The blueprint and the machine — written, reviewed by tests, and deliberately never switched on AUTHORED · ALL GATES GREEN

Peer B exists now. On a second isolated workbench (stacked on top of Peer A's, since it reuses the single source-of-truth column list), we wrote everything needed to actually put the labels into the database — but, crucially, as reviewable files that the automation never executes. The database table definition (CREATE TABLE) is a file a human will run once after review. The backfill program — the machine that will eventually label ~139 million historical bars — is written, argument-checked, and importable, but it has a dry-run default and has never been run here.

The safety lessons got baked in. Every hard-won lesson from Peer A's adversarial review became a structural property of Peer B: the tick feed must arrive strictly in trade-ID order with no duplicates (the Rust boundary now REFUSES anything else — a loud error, not a wrong number); millisecond timestamps from the disk cache are converted to microseconds, and the boundary rejects any timestamp that looks like the wrong unit; bars too close to the newest data ("live edge") are held for the next run instead of being labeled with incomplete windows; the derived round-trip-cost column is computed by the database itself from a formula stored in the table, so it can be re-tuned without touching code.

The last five anti-leak guards are live. Guards B and C prove no label ever appears in the feature manifest or the feature column lists. Guard F freezes the four "tripwire" numbers proving the existing bar pipeline is untouched (126/93/93/68 — all unchanged). Guard H pins the audit playbook. Guard I teaches the candidate-intake tool to flatly refuse any label_* name — labels can never even be nominated as ML features. Plus two "lockstep" tests that byte-compare the SQL file's column descriptions against the single source of truth. All 18 guard tests green; the full gate suite green; zero bytes of oracle drift.

What's next: Peer B gets the same adversarial wrecking-crew treatment as Peer A, any held findings get amended, and pull request B opens — stacked on PR #618 — completing the loop's mandate. Everything after that (merge, table creation, the pilot on SUIUSDT, the full backfill) is human-owned.