… committed-log guards)

Resolve the 28 findings of the study-tree review (H-1, H-2, M-1..M-8, L-1..L-7, F1..F11)
in code, tests and protocol-core-draft.json (review_record round 9).

- Holdout path through run.py and core/holdout.py: authorize (evaluator refusals by rule),
  collect, count (extension decision) and read (carried items only, not-read label after
  refusal, void or deadline); N0 and the window come from the freeze commit (H-1, F4, M-1, M-5).
- core/holdout_store.py merges collection batches per (symbol, session) with rename re-fetch
  rows (M-6).
- runner.context: logs and amendment files must equal origin/main, the protocol is the freeze
  commit's blob, amendment timing is enforced, coverage_decision must match the committed
  count-only output, and a transport deviation governs only when committed and passing
  (F2, F3, M-3, F5, F7, H-2). The mover v3 jsonl logs are no longer gitignored.
- One fetch and one fixed-path results file per stage, and a kill after the write logs the
  file's sha256 (F1, M-4, F10). No bytecode cache from the tree is read (F9).
- run.py count-only command with a trading-host transport and the fetch estimate (M-2, F8).
- Labels, qualifiers, exit counts and the remaining low findings (M-8, L-1..L-7, F11).
- Command-level tests against a temporary repository, so no test depends on the real
  protocol's status (F6).

Synthetic suite: 216 tests, 0 failures, 0 skips under study/runtime.lock (uv 0.12.17,
uv-managed CPython 3.13.15, duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3,
pandas 3.0.6). No market data read, no provider called, no outcome computed. Status stays
draft; frozen_before_outcomes stays false.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…ldout reads, bound transport checks)

Resolve the 23 findings of the second study-tree review (F1-F14, H1, H2, M1-M3, L1-L3) in
code, tests and protocol-core-draft.json (review_record round 10), with the partial
rejections stated there.

- H1/F6: the transport runs in a child process (core/transport_proc.py); a transport
  deviation governs only when it cites the hashed output of a logged run.py transport-check
  run from its tree. run.py dry-run added; the dry run plans every forward exit window.
- H2: holdout count and read fetch and seal in one committed step and evaluate over that
  snapshot in a second; origin/main is checked against the remote with git ls-remote.
- M1: append-only files must only grow across origin/main's first-parent history.
- M2: holdout actions refuse a clock earlier than origin/main's tip; a read whose
  authorization or fetch line reached main after the deadline is not read.
- M3: freeze and reach times come only from commits signed by GitHub's web-flow key,
  pinned as study/pinned/github-web-flow.gpg.
- F1/F8 verdicts, F2 amend records, F3 least-exposed slice for every item, F4 typed void
  deviations, F5 complete validation file, F7/F10/F11 protocol text, F9 per-exchange counts,
  F12/F14 tests, F13 rows_read, validation reach time and the H3-a/b_lane overlap.
- L1 count-only from origin/main with the rate pinned in the protocol; L2 recorded as a
  limitation; L3 every locked package version and RECORD digest checked.

Synthetic suite: 233 tests, 0 failures, 0 errors, 0 skips under study/runtime.lock (uv 0.12.17,
uv-managed CPython 3.13.15, duckdb 1.5.5, exchange_calendars 4.13.2, numpy 2.5.3, pandas 3.0.6;
git 2.43.0, GnuPG 2.4.4). No market data read, no provider called, no outcome computed.
Status stays draft; frozen_before_outcomes stays false.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…dependent holdout read, paced transport)

Resolve the third study-tree review (C1-C15, F1-F7; C15 and F5 are one finding) in code, tests and
protocol-core-draft.json (review_record round 11).

