Keep lane B stage latches separate from the operator STOP - #1087

Scope

Separate lane B's automatic stage marker from both read-only operator STOPs,
retaining the frozen engine/config bytes and exact-config recovery. The LAST
round changes tests/docs only: allocate replay fixtures from the actual child
environment and run issuer-specific probes on explicit CPython3.12 or state
their SKIP. No runtime helper, recut, unit or workflow changes in this round.

• Base: 77cc7ef; lane:trading.
• LAST delta: tests/test_lane_b_stage_latch.py,
  tests/test_lane_b_recut_boundaries.py, tests/paper_issuer_python.py and
  blueprints/us-equities/paper-readiness-seq3/README.md.
• ONE forward commit, no rewrite. Retain exact seq2 replay sources for a git-bound inventory #1102 landed first at
  000ae0e, and its CC-sealed replay record
  was verified before this round began. No new operational packet is claimed.

SOTA sources

• CPython3.12.3 tempfile,
  f6650f9ad73359051f3e558c2431a109bc016664, lines124/880-882: gettempdir
  supplies a directory only when dir is None; TemporaryDirectory forwards an
  explicit dir. A later env change cannot relocate a fixture already created.
• CPython3.12.3 pathlib,
  same pin, lines860-868: permission OSError outside the ignored set propagates.
  CPython3.14.4 pathlib
  and genericpath,
  23116f998f6789d8c2fbe5ed5b8146854c8c2a4f: Path.exists/is_symlink delegate
  to os.path and its exists/lexists/islink catch OSError. Runtime pending()
  already uses lstat; this final commit changes only test selection/citations.
• CPython3.12.3 unittest
  and subprocess,
  same pin: skipTest and the supported interpreter CLI provide the test-only
  version selection. No interpreter install or third-party harness is added.
• systemd v259,
  9ca433482f2281d71718718705ca8cd3bf562ad6, lines416-418/562-585: serial
  command failure and ExecStopPost semantics. Installed259.5 was measured.
• NautilusTrader2.0.0rc5,
  1b0a49d2792a9432a3aca3fcb617ce7a630d905e, lines61-64/98-105: retain bounded
  native lifecycle. The NAS engine pin is8c95a50d10bd2db0b59058c6827275917ce35aa3.

LAST-round fixes

Choose the exact child environment BEFORE allocating its fixture. The test
asks that interpreter for tempfile.gettempdir under the verifier's canonical
TMPDIR / fallback rule, allocates there, and passes the same env to replay.
The unset-env test rebuilds its fixture after removing TMPDIR/TMP/TEMP.
The matrix covers unset, /var/tmp and a distinct writable root, verifying the
real checksum process in each. This corrects the prior universal TMPDIR claim:
parent fixture allocation and child env selection previously disagreed.

Three positive issuer/STOP/retirement probes select and version-check an
explicit CPython3.12 executable from PAPER_ISSUER_TEST_PYTHON, the current
interpreter or python3.12 on PATH. Discovery under another Python delegates
the complete test to that executable; if none is discoverable, unittest emits
SKIP with its missing-interpreter reason. The wrong-interpreter refusal test
still runs portably. Existing catalog-freshness.yml selects CPython3.13; it
does not have to masquerade as the deployment's interpreter. No CI or runtime
guard is changed. These tests consult no credential or installed service.

The CC record ROW-cc-20261014T0222Z-seq3-replay-inventory-git-bound.md now binds
the five replay files to landed #1102 commit000ae0e39e20b947f1bd700e0257f781c069898d.
It establishes first authenticated git provenance, not original seq2-seal
membership. README cites the record and commit; the private record digest is
not published. This tests/docs commit does not add a new runtime inventory
input or change receipt-origin handling. Operational integration remains a
separate gate, and no older candidate becomes activation authority here.

Retained runtime behavior

Only the private per-trial .stage-hook-latch is hook-owned. Host and lane
operator STOPs are read-only; unchanged ownership plus durable native flat
proof is required to release the marker. Recut authenticates copied inventoried
bytes before rewriting, refuses absent replay rows, and the dry-run receipt
requires49 executed non-skipped cases. Keyed access and forbidden process
attempts are tripwired; only exact contained keyless hash checks can execute.
Those runtime mechanisms are unchanged by the LAST round.

Evidence-class table

Local commands run

All named runs use systemd-run --user --scope -p CPUWeight=idle --quiet --
with scratch under /var/tmp. Before the fix: explicit alternate TMPDIR produces
one failure in11 DryRunBoundaries tests; Python3.13 produces four failures in
the46-test suite; the new matrix fails at the old fixture implementation.

After: Python3.12 with temp vars unset passes47 tests; Python3.13 passes47,
no skips, using actual3.12 subprocesses for the issuer cases. Explicit alternate
TMPDIR passes all12 DryRunBoundaries tests. A forced no-discoverable3.12 run
reports exactly3 SKIPs with the stated reason and no failures. The isolated
current-main overlay also passes47 on3.13 with alternate TMPDIR.

Validation, merge-tree, privacy gates and exact pushed head are reported with
actual exit codes in the private lane file. No private log digest is published.
The current-main overlay passes whole-tree validation (rc0:71 components,
11,949 hashed files,4 profiles,240 receipts). Branch-only validation still hits
its older base's Fable landscape-age failure; that currency change is already
landed on main, and the branch was not rebased in this tests/docs round.

