docs(exec): operating tiers T0-T13 — smartness ladder (T1 = better-orders, shippable now; T10 = MALKHUT placement; T13 reserved)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

prod/docs/SPEC_UNIFIED_EXEC_LAYER_20260714.md

@@ -342,7 +342,30 @@ one instrument, two consumers.
 - No green-by-pollution; env-gate live tests; NO SOAKS (operator, 2026-07-14) — bounded
   scenario tests over open-ended clock runs.
 
-## 15. Rollout ladder (each rung publishes its friction delta before the next)
+## 15. Operating tiers — the smartness ladder (operator doctrine, 2026-07-14)
+
+Orthogonal to the deployment rungs (§15.1): tiers are what the executor IS; rungs are
+how each tier goes live. Every tier kill-switches to the tier below; a tier ships only
+after the tier below has published its friction delta. **Higher tiers may only get
+cheaper or safer — never change WHAT (the §2.3 promises hold at every tier).**
+
+| Tier | Name | Content | Standing |
+|---|---|---|---|
+| **T0** | Naive | MARKET everything (today's flights) | LIVE — the eternal fallback, never deleted |
+| **T1** | **Better orders** | The operator's point, verbatim intent: *"fire trades better than costly MARKET, try and MM, cut fees in half by simply using better order types — usable RIGHT NOW."* Concretely: GTX/post-only-first with bounded quote lifetime → cross at TTL; CATASTROPHIC passes through as MARKET untouched; nothing else. No SmartPlacer, no advice, no chase logic. This is a PORT, not an invention: PINK's `maker_both` ran production since 2026-06-11 (L2, 265 tests), and short-lived GTX is the ONLY L8-certified fill-improvement technique (§4-16). Entry gate: Q1 (measure the maker fee — one VST GTX fill). Prize at 50-75% maker conversion: ~$43-64K on BLUE's historical volume (§4-20). | FIRST SHIPPABLE INCREMENT — buildable immediately on unpark, pre-adjudication |
+| **T2** | Characterization-informed | L8 sweep findings become tactics: symbol-aware quantization/notional banding (§4-15), partial-remainder re-quote per urgency (§4-11), venue idiom law (§4-17), SNAPSHOT barrier (§4-19), latency decomposition telemetry (§4-18) | after T1 delta published |
+| **T3** | OB-aware placement | SmartPlacer adoption (L3): where-in-book offsets, `ob_confirms_signal`, conviction→patience (Q2 proxy), Appendix-E depth priors (validated) | gated on A1 adjudication |
+| **T4** | Full drive loop | PINK port complete (§7): chase budgets, requote gate, fill-vs-cancel races, exit escalation | the v1-spec vision |
+| **T5** | Fast plane | WS/shm price seam (L9) in the loop; C1 location-independence exercised (colo-ready); session-aware constants (App. E) | |
+| **T6** | Multi-leg | `exit_leg_ratios` proven end-to-end (Q6); ADVSL partial retraction legs ride the layer | |
+| **T7** | Advised | MALKHUT advice plane live (§5) — she suggests, layer clamps, telemetry closes her training loop | |
+| **T8** | Self-tuning | constants auto-updated from own friction telemetry (provenance-logged, operator-gated) | |
+| **T9** | Multi-venue | second dialect module (§11); Binance pre-staged by L7 tables + App. E | |
+| **T10** | **MALKHUT game-theoretic placement** | she doesn't advise placement — she IS placement (fulfilment policy executes through the same contract, same promises) | the north star |
+| T11–T12 | Unassigned | headroom — the ladder expects rungs we can't name yet | |
+| **T13** | Reserved | ASI. (If the market is still imperfect enough to need an executor, §0 still applies.) | reserved by operator |
+
+## 15.1 Deployment rungs (per tier; each publishes friction delta before the next)
 
 `shadow` (log-only intents beside naive) → `maker_entry_only` → `maker_both` →
 live capital. Kill switch `UV_SMART_EXEC=0` = naive MARKET at next boot (deployment