Week of July 26 – August 1, 2026

This week at a glance

319 user-facing PRs merged across Layer, Overwatch, Locus, RouteShift, Codex, and Invest.

New features

• Layer: add admin-client membership guard ratchet (LAY-749) (#246)
• Layer: add extension API key controls (LAY-740) (#236)
• Layer: privacy-first Sentry + PostHog observability (LAY-760) (#228)
• Layer: add x_PriceBasis and ground the contract-withholding rationale (LAY-734) (#225)
• Layer: make spend surfaces cost-basis aware (LAY-734) (#220)
• Layer: one-shot RouteShift cost-basis backfill script (LAY-728) (#218)
• Overwatch: advance Overwatch Live code-safe acceptance tranche (#333)
• Overwatch: schedule the weekly CBP ingest with a per-form freshness gate (#380)
• Overwatch: Task 4 artifact decision + Task 7 envelope/RLS/crosscheck coverage (#381)
• Overwatch: AXO-715 migration-version collision guard (#371)
• Overwatch: AXO-714 unified pipeline-freshness monitor + h3_coverage_estimate (#370)
• Overwatch: ingest CBP CF-1400/1401 vessel entrance/clearance reports (#347)
• Overwatch: SAR-hybrid dark-fleet verification — GFW cross-val + per-pixel detection (F1–F5 fixed) (#169)
• Locus: AXL-519 OSHA PSM citations table (APRS + RLS) (#391)
• Locus: add building_permits chunk_id backfill engine (AXC-372) (#382)
• Locus: orphan reaper delete lane — age-guarded, double-flagged, fail-loud (#390)
• Locus: dry-run orphaned-R2 archive reaper (report only) (#389)
• Locus: AXL-517 add uspto_patent_grants SourceSpec + LoaderRunResult emission (#388)
• Locus: add dataset card slug linkage to data_source_catalog (AXC-264) (#380)
• Locus: add training example emission with negative examples (AXC-256, AXC-258) (#379)
• Locus: add label provenance emission to civic extractor (AXC-260) (#378)
• Locus: add extraction trace emission to permit extractor (AXC-263) (#377)
• Locus: bridge LoaderRunResult to codex ingestion manifests (AXC-265) (#376)
• Locus: integrate GSA lease escalation clauses (2026-FOI-01417) (#308)
• Locus: APRS coverage report persistence + scheduled live-audit workflow (#341)
• Locus: ship Locus Live KG decision and demo contracts (#310)
• RouteShift: RSH-151 + RSH-152 admin config CRUD for classifier and guardrails (#183)
• RouteShift: RSH-135 async LLM classifier dimensions (#182)
• RouteShift: RSH-139 pre-dispatch guardrail scanning (#181)
• RouteShift: RSH-88 Phase 1 — dual-read v3 path, KEK adapter injection, DEK cache (#174)
• RouteShift: RSH-88 Phase 1 — envelope codec, KEK adapter, schema foundation (#173)
• RouteShift: RSH-134 Phase 3 — worst-case reservation + atomic cascade settlement (#172)
• RouteShift: RSH-85 Phase 1 — pure shadow-routing contract + disabled control plane (#170)
• RouteShift: wire the quality cascade into the served path, gated on a billing ack (RSH-134 step 2) (#168)
• RouteShift: wire the quality cascade into the served path, gated on a billing ack (RSH-134 step 2) (#166)
• RouteShift: expose savings on /admin/usage/by-identity (RSH-137) (#165)
• RouteShift: surface aggregate actual cost on QualityCascadeResult (RSH-134 step 1) (#163)
• Codex: APRS->HF staging transform + reclassify 3 dead-endpoint feeds to manual_only (#124)
• Codex: bind text_view_version and dataset_card to training exports (AXC-257, AXC-264) (#123)
• Codex: permit Socrata canaries, customer-portal prototype, wiki reconciliation (#122)
• Codex: add APRS and training foundations (#98)
• Codex: add governed training data contracts (#97)
• Codex: add training provenance and reproducibility foundations (#96)
• Invest: add native cache recovery and quarantine contracts (#703)
