# UV TESTNET ARMING CHECKLIST — DARK → LIVE on BingX VST

**For the operator.** Execute top to bottom; every box is a stop-if-red. The integrator
(Fable/successor) signs §1–2; only YOU execute §3.

## §1 — Certification complete (integrator signs)
- [ ] Gate A verdict PASS in `prod/docs/uv_cert/GATE_AB_RUN_<ts>.md` (Tier 1 + Tier 2
      green; Tier 3a/3b drift-rates reported and explained). T10 merged.
- [ ] Gate B verdict PASS (fuzz surface green, deterministic re-run identical).
- [ ] T2P1 merged: journal writes verified against real DateTime64(3); raw scan surface
      (`assets[]`, `asset_prices[]`) persisting per scan into dolphin_uv; creds never
      in URL.
- [ ] Zinc soak healthy ≥24h on current main: region seq at scan cadence, TUI
      `source:zinc`, RSS flat (ram block), zero writes outside dolphin_uv (guard log).

## §2 — Seam dry-run reviewed (integrator signs)
- [ ] T9 merged: 3 injected intents fully mapped + journaled, ZERO venue calls (DARK
      default proven); `u-` prefix litmus green; mainnet-block mutation test green.
- [ ] T12 merged: bridge inert-by-default proven; shadow-mode journal shows SUPPRESSED
      intents recorded during a live soak window — review that excerpt: are these the
      trades you'd want taken?
- [ ] End-to-end DARK rehearsal: PRIME live scan → bridge (suppressed) → verify the
      would-have-been intent in dolphin_uv.exec_journal matches the journaled decision
      bit-for-bit.

## §3 — Arming (OPERATOR ONLY, in this order)
1. [ ] Create VST API keys on BingX testnet (never mainnet keys anywhere near this box's
       UV env). Fund the VST account.
2. [ ] Place keys per T9's config seam (env/file per merged T9 README — keys never in
       git, never in the repo tree).
3. [ ] Start the seam runner (uv_exec instance) STILL DARK — verify it authenticates,
       reads balances, places NOTHING. Check venue telemetry region populating.
4. [ ] Write the arming file: `echo "$(date -Iseconds) <your-initials>" >
       /root/uv-wt/prime-live/UV_PROMOTED.arm` and set `UV_PROMOTED=1` on the PRIME
       runner env; restart PRIME runner.
5. [ ] FIRST TRADE WATCH: sit on the TUI for the first bridged intent → order. Verify
       on the venue: clientOrderId starts `u-`, size/leverage match the journaled
       intent, position appears in dolphin_uv.exec_journal with venue echo.
6. [ ] Let it run ONE session. Review: every venue order has a matching BRIDGE row and
       journaled decision; PnL accounting sane vs venue statement.

## §4 — Kill / rollback (know it BEFORE arming)
- Instant stop: delete `UV_PROMOTED.arm` (bridge goes inert next scan) — no restart
  needed. Harder stop: kill the uv_exec runner (positions remain on venue — close via
  venue UI if needed; it is VST money).
- Any anomaly (order without journal row, journal row without order, non-`u-` order,
  any write appearing outside dolphin_uv): kill first, forensics second, report on h5i.

## Standing constraints while live
- Gate C (live soak) is observation, not a pass/fail blocker — but the T8 stop-watcher
  ledger and the differ (PRIME still shadows BLUE — parity keeps being measured WHILE
  UV trades) are the instruments. Divergence trend = stand down and investigate.
- BLUE remains untouched, unthrottled, unshadowed by any of this. If UV ever competes
  with BLUE for the same venue account: it must not — separate VST account, always.