Keep lane-A journal continuity for session-only config changes - #1068

Scope

A lane-A PRE/POST config changes only three coordinated session flags, but the
existing runner refuses its raw config hash on the account's current journal.
For the NEXT paper trial, compare the frozen config fields so this change retains the same ledger,
fees, cash baseline, loss/drawdown history and request budget. Rung changes
remain refused in that journal and use a separately recorded series by design.
Recovery keeps the trial's exact config bytes under the 2026-10-04 / #667
decision; it preserves the existing raw and frozen bindings.
The runner reads one immutable config snapshot; the real loader, continuity
comparison, execution policy and raw/frozen provenance all use those bytes.
Lane-A starting metadata binds the verified frozen signature before execution,
so interrupted trials retain continuity after exact-byte recovery.

• Lane: lane:trading.
• Base: 28e0a25.
• Owned paths: adaptive-paper runner and README, new lane-A continuity test,
  dated decision record, source/evidence hash bindings.
• No deployed config, numeric limit, broker operation or gate row is changed.

SOTA sources

• NAS main dbe7a8da README,
  lines73-91: preferred frozen-field comparison and the separate-series
  ledger's consequences; lines147-149 prohibit evading risk/order state.
• Runner refusal at that pin,
  recovery2548-2552 and admission2577-2579; independent persisted risk limits
  in safety.py:509-511 stay authoritative.
• Official python/cpython v3.12.3,
  the engine runtime version, dumps separators/sort_keys contract183-238, used with the runner's existing
  SHA256 provenance primitive. No alternate trading or execution library.
• Frozen recovery decision,
  2026-10-04 / fix(trading): enforce Alpaca paper admission and recovery guards #667: exact whole-file binding for recovery remains in force.

Evidence-class table

Local commands run

Results and exact commands are in the staged report. New tests fail before
the original fix on the branch's main base; recovery refusal and provenance
regressions also fail at the reviewed 76a8a6b. The round-2 interruption regression fails at af64678. Twenty-one focused continuity tests pass, including the snapshot races and all 98 scalar leaves of the shipped 1x config under legacy/retained signatures.
Credential, runtime-lock, exploratory rotation and hash/manifest controls run
with the same final bytes. Native staged gitleaks and whitespace checks pass.
Final round-2 bounded idle-scope run: 314 tests, rc 0, including the complete runner
module and all 21 continuity tests. scripts/validate.py: rc 0, 71 components,
11877 hashes and 240 receipts. The new scalar-leaf matrix kills the omitted
max_leverage mutant identified by the first read.

Decision record

docs/decisions/2026-10-13-lane-a-frozen-field-continuity.md.
The dated operating ruling is identified by
981d2202da0e50b515a382dc65ff19ba7e1c3b42e28b807f7a2021aba24daebc.
Today's independent-series records are not silently rewritten by this PR.

Follow-ups

• Unknown non-shipped legacy configs require exact retained provenance before
  a changed-session reopen; never infer their settings from current limits.
• Feed and every other non-session field remain frozen. Broader compatibility
  needs separately reviewed evidence and fail-before regressions.
• Operating series switch to this landed mechanism only through a new record.
• Source/report retention: the revised review packet includes pinned NAS and
  runtime-matched CPython sources and retained fail-before/final check reports.
• Broader session-change STOP and other interrupted-publication fixture coverage
  remains a follow-up; existing STOP controls and conservative recovery binding remain.
• Separate follow-up PR: mover paper/recovery must use one immutable config
  snapshot too (mover_runner.py:1128, mover.py:337, mover_runner.py:934 and :690
  at af64678). The adjacent repeated-read race is recorded separately.
• The manifest contains 18 inherited machine-name lines outside this change's
  rows, counted only. Sanitation must update the historical content bindings together.

Checklist

• Three session flags alone are excluded; the actual loader/session guards remain.
• Explicit lane-B rotation and its authoritative SQLite records retain their existing path.
• Failed fixtures and observed results are retained; paper acceptance is NOT_RUN.
• No credentials, account identifiers or private paths are in this publication.
• Independent pre-push and head reviews pending.