# Binding operational and analysis details, before activation

144.51% gate: UNMET. This document refines PROTOCOL.md; where times differ these explicit details control. Implementation and integration review are pending.

The first modeled fill is **2026-10-29T01:10:00+00:00**, after the possible01:00 hourly funding event can be observed. The first decision remains00:55. Primary exposure period is exactly365days, ending **2027-10-29T01:10:00+00:00**; the last decision closes every account, using the same quote/proof/risk rules with zero targets and including spread/fees. Seed10000 is pre-first-fill capital. Successfully witnessed zero-target decisions within this period count as actual cash allocations; pre-start collection has no returns. All22 account/date slots remain present. Missing values are null, never zero. A failed first boundary is START_FAILED. A later missed boundary or unresolved valuation makes full-path performance unavailable, while already-held positions/cost observations remain recorded. No account or date is selectively dropped.

Collection activation must be signed, independently verified and publicly retrieved before **27Oct23:55UTC**, with source observations starting after the signed activation+60seconds and public verification. If that deadline is missed, this registration cannot start29Oct. The27Oct candle is newly complete after activation. Funding starts strictly at activation, so27Oct funding before activation is never requested; the first full fresh eligibility day is28Oct. Each daily funding interval is [day00:00,nextday00:00). A nextday00:00 event belongs to nextday. Initial v8 grid evidence is used only for indicators under the expressly declared adaptation.

Store metadata at activation, daily00:01 and23:58 (with each receipt). Daily query-universe is the union of all supported names in retained snapshots since the prior day start, all still-held and all ever-held names. Do not infer that a name was unavailable yesterday because it is absent today. Decision eligibility uses the latest metadata actually observed by00:50, but full historical rows and status changes remain retained; a missing required snapshot or established-name bar/eligibility funding is a readiness failure. New names append in sorted exact-source order and receive no historical backfill. Their60-valid-bar count begins at their first retained bar; onboarding metadata does not manufacture bars. Excluded assets and new unknown metadata classes remain explicit.

Daily raw inputs are captured00:01–00:40. At00:50 freeze an exact source prefix and all completed-day input hashes; compute and retain the complete11-book target artifact from that prefix. Re-simulate/recompute targets from that frozen artifact and compare. Sign and publicly retrieve its checkpoint before00:55; if late, miss the decision. A decision at00:55 references only that exact witnessed prefix, even if source collection continues. At01:01 the hourly funding overlap refresh runs and must finish by01:08:30. Every currently known due event with nonzero pre-settlement holdings must have a retained validated rate and mark before sizing, including within the15minute discovery grace. Pending funding blocks fills immediately; the15minutes only governs a declared operational-gap alert. Check pending again immediately before execution; no assumed-zero settlement.

At01:09:38–01:09:44 make one all-symbol bookTicker request, not22 per-book requests. Reject any required quote older than10seconds at receipt, any source timestamp after the actual network receipt, or any fill-age upper bound above30seconds. Clock comparison permits at most2seconds uncertainty, applied conservatively to the before/after source-receipt intervals. Construction occurs after all receipts and prior account-state receipts; actual quote time must follow decision by45seconds. Plan all22 accounts in one immutable intent with modeled fill01:10:00. Its external signature AND public receiver receipt AND successful retrieval must precede fill by at least3seconds plus the2second clock bound. Failure by01:09:55 means no fill. The modeled fill time is exactly01:10:00; actual processing/ledger receipt is in [01:10:00,01:10:05], never before. Quote freshness is checked through the receipt upper bound as well as modeled time. Any intervening accounting mutation invalidates intent. A pending unexpected event or source gap invalidates readiness; there is no silent revised intent within the same boundary.

Risk limits apply at rebalance after all legs and costs, not continuously between rebalances. Marked gross/net may drift as prices move; show that drift without an opportunistic intraday rebalance. Marked equity<=0 is insolvency and halts further fills. Missing/stale marks or observed costs leave NAV unavailable. No exchange liquidation or margin sufficiency is inferred. Cost7 and14bp paths are separate accounts with the same frozen target decisions and source quotes; sizing uses each account's post-cost equity, so quantities may differ. Both are reported throughout. The absolute owner gate is evaluated on the7bp path after full reconciliation, with14bp sensitivity and all ten plus control disclosed; it is not a selection-adjusted superiority test.

