Record the regular-session no-signal run and the first extended-hours paper run - #149

…ain (after #149)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… after-hours plan (#147)

* Add a bounded IBKR paper-order harness on NautilusTrader 1.231.0's IB adapter (not yet run)

Steps 2-3 subset of engine-nautilus/acceptance-plan.md section 5 on the paper IB
Gateway through NautilusTrader's own IB execution engine. The pinned 2.0.0rc5
Rust adapter denies stock orders locally (nautilus_trader#4983); 1.231.0 is the
newest stable and still ships the Python adapter on the official ibapi.

Frozen plan (revision 3): SPY only, 1 share, at most 6 orders, 1000 USD notional
cap, RTH with a 10-minute close buffer and contract liquid hours (fail closed),
paper port plus a single DU account checked read-only immediately before, cases
C1 resting buy at half the bid, C2 cancel, C3 marketable buy, C4 flatten, a
provisional cleanup_required receipt before the node, an independent official-
ibapi flat proof on every exit path, bounded re-cancels and flatten retries.

Built and reviewed through two independent rounds (order-safety and API lenses,
then a pre-live safety pass); every finding fixed, with offline tests that fail
without each fix (65 tests; simulated-venue flows under 1.231.0 are synthetic,
not IBKR evidence). Known minor signal-handling residuals are in the README.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Record the bounded IBKR paper-order run through NautilusTrader 1.231.0's IB engine (gate unchanged)

13:53 ET on the paper IB Gateway 10.50.1e from a read-only copy of c23525e:
passed in 11.5 s. C1 resting SPY buy accepted, C2 canceled, C3 marketable buy
filled 768.56, C4 flatten filled 768.50; net -2.08 USD after 2.02 USD
commissions; 3 of 6 orders; independent official-ibapi flat proof 0 positions
and 0 open orders; receipt holds no account ids or balances. An earlier run
refused while the Gateway API was Read-Only (IB 321), before any order.

ibkr-local-acceptance stays not_established: reconnect with an open order,
restart reconciliation and the step-4 kill switch are not run yet, and
1.231.0 is not the pinned 2.0.0rc5 destination (nautilus_trader#4983).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Add a predeclared after-hours plan to the IBKR paper-order harness (outsideRth)

- plan-post.json (revision 4): revision 3 with only the session changed to
  16:00-20:00 America/New_York, outside_rth true, contract tradingHours.
- validate_plan accepts exactly the regular (09:30-16:00, no outsideRth, liquidHours)
  or after-hours (16:00-20:00, outsideRth, tradingHours) session.
- Every order builder passes IBOrderTags(outsideRth=True) under the after-hours plan and
  no tags otherwise; the data client's use_regular_trading_hours follows the plan.
- run --plan chooses between the two predeclared plans only; the receipt records the
  plan's sha256 and the contract-hours field used.
- Tests: plan equivalence and refusals, trading-hours window and refusal, predeclared
  plan choice, builder source check, and a 1.231.0 backtest showing every order tagged
  outsideRth under the after-hours plan and untagged under the regular plan. 73 OK.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Record the after-hours IBKR paper-order run (outsideRth fills; incomplete on the flatten step timeout)

evidence/receipt-20260923-post-incomplete.json from a frozen copy of c5468df (sums in
evidence/frozen-c5468df1.SHA256SUMS; 7 files match git archive). 18:58 ET, plan-post.json:
C1 resting buy accepted outside RTH, C2 cancelled, C3 marketable buy filled 768.01, C4 flatten
timed out at 45 s, cleanup filled 767.96; realized -2.07 USD with commission; flat proof passed;
no IB 399/2109 warnings; no account id in receipt or log. ibkr-local-acceptance note appended,
status unchanged (user decision).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Mark the after-hours C4 cause and the non-committed observations as unmeasured; record the plan-note time erratum

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Harden the IBKR paper-order harness per review: pinned runtime, durable run state, notional cap, commission gate, retained bytes

- refused_unpinned_runtime (exit 3) before any connection unless NautilusTrader and ibapi
  are exactly the plan's engine versions; versions_fn injectable for tests.
- The provisional cleanup_required receipt carries ctx.summary() and is rewritten on every
  case change, order, event and fill (RunContext.on_change), so a kill mid-run leaves the
  orders and fills on disk; cleared before the final receipt.
- OrderBudget enforces max_notional_per_order_usd on every reservation, including the C4
  flatten and cleanup sells; a reservation without a price is refused.
- A missing or adapter-zero commission sets roundtrip.commission_unresolved and blocks passed.
- evidence/harness/ retains the exact run.py and plan bytes behind all three receipts (named by
  sha256 prefix); a test resolves every receipt's harness_sha256 and plan_sha256.
- Backtest tests give the simulated venue a fixed 1 USD fee so the passed path stays covered.

