Make the 15-minute Polymarket Rust Gate non-blocking on Python

[proerror77]

Parent

#486

Defect

The expedited 15-minute Rust Gate still blocks before shadow startup on a fresh
legacy-Python health publication and a worst-case Python RuntimeMaxSec budget.
Rust candidate validation does not require a particular Python process lifetime;
Python is retained unchanged for rollback while the persistent legacy spool is
the parity input.

Change contract

Permit the signed 15-minute Rust Gate to start immediately without waiting for
Python health publication or Python runtime budget. Keep the Python production
unit unchanged as rollback, retain legacy-spool parity, and keep real-segment,
Rust health, OSS readback, immutable evidence, candidate identity, and cutover
checks fail-closed.

Runtime control

• Target: ECS i-6we6afeqsvv8uo1ixmyo; only the five canonical Polymarket units; research/snapshot/Capture full-update Polymarket CLOB evidence for token microstructure research #235 excluded.
• Candidate: exact-main signed release rebuilt after this PR merges, with candidate, release-manifest, control-manifest, control-archive, and clean-ustar SHA bindings independently read back from OSS.
• Controller: /root is the sole production controller; all other work is read-only.
• Stop rule: stop the Rust shadow and retain Python if artifact verification, real-segment preflight, Rust health, parity, OSS readback, immutable evidence, or the 1501-second Gate policy fails.
• Rollback: keep the current canonical Python unit unchanged through the Gate; if cutover verification fails, restore that verified Python control and stop Rust.

Acceptance criteria

• Legacy-Python mode does not wait for a new/fresh Python health publication
  before starting the Rust shadow.
• Legacy-Python mode does not require remaining RuntimeMaxSec to cover the
  Gate or preflight.
• A Python PID/restart during the Gate does not invalidate otherwise valid
  Rust evidence; the canonical production unit remains untouched for rollback.
• Legacy-spool parity remains mandatory and uses a Rust-derived bounded cutoff.
• The production Gate remains 900 seconds plus the existing 601-second parity
  tail and still requires real closed-segment preflight, Rust health, OSS
  readback, immutable bindings, and fail-closed policy validation.
• Focused counterexamples reject missing parity, Rust health, OSS, or immutable
  evidence even though Python admission is non-blocking.

Test seam

deployment/aliyun/polymarket-raw-ops-shadow-gate.sh through
deployment/aliyun/test-polymarket-raw-ops-control-plane.sh.

Out of scope

Collector/uploader data semantics, production cutover itself, research,
snapshot/#235, changing the Python unit, or weakening Rust/OSS/immutable checks.

Rollout / rollback

Build a new exact-source signed release, independently read it back, run the real
closed-segment preflight, then run the 1501-second Gate. On any failure stop the
Rust shadow and leave Python production unchanged.

[proerror77]

Formal Gate evidence from 2026-07-30 confirms the remaining Python dependency:

• candidate 5fa8b358e971003f0ec49f67a53a5a7cfb3753c4dc3d786a2ded7d76d0e607a7
• Gate invocation 8e9b83c4694a4757b7a2187cb415b500
• Rust shadow stayed healthy for the full 900+601 second window, PID stable, NRestarts=0, no unresolved markets or failures
• final parity evidence SHA ca156351ca5a6c7986576844a62e9e980d6cbeef0cc9b5df53d4d6947bd78412
• Rust produced 507 mature trades, 77 metadata records, and 28 settlements
• the legacy Python spool produced 0/0/0 in the same Rust-derived window
• Rust-only contract checks passed: assets, rotation, trade contract, trade coverage, shared values, metadata context, and duplicate lists
• the Gate failed only because strict parity requires positive legacy counts

This is incompatible with the issue contract that Python PID, health cadence, and
cycle completion do not gate Rust. The focused follow-up keeps strict subset and
shared-value comparison whenever legacy overlap exists. When the bounded legacy
window is empty, it must emit an explicit Rust-self comparison mode and require
positive Rust trades/metadata/settlements, required fields, zero duplicates,
assets, rotation, health, real-segment, OSS, and immutable evidence. It must not
synthesize legacy rows or treat an empty legacy lane as observed equality.

Production remained Python; the Rust shadow was stopped fail-closed.

[proerror77]

Audit status (2026-08-01)

代码合约已由 PR #491、#497(及后续 #501/#516/#554)交付,但 runtime 关闭证据尚不完整:唯一有记录的正式 Gate(2026-07-30)以 FAIL 结束(fail-closed,生产保持 Python),新代码下尚无通过的 900 秒 Gate;PR #554(2026-08-01)显示 cutover 仍在进行中,正式 exact-main 候选尚未发布。

下一步:发布正式签名候选并独立回读 OSS SHA 绑定 → 跑一次完整 900 秒 Gate 至 passed → 完成 cutover 验证与 cleanup → 将 candidate/release manifest SHA、Gate invocation、回滚身份与 cleanup 作为 completion evidence 评论记录后经 /pm:issue-close 关闭。

The code contract is delivered (PRs #491, #497, #501, #516, #554), but runtime closure evidence is missing: the only recorded formal Gate (2026-07-30) ended FAIL with production kept on Python, and no passing 900-second Gate under the final code exists. PR #554 shows the cutover is still in-flight with the official exact-main candidate not yet released. Next step: publish the official signed candidate with independent OSS SHA readback, run a full 900-second Gate to passed, complete cutover verification and cleanup, then record candidate/manifest SHAs, Gate invocation, rollback identity, and cleanup as a completion-evidence comment before closing via /pm:issue-close.