leanbot: orders_matched inventory tracking on the nightly-published
screened set (box never screens itself), frozen $150-500 one-sided
crossing, paper FAK $100 capped at print+3c, complement routing for
net-short leans, MAX_PER_EVENT=2, premium logged on every attempt.
guards.py: ex-best-day / ex-top5 / top-event share — the cuts that caught
both studies today, now machinery every grader reports nightly.
grade_lag: v2 band arm (15-40c, forward-only from V2_FREEZE_TS, bar +$8)
+ three report-only control bands.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The first guard treated 'no pid file' as stale, so the launchd run stole a
live old-code lock and TWO nightlies scored concurrently (2026-07-27).
Ledger tolerated it (latest-per-day wins, no dupes) but the races are
avoidable. Conservative now: no pid -> skip unless the lock dir is >6h old.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A killed nightly (pause/crash/reboot) left .nightly.lock.d behind — the
EXIT trap never fires on SIGKILL — and EVERY later run then skipped
silently (caught 2026-07-27: today's run exited in <1s). Lock now
records its PID and a run whose owner is gone takes it over.
Reconcile hit the 15-min tape-sync agent's single-writer lock and died;
now waits it out (20x30s).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Per-file 'flyctl ssh console' acks ride WireGuard; travel networks throttle
it past the 120s timeout, and the raised TimeoutExpired killed whole
backlog runs mid-flight (52/64 files, twice). The delete invariant is
one-directional — the box may delete ONLY what the Mac acked — so a
MISSING ack is always safe. Batch at end, best-effort, log and continue.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
copybot[bot]