fix(paper): refuse malformed preflight collections - #999

Scope

Adaptive paper reads could treat HTTP 200 positions or open-orders {} and JSON
"" as empty collections. Preflight now requires exact lists for both endpoints,
and snapshot collection requires an exact positions list before normalization.
A malformed snapshot freezes admissions and raises the existing sanitized
TransportError, so it cannot become a complete flat-account observation.

• Base commit: 65cf2730068429a1c48c8c18fb24aadef8120817
• Lane: lane:foundation
• Owned paths: adaptive-paper transport.py, README-transport.md,
  source-hashes.json, transport tests and manifests/evidence.json.
• Forward review fix: 011533390e03782bcdef10aac3626e7d8e07b444, directly on
  9b690191e07bafa779bf4c0e5330ed789360243e; one commit closes the shared
  Claude/GPT snapshot P2.

SOTA sources

• alpacahq/alpaca-py v0.44.0,
  commit cc4cb3b7ba50ae250e621983c2779047fb16bb28:
  TradingClient.get_all_positions raw return
  returns the unchecked response with raw_data=True;
  RESTClient._one_request JSON decoder
  returns successful decoded JSON. Native SDK HTTP/JSON handling is retained;
  the application checks the collection contract before normalization.
• The live official commit sources, retained captures and installed 0.44.0
  client/rest files have equal bytes; the live v0.44.0 tag resolves to this commit.
  The next review packet includes UPSTREAM-PINS.json, both
  UPSTREAM-SRC-*.py files and UPSTREAM-TAG.json.

Evidence-class table

Local commands run

/var/tmp/paper-open-e2e-claude-989-venv/bin/python checks.py <owned-root> head
Focused original-9b replay: 3 methods, 9 expected subcase failures, 0 errors/skips.
Focused fixed source: 3 methods, 10 controls, PASS, 0 skips.
Transport/recovery/source-hash/gate-binding/evidence: 195 tests, PASS, 0 skips.
python3 scripts/validate.py
FULL PASS: 70 components, 11,472 hashed files, 4 profiles, 239 receipts.
python3 scripts/evidence_manifest.py --check
PASS.
git merge-tree --write-tree 011533390e03782bcdef10aac3626e7d8e07b444 8bffa2c41692ef483e91b68e3b15aeb331423d2c
PASS; synthetic merged tree 436a0e9174000612df919c60e7b4e272ff490b5f.
/var/tmp/paper-open-e2e-claude-989-venv/bin/python checks.py <merged-worktree> merged
Requested merged matrix: 195 tests, PASS, 0 skips.
Merged FULL validation/evidence: PASS, 70 components, 11,470 hashed files, 4 profiles, 239 receipts.
gitleaks git . --config .gitleaks.toml --redact --no-banner --log-opts=65cf2730068429a1c48c8c18fb24aadef8120817..011533390e03782bcdef10aac3626e7d8e07b444
PASS: 2 PR commits scanned, no findings.

checks.py and its exact argv/cwd/timing/return-code/output-hash receipts are
retained in reviews/pr999-final-20261011T062518Z/ in lane coordination state.
The real SDK HTTP boundary is patched to local successful responses; no broker
or credential-runner operation is involved. JSON null is sent as the bytes
null; tuple and list-subclass controls are SDK-return surrogates that cannot
arise from ordinary JSON decoding. The nine baseline failures include four
empty iterable bypasses and five already-refused shapes whose refusal context
now identifies the explicit list guard. Initial probe setup errors are retained
separately and excluded from fail-before claims.

The synthetic merged commit is used only for local verification; the branch
remains the one forward commit on 9b690191. The review's separate existing
open_orders_complete consumer marker limitation and preflight malformed-row/
invalid-JSON exception sanitization remain follow-ups. Historical broker
qualification is not rerun by these fixture checks.

The genuine merged worktree also runs the archive-dependent runner187,
market-research45, workflow-hardening112 and policy-grants21 modules: 365 methods
reported, no failures/errors, three workflow skips. Two skips require PyYAML in
the SDK runtime; both exact controls separately pass under native Python3.13.16
with installed PyYAML6.0.3. The remaining skip has no hash-frozen workflow to
test. The requested 195-test matrix has zero skips in both trees. These runs
resolve the named archive/Git and YAML controls; no whole-repository test pass
is claimed.

Decision record

blueprints/us-equities/adaptive-paper/README-transport.md records the response
contract and pinned mechanism, including the corrected decoder locator. Keep
the exact-list boundary while native raw-data calls return unchecked JSON;
reconsider it if the adopted SDK validates these collections before returning.

Checklist

• No GitHub Actions or required secrets changed.
• No secrets printed, logged or committed.
• No paid hosting, subscription or billing surface introduced.
• Peer-owned files and worktrees preserved.