docs(trading): prepare R3 event-anchored ranking publication - #867

### Scope

The R3 verifier must return a JSON diagnostic when file access or declared packet integrity fails. This freeze-preparation PR requires valid digests/current-packet joins/carriers, corrects repeated binding counts, and handles missing, malformed or inaccessible inputs. The successor additionally protects filesystem metadata probes and CLI root resolution from `OSError` tracebacks.

- Base commit: `06aca3df6c9ba0edea13719e4b7fb8169bba9838`, the corrected main target for this rebase. #900 landed at `36e36ea498e23ffd5bfc103035a2da883a6a08e4`. The reviewed predecessor of this micro-fix is `0a8589350f1a7b18823b231ef3ea81e865aaad79`; it includes the earlier `a3b8e60083c6e9f728bac9f2905b99c5304684db` corrections.
- Lane: `lane:trading`.
- Owned paths: the packet's verifier, README, ROW14 and three SHA256SUMS carriers; `tests/test_r3_verify.py`; and their evidence registrations.
- All17 current normative joins must resolve to the declared current carrier target. Missing fields/targets, external redirection and unexpected mandatory-container entries fail. Valid optional external evidence remains an unverified boundary; the two declared null PIT-04 inputs remain unaccepted placeholders.
- Both alternate carriers must equal `SHA256SUMS`. Nonregular inputs are rejected before opening. File reads, symlink/regular-file checks, optional-target probes and CLI root/default resolution catch `OSError` and return a named JSON error. Verification exits **0 on PASS, 1 on FAIL**.
- Protocol, registry, allfiveR2contracts and runtime receipts retain landed-base bytes. No external evidence source is opened. Keep the PR draft for both micro reads, CI, the remaining J8/PTA disposition and the CC's cue; this does not freeze or accept strategy/data/identity evidence.

The subsequent micro-fix adds direct tests for member bytes changed without resealing, a well-formed wrong ROW contract digest, and a join retargeted to another present member with its correct digest. JSON decoding now reports RecursionError and ValueError as named failures, and recursive traversal reports its own nesting-limit failure. Tests cover native deep JSON/large integers and deterministic decoder/traversal limits. The docstring and ROW source identify the actual `json.loads`/`hashlib.sha256` primitives, retain the CC-R3-1 lineage and local-only scope, and the unused `digest()` function is removed.

Rebase head `58ea680098d0833b5e75fe8829c5167113726112` preserves the seven PR file bytes from reviewed head `e13d1a3c1aa7676b79240fa03cd4afb892d9c4a6` and rebuilds `manifests/evidence.json` from corrected main plus the seven owned registrations. The intermediate unpublished rebase onto `2ecce6ec` was replaced before the one push. The rebase requires both designated micro reads on its delta, green CI on this head and the CC's cue.

Two further SFH disclosures:

- `assert_cli_failure` gains optional `interpreter_args=()`. Its subprocess argv is `[sys.executable, *interpreter_args, SCRIPT, ...]`; the empty default preserves the prior invocation. The huge-integer regression passes `-X int_max_str_digits=4300` to make the child interpreter's limit explicit.
- The verifier docstring and hash-bound ROW14 `verifier.source` replace the former CPython **v3.12.3** attribution (`json.load`/`hashlib.file_digest`) with **v3.13.16** (`json.loads`/`hashlib.sha256`). This is a source-attribution correction; no interpreter installation, runtime-lock change or historical receipt rewrite is performed.

### Explicit behavior and output changes

1. Symlinked **SHA256SUMS, SHA256SUMS.R3 and SHA256SUMS.R3B** are rejected, as are symlinked members. The former carrier handling followed symlinks.
2. A standalone field named **`sha256`**, without a path/artifact/pdf/receipt sibling, must be a **64-character lowercase hexadecimal string**. It is validated without becoming an internal join.
3. A value under a **manifest-named key** must be a valid hexadecimal digest string. Dictionary and list values there fail validation and are **not recursively walked**.
4. Every **`.json` carrier member must have an object root**, including optional members; array/scalar roots fail.
5. The JSON result adds **`internal_binding_count`** and **`binding_count_scope`**. **`internal_bindings` is deduplicated by source file and digest-pointer location**, giving 17 locations rather than 27 repeated checks for the current packet. **`manifest_sha256` can be null** when the canonical carrier/root cannot be read; **`semantic_checks` can be partial or empty** after an early failure. Those conditions accompany FAIL diagnostics and exit 1.