• Invest: add Nautilus cache admission probe (Part of TRD-1075) (#694)
• Invest: name the broker-open/cache-absent position-truth divergence (detector) (#689)
• Invest: isolate Nautilus cache Redis configuration (Part of TRD-1074) (#692)
• Invest: complete proposal accounting and PAPER rotation evidence (#685)
• Invest: TRD-972 — pre-restart order-state preflight + last-moment drain for mid-RTH deploys (#649)
• Invest: two-stage sizing capture, no_action_class, lighter traces (+ dual-review fix round) (#607)
• Invest: Layer-2 responder on-box systemd deployment + dead-man liveness (#592)
• Invest: NeuralWatt spend estimator (visibility-only) + runaway guard — no cap on normal use (#582)

Updates

• Layer: add concurrency & git discipline invariants (#250)
• Overwatch: AXO-421: harden legacy R2 archive rollback safety (#340)
• Overwatch: 6-PR ticket gauntlet — AXO-453, AXO-214, AXO-479, AXO-421, AXC-369, Overwatch Live tranche (#385)
• Overwatch: Add governed IRS transition candidate outbox (#373)
• Overwatch: AXO-672: bound live-map fallback diagnostics (#339)
• Overwatch: AXO-681: restore and harden dark-event archive RPC (#338)
• Overwatch: AXO-676: remove exact counts from viewport pagination (#337)
• Overwatch: checkpoint confirmed production mutations (#331)
• Overwatch: checkpoint Overwatch Live production acceptance (#329)
• Overwatch: AXO-118/119/122/124/128/131/222/234 release train (#325)
• Overwatch: AXO-360: package Core cargo estimator for Edge (#312)
• Overwatch: centralize cargo visit persistence decision (#310)
• Overwatch: route visit lifecycle decisions through core (#308)
• Locus: operator-lane artifact — drop redundant archive_log partial index (#387)
• Locus: publish shared infrastructure inventory (#328)
• Locus: regenerate Locus agent SOT (#366)
• Locus: close out ingestion release tranche (#365)
• Locus: Complete APRS ingestion health and IRS transition contract (#362)
• Locus: AXL-429: restore EPA ICIS-NPDES permits ingestion (#346)
• Locus: AXL-352: lock transit-frequency monotonicity (#302)
• Locus: AXL-382: harden HHS OIG Edge Function authorization (#348)
• Locus: AXL-502: recover national MDRS snapshot timeout (#351)
• Locus: AXL-418: gate clean Supabase migration bootstrap (#344)
• Locus: AXL-385: reconcile live Scout worker count (#342)
• Locus: AXL-502: ingest official MSHA MDRS weekly snapshots (#329)
• Locus: disable failing Scout sources with explicit containment (#311)
• RouteShift: fix shadow-sampling HMAC contract in RSH-85 memo (RSH-145) (#164)
• RouteShift: design for quality-cascade wiring + Phase 3 accounting (RSH-134) (#160)
• RouteShift: RSH-132/133 research + recover RSH-85 shadow-routing design (#159)
• Codex: Fix Codex ingestion trust-boundary gaps (#121)
• Codex: add deny-default public data expansion backlog (#120)
• Codex: Complete governed cross-platform ingestion handoff (#119)
• Codex: Type-guard drain batch 8: the migration planner, the intake bounds, and the gate's own blind spot (#115)
• Codex: Type-guard drain batch 7: the registry, the emitter, and the label metadata (#114)
• Codex: Type-guard drain batch 6: the two evidence-reaching canonicalizers (#113)
• Codex: Type-guard drain batch 5: the freeze-side leaf, and the keys nobody was checking (#111)
• Codex: Calibrate the sidecar verify-peak gate to what it actually measures (#112)
• Codex: Type-guard drain batch 4: the forgeable-membership class, end to end (#110)
• Codex: Quality-gate honesty + type-guard drain batch 3 (#109)
• Codex: Type-guard drain batch 2: source-policy identity and public evidence allowlist (#108)
• Codex: Type-guard drain batch 1: forged chunk_id family and rights-projection bypass (#107)
