Hand integrity loss promptly to recovery and measure stream follow-ups - #1119

Scope

End the adaptive run loop on irreversible observation loss so owned residuals
reach fresh durable recovery without waiting out duration+cleanup or repeatedly
spending submit slots on refused exits. The same PR closes the adjudicated
stream-batch, opted-counter, submit-diagnosis and order-queue latency follow-ups.

• Base commit: 420452059bc307e13121d9769096291b95cdbf42 (current registry-only rebase, CC semantic-carry adjudication). The reviewed cd81cc1/5b79e897 fix used 929bc3c; earlier a339425 validation/rebases are historical.
• Lane: lane:trading.
• Owned paths: adaptive runner/transport, stream tests, one decision/measurement receipt and registries.
• REQUIRED, pending dependency: Split adaptive paper sells within the durable order envelope #1091 is PARKED. Its re-scoped successor PR must land before its exit bridge can classify integrity-loss SubmissionNotSent as PERMANENT. That part of F1 will be one follow-on commit on the merged main, with a fail-first covering both permanent classification and immediate handoff. It is not implemented by copying the unlanded bridge.
• Deployment condition remains active: no lane packet carries Backpressure paper streams and distinguish frozen outcomes #1084's integrity-loss sell refusal until complete F1 and its measurement are recorded. No existing packet, operating config, order gate or account is changed here.

SOTA sources

• NautilusTrader v2.0.0rc5/1b0a49d2 native queue and sequential dispatch, disconnect discards queued work, and finite node stop grace: use the existing native path, wait for native and durable terminal evidence before requesting stop, and retain unconfirmed orders on the existing configured timeout.

• Landed runner loop at c67bd78b:1847-1985: existing lifecycle and forced-recovery path, reused without weakening order/risk/session gates.

• Landed transport at c67bd78b:957-971 and callback/consumer:1576-1661: actual reservation-before-guard, repeated callback deadline and stale-counter mechanisms measured by fail-first controls.

• Alpaca-py0.44.0/cc4cb3b7, DataStream.stop_ws:222-229 and consume:238-274: supported stop surface and awaited batch processing; the actual pinned SDK executes against synthetic frames in the regression.

• CPython3.12.3/f6650f9, queue.py:133-152 and unittest.mock.patch.object:1632-1655: existing bounded FIFO and supported deterministic/source-control seam. No replacement SDK, queue, library or runtime is introduced.

Evidence-class table

The exact landed-main production and old combined-test source control runs
five assertion-bearing cases: five failures, zero errors/skips. The head's
focused29-case set passes. F3 deliberately controls old test bytes too because
the production counter already exists; this is a missing-coverage defect.

F1's public measurement receipt records the real loop/GuardedSession/Ledger and
recovery routine with a synthetic native lifecycle and a virtual3-second
envelope. Before:29 refused-exit reservations,30 active submits including the
initial entry, limit180; after:zero refused-exit reservations and one active
entry slot. Fresh recovery's first exit is admitted and becomes flat in both
fixtures. This observes budget consumption but does not invent a starvation
result or claim an actual420-second live run. F5's4-second FIFO measurement
is similarly explicit about its synthetic scheduling scope.

Native cancellation dispatch correction

Current registry carry: the CC accepted 5b79e897 → 0e7d50da onto 42045205 after confirming the source-policy JSON delta is exactly the same one added grant with zero removals and the other twelve per-file patch IDs are unchanged. The canonical lander IDs differ (b900db00eb03569db06e5b7a62c4e3e9b781704f / b61b0d4293f58e0854c34836a9a6b7e1aaee81ea) because Git rotates the U0 insertion boundary within repeated JSON blocks; this is an explicit CC semantic-carry adjudication. No production change or follow-up implementation is added by the rebase.

