a083fe8d5b353ee88b3ee5b68, under the verified input manifest 8812730b70e8bb1f82ff5a4b08409bd36275f1491fa540ac800f0fee15eb3b50. No raw page was read or copied.

• Entry ceiling: private us-equities-trading docs/decisions/2026-10-10-paper-caps-and-leverage.md:201 at 2f953241f9a4db7a482b65c78acd24827db6e4de; entry quote age remains at most 3 seconds.

• Official nautechsystems/nautilus_trader v2.0.0rc5, pin 1b0a49d2792a9432a3aca3fcb617ce7a630d905e: Python submit boundary, cancel boundary at :2001, and native cancellation callback dispatch with its callback matrix at :5694. The sell-age policy remains local deterministic glue; the native callback provides the acknowledgment-time replacement boundary. Inspected from the registered upstream mirror; installed native tests keep this rc5 pin.

• T15 next-deployment preset constraint: <state>/coordination/trading-cc/specs/t15-adaptive-exit-policy-plan-20261011.addendum-01.md, SHA-256 98b88e029f6efeeb192ced58c6e8c0abd70af6abdd8545b6b2c8933c0e7dc9de. Presets stay at or below 10 s until step 8 lands; code ceiling remains 30 s.

Evidence-class table

Candidate-conditional profiles and policy framing

Hone's measured diagnostic pass counts are candidate-conditional profiles, not a recommended bound. The verified receipt is ee99f0d2308d9502e4c549562049c3c620000073b4e8ac76a6b1a5b860e9da03 (observed exit 0), and the verified aggregate is 57eda3a309aad567bf95a8c6678a1deb8827e94b168cdffee8a96c69b2541bb7. Counts below were read from that aggregate itself. The counts are unchanged (same values, sanitized bytes); the receipt cited here is Hone's sanitized copy, with home paths replaced by ~ and account names by <user>. They cover 04:00-07:00 ET with a spread cap of 100 bps; UNION and RECORDED-DATE are separate cohorts. Unknown quotes do not pass.

The receipt declares preregistration 70faa88e575bc313f80fdda4fbdd765f5980a578892a063ae94bd4f9336984bc and registered grid amendment 2f67ad1c0ecd6b09df3bb098e43ef769310f29c5568aebca2c25da0f0ab06738. The profile cross-product is spread caps 15 / 50 / 100 bps and ages 3 / 10 / 30 seconds; all nine counts per cohort and the 07:00-09:30 stratum are retained in CANDIDATE-CONDITIONAL-PROFILES.json. The aggregate explicitly infers no threshold or earliest-slot/config change.

exit_quote_max_age_seconds is a policy field under the CC's 30-second code ceiling. The registered grid and profiles show the candidate-conditional admission trade-off across 3/10/30 seconds; they do not optimize, recommend or authorize a configured bound, raise that ceiling, identify the whole snapshot universe, establish PIT availability or show strategy returns/fills. The effective default stays at the entry bound, and an owning fresh-ledger deployment chooses any explicit value within the ceiling under its authority. The decision record's 30-second measurement describes the tested ceiling, not a recommendation to set the field to 30.

All executable synthetic results and simulated prices/holdings/order state remain SYN. The profiles are aggregate diagnostics, and native engine/SDK test execution on synthetic inputs does not grant paper/live qualification. The landing-triggered earliest-slot rule remains the CC's operational rule; no clock time or profile result alone releases deployment.

T15 next-deployment preset constraint

Primary record: <state>/coordination/trading-cc/specs/t15-adaptive-exit-policy-plan-20261011.addendum-01.md, 3,533 bytes, SHA-256 98b88e029f6efeeb192ced58c6e8c0abd70af6abdd8545b6b2c8933c0e7dc9de, directly verified. The next deployment's preset keeps exit_quote_max_age_seconds at or below 10 seconds until T15 step 8's re-price-from-fresh lands. The 30-second code ceiling is unchanged. Step 8 must re-price a latched exit from the freshest quote at each submit and re-send, never from the triggering quote; widening the trigger window must not widen that future pricing window. The current latch/pricing behavior is pre-existing and remains in the exits research queue. The synthetic 20/30-second cases test code limits and do not authorize those deployment presets.

