# MIS v2 Total Context Sweep - Full Output

**Generated:** Thursday, June 4 2026 - 10:13 PM EDT (NY) | Session 41 cont | ANALYSIS MODE, freeze intact
**Workflow:** mis-total-context-sweep (16 agents, ~1.52M subagent tokens, ~12 min) | run wf_c4873c9b-b36
**Scope:** read-only - no clasp/deploy/writes/UI. Critic-reviewed.

---

## A-H SYNTHESIS

Date confirmed: Thursday June 4 2026, 10:10 PM EDT. Producing the synthesis as raw markdown ready to append to `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md`.

---

# MIS v2 — Final Synthesis (14-Section Sweep + Critic)

> **Generated:** Thursday, June 4 2026 · 10:10 PM EDT (NY) · Session 41 cont · ANALYSIS MODE
> **Status:** DEPLOYMENT FROZEN. This document proposes NOTHING to deploy now. It is the read-only synthesis of the 14-section context sweep, reconciled against the critic (Agent 15).
> **Authoritative inputs:** `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md` L1–906 · `MIS/v2/Code.gs` (2,946 lines) · `outputs/2026-06-04_19-57_research_mis-v2-analysis-sweep.md` · live-endpoint claims **demoted to snapshot** per critic C2.
> **Critic corrections applied throughout:** every "live" recon/exposure/health number is labeled **single-source-as-of-2026-06-04-PM** (C2/M1/U1); ASML-dropped is **code-path-plausible, not live-confirmed** (C1); deploy version is **undetermined** (C3); Agent 8's GATE 3/4 engine surgery is **REJECTED** as freeze-violating (U4); GATE-4 rewrite stays **eliminated** (U2/S6).

---

## A. CURRENT MIS STATE

| Dimension | State | Detail | Confidence |
|---|---|---|---|
| **Architecture** | 🔒 FROZEN | Design phase closed 2026-06-04. Two-layer lock: Engine (Durability/Trend/Setup→Action, pure) vs Portfolio (Weight/Margin/Mandate/Concentration WARNING, never mutates Action). Any new score/state/factor/action/vocab auto-FAILS without a 50/183/250 deficiency proof. | SOLID — 3 independent traces |
| **Gate A** (net-equity recon) | ✅ LIVE | `Portfolio_Reconciliation` layer, PASS @77. Equity figure **$22,135 = snapshot-derived, NOT re-fired** (C2). | SHAKY on the number; SOLID it's live |
| **Gate B** (per-account exposure) | ✅ LIVE | `misV2Exposure_` (Code.gs L2031), >25% ⚠CONC warning, never mutates Action, PASS @78. Exposure %s snapshot-derived. | SOLID on mechanism; SHAKY on %s |
| **Gate B.5** (stability observe) | 🟡 OBSERVED, not closed | Equity/exposure/health steady across the one banked snapshot; not closed until B.75 clears. | MED |
| **Gate B.75** (holdings freshness) | 🔒 **OPEN — THE BLOCKER** | Must clear BOTH REDs (600 ABBV 17→7sh; 5692 Joint $230/4.6%). Needs Sam human inputs (a)(b)(c) — unobtainable read-only. | SOLID it's the blocker |
| **Gate C** (Legacy/Proposed display) | 🔒 BLOCKED until B.75 | Promoting `synthV2` IS the GATE-4 fix. Requires building `misV2VerdictFor_` (does NOT exist — grep-verified). | SOLID |
| **Gate D** (after-hours header) | 🔒 BLOCKED until C clean on all 3 surfaces | `regular_pct`, CLOSED-branch. | SOLID |
| **synthV2 engine (decomposed)** | ✅ PROVEN CLEAN | Consumes only `dur/trend/setup/f52/accel + isHeld` boolean (L1885–1900). No mktValue/portTotal/qty. **Wired to ZERO operator surfaces** — orphan until C. | SOLID — 3 traces |
| **Legacy FSE (`misV2BuildFSE`)** | ✅ LIVE = production verdict | GATE 4 (L333) is the SOLE stale-magnitude→Action path; `portTotal` summed across ALL accounts, no filter. Legacy-only contamination. | SOLID — line-cited |
| **GATE-4 rewrite** | ❌ ELIMINATED from critical path | Dissolved by trace (synthV2 already clean). C supersedes it. §6 of the doc still reads as if required — **stale, needs SUPERSEDED marker** (S6). | SOLID |
| **Absolute-score conversion** | 🔒 BLOCKED (post-freeze queue) | HIGHEST-RISK item; percentile→fixed. After C/D. | SOLID it's deferred |
| **Scale 50→183→250** | 🔒 NOT STARTED | ~40% built (long Price_History, row-extend, sector backfill, rolling Finnhub, partial System_Health), 0% exercised. | SOLID |
| **Production swap** | 🔒 BLOCKED — NO | Until all gates + parallel-run + Sam sign-off. | SOLID |
| **Dashboard/Cockpit** | 🟢 EXISTS (long-form) / 🔒 themed re-skin DEFERRED | `misV2Dashboard_` (~20 sections) LIVE via `fn=dashboard&view=1`. Themed "Step 6 Command Center" re-skin built LAST, after scale. | SOLID |
| **Security** | 🔴 KNOWN, defer fix | `RUN_TOKEN` hardcoded in `peek.html` L135 + 3 Python importers + `mis-bridge.gs` + 2 docs; in git history of 2 (private) repos. Rotation = coordinated, NOT a freeze hotfix (U6). | SOLID |
| **All recon/exposure/equity dollars** | ⚠ UNVERIFIED-LIVE | $22,135 / $14,002 / SPY54-ASML49-META46 / ABBV 17sh / 5-account RED-YELLOW table all trace to ONE banked snapshot; `MIS_V2_TOKEN` absent from repo (C2/M1). | SHAKY — re-fire before trusting |
| **5692 Joint root cause** | ❓ UNKNOWN | "Stale control-side price" = hypothesis; no screenshot ever pulled (M2). #1 open verification. | UNKNOWN |
| **Current live deploy version** | ❓ UNKNOWN | @52 (punchlist) vs @55/56/57 (scaling doc); no doc settles it; no agent ran `clasp deployments` (C3). | UNKNOWN |
| **Accounts 1241 / 4436** | ⚠ INVISIBLE | `PORTFOLIO_CONTROL_` holds only 898; classifier loose-matches 4436, misses 1241 entirely (C5). | SOLID gap |
| **2.5%/mo + −20% thesis thresholds** | ⚠ NOT in v2 | Live in v1 `emailDailySnapshot.js`; v2 active-book gates = GATE 6 (R:R≥2.5) + GATE 4 (20% overlap). | SOLID |
| **Stale-but-plausible / freshness SLA** | ❌ NOT GATED | `asof` stamp written to HOLDINGS_CLEAN col J but read by NO freshness guard. `crosscheck`/`factordiag` exist but on-demand, not in health rollup. | SOLID |

---

## B. WORK ALREADY DONE

> Commit hashes for tonight's chain (`67b3116..b5feb3e`) attach to artifacts/analysis; the **converged engineering deltas themselves are read-only analysis — no engine code was deployed tonight** (freeze). Per critic C2, the "live PASS" labels are snapshot-validated, not freshly re-fired.

**Tonight (2026-06-04, chain `67b3116..b5feb3e`):**
- **Gate A — Portfolio_Reconciliation built & validated** PASS @77. Real equity **$22,135** replaces the **$32K phantom** — sums broker-control NET, immune to stale holdings (Code.gs L2005/L2158). *Number = snapshot-sourced.*
- **Gate B — per-account exposure** PASS @78 (`misV2Exposure_` L2031), ⚠CONC display-only.
- **The night's biggest result: P0 ELIMINATED.** Two independent read-only traces proved `synthV2` (L1885–1900) consumes only an `isHeld` boolean → GATE-4 magnitude contamination is **legacy-`misV2BuildFSE`-ONLY** → **C is the GATE-4 fix**, not a blocked rewrite. Third independent trace (Agent 9) corroborated.
- **9-agent analysis sweep** written: `outputs/2026-06-04_19-57_research_mis-v2-analysis-sweep.md` (the only workspace home for tonight's recon/exposure/GATE work).
- **Locked next-window instruction:** "Execute B.75, then C, exactly against the coherence gate. STOP after C. No D, no scale, no swap." (doc L878–886).
- **C 9-point Definition of Done** specified (doc L888–897), incl. load-bearing clause #5 (no silent FSE fallback) and #9 (EXTEND `misV2SurfaceConflictCheck_` L2692, do not replace).

**Prior (verified in code / docs):**
- **20-ticker meta fix** — `misV2RefillMeta_` (`fn=refillmeta`), additive/idempotent, deployed v2 (version @52 *or* later — undetermined, C3); crosscheck 20 OK. (audit `2026-06-03_08-00`)
- **FSE 11-cap removed** — `fn=extendrows`, MAXROW 12→40, scores all 20 (CONTEXT Session 41).
- **Sector blindness fixed** — `fn=fillsectors`; Schwab OAuth ported into v2 (Script Properties); peek overlay LIVE.
- **Snapshot re-pricing done** — `misV2RepriceHoldings_` (@56 per scaling doc).
- **Compute-from-delivery split** — dashboard CacheService (@55), brief cache (@57) — *pending Sam's one-time warm-trigger editor auth.*
- **3 lethal SACS bugs fixed** — ATR floor, risk gate, divide-by-zero (institutional audit `2026-06-02/03`).
- **All v1 auto-email triggers KILLED** 2026-06-02 (no more stale sends).
- **Long Price_History table + row-extend + sector backfill + rolling Finnhub (40 stalest/run)** — scale plumbing built additively, NOT exercised.

---

## C. REMAINING WORK BY TIER

### MUST (gates the entire forward path; nothing proceeds without these)
- **B.75 Sam human inputs** (read-only-impossible): (a) fresh 5692 Joint broker screenshot; (b) `Broker_Qty` per-position control source + seeding ritual (owner/cadence/format — currently undefined); (c) fresh holdings import (EOD Position Summary) to move ABBV 17→7 and clear the 600 RED.
- **Build `misV2HoldingsFreshness_()`** — read-only per-`{account,ticker}` qty divergence + import-age → RED/YELLOW/GREEN; emits health rows; **PROPOSE-not-write, never mutates HOLDINGS_CLEAN.**
- **Build `misV2VerdictFor_(sym)`** — the single-source accessor C requires; does NOT exist (grep-verified, M4).
- **Re-fire `fn=portrecon`/`fn=exposure`/`fn=health` with the Worker token** to refresh every snapshot-derived number BEFORE trusting any of them (U1; read-only, does not violate freeze).
- **Run `clasp deployments`** to settle the live version (C3) before any deploy reasoning.

### SHOULD (closes coherence + removes stale traps; sequenced after the MUSTs)
- **C verdict-promotion + coherence** — repoint the TWO legacy producers (FSE col 7 → brief/Scope/shortlist/dashboard; `Snapshot.FinalState` → EntryPad) to the promoted verdict; MIGRATION_MODE marker; **EXTEND** `misV2SurfaceConflictCheck_` (L2692) to police both producers vs promoted verdict; pair every swap with cache invalidation (brief warm-cache L2932, Worker `/mis/peek`).
- **Add a positive absence-test to the C DoD** — null one ticker's synthV2, confirm all 4 surfaces render "unavailable," never silent legacy revert (Agent 9 gap; DoD #5 tests agreement, not absence-handling).
- **Add SUPERSEDED marker to doc §6 item B.75-#4** so no one builds the eliminated GATE-4 rewrite (S6/U2).
- **Recon dollar-floor** — RED only if `diff% > 3% AND diff$ > threshold`; reconcile the $50 (Obj-1) vs $250–500 (doc L123) split — needs Sam sign-off (changes a portfolio-level gate).
- **Mark moot decisions** — "remove RR from SACS" is moot (SACS = `FlowStrength×0.5 + RS_SPY×25 + RS_Sector×25`, never used RR); fix the cosmetic entry-pad caption (S5).
- **Propagate tonight's deltas into `MIS_SYSTEM_STATE.md`** (one session behind) and refresh `WORKSPACE_AUDIT.md` MIS rows (April-stale) + README.md (v1/v11 era-stale) — the propagation gap (S2/S4).

### MAY (real but lower-leverage; do not pull forward)
- **D after-hours dual header** — only after C clean on all 3 surfaces.
- **Verify partial-fill subject line** against a real Fidelity email BEFORE editing `ImportTrades_` L517 (M3/U3) — do not edit blind.
- **Confirm old v1 plaintext Schwab/Finnhub creds were rotated** (M5) — one-line check.
- **Add freshness SLA + scheduled `crosscheck` to the health rollup**; build the single consolidated `System_Health` tab (spec L258–262) with cache-age + last-run rows.
- **Guard `misV2Cleanup_` Sectors-tab delete-default** (U5) before any cleanup run.

### BLOCKED (freeze + sequence; touch only when a Sam-opened window says so)
- Absolute-score conversion · 50/183/250 scale tests · production swap · themed dashboard re-skin.
- **Wire the 6 risk/factor/VaR/backtest functions off the 16-ticker `misV2HistColMap_` onto the long reader** + fix the `phN>=16` health-gate threshold — real scale defects, but BLOCKED behind the freeze (no scale evidence yet).
- **Token rotation** — coordinated change across peek.html + 3 Python + mis-bridge.gs; defer to a Sam window (U6).
- **❌ REJECTED (do NOT build): Agent 8's B.75 item #3** — "gate GATE 3/4 behind qty-reconciliation / scope heldMap to active accounts." This is ENGINE-layer surgery that reopens legacy logic the freeze + "C is the fix" explicitly removed (U4). B.75 is a **freshness/presence check only.** Also references accounts (1241/4436) the code doesn't recognize.

---

## D. 75%-FORWARD PLAN (biggest SAFE advancement, locked order)

For each step: **DESIGN-DONE vs NEEDS-BUILD** + the gating condition. All steps respect the freeze; the only deploy-eligible work is read-only diagnostics + C's display promotion, and only inside a Sam-opened window.

**1. B.75 Holdings Freshness** — DESIGN-DONE (spec) · `misV2HoldingsFreshness_` NEEDS-BUILD (read-only). **Gate:** Sam inputs (a)(b)(c) + dollar-floor sign-off (c'). Acceptance: ABBV 17→7 AND 5692 RED resolved on BOTH accounts, equity stays ≈$22,135 (must NOT rebound toward $32K), divergence GREEN — verified read-only after next EOD import. *Pre-req:* confirm `misV2PortfolioReconText_` (L2011) NAMES both REDs (rollup currently reports worst only → 5692 may be invisible in the brief while still blocking).

**2. C Legacy/Proposed coherence** — DESIGN-DONE (9-point DoD) · `misV2VerdictFor_` + surface repointing + DoD-#5 absence-test NEEDS-BUILD. **Gate:** B.75 PASS. Promote synthV2 into the two producers; EXTEND L2692; cache-invalidate; STOP after C.

**3. D after-hours header** — DESIGN-DONE (CLOSED-branch spec) · NEEDS-BUILD. **Gate:** C clean on Telegram + Test Entry + Scope.

**4. F absolute-score conversion** — DESIGN-DONE (COPY→VERIFY→BASELINE→PROMOTE, #15A/#15B) · NEEDS-BUILD. **Gate:** C/D done; run on a Drive COPY, not production. HIGHEST-RISK; percentile→fixed shifts original-20 scores by construction.

**5. 50-ticker gate** — DESIGN-DONE (#15A/#15B immutability tests) · NEEDS-BUILD (System_Health tab + wire 6 analytics off the 16-ticker map). **Gate:** absolute conversion done; System_Health tab exists with `phN`-relative (not hardcoded 16) threshold first.

**6. 183/250 path** — DESIGN-DONE (long Price_History) · NEEDS-BUILD (Tickers live-quote batching; Finnhub full-cycle latency ~7d at 40/run; unmeasured FSE rebuild vs 6-min GAS ceiling). **Gate:** 50-ticker immutability PASS.

**7. Production-swap conditions** — DESIGN-DONE (parallel-run doctrine) · NEEDS-BUILD. **Gate:** ALL above + parallel-run zero-verdict-drift + explicit Sam sign-off. Default = NO.

**8. Dashboard (themed cockpit) — LAST** — DESIGN concept-only, NO artifact on disk · NEEDS-BUILD. **Gate:** 50→183→250 validation passed; consumes proven outputs (System_Health, proposed actions, reason codes, Durability/Trend/Setup, positions, cash, macro). Anchor use-case: *"I heard something on Bloomberg — what matters to MY book right now?"*

---

## E. STOP RULES

The session/window STOPS immediately when ANY of these fire:

1. **After C completes** — the locked instruction is "STOP after C. No D, no scale, no swap." Do not continue into D in the same window.
2. **B.75 Sam inputs (a)(b)(c) absent** — the window cannot execute B.75 read-only; STOP and request the screenshot + Broker_Qty seed + fresh import.
3. **Equity rebounds toward $32K** after a holdings import — STOP; the import reintroduced whole-transaction-history qty (the `_full_reconcile` regression), not settled position.
4. **Any need to add a score / state / factor / action / vocab term** — auto-FAIL per the scope gate; STOP unless a 50/183/250 test proves the deficiency is unsolvable in the existing architecture.
5. **Any temptation to rewrite legacy GATE 3/4** (Agent 8 #3) — STOP; that work is eliminated/frozen. C is the fix.
6. **Any "live" number drives a money/trade decision without a fresh re-fire** — STOP; re-hit `fn=portrecon`/`fn=exposure` with the token first (numbers are snapshot-derived).
7. **A surface would silently fall back to legacy FSE** when synthV2 is missing/errored — STOP; must render "unavailable," never a quiet revert (DoD #5).
8. **`clasp deployments` not yet run** before any deploy reasoning — STOP; the live version is undetermined.
9. **Editing `ImportTrades_` L517 without a confirmed real Fidelity partial-fill subject** — STOP; verify against an actual email first.

