Card 78 — certified: causal, deterministic, restart-proof, documented, discoverable 13/16

The feature works; today it earned its certifications. Five distinct properties were formally proven, each with its own test that counts its checks (so a test that accidentally checks nothing fails loudly instead of passing silently):

• No crystal ball (causality): the value at bar #5,000 was recomputed using ONLY data up to bar #5,000 — chopping off everything after it — and had to match the full-history run bit for bit, at dozens of sampled positions on both markets. Any mismatch would mean the feature secretly peeks at the future, which would make it useless (and dangerously misleading) for prediction.
• Same question, same answer (determinism): the entire 10,000-bar computation was run twice and compared at every single bar — not "approximately equal" but identical to the last binary digit.
• Units don't matter (scale-freeness): multiply every price by 4, or re-express every duration in different units — the answer's bits don't move. This proves the feature measures *structure*, not magnitude.
• Garbage in, calm out (totality): 12 hostile inputs (empty windows, NaN, infinity, zero prices, mismatched lengths) — no crash, no infinite output, ever.
• Survives a restart: the pipeline restarts nightly-ish in production. The stream was split in half, frozen to a JSON "memory snapshot", thawed, and continued — every value identical to an uninterrupted run. This also proved live streaming and batch reprocessing agree bar-for-bar on real trade data.

Then the paperwork that isn't just paperwork: an Architecture Decision Record now explains every locked convention (why ranks are computed on a ratio instead of a logarithm, why ties break by arrival order, why the fixtures are self-contained) so a future engineer can't accidentally "fix" a deliberate choice. And the feature became discoverable: six typed commands (/hoeffding:test, /hoeffding:doctor, …) now run its gates — under this repo's rule, a capability without a discoverable command is an incomplete delivery.

What's left before the pull request: the full repo-wide quality gate (format, lints, every test, dependency audit), an adversarial review where one agent attacks the implementation and another defends it (any conceded finding blocks), and the commit.