docs(uv): handover to successor integrator + SOA verdict + T8/T9 subspecs + spec C11 forensics

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

prod/docs/uv_subspecs/UV_TASK_T6_CODEX_REAL_ZINC.md

@@ -0,0 +1,32 @@
+# UV TASK T6 — real Zinc region transport (close the file-snapshot regression)
+
+**Assignee:** codex · **Issuer:** Fable · **PRIORITY: HIGH — operator-ordered promotion.**
+**Why:** the merged main's TUI path reads an atomic JSON file in /dev/shm (`ShmChannel`) —
+file semantics, no mapped region/seqlock/notify. That is the exact "mock shm" the shm-reshape
+sprint existed to eliminate. The REAL transport already exists and soaked 18 h on the clone
+line: `ZincShadowChannel` in `salvage/uv-clone-line-1902e4b`'s `uv/shm.py` (mapped
+`/dev/shm/zinc_uv_shadow_state` region, magic header, monotonic seq, `uv_shadow` prefix,
+DITAv2 zinc adapter loading via `ZINC_PYTHON_PATH`).
+
+**Task:** port `ZincShadowChannel` (+ its region encode/decode + `_FileChannel` fallback
+mechanics as needed) from the salvage branch onto current main, UNDER the reshape snapshot
+contract (BluePrimeSnapshot stays the schema — transport changes, contract does not):
+1. New/updated module in `uv/` (e.g. extend `shm.py` or add `zinc_channel.py`): writer =
+   publish the SAME versioned snapshot into the mapped region, atomic + seq-increment +
+   notify per the zinc-shadow spec §5; reader = TUI-side wait/read of latest complete frame.
+2. `blue_prime/runner.py`: publish via real zinc region as PRIMARY; keep the file snapshot as
+   explicit FALLBACK (env `UV_SHM_TRANSPORT=file`; default `zinc`), not the default.
+   [SPEC AMENDED 2026-07-02: knob name aligned to the salvage implementation's
+   `UV_SHM_TRANSPORT` — same semantics as the original `UV_SHM_FALLBACK`, clearer name,
+   zero churn on the already-soaked code.]
+3. `uv/tui.py`: read the region directly as PRIMARY (same render path — snapshot dict in,
+   panels out); file fallback only when region absent, and SAY SO on screen.
+4. Port/adapt the salvage branch's zinc tests + add: torn-frame/seq test, cross-process
+   round-trip test (writer proc + reader proc), region-absent fallback test, mutation litmus.
+5. Relaunch the guarded soak (same UV_BLUE-PRIME_TUI2 discipline, guard active) on the zinc
+   path; verify seq advances at scan cadence and TUI reads the REGION (show source in meta).
+**Non-goals:** no tui_v2 port (separate, later), no DITAv2 region reuse (own prefix,
+retire-able — zinc-shadow spec §3.3), no schema changes.
+**Branch:** `uv/t6-real-zinc` · fresh clone `/root/uv-wt/t6-zinc` off /root/violet.git ·
+push→CI · DONE to Fable with: branch+sha, tests, soak PIDs + region seq evidence, and
+`grep`-proof the TUI's primary path never opens the JSON file when the region exists.

prod/docs/uv_subspecs/UV_TASK_T8_CMD_STOP_WATCHER.md

@@ -0,0 +1,49 @@
+# UV TASK T8 — shadow stop-watcher (C11's sensor, live overshoot ledger)
+
+**Assignee:** cmd (Command Code) · **Issuer:** Fable · **Master spec:** §4 C11, §5 Gate C.
+**Empirical basis:** `prod/docs/BLUE_STOPLOSS_OVERSHOOT_AND_UV_COUNTERFACTUAL_20260702.md`
+(codex, verified by Fable): last-1000 BLUE trades → 49 stops, 30 overshot the −1.2%
+contract, ≈$4,432 excess. FET `e81e595d`: stop breached 16:08:15.9, eigenscan not until
+16:08:19.6 (measured gaps 11–12 s), overshoot lived entirely inside the scan gap.
+
+## Goal
+A standalone read-only daemon that watches BLUE's OPEN positions on a ~1 s clock and
+journals every stop-contract breach the moment it happens — so every future overshoot is
+measured live instead of forensically. This is the shadow twin of the future C11 fast SL
+clock: when UV trades with fast stops, this ledger IS the A/B evidence.
+
+## Deliverable: `prod/clean_arch/violet/uv/stop_watcher.py` (+ DDL + tests)
+1. **Position feed:** poll `dolphin.trade_events` (read-only, dedup by trade_id, argMax ts)
+   every ~10 s for open positions (entry event without terminal exit). Carry entry_price,
+   side, quantity, our_leverage.
+2. **Price feed:** poll `dolphin.obf_universe` (read-only) best_bid/best_ask per open asset
+   every ~1 s. MEASURE ingest lag (row ts vs now) and journal it; if p95 lag > 2 s, log a
+   LIMITATION line — do NOT silently trust stale prices. (Fallback to BingX public WS
+   bookTicker is allowed — public data, no keys, no BLUE interaction — but is a stretch
+   goal, not v1.)
+3. **Breach detection:** SHORT: ask ≥ entry×1.012; LONG: bid ≤ entry×0.988. On first
+   breach per trade, write one event; keep sampling and write escalation rows at each
+   +0.1 % beyond the stop (so the overshoot PATH is recorded, not just the edge).
+4. **Journal:** `dolphin_uv.stop_watch_events` (NEW table, dolphin_uv namespace ONLY):
+   ts, trade_id, asset, side, entry_price, breach_price, adverse_pct, spread_bps,
+   depth_1pct_usd, obf_lag_ms, kind ('BREACH'|'ESCALATION'|'RESOLVED'). RESOLVED row when
+   the trade's exit appears in trade_events, carrying exit adverse_pct + excess vs 1.2 %.
+5. **Daily rollup view:** overshoot count, total excess $, worst trade — the $4.4K audit,
+   automated forever.
+
+## Iron rules
+- ZERO writes outside `dolphin_uv.*`. Never touch BLUE code, HZ contents, or dolphin.*
+  tables. CH creds read-only usage; INSERT only into dolphin_uv.stop_watch_events.
+- Runs under /home/dolphin/siloqy_env, own log file, no hardcoded worktree paths
+  (derive paths from __file__ / env).
+
+## Tests (doctrine: mutation litmus mandatory)
+Synthetic price/position fixtures → exact expected breach/escalation/resolved sequence;
+mutation litmus (flip breach comparison, drop escalation step → tests go RED);
+lag-measurement honesty test; no-write guard test (any non-dolphin_uv INSERT raises);
+determinism (same fixture ⇒ same journal twice).
+
+## Done
+Branch `uv/t8-stop-watcher` off current main, fresh clone, push → CI, DONE to Fable with:
+branch+sha, test count, a live 30-min run's journal excerpt (real breaches or honest
+"no breaches in window"), measured obf_universe lag stats.

