feat: factor refactor D5a — freeze the exec baseline, catalogue the eleven runners, probe feasibility

[StackOverFlow11]

Factor-layer refactor step D5, part A: the three deliverables that must exist before the unified evaluation runner is built — a tamper-evident freeze of the only reconciliation baseline, a catalogue of the eleven runners' differences, and a feasibility probe. Pure addition (+2064/−0), no engine code touched.

The probe is why this is only part A: it found that D4's materializer cannot run the evaluation universe at all, so D5's four-leg reconciliation (C5) is not executable yet. That finding inserts a new migration step (D4b) before the rest of D5. Details below.

What (5 commits)

1. 6e35d38 C1 — freeze the exec baseline. The 22 exec-basis evaluation artifacts are the reference every later reconciliation compares against; they are gitignored and exist only on this host, and the design's assumed durable copy (scratchpad/baseline_reports/) no longer exists. The new unified runner would write to the same filenames — one run would have destroyed the baseline, and any "reconciliation" afterwards would have compared against files it had just overwritten (the compare_postmerge.py vacuous-reconciliation failure mode this repo has on record). qt/exec_baseline_freeze.py copies them to artifacts/refactor_baseline/exec_baseline/ and commits a sha256 manifest to git (bytes stay gitignored; hashes can only change through a reviewed diff). Reads verify the hash every time; the reader structurally refuses live paths (direct, symlink-alias and .. bypasses all rejected).
   • 77 files frozen, not the 44 requested: the same family also contains 11 _exec_basis_sanity.md (PR feat(analytics): score the eleven minute factors on the 14:51 VWAP exec-to-exec return #79's coverage-bias disclosures) and 22 dashboards, equally single-copy and equally unregenerable. Freezing costs one copy; missing one costs it permanently.
   • Provenance is graded by evidence strength: what is observed is that all 77 share a millisecond-level mtime (a bulk-copy signature), while the 44 close-basis baselines show 11 progressive mtimes matching the fix(analytics): contract v0.8 + v0.9 — cost-correct aligned spread, and gate monotonicity on its N_eff CI #74 rerun window on record. That the bytes came from PR feat(analytics): score the eleven minute factors on the 14:51 VWAP exec-to-exec return #79's run is inferred from the PR record, not observed — hence the field is named frozen_at_git_head, never producing_sha.
2. 559a27d Feasibility probe (qt/saturation_probe.py, a committed reproducible tool, not a throwaway script) — see the finding below.
3. 5d2f311 C2 — catalogue the eleven runners' differences (§6.5: "an uncatalogued difference counts as a failure"). Verified complete by AST-level comparison rather than sampling: _build_book_factors / _write_report / _section_payload are character-identical across all 11; the other shared helpers collapse to one group once string constants are stripped. Also records 7 pre-existing bugs (marked, not fixed) and the FactorSpec 16→20 key drift from feat(factors): D1 — factor registry, PanelField requires, FactorSpec contract v1.0 #86/feat: factor refactor D3 — sparse value store, keys/fingerprints, tail-recompute (+R5 fina horizon unification) #91 that must be pre-registered so reconciliation does not chase it as a D5 regression.
4. d42602e Review fixes (1 HIGH + 2 MEDIUM + 5 LOW/NIT — see below).
5. 1c92053 NIT-A: tell first-time freezers to pass --source-note.

The finding: D4's materializer cannot run the evaluation universe

Measured, reproduced independently by the reviewer, stk_mins_live_calls=0 throughout:

• 995 symbols, 84 of them have their first 1min bar at or after emit_start — so the pooled saturation criterion can never terminate early and always expands to the declared floor. D4's disclosed cost ("a symbol that cannot fill its valid-day pool drags the whole universe to the floor") is structurally guaranteed at full scale, not occasional.
• Disk 8.18 GB (eval window) / 16.43 GB (floor depth); nominal memory 52.7 / 122.2 GB. The per-symbol memory extrapolation is stable within ±1% across n=20/40/60. Peak RSS is 2.2–2.45× the frame (minute_bars concatenates per-symbol parts, so parts and result coexist), which puts the eval window's true peak at ≈115 GB against 56 GB available.
• Not just pooled factors: the bounded path also loads the whole universe in one frame (materialize.py:262), so the eval window alone already exceeds available memory by roughly 2×.
• Three cheaper escapes were evaluated and refuted. Caller-side per-symbol batching is not merely slow — factors/service.py::_ensure_coverage computes gaps by date only, not (date, symbol), so a second batch finds "no gap", returns early, and its symbols vanish from the cross-section silently (the I5a red line). Time-chunking only helps the 3 bounded factors (the 8 pooled ones re-expand to the floor every chunk). Shortening the window doesn't move the pooled load's left edge, which is anchored at the floor.
• intraday_amp_cut closes the last door: it is both pooled and cross-sectional (needs ≥ AMP_CUT_MIN_CROSS_SECTION=10 symbols per day), so per-symbol batching destroys its cross-section and time-chunking cannot bound its depth. Measured: pure factors are bit-identical per-symbol vs whole-universe (max|diff|=0.0 over 728 / 1524 comparable cells), while intraday_amp_cut goes from 1860 finite rows to 0.
• A design-level gap this exposes, recorded honestly: §8 sized the decision hot path (a 20-day tail) and never sized the evaluation path, which is why a whole-universe single frame passed design review. Meanwhile the old runners' docstrings state outright that "the multi-year all-symbol minute panel is NEVER materialized" — D4's load geometry is a regression relative to what it replaces, invisible at D4's 40-symbol smoke scale.
• One idea of the lead's was tested and refuted: reusing qt/panel_freeze.py's loading form instead of building D4b. It has no loading form of its own — it imports the 11 runners and calls their private _load_*_panel, i.e. exactly the second data path decision ③ exists to kill. What is reusable is the shape (read one symbol, aggregate to daily, discard), not the call path.

