Preserve retained paper budgets across startup and recovery - #1105

Scope

Keep the retained root request window authoritative before startup HTTP and
through trading/recovery, including a startup observer created before another
invocation first adopts the root. An exhausted200-request root admits zero
GETs from that observer. Recovery also imports sibling request history without
reading or comparing another account's frozen request-cap identity.

• Base commit: 59899aaf32535032fadc4e208d36e7811195e691 (Separate extended-hours paper startup readiness from order freshness #1097).
• Lane: lane:trading.
• Owned paths: adaptive runner/safety/telemetry, readiness tests, decisions and registries.

This last correction synchronizes every startup callback, first adoption and
replay through the existing native flock pattern. Genuinely unbound default
broker attempts retain a conservative60-second adoption hold in a coordination
marker, so in-flight or not-yet-replayed sends cannot disappear at first binding.
No request/trading journal or trial is bootstrapped for that default path; its
data-GET policy remains unchanged. A contending startup or premature adoption
refuses before HTTP, with no automatic retry.

Sibling journals contribute only retained request/import rows and source binding,
under the existing destination-to-source transaction order. Their risk envelope
is never selected, adopted, compared or changed. The root envelope and current
invocation's exact cap govern startup separately. The two-account regression
retains distinct valid caps and a partially filled owned order, then reaches
startup, replay, cancellation and flatten with both frozen limits unchanged.

Earlier corrections remain:180 failed+12 current startup reservations leave
eight slots; import/reopen/retry does not duplicate rows; linked lane-B recovery
follows cap-only source changes without changing frozen trading/risk limits;
handoff snapshot clocks are captured after the source lock; exporter/dashboard
observe the enforcing source instead of a stale audit mirror.

SOTA sources

• Reviewed runner at937fd8f46:2380-2445: the actual one-time authority selection and sibling-constructor mechanisms reproduced by both fail-first controls.
• Existing native flock pattern at937fd8f46, safety.py:447-470: reuse of supported fcntl.flock/LOCK_EX/LOCK_NB and O_NOFOLLOW. No lock library/framework is introduced.
• Existing source-first import at937fd8f46, safety.py:1617: destination-to-source lock order, bidirectional import provenance and conservative retained spends. No distributed-atomicity/refund claim.
• Reviewed startup at4cd05154:2380 and original Ledger at2ede8ead:1541: earlier sequential startup, retained-window and cap-transition correction provenance.
• Official alpaca-py0.44.0/cc4cb3b7 stock.py:163-182: supported latest-quote GET through the existing guarded SDK client.
• CPython3.12.3/f6650f9 unittest/mock.py:1632-1655: supported patch.object fixture seam. No vendor client, engine or limiter is substituted or forked.

Evidence-class table

Local commands run

Module runs use pinned runtime Python with -B, idle CPU scope and
TMPDIR=/var/tmp. All identities, HTTP, order ports and databases are fixtures;
telemetry uses loopback only. Exact argv, actual exits, hashes and retained
failed controls are recorded in the sealed correction receipt.

runtime-python -B -m unittest tests.test_adaptive_paper_readiness_handoff tests.test_adaptive_paper_start_readiness tests.test_adaptive_paper_lane_a_continuity tests.test_adaptive_paper_exploratory_admission tests.test_adaptive_paper_safety tests.test_adaptive_paper_runner tests.test_adaptive_paper_credential_source tests.test_adaptive_paper_runtime_lock tests.test_adaptive_paper_recovery tests.test_adaptive_paper_transport tests.test_adaptive_paper_native tests.test_adaptive_paper_metrics tests.test_adaptive_paper_live_manifest
691 tests OK/no skips,rc0, before the final replay-lock regression was added; production bytes unchanged afterward.
runtime-python -B -m unittest tests.test_adaptive_paper_readiness_handoff tests.test_adaptive_paper_start_readiness tests.test_adaptive_paper_lane_a_continuity
78 tests OK/no skips,rc0; all7 changed input hashes unchanged before/after this final run.
python3 -B -m unittest tests.test_adaptive_paper_readiness_handoff tests.test_adaptive_paper_start_readiness tests.test_adaptive_paper_lane_a_continuity
78 tests OK/skipped2 declared optional integrations,rc0, including final replay-lock regression.
runtime-python -B -m unittest tests.test_adaptive_paper_exits tests.test_adaptive_paper_extended_exits tests.test_adaptive_paper_source_hashes_manifest
133 tests OK,rc0.
python3 -B scripts/validate.py
PASS11954 hashes,rc0. All83 source-map rows and actual changed evidence rows match file bytes.
gitleaks dir --redact --no-banner --config .gitleaks.toml blueprints/us-equities/adaptive-paper
rc0.

Both final P1 tests fail before production edits and again using exact reviewed
937fd8f runner/safety source: one assertion failure with six GETs and one
persisted_risk_limits_differ error before owned recovery. The fixed core55 passes,
then the final replay-lock variant is covered separately on the final test bytes.
The first53-test development run retained two failures reflecting the new
pre-send validation point and coordination-only artifact; the tests now assert
missing-source refusal at the callback and absence of every request/trading
journal and trial on the unbound refusal path.

Earlier failed controls remain retained: six/twelve sequential startup sends
at4cd05154, three local recovery/snapshot/telemetry fail-before cases, the
replay-fixture clock correction, the eager disabled-stub limits correction,
and the unchanged two-second native synthetic runner scheduling failure also
reproduced on exact previous production. No order-contract, promotion gate,
native fixture, clock guard or timeout was relaxed to obtain a pass.

Decision record

docs/decisions/2026-10-14-paper-readiness-budget-handoff.md records the ordering,
native lock/source provenance, conservative adoption refusal, sibling-history
boundary, earlier corrections and evidence/qualification limits.

Host evidence

No host acceptance claim or operating deployment. Previously sealed series,
configs and units keep their old pins until explicit successor records.

Checklist

• Existing SQLite/native flock/SDK mechanisms reused; no dependency/workflow/billing change.
• No credentials, real account identifiers or private operating paths published.
• Actual source/evidence bytes registered with the owning tool.
• Explicit paths staged; ordinary commit/push hooks retained.
• Peer worktrees, original engine receipts and sealed records preserved.

Follow-ups

• Keep the runbook guard until merged landing and an operator successor binding: starts at least30seconds/account, preflight refusal ends the series without automatic restart, no lane-B cap changes in the guarded series.
• Lane-B mover startup/replay integration is a separate P1 prerequisite before any bundle containing this retained-window implementation runs mover trials. Today's sealed older-byte lanes are unaffected.
• Pre-lock request timestamp ordering can still conservatively refuse; the corrected handoff snapshot does not prove every reservation interleaving. No excess send is claimed for that clock case.
• Schema-less sibling/provenance and ancestor-safe opens remain separate hardening work. Participating same-root startups must use this coordination; old concurrent implementations are not qualified by it.
• Historical source/measurement captures remain missing; current mirrors and synthetic controls do not replace them.
• Actual broker/session restore, exact-byte recovery, native cancellation/flattening and provider/account-wide measurements remain qualification work.
• Backpressure paper streams and distinguish frozen outcomes #1084 combined readiness/backpressure and exact supplemental two-destination/commit-fault variants remain separate coverage; the quote-age fixture retains real asyncio scheduling.
• The unchanged two-second synthetic native runner fixture has a reproduced baseline scheduling/cleanup failure, retained independently of the passing final module outcomes.