Separate family inference at the end: paired common-date daily log equity differences against TSI, all ten candidates on the7bp path; no missing/nonpositive equity permits a test. Primary statistic is mean daily log difference. One-sided centered circular moving-block bootstrap with block14days,10000resamples, NumPy PCG64 seed20261029, p=(1+exceedances)/(10001), Holm correction across all ten at0.05. Block7/30 sensitivity and the14bp paths are secondary, explicitly labelled; they cannot replace a failed primary claim. Report all books, available counts, missing dates, correlations and full selection-trial lower bound, not merely successful names. A family's apparent winner meeting an unadjusted owner gate is not statistical proof of edge.

Terminal source audit recaptures all known/ever-held symbols' effective settlements over the full study in fixed one-calendar-day pages, in deterministic day/symbol order, with the same schema/duplicate/saturation policy. Finish within7days after terminal fill. This bounded revision audit does not establish source finality. Retain later-discovered corrections; if material after the audit deadline, withdraw or restate any affected gate conclusion, never rewrite past decision sizing. Unresolved or missing interval leaves gate UNMET and net performance unavailable. All original provisional snapshots remain available with receipt times and versions.


Final implementation clarifications before registration: actual network receipt establishes when quote/mark bytes were available. Preserve that exact receipt; do not fabricate a delayed receipt to satisfy a clock test. Require source transaction time<=actual receipt, observed quote age<=8seconds (plus2s adverse offset gives10), conservative fill-age bound through modeled fill+5s receipt+2s uncertainty <=30seconds, and source transaction lower bound minus2s strictly after decision+45s. Clock offset is bounded using the entire source request interval, not only its end; wall/monotonic continuity is checked across requests. Runtime/source measurements remain observational, conditional on the venue/TSA clocks, not a proof of absolute UTC.

All HTTP429/418 responses permanently halt this collector registration, with the full Retry-After retained durably. There is no automatic source resumption, including after process restart; a separately reviewed future registration is required. This is more conservative than merely waiting a parsed cooldown and cannot shorten the venue's requested ban. Before the first fill, monitoring gaps outside the required full28Oct day remain explicitly retained initialization gaps; continuous coverage is required from28Oct00:00 through first fill. After first execution, any >90s monitoring gap immediately makes the whole path incomplete and NAV null. No automatic gap clearing is implemented.

Minute marks are source-ledger observations. Public provisional views apply those fresh retained marks to a copied account state; they do not append a redundant accounting mutation each minute. Funding and fills mutate the accounting chain. Every public marked view binds the source prefix as well as the accounting prefix. Account existence/seeded balances do not establish an active test: only the first durable executed boundary does. No pre-fill seeded equity curve is published. Accounting replay uses an in-memory cache invalidated by connection changes, external data version or schema version; initial startup verifies the full durable chain. Source-kind indexes bound routine lookups. These are implementation optimizations, not a claim of one-year uptime or throughput.

Persisted targets are rebuilt from the exact as-of source prefix by01:09:30, before the actual01:09:38–01:09:44 quote request. Failure or slow replay misses that boundary. All held-symbol overlap funding requests must complete and record success by01:08:30, even for cash-only first startup; an interrupted start marker is not a success. Every external acknowledgement retains exact sequence, hash and server receipt; startup compares those plus witnessed source/accounting prefixes to reject rollback. The checked project/transitive archive source buffers are executed by a verified-byte loader; the manifest is not merely a check of paths subsequently imported. Runtime/filesystem administrator substitution remains outside that guarantee.

The specified terminal full-study recapture and family bootstrap/Holm analysis are required future components before any promotion claim. They are not automated by the present operational collector, which ends after the terminal modeled close. A separately registered, implemented and independently reviewed terminal audit must satisfy the fixed endpoint,7day correction audit and inference details above. Until then net_nav remains null and the hard-coded gate remainsUNMET. This limitation does not authorize interim winner selection or a changed analysis endpoint.