Maintainer verification — external financial review, 2026-09-09

Companion to research/2026-09-09_external_financial_review.md (committed verbatim, unedited). Same treatment the 2026-09-05 design review got: every finding re-derived against the repo before anything was acted on, because that review's ranking changed once its claims were measured.

Verified 2026-09-10 by the owner-side interactive session at 562cb7a. Nothing here disputes the review's conclusion, which is correct and which this project's own records already reached. What follows is the arithmetic.

Summary

F1 — confirmed in substance, wrong in citation

Confirmed exactly: README.md:41 read "CPCV PBO 50%, mean OOS Sharpe 0.624, IS-OOS correlation +0.02, 15/15 positive OOS paths", and its last commit was 2026-05-25 19:00, five days before the 05-30 leak fix that made those numbers harsher.

Misattributed evidence. The review cites tests/test_docs_consistency.py:500 as explicitly exempting README.md from coverage. That line is infra = {"ROUTINES.md", "README.md"} inside test_every_audit_procedure_is_registered, which globs ops/*.md and excludes a directory doc — ops/README.md, which does not exist. It has nothing to do with the root README.

The conclusion survives the correction and is arguably worse than stated: grep for any test reading the root README returns nothing. It was not exempted from a guard; there was no guard.

Acted on (this PR): README rewritten to the current figures with the timing-luck spread and the forward evidence beside them, plus two pins — test_readme_does_not_quote_retired_validation_figures and test_readme_validation_numbers_agree_with_claude_md. Negative control run and shown: both fail against the old text, pass against the new.

F2 — the mechanism is real; the load-bearing sentence is not

Live snapshot values are as quoted (gross_leverage 0.2943, vol_scalar 2.6883, max_leverage 3.0, which config/settings.yaml:179 confirms "caps the vol-target scalar only").

The review's escalation — "this is not a cap that occasionally binds, it is the binding constraint in the current regime" — does not survive measurement. Across the last 20 sessions of data/processed/portfolio_snapshots.jsonl:

vol_scalar  min 2.33   max 2.688   at-cap (>=2.999): 0

The cap has never bound. Sizing is being set by the two risk models as designed. The scalar sits at ~90% of ceiling, so the concern is well-aimed at a condition one quiet regime away — but it is a forecast, not an observation, and the finding is written as an observation.

The review's other F2 argument needs no cap at all and is the durable one: half-Kelly requires an edge estimate you believe; at DSR 0.611 the edge is statistically indistinguishable from zero; sizing on that estimate and then levering it 2.7x compounds estimator noise rather than managing risk. Filed as FIN-1 on that argument, not on the cap.

F3 — right question, wrong numbers

The only target-weights artifact in the repository is results/weights_history.parquet, whose latest rebalance is 2026-03-02 — the frozen research snapshot, six months stale against the live book. Multiplying those weights by today's live equity mixes a research artifact with a live account. Doing exactly that, at $13,740:

The SNDK example — "SNDK at $4.14 (0.0026 shares at $1,566/share)" — reads a portfolio weight as a share count. thales inspect holdings prints a weight column summing to 0.4728; SNDK's 0.002584 is $35.50, not $4.14.

So "roughly a quarter of the book is pure cost with no capacity to contribute" is not supported: nothing is under $20. What does survive: a ~$96 median position on a $13.7k account is thin, 54% sit under $100, and the live book does hold 67 positions against a 50-name target (independently verified before this review was read; it is the parity-pinned deviation where the engine caps weighted turnover and live caps name churn, daily.py:785).

The review's recommendation survives its numbers intact and is worth doing: capacity.py studies the ceiling and nothing studies the floor. Filed as FIN-2 with instructions to re-derive from the live book.

F4 — confirmed, with a qualification the review omits

The ledger reads exactly as quoted: INSUFFICIENT_DATA n=56 on 09-01, OK n=61 on 09-09, live Sharpe -1.70 -> -1.33. Nothing about the evidence improved; the sample crossed an integer and the label changed.

Omitted: no machine reads that OK as a pass. The go-live gate evaluates a separate criterion, forward_sharpe_lower, which fails (95% lower -5.456 < 0). The false-reassurance risk is to a human skimming a verdict word, not to the gate. That lowers the severity but not the fix, and the review's timing point is sharper than its finding: make the change before December, so it is never a change made while looking at the result. Filed as FIN-3.

F5 — confirmed, and the item with the most value per unit of effort

MTUM appears nowhere in the repository except one 2026-05-29 AFK transcript. benchmark: "SPY" at config/settings.yaml:117 and :303. No gate anywhere requires beating a momentum proxy; the SHIP gate is Sharpe, PBO, IS-OOS correlation and survivorship-free confirmation.

The framing is correct and uncomfortable: the project could clear every gate it has written and still be strictly dominated by a one-line ETF purchase, and nothing in the harness would say so. Filed as FIN-4.

One rhetorical slip

The review calls IS-OOS correlation -0.281 "anti-predictive ... the textbook signature of a search that has fit noise", then concedes two sentences later that the C2 null calibration measured no-skill books at median |corr| 0.443. Those do not sit together: at -0.281 this book is less extreme than a random one, so the figure is consistent with no skill rather than evidence of noise-fitting. The review has it right in the concession and wrong in the rhetoric — which is the exact error the C2 memo was written to prevent, and worth naming because a future reader will quote the sentence, not the caveat.

Pattern worth recording

Three of five findings carry a citation or arithmetic error (F1's test line, F2's cap claim, F3's dollar figures), while every prose judgement in the review is sound and the two conclusions that matter most — the front door, and the missing factor benchmark — are correct and were not visible from inside. Read future external reviews the same way this one was read: the reasoning is the product; verify every number before acting on it.