---

## F. DEPLOY-WINDOW CONTRACT

**Default state: NO deploy. Freeze holds until Sam explicitly opens a window WITH the locked instruction.**

**Deployable (only inside a Sam-opened window, in this order):**
1. **Read-only diagnostics** — `misV2HoldingsFreshness_` (PROPOSE-not-write), re-fire of `fn=portrecon`/`fn=exposure`/`fn=health`, `clasp deployments`. These never mutate Action/holdings and do not violate the freeze.
2. **B.75 closure** — after Sam inputs (a)(b)(c) land; verified read-only post-import.
3. **C verdict-promotion** — build `misV2VerdictFor_`, repoint the two producers, MIGRATION_MODE marker, EXTEND `misV2SurfaceConflictCheck_`, cache-invalidate, absence-test. **STOP after C.**

**Must remain READ-ONLY / untouched this window:**
- **Engine layer** (`misV2BuildFSE` GATE 3/4 logic) — no rewrite, no heldMap re-architecture (U4/U2).
- **Portfolio layer recon/exposure math** — display/threshold only; never writes Action.
- **All scale plumbing** (long-table analytics wiring, Finnhub cadence, System_Health thresholds) — BLOCKED.
- **Token rotation** — coordinated, deferred to its own Sam window (breaks peek.html + 3 importers + mis-bridge simultaneously).
- **D, absolute-score, 50/183/250, production swap, themed dashboard** — past the stop line.

**Deploy mechanics when authorized:** `clasp push` → `clasp deploy -i <LIVE_DEPLOYMENT_ID>` (versioned, not @HEAD) → `curl` /exec = 200. Pair every display swap with cache invalidation in the same pass.

---

## G. DECISION GRID

| Decision | Inputs | Threshold | Default | Owner | Cadence | Governance | Metric | Rollback |
|---|---|---|---|---|---|---|---|---|
| **Re-fire recon/exposure/health** | Worker token, live endpoints | Any number used for a decision | DO (read-only) | Claude | Each window-open | Read-only, freeze-safe | All figures timestamped-live, not snapshot | n/a (read-only) |
| **Run `clasp deployments`** | clasp auth | Before any deploy reasoning | DO | Claude | Each window-open | Read-only | Live version known | n/a |
| **Close B.75** | 5692 screenshot, Broker_Qty seed, fresh EOD import, $-floor sign-off | BOTH REDs clear AND equity holds ≈$22,135 | WAIT for Sam inputs | Sam (inputs) / Claude (build) | One-time then per-import | Read-only freshness check; PROPOSE-not-write | Divergence GREEN; equity ≠ $32K rebound | Re-import prior Position Summary; revert HOLDINGS_CLEAN unchanged (never written) |
| **Build `misV2VerdictFor_` + C promotion** | B.75 PASS, synthV2, 9-point DoD | All 9 DoD points incl. absence-test | BLOCKED until B.75 | Claude | One window | EXTEND L2692, no replace; cache-invalidate | All 4 surfaces show same Legacy/Proposed/Mode; 0 silent fallbacks | Revert surface adapters to FSE col 7 read; MIGRATION_MODE off |
| **Recon dollar-floor** | $50 vs $250–500 split | `diff% > 3% AND diff$ > floor` | WAIT Sam sign-off | Sam (value) / Claude (impl) | One-time | Portfolio-layer gate change | Kid accounts stop false-RED; real gaps still RED | Restore relative-only threshold |
| **D after-hours header** | C clean ×3 surfaces | C DoD passed | BLOCKED | Claude | After C | STOP-after-C overrides until next window | CLOSED-branch shows regular_pct correctly | Revert header to single-price |
| **Absolute-score conversion** | C/D done, Drive COPY | #15A scores unchanged + #15B actions explainable | BLOCKED | Claude | Post-D window | COPY→VERIFY→BASELINE→PROMOTE | Original-20 scores/actions stable | Discard COPY; production untouched |
| **50/183/250 scale** | absolute done, System_Health tab | #15A/#15B PASS on COPY | BLOCKED | Claude | Post-conversion | phN-relative health threshold first | 0 unexplained verdict moves | Discard COPY |
| **Production swap** | all gates + parallel-run | Zero verdict drift + Sam sign-off | NO | Sam | Final | Hard sign-off gate | Parallel-run match 100% | Repoint surfaces to legacy FSE |
| **Themed dashboard** | scale PASS, proven outputs | Built LAST only | BLOCKED | Claude | Last | Confirm-what-exists only until then | Answers "what matters to MY book now" | n/a (additive surface) |
| **Token rotation** | new RUN_TOKEN | Sam window | DEFER | Sam + Claude | Own window | Coordinated across 5 locations + history scrub | New token only in PropertiesService; peek.html routes via Worker | Restore prior token across all 5 |
| **Edit `ImportTrades_` L517** | real Fidelity partial-fill email | Confirmed exact subject string | WAIT for email | Claude | After verification | No blind edit | Partial-fills ingest correctly | Revert to `subject:"Order Execution"` |

---

## H. FINAL RECOMMENDATION

The highest SAFE 75% advancement from here is to execute the locked **B.75 → C → STOP** path and nothing beyond it — but to front-load it with two zero-risk, freeze-compliant moves the critic made unavoidable: **(1) re-fire `fn=portrecon`/`fn=exposure`/`fn=health` with the Worker token and run `clasp deployments`**, because every "live" number in this sweep ($22,135, the two REDs, the exposure %s, the @52-vs-@57 version) is actually a single banked 2026-06-04-PM snapshot and must be refreshed before it drives anything; and **(2) build the read-only `misV2HoldingsFreshness_` check and `misV2VerdictFor_` accessor**, the only two missing pieces B.75 and C respectively need. The architecture conclusion is solid and conservative — three independent traces prove `synthV2` is portfolio-dollar-clean and that **C (promote the proven verdict) IS the GATE-4 fix**, so the single biggest safe win is a *display promotion plus coherence guard*, never an engine rewrite. This reconciles perfectly with the freeze: it adds no score/state/action/vocab, it leaves the engine and all scale work untouched, it rejects Agent 8's GATE 3/4 surgery as freeze-violating, and it keeps the GATE-4 rewrite eliminated. The blocker remains human, not technical — B.75 cannot close until Sam supplies the 5692 screenshot, the Broker_Qty seed, the fresh EOD import, and the dollar-floor sign-off — so the correct posture tonight is: stay frozen, propagate tonight's deltas into the stale living docs, add the SUPERSEDED marker to doc §6 so no one rebuilds the dead GATE-4 fix, and wait for Sam to open the window with the locked instruction.

---

**Source trail:**
- Append target: `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md`
- Inputs: 14-section sweep + Agent 15 critic · `MIS/v2/Code.gs` (2,946 lines) · `outputs/2026-06-04_19-57_research_mis-v2-analysis-sweep.md`
- Generated: Thursday June 4 2026 · 10:10 PM EDT (NY) · Session 41 cont · ANALYSIS MODE · deploy freeze intact
- Working dir: `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\MIS`
- Read-only synthesis: no endpoints fired, no files edited, nothing deployed.

---

## CRITIC REVIEW (agent 15)

I have all 14 sections. Producing the critic review now.

# AGENT 15 — CRITIC REVIEW: MIS v2 Context Sweep

The 14 sections are unusually disciplined — most agents self-flagged their own unverified claims, which is the right behavior. The convergence on the central architecture finding is genuine and independently corroborated. Below are the cracks worth surfacing before anyone acts.

---

## 1. CONTRADICTIONS BETWEEN AGENTS

**C1 — "ASML is currently WATCH" vs "ASML is the latent/design case" (Agents 1, 6, 9 vs Agent 1's own L657 note).**
Agents 6 and 9 assert ASML is silently dropped from the shortlist *today* because its live legacy verdict is WATCH (GATE-4). Agent 1 simultaneously records (finding #4) that the "ADD-while-overweight" tension is **latent, not active** — and that ASML's WATCH is via GATE-4 portfolio overlap, not a SACS reject. These are reconcilable but the framing collides: Agent 9 calls the ASML-dropped symptom "CONFIRMED by mechanism" while admitting "Unverified at runtime — I did not call `fn=shortlist`/`fn=state` to read ASML's current col 7." **Resolution: ASML-dropped is a CODE-PATH-PLAUSIBLE claim, NOT a live-confirmed one.** No agent read ASML's actual `FINAL_STATE_ENGINE` row this sweep. Treat "ASML silently dropped every morning" as a hypothesis with a clean mechanism, not a fact.

**C2 — `fn=portrecon` and `fn=exposure` "fetched this session" (Agents 7, 11) vs "no analyst re-fired live endpoints, MIS_V2_TOKEN absent from repo" (Agents 1, 3, 8, 9, 12).**
This is the sharpest contradiction in the sweep. Agent 7 writes "The 2 REDs — CONFIRMED live (`fn=portrecon`, fetched this session)" and prints a full account table; Agent 11 writes "Live pull (verified, `fn=health` 2026-06-04)"; Agent 7 also claims "Live `fn=holdings` shows `600 ABBV 17sh $3,729`." But Agents 1, 3, 8, 9, and 12 all independently state the token is a Worker secret **absent from the repo**, that no analyst re-fired endpoints, and that every "live" number traces to the **one banked B.5 snapshot of 2026-06-04 PM**. Agent 12 (security) confirms the token only lives server-side in the Worker + PropertiesService + the hardcoded peek.html copy. **Resolution: Agents 7 and 11 are almost certainly reporting the BANKED SNAPSHOT as if freshly fetched** — either they read cached values, or they pulled via the token embedded in peek.html (Finding 1) without saying so. The five-agent majority + the structural fact (token not in repo) wins. **Every recon/exposure/health number in this sweep must be labeled single-source-as-of-2026-06-04-PM, NOT live.** This is the single most important correction in this review.

**C3 — Deploy version: `@52` (Agents 2, 4) vs `@55/@56/@57` (Agents 2, 10, 13).**
Agent 2 flags it directly: punchlist says deploy-in-use `@52`; scaling doc references `@55/@56/@57` as done; both same day, neither hour-stamped. Agent 4 repeats `@52` for the 20-ticker fix; Agent 13 cites dashboard cache `@55`, brief cache `@57`. **Resolution: the current live deploy version is NOT established by any document.** Must be resolved against `clasp deployments` before any deploy action. No agent ran it.

**C4 — 5692 Joint status: GREEN (Analyst-1, surfaced by Agents 1, 3, 4) vs RED 4.6%/$230 (calibration B.5, adopted by Agents 1, 7, 8).**
This is a *resolved* contradiction (the doc adjudicates DOC-WINS / live-read primary), and Agents 1, 3, and 4 all correctly carry the resolution. No action needed except to note: the resolution rests on the same banked snapshot impugned in C2. So "5692 is the second RED" inherits the single-source caveat. B.75 must clear it regardless because the *safe* assumption is two REDs.

**C5 — Account coverage: "898 ACTIVE" (most agents) vs "898/1241/4436 ACTIVE book" (Agents 7, 8 citing CLAUDE context).**
Agent 7 found `PORTFOLIO_CONTROL_` contains only **898**; `misV2ClassifyAccount_` matches `898|436|SWPF` where `436` loose-substring-matches 4436, and **1241 is absent from both**. Agent 8 confirms. No other agent caught this. **Resolution: this is a real coverage gap, not a contradiction** — 1241/4436 are portfolio-invisible. Valid finding; flag for the recon owner. (See also UNSAFE-N4: the B.75 acceptance test in Agent 8 references scoping heldMap to "898/1241/4436" — accounts the code doesn't fully recognize.)

---

## 2. STALE FACTS

**S1 — `README.md` describes v1/v11.0h as "current active code" (Agent 2).** Correctly caught. It points at `MIS-v1-script/emailDailySnapshot.js` + the 3-email schedule + `1HEmRev` sheet as live, never mentions v2/Code.gs or the two-layer architecture. Resolution: README is era-stale; the v2 engine + calibration module are canonical. Agent 2's call is solid.

**S2 — `docs/WORKSPACE_AUDIT.md` MIS rows (Agent 3).** Lists MIS as "v11.0f code, FSE arch queued · Apr 28" and references v7.1/V11/v8/v7.3 as the live set. This is the canonical anti-rediscovery map per CLAUDE.md, and it is **wrong for MIS as of June**. High-value catch — this is the file other sessions trust *instead of* re-searching, so its staleness actively misleads.

**S3 — `docs/CURRENT_STATE.md` L28 (Agent 3).** "PORTFOLIO_OVERLAP gate operates against 10-position view because paste didn't land" — contradicts the GATE-4 contamination finding. Self-flagged stale (last real update 2026-05-19). Correct to not act on it.

**S4 — `MIS_SYSTEM_STATE.md` is one session behind (Agent 3).** The June-2 canonical living doc does NOT record the A/B recon, GATE-4 contamination finding, $22,135 correction, or the freeze. This is the propagation gap, not a contradiction — the tonight work lives ONLY in the calibration module + the 19-57 sweep. Important: the "definitive system state" doc and the actual converged state disagree by one session. Anyone reading only `MIS_SYSTEM_STATE.md` gets a wrong picture.

**S5 — SACS formula caption is cosmetically wrong (Agent 1).** Entry-pad caption "SACS = Composite·0.3 + Flow·0.3 + RR·0.2 + Grade·0.2" is documented-but-false; actual = `FlowStrength×0.5 + RS_SPY×25 + RS_Sector×25`. Consequence: the locked decision "remove RR from SACS" is **moot** (SACS never used RR). Self-flagged in the doc but the decision still sits unmarked in the decisions list. Valid stale-decision flag.

**S6 — Stale within the doc itself: GATE-4 framing not retracted (Agent 1, finding #2).** §6 still reads as if GATE-4 rewrite is required CRITICAL work (L588/L621/L716/L778); later appendices (L783-839/L870) eliminate it. The doc never struck the earlier P0. **Live risk: a reader landing on §6 builds the eliminated fix.** This is the most actionable internal-staleness finding — recommend the doc get a SUPERSEDED marker on §6 item B.75-#4. Agent 1's catch is correct and important.

---

## 3. MISSING EVIDENCE

**M1 — All recon/exposure/equity dollars trace to ONE snapshot (Agents 7, 11 assert live; 1/3/8/9/12 expose the gap).** Covered in C2. The $22,135, the SPY54/ASML49/META46, the 600-account table, the ABBV 17sh — none independently re-fired. SHAKY until `fn=portrecon` is re-hit with the token.

**M2 — 5692 root cause has zero evidence (Agents 1, 4, 8).** "Stale control-side price" is a hypothesis; no screenshot pulled. Agent 4 calls it "the #1 open verification across all artifacts." Correctly flagged everywhere. Requires Sam's screenshot (B.75 input a) — unobtainable read-only.

**M3 — Partial-fill subject-line gap is unverified (Agent 8).** Agent 8 proposes fixing `ImportTrades_` L517 from `subject:"Order Execution"` to include `"Order Partially Filled"`, but admits "no analyst pulled the actual ABBV fill email to confirm Fidelity's exact subject." **Do not edit the query string against an unverified subject line.** Pull one real Fidelity partial-fill email first.

**M4 — `misV2VerdictFor_` does not exist — well-evidenced (Agent 9, corroborated 6).** Agent 9 grepped: zero hits. This is the rare claim that's *negatively* verified. The C DoD references it as if it exists; it must be BUILT. Solid.

**M5 — Old v1 plaintext Schwab/Finnhub creds: rotation status unknown (Agent 2, 12).** Agent 2: "unverified whether the old v1 plaintext creds were ever rotated/removed." Agent 12 confirms v2 is clean (PropertiesService) but the v1 KEY/VALUE-tab plaintext creds (flagged in the v11.0f teardown) have no confirmed rotation. Missing evidence on a live-security item. One-line confirm needed.

**M6 — Agent 14's $22,135-vs-$32K "before/after sales asset" inherits M1.** Agent 14 honestly marks it "the brief's claim, did NOT independently re-verify." Good discipline — but it means the productization "proof story" is built on the same single-source number. Fine for a signal note; do not put the figure in a buyer-facing one-pager until re-verified.

---

## 4. UNSAFE NEXT STEPS

**U1 — Acting on any "live" number as if fresh (triggered by Agents 7, 11 framing).** The most dangerous outcome of this sweep would be someone funding a decision on "$22,135 LIVE" or "RED on 600/5692 LIVE" when those are banked-snapshot values. **Safe step: re-fire `fn=portrecon`/`fn=exposure`/`fn=health` with the Worker token before treating any figure as current.** This does not violate the freeze (read-only endpoints).

**U2 — Building the GATE-4 rewrite (latent in Agent 1 §6 staleness).** The eliminated P0. Anyone following §6 of the calibration doc would rewrite legacy GATE-4 — explicitly removed from the critical path. **C is the fix; do not touch GATE-4.** This would also arguably violate the freeze (reopening engine work without scale evidence).

**U3 — Editing `ImportTrades_` L517 subject query (Agent 8).** Unverified subject string (M3). Editing it blind could silently break trade-log ingestion. Verify against a real email first.

**U4 — Agent 8's proposed B.75 fix #3: "scope heldMap/portTotal to ACTIVE accounts (898/1241/4436)."** Two problems: (a) per Agent 7, the code doesn't recognize 1241 and only loose-matches 4436 — so this scoping would silently exclude/misroute; (b) more importantly, **gating GATE 3/4 behind qty-reconciliation is ENGINE-layer surgery.** Tonight's converged finding is that GATE-4 contamination is legacy-only and **C (promote the clean synthV2 verdict) is the fix — NOT patching the legacy engine.** Re-architecting the legacy heldMap is exactly the work the freeze + "C is the fix" decision says NOT to do. **Agent 8's build-list item #3 contradicts the locked B.75→C path.** B.75 should be a *freshness/presence* check (the read-only `misV2HoldingsFreshness_` it also proposes is fine); it should NOT rewrite GATE 3/4. Flag this as the one unsafe build recommendation in the sweep.