• Codex: AXC-349 AC2 (closed): capture the build environment and interpreter version (#106)
• Codex: AXC-349 AC2 (partial): enforce dependency pins against actual imports (#105)
• Codex: AXC-353 AC2: runnable PyArrow / SQL / graph loader quickstarts (#104)
• Codex: AXC-351: type-guard ratchet gate for isinstance trust boundaries (#103)
• Codex: Harden publication, family pack, and OpenSanctions intake (AXC-309/283/276) (#95)
• Codex: Codex Graph: harden adjudication, ER, and geospatial gates (#86)
• Codex: Codex Graph: harden release-read, maritime draft, and metadata gates (#85)
• Codex: Integrate waves 28-42, AXC-261 export-quality command, CI gates, and the 4-of-4 gauntlet fixes (#102)
• Invest: TRD-1009/TRD-1089/TRD-1101: add native evidence contracts (#717)
• Invest: TRD-1102 to TRD-1105: consolidate native session and causal authority (#713)
• Invest: TRD-1106: retire direct pin and expiry close writer (#710)
• Invest: TRD-1097: pin native Portfolio Greeks boundary (#708)
• Invest: retire stale per-leg combo authority (#707)
• Invest: centralize position identity normalization (#706)
• Invest: converge native combo compiler arithmetic (#705)
• Invest: TRD-1088: consolidate options paths on native Nautilus owners (#702)
• Invest: TRD-965: segment realized edge by structure (#697)
• Invest: TRD-1087: complete direction-classifier wiki ingest (#698)
• Invest: TRD-948: classify delayed order acceptance truthfully (#696)
• Invest: TRD-964: meter cash_secured_put in the concentration + regime entry gates (#686)
• Invest: TRD-1024/1016/1026 guard-cluster reliability design — durable critical delivery, bounded SIGTERM exit, unrepairable-class classification (#657)
• Invest: TRD-1017: account-scope the opening-equity witness + persist it durably (#671)
• Invest: TRD-1030 + TRD-1038: portable, fail-loud morning-triage launcher and deploy trusted-path allowlists (#669)
• Invest: TRD-1043 — upstream issue FILED as nautilus_trader#4619 (#677)
• Invest: TRD-1043: pin the nautilus netting-reconciliation fail-open contract (verdict + AST/behavioural pins + wiki note) (#668)
• Invest: external-operator (Hermes) readiness — delete stale briefings, onboarding runbook, wiki fixes (#653)
• Invest: TRD-998 — root-cause the BAG leg-fill index:order_position mint seam (remediation deferred to TRD-1009) (#645)
• Invest: TRD-1013 design — reconciliation leg-on-BAG orders-row fidelity (DRAFT, gauntlet owed) (#639)
• Invest: TRD-993 — harden Linear auto-close, mandate Part-of references (#635)
• Invest: cap review loops at 2-3 rounds + hard 7-cycle breaker (owner directive) (#623)
• Invest: cap adversarial review loops (#624)
• Invest: TRD-966: gauntlet fixes + migration 0074 view guards + agent-worktree reclaim tooling (#614)
• Invest: TRD-948/940/941: exit-fill writeback reconciled with deployed master, position_effect (0072), combo slippage normalization (#608)
• Invest: TRD-924/925: bounded short-PUT planned-risk fallback + env-controlled breakdown veto (#606)
• Invest: TRD-945/TRD-947: protection-latency sweep + governor clamp receipt (#599)
• Invest: TRD-939: wire rationale/confidence_breakdown/sizing into the weekly decision-review evidence (#604)
• Invest: TRD-933/TRD-935: alerter crash-loop detection + self-observability (#597)
• Invest: TRD-929/TRD-935: budget-exhausted freshness status + alerter-timer watcher (#598)
• Invest: TRD-931/913/929/930: outage hardening — broker hard-exit watchdog, equity keep-warm, absolute decision-freshness alarm, drill procedure (#596)
• Invest: TRD-916/917/921: RTH conversion + bookkeeping repairs (mixed-combo generation filter, Track C warmer, close-tag effect override) (#595)