Tests: 78 OK under nautilus_trader 1.231.0; 78 (13 skipped) under system python3.
validate.py passed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Persist cleanup, cancel and finish state too; never raise from persistence; name a cleanup notional refusal

Independent review follow-ups (none blocking): start_cleanup, each cancel request, _finish and
the end of the node phase now call ctx.changed(); changed() catches any exception; a notional
refusal during cleanup finishes as cleanup_notional_refused; README states that zero-commission
plans cannot pass and that the atomic writes have no fsync. New test covers the cleanup-start
write, the no-op on an already-ended case, and a failing writer.

Tests: 79 OK under 1.231.0; 79 (13 skipped) under system python3. validate.py passed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Refresh this branch's evidence-manifest entries after rebasing onto main (after #149)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Show the IBKR paper-order evidence on the grand dashboard (gate row; acceptance gate unchanged)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: seathatflowsinourveins <[email protected]>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

section_from() used str.index, so a document lacking the #149 heading (the 16f0a1f text) gave
3 test errors instead of contract failures. It now raises AssertionError naming the heading, and the
first #149 test no longer asserts on the whole document before extracting the section: the module
gives 6 OK on the head text and 4 assertion failures, 0 errors, on the 16f0a1f text.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…rrection #149)

The maintenance doc said the allowlist installers carried --capture-assistant. 0 of 9 Claude and
0 of 7 Codex hook commands did: ai-memory bakes the flag only into the Stop command and only
preserves an opt-in already present (install_hooks.rs:689-701, 1104-1109 @ 89bd8ded;
render_shared.rs:1425-1427), so applications without the flag never added it. Claude was
re-staged with it on 2026-10-11; Codex waits for a trust refresh (trusted_hash changes).

Also: the HookArgs v2.6.3 range in the doc-contract test becomes :2961-2970, test 1 checks every
--check-capture block, a new test fails on the previous text, and the read kit's "repositories
commit the marker" comment is listed as a host note against .gitignore:73.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

section_from() used str.index, so a document lacking the #149 heading (the 16f0a1f text) gave
3 test errors instead of contract failures. It now raises AssertionError naming the heading, and the
first #149 test no longer asserts on the whole document before extracting the section: the module
gives 6 OK on the head text and 4 assertion failures, 0 errors, on the 16f0a1f text.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…d pin it to the installed releases

Fixes the four Codex review threads on #997 (each verified valid at 805aca0):

1. Contradiction. The two paragraphs after the correction said, in the present tense, that both
   clients' assistant Stop excerpts are opted in and that Codex trust ended in a captured outcome.
   They now open "At the 2026-09-21 qualification" (git blame 54896e7 and every artifact under
   evidence/artifacts/memory-landscape-20260921 carry that date) and point at correction #149. A
   new test reads that prose, which correction_149_section stops before.
2. Unverified host state. The 0 of 9 and 0 of 7 counts, the earlier hook applications, the Claude
   re-stage and the pending Codex trust are labelled CC host measurements, cited to correction #149
   in command-center/lessons-20261005/cc-corrections-20261005.md and "not re-read by this change".
3. Pin. The host runs ai-memory 2.6.3 (385b81ea). install_hooks.rs:689-701, :1104-1109 and :1142
   and render_shared.rs:1425-1427 are byte-identical at the same lines in v2.6.3 and v2.6.0
   (89bd8ded), so both pins are cited and the test requires the v2.6.3 pin beside each cite.
4. Trust hash. Re-rendering changes the computed current hash; the stored trusted_hash is
   unchanged, the mismatch marks the hook modified, and the /hooks review writes the reviewed hash
   into trusted_hash (docs/decisions/2026-10-04-codex-rtk-hook-qualified.md Decision 1 at
   rust-v0.159.3; re-read at rust-v0.162.1 = 092d3acd, the installed codex-cli: discovery.rs:796-813
   and :715-721, hooks_rpc.rs:58-92). The test rejects "re-rendering changes ... trusted_hash".

tests/test_memory_landscape_capture_doc.py now has 10 tests: on the 805aca0 doc text the module
gives 6 OK and 4 assertion failures, 0 errors (one per thread); on this text 10 OK.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…/lessons-20261005/...

