v6.16.0 - v6.16.2: The Edge Lab

The Edge Lab arc (v6.16.0 → v6.16.2 + fixes): external strategies on trial, a cockpit that shows the whole machine, and the autonomy stack catching its first bug alone.

• Six-repo audit → 42 zero-authority shadows (tc_vwapbb_*, es_*) with new vwap_dist_pips/adx14 feed features — every cell carries its source's honest evidence (including TradeClaw's own negative costed test) and earns any seat exclusively through family cycles. Full audit with verdicts and license notes in docs/slates/.
• ⚡ EDGE COMMAND on the LIVE page: the stamp → replay → probe → trust pipeline with live counts, admission status straight from the Commissioner, trusted/decay tiles, the open-floor liability hero number, and the hot queue. SHADOW is now EDGE LAB (purple/cyan, NEW badge) with the governance card grid and the full decision ledger — every flip with its reason.
• Δ_promotion instrumentation: every governor run snapshots decision-time scores before outcomes exist; delta_promotion.py will answer whether admission actually predicts the next broker cycle. Verdict withheld until ≥5 outcomes per arm.
• B-119: the Commissioner's reconcile guard flagged an untracked trade over the weekend halt, and the trail led to a critical broker-truth bug — OANDA returns HTTP 200 with the close order created-and-cancelled (MARKET_HALTED), and the engine was booking phantom exits on it. Fixed at three layers with a typed CloseRejected; verified live (trade re-tracked, 6/6 broker match). The machine found, flagged, and led us to this while nobody was watching — which is the whole point.

Suite 384 → 391. Book: 207 setups, 11 ACTIVE, both promotion lanes dark, Commissioner validating.

v6.15.0 - Cheater v4: earn the family policy (PR #7)

Review round 4 — merged from PR #7: the cheater lane now has to earn its policy.

Both critical defects closed:

1. Grid identity can no longer cross seat eras. Governance transitions run a staged, fail-closed pipeline — quiesce → retire → establish policy → flip — through a new /api/pp/retire endpoint that retires exactly the flat grid belonging to the transitioning cell (busy grids fail closed; a grid owned by a different cell is untouched; unknown legacy owners are quiesced, never guessed). A quiesced grid manages its open poppers but cannot fire. Explicit probe:false grids on PROBE cells reconcile down; graduated seats get a fresh full-size grid, not a stale reduced one.

2. PP_ON must prove the grid adds value. Policies qualify independently; FAMILY_PP additionally requires a positive paired GridLift LCB90 over ≥3 paired cycles — unpaired completed-only means can never select the grid. Every unresolved selected-policy cycle and every missing replay path is an admission veto, and the replay window is now 8 days (the live 7-day grid lifecycle + a resolution day). The reviewer's reproduction — PP_ON passing +1.50R while every paired episode said the grid hurt and three cycles sat unresolved — now returns PARENT_ONLY.

Test-suite hardening: tests/test_review_r4.py (18 tests) exercises production symbols — the round-3 logic-snippet tests were replaced, and censored-parent candidacy now has an integration path test. Suite 356 → 374.

Commissioning posture, explicit in config: allow_promotions: false, cheater_promotion_enabled: false, cheater_max_seats: 1, cheater_replay_days: 8.0, cheater_min_paired_cycles: 3, cheater_min_grid_lift_lcb: 0.0. Ordinary parent-metric promotions stay disabled until rewritten around family evidence. The commissioning experiment, when it comes, is one 0.33× whole-family PROBE seat.

v6.13.0 - v6.14.3: The Family-Cycle Program

The Family-Cycle Program — eleven items, one day, shipped v6.13.0 → v6.14.3.

An external design review proved our shadow scorer was grading a materially different trading system than the one using live capital (parent-only, horizon-capped, coarse-geared, session-blind, leg-counted). Rather than defer to V7, every item was implemented in V6, tested, and deployed same-day:

