Roll out USD-M reference manifest V2 on existing ECS host

[proerror77]

Exact target identity

ECS i-6we6afeqsvv8uo1ixmyo (monday-trade-data-26, ap-northeast-1b): only binance-usdm-reference-collector.service, binance-usdm-reference-upload.service, and binance-usdm-reference-upload.timer, plus the digest-addressed isolated shadow unit.

Named controller

codex-root

Candidate identity

• Source/main and PR fix(deploy): accept collocated reference uploader upgrades #808 merge: 9f2d3cbafe9dc9fee25447c0e755236f44a61785.
• Release workflow: 32043628527 (success), artifact ID 9292453505, artifact binance-lob-archiver-linux-amd64-9f2d3cbafe9dc9fee25447c0e755236f44a61785, uploaded ZIP SHA-256 138c761f0c5b7eb7c0f7942b8d2d4c7a48a6e17d8639c253a14e2abf95e5eb0c.
• Immutable image: crpi-ygobwehhof7qs9m3.ap-northeast-1.personal.cr.aliyuncs.com/wildcard0923/binance-lob-archiver@sha256:7e84dc6838cd646b1ebd71b486a43db2fba8fa2fde4d2c407b1d9eae55594d62.
• Collector SHA-256: f3cd2e79179765fdbf71684b3ab6e6de339df24763e9d07e76938f4d6dc90f64.
• Verifier SHA-256: d2c4c234e8fc2232937f1609df4bd30bc53918902586ad2e8577cb6826a4b92a.
• Uploader SHA-256: 35891f1b7383e55a2c9f88e91c409f41cc4f751d8b8f4ff44d69fe77aca44b83.
• Release JSON SHA-256: 3bc4c855199d11f9007f1289e83a3a743632fb77b0d3d6adc5643e1498c2bbd7.
• Shadow control manifest SHA-256: b3ae87e6b7fb7f891f0b2733786c362f27702a6f2dc01d64d2245dd6a44d197a.
• Production control manifest SHA-256: b762bf780d3efedc365ac70459248c1407b56c257be182b35f3d2d6b10d0c4ad.

Exact rollback identity

• Source revision: 32e01918a88355f0708bbacd9ae6d4d5eb32aa13.
• Collector: 8b5b724e49c32ac8ead32c68cc9b5942d9010c1268973785d816ddf9c647b7d4.
• Uploader: 539d6b6530220dadedbe002f5bce4430ab5e572352ca84124295e310ded116b6; sidecar SHA-256 ac7b09f4cce5fbbdb02f44e96650872bd10a4902ebc65f7f8c2b1f9ea0c652d2.
• Release JSON SHA-256: 84aa368d9385ad051ece449e041ede7ba457c9d662953f8e0c247f3f468892ea.
• Installed collector/uploader/timer/env SHA-256: 0d15b20778c729059bfbe03d3498e4eb9e1a60f3f2e53a32f0053959f47e15a7, 0eb681c5b6270d2f86d7913f51f079d376c2a5f6204340d40e587518f1affdf8, 2e6823d2eeb4f5cd285dba9edd8547635c9ce1e372f5681af950785294d085c9, fc06c431c6f7baa94723543cdbc3c066432e4783846c8ce66f53782c56beb7f3.
• Existing cutover script stages these exact assets and automatically restores the prior release after any post-transition failure; failed rollback must leave all four transition units runtime-masked.

Current read-only preflight

• Production collector and timer are active/enabled; executable resolves to the rollback collector; no drop-ins or shadow unit are active.
• Current manifest is binance.usdm_reference_manifest.v1; this is the exact research blocker in Prove one exact-main single-instrument mission with immutable readback #606.
• NRestarts=42 is explained by two observed RuntimeMaxSec=2h5m rotations; PR fix(deploy): accept collocated reference uploader upgrades #808 keeps zero-restart enforcement for candidate and rollback processes.
• /data has 143,773,134,848 bytes available (27% free), above the existing 25% warning floor.