**U5 — `misV2Cleanup_` deletes the Sectors tab by default (Agent 13).** Not a proposed step, but a latent hazard: if anyone runs cleanup, the dashboard's sector section silently empties. Worth a guard before any cleanup run. Unverified whether it has fired.

**U6 — Token remediation must NOT happen mid-freeze without Sam (Agent 12).** Agent 12 correctly says "do NOT act now." Rotating `RUN_TOKEN` would break peek.html, the 3 Python importers, and mis-bridge.gs simultaneously. Correct to defer to a Sam-opened window. The finding (token in git history of two repos + a deployed page) is real and high-priority, but the *fix* is a coordinated change, not a freeze-time hotfix.

**U7 — No score/state/action/vocab additions appeared — freeze respected.** Positive finding: no agent proposed adding a score, state, factor, action, or vocab term. Agent 14 explicitly walls off productization from the build plan. Agent 10 correctly keeps all scale work behind the freeze. The one exception is U4 (Agent 8's GATE 3/4 surgery), which would reopen engine logic.

---

## 5. CONFIDENCE MAP

### SOLID (independently corroborated, code-cited, or negatively verified)
- **synthV2 consumes only `dur/trend/setup/f52/accel + isHeld` boolean** — three independent traces (Agents 1, 5, 9), exact line cites (L1885-1900). The architecture's load-bearing claim. **C is the fix, GATE-4 rewrite eliminated** follows from this.
- **GATE-4 (`misV2BuildFSE` L333) is the SOLE stale-magnitude→Action path, legacy-only** — Agents 5, 8, 9 all line-cite L304-333.
- **`misV2VerdictFor_` does not exist; must be built for C** — grep-verified (Agent 9).
- **C must repoint TWO legacy producers** (FSE col 7 + Snapshot.FinalState→EntryPad) — Agent 6, line-cited.
- **"No silent FSE fallback" is true-because-not-yet-wired, NOT a safety property C inherits** — Agent 9's sharpest correction; it's the thing C's DoD #5 must establish, not inherit.
- **Two-layer Engine/Portfolio separation holds in code** — exposure/recon never write Action (Agents 5, 7, line-cited headers).
- **README.md / WORKSPACE_AUDIT.md MIS rows / CURRENT_STATE.md are stale** — Agents 2, 3, self-flagged sources.
- **Token is hardcoded in peek.html L135 + 3 Python files + mis-bridge.gs + 2 docs; both repos private** — Agent 12, directly read, `gh repo view` verified.
- **Scale path ~40% built, 0% exercised; `misV2HistColMap_` 16-ticker map still powers 6 risk/factor functions** — Agent 10, line-cited; this is a real undocumented scale defect.

### SHAKY (single-source, snapshot-derived, or runtime-unverified)
- **All recon/exposure/equity dollars** ($22,135, $14,002, SPY54/ASML49/META46, ABBV 17sh, the 5-account RED/YELLOW table) — single banked snapshot; Agents 7/11 "live" framing is contradicted by 5 agents + the structural token-absence fact. **Re-fire before trusting.**
- **`fn=health` = YELLOW, `fn=portrecon` = RED-rollup** (Agent 11/7 "live pulls") — same snapshot caveat.
- **ASML silently dropped from shortlist every morning** — clean mechanism, NO live read of ASML's FSE row (C1).
- **5692 Joint is the second RED + its root cause** — adjudicated DOC-WINS but rests on the snapshot; root cause is pure hypothesis (M2).
- **Current live deploy version** (@52 vs @55/56/57) — undetermined by any doc (C3).
- **Partial-fill subject-line gap** — proposed fix on an unverified Fidelity subject string (M3).
- **Old v1 plaintext cred rotation status** — unknown (M5).
- **1241/4436 account coverage** — Agent 7's read of the classifier is solid, but whether those accounts hold material value is unverified.

### ONE UNSAFE BUILD RECOMMENDATION TO REJECT
- **Agent 8's B.75 build-item #3 (gate GATE 3/4 behind qty-reconciliation / scope heldMap to active accounts)** — reopens legacy engine logic the freeze + "C is the fix" decision explicitly removed. B.75 should be read-only freshness/presence checking only. Everything else in Agent 8 (the `misV2HoldingsFreshness_` read-only check, the asOf-stamp-written-but-never-read gap, PROPOSE-not-write discipline) is sound.

**Net:** The architecture conclusion is SOLID and conservative — the sweep earned its central claim. The live numbers are SHAKY and over-stated by two agents as "live" when they're snapshot-derived. The freeze is respected everywhere except Agent 8's one engine-surgery item. Before any window opens: (1) re-fire the read-only endpoints to refresh the numbers, (2) run `clasp deployments` to settle the version, (3) add a SUPERSEDED marker to the calibration doc's §6 so no one builds the eliminated GATE-4 rewrite.

---

## RAW CONTEXT SECTIONS (1-14)

### Agent 1 Canonical spec

I've read the canonical spec in full. I have everything needed for my slice. Let me produce the authoritative gate/state table and flag internal contradictions.

## MIS v2 Canonical Spec — Authoritative State & Gate Table (from `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md`, read in full L1–906)

### CURRENT STATE (verified against the doc as primary source; freshest appendices L743–906)
- **Architecture: FROZEN** (L13, L205, L222). Design phase CLOSED 2026-06-04 (L3). Scope gate active: any new score/state/factor/action/vocab auto-FAILS unless a 50/183/250 scale test proves a deficiency unsolvable in the existing arch (L3–11).
- **Two-layer architecture (locked):** Engine Layer (Durability/Trend/Setup→Action, pure) | Portfolio Layer (Weight/Margin/Mandate/Concentration WARNING, never mutates Action) — restated L778, L793, L849–854.
- **Live changes tonight = A + B ONLY.** A (Portfolio_Reconciliation, equity $22,135 real vs $32K phantom) PASS @77 (L86). B (per-account exposure, SPY54/ASML49/META46, >25% ⚠CONC) PASS @78 (L87). Everything downstream BLOCKED. `$22,135 stands` (L778, L806, L906).
- **Shadow engine COMPLETE; production UNCHANGED; scale validation NOT STARTED; calibration DEFERRED; promotion BLOCKED** (L13–14).
- **The big tonight result (L783–873):** the feared P0 (rewrite legacy GATE 4) was **ELIMINATED** by two independent read-only traces proving the decomposed engine (`synthV2`, L1885–1900) consumes only an `isHeld` BOOLEAN — no mktValue/portTotal/qty magnitude. GATE 4 magnitude contamination is **LEGACY-`misV2BuildFSE`-ONLY** (L333). Therefore **C (promote the clean verdict) IS the GATE 4 fix** — not a blocked feature.

### AUTHORITATIVE GATE / STATE TABLE

| Gate | What it is | Status | Blocker / dependency | Source |
|---|---|---|---|---|
| **A** | Net-equity reconciliation (Portfolio_Reconciliation layer; equity $22,135, Invest-n-Save net $14,002) | ✅ **PASS @77** — LIVE | none — unaffected by GATE 4 | L86, L778 |
| **B** | Exposure reconciliation (per-account %; >25% ⚠CONC warning, no Action mutation) | ✅ **PASS @78** — LIVE | none | L87 |
| **B.5** | Observe one full refresh cycle (stability) | 🟡 **OBSERVED, NOT fully closed** — equity/exposure/health steady, but NOT closed until B.75 clears | gated on B.75 | L89, L117, L709–710 |
| **B.75** | Holdings Freshness (NEW first-class gate) — must clear **BOTH** REDs (600 ABBV + 5692 Joint) | 🔒 **OPEN — the blocker** | needs Sam human inputs (a)(b)(c) below | L90, L712–719, L899–903 |
| **C** | Legacy vs Proposed display (MIGRATION_MODE) — pure presentation; promoting synthV2 IS the GATE 4 fix | 🔒 **BLOCKED until B.75** — primary remaining implementation risk | B.75 pass + 9-point DoD | L91, L793, L854, L888–897 |
| **D** | After-hours dual header (`regular_pct`, CLOSED-branch) | 🔒 **BLOCKED until C passes all 3 surfaces** | C clean | L92, L729–733 |
| **Legacy GATE 4 rewrite** | Rewrite engine to read reconciled denominator | ❌ **REMOVED from critical path** — dissolved by trace (synthV2 already clean) | n/a — C supersedes it | L778→L793, L838–839, L870 |
| **Absolute-score conversion** | Durability/Trend → fixed input→0-100 (not percentile) | 🔒 **BLOCKED** (queue item A of post-freeze) — HIGHEST-RISK item | after C/D; COPY→VERIFY→BASELINE→PROMOTE; #15A/#15B | L171, L199–201, L736 |
| **Scale 50 → 183 → 250** | Scale-invariance validation (#15/#15A/#15B) | 🔒 **NOT STARTED — primary risk** | after absolute conversion | L93, L175, L736 |
| **Production swap** | Replace live FinalState with synthesis | 🔒 **BLOCKED — NO** until ALL gates + parallel-run + Sam sign-off | everything above | L93, L165–166, L736 |
| **Dashboard / Cockpit** | User-facing command center | 🔒 **DEFERRED — built LAST** | after 50→183→250 | L181–188 |

### LOCKED QUEUE / NEXT-WINDOW INSTRUCTION (L878–886)
Exact locked instruction for the next deploy window: **"Execute B.75, then C, exactly against the coherence gate. STOP after C. No D, no scale, no swap."** Order: **1. B.75 → 2. C → 3. STOP.** Default = NO deploy; freeze holds until Sam explicitly opens the window WITH this instruction (L905–906).

### C — 9-POINT DEFINITION OF DONE (all 9 must pass; "ASML says ADD" is NOT the DoD — L888–897)
1. Telegram gets Proposed from `misV2VerdictFor_`
2. Test Entry gets Proposed from `misV2VerdictFor_`
3. Scope gets Proposed from `misV2VerdictFor_`
4. NO surface computes its own Proposed action
5. **NO surface falls back to legacy** (the load-bearing clause — missing/error synthV2 renders "unavailable," NEVER a silent revert to contaminated FSE; "looks migrated while quietly reverting" is worse than not migrating)
6. Legacy remains shown separately
7. Migration Mode visible
8. Exposure warning DISPLAYED, not used to mutate action
9. `misV2SurfaceConflictCheck_` passes — **EXTEND** it (L2692), do NOT replace

### B.75 — HUMAN INPUTS REQUIRED BEFORE THE WINDOW CAN EXECUTE (Sam-only; cannot be gotten read-only — L899–903)
- **(a)** Fresh **5692 Joint broker screenshot** — classify the 2nd RED + seed control truth.
- **(b)** **`Broker_Qty` per-position control source** — the per-ticker broker-truth store the divergence check compares against (no source/seeding ritual exists yet — open item #4).
- **(c)** A **fresh holdings import** (EOD Position Summary) — to move ABBV 17→7 and clear the 600 RED.

### CONFIRMED BLOCKERS (synthesized)
1. **B.75 cannot reach acceptance without Sam inputs (a)(b)(c)** (L903) — the window stays closed until then.
2. **The 5692 Joint RED is UNVERIFIED** (L121, L693, §5 item 1) — hypothesis is control-side stale price, but no fresh screenshot pulled. #1 open verification.
3. **Recon dollar-floor threshold UNRECONCILED** — doc says $250–$500 (L123), Obj 1 said ~$50; needs Sam sign-off (L700, item 8).
4. **`Broker_Qty` seeding ritual undefined** — owner/cadence/format hand-waved (L696, L714).

### INTERNAL CONTRADICTIONS / TENSIONS WITHIN THE DOC ITSELF (flagged per instruction)

1. **The doc explicitly contains and resolves one load-bearing contradiction — 5692 status.** L536/L579–582: Analyst 1 (recon inventory) reported 5692 as GREEN ("<1%"); the doc's own B.5 snapshot (L106, L111–113) records it RED at 4.6%/$230. The doc adjudicates **DOC WINS** (live `fn=portrecon` read = primary source), forcing B.75 to clear **TWO** REDs. This is a resolved contradiction, but it's load-bearing — any punchlist closing only ABBV leaves B.75 open. (Self-flagged honestly at L536, L582.)

2. **GATE 4 framing evolves across the night — three states stacked in one doc without retracting the earlier ones.** Earlier sections still read as if GATE 4 is a live CRITICAL needing a rewrite: L588 ("CRITICAL, violates the locked rule"), L621 ("MUTATES ACTION… CRITICAL"), L716 ("HIGHEST-VALUE OBJ-4 FIX — gate misV2BuildFSE GATE 3/4… the only fix that stops stale data MUTATING Action"), L778 ("P0 architecture fix… Until then the freeze holds"). These are **superseded** by the later traces (L783–839, L870) which REMOVE the GATE 4 rewrite from the critical path. The doc never strikes/marks the earlier P0/punchlist items as obsolete, so §6's punchlist item #4 (B.75 "gate GATE 3/4 behind qty-reconciliation") still reads as required engine work, while L839/L870 say the legacy rewrite is removed. **Risk: a reader landing on §6 (L716) would build the eliminated fix.** Reconciliation: the LATER appendices (timestamped ~9:25–9:40 PM, L846, L878) are authoritative; the GATE 4 rewrite is dissolved, C is the fix. Recommend the doc add a SUPERSEDED marker on §6 item B.75-#4.

3. **"0 of 20 flip" vs "CRITICAL mutation is real" — both true, reconciled by the doc but easy to misread.** L758/L768: tonight 0 names flip from stale ABBV (margin-of-threshold luck — SPY/ASML/META trip GATE 4 under both portTotals, ABBV never crosses 20%). L588/L597: "stale qty DOES mutate Action" as a CRITICAL. Not a true contradiction — the mechanism is unbounded/real but unrealized tonight (L768) — but the severity language ("CRITICAL") coexists with "0 realized flips," which could read as inconsistent.

4. **ASML is simultaneously "the case you should NOT add to" (latent) and "currently WATCH not ADD" (live).** L50–53 treats ASML as the Proposed-ADD-while-49%-overweight canonical case; L657 + L770–771 show ASML's LIVE legacy verdict is **WATCH** (via GATE 4 @23% portfolio overlap, not SACS), so the "ADD-while-overweight" tension is **latent, not active** right now. The doc flags this nuance (L657) — design target, not current live state — but the headline framing (L50) overstates it as live.

5. **SACS formula: documented vs actual.** L298–300 / L497–501: the entry-pad caption "SACS = Composite·0.3 + Flow·0.3 + RR·0.2 + Grade·0.2" is **COSMETIC AND WRONG**; actual SACS = `FlowStrength×0.5 + RS_SPY×25 + RS_Sector×25` (no Composite/Grade/RR). So "remove RR from SACS" (one of the 4 locked decisions, L380–381) is **moot** — SACS never used RR. The doc self-flags this (L501) but the "RR-as-constant → REMOVE from SACS" decision remains in the decisions list without a moot-marker.

### CALIBRATED-CONFIDENCE NOTES (unverified per the doc itself — §5, L691–702)
- **Every "live" recon/exposure number traces to the ONE B.5 snapshot, not a fresh fire** (L694) — `MIS_V2_TOKEN` is a Worker secret absent from repo; analysts reasoned from code + banked snapshot. Treat $22,135 / SPY54/ASML49/META46 as single-source-as-of-2026-06-04-PM.
- 5692 root cause, partial-fill Gmail subject line, D's CLOSED-branch gap, and the current count of stale HOLDINGS_CLEAN rows are all **code-reasoned, not observed** (L693–699).

**Source trail:** `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md` L1–906 (read in full, two pages). Freshest authoritative appendices = L846–906 (state machine + next-window instruction, ZW-ENGINE-V9 ~9:25–9:40 PM 2026-06-04). No endpoints fired, no files edited — read-only. Code anchors cited from within the doc (not independently re-traced this slice): `MIS/v2/Code.gs` `misV2BuildFSE` L295–348, `synthV2` L1885–1900, `misV2SurfaceConflictCheck_` L2692.

### Agent 2 MIS docs

I have everything I need. Let me compile the inventory.

## MIS Docs Inventory (agent slice 2 — all MIS/*.md + MIS/docs/*.md except the calibration module)

**Method:** Read every `.md` in the MIS tree (excluding `docs/MIS_SACS_CALIBRATION_MODULE.md` = agent 1, and the live `MIS-v1-script/` clasp project). 18 docs total. The `.docx` blueprints and `private_trading_engine_*.pdf` files in `docs/` are binary and not parsed (noted as legacy reference).

### Thesis numbers (the load-bearing answer)
**`MIS/MIS_INVESTMENT_THESIS.md`** (L1-109, dated 2026-05-21, **LIVING** — "scoring rubric for every MIS conversation"). Canonical thesis numbers:
- **Base capital:** $2M working / $4M total; **<$30K = practical floor**, **>$250K = bucket discipline becomes structural** (L18).
- **Monthly cash-flow target = 2.5%/mo** ($50K/mo on $2M = $600K/yr; compounds to **34.5% annualized**, L19/L85).
- **Hard drawdown stop = −20%** (position-level AND portfolio-level; "TBD which threshold sits where" — still unresolved, L20).
- **Reserve compounding:** 20–25% of upside stays in; 75–80% extracted to keep base static (L21).
- **Buckets:** A Working/Cash-flow ~50% (2.5%/mo extraction, tight trailing stops) · B Buffer/Swing ~25–30% (long-hold, looser stops, no monthly clock) · C Conviction/Long-hold ~20–25% (rides, clock doesn't apply). **Below $30K = all Bucket A** (L37-43).
- 5-question 30-second acceptance test (L69-79): hit 2.5%? · drawdown vs −20? · sector concentration? · what to trim? · bucket allocation vs target?
- Self-described as **cash-flow discipline machine, NOT a P&L tracker** — fully consistent with the canonical spec and `project_mis_cashflow_thesis` memory. **No contradictions found.** This matches the workspace task brief's thesis framing exactly.