Measured ceiling and implementation

Known pre-07:00 stale candidate-minutes recompute to 58,253/66,234 (87.9503%) for the fixed union and 4,526/7,740 (58.4755%) for recorded-date candidates. Unknown quotes remain separate. Pooled 04:00 spread <=100 bps admits 39/370 at <=3 s, 55/370 at <=10 s and 59/370 at <=30 s. Thirty is the largest profiled age and the CC's code ceiling; the profile is not a recommended bound. The code rejects larger, zero, negative, Boolean and noninteger explicit values.

Only aggregate minute medians supply the synthetic age cases. Their prices, positions and orders are synthetic, and a median age is not asserted to belong to a particular candidate's spread. The data establishes neither a PIT universe nor paper fill quality.

The same optional sell limit reaches reservation, pending revalidation, mover exit quotes, owned recovery and the nanosecond guard immediately before POST, including budget-delay checks. Entry prices, spread/session/halt/ownership/quantity/notional limits, request budgets and future tolerance remain in place. The mark_to_market() method retains the entry budget even when it skips the entry spread gate.

When absent/null, the field is omitted from frozen_json and default transport kwargs, preserving existing default ledgers and factories. An explicit changed exit limit is frozen and refuses a mismatched reopen. Existing configs remain unchanged at their 3-second default; the owning fresh-ledger deployment can explicitly choose "exit_quote_max_age_seconds": 30 after landing.

CC B1 correction

The CC ruled SWITCH for the armed gap-stop trigger. Commit a5431d0f1c8d3ac66ccb309f791bbc3bd7d1cdda on reviewed parent 1bb44890efaacd4c87b650e204c32282a7dec5ec uses sell_quote_age_seconds(self.policy.config) for that trigger and corrects the comment. Stop arming and prior-close capture retain entry-age guards; their comments now state that distinction. F5 is folded into the same commit: the mover decision-record locators are re-anchored to verified main 569bbc59db2b5f7c8a932357726efb7acca90b91 bytes at mover.py:366-380,1201-1203,1261-1299. Source-map and evidence registrations are re-derived.

SYN fail-first at reviewed parent 1bb44890: three workflow methods, ten assertion failures, zero errors, exit 1. The armed trigger admits ages 4/10/20/30 s with exit 30 and refuses 31; an arming workflow waits for an entry-fresh reference before an older bounded sell trigger; absent/null controls retain legacy 3-second behavior. The unchanged arming/default assertions already pass at the parent; each workflow's configured bounded-sell assertion discriminates the correction. At the final B1 source: three workflows pass, exit 0; touched native/policy/exit/session/runner/registry modules pass 491 tests, exit 0; validate passes 11,678 hashes, exit 0. Observed sources and sanitized outputs are retained in <state>/coordination/ns2604-coop/lanes/engine-qual.pr1015-gap-stop-20261011/.

Astra ACKed reviewed parent 1bb44890efaacd4c87b650e204c32282a7dec5ec with zero blockers under the scope lock. The CC had already ruled SWITCH for B1; the co-op released this unchanged commit. Fresh fetch followed by ONE push leased exactly on 1bb44890efaacd4c87b650e204c32282a7dec5ec publishes a5431d0f1c8d3ac66ccb309f791bbc3bd7d1cdda. The Opus/Astra/Codex confirmation wave now reads this head; no additional source correction is implied by the recorded P3 follow-ups.

Ordinary adaptive sell correction and complete current quote-age inventory

The first head c90efda9 accepted the field but left ordinary adaptive sell decisions on the entry age. The adaptive propagation correction at 1bb44890efaacd4c87b650e204c32282a7dec5ec, preserved through the pure rebase in current 5dea1e2452e3cc950dd709444cecfb342eb2e4ce, carries the validated effective RiskLimits sell bound into PolicyConfig, exit evaluation, native forced/action guards and cancel-ack replacement. Entry paths retain their previous age. Gap-reference sampling retains the entry standard. The CC-ruled B1 correction also switches the armed RTH gap trigger to the effective sell age; stop arming and prior-close capture retain entry age.

SYN fail-first: the new module runs seven methods at c90efda9 with 39 assertion failures, zero errors, exit 1. All four regression methods fail: policy stop exits (9 cases), native ordinary stop sells (6), native forced sells (12) and cancel-ack replacements (12). Absent/null and entry-feature/order/held-admission isolation controls already pass there. Exact 10/30-second limits are inclusive; just-over-limit and future-tolerance refusals remain. Default RTH, explicit RTH, PRE and POST are covered. The stale age comes from the retained aggregate-selection fixture, with synthetic prices/state/order I/O.