The #149 correction named the CC's ledger as command-center/lessons-20261005/cc-corrections-20261005.md, the
form the brief prescribed. The CC recorded that as its correction #180: the ledger sits at
coordination/lessons-20261005/cc-corrections-20261005.md (state-root relative), a sibling of command-center/,
not under it. The doc keeps "(host state, not in this repository)"; the test now pins the true locator and
rejects the old form. Found by looking up the file name under the host state root; the CC confirmed it in #180.

Fail-before: with the new pin the module gives 9 OK and 1 assertion failure, 0 errors, on the 8b8c8f5 doc
text; 10 OK after. validate.py and evidence_manifest.py --check pass.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… to the native profile

Fixes the two upheld Codex threads on #997 at 03fc660 (4245318057, 4245318059). The third,
4245318064 (P1, layer-resolution record), is not accepted: the layer-resolution protocol (#1008)
governs layer adoption and verdict decisions, and this change adds no layer verdict. It corrects a
host-state claim under AGENTS.md "Corrections", which the pinned sources already cited (ai-memory
v2.6.3 = 385b81ea, Codex rust-v0.162.1 = 092d3acd) and the fail-before tests below satisfy.

1. The installer lead (4245318057). The retained 2026-09-21 record,
   evidence/artifacts/memory-landscape-20260921/native-commands.json:295-393 at 03fc660, shows the
   three installers run with --capture-assistant, exit 0 each, so the lead was true but undated; what
   it contradicted was correction #149's undated "The earlier hook applications ran without the
   flag". The lead now opens "At the 2026-09-21 qualification", cites that record and says it is not
   the hook state now. Correction #149 says the qualification's installers carried the flag, so the
   flag was lost before the 2026-10-11 measurement (the loss path is host history not reconstructed
   here), and names the two later flagless applications, the #144 repair and the 2.6.3 re-stage of
   2026-10-10. "Not in force" is dated 2026-10-11.
2. The second Codex profile (4245318059). hook-trust.json at 03fc660 lists seven hook commands for
   the native profile (:35-77) and seven for the Desktop profile (:279-321), 14 in all, so the CC's
   0 of 7 is one profile's. Correction #149 and the qualification prose after it now bound the count
   and the Codex conclusions (trust pending, capture off) to the native profile and say the Desktop
   profile was not measured.

tests/test_memory_landscape_capture_doc.py has 16 tests (10 kept, 6 new). On the 03fc660 doc text
the module gives 11 OK and 5 failures, 0 errors; on this text 16 OK. The new tests read the
artifacts: the line ranges the doc cites, the flag and exit code of the three installer records, and
seven commands per profile. manifests/evidence.json: hashes of the doc and the test re-registered
only.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…rrection #149) (#997)

docs: ai-memory --capture-assistant was not in force on this host (correction #149)

* docs: ai-memory --capture-assistant was not in force on this host (correction #149)

The maintenance doc said the allowlist installers carried --capture-assistant. 0 of 9 Claude and
0 of 7 Codex hook commands did: ai-memory bakes the flag only into the Stop command and only
preserves an opt-in already present (install_hooks.rs:689-701, 1104-1109 @ 89bd8ded;
render_shared.rs:1425-1427), so applications without the flag never added it. Claude was
re-staged with it on 2026-10-11; Codex waits for a trust refresh (trusted_hash changes).

Also: the HookArgs v2.6.3 range in the doc-contract test becomes :2961-2970, test 1 checks every
--check-capture block, a new test fails on the previous text, and the read kit's "repositories
commit the marker" comment is listed as a host note against .gitignore:73.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* test: name the missing correction heading instead of raising ValueError

section_from() used str.index, so a document lacking the #149 heading (the 16f0a1f text) gave
3 test errors instead of contract failures. It now raises AssertionError naming the heading, and the
first #149 test no longer asserts on the whole document before extracting the section: the module
gives 6 OK on the head text and 4 assertion failures, 0 errors, on the 16f0a1f text.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* docs: reconcile correction #149 with the dated qualification prose and pin it to the installed releases

Fixes the four Codex review threads on #997 (each verified valid at 805aca0):