• Invest: align Invest public docs and memory config (#593)
• Invest: comprehensive read-only review + 3-family adversarial gauntlet (kimi-k3 / Codex Sol / Gemini 3.1 Pro) (#571)

Fixes

• Layer: verify authoritative membership before issuing service-role client (LAY-768) (#252)
• Layer: isolate Git fixtures from hook state (LAY-766) (#249)
• Layer: enforce FOCUS 1.3 profile gate (LAY-747) (#244)
• Layer: upgrade Next.js to 16.2.12 to clear middleware/auth CVEs (LAY-739) (#243)
• Layer: pin Next.js to patched 16.2.12 (LAY-739) (#241)
• Layer: paginate reconciliation reads (LAY-748) (#242)
• Layer: enforce stable merge gates (LAY-725, LAY-746) (#240)
• Layer: reject malformed RouteShift usage (LAY-733) (#237)
• Layer: restore scheduled sync execution (LAY-737) (#234)
• Layer: preserve extension usage if gap storage fails (LAY-738) (#233)
• Layer: provision baseline subscriptions atomically (LAY-737) (#231)
• Layer: run docs-agent driver from the axiom-docs checkout (single source) (#230)
• Layer: per-request CSP nonce so Axiom Drift actually hydrates (LAY-761) (#229)
• Layer: restore FOCUS reconciliation source-derived expectations (LAY-735) (#227)
• Layer: disclose cost basis on the last three blind readers (LAY-734) (#226)
• Layer: remove reconciliation rules that could never fire (LAY-734) (#224)
• Layer: make all four FOCUS cost columns non-nullable and gate un-costed rows (LAY-734) (#223)
• Layer: stop the cost-basis caveat asserting what it cannot know (LAY-734) (#222)
• Layer: flag unrepairable rows when upstream returns no records (LAY-728) (#219)
• Layer: bill plugin surcharge into per-person RouteShift spend (LAY-728) (#217)
• Overwatch: harden sanctions identity query (#361)
• Overwatch: restore durable delivery and inbox state (AXO-479) (#360)
• Overwatch: support ANTAQ annual data bundles (#351)
• Overwatch: repair verification scratch-table RLS (#349)
• Overwatch: fail closed when a GLEIF load parses zero relationship rows (#383)
• Overwatch: raise CBP ingest attempts to 9/form and un-gate the primaries (#382)
• Overwatch: fail closed and fence UCC processing (#355)
• Overwatch: make deploy verification auth-aware (#348)
• Overwatch: fail closed on ambiguous UCC termination status (#334)
• Overwatch: escalate lifecycle-status date lines in UCC cheap path (AXO-465 fail-open) (#375)
• Overwatch: harden AXO-222 database readiness (#378)
• Overwatch: add -- end-of-options separator before server-controlled Location (AXO-634) (#376)
• Overwatch: make the CBP loader actually parse the live reports (#374)
• Overwatch: enforce bounded cargo validation matching (#350)
• Overwatch: contain AXO-436 adjudication queue server-side (#354)
• Overwatch: retry positions schema-cache reads (AXO-714) (#359)
• Overwatch: close AXO-423 detector evidence boundary (#356)
• Overwatch: degrade positions/latest gracefully when service-role key is absent (AXO-711) (#343)
• Overwatch: classify nonfatal resource errors (AXO-652, AXO-690) (#367)
• Overwatch: fail closed on ingestion run identity (#368)
• Overwatch: filter unattributable Server Action Sentry noise (AXO-448) (#365)
• Overwatch: reconcile AXO-418 schema drift and durable recovery (#352)
• Overwatch: gate route replay by port scope (AXO-688) (#362)
• Overwatch: close AXO-419 API and live-map gaps (#353)
• Overwatch: fall back from failed Mux hero playback (AXO-698, AXO-700) (#366)
• Overwatch: bound dashboard navigation prefetch fan-out (AXO-608) (#364)
• Overwatch: repair kinematic conformal test collection (AXO-422) (#363)
