fix(polymarket): complete legacy rollback before full-cycle health

[proerror77]

Parent

#499

Defect

The governed rollback restores the legacy Python collector, then waits up to
180 seconds for a new full-cycle health.json before restoring the saved upload
timer state. Production Python publishes health only after an approximately
35-minute catalog/trade cycle. The collector is already active with the exact
saved unit and a stable PID/InvocationID/NRestarts, but rollback exits early,
leaves both timers inactive, and leaves immutable evidence at
PASSED.rollback-pending.sha256.

Focused production proof: post-cutover smoke invocation
t-jpn6sictxlowsg0 restored Python PID 745169, InvocationID
973ec6842b8e4939a5641afae17ef5a0, NRestarts 0, while health was correctly
not yet published; the rollback then failed before restoring timers.

Change contract

For a legacy Python rollback, verify the exact restored collector runtime and
canonical saved unit identity, restore the saved collector/timer state, and
finalize rollback without requiring a new full-cycle health publication. Keep
the existing advanced-health requirement for a Rust-to-Rust rollback.

Acceptance criteria

• Legacy rollback does not wait for health.json before restoring the
  checksum-protected saved timer state.
• Legacy rollback still requires the exact Python ExecStart, stable
  PID/InvocationID/NRestarts, canonical FragmentPath, and empty DropInPaths.
• Saved enabled/active collector and timer state is restored before rollback
  returns success.
• Rust-to-Rust rollback still requires a new clean Rust health publication.
• A focused counterexample proves missing legacy health does not strand the
  timers, while a changed legacy PID/unit still fails closed.

Runtime control

• Target: ECS i-6we6afeqsvv8uo1ixmyo Polymarket raw-ops rollback.
• Candidate: PR fix(polymarket): complete legacy rollback before health #520 head
  cf2102890de62195d3cd10272405d7c41c88095c, based on exact main
  3896eed3a504bfd0e1e424af20a5681a1162ec3a.
• Controller: /root only.
• Rollback: Revert the focused control-plane commit; production recovery uses
  the existing checksum-protected rollback snapshot.
• Stop rule: Any snapshot checksum, canonical unit, PID/InvocationID,
  NRestarts, saved timer-state, or immutable marker mismatch fails closed.

Out of scope

Gate duration, collector/uploader data semantics, Python cycle performance,
quote-collector RuntimeMaxSec, research, snapshot/#235, evaluator/MCTS, and CI
restructuring.

Development workflow

This is a small, fully specified safety-boundary defect with a focused failing
production proof, so a PRD is unnecessary. Implement test-first, then run the
focused control-plane tests, ShellCheck, and code review.

[proerror77]

Audit status (2026-08-01)

代码合约已由 PR #520(2026-07-30T20:20Z merged)交付并通过 focused 测试,但 runtime 关闭证据缺失:没有任何评论或 PR 正文记录"用修复后脚本执行的后续 legacy rollback"的调用 ID、timer/collector 状态恢复校验和终态结果;2026-07-31 的两次实际回滚分属 #527/#529/#531 合约,且 03:17 那次仍留有 #531 缺陷(未关闭)。

下一步:由 controller /root 在 ECS i-6we6afeqsvv8uo1ixmyo 上执行(或指认已发生的)一次修复后 rollback,记录 invocation ID、恢复的精确状态校验、Terminal result 与 cleanup evidence,再走 /pm:issue-close 519。

The code contract landed in PR #520, but runtime closure evidence is missing: no follow-up legacy rollback run with the fixed script (invocation ID, restored timer/collector state verification, terminal result, cleanup) is recorded anywhere. The 2026-07-31 rollbacks belong to #527/#529/#531 contracts, and the 03:17 one still exhibited the open #531 defect. Next step: controller /root records a post-fix rollback run's evidence on i-6we6afeqsvv8uo1ixmyo, then close via /pm:issue-close 519.