RESEARCH_AUDIT_LOG.md — the pipeline's own measurement series

Append-only. One dated block per run of the Thales research audit routine (ops/RESEARCH_AUDIT.md), carrying M1–M5 and the G1 residue count.

The series is the point, not any single block. Every measurement here is about the machinery that produces beliefs, and drift is invisible from inside a single run — a reviewer softening by 5% a month looks like a normal day every day. So the run appends even on a quiet month: a gauge with gaps is not a series, and a missing block is indistinguishable from a healthy one.

Recomputable by construction: every entry should name its source (a git range, a queue diff, a registry count) so the next reader can check it rather than trust it.

Baseline note — 2026-08-11 (seeded, no run yet)

Seeded when the procedure was written; the first real block lands on the routine's first run. For orientation, the state at seeding:

• pipeline age: panel live 2026-08-06, triage 2026-08-10, implementer never yet had an approved item to build;
• queue: 9 open, 0 approved, 0 built, 7 dismissed;
• trial registry: 412 rows (results/research_registry.jsonl);
• closed questions since the pipeline started: 0 via the pipeline — every closure so far predates it;
• known unmeasured: G1 residue (no prior fresh-context audit), G2 time-to-loud, G4 capture-gap census.

The honest read at seeding: the pipeline has produced findings but has not yet closed a question, and its most valuable output to date has been defects in its own scaffolding (the beacon transport, the runner-loss window, the capture-QA branch). That is a legitimate early phase, and M5 exists to notice if it becomes a permanent one.

2026-09-03 — run 1 (window: 2026-08-11 seeding → 2026-09-03)

Run context, recorded first: the scheduled 2026-09-01 first run completed its measurements and died on the shared Fable quota before writing anything (NORTHSTAR §7b; healthchecks alarmed correctly). This re-run is therefore the series' first real block; the window is everything since the 2026-08-11 seeding. Environment: routine container, no broker keys, no data/raw, no owner Mac; memory/ is absent from the checkout (relevant to M4 below). Facts below come from the repo's git history and files unless a GitHub source is named.

M1 — proposal-survival drift · source: git log over research/queue/ + the run commits' own diffs

Panel runs 1–17 (2026-08-06 → 2026-09-02). The frozen archive alone under-reports — the run-6/7/8 narratives were deleted from it (incident already recorded at research/RESEARCH_QUEUE.md:2003); counts were recovered from each run commit's diff. Survival = items added to queue/open/ ÷ candidates considered, over runs whose denominator was recorded at all:

Verdict: RISING at roughly constant volume — the softening signature this measurement exists for. Two recorded mitigations before reading it as reviewer rot: the reviewer is still visibly cutting (run 15 killed 2 of 4, 528793d; run 14's row survived only "with three required edits", 56825fb; run 16's rows were "adversarially narrowed", 86152c2), and the high-survival fortnight coincides with a genuinely defect-rich delta (queue migration 47e8e73, the displaced-cron regime, the phantom equity mark 29c6f23) — run 13 pre-empts the charge in its own text ("volume is delta-justified, not quota-shaped"). One month cannot separate softening from a rich delta. Next month's block recomputes this table; a second rising month without a matching delta is the finding.

Metric-integrity finding: the "considered" denominator is NOT-RECORDED in 5 of 17 runs (1, 4, 6, 10, 17) and got worse post-migration — run 17's count exists nowhere in git (PR #131 names only the surviving row). The gauge is degrading at its source. → feedback item 2 below.

Cadence: 17 runs over 20 weekdays; the run numbering is contiguous, so 2026-08-25/26/27 are genuinely missed runs, not quiet days (quiet runs 6/7/9/10 all committed narrative anyway). The window matches the displaced-cron regime (research/2026-08-31_displaced_cron_regime.md); the panel runs on claude.ai infra, so the cause is not recoverable from git.

M2 — registration before computation (G5) · source: commit dates, hashes below

Population since seeding: 5 guard builds (queue/built/), 1 recorded measurement (RWG-1 leg 2), 1 evaluator pinning (VRP forward-gate), and 0 thales evaluate runs (trial registry untouched since 2026-08-01, 4286d89).