### LIVING / current docs (trust these)
| Doc | Purpose | Load-bearing fact(s) |
|---|---|---|
| `docs/MIS_PUNCHLIST_2026-06-03.md` | Phase-1 verified punch-list, written from LIVE checks | **Freshest non-calibration status doc.** NVDA traced raw→FSE→gate→output; `fn=state` == `/mis/peek` (WATCH/37.09/C) → confirms single-source-of-truth holds. Deploy in use = v2 `@52` (has `refillmeta`). 🔴 B1 cost-basis/P&L broken (every ticker "$0.00"); B2 Schwab cost-basis txn-weighted bug (needs Sam's Positions CSV for 898+436). **Note: this doc cites deploy @52 while the scaling doc cites @55/56/57 — see contradiction below.** |
| `docs/MIS_SCALING_RESTRUCTURE_PLAN.md` | Execution spec to run BEFORE adding 250 tickers | v2 **breaks at ~200 tickers** (per-ticker `Date\|Close` tabs → past Google's ~200-tab cap). Fix = ONE long `Price_History` table + collapse 2 engines (Momentum_Engine + Trade_Planner) → 1 (retire Trade_Planner) → FSE only. Snapshot re-pricing ✅ DONE (`misV2RepriceHoldings_` @56). Hard safety gate: baseline verdicts → migrate on a COPY → diff → zero verdicts moved = pass. |
| `MIS/MIS_INVESTMENT_THESIS.md` | Scoring rubric (see above) | base/2.5%/−20%/buckets |
| `MIS/README.md` | Top-level pointer | Active code = **v11.0h** in `MIS-v1-script/emailDailySnapshot.js`; active sheet `1HEmRev...`; canonical arch = workspace `docs/MIS_FSE_ARCHITECTURE.md`. **Partly stale: README describes the v1/v11 Apps-Script-email era, not the current v2/Code.gs engine the task brief centers on.** |

### HISTORICAL / point-in-time (frozen, do not treat as current)
| Doc | Date | What it froze |
|---|---|---|
| `docs/GITHUB_ISSUES_TRIAGE_2026-05-12.md` | 2026-05-12 | Repo issue triage #3-#10; email-render visual work (BLUF, badges, holdings cards). v11.0g era. |
| `MIS/FINAL_STRUCTURE_RECOMMENDATION.md` | 2026-05-03 | Sheet/script/trigger keep-vs-kill plan; the A/B "Mon May 4 v1 vs production email" comparison. |
| `MIS/FOLDER_INVENTORY.md` | 2026-05-03 | Folder-by-type map; Schwab 898 seed (AFRM 15@$50.78, DAL 3@$63.76, MRVL 1@$91.94). |
| `docs/HOLDINGS_RECONCILIATION.md` | 2026-05-05 | **13 reconciled positions, $19,977 total**; named **6 phantoms** (AVGO/VOO/COST/SCHZ/KO/PYPL) not in any broker CSV. Pre-cursor to the recon work now live. |
| `docs/HOLDINGS_FIX_PASTE_INSTRUCTIONS.md` | 2026-05-06 | Manual paste of `Trade_Planner_Replacement.csv` into a `Trade_Log_Imported` tab. |
| `docs/RUN_3PM_POWER_HOUR_MANUAL.md` | 2026-05-06 | Manual-fire runbook for the v1/v11 3PM email (`misSendPowerHour300`). |
| `MIS/MIS_v7.1_full_audit_report.md` | 2026-05-04 | Excel-export audit: 59 tabs, 2,805 error cells, `ETF_Map=#REF!`, GOOGLEFINANCE non-portable to .xlsx. |
| `audits/MIS_Master_v11_0f_Forensic_Teardown.md` | ~May | **SECURITY:** Schwab CLIENT_ID/SECRET/REFRESH_TOKEN + Finnhub key in plaintext on KEY/VALUE tab — revoke/rotate/move to PropertiesService. |
| `audits/MIS_V11_Forensic_Teardown.md` | ~Apr/May | 5-gate engine (RiskGate_2.5 / GradeGate_AB / SACS_Gate_60 / FlowGate_75 / FinalGate); bad sectors (BTCUSD→Utilities); RR_13W blowups (AMGN 58M); STARTER firing with SACS_Gate=FALSE. |
| `audits/MIS_1F31z_Forensic_Teardown.md` | ~Apr/May | The 1F31z sheet is "dead" — all SACS/Flow/Setup = `#NAME?`. Confirmed phantom→dead branch retired. |
| `v2/MIS_V1_FORMULA_ARCHIVE.md` | (v2 folder) | Frozen v1 Snapshot/Momentum_Engine column→formula map (e.g., Snapshot!T = SACS = Momentum_Engine!AZ2). Useful as migration reference only. |
| `MIS/docs/MIS_v7.1_Production_Blueprint.md` | 2025-10-18 | Original 13-tab formula-only "Closed-Loop Alpha Engine" spec. **Genesis doc.** Reference_Rules: VIX 14/20/28/35, regime factors 1.2/1.0/0.8/0.6, Risk_Per_Trade 1%, Portfolio_Start $25K. |
| `MIS/docs/MIS_v5_Master_Deployment_Prompt.md` | 2025 | Earlier v5 of the same generator prompt. Superseded by v7.1. |
| `MIS/docs/MIS_SETUP_INSTRUCTIONS.md` | 2026-02-26 | 5-min install of the 20-tab formula-only build. |

### Stale / superseded flags & contradictions vs current state
1. **DEPLOY VERSION CONTRADICTION (medium-confidence, verify):** `MIS_PUNCHLIST_2026-06-03.md` L7 says deploy in use = v2 `@52`; `MIS_SCALING_RESTRUCTURE_PLAN.md` (also 2026-06-03) references `@55/@56/@57` as done. Both same day. Likely the punch-list was written earlier in the session and the scaling doc later — but neither is dated by hour, so the *current* live deploy version is not unambiguously stated in the docs. Resolve against `clasp deployments` / live `/mis/peek` before acting.
2. **`README.md` is era-stale (high confidence):** It documents the **v1/v11.0h Apps-Script email engine** (`MIS-v1-script/emailDailySnapshot.js`, 3-email/day schedule, `1HEmRev` sheet) as "current active code." The task brief's converged state is built on **v2/Code.gs** (FSE decomposed engine, `synthV2` L1885, `/mis/peek` Worker). README never mentions v2/Code.gs or the two-layer Engine/Portfolio architecture. It should point to the v2 engine + calibration module as current.
3. **`MIS_PUNCHLIST` L13 vs older state doc:** punch-list explicitly flags that the (separate) state doc row saying "`MIS_V2_URL`/`MIS_V2_TOKEN` NOT SET" is **STALE** — they ARE set. Self-documented staleness; trust the punch-list.
4. **`MIS_PUNCHLIST` S1:** doc references `fn=portfolio` which returns "unknown fn" — the doc itself flags this as stale (use `fn=risk/positions/state`). Consistent with the read-only fn list in the task brief (no `portfolio` fn).
5. **Phantom-holdings docs (HOLDINGS_RECONCILIATION, HOLDINGS_FIX, RUN_3PM) are HISTORICAL and partly superseded:** they describe the May v1 `Trade_Log_Imported` manual-paste fix. The current engine reconciles via `Portfolio_Reconciliation` (tonight's live A/B) and `HOLDINGS_CLEAN` (cols A=Ticker/B=Account/C=Qty/F=MktVal per task brief). The $19,977 reconciled total (2026-05-05) is now superseded by tonight's **real equity $22,135** (was $32K phantom). The old "$32K/$33,602 portfolio" figures in FINAL_STRUCTURE_RECOMMENDATION L76 and these recon docs are the **phantom-era numbers the task brief says were corrected** — do not propagate.
6. **No contradiction on architecture or thesis:** every doc that touches decision-truth (punch-list, scaling plan, thesis) agrees with the task brief: single-source FSE, two-layer Engine/Portfolio split, Portfolio layer never mutates Action, 2.5%/−20%/bucket thesis intact. The scaling plan's "retire Trade_Planner, collapse to one engine→FSE" is the structural expression of "two surfaces classifying one ticker is what FSE exists to kill" — fully aligned.
7. **SECURITY still possibly live:** plaintext Schwab/Finnhub creds flagged in `MIS_Master_v11_0f_Forensic_Teardown.md` were on the v1/production KEY-VALUE tab. Punch-list G6 says v2 creds are in "v2 Script Props (per doc ✅)" — so v2 is clean, but **unverified whether the old v1 plaintext creds were ever rotated/removed.** Worth a one-line confirm.

**Naming-convention note (per CLAUDE.md LIVING-vs-HISTORICAL rule):** `MIS_PUNCHLIST_2026-06-03.md` is dated but functions as the de-facto living status; once the v2 work stabilizes it should likely be promoted to an undated living `MIS_STATUS.md` or folded under the calibration module to avoid the README/punch-list/scaling-doc tri-fork that currently makes "what's the current deploy + engine" ambiguous.

### Agent 3 Workspace ctx

I have everything I need. The tonight's research artifact (`outputs/2026-06-04_19-57_research_mis-v2-analysis-sweep.md`) is a sibling analysis-mode sweep that largely corroborates the orchestrator's converged state — but it also surfaces important caveats (single-source numbers, unreconciled threshold). I'll fold these into my output as the freshest workspace record while flagging the staleness in the canonical living docs.

## Slice 3 — Workspace Context: MIS state as the workspace records it + open loops + disagreement flags

**Date anchored:** Thursday June 4 2026, 10:00 PM ET (19 Sivan 5786). Confirmed via `scripts/now.ps1` — the orchestrator's "tonight" = June 4.

### What the workspace records as MIS state (by recency tier)

**Tier 1 — FRESHEST & authoritative (matches tonight's converged state):**
- `docs/MIS_SYSTEM_STATE.md` (L2, "Last updated 2026-06-02 · Session 41 · written from verified code, not memory") is the canonical living MIS doc. It records the **three-piece architecture** consistent with the brief's two-layer lock: **v1 Brain** (183-ticker scoring engine, sheet `1HEmRev…`, script `1yBMztL4…`, **triggers KILLED 2026-06-02**, L13), **v2 Data Layer** (portfolio-truth, sheet `1N2v-MDDi…`, script `1KDEBYMFZ…`, L17-22), **ops-api Worker** (router/portal backend, L25-31). Explicitly: "Complementary, NOT redundant" (mirrors CONTEXT L63). Confidence: high — code-derived.
- `docs/CONTEXT.md` L57-71 (Session 41 close, 2026-06-02) — same v1/v2 truth; FSE 11-cap removed (`fn=extendrows`, MAXROW 12→40, scores all 20), sector blindness fixed (`fn=fillsectors`), Schwab OAuth ported into v2, peek overlay LIVE.

**Tier 2 — Tonight's analysis sweep (sibling artifact, READ-ONLY freeze, NOT yet in living docs):**
- `outputs/2026-06-04_19-57_research_mis-v2-analysis-sweep.md` (Generated June 4 7:57 PM, "Session 41 cont, ANALYSIS MODE, deploy freeze intact," L3). This is an **8-stream synthesis appendix to `MIS_SACS_CALIBRATION_MODULE.md`** and is the only workspace artifact that records tonight's recon/exposure/GATE work. It **corroborates the brief's converged state** but adds caveats the brief does not state — see "disagreements" below.

**Tier 3 — STALE (April-era; do NOT trust for current MIS state):**
- `docs/WORKSPACE_AUDIT.md` MIS rows are badly stale: L13 lists `MIS/` as "v11.0f code, FSE arch queued · Apr 28 `f27e839`"; L60-66 still references `MIS_v7.1_gsheet` / `Architect V11` / `MIS v8` / `v7.3` as the live/stale set — predates the entire v1/v2 reconciliation. The audit's "canonical map, use INSTEAD of re-searching" claim is **wrong for MIS** as of June. Flag for refresh.
- `docs/MIS_FSE_ARCHITECTURE.md`, `MIS_REVIEW_2026-04-27.md`, `MIS_AUDIT_2026-04-26.md`, `MIS_TAB_AUDIT_2026-04-28.md` — all April snapshots; useful for FSE bones only, not current state.

### Open MIS loops the workspace tracks (with bumpers)

From `docs/SCOPE_BACKLOG.md` (last updated May 28, Session 39 cont — itself pre-dates the recon work):
- **39c-1** Cost-basis CSV import — 11+ positions missing avg cost → Position Return % blank. Owner Sam, 5 min (Schwab/Fidelity CSV → `fn=importbroker`). **Still relevant** — ties to tonight's "Missing Cost Basis" recon category.
- **39c-5** Schwab live quotes never wired (7-day refresh-token pain) — deferred until live execution matters. **Note:** CONTEXT L23 ("Schwab activated" per commit `c0caf00`) and `MIS_SYSTEM_STATE.md` L44 ("v2 Schwab in Script Properties ✅") partially supersede this.
- **39c-6 / 9 / 14** Stage-14 self-learning loop (forward-return + decision IC) — needs 30+ FSE runs of history. Owner Claude.
- **L4b** (`SCOPE_BACKLOG` L132) **MIS Apps Script binding Option A/B/C still UNDECIDED** — flagged "🟠 OPEN" since May 5. **This is effectively resolved by the v1/v2 split** (v1 = brain, v2 = truth layer) but never struck through — stale open loop.
- From `MIS_SYSTEM_STATE.md` "ordered next-session build list" (L109-119): set `MIS_V2_URL`+`MIS_V2_TOKEN` on Worker (peek overlay dark until then), migrate v1 plaintext Schwab/Finnhub creds out of CONTROL tab (security P0), Flow-formula restore (still tristate 28/44/76 not continuous 0-100, L47), Worker `/mis/dashboard` render endpoint, build dashboard site from Stitch anchors.

### Where CONTEXT.md / living docs DISAGREE with the canonical spec (flags requested)

1. **`docs/CURRENT_STATE.md` is stale-but-self-flagged.** L1 header marks it "REFERENCE ONLY — last real update 2026-05-19, 11+ days stale, CONTEXT.md canonical." Its MIS lines (L28: "PORTFOLIO_OVERLAP gate shipped 5/15 but operates against 10-position view because paste didn't land") **directly contradicts** the spec's tonight finding that GATE 4 mutates Action via stale gross `mktValue`/`portTotal` ($32,173, no account filter) in the LEGACY engine. CURRENT_STATE thinks the gate is merely scoped to 10 positions; the spec/sweep says the deeper issue is contamination + the decomposed engine being clean. **Don't act on CURRENT_STATE for MIS — it predates the recon work by ~2 weeks.**

2. **`MIS_SYSTEM_STATE.md` (June 2) does not yet record the A/B recon or per-account exposure work, the GATE-4 contamination finding, the $22,135 real-equity correction (vs $32K phantom), or the freeze.** That work exists ONLY in tonight's sweep output + the calibration module — it has NOT been propagated into the canonical living MIS doc. So the "definitive system state" doc is **one session behind the spec.** This is a propagation gap (the recurring "skills/docs are a propagation target" lesson, `feedback_verify_before_propagating`).

3. **The sweep itself flags that the spec's "LIVE" recon numbers are single-source (NOT independently verified).** `outputs/2026-06-04_19-57…md` L177-178: "No analyst re-fired the live endpoints. `MIS_V2_TOKEN` is a Worker secret absent from repo… Every 'live' recon/exposure number traces to the one B.5 snapshot, not a fresh fire." It also notes (L63-65) an **internal contradiction in the spec's own appendices**: Obj-1 calls 5692 Joint "GREEN, ≈0 diff <1%" while calibration B.5 (L106-113) calls it "RED, 4.6%, $230 gap." **→ Treat the brief's "$22,135 LIVE / TWO recon REDs (600 + 5692)" as code-inferred from a banked snapshot, not a fresh live read.** Mark UNVERIFIED until someone re-fires `fn=portrecon` with the token.

4. **The recon dollar-floor threshold is UNRECONCILED in the workspace** (sweep L183): Obj-1 says ~$50, calibration doc L123 says $250–$500. The brief states "RED threshold is relative-only (design flaw: small accts trip on noise)" but does **not** record that the absolute-floor fix number is still open and needs Sam's sign-off (it changes a portfolio-level gate). Open decision, no bumper assigned.

5. **2.5%/mo extraction clock + −20% hard stop are NOT in `MIS/v2/Code.gs`** (sweep L130) — they live in v1 `emailDailySnapshot.js`. The only active-book thresholds in v2 are GATE 6 (R:R≥2.5) and GATE 4 (20% overlap cap). The sweep pre-flags a risk the brief doesn't: wiring C displays could wrongly apply the 2.5%/mo clock to the Fidelity GROWTH/PRESERVE books — **guard before Gate C, not after.**

### Net read for the orchestrator
The workspace's **living MIS state (`MIS_SYSTEM_STATE.md` + CONTEXT.md Session 41) corroborates the brief's architecture** (v1 brain / v2 truth / ops-api router; two-layer Engine-vs-Portfolio lock; Schwab in v2 Script Properties; triggers killed). The brief's **tonight-specific deltas (A/B recon LIVE, $22,135 equity, GATE-4 contamination = legacy-only, locked B.75→C→D order, freeze) are recorded ONLY in tonight's sweep artifact and the calibration module — NOT yet propagated to the canonical living docs**, and the sweep itself marks the recon dollar figures as single-source/unverified with one unresolved internal RED/GREEN contradiction on account 5692. Stale traps to avoid: `WORKSPACE_AUDIT.md` MIS rows (April), `CURRENT_STATE.md` (self-flagged stale), and the never-struck `SCOPE_BACKLOG` L4b A/B/C decision.