Stop rules

• Stop before any production mutation on candidate/control/rollback digest drift, unsafe owner/mode/path, non-internal OSS configuration, wrong unit/process identity, active uploader at the cutover check, mount drift, or /data below the existing 25% free warning floor.
• Stop the shadow on any restart, InvocationID drift, API/artifact error, V1 manifest, missing modality clock, gap above 90s, artifact discontinuity, or incomplete 3600-second observation.
• Cut over only from exactly one immutable PASSED.sha256 bound to this candidate/control bundle. On production health, upload, identity, or readback failure, use only the cutover script automatic rollback/containment.

Success and independent readback

• One isolated 3600-second V2 shadow gate passes; shadow is then inactive.
• Cutover receipt and PASSED.sha256 validate; exact candidate process and upload timer are active/enabled with zero candidate restarts.
• A fresh production manifest is binance.usdm_reference_manifest.v2 with separate mark_index_funding and open_interest clocks and max gap at most 90s.
• OSS data, manifest, and _SUCCESS are independently read, hashed, and match the production receipt; uploader-owned local source is removed.
• The temporary transport object is deleted only after on-host digest verification and the digest-addressed release remains as rollback/audit evidence.

Out of scope

No account credentials or fee files; no LOB/raw collector cutover; no Paper, Shadow trading, LiveSmall, orders, risk-limit change, or runtime resume. Research consumer/readback remains #606.

[proerror77]

Isolated candidate staging remains pre-production and fail-closed.

• Attempt 1: Cloud Assistant invocation t-jpn6ua4syycxam8 stopped before installing files or starting the shadow because direct ossutil did not receive the ECS RAM role credentials.
• Falsifying check: aliyun ossutil cp through profile ecs-role and the internal OSS endpoint downloaded the exact 3,304,971-byte transport; SHA-256 matched 354fda471c3a894820277992cea822d3c0a5bfb860c59496ec8f89a36967e471.
• Attempt 2: invocation t-jpn6ua52mp51kow downloaded and verified that transport, then stopped during GNU tar extraction because the macOS-produced transport contains LIBARCHIVE.xattr.com.apple.provenance headers. No final release move, unit install, spool creation, or shadow start occurred.
• Independent cleanup readback: invocation t-jpn6ua5av1avzls reports candidate release absent, candidate shadow spool absent, shadow unit inactive; production collector remains the old exact 8b5b724e49c3... binary with collector and upload timer active.

Next bounded hypothesis: reuse the same immutable transport and independent artifact/control hashes, but extract with GNU tar --warning=no-unknown-keyword --no-same-owner. This changes only staging behavior; production remains untouched.

[proerror77]

Attempt 3 (t-jpn6ua5ewlud43k) again failed before extraction or installation. The transport download and exact SHA-256 check passed. The remaining xattr warning came from the preceding tar -tzf file-list check, which still lacked the GNU tar warning option; the three extraction commands were not reached.

Cleanup/readback t-jpn6ua5gqheglq8: candidate release absent, shadow spool absent, shadow unit inactive; production remains exact old candidate 8b5b724e49c3... with collector and upload timer active.

Changed hypothesis for attempt 4: apply --warning=no-unknown-keyword to the tar file-list read as well as all three extraction points. All immutable SHA-256 and exact file-list checks remain unchanged.

[proerror77]

Attempt 4 (t-jpn6ua5ikrvgb9c) downloaded and SHA-verified the original transport, but GNU tar still returned nonzero before artifact checks; hiding unknown-keyword warnings does not make that macOS pax input portable. Cleanup/readback t-jpn6ua5micca7sw again confirmed candidate release/spool absent, shadow inactive, and exact old production active.

Stopped retrying that input. Repacked only the outer transport as portable ustar; all 14 member files are byte-for-byte identical to the released artifacts, exact file list remains unchanged, and the new stream contains no LIBARCHIVE/SCHILY xattrs or com.apple.provenance.

• transport SHA-256: dbfb1046e18c168dc5a1ea566b1a12446f15183878ebf044748fdbb04b5e2700
• size: 3,303,751 bytes
• immutable OSS metadata binds source 9f2d3cb and candidate f3cd2e79179765fdbf71684b3ab6e6de339df24763e9d07e76938f4d6dc90f64

Attempt 5 will reuse the original fail-closed staging script with only this content-addressed transport object and SHA changed.

[proerror77]

Isolated staging succeeded on attempt 5 (Cloud Assistant t-jpn6ua5sm02u77k) using portable content-addressed transport dbfb1046e18c168dc5a1ea566b1a12446f15183878ebf044748fdbb04b5e2700.

