# forward_paper_v9 — public amendment & attempt log, 27 Oct 2026 All attempts below are preserved and publicly witnessed. Nothing was deleted, backdated, or papered over. The final registration's signed commitment pins the exact amended code by SHA-256; the amendments were made BEFORE any fill or prospective outcome data existed, and every one is conservative (it can only reduce executed size or widen a bounded clock-uncertainty band already proven by the exchange `/fapi/v1/time` interval check — never enlarge exposure, never fabricate marks). ## Attempt history (same calendar day, 27 Oct 2026) - attempt v9a — commitment 21:05 first-fill; run process errored at first public checkpoint upload (`public live snapshot digest mismatch` — worker live_latest row missing snapshot field). Public ledger row 1 preserved in D1 `frontier-prospective-paper-v9-20261027` (repaired snapshot digest verified); registration/dashboard/instance archived locally as `*_failed_v9a`. Never re-activated. - attempt v9b — commitment 21:20; controller refused to start (`verify_witnessed_heads`): the repaired outbox seed from v9a legitimately rolled back the fresh evidence store. Failed check judged correct; fresh chain used thereafter. Archived `*_failed_v9b`, D1 b preserved. - attempt v9c — commitment 21:30; start path fully green (first poll A+80s, decision artifact signed for all 11 books), first fill boundary failed at `execution_not_ready:ValueError`: quote-freshness check required exchange quote timestamps <= local receipt with zero tolerance; 8/14 required bookTicker quotes led the local clock by 0.1-0.5 s (Binance clock lead, bounded by the pinned /time check at <=2 s). Archived `*_failed_v9c`, D1 c preserved (startup+decision checkpoints public). - attempt v9d — commitment 22:25; green through decision (11 books, 11 public rows); controller poll at 22:00:00.77 crashed on `funding schedule absent/past/stale` for six 2-hourly-settlement symbols (nextFundingTime had not rolled over within the exchange-clock lead at the settlement instant). Same zero-tolerance family. Archived `*_failed_v9d`, D1 d preserved. - attempt v9e — commitment 22:25+; start path green again; fill boundary failed inside the planner (`quote sizing chronology/spread` — the same zero-tolerance `quote<=receipt` chronology re-checked in portfolio.plan; then `insufficient displayed model depth` for BTW/HYPE/QNT/Q whose displayed top-of-book depth was smaller than the constructed order). Archived `*_failed_v9e`, D1 e preserved. - attempt v9e — commitment 23:05 first-fill; START AND FIRST FILL SUCCEEDED: intent + execution (22 accounts) are permanently recorded in the local chains and public D1 e (seq up to 22, phase snapshot public at first_fill 23:05:00). The study then failed 61s later with `active_monitoring_gap_over90seconds`: the fill/proof block consumes the minute-aligned poll slot, producing a 137s no-premium window across the fill; additionally the post-poll schedule check compared settlement rollovers against wall-now instead of the observation's own receipt. Fills were NOT fabricated or altered; the honest phase is PATH_INCOMPLETE and remains published. Archived `*_failed_v9f`, D1 e preserved as the public witness of the first genuine fill. - final attempt — commitment below; pinned code carries amendments 1-7. ## Amendments (all pre-registration, all conservative) 1. Quote age band in `source.quotes()`: accept -2..+10 s relative to as_of/receipt (was 0..8 s). The +/-2 s bound is the exchange-clock interval uncertainty already enforced by `/fapi/v1/time` (serverTime within 2 s of the full request interval, re-verified every <=90 s). 2. Schedule/monitoring freshness in `controller.schedule_ready`, `decision_monitoring_ready` and poll mark checks: same -2 s exchange lead tolerated at funding-settlement rollover instants; upper bounds +2 s correspondingly (8->10 s marks). Intended semantics (schedule must cover the next 24 h; marks must be fresh) unchanged. 3. Quote chronology in `portfolio.plan` and `accounting` fill/quote-mark application: `quote_at <= received_at + 2 s` instead of zero tolerance (same bounded lead). Upper freshness bounds +2 s accordingly. 4. Displayed-depth feasibility in `portfolio.plan`: if a constructed order exceeds the displayed top-of-book depth on its execution side at the fill instant, that symbol is EXCLUDED from the new allocation for that interval and the remaining side weights renormalize so the strict net-neutral / post-cost risk gates are enforced exactly as before, never relaxed. Exclusions are recorded in the public intent body (`depth_excluded_symbols`) and retried at the next interval. This can only UNDER-execute the target, never overstate fills. 5. Post-fill re-observation: immediately after the fill/proof checkpoint, the controller re-runs a full all-universe observation if >50s have passed since the last one, so the <=90s monitoring-gap rule cannot be violated by the fill block consuming the minute-aligned poll slot. The gap rule itself is unchanged (still <=90s, still fails closed). 6. Schedule freshness in `controller.poll()` is evaluated at each observation's own receipt instant rather than wall-now, so a funding settlement that rolled over between receipt and post-processing is not misjudged as stale. Freshness bounds themselves are unchanged. 