- C1 (high): the dry run refuses any planned request that starts before 2021-01-04 or ends after
  2024-10-31 (core.count_only.check_dry_run_reach), before any fetch or run-log line; the earliest
  session is the 60th after 2021-01-04. freeze_preconditions restates the bound.
- F1 (high): a refused read authorization is spent only after a signed deadline, only if no read
  sealed a snapshot, only if it is the latest read authorization and no granted read is open. A
  sealed read is always evaluated (late ones carry 'late-read'); a timely granted read is always
  carried out; a void count refuses the read at authorization.
- C2 paced child transport at the pinned rate (429 waits a full window); C3 per-session late
  collection; C4 parameters check before count-only/dry-run; C5 per-exchange splits; C6 per-item
  empty counts; C7 test; C8 holdout_label; C9 development not untested by a dropped 2020; C10, C13,
  C14 protocol text; C12 opposite_direction with interval_95; C15/F5 same_snapshot from committed
  lines; F2 due times from signed reach times and record-time check; F3 validation fetch before
  development evaluation, seeded live sample and holdout snapshots in transport-check; F4 pushed
  start lines before count-only, dry-run and stage fetches; F6 ruleset cited.
- Rejected: C11 (already present at ece7b37), C15's count-retry bound (the read deadline is
  earlier), F6's in-repo freeze record and web-UI commit concern (reasons in review_record).
- F7: manifests/evidence.json entries changed on this branch against main are
  blueprints/us-equities/mover-v3/README.md, blueprints/us-equities/mover-v3/protocol-core-draft.json
  and .gitignore.

Synthetic suite: 246 tests, 0 failures, 0 errors, 0 skips under study/runtime.lock (uv-managed
CPython 3.13.15). validate.py, validate_catalogs.py, landscape.py, evidence_manifest.py --check and
verdict_review_gate.py pass. No market data read, no provider called, no outcome computed. Status
stays draft; frozen_before_outcomes stays false.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…es, ns quote order, clustered splits)

Two independent reviews of the study tree at 5b66e23: cross-family Codex
(gpt-6-astra via codex exec, 1 P1 and 4 P2) and a two-pass Claude review
(F1-F10 and F1-F8). Every finding was verified; none rejected. Each fix has
a synthetic regression test that fails without it.

Codex:
- P1: identity dedup ran over the whole stage, so hold-window closes after t
  could remove the candidate at t. Dedup now runs as of each candidate
  session over rows of sessions <= t (core/identity.py dedupe_asof).
- P2: a count's or read's _fetch line pins its ordered base snapshots and
  collection batches; step 2 (and any retry) reads exactly those.
- P2: quotes are ordered by exact integer nanosecond stamps, not by price.
- P2: BH diagnostic split p uses a session-clustered standard error.
- P2: an undefined rebooking factor leaves the terminal-zero rebooking
  sensitivity and is counted, instead of booking -1.

Claude, first pass: count/read recheck carried items against the governing
validation file and refuse malformed authorization records (F1); tests that
can fail for the H3-c holdout sign rule (F2), void/untested p = 1 (F3), the
two-sided MDE level (F4), Holm tie order via reported holm_order (F5),
terminal-merger net and window (F6), sigma_d ddof (F7), rename window and
b_lane_middle (F8); opposite-direction never passes by rule (F9); the
transport child's stdout is closed (F10).

Claude, second pass: a sealed read may be retried after the deadline (F1);
check_coverage_decision requires passing identity probe and fetch margin at
the frozen rate limit (F2); failed count-only/dry-run end lines log every
sealed part, and a run that sealed part 1 fixes later runs' coverage_rule
(F3); collection_limitation covers count snapshots (F4); the pre-freeze rule
exempts part 0's enumeration (F5); late void deviations are reach-checked
and named (F6); runtime.lock verified record updated (F7).

protocol-core-draft.json: the changed rules, a round-12 review_record entry
naming both review families, new draft tree 74297f9 and test_record.
manifests/evidence.json: README.md and protocol-core-draft.json hashes.

Synthetic suite: 263 tests, 0 failures, 0 errors, 0 skips under
study/runtime.lock (uv 0.12.17, CPython 3.13.15). validate.py,
validate_catalogs.py, landscape.py, evidence_manifest.py --check and
verdict_review_gate.py pass. No market data read, no provider called.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…luate, as-of survivors, count retry)

Two independent reviews of the study tree at a0d7300: a Claude review (F1
medium, F2 low) and a cross-family Codex review (5 P2, treated as medium).
Each finding was verified; each fix has a synthetic regression test that
fails without it.

