iteration 07 · PR-B adversarial + open · crypto cost-realism labels · 2026-07-14
The wrecking crew earned its keep — and both pull requests now sit at the human red line PR-B OPEN SATURATION
← campaign board · ← iter 06 · PR #618 (A) · issue #614
In plain language — what happened this iteration
This is why we pay the wrecking crew. Peer B's adversarial review raised 18 attacks, and this time several drew blood — exactly what the process is for. The best catch was embarrassing and priceless: the database table definition, the ONE file whose whole job is to be executable, had two clauses in an order ClickHouse's parser rejects. Our byte-comparison guard was green — it checked the words, not the grammar. The reviewers proved it against the actual database binary on this machine. One clause swap and the file parses cleanly; the guard now also checks clause order.
Three real bugs in the backfill machine died before ever running: (1) it handed the database 14 values for 13 columns — first real run would have crashed instantly (the dry-run looked perfect); (2) its page-turning logic stopped after the first 200,000 bars of every partition while printing "DONE" — a multi-million-bar symbol would have needed dozens of blind re-runs; (3) a bar closing seconds before midnight could get stuck forever if the next day opened quietly, silently freezing the whole partition behind it. All three are fixed, and a new test drives the runner end-to-end over a stubbed database to prove pagination, row shape, and termination — the class of test that would have caught all three.
Also fixed: the read view now de-duplicates both tables at read time (otherwise a re-label could briefly show doubled or stale rows — precisely what the design document forbids); missing labels now read as honest NULL instead of a fake 1970 timestamp; the dry-run now says "would_write" instead of "written"; the pilot instructions show the plan-then-execute two-step explicitly; and the safety boundary in the Rust bridge (reject out-of-order trades, reject wrong-unit timestamps) is now pinned by committed tests, not just implemented.
The finish line (for the automation): Pull request B is open, stacked on pull request A. The loop's contract is now saturated — implement, prove, challenge, open, stop. Every next step is human-owned: review, merge A then B, run the table-creation file once, pilot on SUIUSDT, audit, then the full ~139-million-bar backfill.
Grounded this iteration
R8 pass over the PR-B delta: 4 attack lenses → 18 findings → independent defender verdicts (several verified against the host's own ClickHouse 25.12 binary and by hermetic simulation). Refuted: 4 (incl. threshold-type mirror and the missing-/-entry claim). Held/partially-held — ALL amended: DDL — COMMENT-before-CODEC clause order on the 3 Int64 key columns (was a hard SYNTAX_ERROR; clickhouse-format --multiquery now exits 0), FINAL on both RMT sides of the VIEW (pre-merge duplicate rows + the D3-forbidden stale-bar×stale-label pair; FINAL-through-view is silently ignored so it lives inside the definition), toNullable(l.computed_at) (epoch-zero masquerade). Runner — row arity 14→13 (*vals[:len(MEASURED_COLUMNS)], zip(strict=True)), pagination termination (partial-page break + no-progress stall guard; dead code removed), day-tail live-edge stall (next-day-coverage probe clamps maturity so genuinely empty exit windows are WRITTEN as NULL taxonomy instead of held forever), dry-run prints would_write(DRY-RUN)=, ruff clean. Docs/wiring — pilot Step 2 shows plan-then---execute; labels:guards/check-full descriptions updated to A–I + R5 (wrappers mirrored verbatim); test-file docstring states the real import surface. New pins — binding feed-contract test (strict-TID ValueError, ms-timestamp rejection, horizon guard, spec-order happy path) + the stubbed end-to-end runner test (3 pages, 7/7 bars, exact arity) + DDL clause-order/FINAL/toNullable guard asserts. Post-amendment: labels:check-full GREEN — 16/16 · 36/36 · guards 20/20 · 0-byte oracle drift; DDL parses; ruff clean; tripwires 126/93/93/68 UNCHANGED.
Decisions made (for operator review at PR time)
| # | Decision | Why |
|---|---|---|
| 1 | All held findings amended in-branch before opening PR-B | One was critical (unexecutable DDL); shipping known-broken operator artifacts wastes a pilot cycle |
| 2 | VIEW reads both sides FINAL despite the read cost | D3's "never silently wrong" beats read latency; per-query FINAL through a view is silently ignored, so it must live in the definition |
| 3 | Day-tail maturity uses a next-day-coverage probe, not blind trust | Distinguishes genuine empty-window NULLs (written) from true live edge (held) — keeps the audit taxonomy honest without permanent stalls |
| 4 | Contract flipped ACTIVE → DONE (saturation) | Exit condition met: kernel PR (#618) + schema/runner PR both open, green, challenged. Merge, CREATE TABLE, pilot, backfill, audit, deploy = operator-owned. |
Hand-back — operator's runway from here
labels_schema.sql once (Step 0 of PILOT-SUIUSDT.md). 4) Pilot: dry-run, then --execute on SUIUSDT; audit per COVERAGE-AUDIT-SPEC.md. 5) Full backfill + coverage report. 6) Dashboard deploy remains operator-gated. Every gate re-runs with one keystroke: /labels:check-full.