• Overwatch: drop unattributable browser-global onerror noise from Sentry (AXO-706) (#344)
• Overwatch: harden CBP loader failure handling + UTC occurred_at (#357)
• Overwatch: pin Stripe apiVersion in stripe client (#358)
• Overwatch: retry transient AXO-222 image pulls (#345)
• Overwatch: restore AXO-417 Deno load contracts (#342)
• Overwatch: stabilize homepage hydration period (AXO-605) (#336)
• Overwatch: retry transient status-check schema cache writes (AXO-704) (#335)
• Overwatch: run docs-agent driver from the axiom-docs checkout (single source) (#332)
• Overwatch: harden confirmed production migration tranche (#330)
• Overwatch: stop status_check silent-ingestion recursion (#328)
• Overwatch: redirect map-host dashboard deep links (#326)
• Overwatch: publish empty archives for all PMTiles sources (#327)
• Overwatch: publish valid empty tanker and bulker archives (#322)
• Overwatch: fail health closed on stale AISStream (#323)
• Overwatch: keep active AIS run open for streaming batches (#321)
• Overwatch: parse block-scalar skill descriptions (#311)
• Overwatch: lock cargo shim trim metadata parity (#309)
• Overwatch: harden pg-cron failure lookbacks (AXO-477) (#307)
• Overwatch: make obfuscation scoring writes honest (#306)
• Overwatch: harden Overwatch Live release and acceptance gates (#305)
• Locus: complete v2 temporal cutover (#393)
• Locus: restore AXC-373 scheduler acceptance (#392)
• Locus: deterministic archive batch selection — id tiebreaker (POI selector + archiveToR2) (#386)
• Locus: archive punch-list — missing-ETag fail-loud, run-completion null-guard, rowsArchived doc (#385)
• Locus: persist canonical R5 accessibility input (#323)
• Locus: add full unique index on archive_log(table_name,run_id,batch_num) — fixes receipt ON CONFLICT regression (#381)
• Locus: loss-safe R2 archive delete retries — FK-safe AIS delete + bounded POI delete (#371)
• Locus: AXL-506 parse composite keyset-cursor watermark prefix (#375)
• Locus: AXL-507 make civic_records projection drop observable (#374)
• Locus: AXL-511 ledger-safe reconciliation of poisoned v1 cursor (#373)
• Locus: AXL-472 count state-total rows in patent join coverage (#372)
• Locus: AXL-472 persist skipped_non_grant_count for non-grant PTGRXML docs (#367)
• Locus: align freshness source count with evidence (#364)
• Locus: accept duplicate historical migration names (#363)
• Locus: apply post-review EPA permit hardening (#360)
• Locus: AXL-510 FtM Airplane schema + AXL-294 revoke heavy RPC public execute (#359)
• Locus: OpenSanctions bulk APRS envelope + FTM provisions parity (#337)
• Locus: quiesce HMDA cron through scheduler API (#358)
• Locus: repair managed pg_cron terminal path (#357)
• Locus: stamp HMDA APRS envelope at write time (#349)
• Locus: backfill unknown ruling occurrence timestamps (AXL-503) (#350)
• Locus: harden Stripe webhook onConflict + ordering safety (#356)
• Locus: pin Stripe apiVersion in stripe client (#354)
• Locus: reconcile live migration version (#352)
• Locus: APRS coverage audit fabricated schema-missing findings from sample-query errors (#347)
• Locus: registration exemptions for 9 secondary destinations (AXC-252 audit findings) (#345)
• Locus: run_all aggregate uses partial_result attribute (contract consistency) (#340)
• Locus: require accepted Scout catalog watermarks (#326)
• Locus: enforce canonical civic record writes (#327)
• Locus: fail loudly on incomplete government dataset loads (#336)
• Locus: atomically bind FAF5 completion evidence (#324)
• Locus: enforce strict OpenSanctions scheduler results (#331)
• Locus: add 'provisions' to TS Sanction allowlist + interface (Python↔TS parity) (#338)