The integrity-loss tick disables admissions, requests cancellation through the existing selector, and keeps the native session alive until both its native terminal callback and durable terminal observation close each requested order. The existing order_timeout_seconds bounds the entire wait, including dispatcher/operation-lock delay. A queued command, cancel_requested flag, or DELETE acknowledgement without terminal evidence is insufficient. Expiry or early native-session exit records unconfirmed counts and integrity_loss_cancellation_unconfirmed, retains unresolved journal state, and yields needs_attention; it does not fabricate cancellation or retry exposure. The existing cancellation policy also selects timed-out, non-halted exits.

tests/integration/stream_cancel_dispatch.py uses a real rc5 LiveNode, native Strategy.cancel_order, both execution queues, the actual adapter and terminal callbacks, with a synthetic broker and a one-order strategy decision. The regression holds submit dispatch for 0.6 seconds after loss, beyond the native shutdown grace. At cd81cc1 it completes teardown with zero port cancellations, one active entry and one unresolved journal order: one assertion failure, zero errors/skips. After the fix, dispatch and terminal confirmation precede session.stop; the pending_cancel control expires with the order retained and needs_attention. No fresh recovery is called. The source comment cites the pinned Nautilus queue/disconnect mechanism.

The mandatory integration runner discovers the native-dispatch cases and the earlier F1/F2 cases without skip guards. Its final observed seven-case run passes without skips. F2 remains PARTIAL for arbitrary healthy successful batches. #1091 is PARKED; permanent F1 classification is REQUIRED and pending on its re-scoped successor PR. The #1084 deployment condition remains active.

Current correction regressions: thirteen named modules (runner, native adapter, transport/recovery, stream follow-ups, source-map and Architecture policy) passed 551 tests, zero skips, on the pinned runtime under the prescribed no-network/private-runtime-lock harness. The real-node single-case baseline at cd81cc1 failed with zero cancel calls, one active entry and one unresolved journal order; it completed teardown and returned one assertion failure, zero errors/skips (rc 1), rather than timing out.

Current default python3 scripts/validate.py: rc 0, 12,030 hashes. All 87 source-map rows and the six owned evidence-registration deltas match actual bytes. GitHub CI and the new-head independent delta/native receipts remain separate requirements; local checks do not claim their verdicts.

Historical validation at 3cb5fc9 on 2026-10-15T00:54Z: 497 named regression tests, five integration tests and three SDK-free follow-up tests passed. Its default validator was blocked by nine inherited UTC-rollover model-currency errors; #1124 owned that incident. That failure is historical: reviewed cd81cc1 on base 929bc3c subsequently passed its default validator (12,029 hashes) and exact-head native receipt. At the reviewed 5b79e89 fix, the newer-main registry conflict was separate and no newer-main merge was claimed. The subsequent registry-only carry now uses the base declared above.

Local commands run

Pinned runtime module commands run inside a network-only namespace with the
normal runtime UID/GID restored before Python starts. Only loopback exists and
there are no routes. This preserves the credential guard's real ancestor-UID
semantics; no guard is bypassed. CPU scopes are idle and TMPDIR is external.

runtime-python -B -m unittest tests.test_adaptive_paper_stream_followups tests.test_adaptive_paper_readiness_backpressure tests.test_adaptive_paper_stream_backpressure tests.test_adaptive_paper_transport tests.test_adaptive_paper_recovery tests.test_adaptive_paper_mover_native tests.test_adaptive_paper_exit_quote_age tests.test_adaptive_paper_runner tests.test_adaptive_paper_start_readiness
458 tests OK/no skips,rc0, in the UID-preserving network-only namespace. Source-hash module separately8 tests OK,rc0.
python3 -B scripts/validate.py
rc0;12023 hashes.85 source-map rows and9 owned evidence registrations match actual bytes.
gitleaks dir --redact --no-banner --config .gitleaks.toml blueprints/us-equities/adaptive-paper
rc0.

Both semantic-parent mutations produce one assertion failure in the combined
module; counter_removed_parent produces one failure in the23-test
stream_backpressure module. Each underlying test fails with zero errors/skips;
the mutation driver returns0 only after verifying those expected failures.