prod/docs/uv_subspecs/UV_TASK_T9_CMD_DITAV2_EXEC_SEAM.md

@@ -0,0 +1,48 @@
+# UV TASK T9 — C10 DITAv2 exec seam (KernelIntent → DITAv2 → BingX VST, DARK)
+
+**Assignee:** cmd-PASS1.2 · **Issuer:** Fable · **Master spec:** §4 C10, §8 fast path.
+**Doctrinal kernel:** post-sync vendored dita_v2 per `UV_DITAV2_SOA_VERDICT_20260703.md`
+(includes VenueTelemetrySnapshot + zinc venue plane + asex_account.py). Do NOT start
+until Fable confirms the vendor sync landed on main (watch the bus).
+
+## Goal
+The physical trading path: a UV-owned execution runner that consumes KernelIntents and
+drives DITAv2 against BingX **VST testnet** — built now, DARK by default, so that when
+PRIME is promoted (post Gates A+B) the only remaining step is arming it with keys.
+Pattern precedent: `prod/clean_arch/violet/v4_execution_runner.py` (read for shape; this
+is a NEW instance and a NEW module — never reuse a BLUE/PINK/VIOLET runner instance).
+
+## Deliverable: `prod/clean_arch/violet/uv/exec/` (new package)
+1. **`intent_source.py`:** KernelIntent inlet. v1 = injectable queue + a file/CLI
+   injector for dry-run intents (PRIME promotion wiring is a LATER task — leave a
+   clearly-marked seam, not a stub that pretends).
+2. **`seam.py`:** intent → DITAv2 order mapping. EVERY clientOrderId prefixed `u-`
+   (non-negotiable — this is how UV's orders are distinguishable on the venue forever).
+   Sizing/leverage passthrough from intent; no local overrides.
+3. **`runner.py`:** launcher wiring per dita_v2 `launcher.py` — NEW instance name
+   (`uv_exec`), zinc venue plane ENABLED (venue_region telemetry is the seam's flight
+   recorder), jemalloc-friendly long-run posture, no hardcoded paths.
+4. **DARK doctrine:** with no keys configured → observe-only: log + journal every intent
+   and the order it WOULD place (full params), place nothing. `ALLOW_MAINNET=0` is a
+   hard block: mainnet refuses even if env says otherwise unless a separate operator
+   arming file exists (two-man rule). VST base URL only.
+5. **Journal:** every intent, mapping, would-place/placed, venue telemetry snapshot →
+   `dolphin_uv.exec_journal` (dolphin_uv namespace ONLY).
+
+## Iron rules
+- VST ONLY. DARK until operator arms. `u-` prefix on every clientOrderId.
+- Zero writes outside dolphin_uv.*; zero BLUE touches; vendored dita_v2 is read-only
+  (any kernel change goes upstream + vendor_sync, never in-place).
+- Graal-ready NFR-G applies (no CPython-only exotica in the seam layer).
+
+## Tests (mutation litmus mandatory)
+Intent→order mapping bit-exact fixtures; `u-` prefix litmus (strip the prefix in code →
+test RED); DARK default test (no keys ⇒ zero venue calls — assert at the venue adapter
+seam, not by mocking the seam itself); mainnet-block mutation test (force
+ALLOW_MAINNET=1 without arming file ⇒ still refuses); venue-plane telemetry presence
+test; determinism.
+
+## Done
+Branch `uv/t9-exec-seam` off post-sync main, fresh clone (NOT a worktree of the bare),
+push → CI, DONE to Fable with: branch+sha, test count, and a dry-run journal excerpt
+showing 3 injected intents fully mapped + journaled + zero venue calls.