Separate extended-hours paper startup readiness from order freshness - #1097

Scope

Extended-hours paper starts can fail at the REST benchmark gate or pause on
sparse benchmark quotes despite a ready preceding preflight. Add a strict
opt-in extended_hours_start_readiness block: a 30-second startup window and
five-second selected-benchmark health threshold throughout the extended-hours
stage, while strategy/ledger/order
wire freshness keeps the shipped three-second bound. Defaults, RTH starts,
standalone preflight and recovery retain their existing behavior.

• Base commit: 329985de1c8dccf0df7491373d0d9932eaa723d4
• Lane: lane:trading
• Owned paths: adaptive runner/transport/native startup configuration, one
  validation helper, focused tests, README/decision and hash registrations.
• The CC approved this one priority PR at 20:47Z. It activates no series or
  unit. New PRE operating bindings use the landed code, never an edit to the
  protected frozen runtime.

SOTA sources

• alpacahq/alpaca-py 0.44.0, cc4cb3b7ba50ae250e621983c2779047fb16bb28, stock.py:163-182: supported symbol-list latest-quote request. Existing guarded read-only SDK clients, authorizer and request observer are reused.
• Same pin, data/live/websocket.py:121-128: caller websocket settings and existing awaited callback contract. No SDK fork or replacement transport.
• Official NautilusTrader at 1b0a49d2792a9432a3aca3fcb617ce7a630d905e, crates/live/src/python/config.rs:1114-1159: supported LiveNodeConfig Python connection timeout; crates/live/src/node/mod.rs:433-464 shares the deadline across client connections. Installed 2.0.0rc5 checks are distinct from this source-review pin.
• Historical runner at dbe7a8da1bb497570471e2b9d0dcfe56bbdc56e9: REST preflight benchmark gate, before stream construction. A stream-only wait cannot address that refusal.

Evidence-class table

Local commands run

Round-1 tests (all idle scope, scratch outside operating roots):

systemd-run --user --scope -p CPUWeight=idle <runtime-python> -B -m unittest tests.test_adaptive_paper_start_readiness tests.test_adaptive_paper_lane_a_continuity
At7844c4fb:36 tests, rc1 (PRE boundary failure, continuity and request-bound errors; invalid-symbol test fixture corrected separately).
Corrected30-symbol budget case alone at7844c4fb:rc1, preflight_request_bound on final benchmark GET.
Fixed36 tests:rc0.
systemd-run --user --scope -p CPUWeight=idle <SDK-free-python> -B -m unittest tests.test_adaptive_paper_start_readiness tests.test_adaptive_paper_lane_a_continuity
36 tests OK, rc0, skipped2 optional real SDK/native tests. STOP/deadline/polling/refresh execute.
systemd-run --user --scope -p CPUWeight=idle <runtime-python> -B -m unittest tests.test_adaptive_paper_start_readiness tests.test_adaptive_paper_lane_a_continuity tests.test_adaptive_paper_transport tests.test_adaptive_paper_credential_source tests.test_adaptive_paper_runner tests.test_adaptive_paper_native
464 tests OK, rc0.

An initial system interpreter attempt lacked the required exchange-calendars
package (two import errors); the SDK-free result above uses the configured
Python with CI calendar dependencies and no broker/native SDKs.

Initial implementation evidence retained below:

systemd-run --user --scope -p CPUWeight=idle <runtime-python> -B -m unittest tests.test_adaptive_paper_start_readiness
Final pre-wiring nine-test module on base329985de: rc1, 10 refusal failures including subcases and8 unsupported-API errors.
Head nine-test module: rc0. Final module with main-call forwarding case:10 tests OK, rc0.

systemd-run --user --scope -p CPUWeight=idle <runtime-python> -B -m unittest tests.test_adaptive_paper_start_readiness tests.test_adaptive_paper_transport tests.test_adaptive_paper_credential_source tests.test_adaptive_paper_runner
382 tests OK, rc0, before the outer native-window change.
systemd-run --user --scope -p CPUWeight=idle <runtime-python> -B -m unittest tests.test_adaptive_paper_start_readiness tests.test_adaptive_paper_native
63 tests OK, rc0 after the outer native-window change.
python3 -B scripts/validate.py
rc0:11923 hashed files; integrity/scope checks passed.
gitleaks dir blueprints/us-equities/adaptive-paper --config .gitleaks.toml --redact --no-banner
rc0:no leaks.
gitleaks dir tests/test_adaptive_paper_start_readiness.py --config .gitleaks.toml --redact --no-banner
rc0:no leaks.

The initial test import aliased existing TestCase classes, adding seven unrelated
tests to discovery; that harness counting issue was corrected before production
edits. The final base/head counts above are from the isolated module. Test HTTP
and submit boundaries are mocked; no broker, credential, GO, unit or shared-state
call. All scratch and logs are outside protected operating roots.