Development failures remain retained: one incomplete synthetic strategy fixture,
one interrupted positive asyncio-sleep under a pinned loop clock, missing
stop_ws on old Mock constructor fixtures, the relative8-second assertion after
advancing the quote fixture clock, and the terminal receipt's new null latency
fields. The first broad user+network namespace run also exposes the credential
guard's correct refusal of unmapped host ancestors. The network-only namespace
fix preserves real ownership; the21 credential/terminal-shape cases then pass.
No production credential, safety, timeout or order gate was relaxed.

Decision record

docs/decisions/2026-10-14-stream-integrity-followups.md records the mechanisms,
source pins, measured limitations, required classification through #1091's re-scoped successor PR and deployment
condition. evidence/receipts/stream-integrity-followups-20261014.json retains
the F1 submit-budget and F5 FIFO observations as synthetic evidence.

Host evidence

No host receipt or deployment claim. Names, prices, HTTP responses, ports and
SQLite journals in tests are declared fixtures. #1084's adjudicated head and
all previously sealed operating records remain unchanged.

Checklist

• Existing upstream lifecycle/SDK/FIFO mechanisms reused; no dependency/workflow/billing change.
• F1 handoff and F2-F5 each have their own observed fail-first control; the REQUIRED permanent-bridge extension awaits Split adaptive paper sells within the durable order envelope #1091's re-scoped successor PR (Split adaptive paper sells within the durable order envelope #1091 is PARKED).
• Source/evidence registration uses actual bytes and the owning registrar.
• No credentials, real account identifiers or operating paths are published.
• Explicit staging, verified no-reply identity and normal hooks/push.

Follow-ups

• Cancellation confirmation follow-up (CC ruling on local v4 P2): REST-poll pending_cancel orders inside _wait_for_integrity_cancellations so terminal confirmation can still reach the native strategy/journal after stream admission stops; retain the configured deadline and unresolved-order recovery path.

• Timeout validation follow-up (CC P3-2): range-check order_timeout_seconds when loading the adaptive config, matching the mover's existing 1–60 second requirement (mover.py:367). The shipped value is 10 seconds; this rebase does not implement that validation.

• Portable source/fail-first evidence (Astra P3): retain historical controls, exact commands/raw before logs and pinned source captures in future portable packets; historical F1/F5 scalars and the prior F1/F2 suite-membership move are not re-established by current positive runs. This correction supplies pinned Nautilus mechanism citations and a genuine real-node fail-first.

• Integration/measurement scope (Astra P3): integration discovery rejects skips but integration is not one of the seven required contexts in the committed ruleset. Synthetic ports establish native dispatch/terminal handling, not broker acceptance, sustained FIFO latency or shutdown/reconnect qualification.

• Historical locators (Astra P3): preserve pinned historical coordinates; refresh unqualified legacy prose in its owning change without presenting old locators as current.

• The former P3-A queued-cancel window is the P1 fixed by this native confirmation wait. Deadline expiry, early node completion, pre-existing task.done-before-health behavior, the non-atomic health/reservation boundary, mover handoff and recovery start/snapshot dependencies remain separately qualified; no blanket adjacent-state guarantee is claimed.

• REQUIRED and pending before F1/deployment completion: Split adaptive paper sells within the durable order envelope #1091 is PARKED; after its re-scoped successor PR lands, use its actual merged bridge to classify integrity-loss SubmissionNotSent PERMANENT; add the combined permanent/handoff fail-first and one commit as directed. One Astra/local/CC wave should assess the completed head.

• Historical portable source/measurement captures and legacy pinned locator refresh remain graded follow-ups.

• Overnight/exception status precedence remains separate; this change does not label a frozen or unreconciled outcome successful.

• Live sustained FIFO, real shutdown delivery/reconnect and order latency acceptance remain qualification work. The new latency fields and synthetic measurement make that future evidence observable.

• F2 closes the reproduced repeated-deadline stall after irreversible loss; it is not a blanket keepalive guarantee for arbitrary healthy successful batches.

• Preserve retained paper budgets across startup and recovery #1105 remains parked; this PR does not reopen it or satisfy its separate retained-budget mover prerequisite.