SYN corrected checks before rebase: new module: 7 tests, exit 0; touched policy/exit/extended-exit/session/runner/source-registry modules: 517 tests, exit 0; age/safety/admission/evidence controls: 127 tests, exit 0. Final test-file cleanup removed only a trailing blank line; final source/registry tests: 20 tests, exit 0. python3 scripts/validate.py passes after that cleanup: 70 components, 11,636 hashes, 4 profiles, 239 receipts, exit 0. Local observed commands, sanitized outputs, source snapshots and pinned native excerpts are retained in <state>/coordination/ns2604-coop/lanes/engine-qual.adaptive-sell-fix-20261011/. These are synthetic integration checks, not broker fills or paper/live qualification.

Whole-repository command at the current published head:

git grep -n -e quote_max_age_seconds -e quote_age_seconds a5431d0f1c8d3ac66ccb309f791bbc3bd7d1cdda -- .

Observed exit 0: 198 matching lines in 67 files. This substring search deliberately also includes optional sell/order fields, helpers and independent similarly named blueprint fields. The following tables classify every executable consumer; the complete file/line index also accounts for tests, config declarations, historical snapshots and documentation. Adaptive table paths are relative to blueprints/us-equities/adaptive-paper/, all at current a5431d0f1c8d3ac66ccb309f791bbc3bd7d1cdda. exits.py and _wire_guard are included despite consuming derived values rather than matching the entry-field search themselves.

Prior registry-only rebase confirmation

The two original commits were rebased onto 569bbc59db2b5f7c8a932357726efb7acca90b91 after the mover exit-chain landing. Original c90efda95 maps to 57312f2b4; original 2ae782209 maps to 1bb44890e. git range-diff reports both as = when excluding only manifests/evidence.json and blueprints/us-equities/adaptive-paper/source-hashes.json; full-range differences are confined to those registries. Source hashes were re-derived from actual bytes using the co-op recipe, with only this PR's own new keys; no changed key belongs to an unrelated file. Evidence was regenerated through scripts.host_receipts.register_file under docs/lanes.md:94-141. No production or test content correction was added during the rebase.

At reviewed parent 1bb44890, SYN focused sell-age/source-map checks pass 15 tests (exit 0); the union of all previously run adaptive modules and admission/evidence controls passes 969 tests across 16 modules (exit 0). python3 scripts/validate.py passes (exit 0): 70 components, 11,678 hashes, 4 profiles, 239 receipts. The earlier fail-first results remain tied to their exact retained source. Those rebase checks apply to reviewed parent 1bb44890; the complete consumer inventory above is refreshed at current a5431d0f, and its B1 checks are recorded separately. Local observed rebase checks and sanitized outputs are retained in <state>/coordination/ns2604-coop/lanes/engine-qual.pr1015-rebase-20261011/.

Local commands run

python3 -m unittest tests.test_adaptive_paper_exit_quote_age.SellQuoteAgeRegressionTests
Unchanged main plus new tests: exit 1, 5 tests, 13 assertion failures, zero errors.

<installed-test-venv>/bin/python3 -B -m unittest tests.test_alpaca_admission_regressions.CashContinuity.test_sell_age_reaches_paper_and_forced_recovery_without_widening_entries
Pristine main production code plus new test/observer helper: exit 1, 1 assertion failure, zero errors.

python3 -B -m unittest tests.test_adaptive_paper_exit_quote_age tests.test_adaptive_paper_safety tests.test_adaptive_paper_mover tests.test_adaptive_paper_source_hashes_manifest
Final source: exit 0, 187 tests passed.

<installed-test-venv>/bin/python3 -B -m unittest tests.test_adaptive_paper_exit_quote_age tests.test_alpaca_admission_regressions.CashContinuity.test_sell_age_reaches_paper_and_forced_recovery_without_widening_entries
Final source: exit 0, 12 tests passed.

python3 scripts/validate.py
Exit 0: 70 components, 11,635 hashes, 4 profiles, 239 receipts.

The larger installed-SDK run covers 12 named modules, 772 tests, exit 0; its exact commands are retained in PRE-FINAL-VERIFICATION.json. Final changes afterward were comments/docstrings only, followed by the final current-source checks above. The installed test environment is <state>/ns2604-uet-read-env/venv/ with NautilusTrader 2.0.0rc5 and alpaca-py 0.44.0; bytecode writes were disabled. No environment installation, study-runtime change, real broker call or order was performed.