Claude:
- F1: a void deviation applies only if it reached origin/main before the
  outcome it would void could be computed: 'tests'/'validation' before the
  validation evaluation's first start line, 'holdout' (now citing read_utc)
  before the first granted count or read authorization. A later void is
  reported (void_deviations_late, voids_late, holdout_label), never applied,
  so it cannot cancel the read. An applied void recorded after the freeze is
  named. run.py evaluate runs in two committed steps (evaluate_start line).
- F2: identity dedup and the same-session guard use only rename records
  effective on or before t and no (today's) active status.

Codex (P2):
- void recheck: the read refuses under every applying void of any scope;
  late tests/validation voids are reported in holdout_label. The part asking
  that a late validation void still void the holdout is rejected
  (read_timing: no person can cancel the read).
- a count after a failed count must be its retry (retry_of, retry rule).
- sealed_refs reads a count snapshot from the directory its count_fetch line
  sealed, not from the completing authorization's id.
- merge_quotes keeps identical updates inside a page; only a repeat across a
  page boundary is dropped.
- read lines record fee_span [N0, last + 5]; fee first use uses it.

protocol-core-draft.json: the changed rules, a round-13 review_record entry
naming both review families, draft tree 51c1454 and test_record (269 tests,
0 failures, 0 errors, 0 skips). No market data read.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…vent data, fee supersession, dividend cash, hard-kill recovery)

Two independent reviews of the study tree at 910666c: a Claude review (F1, F2
medium; F3, F4 low) and a cross-family Codex review (1 P1, 2 P2). Each
finding was verified; each code fix has a synthetic regression test that
fails on the round-13 code. None rejected.

Codex:
- P1: count and read now refuse unless the working validation file's sha256
  equals the authorization's validation_results_sha256 and the governing
  run-log line's; the read takes the H3-c sign from those bound bytes.
- P2 (dividend cash): cash is taken per ex-date in (e, x] at the previous
  close (D = all/split steps above the 2e-3 band), so it no longer moves
  with the exit session's close after an overnight exit.
- P2 (hard kill): a results file that no line cites no longer refuses the
  retry; evaluate, count and read recompute from the same sealed snapshot,
  replace it and record replaced_uncited_results_sha256.

Claude:
- F1: a per-event or quote response that an earlier sealed snapshot (the
  count's) fetched before its data end is fetched again, so delayed exits
  after the window's last session keep their bars and prints.
- F2: fee amendments supersede earlier rows by precedence, overlapping base
  rows are refused at load, a count or read refuses a fee gap before it
  fetches, and '_fetch' lines count as fee first use.
- F3: fetch steps refuse a sealed ledger that no committed line names; the
  remaining local limitation is recorded in the protocol.
- F4: the protocol states the stage-local screen window dedup uses.

Not fixable without a redesign, listed in the new protocol key
open_before_first_holdout_count (authorize refuses a 'count' while it is
non-empty): R14-open-1, the read's corporate-action end date; R14-open-2,
hard-kill recovery for count-only, dry-run and transport-check outputs.

Synthetic suite: 279 tests, 0 failures, 0 errors, 0 skips under
study/runtime.lock. No market data read, no provider called.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…killing tests)

Codex P2 on 202968f (core/costs.py cash_term): a session of the hold without
its split or all bar was skipped, so the dividend step across it took an
older close as the previous close (closes $20, $40, $39, $39, $39, a $1
dividend ex on the third session and only the second session's split bar
missing booked $0.50, not $1). A dividend's previous close is now the close
of the session immediately before its ex-date, by the XNYS calendar; a step
outside the 2e-3 band across a missing bar leaves the cash undefined and the
trade or H3-c event is excluded like an undefined F. A non-flat-price test
fails on the old rule. populations.corporate_actions, a review_record
follow-up entry and the READMEs state the rule.

New or extended tests kill the round-14 mutation survivors, each checked by
applying the mutation to a git-archive copy: HoldoutStore without the
calendar in _fetch_step (both stores) and _sealed; count and read without
require_fee_coverage; trades._cash on D7's formula; count's hard-kill path
without its recompute or replace; the 'finally' of runner.evaluate_run,
count and read adopting an uncited file it did not write; and the P1 clause
that the working sha256 equal the governing line's results_sha256, alone.