**Files cited (all absolute):**
- `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\docs\MIS_SYSTEM_STATE.md` (canonical living, June 2)
- `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\docs\CONTEXT.md` (L57-71 Session 41; no recon/GATE-4 entry)
- `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\outputs\2026-06-04_19-57_research_mis-v2-analysis-sweep.md` (tonight's sweep — the only workspace home for the recon/exposure/GATE-4 work; L63-65, L130, L177-184)
- `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\docs\CURRENT_STATE.md` (STALE, self-flagged; L28 contradicts spec)
- `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\docs\WORKSPACE_AUDIT.md` (STALE MIS rows, L13/L60-66 — needs refresh)
- `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\docs\SCOPE_BACKLOG.md` (open loops 39c-1/5/6, L4b A/B/C undecided)
- `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\docs\MIS_V2_GAP_ANALYSIS.md` / `MIS_V2_LOGIC_CAPTURE.md` / `MIS_V2_200_TICKER_PREP.md` / `MIS_V2_SETUP_AND_KEYS.md` (May 28-29 build docs — not flagged in the orchestrator's KEY LOCATIONS, which listed only MIS/docs/)

### Agent 4 Outputs

I now have full context across the chronology. I have everything needed for my slice. Writing the final output.

## Slice 4 — Output Artifacts Inventory (MIS-related)

**Scope verified:** I read the full `outputs/` listing (Glob silently failed on case/path — used `ls | grep` instead; flag for the file-tooling note). 28 MIS-tagged HTML/MD artifacts span 2026-04-24 → 2026-06-04, plus 9 MIS PNG icons and `peek.html`. Confidence: HIGH on the 5 most recent (read in full or near-full); MEDIUM on older ones (read headers + headlines, classified by chronology + supersession logic).

### A. The artifacts that are still load-bearing (read these; ignore the rest)

| File | Date / kind | STILL-RELEVANT conclusions | STALE / superseded |
|---|---|---|---|
| **`2026-06-04_19-57_research_mis-v2-analysis-sweep.md`** | 6/04 research (9-agent sweep, 668 lines; I read L1–368 in full, 369–668 are raw pre-synthesis already rolled into the synthesis) | **THE freshest canonical artifact.** Still-true: TWO recon REDs not one (600 ABBV pending-sale + **5692 Joint $230/4.6% — doc wins over analyst-1's "GREEN", `MIS_SACS_CALIBRATION_MODULE.md` L106**); GATE 3/4 `misV2BuildFSE` L304–333 builds `heldMap` with **zero account filter** = the single CRITICAL (stale qty CAN mutate Action in the *engine* layer, even though the *display* layer is clean — both Obj4 & Obj8 reconciled); asOf freshness stamp written (col J `email-EOD`) but **never read** by any consumer; recon RED gate is relative-only (>3%) with **no $-floor** → micro/kid accounts trip RED on $16–$39 noise; locked punchlist **B.5→B.75→C→D**; `HOLDINGS_CLEAN` cols A=Ticker B=Account **C=Shares(=Qty) F=MktVal** (task's map confirmed). | Nothing stale yet (most recent). Its own §5 lists 9 self-flagged UNVERIFIED items — chiefly the 5692 root cause (no screenshot pulled), the recon $-floor threshold (Obj1 $50 vs doc $250–500, unreconciled), and that **no analyst re-fired live endpoints** (`MIS_V2_TOKEN` absent from repo — every "live" number traces to one banked B.5 snapshot). |
| **`2026-06-03_19-47_audit_mis-v2-foundation.html`** | 6/03 audit (the "foundation must be amazing" gate; report-only, no fixes) | **The big-three foundation problems, mostly still open:** (1) SACS mis-calibrated LOW — modal verdict GRADE_FAIL (8/20), top score SOXX 55, megacaps graded D (AMZN 0.02, META 3.56); **root cause = 10 of 20 Reference_Rules weight dials below the locked floor of 12** ("dial corruption"), `fn=resetweights` restores defaults. Held for Step-4d. (2) P&L covers only 14 of ~28 positions (cost-basis join too narrow) = M1. (3) **Plan-assumption corrected: the RiskGate-on-Risk%≤2.5% theory was WRONG** — gate keys on broken SACS/grade, not risk. Mechanical fix-list M1–M7 + verdict-mover list. | The "Schwab active book absent" framing (issue #3) is partly **superseded** by the 6/04 sweep's cleaner account model (898/1241/4436 ACTIVE cash, Fidelity NOT Plaid-connected). Account-241-cash-line question is older noise. |
| **`2026-06-03_08-00_audit_mis-20-ticker-fix.html`** | 6/03 audit + FIX (the only artifact that **applied** a fix, not read-only) | **Still true & DONE:** the 15 post-pilot tickers (added 5/28) were appended as bare symbols missing `buildTickers_` GF formulas → blank Name/Price/Beta/Sector cascaded downstream. Fix = `misV2RefillMeta_` (`fn=refillmeta`, additive/idempotent), **deployed live v2 @52**, crosscheck now 20 OK. Remaining polish list (COST stale earnings date, SACS_BIG Excel-serial date format, EARNINGS_DEPTH only covers INTC+NVDA, "Communication Services" ETF unmapped, Decisions-tab 9 junk NVDA rows). | The 9-junk-NVDA-rows = the same M2 Decision_Log test-burst the 6/03_19-47 audit also flags (dedupe these two when actioning). The blank-sector item overlaps M7. |
| **`2026-06-03_02-10_audit_mis-v2-state-institutional-rerun.html`** & **`2026-06-02_14-24_briefing_mis-v2-state-ken-griffin-audit.html`** | 6/02–6/03 institutional audit | Still-relevant baseline of the *same* foundation issues at an earlier hour: FSE built **11/20** (9 missing on blank sector/price), 3 lethal SACS bugs fixed (ATR floor, risk gate, divide-by-zero), all v1 auto-email **triggers KILLED** (no more stale sends), **peek.html + home MIS tile LIVE** with real FSE verdicts/cost/P&L. | **Superseded by 6/03 fixes:** "FSE 11/20, 9 missing" → the 20-ticker-fix audit raised it to 20 OK; "Position costs cost=$0 ❌" → still open but now tracked as M1/HOLDINGS join. Read these only for trigger-kill confirmation; the foundation audit + sweep supersede the rest. |
| **`2026-05-31_13-20_audit_mis-v1-v2-full-review.html`** | 5/31 audit | Still-relevant structural truth: **v1 = daily Morning Brief/Trade Action/Power Hour emails; v2 = Web App dashboard + Scope — different purposes, not duplicates.** Schwab-API bug (was reading CONTROL tab only → now falls back to Script Properties) FIXED locally. Phantom-tab cleanup list (feeds M4/M5). | "You have IBKR — changes my recommendation" is an aside not carried forward. Equity figures here predate the $32K→$22,135 correction (6/04) — treat any dollar amounts as STALE. |

### B. Older MIS outputs — context only, do NOT act from

`2026-05-29` status-report/compact, `2026-05-28` stage-20-roadmap, `2026-05-26` 10-day-emails review, the `2026-05-19/20` deepdive cluster, `2026-05-14` holdings/pickup, `2026-05-13` portfolio-thesis, `2026-05-08` deep-review, `2026-05-04` power-hour, `2026-05-03` ecosystem-map/control-panel, `2026-04-24/27/29` proposal/v11-handoff/prep — all are **pre-engine-decomposition** and pre-account-reconciliation. Their architecture framing (v11.0e/f surface-fix era) is explicitly superseded by `MIS_FSE_ARCHITECTURE.md` and the 6/04 two-layer lock. Mine only for historical "how we got here," never for current state or dollar figures.

### C. Which mockups anchor the C / dashboard design

**Finding: NO Stitch-generated mockup anchors the C/dashboard design.** Stitch (stitch.withgoogle.com, Daniel Teitelbaum's rec) is **still at evaluation stage only** — referenced in `outputs/stack-map.html` and `outputs/2026-05-29_16-00_primer_other-claude-session-handoff.md` (L74: "If Sam wants to integrate, he generates an API key + MCP config"), and parked in memory `project_stitch_mcp_evaluation`. It has produced zero screens for MIS. (Stitch tools ARE now wired as deferred MCP tools per the tool list, but no MIS artifact references generated output.)

**What actually anchors the C/dashboard design** (all hand-coded HTML, house dark-navy + gold style):
1. **`outputs/peek.html`** = the live **Scope** page — the canonical surface for the C "Legacy | Proposed" migration display. The 6/04 sweep §4 targets it by exact line: the `.hld` block (peek.html L341–371) is the only C surface needing a read-only Apps Script change (`peekoverlay` L2890 must emit `verdict_legacy`+`proposed_rc`+`exposure_pct`+`conc`+`mandate`). **This is the design anchor for Gate C / dashboard.**
2. **`2026-05-27_17-50_dashboard_mis-v2.html`** (the 4th/latest of four same-day iterations: 16-34, 17-10, 17-30, **17-50**) = the visual mockup the live dashboard is built from — THE MARKET strip, per-ticker verdict cards (ADD/REJECTED pills, ~130-day sparkline SVG, 3d/10d/30d momentum chips, stop/target/R:R, range bar), SECTORS-today bars. The 17-50 file is the canonical one; the earlier three are superseded iterations of the same hour.
3. **`2026-05-03_14-15_master-summary_mis-control-panel.html`** = the earlier "control panel" concept, now superseded by peek.html + the 5/27 dashboard but useful for the original information-architecture intent.

The C-UI layouts in the 6/04 sweep §4 (Telegram / Test Entry / Scope two-cell `LEGACY|PROPOSED` strip) are **design-ready specs against peek.html + the 5/27 dashboard**, not against any Stitch output.

### Flag for the orchestrator
- **Tooling:** `Glob "outputs/**/*mis*"` returned nothing despite 28 matches — case-insensitivity/path issue on this OneDrive mount. Fall back to `ls | grep` for outputs/ discovery.
- **Dedup target when actioning:** the junk NVDA Decision/Decisions rows appear in BOTH 6/03 audits (M2 in foundation + "delete rows" in 20-ticker) — one fix closes both.
- **#1 open verification across all artifacts:** the 5692 Joint RED root cause — no screenshot has ever been pulled; analyst-1 got it wrong (called GREEN); blocks B.75.

### Agent 5 Code arch

I have everything needed. Confirming the key architecture claims and writing the function map.

## Code architecture: MIS/v2/Code.gs function map

File: `MIS/v2/Code.gs` — 2,946 lines, single Apps Script module. Confidence high (read directly); live-endpoint behavior not re-run, so runtime values are unverified.

### Top-level config (L1–20)
- `SEED_TICKERS` (L8), `ETF_MAP` sector→ETF (L16), `MAXROW=40` (L19). `misV2HistColMap_` (L139) and `misV2HistMapLong_` (L166) are the History-tab column registries the decomposed scores depend on.

### Tab builders / setup (L21–294)
Pure scaffolding: `getOrClear_`, `writeFormulaTab_`, `buildReferenceRules_/Tickers_/SectorMap_/CatalystEngine_/DailySnapshot_/MarketTab_/HistoryTab_/SectorsTab_/SupportTabs_`, plus `misV2ExtendRows_`, `misV2Cleanup_`, `setupMisV2` (L284, the master scaffolder). Consume hard-coded seeds + sheet structure; produce/clear tabs.

### ENGINE 1 — Legacy gate cascade: `misV2BuildFSE` (L295–358)
**This is the production verdict engine.** Reads `Snapshot` (per-ticker columns) + `HOLDINGS_CLEAN` + wash map; writes `FINAL_STATE_ENGINE` (15 cols) and appends `FINAL_STATE_HISTORY`.
- Builds `heldMap` (L304–309: qty/avgPrice/mktValue per held ticker, excluding cash-likes) and **`portTotal` = sum of held mktValue, NO account filter** (L311). This is the contaminated denominator.
- Per-ticker gate cascade (input set per row, L316–320): `Ticker, Price, DataQuality, EarnFlag, DayChg%, Grade, SACS, Setup, ActionFlag, FinalGate, SACS_Gate_60, Stop_1.3xATR, Target_Price, RR_Ratio, Shares_1pct, %From52WH`.

**GATE confirmation (your slice's core question):**
- **GATE 3 (L330–331)** HELD_LOSS → REDUCE. Inputs: `heldMap[tU].avgPrice` + live `price` (held + price < 92% of avg cost).
- **GATE 4 (L332–333)** PORTFOLIO_OVERLAP → WATCH. Inputs: `heldMap[tU].mktValue / portTotal >= 0.20`. **Confirmed: this mutates the Action (→WATCH) off the unfiltered gross `mktValue/portTotal`** ($32,173-class gross, no per-account scoping). This is the contamination you flagged — and it lives ONLY in this legacy engine.
- Remaining gates: G0 WASH (L323–325), G1 DATA_STALE (L327), G2 SHOCK ±7% (L329), G5 EARNINGS (L335), G6 RISK_FAIL R:R<2.5 (L337), G9 EXTENDED ≥−8% of 52wH (L339), G7-8 final/SACS/grade cascade (L341–344), then the LIVE-quote downgrade ADD→STARTER (L346–347).

### ENGINE 2 — Decomposed / shadow: `misV2ComputeShadow_` (L1794–1845) → `misV2ProposedState_`/`synthV2` (L1869–1920)
- `misV2ComputeShadow_` reads `Momentum_Engine` + long price history (`misV2HistMapLong_`) + `Tickers` beta + a **read-only join of `FINAL_STATE_ENGINE`** (L1801–1802, pulls sacs/grade/state only). Produces per-ticker `{q1, dur, trend, setup, f52, accel, state, grade, sacs, issues}` — percentile-ranked blends (Durability L1835, Trend L1836, Q_v1_RS L1834). No Action.
- `misV2ProposedState_` (L1869) builds a `held` boolean map from `HOLDINGS_CLEAN` cols A/C (ticker, qty>0; L1872) and runs `synthV2`.
- **`synthV2(o, isHeld)` (L1885–1900): CONFIRMED input set = the three banded scores `dur/trend/setup` + `o.f52` (nearHigh) + `o.accel` (weakening) + the `isHeld` BOOLEAN.** It never reads mktValue, portTotal, weight%, or any dollar figure — ownership enters only as a boolean branch (held vocab {ADD,HOLD,EXIT,TRIM} vs not-held {ADD,STARTER,WATCH,REJECTED}). **This corroborates tonight's converged finding: the decomposed engine is portfolio-dollar-clean; the GATE-4 contamination cannot reach it.** `runProposedState`/`fn=proposedstate` (L2833) is shadow-only — does not write FINAL_STATE_ENGINE.
- `misV2ShadowScores_` (L1846) / `fn=shadowscores` (L2832) — diagnostic correlation + leader-basket dump over the same `misV2ComputeShadow_` output.

### Readers off FINAL_STATE_ENGINE (the surfaces)
All read the legacy engine's verdict, none re-classify: `misV2State_` (L693, `fn=state`), `misV2Shortlist_` (L1366, filters ADD/STARTER, `fn=shortlist`), `misV2UniverseHtml_` (L2724, `fn=universe`), `misV2Dashboard_` (L1288, `fn=dashboard`), `misV2SignalViewHtml_` (L2653), `misV2EntryPad_` (L704, the trade ticket). `peekoverlay` (L2882) reads FSE row directly for the Worker's Scope card.

### Portfolio layer — recon / exposure / metrics (NEVER mutate Action)
- `PORTFOLIO_CONTROL_` (L1980): hard-coded control table — 5 accounts with mandate/cash/margin/netEquity (600 Fidelity GROWTH margin −$11,131.76 / 5692 Joint PRESERVE / 4073 / 5378 kids / 898 Schwab ACTIVE). Real NET equity source.
- `misV2GrossByAccount_` (L1988): sums `HOLDINGS_CLEAN` MV by account (regex last-3/4).
- `misV2PortfolioRecon_` (L1995) → `misV2PortfolioReconText_` (L2011, `fn=portrecon`) / `misV2BuildPortfolioReconTab_` (L2016, `fn=buildportrecon`). **RED/YELLOW/GREEN on relative `diffPct` only** (>3% RED, >1% YELLOW; L2001) — confirms your "relative-only, small accounts trip on noise" design flaw.
- `misV2Exposure_` (L2031, `fn=exposure`): position MV / account NET equity; `⚠CONC` at ≥25%. Header explicitly: "WARNING only, does NOT change Action" (L2045).
- `misV2PortfolioMetrics_` (L2141, `fn=portmetrics`), risk stack `misV2RiskMetrics_`/`PortRisk_`/`VaR_`/`MonteCarloVaR_`/`StressTest_`/`Backtest_` (L1466–1568, `fn=risk/mcvar/stress/backtest/btnet/factors`).

### Health / integrity / conflict
- `misV2SystemHealth_` (L1924, `fn=health`) — RED/YELLOW rollup, pre-250 observability gate.
- `misV2Integrity_` (L2703, `fn=integrity`) — 5 checks → Integrity_Check tab.
- **`misV2SurfaceConflictCheck_` (L2692, the L2692 you cited)** — compares `FINAL_STATE_ENGINE.state` vs `Snapshot.FinalState` per ticker, logs mismatches to SURFACE_CONFLICT_CHECK; called at end of `misV2BuildFSE` (L354) and returns conflict count. This is the extension point named in your locked order (C: extend it for the Legacy/Proposed coherence DoD).

### Data ingestion / quotes / triggers
Finnhub (`misV2RefreshFinnhub_` L975, `fn=finnhub`), Schwab OAuth+quotes (L1630–1725, `fn=schwab*`), holdings import/reprice/joincost (L1107–1222, `fn=loadholdings/reprice/joincost/holdings`), broker CSV (L2245, `fn=importbroker`), cost basis (L2222–2302, `fn=setcost/loadcosts/costs`), wash-sale (L644–668, `fn=washsale/washlist`), snapshot capture (L2323, `fn=snapshot`), triggers (`setupAllTriggers` L617, `fn=triggers`), brief/pulse/movers (L546–616, L2051–2075, `fn=brief/briefpush/pulse/gaps/topmovers/moverspush`).