Local packet: <state>/coordination/ns2604-coop/lanes/engine-qual.exit-quote-age-20261011/, with exact source/test/input hashes, retained failure observations, aggregate-only inputs, final confirmations and primary sources. Test outcomes are synthetic integration evidence; no paper/live qualification or promotion follows.

Decision record

docs/decisions/2026-10-11-sell-only-quote-freshness.md records measured inputs, the strict 30-second optional ceiling, unchanged entry limit, compatibility and the PRE trigger.

PRE readiness

The cited T15 addendum leaves Monday's already scheduled paper work on its sealed bundle. #1015 and #1017 enter the next deployment, re-cut after Monday's session, with the <=10-second preset constraint until step 8 lands. The CC and owning deployment lane release that operation; this PR changes no deployed config or existing ledger and places no orders.

Host evidence

No evidence/hosts acceptance or platform change.

Follow-ups

• FINAL Codex dispositions at docs commit c7adc2135c66d576129fb6e3ec5267915de54e26: co-op research queue row 27 retains caching delivered-late quotes; the body now states the timeout's effect on sell pricing. Row 28 asks whether sell-path marks older than quote_max_age_seconds should feed risk halts (force_exit), with option (a) retained as a candidate. The CC released option (b), documenting current behavior without a behavior change.

• Astra P3 comment: the former native_strategy.py:677-683 claim of an identical entry/sell freshness window is corrected by the B1 switch commit a5431d0f; arming/capture are explicitly entry-bound and the trigger is sell-bound. No comment correction remains owed.

• Astra P3 running high: preserve the newly widened policy running-high behavior with a regression; a valid bid older than entry age but within exit age may raise Holding.high_bid, while out-of-bound quotes must not.

• Astra P3 measurement-capture gap: cited CSVs, input manifest, preregistration/grid amendment and pinned private caps-decision bytes were unavailable in her review packet; supply captures for independent recomputation, retaining candidate-conditional/SYN limits.

• Astra P3 inherited host labels: 20 pre-existing occurrences on 18 lines in manifests/evidence.json, count only; no identifier is published here.

• Correctly stopped publication false positive: rule generic-api-key, path blueprints/us-equities/adaptive-paper/source-hashes.json (redundant packet copies).

• Combined F1 (P3): pin mover entry isolation with exit age 30: a waiting leg quoted 3.25 s ago emits no buy, and a held leg with that age blocks another symbol's entry with held_mark_stale.

• Combined F2 (P3, pre-existing rule-gate test gap): pin that no exit reason/event latches on a quote older than the effective sell bound or beyond the future tolerance (for example 30.5 s at exit 30 and 3.5 s at the default).

• Combined F3 (P3): pin the mover running high under the sell bound, raised by a valid 3.25 s bid with exit 30 but unchanged for a 30.5 s bid or a quote beyond the future tolerance.

• Combined F4 (P3, fail-closed wiring/boundary gaps): add SDK-free standalone command_recover exit-kwarg coverage and CI-visible paper constructor coverage; pin the -0.25 s future boundary and exact entry/sell ceilings.

• Combined F6 (P3): document stream_quote_timeout_seconds beside any exit-age opt-in. It defaults to the entry age and is configured at mover.py:457-458; the deployment must state that timeout with its constrained exit-age preset.

• P3 source-capture gap: retain and supply the cited CSVs, their input manifest, preregistration, grid amendment and pinned private caps-decision capture so reviewers can independently recompute every cited row; retain the candidate-conditional/SYN boundaries.

• P3 inherited host-label hygiene: 20 existing occurrences on 18 lines in manifests/evidence.json, also present in the PR base; no identifier is published here. Any later normalization must update dependent registrations together.

• The owning next deployment selects an exit-age preset at or below 10 s and a matching fresh ledger until T15 step 8 lands; paper observations need their own execution evidence.

• Historical aggregate admission counts do not settle live quote cadence, fills, venue liquidity, profitability or original universe availability.

Checklist

• Entries retain their <=3-second ceiling and held-entry checks.
• Five age/config regressions and the native wiring regression fail on main, pass at the implemented source.
• Default frozen-ledger bytes match; changed explicit limits remain protected.
• Only aggregate inputs used; raw pages and private credentials untouched.
• No broker/paid/deployment/arming/promotion action.
• Existing SDK surfaces and supported registration API reused; peer worktrees preserved.