• RWG-1 leg 2: registered 8359538 (2026-08-20, panel run 11) + rider a3dfe8c (08-21 06:47) → measured 9b2e268 (08-21 15:20). Order correct.
• 5 built items: proposal commits 2026-08-10..08-28 (9fc741e, a3dfe8c, 5972694, 56825fb) all precede build commits 2026-08-26..09-02 (2072f4b, 8c0f731, 6321abb, 100cf61). Order correct.
• VRP forward-gate evaluator (fc389d7, #136): pinned 2026-09-02, ~4 months before its ~Jan-2027 clock matures — the exam pinned before any student can see it, as §6 demands.

Inversions: 0.

M3 — kill-criterion honesty · source: git show of proposal vs built text, all 5 queue/built/ items

5/5 IDENTICAL wording from proposal to verdict — byte-for-byte through the 08-24 queue migration — and every criterion was actually evaluated, with negative controls run and revert-reds shown (proposal/built hashes as in M2; the one pre-build edit, STAMP-1 at a1b0bb6, is a dated insertions-only triage annotation, +44 lines, criterion untouched).

Honesty-positive disclosures: AMG-4's built note says plainly its pre-registered end-to-end probe PR was NOT run ("recorded as not done, not as done"); all five record the route around queue/approved/.

One minor unflagged under-execution: STAMP-1's pre-registered negative control says "replay the captured_at timestamps of the last 20 committed capture days"; the shipped test replays 5 representative instants (tests/test_utils/test_market_session_date.py) and the built note does not flag the reduction. Not a criterion change — the 20-trading-day forward shadow is separately pinned — but a control's sample size is part of the registration, and shrinking it deserves a sentence.

Silent divergence: 0. Unflagged control under-execution: 1 (minor).

M4 — reject-ledger integrity · source: queue/open/ (12) vs queue/dismissed/ (10) + web/public/data/killlist.json (13) + RESEARCH.md kill headers

9 NONE / 3 SUPERFICIAL / 0 RESTATEMENT. The three superficials share territory but not the killed question — CNT-1 ~ f2-reopen (both "digest count disagrees with truth", but F2 killed a queue-count regex parser and CNT-1 is a clean-clock counting convention split); PIT-1 ~ b4-notch (both "row-count floor", but PIT-1 is a writer-side persistence guard on the pit stream, touching neither the skew stream nor the affirmed ≥400 pin); SKW-2 ~ b4-notch (B4-adjacent, but proposes no floor amendment and itself flags the mid-accrual sensitivity check). Owner can disagree; the full quotes are in this run's transcript. No dismissed idea has been re-proposed — notably, cron-delay-capture predicted itself "the single most likely re-proposal next time the scheduler misbehaves"; the scheduler then misbehaved for a week and the panel routed the pain into writer/QA hardening instead. The tripwire was tested by events and held.

Caveat on source coverage: memory/strategic-posture.md is absent from the routine checkout — exactly the state open item MEM-1 documents — so the public kill list + in-repo kill records served as the standing-kills source.

M5 — closure rate and cost (G3) · source: results/research_registry.jsonl, results/diagnostics/oos_verdict_history.jsonl, triage commits

• Trial-registry rows added since seeding: 0 (413 rows, last touched 2026-08-01 4286d89). Deflated-Sharpe hurdle movement: none. Correction to the seed block: it recorded 412 rows at seeding; a recount says the file already held 413 (both registry commits are 08-01, the file untouched since). The seed miscounted by one.
• Questions closed since seeding: 5 — the built detectors, each with a reported criterion verdict (M3). Triage dismissals (4 on 08-24 f51c479, 3 at the 12-cap on 08-31 a1b0bb6) are grooming, counted separately, not closures. The oos-monitor's 09-01 append (oos_verdict_history.jsonl row 3, INSUFFICIENT_DATA) is a ledger row, not a closure.
• Cost per closed question: 0 registry rows / 5 closures. All five are instrument/operational closures; zero strategy questions closed — the charter's intended shape (apparatus over weather), and free. M5's warning direction (rows spent without closures) is not present; the inverse is.
• Route counter — keep this in the series: builds via queue/approved/ 0 of 5. All five built items were built on owner-interactive instruction, each citing "the EXQ-1 precedent", honestly recorded and human-merged — no rails breach. But queue/approved/ has never held an item (its only history is the gate's own creation, 47e8e73), and the Wednesday implementer has never had work. The designed panel→triage→approve→implement path has never once run end-to-end, and precedent is accreting around the unexercised gate. Recorded as a counter, not a proposal: if this reads 0/N again next month while the interactive route keeps building queue items, the pipeline's approval gate is a drawing, not a door, and that becomes the finding.