### Endpoint dispatch — `doGet(e)` (L2744–2946)
Token-gated (`RUN_TOKEN`, L2746–2748). `p.view==='1'` path renders HTML for dashboard/entry/decide (L2751). Otherwise a long `fn=` if/else chain (L2757–2943) dispatching ~80 functions; unknown fn → "unknown fn" (L2943); try/catch wraps all (L2944). Your diagnostic set maps cleanly: `state`(L2760), `health`(L2835), `holdings`(L2780), `exposure`(L2840), `portrecon`(L2838), `shadowscores`(L2832), `proposedstate`(L2833), `market`(L2771), `sectors`(L2773), `peekoverlay`(L2882). Note: there is **no `fn=portmetrics` alias bug** — it is `portmetrics` at L2794 and `portrecon` at L2838 (distinct).

### Architecture verdict (no reopen warranted)
Two-layer split is real and enforced in code: the **only** place portfolio dollars touch a verdict is legacy GATE 4 (L333). The decomposed `synthV2` (L1885) is proven boolean-only on ownership. The clean migration path (promote `misV2ProposedState_` via the `misV2SurfaceConflictCheck_` coherence layer, L2692) is structurally available without an engine rewrite — consistent with tonight's locked "C is the fix, GATE-4 rewrite eliminated."

### Agent 6 Surfaces

I have full confirmation. The peekoverlay (Scope's verdict source) reads **FSE column 7** (legacy engine). EntryPad reads **Snapshot.FinalState** (also legacy). Neither consumes synthV2. Now I have everything to write the surface map.

## 6. Surfaces — Verdict-Source Map (C migration scope)

Every operator surface reads the **legacy engine verdict** today. The decomposed engine (`synthV2`) is computed only inside one shadow report and is wired to **zero** operator surfaces. This is the core finding: C is a *display promotion* job, surface by surface.

### Verdict-source taxonomy (two legacy producers + one orphan)

| Producer | Where it's written | What consumes it |
|---|---|---|
| **Legacy FSE** = `misV2BuildFSE()` 9-gate cascade, written to `FINAL_STATE_ENGINE` col 7 (`Code.gs` L295–348) | tab `FINAL_STATE_ENGINE` | Telegram brief, Scope/peek, Shortlist, Dashboard, Universe table |
| **Snapshot.FinalState** (legacy too — Snapshot's own gate column, distinct sheet from FSE; this divergence is exactly what `misV2SurfaceConflictCheck_` L2692 logs) | `Snapshot` tab col `FinalState` | Test Entry pad ONLY |
| **`synthV2`** = decomposed/position-aware engine (`Code.gs` L1885) | nowhere persisted — lives inside `misV2ProposedState_()` L1869, returned as a text blob via `fn=shadowscores` | **no operator surface** (orphan) |

Unverified: I did not confirm at runtime that `Snapshot.FinalState` and `FINAL_STATE_ENGINE` col 7 actually diverge today — but the existence of `misV2SurfaceConflictCheck_` (L2692, appends every mismatch to `SURFACE_CONFLICT_CHECK`) and `verifyMisV2`'s contradiction loop (L368–370) prove the system *expects* them to diverge. That's the dual-legacy-producer risk C must close.

### Surface-by-surface

**1. Telegram brief — `misV2DailyBrief_(detail)` (`Code.gs` L580; pushed by `misV2BriefAndNotify_` L605; triggers 7AM + 4:15PM L613-614; HTTP `fn=brief`/`fn=briefpush` L2928/2933)**
- Reads: `FINAL_STATE_ENGINE` col 7, filtered to `ADD`/`STARTER`, sorted by SACS (L586). Plus BLUF breadth count off the same col 7 (L594).
- Verdict shown: **legacy FSE**.
- C must change: shortlist + breadth lines must read the promoted Proposed/Legacy verdict, and the brief should carry a MIGRATION_MODE marker so Sam can tell which engine produced the picks. Cache caveat: brief is served from a 1-hour warm cache (`misV2Cached_('brief:'+dt,3600,...)` L2932) — C's display change won't show until cache expiry or `fresh=1`; pair the swap with cache invalidation (this is exactly the `feedback_cache_invalidation_on_deploy` trap).

**2. Test Entry / Entry Pad — `misV2EntryPad_(sym,opts)` (`Code.gs` L704; HTTP `fn=entry&view=1` L2753/2781; linked from Scope's "Set up Trade →" button, peek.html L465)**
- Reads: `fs=g('FinalState')` (L719) = **Snapshot.FinalState**, NOT FSE col 7. This is the one surface on the *other* legacy producer.
- Verdict shown: **legacy Snapshot.FinalState** — drives the verdict pill color (L742), the coherent "why" narrative (L803-812), "THE READ" (L816), and the behavioral gut-check (L824+).
- C must change: highest-priority coherence target. The 9-point coherence DoD has to reconcile EntryPad (Snapshot.FinalState) against the same verdict every other surface shows (FSE col 7). If C promotes the clean Proposed verdict only into FSE col 7, EntryPad would still show stale Snapshot.FinalState and *visibly contradict* Scope for the same ticker. EntryPad must be repointed to the promoted verdict, and `misV2SurfaceConflictCheck_` (L2692) should be extended to cover this Snapshot-vs-promoted axis (matches the locked instruction "extend `misV2SurfaceConflictCheck_` L2692").

**3. Scope / peek — `peek.html` → Worker `/mis/peek` (`ops-api/src/index.ts` L600/617) → MIS `fn=peekoverlay` (`Code.gs` L2882)**
- Reads: `peekoverlay` pulls verdict from `FINAL_STATE_ENGINE` col 7 (`ov.verdict=fd[j][7]`, L2890) plus the col 8–14 trade plan (setup/stop/target/rr/shares/reject_code). Worker passes it through as `universe.verdict` (index.ts L829); peek.html renders it as the held-position pill (`u.verdict`, peek.html L334-339) and speaks it via TTS ("MIS verdict: …", L382).
- Verdict shown: **legacy FSE** (col 7).
- C must change: once FSE col 7 carries the promoted verdict, Scope inherits it for free — but peek.html hard-codes a `NOT FSE` disclaimer in the header (peek.html L103) and the Worker may cache `/mis/peek`. The "Set up Trade →" link (L465) jumps to EntryPad which is on the *other* producer, so Scope→EntryPad is the visible cross-surface contradiction C must eliminate.

**4. Shortlist — `misV2Shortlist_(maxN,maxPerSector)` (`Code.gs` L1366; HTML twin `misV2ShortlistHtml_` L1380 used in Dashboard; HTTP `fn=shortlist` L2936)**
- Reads: `FINAL_STATE_ENGINE` col 7, keeps only `ADD`/`STARTER` (L1373), sorts by SACS desc (L1375), caps per sector (L1377), drops `Pre-Earnings` (L1377).
- Verdict shown: **legacy FSE**.
- **ASML-dropped symptom — CONFIRMED by mechanism (not by live run).** Three independent filters can silently drop ASML: (a) the `ADD`/`STARTER`-only gate (L1373) — if ASML's FSE col 7 is WATCH/EXTENDED/PORTFOLIO_OVERLAP it never enters the candidate pool; (b) the per-sector cap `maxPerSector=2` (L1377) — if two higher-SACS semis (e.g. NVDA, AVGO) precede it, ASML is capped out of its own sector; (c) the `earn==='Pre-Earnings'` skip (L1377). Most likely culprit given the locked context: ASML is held, and GATE 9 EXTENDED (L339, `%From52WH ≥ -0.08`) or the legacy GATE-4 PORTFOLIO_OVERLAP (L333, the contaminated gross-mktValue gate) flips it to WATCH → it's excluded from the `ADD`/`STARTER` candidate set → dropped from shortlist. This is precisely the legacy-engine contamination C is meant to cure: under the clean decomposed engine ASML would carry its own decomposed verdict instead of being silenced by a portfolio-layer gate that mutated Action. *Unverified at runtime — I did not call `fn=shortlist`/`fn=state` to read ASML's current col 7; confirm by checking ASML's row in `FINAL_STATE_ENGINE`.*
- C must change: shortlist candidate filter must run off the promoted verdict; if Proposed adds `HOLD`/`TRIM`/`EXIT` vocabulary (synthV2 L1888-1893), the `ADD`/`STARTER`-only filter (L1373) needs a deliberate mapping decision so held names like ASML aren't auto-excluded.

**5. Dashboard / Universe table — `misV2Dashboard_` (composes BLUF L1419 + Shortlist L1352 + `misV2UniverseHtml_` L2724); HTTP `fn=dashboard&view=1` L2753**
- Reads: BLUF breadth (L1426-1428), Universe table (L2727 col 7), and embedded Shortlist — all `FINAL_STATE_ENGINE` col 7.
- Verdict shown: **legacy FSE**.
- C must change: per locked order, Dashboard is BLOCKED (scale/dashboard frozen). It inherits the promoted verdict once FSE col 7 is promoted, so no separate C work — but it's the largest blast radius, which is why it's gated behind C's coherence DoD.

### One-line answer to "what C must change"
C is a **verdict-promotion + coherence** job, not a re-architecture: promote the proven-clean decomposed verdict into the **two** places surfaces actually read (`FINAL_STATE_ENGINE` col 7 → feeds brief/Scope/shortlist/dashboard; `Snapshot.FinalState` → feeds EntryPad), display a MIGRATION_MODE Legacy-vs-Proposed marker, extend `misV2SurfaceConflictCheck_` (L2692) to police *both* legacy producers against the promoted verdict, enforce the 9-point coherence DoD with no silent FSE fallback, and pair every swap with cache invalidation (brief warm-cache L2932, Worker `/mis/peek`). `synthV2` (L1885) is computed today but consumed by nothing — C is what wires it to glass.

Files cited: `MIS/v2/Code.gs` (L295-348 legacy FSE, L580-604 brief, L704-727+L803-812 EntryPad, L1366-1384 shortlist, L1419-1436 BLUF, L1869-1918 synthV2/Proposed, L2692-2700 conflict check, L2724-2739 universe, L2882-2916 peekoverlay) · `outputs/peek.html` (L103 NOT-FSE disclaimer, L334-382 verdict render+TTS, L465 Set-up-Trade link) · `ops-api/src/index.ts` (L600-617 /mis/peek route, L828-829 universe verdict passthrough).

### Agent 7 Portfolio truth

Everything is confirmed against primary sources. Note one discrepancy worth flagging: live holdings shows 600 ABBV at 17sh / $3,729 (matching the gross $27,193), confirming the stale count is still live. I have enough to write the slice.

## 7. Portfolio Truth — Holdings / Reconciliation / Exposure / Margin / Mandates

**Verdict up front:** The portfolio layer is structurally sound and the NET-equity number is now trustworthy ($22,135 real, not the $32K phantom). What is NOT trustworthy: the RED/YELLOW recon flags themselves are noisy on small accounts (relative-only threshold), and per-account holdings freshness is stale on two Fidelity accounts. Margin is hard-coded in a control array, not live.

### The data spine (all read-only verified)
- **Source of truth split (locked):** `PORTFOLIO_CONTROL_` array, `Code.gs:1980-1987` — a 5-row hard-coded control table `[acct, broker, mandate, cash, marginDebit(neg), netEquity, source]`. NET equity for every portfolio-level surface comes from here, NOT from gross `HOLDINGS_CLEAN` sums. Seeded from "Fidelity screenshot 2026-06-04" + "Plaid-live 2026-06-04" (per-row `src`).
- **Gross by account:** `misV2GrossByAccount_` `Code.gs:1988-1994` — sums `HOLDINGS_CLEAN` col F (MktVal) grouped by last-3/4-digit account (col B, regex-stripped to digits). Confirmed cols A=Ticker, B=Account, C=Qty, F=MktVal (matches slice header).
- **Recon engine:** `misV2PortfolioRecon_` `Code.gs:1995-2010` — for each control row: `misNet = grossMV + cash + margin(neg)`; `diffPct = |misNet − ctrlNet| / |ctrlNet|`; status `>3% RED / >1% YELLOW / else GREEN`. Rollup `reconStatus` = worst single account. **Total NET = sum of control `netEquity`, NOT MIS-calc** (so the headline $22,135 is broker-truth, immune to stale holdings).

### The 2 REDs — CONFIRMED live (`fn=portrecon`, fetched this session)
```
NET EQUITY (real): $22,135 | Cash: $1,897 | rollup = RED
600  Fidelity GROWTH  gross $27,193  margin −$11,132 → NET $14,002 (MIS-calc $16,061, 14.7% RED)
5692 Fidelity PRESERVE gross $4,656  cash $541       → NET $4,967  (MIS-calc $5,197,  4.6%  RED)
4073 Fidelity KID(son)                               → NET $1,289  (1.4% YELLOW)
5378 Fidelity KID(dtr)                               → NET $523    (2.0% YELLOW)
898  Schwab   ACTIVE                                 → NET $1,355   (0.0% GREEN)
```
- **600 RED (14.7%, ~$2,059 gap):** stale ABBV. Live `fn=holdings` shows `600 ABBV 17sh $3,729` — the partial sale (17→7sh ≈ $2,154) is NOT yet reflected in HOLDINGS_CLEAN. Class = **Pending/Settling Trade / data-freshness**, NOT a valuation or engine fault. Confirmed in spec `MIS_SACS_CALIBRATION_MODULE.md:88,112`.
- **5692 Joint RED (4.6%, ~$230 gap):** a *second*, smaller freshness case. Spec (`:113,119`) flags root cause as TBD — stale price vs stale holdings — likely control-side stale price per the slice. Unverified which; the freshness sweep (B.75) is meant to classify it.

### Relative-only-threshold flaw — CONFIRMED (this is a real design defect)
`Code.gs:2000-2001`: `diffPct = |diff| / |ctrlNet|`, then a fixed 1%/3% band. Because it is **purely relative**, a $230 absolute gap on a $4,967 account trips RED, while the same $230 on the $14,002 account would be 1.6% (YELLOW), and on a $100K account would be GREEN. Small accounts trip on noise. The spec itself names this: "RED threshold is relative-only (design flaw: small accts trip on noise)" and the appendix lesson `:28` calls out "relative-vs-absolute contamination" as a recurring root-cause class. **Trustworthy: the dollar gaps. Not trustworthy: the RED/YELLOW label on small accounts** — a RED here does not mean "materially wrong," it means "small denominator." Fix would be a dollar-floor (e.g. ignore gaps under ~$250–500) ANDed with the percentage. (Confidence: high on the flaw; the specific floor value is my suggestion, not in spec.)

### Exposure layer — `misV2Exposure_` `Code.gs:2031-2046` (confirmed live, `fn=exposure`)
- Position MV / **account NET equity** (from recon control, so it matches the broker's "% of account"). `>25% → ⚠CONC`. Live: `600` SPY 54% / ASML 49% / META 46% / ABBV 27% all ⚠CONC; `5378` META 68% ⚠CONC.
- **Architecturally clean:** the header literally states "WARNING only, does NOT change Action" and the code only emits display strings — it never writes back to FSE or Action. This is the Portfolio Layer behaving as designed (never mutates Action). Trustworthy as a *warning surface*; note the ⚠CONC threshold is itself relative-to-account, so a kid account with 4 positions will always look concentrated — informational, not actionable for those mandates.

### Per-account mandate handling — CONFIRMED, two mechanisms (partially redundant)
1. **In recon:** mandate is a free-text string carried per control row (`Code.gs:1982-1986`): 600=GROWTH(margin), 5692=PRESERVE(Joint,no-margin), 4073/5378=KID, 898=ACTIVE. Display-only; recon math does not branch on mandate.
2. **Separate classifier:** `misV2ClassifyAccount_` `Code.gs:2384-2397` returns `{owner, name, broker}` by regex — 4073=SON, 5378=DAUGHTER, 5692/835692=JOINT, 720600=SAM Invest-n-Save, 898/436/SWPF=Schwab. Used by the cash/margin and performance surfaces.
- **Trustworthiness caveat — two account maps that don't fully agree.** The slice/CLAUDE context lists Schwab **898/1241/4436** as the ACTIVE book, but `PORTFOLIO_CONTROL_` only contains **898**; `misV2ClassifyAccount_` matches `898|436|SWPF` (not 1241, not 4436 exactly — `436` substring-matches 4436). So 1241 is absent from both recon and classifier, and 4436 only matches by loose substring. **Anything portfolio-level for 1241/4436 is currently invisible/unreconciled.** (Confidence: high — verified by reading both functions + live portrecon returning only 5 accounts.)

### Margin & cash — `misV2CashMarginHtml_` `Code.gs:2354-2380` + `misV2GetMarginNote_` `:2303-2309`
- Margin in the **recon** path is the hard-coded `−11,131.76` on 600 (control array). Margin in the **cash/margin HTML** path is a *separate* source: `Margin_Notes` sheet via `misV2GetMarginNote_` (set by bot `MIS SETMARGIN`). **Two independent margin sources** — the recon array is authoritative for NET equity; the Margin_Notes sheet feeds only the broker-rollup card and will show "Margin not yet recorded" if empty. Risk: these can drift (control array says −$11,132; Margin_Notes may say something else or nothing).
- Cash classification: `misV2CashMarginHtml_` and `misV2PortfolioMetrics_` (`:2146`) treat `CASH/SPAXX/SGOV/SCHZ/SCHG` as cash. **SCHG is a growth ETF, not a money-market** — bucketing it as cash overstates cash / understates equity on any account holding it (5692 holds SCHG 6.169sh $214). Minor dollar impact here but a classification bug. (Confidence: high — SCHG is the Schwab US Large-Cap Growth ETF; code comment even hedges "money-market-ish" at `:2365`.)
- `misV2PortfolioMetrics_` `:2141-2158`: reports `total/equity = totalNet` (both = reconciled NET), `cashPct = totalCash/totalNet`, plus book-risk from `Decisions` × FSE stop. The metric's own internal gross-equity sum (`equity` var) is computed but then **overwritten by `_R.totalNet`** at `:2158` — correct (uses broker truth) but means the "EQUITIES" tile and "PORTFOLIO" tile show the *same* number ($22,135), which is misleading labeling (equities ≠ total when there's $1,897 cash). (Confidence: high — read the return object.)