1. v6.13.0 — B-117: families keyed (instrument, session, setup); evidence = completed grid cycles, not legs; asymmetric verdicts (one catastrophic cycle benches; defending takes more cycles than convicting). Cheater v1 retired.
2. v6.13.1 — grid_id on the wire: popper tags name their creating parent (pp_v1;g=<id>); family attribution is an exact transaction-stream join.
3. v6.13.2 — the simulator trades the live gear (2p/0.5min stamped + honored); horizon exits are censored, never outcomes.
4. v6.13.3/4 — the family-cycle replay engine: virtual grids under full live mechanics (marker fires, re-arms, caps, liability tracking, no horizon), both management policies, GridLift.
5. v6.13.5 — Geometry v3: Cell Edge = LCB90 over cycles, account-bps, and the open floor (stops-execute liability behind deferred verdicts).
6. v6.13.6 — PROBE seats (0.33× audition sizing) + era resets on popper-config changes.
7. v6.14.0 — Cheater v3: the ticket is ≥+1.25R of risk actually covered across ≥3 resolved virtual cycles, consistency-gated; GridLift picks poppers ON/OFF per seat; all promotions land on PROBE — full capital is earned by graduation on broker cycles.
8. v6.14.1 — Heat & Trust: two-speed time-weighted scores (2d/21d half-lives, shrinkage), trusted-seat inertia, decay detection, cluster-best gate (one seat per correlated peer group).
9. v6.14.2 — the Selector: ExecutionScore (relative heat + trust floor − correlation − exposure) replaces first-in-config-order at both selection levels, with every losing candidate logged.
10. v6.14.3 — the Δ_hot harness: the pre-registered walk-forward test of the central hypothesis — does recent family performance predict the next cycle? No lookahead anywhere; benchmark books included. Either answer is a result.

Suite grew 291 → 348 along the way. The scoring stack now grades the machine that actually trades: families, cycles, live gear, real selection.

v6.12.7 - Plot Time on the Time Axis

Small fix to the public live tracker: the equity card now moves every hour, because the account does.

B-116 — the README card plotted only the realized curve on a per-trade index axis. A morning with six open trades and a $160 NAV swing rendered as a frozen flat line — indistinguishable from a dead updater, which is exactly how it got read. The data pipeline was never broken (hourly commits all along); the chart just couldn't show open-trade reality.

Now: time on the x-axis, bold realized steps at each close, and a thin blue hourly NAV line (including open trades) sourced from the same public equity.csv. Legend and end-dots included, so realized-vs-floating is readable at a glance.

The lesson on the tin: a public tracker must answer "is it alive?" before it answers anything else. Plot time on the time axis.

v6.12.6 - One Move, One Vote

The Setup Scoreboard was counting stamps as trades.

The engine re-stamps a setup every scan cycle while its conditions hold, so a single four-hour runaway move produces dozens of stamps — all riding one trade. The scoreboard counted each as an independent win, and its recent-50-stamps sim cap meant one clustered day didn't just inflate N, it became the entire sample. That's how ps_floor_break_short read "78 trades, 100% WR, +67.9p" when its true record was 15 decisions going 8W/7L with nearly all the pips from one afternoon.

The fix: stamps ≤30 minutes apart collapse into one episode — one real entry decision, the same rule the SHADOW board's era machinery uses — and the sim runs one entry per episode (most recent 50 episodes). The table now shows N eps (stamps) so both numbers stay visible.

The poster child for why this matters: kc_up_short_lean AUD/USD/london went from "503 trades, 100% WR, +7.2p" to 10 episodes, 62.5% WR, −5.2p — the tab's biggest star was a bleeder wearing a replication costume.

The lesson on the tin: N is the most dangerous column on any scoreboard. Before trusting it, ask what one row-unit is — a monitor that re-observes the same event must never present observations as decisions.

No restart needed (the scorer is a subprocess and the panel is served from disk). Suite 305 green.

v6.12.5 - Three Different Programs (CRITICAL, live accounts)

⚠️ CRITICAL if you trade a LIVE (not practice) account. Pull this release.

B-114 — a regression introduced by the B-112 fix. v6.11.1 reordered popper comments critical-fields-first so truncated live copies keep what attribution needs — but that same reorder pushed sl/tr past the live account's ~32-char clientExtensions truncation, and the recovery classifier still required them. Result: on any bot restart, every truncated popper was misclassified as a parent, and the one-parent-per-pair rule silently dropped the rest of that pair's trades.

We found it the hard way this morning: a 4-trade GBP/USD grid ran unmanaged for ~9 hours — stops still at entry −60p while the trades were +30p in profit. No ratchet, no locks, and the dashboard showed 2 open positions while the broker held 6. (Money outcome: fine — we caught it, locked the profits manually, then the fixed recovery re-adopted 6/6 and the ratchet re-locked higher within seconds.)

The fix:

• Classification now keys on whatever survives truncation: the pp_v1 tag when intact, the new-format prefix fields (anc/lvl/psu), or the legacy sl+tr pair. Extracted to _looks_like_popper() with regression tests pinning the exact mangled strings the live endpoint returned.
• The one-parent-per-pair skip now logs a WARNING naming the unadopted trade — silence is how four trades vanished.

