fix(trading): restore GET-only flat proofs and recover predecessor pre-skip - #1117

Scope

The seq2 GET-only observer omitted the frozen transport's mandatory before_request callback. Both launch skip and the no-owned-trial recovery hook raised TypeError before HTTP, leaving no native proof. Reuse the frozen mover runner's existing bounded callback, require complete zero-position/zero-open-order GET observations, and add authenticated recover pre-skip for the original predecessor marker.

The new recovery authenticates the original predecessor seal/strict manifest, unchanged config and active/used-GO/payload binding. It writes native proof and standard receipts naming both seals, and retires the unchanged active bytes only when flat. Non-flat produces needs_attention and retains the marker. This path cannot instantiate order transport or touch STOP.

Observer HTTP errors, timeouts and missing/invalid/stale proof now also persist both standard needs_attention receipts. Receipts record actual exit code (null on an execution exception), bounded error class/phase and explicit proof absence with null counts/hash. A failed retry cannot reuse an earlier observation's counts or retire from stale proof. Native HTTP-failure and non-flat-then-failed-retry regressions both fail on the original reviewed helper and pass with this correction.

The recutter captures the original authenticated runtime bytes, preserves frozen runtime/configs, writes a separate new seal and relocates 22 units to a distinct suffix. The existing seq3 PR is unchanged. Activation requires two micro PASS and the existing explicit CC changeover authorization; this PR performs no real recovery, broker request, GO, install, arm or start.

SOTA sources

• Native source pin 8c95a50d10bd2db0b59058c6827275917ce35aa3: transport.py:1009, required keyword-only callback and GET-only clients; mover_runner.py:620, existing 50-request callback, called at 695-697 and 908-914; runner.py:2345, equivalent callback and preflight contract. Verified all three Git blobs equal the exact frozen runtime files.
• alpaca-py 0.44.0: native TradingClient/StockHistoricalDataClient retained. Native tests execute pinned SDK and GuardedSession with only final HTTP answers stubbed; any non-GET fails.
• CPython 3.12.3 ast, supported AST argument inspection; native sha256sum --strict --check seals the new packet.

Evidence-class table

Local commands run

All measured test/validation/commit/push commands use idle systemd scopes. Four named fail-first tests return rc1/four failures against the untouched sealed source: skip observer, no-owned-trial observer, recover pre-skip and variant required-keyword check. tests.test_pre_skip_flat_probe tests.test_flat_proof_recut tests.test_lane_b_stage_latch tests.test_lane_b_recut_boundaries: rc0/61 tests. Native SDK mode with original frozen tree: rc0/14 tests. System Python focused new modules: rc0/14 tests. python3 scripts/validate.py: rc0. git diff --cached --check: rc0. Normal publication hooks retained.

Final receipt correction: FailureReceipt.test_http_failure_records_needs_attention and FailureReceipt.test_failed_retry_never_reemits_stale_nonflat_counts fail against the original reviewed packet with absent receipt and stale count respectively (rc1/two failures). Final focused modules: rc0/66 tests. Native pinned SDK mode: rc0/19 tests. Timeout, malformed/missing proof and stale successful proof are also covered; failure cases preserve original active and STOP bytes and never publish completion.

Decision record

blueprints/us-equities/paper-flat-proof/README.md records the supported recovery/changeover sequence, pinned callers and all 15 direct frozen transport function/constructor calls with file:line. AST census checks explicit required keyword-only arguments and records dynamic kwargs without assuming they supply a missing argument. It does not claim dynamic object-method resolution.

Host evidence

No host evidence/status flip. Native flat proof is pending authorized recovery after both reviews. Private bundle/authority hashes are excluded from public source and this body.

Follow-ups

Existing seq2 lifecycle/STOP semantics outside the new GET-only pre-skip path remain inherited. New/old watchers must never be armed together; the co-op performs the authorized changeover and issuer rebinding. The existing seq3 inventory PR remains independent.

The seq3 retirement inventory must cover seq2-flat watchers in a separate small PR before any seq3 changeover; it is not folded into this fix. Reader follow-ups retained: the bounded 15-signature census omits two inherited TransportError constructors (mover_simulation.py:97,221 at the frozen pin; 17 direct calls total), symbols-only config fallback evaluation, source-commit-to-checkout binding in the builder, and original-versus-masked review attachment hashes/pinned-source captures. The variant check covers top-level deployment and immediate adaptive-paper files, not recursive dynamic dispatch. PREDECESSOR_BUNDLE is deliberately rebound to the supplied original seal. Future markers bound to a new-generation bundle remain a separate lifecycle follow-up.

Checklist

• Fail-first executes native observer/transport rather than checking argv alone.
• Original seal and active bytes remain immutable.
• No workflows, credentials, dependency or broker implementation changed.
• READY for priority Astra and CC Opus micro at this exact head.