Readback at 2026-08-17T16:14:43Z:

• candidate f3cd2e79179765fdbf71684b3ab6e6de339df24763e9d07e76938f4d6dc90f64; all six release sidecars and both control manifests passed
• shadow PID 2897624; InvocationID 0c1ddf1f0d1448e8a1db4e23e407a10f; NRestarts=0
• health healthy; total API errors=0; total artifact errors=0
• manifest binance.usdm_reference_manifest.v2 / data binance.usdm_reference.v3
• 570 active contracts; separate mark/index/funding and open-interest clocks; max gaps 0 ns and 4,683,282 ns
• data SHA-256 052e38ea492a6f5cd30a03a55ae7b588b9cde17aaad735641e63828ac2234e54; manifest SHA-256 8f8f2e6914830f8bea22f7a7003ade553bdad48aebcd5aebba3d07758749cc9d
• production remains exact old candidate 8b5b724e49c32ac8ead32c68cc9b5942d9010c1268973785d816ddf9c647b7d4

Starting the existing mandatory 3600-second shadow observation gate next. No production cutover is authorized by a preparation result alone.

[proerror77]

Current runtime boundary — 2026-08-17T17:54Z

The one-hour isolated collector gate ran for the full window and rejected only because the gate compared a post-scan health update with an earlier scan cutoff. Read-only diagnosis proved the isolated V2 collector itself remained healthy, exact, restart-free, and zero-error.

The shared race was fixed by PR #917 and merged as b664cc65ae0831578d475db7c4fd76c6686c225f; release run 32051097318 completed successfully and published immutable collector image sha256:c7fc0ed9e69ef4eb1be13e158ebe24ecbade5fda0191ab25b13e569d1798bef7. The fix snapshots health once and scans through that health-bound artifact, while retaining the 90-second freshness limit and exact manifest/data binding.

Production cutover did not occur. Control invocation t-jpn6uae0syke2v4 stopped before download or mutation because /data had only 18% free, below the existing 25% floor. Inventory showed the candidate spool was about 130 MB; unrelated Polymarket spool occupied about 341 GB. The floor is not weakened and unrelated data is not modified. Production remains the old exact V1 collector.

For Issue #606 only, the isolated public-data collector was restarted under invocation t-jpn6uaeguzui7eo with native automatic stop timer monday-stop-usdm-reference-shadow-f3cd-20260817t1804z.timer, to close a bounded V2 reference window through 18:00Z. This is a public market-data collector shadow, not Paper/Shadow trading: it has no exchange account credential, order path, risk authority, or Live authority. Its stop and data readback are still pending at this timestamp; no production claim is made.

[proerror77]

Final bounded public-reference readback for Research attempt 005

The isolated V2 public reference collector tail reached its native automatic stop and was independently read back at 2026-08-17T19:04:11Z:

• candidate: f3cd2e79179765fdbf71684b3ab6e6de339df24763e9d07e76938f4d6dc90f64
• shadow state: inactive/dead, PID 0, restart count 0; automatic stop timer/service collected and absent
• BTCUSDT metadata/funding/open-interest: 123 batches each
• first clocks: 1786989598665582645 / 1786989598684069509 / 1786989598762139519
• last clocks: 1786993391079944950 / 1786993391146804643 / 1786993391244057402
• maximum gaps: 66442450688 / 66443375104 / 66448304896 ns, all below 90 seconds
• rules stable at tick=0.10, step=0.001, min_notional=50
• final health object was V2/V3, healthy, zero API/artifact errors, with exact data/manifest/success binding

Research #606 selected only the 21 triplets that bracketed its strict-gate raw segment. Those were copied into an isolated research prefix and independently read back; no canonical production reference key was changed.

Production remains unchanged and active on exact old V1 binary 8b5b724e49c32ac8ead32c68cc9b5942d9010c1268973785d816ddf9c647b7d4; its upload timer is active. /data was 88% used at final readback, so the existing 25% free-space floor still blocks production cutover. The floor was not weakened and unrelated spool data was not touched.

This was public market-data collection only, not Paper/Shadow trading. Issue #916 remains open for its own production cutover evidence.