Synthetic suite: 286 tests, 0 failures, 0 errors, 0 skips under
study/runtime.lock (study tree febdf9e). No market data read, no provider
called.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

runtime-requirements.txt (all 10 packages pinned with ==) is scanned
with the requirements.txt parser. runtime.lock is a JSON pin record
with no OSV-Scanner extractor, and the study's freeze gate binds its
sha256, so it is listed as covered by that file instead of being renamed.
This resolves the tests.test_osv_lockfile_coverage failure that failed
validate and validate-macos on #190 (run 36017203000).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…trade date (#190 review fee-date item)

Freeze the exchange/NSCC convention: a sale's SEC Section 31 row is the one in
force on its settlement date (17 CFR 240.31(a)(3)(i), Release 34-49928), its
FINRA TAF row the one on its trade date. The settlement cycle follows the trade
date (T+3 before 2017-09-05, T+2, T+1 from 2024-05-28) over settlement days that
skip Columbus Day and Veterans Day. Holdout fee spans run to the settlement date
of the last sale session. Sources quoted in cost_model.fee_charge_dates; tests
cross the SEC boundaries on settlement dates and the TAF boundaries on trade dates.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…knowns (#190 review N03, F03)

A fetch-incomplete screen or default-asof request no longer drops its sampled
batch from every rate: unknown cohort members count against coverage (official
close, identity, stamps, minute bars), and pairs with unknown candidacy count
toward the fetch-estimate bound. The hashed coverage_rule.year_rule states the
fail-closed cohorts (new COVERAGE_RULE_SHA256). Selective-failure test added.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…d ticker reuse (#190 review F09, N07)

A rename probe matches only over the same sessions on both tickers, spanning
the rename, and on identical quote windows. Each ticker-reuse case is verified,
failed or inconclusive; an observed failure fails the identity gate through the
hashed ticker_reuse_failed_cases_max = 0 (new COVERAGE_RULE_SHA256), and the
zero-case policy records reuse as unverified without failing the gate.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…adopt orphan outputs (#190 review F04, N02 R14-open-2)

The count-only output records its dependency manifest (tree, runtime lock, data
files, parameters, coverage rule, rate limit); pre-freeze runs refuse data files
that differ from data-pins.json; every frozen run refuses an output without its
complete producer line or with dependencies other than the frozen ones. A
count-only, dry-run or transport-check output left by a hard kill before its
line is adopted only if it equals the recomputation from its seals (the
transport check now seals its live samples); nothing is fetched again.
R14-open-2 leaves open_before_first_holdout_count.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…st; empty open list (#190 review N02 R14-open-1)

A count and a read now fetch every corporate action to their own fetch date
(kind terminal_actions) and give its records to the trade walk only (merger
booking, the in-hold split exclusion, the rename sensitivity); the enumeration,
screen and dedup keep the first count's records. The fetch line records the
date and the evaluation reuses it. open_before_first_holdout_count is now empty
and must be empty at the freeze.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…#190 review F02)

cum_dv_at now passes the pinned Bars arithmetic only the 1-minute bars that
finished by the fill time, so a mid-minute fill no longer counts volume traded
after it. Mid-minute regression added; cost_model.lookup.cell_key updated.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…xit split check (#190 review F01, F05, N06)

The count and the read now use the same record exclusions (split record with
F = 1, and a new spin-off record exclusion) and the same accounting check
(defined F and cash term; cash definedness from adjustment factors only, so the
count stays price-free). The count excludes an undefined booking where the
planned exit session traded; H3-c's count applies the legs' accounting. A
delayed exit is re-checked for records through its actual exit session.
Supported entitlements are cash distributions; the no-record limitation is pinned.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…ed sessions reported (#190 review F06, F14)

MDE-exclusion bounds now place undefined draws on the side that cannot support
an exclusion; an item whose undefined-draw share exceeds its tail level or whose
draws are degenerate can neither pass nor be MDE-excluded (underpowered). Item
results report occupied entry sessions (per H1-D group), units and the inference
record; the H3-c MDE table is labelled in log points. A stricter fixed session
floor is recorded as an open decision.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…view F10)

