Preflight Rust uploader with a real closed Polymarket segment

[proerror77]

Parent

#326

What to build

Before any long Polymarket shadow observation starts, prove that the exact candidate Rust uploader can consume a real, already-closed production market-tape segment. The preflight must independently bind and verify the source data triplet, run the candidate against that real input, publish only to an isolated immutable preflight namespace, read it back, and fail before the observation window if production input is incompatible. Synthetic market data may remain as a unit fixture but cannot satisfy production compatibility.

Acceptance criteria

• The preflight selects a complete real production closed segment and verifies its manifest byte count, SHA-256, and success marker before candidate execution.
• The exact candidate binary, source revision, release manifest, and control hashes are recorded alongside the selected production segment identity.
• Candidate upload uses a unique non-production dataset or prefix, completes OSS readback, and leaves immutable evidence without overwriting a previous run.
• A real segment missing required quote status fields fails closed before the 4201-second observation window begins.
• A compatible real segment passes without synthetic market records substituting for production input.
• Focused tests cover the incompatible real-format counterexample and the ordering requirement that this preflight completes before the shadow service starts.
• Production services and research/snapshot logic are unchanged.

Blocked by

None - can start immediately

Out of scope

Changing uploader validation, normalizing legacy quote records, upgrading the production quote runner, snapshot construction, evaluator/MCTS work, and #235.