# Maintainer verification — external financial review, 2026-09-09

Companion to `research/2026-09-09_external_financial_review.md` (committed
verbatim, unedited). Same treatment the 2026-09-05 design review got: every
finding re-derived against the repo before anything was acted on, because that
review's ranking changed once its claims were measured.

Verified 2026-09-10 by the owner-side interactive session at `562cb7a`.
**Nothing here disputes the review's conclusion, which is correct and which
this project's own records already reached.** What follows is the arithmetic.

## Summary

| finding | severity claimed | verdict | note |
|---|---|---|---|
| F1 README advertises retired numbers | critical | **CONFIRMED** (prose) / evidence misattributed | the cited test line is an unrelated `ops/` check — but no test read the root README at all |
| F2 Kelly vs vol-target, "a constant is deciding" | high | **MECHANISM REAL, HEADLINE FALSE** | the cap has never bound: 20 sessions, max scalar 2.688 vs 3.0, at-cap count **0** |
| F3 book below minimum viable size | high | **RIGHT QUESTION, NUMBERS WRONG ~2x** | one figure is a weight read as a share count |
| F4 OK verdict at live Sharpe -1.33 | medium-high | **CONFIRMED** | with one qualification the review omits |
| F5 benchmark is SPY, should be a momentum proxy | medium | **CONFIRMED** | the most valuable forward item |

## F1 — confirmed in substance, wrong in citation

Confirmed exactly: `README.md:41` read *"CPCV PBO 50%, mean OOS Sharpe 0.624,
IS-OOS correlation +0.02, 15/15 positive OOS paths"*, and its last commit was
**2026-05-25 19:00**, five days before the 05-30 leak fix that made those
numbers harsher.

**Misattributed evidence.** The review cites
`tests/test_docs_consistency.py:500` as explicitly exempting `README.md` from
coverage. That line is `infra = {"ROUTINES.md", "README.md"}` inside
`test_every_audit_procedure_is_registered`, which globs `ops/*.md` and excludes
a directory doc — `ops/README.md`, which **does not exist**. It has nothing to
do with the root README.

The conclusion survives the correction and is arguably worse than stated:
`grep` for any test reading the root README returns **nothing**. It was not
exempted from a guard; there was no guard.

**Acted on** (this PR): README rewritten to the current figures with the
timing-luck spread and the forward evidence beside them, plus two pins —
`test_readme_does_not_quote_retired_validation_figures` and
`test_readme_validation_numbers_agree_with_claude_md`. Negative control run and
shown: both fail against the old text, pass against the new.

## F2 — the mechanism is real; the load-bearing sentence is not

Live snapshot values are as quoted (`gross_leverage` 0.2943, `vol_scalar`
2.6883, `max_leverage` 3.0, which `config/settings.yaml:179` confirms "caps the
vol-target scalar only").

The review's escalation — *"this is not a cap that occasionally binds, it is the
binding constraint in the current regime"* — does not survive measurement.
Across the last 20 sessions of `data/processed/portfolio_snapshots.jsonl`:

```
vol_scalar  min 2.33   max 2.688   at-cap (>=2.999): 0
```

The cap has **never bound**. Sizing is being set by the two risk models as
designed. The scalar sits at ~90% of ceiling, so the concern is well-aimed at a
condition one quiet regime away — but it is a forecast, not an observation, and
the finding is written as an observation.

The review's *other* F2 argument needs no cap at all and is the durable one:
half-Kelly requires an edge estimate you believe; at DSR 0.611 the edge is
statistically indistinguishable from zero; sizing on that estimate and then
levering it 2.7x compounds estimator noise rather than managing risk. Filed as
FIN-1 on that argument, not on the cap.

## F3 — right question, wrong numbers

The only target-weights artifact in the repository is
`results/weights_history.parquet`, whose latest rebalance is **2026-03-02** —
the frozen research snapshot, six months stale against the live book.
Multiplying those weights by today's live equity mixes a research artifact with
a live account. Doing exactly that, at $13,740:

| review | measured |
|---|---|
| median position $61.65 | **$95.90** |
| smallest MRNA $1.82 | **SATS $26.67** (MRNA is not in the book) |
| 26% of positions under $20 | **0%** |
| 48% under $50 | 24% |
| 70% under $100 | 54% |

The SNDK example — *"SNDK at $4.14 (0.0026 shares at $1,566/share)"* — reads a
**portfolio weight as a share count**. `thales inspect holdings` prints a weight
column summing to 0.4728; SNDK's 0.002584 is $35.50, not $4.14.

So "roughly a quarter of the book is pure cost with no capacity to contribute"
is not supported: nothing is under $20. What does survive: a ~$96 median
position on a $13.7k account is thin, 54% sit under $100, and the live book
does hold **67 positions against a 50-name target** (independently verified
before this review was read; it is the parity-pinned deviation where the engine
caps weighted turnover and live caps name churn, `daily.py:785`).

The review's *recommendation* survives its numbers intact and is worth doing:
`capacity.py` studies the ceiling and nothing studies the floor. Filed as FIN-2
with instructions to re-derive from the live book.

## F4 — confirmed, with a qualification the review omits

The ledger reads exactly as quoted: `INSUFFICIENT_DATA n=56` on 09-01, `OK
n=61` on 09-09, live Sharpe -1.70 -> -1.33. Nothing about the evidence
improved; the sample crossed an integer and the label changed.

Omitted: no machine reads that OK as a pass. The go-live gate evaluates a
separate criterion, `forward_sharpe_lower`, which **fails** (95% lower -5.456 <
0). The false-reassurance risk is to a human skimming a verdict word, not to
the gate. That lowers the severity but not the fix, and the review's timing
point is sharper than its finding: make the change **before** December, so it
is never a change made while looking at the result. Filed as FIN-3.

## F5 — confirmed, and the item with the most value per unit of effort

`MTUM` appears nowhere in the repository except one 2026-05-29 AFK transcript.
`benchmark: "SPY"` at `config/settings.yaml:117` and `:303`. No gate anywhere
requires beating a momentum proxy; the SHIP gate is Sharpe, PBO, IS-OOS
correlation and survivorship-free confirmation.

The framing is correct and uncomfortable: the project could clear every gate it
has written and still be strictly dominated by a one-line ETF purchase, and
nothing in the harness would say so. Filed as FIN-4.

## One rhetorical slip

The review calls IS-OOS correlation -0.281 *"anti-predictive ... the textbook
signature of a search that has fit noise"*, then concedes two sentences later
that the C2 null calibration measured no-skill books at median |corr| **0.443**.
Those do not sit together: at -0.281 this book is **less** extreme than a random
one, so the figure is consistent with no skill rather than evidence of
noise-fitting. The review has it right in the concession and wrong in the
rhetoric — which is the exact error the C2 memo was written to prevent, and
worth naming because a future reader will quote the sentence, not the caveat.

## Pattern worth recording

Three of five findings carry a citation or arithmetic error (F1's test line,
F2's cap claim, F3's dollar figures), while every prose judgement in the review
is sound and the two conclusions that matter most — the front door, and the
missing factor benchmark — are correct and were not visible from inside. Read
future external reviews the same way this one was read: **the reasoning is the
product; verify every number before acting on it.**