• Locus: bound OSHA archive downloads (#335)
• Locus: route DOI PAL to operator-auth hold (#320)
• Locus: prevent demographics RPC integer overflow (#318)
• Locus: run docs-agent driver from the axiom-docs checkout (single source) (#313)
• RouteShift: pin Stripe apiVersion in savings-reporter (#186)
• RouteShift: clear stale DEK version on provider-key rotation (#180)
• RouteShift: harden provider-key envelope reads (#179)
• RouteShift: observe gated credential load and cooldowns (#178)
• RouteShift: reconcile unknown provider costs safely (RSH-149) (#177)
• RouteShift: restore CI and harden shadow experiment controls (#176)
• RouteShift: run docs-agent driver from the axiom-docs checkout (single source) (#175)
• RouteShift: downgrade CSP report logging from warn to info (#169)
• RouteShift: de-stale /compare/openrouter against OpenRouter's shipped features (RSH-144) (#167)
• Codex: run docs-agent driver from the axiom-docs checkout (single source) (#116)
• Codex: harden portal ontology and family contracts (AXC-286/289/290) (#94)
• Codex: harden audited boundaries (AXC-292 AXC-293 AXC-294) (#93)
• Codex: harden AIS, identity, and entitlement gates (AXC-287/321/333) (#92)
• Codex: harden lineage and release audit integrity (AXC-320, AXC-330, AXC-352) (#91)
• Codex: harden permit, KG, and ingestion boundaries (#90)
• Codex: close identity and release-operation gaps (AXC-321/333/354) (#89)
• Codex: close fail-open identity gaps (AXC-343/346/351) (#88)
• Codex: fail closed on temporal, permit, and OSHA evidence (#87)
• Invest: align cache admission probe authority (#701)
• Invest: isolate Nautilus cache authority (#699)
• Invest: _persist_event returns True on committed write — volume-control dedup now engages (#687)
• Invest: EOD brief fires on weekends/holidays and reads a UTC "today" (#661)
• Invest: never let a price stop sell a load-bearing protective long (#684)
• Invest: TRD-1054 — entry fence must never publish a transient OPEN verdict (#678)
• Invest: TRD-1025 lane-A/B per-class critical cooldown (#659)
• Invest: TRD-1045 — stop the reconciler queueing starts behind an in-flight stop, + page on in-session restart storms (#672)
• Invest: nautilus int-backed enums silently disabled three side checks (close-tag override, naked-short shadow cover, lifecycle leg matcher) (#660)
• Invest: TRD-1033 — concurrent deploy-writer refusal fails CLOSED (exit 1 + audited break-glass) (#670)
• Invest: TRD-1042 null ibapi UNSET sentinels at the audit-write seam + TRD-1015 exclude-and-log impossible price evidence in small-n drift (#665)
• Invest: TRD-1046 — persist entry-blocking equity-baseline state to runtime_events (#674)
• Invest: TRD-1017 (PARTIAL — does NOT close the ticket) — decouple the account-scoped open witness from position-truth (#664)
• Invest: TRD-1018 journal pointer in the probe Repair line + TRD-1020 page on drain probe error (#666)
• Invest: TRD-1025 — differentiate lane-A/B critical page content (#655)
• Invest: TRD-928 follow-up — detect-and-report combo-LEG classification (not silent-waive) (#658)
• Invest: TRD-928 combo-LEG parent-aware orphan classification (#654)
• Invest: TRD-949 — durable event-time edge/tier evidence for clamp decisions (#648)
• Invest: TRD-950 — close-ledger fail-open capture for cache-absent positions (#646)
• Invest: TRD-1011 h2h residuals, rebased + re-adjudicated vs master (Part of TRD-1011/TRD-1012) (#642)
• Invest: TRD-989/996/997 — EOD brief fills-day caveat + close-book completeness (#631)
• Invest: TRD-985 gauntlet-lint P0/hypothesis-leak gaps; TRD-992 mypy comment refresh (#626)
• Invest: TRD-1010 — scheduled brief failures are now loud, not invisible (#634)