If you're on 6.11.1–6.12.4 with a live account: any restart you did with open poppers left them unmanaged (server-side stops still protect them, but no ratchet/trailing). Pull v6.12.5 and restart once — recovery will re-adopt everything — then glance at the dashboard's open-positions count against your broker app.

Practice accounts were never affected (they don't truncate client extensions).

The lesson, on the tin: encoder, decoder, and classifier are three different programs. When you change a wire format, grep for every consumer of the old shape. Suite 301 green.

v6.12.4 - The Death Rate

The mirror of v6.12.3's engage rate: hitSL — the share of episodes whose MAE reached the setup's stop (config SL − 0.5p; mid-price understates adverse excursion, the executable side hits the stop first).

The two columns together are the whole story of this system's geometry: an engaged trade locks +6 and cannot lose; a death eats the full stop. At lock 6 / SL 60, one death costs ten engages — so read them as a ratio. It's also the strongest single-stat predictor we've tested against per-cell net (ρ −0.47, 33 cells n≥8, vs +0.42 for engage rate).

The autopsy of our favorite trap cell completes: GBP/ny ps_ceil_fade_short engages 75% of the time — and dies 25% of the time. Three engages per death, against the ten required. Every one of our currently-green live families reads 0%.

Also in this release: both hit columns now read live per-setup geometry from config/cells (trigger_pips / sl_pips, including range-sized 40/50/60 stops) rather than constants — re-tune a gear and the columns re-score on the next board build.

Suite 296 green.

v6.12.3 - The Engage Rate

The SHADOW board's hit column now measures what actually decides a trade's fate.

hit≥6p → hit≥trig: the old stat counted episodes whose MFE touched the 6-pip lock level. But the causal event is the ratchet trigger — 8.5p on book gear, 20p on _t20s gear — because an engaged trade locks +6 and cannot lose. The column now measures MFE ≥ trigger + 0.5p (mid-price buffer): 9p book, 20.5p t20s.

Why it matters, from our own tape: the forward test's worst family (rvol_low_240_t20s, −$858) touched +6p in 61% of episodes — looking lively — but reached its actual 20p trigger only 17% of the time. The old column flattered exactly the most dangerous cell shape: the almost-winner that pops small and then drowns. Rank correlation with per-cell net improves (+0.35 → +0.42 across 34 cells with n≥8).

Still not the scoreboard — WR and family broker net remain that. This column's job is diagnosis: a cell that scores high on the old measure and low on this one is the almost-winner signature.

v6.12.2 - Trust the Switch

Small fix, operator-critical: your manual switches now show up instantly.

B-113 — the SHADOW board's payload is cached (rebuilt at most every 15 minutes) and each row's status was baked in at build time. Flip a cell ACTIVE from the dashboard and the engine would trade it on its next scan — but the board kept serving the pre-flip snapshot, showing it still "waiting to promote." The switch worked; the display didn't trust it.

Two layers:

• get_board() now re-joins config/cells at serve time — live status always wins, flipped rows re-tier and the board re-sorts, even when the aggregate payload is stale.
• POST /api/cell/status invalidates the board cache, so the next page load kicks an immediate full rebuild.

The lesson on the tin: cache aggregates, never state. Anything that changes when you throw a switch must be read fresh on every serve.

Five regression tests; suite 296 green.

v6.12.1 - Guardrails on the Dice

Same-day hardening of v6.12.0's cheater rule, plus a status guarantee worth knowing about.

• cheater_min_n = 3 — the +100p cumulative must span at least 3 era episodes; one lucky monster episode can't buy a seat.
• The cheater check now runs before the sequential-peeking guard (the guard protects the statistical bar from evidence re-rolls; a fixed threshold has no p to hack). Found live: the first qualifying cell was silently skipped until this reorder.
• First CHEATER-PROMOTE on record: CAD_JPY/asia ps_ceil_fade_short — a March-replay resurrection cross that had never traded real money — promoted on era cum +116.8p, 5-for-5 green episodes. The same governor run delivered the second autonomous family-red demotion. Both directions of the machine, one afternoon, all in the public ledger.
• DISABLED IS SACRED: a manually disabled setup is now untouchable by every automation — loop filters plus a live status re-check at flip time, regression-tested. SHADOW = on trial, ACTIVE = seated, DISABLED = the human's word, final.

Suite 291 green.