Consequence: a new migration step D4b (per-symbol streaming materialization) is inserted before the rest of D5, with its own four-leg acceptance including an end-to-end cell-by-cell reconciliation of intraday_amp_cut. The design doc records this as implementation-time amendment A1. C3–C6 remain unstarted — deliberately: fixing the materializer changes the factor values path and must carry its own acceptance, and smuggling it in as a "make the run work" change is the exact shape this project keeps catching.

Review (adversarial, 2 rounds)

Round 1 BLOCK, 1 HIGH: freeze() rewrote the manifest unconditionally and did not inherit source_note, so running the command the docs called "idempotent" on an unchanged tree reported pure success (copied: 0 / already ok: 77) while silently wiping the provenance narrative and re-stamping frozen_at_git_head to the re-runner's SHA — an active false claim, in the one file whose whole purpose is provenance, with all 16 tests still green afterwards. Fixed: provenance is inherited (explicit --source-note overrides), nothing is written when content is unchanged, and the always-running manifest test now asserts source_note non-empty, frozen_at_git_head matches ^[0-9a-f]{40}$, every sha256 is valid hex (previously only length), and size_bytes > 0. The reviewer mutated each of the four assertions separately — all four fail as intended.

MEDIUM ×2, both fixed: a vacuous test in this PR's own suite (test_frozen_tree_is_not_a_git_tracked_path never touched git — commenting out .gitignore's artifacts/ left it passing), now checks the git index via git ls-files -- <prefix>; and the C6 blast radius, where three of the four non-test modules importing the 11 runners were uncatalogued — including qt/panel_freeze.py, the tool that produced the D1 frozen baseline that D5's panel leg compares against. Its documented rerun procedure is a hybrid (old SHA + current branch's file) that goes stale under either C6 disposition; that is now registered too.

Two vacuous mutations were written during this work and both are recorded (in the freeze doc, not just the PR): the first tamper test replaced a byte string that did not exist in the file; the git-index mutation's first version used git add -f, which git refused under a symlink, so nothing changed and the test "passed" for the wrong reason. Neither was caught by a test — both were caught by an observation contradicting an expectation. The reviewer added a third: its own suggested git ls-files --error-unmatch returns rc=1 identically for "not tracked" and "path does not exist", so an assertion built on it would have passed vacuously on exactly the machines lacking the frozen bytes. Review suggestions need mutation evidence too.

Lead independent gates: pytest 2117 collected, rc=0 (2116 passed + 1 skipped without the artifacts symlink; the skip is the byte-binding test, whose bytes are gitignored — the manifest self-consistency test runs unconditionally) · ruff clean · phase0 anchor ic 0.9600 / annual 0.8408 unchanged · validate-config 31/31 · secret scan 0 · --verify 77/77 with frozen_at_git_head still 45c14aa after every rerun · artifacts/refactor_baseline/{panels,panels_d2} byte-identical throughout · worktree clean.

Aside, corrected here because it has been repeated in project docs for many sessions: "pytest's summary line gets swallowed by this machine" is a misdiagnosis — pyproject.toml:53 already sets addopts = "-q", so passing -q again makes it -qq. Drop the flag and the summary line returns. Dot-counting remains a useful cross-check (it caught a 2113-vs-2114 discrepancy here) but it was never necessary for lack of a summary.

Disclosed boundaries

• NIT-B (accepted, not fixed): deleting the frozen tree and re-freezing from a different live source would carry the old provenance note onto new bytes. Reachability is low (requires deleting the tree first) and the manifest diff would show all 77 hash lines changing, which is loud; the docstring now says to pass --source-note when the source really changed.
• The byte-binding test skips where the frozen bytes are unreachable. The recommended hard gate belongs in C5's consumption path (verify_all() 77/77 or refuse to run), not in more test plumbing; noted for D5 part B.

No CLAUDE.md/AGENTS.md changes here (docs PR follows). artifacts/refactor_baseline/{panels,panels_d2} untouched.