## SOTA sources

- [python/cpython v3.13.16 json](https://github.com/python/cpython/blob/v3.13.16/Lib/json/__init__.py) and [decoder](https://github.com/python/cpython/blob/v3.13.16/Lib/json/decoder.py): installed parser/JSONDecodeError and the native interpreter used for returned failure behavior.
- [CPython v3.13.16 pathlib](https://github.com/python/cpython/tree/v3.13.16/Lib/pathlib), [hashlib](https://github.com/python/cpython/blob/v3.13.16/Lib/hashlib.py), [re](https://github.com/python/cpython/tree/v3.13.16/Lib/re) and [unittest](https://github.com/python/cpython/tree/v3.13.16/Lib/unittest): filesystem predicates/reads, exact byte digests, whole-string validation and the native regression harness. The installed pathlib predicates may propagate PermissionError/ENAMETOOLONG; those operations now share protected diagnostic paths.
- [Published verifier at36e36ea4](https://github.com/seathatflowsinourveins/native-agent-stack/blob/36e36ea498e23ffd5bfc103035a2da883a6a08e4/blueprints/us-equities/event-anchored-ranking/R3-VERIFY.py), [protocol](https://github.com/seathatflowsinourveins/native-agent-stack/blob/36e36ea498e23ffd5bfc103035a2da883a6a08e4/blueprints/us-equities/event-anchored-ranking/protocol.draft.json) and [ROW14](https://github.com/seathatflowsinourveins/native-agent-stack/blob/36e36ea498e23ffd5bfc103035a2da883a6a08e4/blueprints/us-equities/event-anchored-ranking/ROW14-SUBMISSION-R3.json): reference integration and normative schema. Existing `scripts/host_receipts.py:register_file` refreshes the dependent hashes. No new dependency or runner is added.
- Designated GPT verdict SHA256 **406d3bee5bf70ad9617d6749c5206bcae30c7625c8ab683fae6f9b1e36ab53e2** and api-actions J8 silent-failure report SHA256 **3e63cf3b7621e1ae39edd756f12c592c329fa338d37dda08d78160b37d90d7f7** identify the reviewed failure paths and behavior/test gaps. This successor implements the released items; the PTA result and both micro verdicts remain separate.

- CC micro-read SHA256 **192c02a0ff10b34dc4cb18b78a5833b9217fe24965639f73aa26b24c03459084** and J8 test-analyzer rerun SHA256 **53459435782bb7a5428b1da4a85e437d76d6cb0bfb58c3d43f89a3dccf763271** identify the released F1/F2/F10/F6/P3 micro items. The prior 40-case verification remains predecessor evidence; the new head requires its delta read, J8 micro, CI and the CC cue.

- J8 micro report SHA256 **626fbe4ca7fe9071e803cf2313837cc0ae518e0da284af171262fb5b7533e2af**, section3: the two additional disclosures above. The report was hash-verified before use.

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| Filesystem metadata/read/root-resolution errors return JSON FAIL/exit 1 | synthetic / local_integration | Each probe is exercised with PermissionError and ENAMETOOLONG through the CLI entry; native256-character member/reference cases also run. The predecessor reproduced2failures/8errors. |
| New rejection branches and result shape | synthetic / local_integration | Symlink carriers/member, nonUTF8canonical carrier, malformed format/digest/path/duplicate manifest lines, standalone hashes, manifest-named dict/list and optional JSON-array cases. |
| Exact committed packet remains valid | local_integration | Regression calls `VERIFIER.verify(PACKET)` without resealing and executes the native CLI on that same packet, requiring PASS/exit0 and17uniquejoins. |
| Repository and registration consistency | local_integration | Named verifier/classification/pre-push/evidence-manifest modules, native carrier and `scripts/validate.py`; actual returned output retained. |
| Scientific protocol/contracts/gates retain bytes | source_review | Native byte comparison with landed base and reviewed predecessor; only verifier/docs/hash-source metadata and dependent integrity artifacts change. |

Fresh checks on the rebased committed head: `tests.test_r3_verify` **47/47**, `scripts/validate.py` rc0, native verifier PASS with **17 bindings** and nine semantic checks, and each of the three carriers **12/12OK**. The classifier41/pre-push16/evidence-manifest5 results below remain the retained predecessor runs; they were not rerun for this rebase. The PR packet/test bytes are unchanged, and CI acceptance remains pending on the new head.

### Local commands run

```sh
nice -n 10 ionice -c2 -n7 timeout 600 python3 -B -m unittest tests.test_r3_verify
nice -n 10 ionice -c2 -n7 timeout 600 python3 -B -m unittest tests.test_blind_checkout
nice -n 10 ionice -c2 -n7 timeout 600 python3 -B -m unittest tests.test_pre_push_gate
nice -n 10 ionice -c2 -n7 timeout 600 python3 -B -m unittest tests.test_evidence_manifest
nice -n 10 ionice -c2 -n7 timeout 600 python3 -B scripts/validate.py
python3 -B blueprints/us-equities/event-anchored-ranking/R3-VERIFY.py
sha256sum --check SHA256SUMS
git diff --check
```

Final verifier module:47cases; classification41, pre-push16 and evidence-manifest5. All returned rc0 on the implementation predecessor; the fresh rebase results are specified above. Validatorrc0; current verifierPASS,12members/17distinctbindings/9semanticchecks; nativecarrier12/12OK. Locally authored mutation/injection tests and exact-packet integration checks do not supply upstream scientific acceptance, either micro verdict or CI acceptance.

### Decision record

The packet README records the verifier error/count contract, numeric exits and evidence limits. The chosen approach extends the existing stdlib integration, preserving its scientific inputs. Fresh GPT/CC micro reads, CI, any J8 micro required by the PTA result and the CC's cue remain pending. #867 is closed with a pointer to landed #900.

No census count, fit, acquisition, vendor contact, purchase or broker action was performed. Sanitized returned command evidence remains with the custodian; private locators and protected study inputs are excluded from this PR.