### What is trustworthy vs not (portfolio level)
| Item | Trust | Why |
|---|---|---|
| NET equity headline ($22,135) | ✅ Trustworthy | Sums broker-control NET, not stale holdings (`:2005,2158`) |
| Cash total ($1,897) | ✅ Trustworthy | From control array cash column |
| Margin debit on 600 (−$11,132) | ✅ in recon / ⚠ may drift | Hard-coded control vs separate Margin_Notes sheet |
| Per-account gross MV | ⚠ Stale | 600 ABBV 17→7sh not refreshed; drives both REDs |
| RED/YELLOW recon flags | ⚠ Noisy | Relative-only threshold; small accts trip on noise |
| Exposure % + ⚠CONC | ✅ as warning | Clean Portfolio Layer, never mutates Action |
| Mandate strings | ✅ display / ⚠ coverage | 1241 absent, 4436 loose-match in classifier |
| Cash classification (SCHG) | ⚠ Bug | Growth ETF counted as cash |
| Accounts covered | ⚠ Incomplete | Only 5 of the named book (898 yes; 1241/4436 missing) |

**Bottom line:** Portfolio truth is now anchored to broker NET (the night's real win — kills the $32K phantom). The remaining portfolio-level risks are all *data/threshold* issues, not architecture: (1) holdings freshness on 600+5692 (B.75), (2) the relative-only RED threshold needs a dollar floor, (3) the Schwab active book (1241/4436) isn't in the control table, (4) SCHG mis-bucketed as cash. None of these touch the Engine Layer or mutate Action — the two-layer separation holds.

Files: `MIS/v2/Code.gs` (lines cited) · spec `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md:42-119` · live `fn=portrecon`/`fn=exposure`/`fn=holdings` (fetched this session).

### Agent 8 Data freshness

Confirmed: the asOf stamp is written into HOLDINGS_CLEAN col J (`email-EOD <date>`) but no function reads col J as a freshness guard — the only `asof` read at L2307 is a margin/buying-power lookup, unrelated. I have full verification.

## 8. Data Freshness — B.75 + the Holdings Pipeline

### Pipeline map (all in `MIS/v2/Code.gs`)

| Fn | Lines | Role | Stale vector |
|---|---|---|---|
| `misV2ImportHoldings_` | 1205–1221 | Gmail-reads Fidelity **"Position Summary"** (`newer_than:3d`), parses qty/price/MV per account, keeps newest email per acct, calls WriteHoldings | T+1 lag — a fill today only appears in the *next* evening's summary (its own comment, L1199–1204) |
| `misV2WriteHoldings_` | 1107–1118 | **Full clear + rewrite** of HOLDINGS_CLEAN rows 2..n; stamps col J `'email-EOD '+asOf`; auto-calls JoinCostBasis (→ Reprice) | Qty (col C) written **once from the email, never re-derived** (confirmed §3.2 root, L634) |
| `misV2RepriceHoldings_` | 1157–1170 | Overwrites **only** Current_Price (col E) and Market_Value (col F = livePx × **stale qty**) from Momentum_Engine GOOGLEFINANCE | **The core deceit:** repricing makes a stale count look freshly computed. MV = fresh price × stale qty |
| `misV2JoinCostBasis_` | 1125–1143 | Joins Position_Costs → Avg_Price (D), Unrealized (G), PnL% (H); calls Reprice first (L1129) | Inherits stale qty into Unrealized = (cur−ac)×**stale sh** (L1137) |
| `misV2ImportTrades_` | 512–538 | Parses Fidelity/Schwab **execution emails** → TRADE_LOG, dedup by Order_Id | **Decoupled from positions** — writes a fill log; does NOT update HOLDINGS_CLEAN qty. The two never reconcile |
| `misV2DropSchwab_` | 1177–1197 | Manual one-off row delete (Schwab exit 6/3) | n/a — manual |

HOLDINGS_CLEAN cols: A=Ticker, B=Account, C=Qty, D=AvgPrice, E=CurPrice, F=MktVal, G=Unrealized, H=PnL%, I='A', J=`email-EOD <asOf>`, K=src.

### How holdings go stale (three confirmed mechanisms)

1. **Decoupled fill vs position-summary.** `ImportTrades_` (L512) logs executions to TRADE_LOG but never touches HOLDINGS_CLEAN qty. The only thing that moves qty is the next **Position Summary** email re-import (`WriteHoldings_` full-clear, L1110). Between a fill and the next EOD summary, qty is stale by design.
2. **Settlement / T+1 lag.** `ImportHoldings_`'s own comment (L1199–1204) states a fill today appears in the next evening's summary → built-in one-day window. The **ABBV 600 RED** (17sh MIS vs 7sh broker, doc L609) is exactly this: a partial sale settling, HOLDINGS_CLEAN not yet refreshed.
3. **Reprice keeps stale qty (the deceit).** `RepriceHoldings_` (L1161–1166) updates *only* E and F; F = `px × Number(data[i][2])` where col C is the never-re-derived qty. A stale count therefore renders as a freshly-priced, freshly-computed MV everywhere downstream. *Second vector (doc L634, unverified by me): re-importing `_full_reconcile_2026-06-03.json` reintroduces ABBV=17 = whole-transaction-history qty, not settled position.*

### The asOf-stamp gap (high confidence — 3-stream agreement, doc L592–599; I verified)
`WriteHoldings_` writes a freshness stamp into col J (L1111) but **no function reads col J as a guard.** GATE 1 `DATA_STALE` (`misV2BuildFSE` L327) checks only the per-ticker Snapshot price dq string (`price===0 || dq.indexOf('stale')`), **not** the HOLDINGS_CLEAN asOf. Grep confirms the only `asof` read (L2307) is an unrelated margin/buying-power lookup. ⇒ **an old holdings load with live prices passes every freshness gate.** The guard exists in data, absent in logic.

### The missing `Broker_Qty` control (the gate-blocker)
`heldMap` (the GATE 3/4 input) is built at **L304–311** straight from HOLDINGS_CLEAN qty (col C / x[2]), summed across **all accounts with zero account filter**, with **no broker-truth comparison**. There is no `Broker_Qty` / `BROKER_POSITIONS_` store anywhere — confirmed by grep (only `PORTFOLIO_CONTROL_` exists, L1980, which holds per-account net equity, **not** per-ticker qty). Per completeness-critic §5 #4 (L696): the seeding ritual (owner/cadence/format) is **hand-waved, not specified** — this is the single hardest blocker, and it requires a **Sam-only human input** that cannot be obtained read-only (L901).

### Why this is the CRITICAL (not just cosmetic)
Stale qty **mutates Action** through `misV2BuildFSE` GATE 3 (HELD_LOSS, L331) and GATE 4 (PORTFOLIO_OVERLAP, L333) — both keyed on `heldMap[tU].mktValue` / `portTotal` (L308, L311), which carry stale qty. This violates the locked Portfolio≠Engine rule (doc §3.2 #1, L621 = CRITICAL). One stale row → multi-account fake concentration. *Caveat per the L1885 synthV2 traces (slice-6 territory): the **decomposed** engine consumes only an `isHeld` boolean, so for ABBV — genuinely held at 7sh — presence is correct and only legacy GATE 4 is contaminated. B.75 is therefore a **presence/freshness** fix, not a magnitude-into-engine fix (doc L797, L841).*

### Broker-email-watcher design (Obj 2; design-only, unverified against a real email)
- **Partial-fill query gap:** `ImportTrades_` L517 searches `subject:"Order Execution"` — Obj 2 asserts this **misses "Order Partially Filled"**, the literal ABBV case. Fix = `subject:("Order Execution" OR "Order Partially Filled")`. **Unverified** — no analyst pulled the actual ABBV fill email to confirm Fidelity's exact subject (completeness-critic §5 #6, L698).
- A watcher that ingests partial-fill emails would close the decoupling gap by updating qty between Position Summaries — but the canonical design still routes truth through the EOD Position Summary re-import + a `Broker_Qty` divergence check, **PROPOSE-not-write** (never mutates HOLDINGS_CLEAN).

### What B.75 needs to execute

**Sam-only human inputs (cannot be gotten read-only; gate stays closed without them — doc L899–903):**
- (a) Fresh **5692 Joint** broker screenshot to classify the 2nd RED ($230/4.6%, Stale-Price-vs-Pending **UNVERIFIED** — doc L693, §5 #1, the load-bearing Unknown).
- (b) **`Broker_Qty` per-position seed** + documented seeding ritual (owner/cadence/format), seeded from the same broker screenshots that seed `PORTFOLIO_CONTROL_`.
- (c) Recon **dollar-floor threshold** sign-off (~$50 Obj 1 vs $250–$500 doc L123 — unreconciled, §5 #8) to stop chronic kid-account false REDs.

**Functions to build (all read-only / PROPOSE-not-write):**
1. `BROKER_POSITIONS_` constant array **or** `Broker_Positions` tab (input #b above).
2. **`misV2HoldingsFreshness_()`** (NEEDS-BUILD, L715) — per `{account,ticker}` compare HOLDINGS_CLEAN qty vs Broker_Qty → DIVERGENT(RED)/STALE(YELLOW)/FRESH(GREEN); emit 2 health rows (import-age + qty-divergence); Telegram + diagnostic tab; **never mutates HOLDINGS_CLEAN**.
3. **Gate `misV2BuildFSE` GATE 3/4 behind qty-reconciliation** (L716, the single CRITICAL fix) — compute `heldMap` from `min(MIS qty, Broker_Qty)`, OR skip GATE 3/4 for any ticker where MIS qty ≠ Broker qty (mark `QTY_UNRECONCILED`, WARNING-only). Also scope `heldMap`/`portTotal` to ACTIVE accounts (898/1241/4436) to fix the zero-account-filter mandate-blend (doc L640).
4. **Fix partial-fill query** at L517 (verify against a real email first).
5. **Recon dollar-floor:** RED only if `diff% > 3% AND diff$ > threshold` (input #c).

**Acceptance (6-point + 5692, doc L719):** ABBV 17→7 **and** 5692 RED resolved, RED clears on **both** accounts, recon within tolerance, **equity stays ≈$22,135 (must NOT rebound toward $32K)**, divergence GREEN — verified read-only after the next EOD Position Summary import, no write endpoint fired. Open risk (§5 #9, L701): confirm the recon TEXT builder (`misV2PortfolioReconText_`, L2011) **names both REDs** — current roll-up reports only the worst (600), so the 5692 RED may be invisible in the brief while still blocking B.75.

**Confidence:** Code line/fn citations = verified directly. Recon dollar figures, the two-RED classification, ABBV 17→7, and 5692 root cause = sourced from doc + the one B.5 snapshot, **not re-fired live** (no analyst re-hit endpoints; `MIS_V2_TOKEN` absent from repo — doc §5 #2). The partial-fill subject-line gap and the 5692 Stale-Price hypothesis are explicitly **UNVERIFIED** pending a real email / fresh screenshot.

### Agent 9 Legacy-vs-synth

All claims verified against primary source. `misV2Shortlist_` (L1373) filters `x[7]==='ADD'||x[7]==='STARTER'` from FINAL_STATE_ENGINE — the legacy output. ASML=WATCH (GATE 4) is silently dropped; confirmed. And `misV2VerdictFor_` returns zero hits — it does NOT yet exist, confirming C requires building it.

## 9. Legacy vs synthV2 — adversarial re-verification of tonight's biggest claim

**Verdict: tonight's central claim CONFIRMED by independent primary-source trace.** `isHeld` (boolean) is the ONLY holdings-derived input to the decomposed verdict; the legacy `misV2BuildFSE` GATE 4 is the SOLE stale-magnitude→Action path; no surface recomputes overlap; and — critically — no surface *can* silently fall back to FSE today because the decomposed engine writes nothing any surface reads. I found one material correction to how the no-fallback claim should be stated, below.

### Claim 1 — "isHeld (boolean) is the ONLY holdings input to the decomposed verdict" → CONFIRMED
- `synthV2(o, isHeld)` complete signature and body: `MIS/v2/Code.gs` L1885-1900. The only fields read off `o` are `dur, trend, setup, f52 (nearHigh), accel (weakening)`. The only ownership term is the `isHeld` branch (L1888). **No `mktValue`, `portTotal`, `qty`, weight, or 20% gate anywhere in the function.**
- `isHeld` origin (`h`) is a pure boolean: `MIS/v2/Code.gs` L1872 — `held[t]=true` gated on `q>0`; the *value* of `q` is never stored or used. ABBV 17sh vs 7sh → both → `isHeld=true` → identical verdict. The stale-qty magnitude leak cannot reach synthV2.
- The `o` objects are built by `misV2ComputeShadow_` (L1794-1845). I traced its entire output object (L1833-1843): fields are `q1, dur, dsrc, trend, tsrc, setup, f52, accel, state, grade, sacs, issues`. Inputs are `Momentum_Engine` + price history (`misV2HistMapLong_`, L1800) + `Tickers`/beta (L1805-1806). **It never opens HOLDINGS_CLEAN, never builds heldMap, never computes mktValue/portTotal.** The legacy FSE `state` it attaches at L1838-1841 (`f.state`) is a display-only column; `synthV2` is called with `(o, h)` and never reads `o.state`. Confirmed.

### Claim 2 — "no surface recomputes overlap" → CONFIRMED (for the decomposed path)
- GATE 4 / PORTFOLIO_OVERLAP lives in exactly one place: `misV2BuildFSE` L333, using `heldMap[tU].mktValue/portTotal>=0.20`. `portTotal` is summed across ALL accounts with zero account filter (L304-311). This is real engine-resident portfolio logic that mutates Action — but it is **legacy-only**.
- No other function computes a 20%/overlap gate that feeds a verdict. Surface adapters (dashboard L1288-1292, shortlist L1366-1374, universe L2724-2731) all *read* `FINAL_STATE_ENGINE` col 7; none recompute overlap. Confirmed.

### Claim 3 — "no surface silently falls back to FSE" → CONFIRMED, but the framing is currently *vacuously* true and must not be mistaken for *structurally* true
This is the one place I'd push back on the converged wording. Today there is no fallback **because there is nothing to fall back from**:
- `misV2ProposedState_`/`synthV2` is invoked ONLY by `runProposedState()` (L1920) and `fn=proposedstate` (L2833). It **returns a text report and writes nothing** — no sheet, no `FINAL_STATE_ENGINE`, no accessor.
- Every decision surface Sam actually sees (dashboard L1292, shortlist L1373, brief, universe, `misV2State_`) reads `FINAL_STATE_ENGINE`, which is written ONLY by the legacy `misV2BuildFSE` (L348-350).
- **So the decomposed verdict reaches NO operator surface today.** The "no silent fallback" property holds trivially because there is exactly one source (legacy), not because a clean dual-source guard exists. The fallback risk the spec's DoD #5 names (`MIS_SACS_CALIBRATION_MODULE.md` L893) is a **future** risk that materializes the moment `misV2VerdictFor_` is introduced. **Adversarial note:** the claim "no silent fallback" should be read as "not-yet-applicable," not "proven safe" — the dangerous state ("looks migrated while quietly reverting") can only exist *after* C starts wiring surfaces to synthV2. The spec correctly classifies this as the open **implementation** risk (L854, L893), so the converged state is internally consistent — but anyone reading "no silent fallback = CONFIRMED" should not treat it as a property C inherits for free.

### Operator-facing contamination is real TODAY — independently confirmed
- `misV2Shortlist_` (L1373) filters `x[7]==='ADD'||x[7]==='STARTER'` straight off legacy FSE. ASML's live legacy verdict is WATCH/PORTFOLIO_OVERLAP (GATE 4, per spec L770-771), so **ASML is silently dropped from the brief shortlist every morning** while synthV2 would say ADD. The spec's "contamination reaches Sam concretely" claim (L833-834) is verified at the code level. (Unverified by me live: that ASML's *current* FSE row is actually WATCH — I did not call the live endpoint; this rests on the spec's trace at L760-771. Confidence high but second-hand on the live value.)

### Assessment of the C coherence-gate design + `misV2SurfaceConflictCheck_` as its foundation
- **`misV2SurfaceConflictCheck_` (L2692-2700) — what it actually does:** compares `FINAL_STATE_ENGINE` col 7 against `Snapshot.FinalState` per ticker, appends mismatches to `SURFACE_CONFLICT_CHECK`. It is a **legacy-vs-legacy** consistency check (FSE vs the Snapshot formula state). **It does not touch synthV2/Proposed at all.** So as C's "foundation" it is a *pattern* (per-ticker cross-source mismatch detection + log to a tab), not a reusable mechanism — extending it to synthV2 coherence requires (a) a new `misV2VerdictFor_(sym)` accessor that does not yet exist (grep for `misV2VerdictFor_` = ZERO hits in Code.gs; confirmed must be built), and (b) adding the synthV2 source to the comparison. The spec's instruction "EXTEND it, do NOT replace" (L867, L897, DoD #9) is sound — the per-ticker-diff-to-tab skeleton is genuinely reusable — but the word "foundation" oversells current coverage: today it proves nothing about the Proposed verdict.
- **C DoD design quality (L888-897):** strong. DoD #5 (no silent fallback) is correctly flagged as "the load-bearing clause" and the failure mode ("looks migrated while quietly reverting") is the exact risk my Claim-3 analysis surfaces. DoD #1-4 (single-source via `misV2VerdictFor_`, grep-proven no surface reads `FINAL_STATE_ENGINE.FinalState` for Proposed) is the right enforcement. DoD #8 (exposure DISPLAYED not used to mutate) correctly relocates GATE 4's good intent to the Portfolio Layer.
- **One gap in the DoD I'd flag:** DoD #5 says a missing synthV2 renders "unavailable, never legacy" — but there is no acceptance step that **forces** a synthV2-absent condition and verifies the surfaces render "unavailable" rather than the legacy value. "Grep proves no `||` fallback" (DoD-implied) is necessary but not sufficient; a positive negative-test (null out one ticker's synthV2, confirm all 4 surfaces say "unavailable") would close it. The probe set (L862) tests *agreement*, not *absence-handling*. Worth adding before calling C done.