G1 — auditor's residue · target: PR #132 / commit 100cf61 (STAMP-1+STAMP-2, market-session stamping)

Method: a fresh-context adversarial audit of the change as if no routine had reviewed it, then compared against everything reported at the time (panel run 14, the two built records, the 09-02 self-audit, the PR). The change's core claim VERIFIES — the four incident instants and the pinned edge probes replay correctly, the idempotency gate now keys on the session, and the 30-run negative control is genuinely in the test file.

Residue: 7 = 1 MAJOR (3) + 4 MINOR (4). None of the five items appear in any record made at the time.

• MAJOR — the pre-open→previous-day rule inverts for current-state captures. market_session_date maps any pre-09:30-ET instant to the previous trading day, on the rationale "the only data that exists then is that day's close" — true for chains, false for snapshot-shortability, whose content is a current-state-only snapshot (the call site's own comment: "a threaded historical date would FABRICATE state", cli.py:2153-2157). A skew-snapshot run delayed into the 04:00–13:30Z window (measured dispatch delays reach 9 h; 9 h past 19:00Z lands exactly at midnight ET) writes morning-refreshed ETB/HTB flags permanently to yesterday's parquet, and the TIME-GATED flip panel dates an overnight flip to the wrong session. The pre-fix UTC stamp was content-correct for this one stream; #132 made it wrong. No test covers a pre-open instant reaching this writer. → filed as queue item STAMP-3 (feedback item 1).
• MINOR — the "a holiday stays the holiday" promise holds only after 09:30 ET; a pre-open holiday instant jumps two calendar days back (2026-09-07T12:00Z → 2026-09-04), contradicting the docstring; the pinned holiday test probes only 14:35Z.
• MINOR — the per-sleeve digest's no-run canary still judges the UTC date (digest.py:49 via cli.py:4378, today=None → date.today()): the backwards fire #132 fixed in the fleet path survives in the manual single-sleeve path, and the retained clock-hermeticity entry sanctions it.
• MINOR — failure-alert email subjects stamp date.today() (UTC) (cli.py:3628, :4392): a post-midnight displaced failure emails tomorrow's date in the one channel a human reads to pick which session to investigate.
• MINOR (hygiene) — duplicate in-function import of the helper (cli.py:4713, :4760); the commit message's "capture-qa" rewiring claim is loose (capture_qa takes no date); export-public's date.today() feeds a dead parameter.

Series note: this is G1 datum #1 (residue 7 on one change). The 09-02 self-audit's residue 23 was whole-system scope — not comparable; the comparable series starts here, same method, one change per month.

Feedback filed this run (each with its motivating measurement)

1. research/queue/open/stamp-3-preopen-current-state-inversion.md — the G1 MAJOR plus the three same-class UTC residuals as riders, full contract with a pre-registered, negative-controlled kill criterion (motivated by G1).
2. PR editing ops/RESEARCH_PANEL.md (will not auto-merge, deliberately): every panel run record must carry the triple considered / survived-review / opened, zero days included (motivated by M1's denominator being unrecorded in 5 of 17 runs and worsening).
3. Deliberately NOT proposed: any reaction to the rising M1 survival rate (one month cannot separate softening from a rich delta — the recompute next month decides), and any machinery for the 0/5 approved-route counter (the series carries it; machinery would be a sixth opinion).

Post-measurement note, same day: while this block was being written, CNT-1 moved open→built on main (b50ae9b, #141) — route again owner-interactive ("recorded honestly" in the file), so the M5 route counter closes the window at 0 of 6 and M4's open-set is now 11. The closure count for this window stays 5 (CNT-1's verdict belongs to next month's window).

Kill-criterion status of this routine (procedure §4): run 1 — adopted-change counter starts now; the 09-01 quota death counts against the beacon record, not this criterion.