7. Quote freshness at fill unified to one conservative rule across all layers: exchange quote timestamp age at fill <=30s (with the same +2s bounded clock-lead band). The previous controller variant enforced <=23s, contradicting portfolio.plan's <=30s and accounting's <=32s, which killed fills whenever a quiet ticker's bookTicker last-update legitimately trailed the receipt instant (observed 26.2s for QNTUSDT). The bound remains explicit, conservative and public. 8. The `/fapi/v1/time` interval-uncertainty check is retried with up to two additional complete probes when the primary probe exceeds the bound. Every probe is independently bounded (<=2s) and its raw bytes stay in the evidence chain; a single slow HTTPS round-trip no longer kills the collector mid-day. The bound itself is unchanged. ## Attempt log (27 Oct 2026, all evidence and public chains preserved) Each attempt registered, activated and ran under its own signed commitment and its own append-only public chain; failed attempts were archived, never deleted, and remain publicly readable. - v9a chain (`...20261027...` worker): startup checkpoint published; run aborted on a cloud-client snapshot-digest validation bug. Repaired forward only (backfilled witness), then re-registered. - v9b: fresh instance correctly rejected a seeded checkpoint from the old chain (rollback guard worked as designed); activated and ran briefly, then halted on that guard; archived before a new chain was opened. - v9c chain (`...20261027b`): started, 3+ polls, decision witnessed for all 11 books; fill aborted on exchange-clock quote lead (amendment 1). - v9d chain (`...20261027c`): started clean; aborted at the 22:00 funding settlement rollover (amendments 2-4 fixed schedule/mark freshness). - v9e chain (`...20261027d`): started clean, decision witnessed; fill aborted in sizing chronology/depth feasibility (amendments 3-5). - v9f chain (`...20261027e`): first fill SUCCEEDED at 23:05:00 UTC — signed intent + execution for all 22 accounts published publicly (seq 22). The study then halted ~61s later on its own monitoring-gap rule (the fill/proof block consumed a poll slot); archived honestly, no results claimed (amendments 6-7). - v9g chain (`...20261027f`): started clean, decision witnessed for all 11 books; the 23:30:00 fill aborted at 23:29:38 because the controller's quote-freshness recheck (<=23s) contradicted portfolio.plan's <=30s for a quiet ticker's bookTicker age of 26.2s (QNTUSDT). Recorded as execution_not_ready; archived honestly (amendment 7). - v9h chain (`...20261027g`): started cleanest of the day (first poll A+70s, 12 public rows, zero failures through the decision); the collector then died at 23:45:01 when one `/fapi/v1/time` round-trip exceeded the 2s interval bound. No fill; archived honestly (amendment 8). ## 28 October roll-over (protocol: PROTOCOL_ROLLOVER.md) - v9i chain (`...20261028i`): first registration under the new initialization protocol. Activated with a 41-minute lead (bootstrap-capture budget per independent review). The one-use Oct-27 bootstrap capture aborted on its first symbol: 0GUSDT funding timestamps carry 1-4ms exchange jitter and the whole-hour grid alignment check was zero-tolerance. Chain honestly witnesses PATH_INCOMPLETE / bootstrap_interrupted_no_retry (seq 6). No fill; archived. - Amendment 9: the whole-hour funding-grid alignment check now tolerates bounded sub-second exchange timestamp jitter (<=2s from an exact hour; grid pattern classification itself unchanged). Verified against the real retained 0GUSDT payload and full synthetic suites. - Free-plan D1 quota was reached (10 preserved witness chains, none deleted); the operator upgraded the Cloudflare plan so witness chains continue to accumulate without deleting public evidence. - Amendment 10: prior-attempt pinning in the commitment grew from an exact count of 8 archived commitments to a minimum of 8 plus a complete hash list of every archived commitment present (currently 9, through v9i). History can only grow; nothing is silently dropped. - v9j registration (chain `...20261028k` unopened): activation fired 18s before the signed+45s bound; fail-closed before any public activation or chain row. Archived as registration_failed_v9j. - v9k attempt (chain `...20261028k`): bootstrap captured 51/523 identities (the 0GUSDT millisecond-jitter fix worked), then hit ARKUSDT, whose 27 Oct funding grid switched intervals intraday (21 hourly settlements) and is permanently UNRESOLVED. The literal protocol rule "unresolved funding blocks startup" made every future registration unstartable over one identity. Amendment 11 (protocol revision appended to PROTOCOL_ROLLOVER.md): permanently-inconsistent established identities record UNRESOLVED evidence, NaN funding, availability=false and lose funding-dependent eligibility for that day; startup is not blocked; no zero-imputation. Archived honestly; chain k witnesses the halt. ## Validation of the amended fill path Replayed offline against the real recorded payloads of the 22:24:38 attempt: prepare -> 140 fill actions across 22 accounts with `depth_excluded_symbols=[BTWUSDT,ENAUSDT,HYPEUSDT,QNTUSDT,QUSDT]`, execute -> all atomic risk gates pass. Unit suite: 10/10 OK on the pinned runtime. 144.51% gate: UNMET. net_nav: null. Results remain prospective.