Decision record

docs/decisions/2026-10-13-extended-hours-paper-start-readiness.md

The exact 30/5 integer block requires the coordinated extended-hours session
flags and applies to actual PRE/POST paper only. Read-only REST polling is
bounded and re-establishes account/flat proof after waiting; every GET retains
the existing request ceiling and observers. Selected benchmark stream readiness
uses five seconds with vendor-time aging; asset quotes and final order pricing
retain their shipped bounds. The native outer connection cap becomes40 only
for this registered30-second transport so it cannot truncate the inner wait.
Defaults remain10. The REST and stream readiness phases each have their own
30-second bound; no throughput or guaranteed entry is claimed.

Round-1 corrects the CC's P2-1..P2-5 and P3-1 plus the local request-budget P2.
The readiness block is omitted from the next-trial frozen trading signature;
exact-byte recovery remains strict. Opted PRE starts refuse when their duration,
cleanup and existing60-second allowance cross09:30ET. Five-second health and
watchdog behavior is stage-long. Poll cadence reserves five final snapshot GETs
within the unchanged50-request ceiling, including a30-symbol universe ready at22s.
A request-bound SafetyError yields not_started with zero orders. Deadline/STOP,
polling and final snapshot refresh have SDK-free CI tests; optional real SDK/native
tests retain their declared runtime requirements. Assets are read once before polling.

Round-2 resolves Astra's durable-window blocker. Opted readiness broker and
data GETs reserve through existing Ledger.request_budget before HTTP in a
retained root-local request-only journal. The same configured total request cap
governs its trailing60s window; refused starts and retries retain reservations.
Successful startup replays opted data_read rows into the trading ledger too.
Default broker/data accounting is unchanged; no trial, order or position is
created in the request-only journal. Synthetic/real-SDK fixtures assert all12
requests (read9/data_read3) in both windows. Exhausted-window and main-wiring
tests require zero additional GETs on each retry.

Fail-before at9cc5c204: adopted review probe's three-test selection rc1 with
two failures (read9 instead of read9/data_read3; exhausted window permitted
GETs), default-policy case passed. Separate actual previous-main source control
fails at the final HTTP boundary with exhausted-window GET assertion. Fixed
five-module carry413 OK; final readiness/continuity/exploratory-admission43 OK;
SDK-free readiness18 OK/skipped2 declared integration tests. All tests are bounded
idle-scope synthetic/local integration, no broker or operating-state calls.

Current-date validation after UTC midnight reports rc1 solely for the unchanged
claude-fable-5-1 currency record: its landscape check is older than7 days while
the model release is older than42 days. The currency bytes are identical at
9cc5c20 and this fix, and the actual model_currency_problems predicate reproduces
the same refusal for both. No date override or currency edit is part of this fix.

Host evidence

Private operating receipts are summarized in the decision with their limits;
their local paths/digests stay in coordination. No new paper execution,
broker acceptance or qualification result is claimed. Readiness does not turn
an old quote into an executable price and can still end with no signals.

Checklist

• Existing official SDK/native interfaces reused; no dependency/workflow.
• No credentials, account identifiers, private operating paths or paid service.
• Frozen code, unit files, accounts and peer-owned worktrees preserved.
• Explicit source/evidence registration through existing tools.

Follow-ups

• After landing, one CC-directed follow-up PR: refused-start reservations must count in the rolling window; changed request ceilings must reopen the request-only journal after its window. Until it lands, do not change a request ceiling between opted lane-B trials.
• New PRE records supersede the old frozen pp2b bindings after landing and fresh operator integrity checks.
• Backpressure paper streams and distinguish frozen outcomes #1084 interacts through start_timeout: its ruled blocker commit bounds handler wait at8s below the10s ping timeout. Whichever PR lands second adds the combined30s-start/8s-handler test. Quiet-market classification and recovery blockers remain in its separate commit.
• Split adaptive paper sells within the durable order envelope #1091 whole-share sell fix has been handed to gule; this branch does not change it.
• Measure PRE interarrival/startup distributions and request use before replacing these initial approved bounds.
• Extend malformed refresh/identity branch coverage; assets currently are not refreshed after polling. The initial fail-before control had nine tests; the later tenth main-wiring case was not part of it.
• Before the next qualification of those branches, cover negative readiness override/scope, OVERNIGHT forwarding, changed account identity and the full malformed final-snapshot matrix.
• Record correction-specific pinned local policy provenance for frozen-signature exclusion, PRE duration/cleanup allowance, request-slot arithmetic and refusal-receipt classification; vendor citations establish vendor mechanisms.
• At the next native qualification, cover session transitions, restore/replay and exact-byte recovery alongside the second-lander combined startup/handler test.

The final test-only correction pins the request-bound/no-state fixture to RTH.
At87bc349f that test fails under PRE/POST and passes under RTH/CLOSED; at9cc5c204
it passes all four sessions. With the pin it passes under all four outer-session
controls. This fixture targets the invocation-bound receipt, not opted durable
journal creation, whose separate tests retain PRE coverage. Runtime code is unchanged.