Decision record

blueprints/us-equities/paper-readiness-seq3/README.md documents the corrected
fixture scope, pinned CPython evidence, CI/test interpreter distinction and
authenticated replay provenance.

Host evidence

No installed unit, watcher, GO, broker, credential, STOP/HOLD, real journal,
receipt or writer-state action. Private replay record was only read/verified.

Checklist

• Retain exact seq2 replay sources for a git-bound inventory #1102 landed and CC record verified first.
• ONE forward tests/docs commit; runtime byte delta is empty.
• Fail-first TMPDIR/Python3.13 proofs and explicit skip accounting.
• ONE read wave on this head, trading-cc success and CC landing.
• If that wave finds any P1, PARK Keep lane B stage latches separate from the operator STOP #1087; seq3 waits for a short design pass.

Follow-ups

• Receipt origin against the original deployed seal versus replay-inclusive
  packaging identity, and quoting in ExecStart, are not changed in this round.
• Retain prior guard-coverage, marker-before-receipt, stop-mark/recover-chain,
  missing old-unit inventory and positional process-override follow-ups.
• Future seq3 recut must cite the CC replay record/landed commit, preserve
  genuine predecessor receipts and pass strict seal/full SYN/validity gates.

Astra final ACK at 77c7c75: seven deferred findings

The final review ACK has no blocker. These five P2 and two P3 findings remain
follow-ups; this body update changes no code or reviewed head.

1. P2 — Standalone issuer-test dispatch. tests/paper_issuer_python.py:41-45
   selects tests.main when a test file is run directly on Python3.13; the
   explicit3.12 child then raises ModuleNotFoundError. Required module invocations
   pass. Derive an importable module from the source file or supply its identifier,
   and cover both module and standalone entry points.
2. P2 — Separate receipt origin from replay packaging. recut.py:55-56
   still uses the replay-inclusive packaging identity for predecessor receipt
   origin. In the separately authorized operational change, distinguish the
   original deployed seal and verify genuine predecessor receipts. The CC record
   establishes replay provenance, not original seq2-seal membership.
3. P2 — Quote or reject destination whitespace. recut.py:133-134 accepts
   a destination with spaces, but generated ExecStart tokenizes the path into
   multiple words. Reject unsupported characters before copying or consistently
   apply systemd quoting, with the reproduced destination regression.
4. P2 — Bind positional process arguments. dry_run.py:67,86-94,169 checks
   the allowlisted argv and keywords but admits a positional Popen executable
   override. The harmless /usr/bin/true probe yields a passed receipt with one
   verification process and no tripwire. Bind and check positional constructor
   arguments before admitting a checksum process; the broad process-boundary
   description is subject to this deferred limitation.
5. P3 — Supply portable primary and historical captures. The review packet
   verifies CPython3.12.3 but lacks a mirror/capture for the cited3.14.4 pin,
   the named CC inventory record and the historical full drill. Retain suitably
   sanitized primary captures with hashes only of published bytes. Missing
   captures are evidence gaps, not independently reproduced historical results.
6. P3 — Complete deferred lifecycle and guard coverage. recut.py:74-75,
   lane_latch.py:84 and seq2_retirement.py:12 retain marker-before-receipt crash,
   stop-mark/recover chaining and missing old-unit inventory boundaries. Resolve
   crash/retry recovery, chaining, new-host retirement and remaining guard tests
   under their recorded follow-up, preserving operator STOPs and durable flat
   proof. The paused-issuer/recovery runbook remains in force.
7. P2 — Base-added module import compatibility. In the live-base merge,
   tests/test_capacity_probe_stop_stage.py:11 imports test_order_throughput as
   a top-level module. Its unittest module invocation returns one loader error;
   the file entry point passes four tests. Make that base test's sibling import
   compatible with the supported module runner. This finding is inherited from
   main and does not change this PR's ACK.

Claude micro at 77c7c75 and the local review: deferred findings (CC ruling, scope lock)

The Claude-family micro at 77c7c75 is PASS with no P1 (blockers A, B, D and F closed, each with a fail-first test).
These findings are follow-ups; none has an order, broker or STOP effect. This body update changes no code or head.

1. P2: recut re-reads its output after verification. recut.py:215-219 verifies each copied row once, then later
   steps re-read the output (:222, :248, :259, :269). Rewrite units and take digests from the verified bytes, or
   re-verify before the receipt.
2. P2: dry-run replay bytes are not the checked bytes. dry_run.py:32-34 checks the manifest; replay modules are
   read at :113 and executed at :150 without a re-hash. Execute the verified bytes and hash the captured manifest.
3. P3: the "-seq2" rename also rewrites a destination path containing "-seq2" (recut.py:133-134; fails safe).
4. P3s:
   • README:61-62 test count (47);
   • README:84-85 should also say the PR gate (validate.yml) runs the image's CPython 3.12.3;
   • tests/paper_issuer_python.py:38-40: check the current interpreter before the 5 s probe;
   • the TMPDIR matrix's distinct root should sit outside /var/tmp;
   • README:176-177 re-cut wording;
   • the whole seq3 bundle stays private (GO-BINDING-REQUEST.json and PREDECESSOR_BUNDLE carry the predecessor digest);
   • extend dry-run tripwires to os.system, posix_spawn, exec* and multiprocessing.

Digests in this PR's earlier commits (CC ruling, 2026-10-13, e3974ed addendum-01): ACCEPT, no history rewrite. The
preimages are large manifests and not guessable; the head no longer carries the digests; the squash merge keeps them off
main; and a force-push would not remove them from GitHub's view.