H3-a's exit search can run to E+5, so its entries in the first 6 sessions of a
segment are embargoed like every other arm's, and its bootstrap block is 10
sessions like the other items'. The test that asserted the exemption is replaced.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…line (#190 review N04)

The validation result is timely only if the first signed commit holding the
exact governing bytes and the first holding its governing evaluate line both
reached origin/main before 09:30 ET on N0; a pre-N0 placeholder under the same
path no longer dates a later result. Placeholder and late-line regressions added.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…190 review N05)

Every final holdout run-log line now records its completion's fields, and
run.py complete rebuilds a completion a kill left unwritten from that line,
bound to its results sha256, snapshot, rows and exposure; it is idempotent and
refuses a pending step or a changed result.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…nput vintages (#190 review F08)

universe_and_identity.vintage_scope states what is fetched when and that no
decision-time availability or revision rule is enforced (the provider serves no
point-in-time vintages); every result carries claims_scope and the first and
last fetch vintage it read.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… measured allowance (#190 review F12)

The margin now prices pages at the slower of the pinned rate and the native dry
run's measured seconds per page, the trading API at its own pinned limit, plus
pinned retry and evaluation-and-merge allowances. The transport paces each host
at its own rate. The dry run records its measurement from its seal, and every
frozen run refuses unless the pinned allowance bounds it. The allowance values
remain open decisions for a reviewed PR before the count-only run.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… freeze status (#190 review N08, F15)

The overview names every coverage threshold, says a post-freeze code change
outside study/fetch/ cannot run, qualifies the crash and retry claim and reflects
the round-15 rules. study_code_status.freeze_acceptance lists each freeze
precondition with its status and evidence; artifact presence is not completion.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…ew, not frozen)

Records the round-15 synthetic suite (329 tests, 0 failures, 0 errors, 0 skips)
at draft tree 0e0a53f, the F11/F13 no-change entry, the updated study status
with its open decisions, and the runtime lock's verification note. The protocol
stays a draft; a cross-family pre-outcome review of this tree must follow.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…olution

manifests/evidence.json is main's registry with the stale digests
refreshed. On the merged tree, the study suite under runtime.lock's
test_command runs 329 tests OK. validate.py, evidence_manifest.py
--check, validate_convergence.py --all-recorded,
test_osv_lockfile_coverage and test_mover_v3_data all pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… Fed holiday schedule

Resolves round 15's F06 open decision with a fixed floor of 20 occupied
entry sessions per item or H1-D group, alongside the existing
bootstrap-implied rule: core/stats.py inference_check and mde_excluded
take an `occupied` argument and report insufficient_occupied_sessions;
core/evaluate.py passes its already-computed occupied_sessions through;
core/count_unit.py adds the count_unit key the round-15 author noted
would be needed (:sessions companions to the six count keys), so the
holdout extension decision also sees the floor; core/params.py and
protocol-core-draft.json's minimum_sample record the parameter beside
the existing minima with its rationale.

Reconciles round 15's N01 entry with the committed 2015-09-01
session-calendar start: the 60-session reach before 2016-01-04 is met
at 2015-10-07 (verified against the committed calendar), and
check_study_reach already tests it.

Adds the Federal Reserve's own K.8 holiday-schedule citation beside the
existing SEC and FINRA sources in cost_model.fee_charge_dates, for the
Columbus Day / Veterans Day settlement-day rule (documentation only;
the source confirms the encoded rule and the code needed no change).

Each item gets a dated round-16 review_record entry. New tests cover a
group one below the 20-session floor and one at it, plus the floor in
isolation and the extension-decision key; verified to fail against the
pre-round-16 code via a source-only git stash.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

manifests/evidence.json is main's registry with the stale digests
refreshed. On the merged tree, the study suite runs 333 tests OK under
runtime.lock's test_command. validate.py, evidence_manifest.py --check,
validate_convergence.py --all-recorded, test_osv_lockfile_coverage and
test_mover_v3_data all pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… marker fix)

The previous merge landed while main was red: test_adoption_docs_consistency
failed from 9bdce90 until dcd6f0c, and that test failed CI on dec9034.
This merge brings in the fix; the docs-consistency, OSV coverage and v3 data
tests pass. No file under blueprints/us-equities/mover-v3 changes.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>