1. Contradiction. The two paragraphs after the correction said, in the present tense, that both
   clients' assistant Stop excerpts are opted in and that Codex trust ended in a captured outcome.
   They now open "At the 2026-09-21 qualification" (git blame 54896e7 and every artifact under
   evidence/artifacts/memory-landscape-20260921 carry that date) and point at correction #149. A
   new test reads that prose, which correction_149_section stops before.
2. Unverified host state. The 0 of 9 and 0 of 7 counts, the earlier hook applications, the Claude
   re-stage and the pending Codex trust are labelled CC host measurements, cited to correction #149
   in command-center/lessons-20261005/cc-corrections-20261005.md and "not re-read by this change".
3. Pin. The host runs ai-memory 2.6.3 (385b81ea). install_hooks.rs:689-701, :1104-1109 and :1142
   and render_shared.rs:1425-1427 are byte-identical at the same lines in v2.6.3 and v2.6.0
   (89bd8ded), so both pins are cited and the test requires the v2.6.3 pin beside each cite.
4. Trust hash. Re-rendering changes the computed current hash; the stored trusted_hash is
   unchanged, the mismatch marks the hook modified, and the /hooks review writes the reviewed hash
   into trusted_hash (docs/decisions/2026-10-04-codex-rtk-hook-qualified.md Decision 1 at
   rust-v0.159.3; re-read at rust-v0.162.1 = 092d3acd, the installed codex-cli: discovery.rs:796-813
   and :715-721, hooks_rpc.rs:58-92). The test rejects "re-rendering changes ... trusted_hash".

tests/test_memory_landscape_capture_doc.py now has 10 tests: on the 805aca0 doc text the module
gives 6 OK and 4 assertion failures, 0 errors (one per thread); on this text 10 OK.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* docs: cite correction #149's ledger by its true locator, coordination/lessons-20261005/...

The #149 correction named the CC's ledger as command-center/lessons-20261005/cc-corrections-20261005.md, the
form the brief prescribed. The CC recorded that as its correction #180: the ledger sits at
coordination/lessons-20261005/cc-corrections-20261005.md (state-root relative), a sibling of command-center/,
not under it. The doc keeps "(host state, not in this repository)"; the test now pins the true locator and
rejects the old form. Found by looking up the file name under the host state root; the CC confirmed it in #180.

Fail-before: with the new pin the module gives 9 OK and 1 assertion failure, 0 errors, on the 8b8c8f5 doc
text; 10 OK after. validate.py and evidence_manifest.py --check pass.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* docs: date the installer lead and bound correction #149's Codex count to the native profile

Fixes the two upheld Codex threads on #997 at 03fc660 (4245318057, 4245318059). The third,
4245318064 (P1, layer-resolution record), is not accepted: the layer-resolution protocol (#1008)
governs layer adoption and verdict decisions, and this change adds no layer verdict. It corrects a
host-state claim under AGENTS.md "Corrections", which the pinned sources already cited (ai-memory
v2.6.3 = 385b81ea, Codex rust-v0.162.1 = 092d3acd) and the fail-before tests below satisfy.

1. The installer lead (4245318057). The retained 2026-09-21 record,
   evidence/artifacts/memory-landscape-20260921/native-commands.json:295-393 at 03fc660, shows the
   three installers run with --capture-assistant, exit 0 each, so the lead was true but undated; what
   it contradicted was correction #149's undated "The earlier hook applications ran without the
   flag". The lead now opens "At the 2026-09-21 qualification", cites that record and says it is not
   the hook state now. Correction #149 says the qualification's installers carried the flag, so the
   flag was lost before the 2026-10-11 measurement (the loss path is host history not reconstructed
   here), and names the two later flagless applications, the #144 repair and the 2.6.3 re-stage of
   2026-10-10. "Not in force" is dated 2026-10-11.
2. The second Codex profile (4245318059). hook-trust.json at 03fc660 lists seven hook commands for
   the native profile (:35-77) and seven for the Desktop profile (:279-321), 14 in all, so the CC's
   0 of 7 is one profile's. Correction #149 and the qualification prose after it now bound the count
   and the Codex conclusions (trust pending, capture off) to the native profile and say the Desktop
   profile was not measured.

tests/test_memory_landscape_capture_doc.py has 16 tests (10 kept, 6 new). On the 03fc660 doc text
the module gives 11 OK and 5 failures, 0 errors; on this text 16 OK. The new tests read the
artifacts: the line ranges the doc cites, the flag and exit code of the three installer records, and
seven commands per profile. manifests/evidence.json: hashes of the doc and the test re-registered
only.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>