• Invest: TRD-999/1000 — wiki_code_drift fails closed on git errors, adds PR-stage range check (#627)
• Invest: TRD-1012 — name every dropped tagged dispatch event; provenance has_decision_id + ERROR writeback (#640)
• Invest: TRD-983 — wait_for_green do-while probing, monotonic $SECONDS deadline, terminal log (#628)
• Invest: TRD-994 — deterministic panic-flatten native alert dialog handling (#630)
• Invest: TRD-969/971/990 — alerter-timer proof, lane-drift guard, ET day windows (#636)
• Invest: TRD-1001 — dual-condition slippage outlier clamp for low-priced options (#629)
• Invest: TRD-1014 — gauntlet_lane_call.sh makes inline-key argv exposure mechanically impossible (#638)
• Invest: TRD-970 — trade_quality_target absent-knob debug parity line (#633)
• Invest: TRD-1011 — record lot provenance for generic-spread leg fills (#632)
• Invest: TRD-954/955/956 lifecycle-provider connect bounds, durability-degraded severity, restart-guard age bounds (#619)
• Invest: armed-halt visibility, halt-class split, pre-arm unseeded-baseline guard (#617)
• Invest: TRD-846 lot-attribution legacy fallthrough + decision-id backfill (#625)
• Invest: tag-derived close-row convention, duplicate-row self-heal, pin/expiry CAS heal, orders_schema logging (#621)
• Invest: checkout-failure ordering, governor out-of-window review, guard-error isolation (#618)
• Invest: EOD brief error-visibility + transaction hygiene (#615)
• Invest: withhold NULL-limit combo rows, add outlier clamp + order_origin exclusion (#616)
• Invest: TRD-840 escalation tool-call budget default 12→20 + regression guard (#622)
• Invest: TRD-973 — un-vacuous wiki-code-drift gate (fetch-depth: 0) (#613)
• Invest: deploy-gate harness GREEN/ROLLBACK budgets 1s -> 3s (CI false-RED race) (#611)
• Invest: decision_scorer decision_count counts synthetic admission rows (TRD-961) (#605)
• Invest: persist lifecycle-close orders to invest_state.orders (#602)
• Invest: force IdentityAgent=none on all workstation→box ssh (1P agent hang, TRD-951) (#603)
• Invest: exhaustion-boot deadlock — admission no_action row + generator chain-snapshot Redis reseed (#600)
• Invest: multi-expiration detector chain coverage — otm_calls/otm_puts structural starvation (#590)
• Invest: force-release wedged decision cycles + bounded conservative spend terminalization (#591)
• Invest: remove lifecycle_exit.ruin_fence_blocked from DEPLOY_TOLERATED_CRITICAL_EVENTS (#589)
• Invest: correlate proposals to orders by decision_id — counts cannot mask a dropped proposal (#588)
• Invest: rc-check and prove the TARGET trader restart before wait_for_green (#587)
• Invest: close-evidence instrument-identity bridge — stop a different contract's close from suppressing the gap alert (#586)
• Invest: dedupe deployment-governor would-clamp knob_audit spam (#585)
• Invest: make propose_to_submit_parity readiness probe gate-aware (#584)
• Invest: dispatch durable-spend Lua test fakes by exact marker, not substring (#583)
• Invest: emergency-close realized-trade synthesis + snapshot-to-ledger gap alert (#561)
• Invest: trading-health alerter pages severity=critical events regardless of log level (#581)
• Invest: deploy_recon_probe scans HASH-type order_position index for class-C orphans (#580)
• Invest: claim mid-session instruments so reconciliation stops minting EXTERNAL sibling Positions (#578)
• Invest: unpriced LLM lane must not poison the spend-cap machinery (#579)
• Invest: triage post-green criticals by event class instead of counting (TRD-879) (#575)
• Invest: fail closed at boot if the INVEST_ISOLATED_CONTEXT hatch would be open (#574)