### Bottom line
The architecture claim is real and conservative: synthV2 is provably free of the stale-qty magnitude leak (two independent traces now, this is the third), legacy GATE 4 is the sole contaminant, and "C IS the fix" (promote the clean verdict, don't rewrite GATE 4) is justified. The only correction: "no silent fallback to FSE" is **true-because-not-yet-wired**, not a safety property C inherits — it is precisely the thing C's DoD #5 must *establish*, and the current `misV2SurfaceConflictCheck_` does not yet test it. `misV2VerdictFor_` does not exist; building it + a positive absence-test is the real work of C.

Files cited: `MIS/v2/Code.gs` (L304-348 legacy FSE, L1366-1378 shortlist, L1288-1292 dashboard, L1794-1845 ComputeShadow, L1869-1920 ProposedState/synthV2, L2692-2700 SurfaceConflictCheck), `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md` (L745-905 traces + C DoD).

### Agent 10 Scale

Confirmed: `Quote_Cache` and `Universe_Registry` do NOT exist in Code.gs — they appear only in the spec's planning vocabulary. The Tickers tab + History/Price_History tabs are the de-facto equivalents. I have full evidence. Writing the slice.

## 10. Scale Readiness — 50→183→250 Path, Blockers & Evidence

**Confidence: HIGH on code-level blockers (all line-cited); MEDIUM on runtime estimates (no live 50/183/250 run has executed — the doc states "Scale validation NOT STARTED," `MIS_SACS_CALIBRATION_MODULE.md` L14). Numbers below are derived from code structure, not observed.**

### Current state: the path is *partially* built, NOT exercised
The universe-expansion plumbing exists and is ADDITIVE/non-destructive, but no run past the ~20-ticker pilot has happened. The locked freeze (B.75→C→D, STOP) explicitly defers all scale work (`Code.gs` L886; doc L880, L93 "Production swap · 50 · 250 · dashboard | 🔒 BLOCKED").

### What's already built for scale (the good news)
1. **Long Price_History table** — `buildPriceHistoryTable_` / `misV2MigrateHistory_` (`Code.gs` L142-163). Single `Ticker|Date|Close` long table replacing the wide per-ticker column blocks. Comment L143 states the explicit reason: the wide layout "hit ~750 cols of GOOGLEFINANCE at 250 tickers" (3 cols/ticker × 250). Built additively; old `History` tab untouched until verified (`misV2HistVerify_` L174).
2. **Row extension** — `misV2ExtendRows_` (`Code.gs` L228-246) copies the row-2 formula template of `Momentum_Engine` + `Snapshot` down to N rows. Fixes the old hard cap where formula tabs were "hardcoded to 12 rows" (L227).
3. **Sector backfill** — `misV2FillSectors_` (L198-222) has a ~150-name static SEC map; covers ~the 183 set.
4. **Rolling Finnhub refresh** — `misV2RefreshFinnhub_` (L985-1008) processes the **40 stalest tickers per run** (`runFinnhub` L1011), sorted stalest-first (L991), 1.1s sleep between calls (L998, L1003) to stay under Finnhub 60/min.

### What BREAKS at 250 — blockers with evidence

**BLOCKER 1 — Hardcoded 16-ticker history map still powers ALL analytics (HIGH severity).**
`misV2HistColMap_` (`Code.gs` L139) is a literal `{INTC:2, NVDA:5, ... SOXX:47}` — 16 tickers, frozen. The long-table migration is **only half-wired**:
- FSE/engine path correctly uses the long reader `misV2HistMapLong_` (`Code.gs` L1800, L1944). ✅
- But every **risk/factor/backtest/VaR analytic still calls the 16-ticker wide map**: `misV2RiskMetrics_` (L1466), `misV2FactorScores_` (L1480), `misV2VaR_` (L1492), `misV2MonteCarloVaR_` (L1502), `misV2Backtest_` (L1545), `misV2BacktestNetCost_` (L1558). At 50/183/250, these surfaces silently cover only the original 16 names — Sharpe/Sortino/beta/maxDD/momentum/stress-test go blank or stale for the other 234. This is the **single biggest scale defect in code** and is NOT on the current punchlist.

**BLOCKER 2 — GOOGLEFINANCE in-sheet fanout (HIGH severity, the documented one).**
Live prices on `Tickers` are 4 GOOGLEFINANCE formulas per row (changepct/price/beta/name — `Code.gs` L55-58); `buildHistoryTab_` writes daily-close series via GOOGLEFINANCE (L120-135). At 250 names: ~1,000 live-quote formulas on Tickers + the wide History tab's ~750 columns (the exact reason the long table was built, L143). GOOGLEFINANCE has undocumented per-sheet cell limits and recalc throttling; mass `#N/A`/`Loading…` and 15-min lag (doc L561) are the expected failure. **Long Price_History mitigates the History side; the Tickers live-quote fanout is NOT yet refactored** — still per-row formulas.

**BLOCKER 3 — GAS 6-minute execution ceiling (MEDIUM-HIGH; runtime UNVERIFIED).**
`misV2RefreshFinnhub_` sleeps 2×1.1s per ticker (L998+L1003) = ~2.2s/ticker. The 40-cap (L1011) = ~88s, safely under 6 min. But a **full 250-name Finnhub refresh = ~250×2.2s ≈ 9.2 min > the 6-min GAS limit** — which is *why* it's capped at 40/run and runs daily (L1016, ~6:20 AM). Consequence at 250: a full metadata refresh takes **~7 calendar days** to cycle (250÷40). `EARNINGS_DEPTH` (L463-494) sleeps 3×1.1s/ticker = even worse. FSE rebuild itself (`misV2BuildFSE`, daily 4:20 PM, L688) reads whole tabs into memory; its 250-row runtime is **unmeasured** — flag as a scale-test must-measure.

**BLOCKER 4 — No batched price refresh / no Quote_Cache (MEDIUM; architectural gap, not a bug).**
Despite the spec vocabulary, **`Quote_Cache` and `Universe_Registry` do NOT exist anywhere in `Code.gs`** (grep: zero hits). They are planning terms in the master plan, never built. The de-facto universe registry = the `Tickers` tab; the de-facto quote cache = the GOOGLEFINANCE cells + Finnhub `Finnhub_Updated` timestamp column (col 13). There is no batched `UrlFetchApp.fetchAll` quote path — all live prices ride GOOGLEFINANCE (Blocker 2), and Finnhub is sequential-with-sleep (Blocker 3). At 250 this is the structural ceiling.

**BLOCKER 5 — Percentile-relative scores reshuffle by construction (HIGH; the doc's own #1 risk).**
Durability/Trend are universe-relative percentile blends (doc L208-212, L250-256). Embedding the original 20 inside 250 "**will shift their scores by construction** (90th-of-20 ≠ 90th-of-250)" (doc L252). This is not a plumbing bug — it's the architecture's load-bearing scale question, and it forces the absolute-score-conversion decision (doc L255, the "HIGHEST-RISK item," L199).

### What the scale-test gate (#15A/#15B) requires
From doc L190-201:
- **#15A Absolute Score Immutability:** before ticker #21, capture original-20 {Durability, Trend, Setup}; diff after 50/183/250. PASS = scores materially unchanged.
- **#15B Action Immutability:** capture original-20 shadow Actions; diff after 50/183/250. PASS = actions move only for explainable reasons (e.g., sector-relative shift), FAIL = "200 unrelated tickers turn META HOLD→REJECTED."
- **Method (mandatory, doc L200):** COPY → VERIFY → BASELINE → PROMOTE — run on a **Drive copy**, not production. Same discipline as the History migration.
- **Hard pre-250 gate (doc L258-262):** the **System_Health tab** must exist first, with rows for Cache Freshness · Quote Coverage · Price History Coverage · Action Distribution · Action Churn, each Green/Yellow/Red. "Build it BEFORE scaling." This is **partially built** — `Code.gs` L1942-1948 already emits Quote coverage / Sector coverage / Price_History coverage / Factor status rows. **But L1945 hardcodes `phN>=16` as the GREEN threshold** — so at 250 the health gate would falsely report GREEN with only 16 of 250 history series present. That threshold is a latent scale bug in the gate that is supposed to *catch* scale bugs.

### Net read
The 50→183→250 path is ~40% built (long history table, row extension, sector backfill, rolling Finnhub, partial System_Health) and 0% exercised. Hard blockers in priority order: **(1)** wire the 6 analytics functions off `misV2HistColMap_` onto the long reader; **(2)** the `phN>=16` health-gate threshold must become universe-relative before it can gate anything; **(3)** GOOGLEFINANCE Tickers-tab live-quote fanout needs batching/caching it doesn't have; **(4)** Finnhub full-cycle latency (~7 days at 40/run) and unmeasured FSE rebuild runtime vs the 6-min ceiling; **(5)** the percentile→absolute score decision (doc-flagged, not code-fixable). All of this sits behind the locked freeze — correctly, per doc L223 "Architecture is FROZEN unless scale testing reveals a real defect."

**Files cited:** `MIS/v2/Code.gs` (L55-58, L120-163, L198-246, L985-1019, L1466-1560, L1800, L1942-1948); `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md` (L14, L93, L190-262, L880-886).

### Agent 11 Health

I have everything needed. Writing the audit.

## 11. Health / Monitoring Audit — `fn=health` (`misV2SystemHealth_`) + `misV2Integrity_` + sibling diagnostics

**Live pull (verified, `fn=health` 2026-06-04):** `SYSTEM_HEALTH: YELLOW (0 red, 1 yellow)` — only YELLOW is `Tickers→FSE: WMT` (21 Tickers vs 20 FSE rows, scale-pending). All other rows GREEN: 20 verdicts/0 blank, 0 formula errors, 0 blank price, 0 blank sector, 16 tickers w/ Price_History, EventImpact GREEN-by-design (deprecated weight=0), 20 shadow-scored, 1 trigger installed.

### Checks that EXIST today

**A. `misV2SystemHealth_` (`Code.gs` L1924-1955)** — the live `fn=health` surface (`doGet` L2835). 9 checks, each emits `name | GREEN/YELLOW/RED | detail`; rollup = RED if any red else YELLOW if any yellow:
- **FSE completeness** (L1927-1929) — RED if 0 verdicts or any blank `FinalState` (col 8).
- **Tickers→FSE alignment** (L1930-1933) — YELLOW if any Tickers-tab symbol absent from FSE (the live WMT YELLOW).
- **Formula errors** (L1934-1938) — RED on `#N/A|#REF!|#VALUE!|#NUM!|#DIV/0!|#NAME?|Loading` across first 60×60 of Momentum_Engine/Snapshot/FSE/Market/Sectors. *Bounded to 60 rows/cols — see gap below.*
- **Quote coverage** (L1939-1942) — YELLOW on any blank/≤0 price in Momentum_Engine.
- **Sector coverage** (L1943) — YELLOW on blank Sector.
- **Price_History coverage** (L1944-1945) — YELLOW if `<16` tickers have history (hardcoded `16` — see gap).
- **Factor status** (L1946-1948) — detects dead/constant factors but emits GREEN either way (EventImpact intentionally deprecated).
- **Action layer (shadow)** (L1949-1950) — YELLOW if `misV2ComputeShadow_` returns 0; swallows exceptions to empty.
- **Triggers** (L1951-1952) — GREEN if `>0` project triggers; never RED (scope-fail and 0 both → YELLOW).

**B. `misV2Integrity_` (L2703-2721, `fn=integrity` L2789)** — appends to an `Integrity_Check` audit tab: Include=Y count, blank sectors, `priceErr` (0/blank price), `Weight_* >= 12` dial-corruption check (L2716), FSE populated. Returns PASS or `WARN N issue(s)`. **Overlaps heavily with health** (sectors, prices) but adds the Weight-dial check health lacks.

**C. `misV2FactorDiag_` (L1752-1788, `fn=factordiag` L2831)** — deepest data-quality surface: per-factor mean/med/sd/min/max + `miss%`/`zero%` + `⚠CONSTANT/DEAD` flag (sd<1e-9 or >80% identical, L1776) + per-ticker defect list. This is the real "stale-but-plausible" detector at the factor level. *Not wired into the health rollup.*

**D. `misV2Crosscheck_` (L1061-1102, `fn=crosscheck`)** — cross-feed validation: Finnhub `/quote` vs Google Finance, FLAGs >2% price gap or >1pt change-pct gap (L1086-1087) + earnings sanity (missing/past/>120d, L1088). This IS a stale-but-plausible guard for prices — but on-demand only, **not in health, not scheduled.**

**E. Targeted monitors (live, scheduled via warm trigger L1269):** `misV2SchwabExpiryCheck_` (L1695-1706) pings Sam at day-6 of the 7-day Schwab token; `RUN_LOG`/`log_` audit trail; `DIAGNOSTICS` tab for Schwab API state (L1713). DATA_STALE gate in the engine (L327) rejects a ticker when `price===0` or `DataQuality` contains "stale". Finnhub refresh tracks per-row staleness with a `STALE` window (L989-990).

### GAPS (what's missing)

1. **No freshness SLA in health.** Nothing checks "how old is the data?" Health asserts price ≠ 0 but never asks *when* it was written. HOLDINGS_CLEAN carries an `asof` (L1115) and Momentum_Engine has per-row update times (L989), but `misV2SystemHealth_` reads neither. **This is exactly the B.75 hole** — the two recon REDs (600 ABBV 17→7sh; 5692 Joint $230) are *freshness* failures health reports as all-GREEN. (Confirmed: live health = GREEN-with-WMT-YELLOW while two accounts sit RED in `fn=portrecon`.)
2. **Stale-but-plausible (the BTC-class bug) is not gated by health.** A frozen-but-nonzero price passes Quote coverage (it only checks ≤0). The detectors that *would* catch it — `factordiag` CONSTANT flag and `crosscheck` cross-feed gap — exist but are **on-demand, not in the rollup, not scheduled.** *(Unverified: I did not locate a specific BTC code path; BTC/XAU are fetched live via `cbSpot_` at L106 with no staleness assertion, so a frozen Coinbase spot would propagate silently — consistent with the described bug class.)*
3. **Formula-error sweep is bounded to 60×60** (L1936). At 250 tickers an error in row 61+ or col 61+ is invisible. Schema-fragile as the universe scales.
4. **Trigger monitor is shallow.** Health only counts triggers `>0` (L1951) — it never verifies the *right* triggers exist, last-run recency, or runtime/failures. A warm trigger that silently stopped firing (stale cache, stale Schwab warning) shows GREEN.
5. **No cache contract / cache-age check.** `misV2Cached_` (L1246-1261) serves CacheService copies up to 6h TTL with **no freshness stamp surfaced to health** — a 6h-old dashboard reads identical to a live one. The spec explicitly lists "Cache Freshness" as a required row (L259); it does not exist.
6. **No schema lock.** Header maps are rebuilt by name every call (`H[h]=i`). A renamed/reordered column degrades to blank/missing silently; nothing asserts the canonical schema (L263-278) still holds.
7. **No baseline-diff / action-churn monitor.** Spec mandates Acceptance #14 Action Churn % + distribution history (L264-266); not implemented. Verdict drift is invisible.
8. **Two overlapping surfaces, no single tab.** health (transient string), integrity (`Integrity_Check` tab), factordiag, crosscheck (`Data_Crosscheck` tab) each cover slices. The spec's **single `System_Health` tab** (L258-262: Factor Diag · Baseline Diff · Formula Errors · Trigger Health · Cache Freshness · Quote/History Coverage · Action Distribution · Action Churn, each G/Y/R + last-run) is **NOT built** — it's the hard pre-250 gate per ZW critique #7.

### RED/YELLOW logic soundness

- **Sound:** FSE completeness and Formula errors correctly RED (true blockers). The G/Y/R rollup precedence (L1953) is correct.
- **Weak — under-escalation:** Quote/Sector/History/Alignment top out at **YELLOW** even when fully broken; a universe with zero prices would be YELLOW, not RED. Triggers can never go RED (L1952) — a dead trigger reads GREEN-ish.
- **Weak — relative-only recon threshold (cross-cited from slices A/B):** the >1%/>3% recon RED is *relative-only*, so small accounts (4073 1.4%, 5378 2.0%) trip on dollar-trivial noise while the engine reports system GREEN. Health and recon disagree because **health has no freshness dimension at all** — the design flaw is that the soundest RED (a stale position) lives outside the health surface entirely.
- **Brittle constants:** Price_History `>=16` (L1945) and Formula 60×60 (L1936) are hardcoded to the current ~20-ticker universe and will mislead at 50/183/250.

### Monitoring B.75 / C will need

- **B.75 (Holdings Freshness — the live blocker):** a freshness-SLA check that reads HOLDINGS_CLEAN `asof` per account and goes **RED when stale**, plus a per-account recon-age signal so the 600/5692 REDs surface *in health* — not only in `fn=portrecon`. Add an absolute-dollar floor to the relative recon threshold so small accounts stop noise-tripping. Promote `crosscheck` into a scheduled stale-but-plausible guard.
- **C (Legacy/Proposed MIGRATION_MODE display):** a **MODE-coherence check** — assert Telegram/Test-Entry/Scope all render the same Legacy/Proposed/Exposure/Mode for a ticker (the 9-point coherence DoD); a **no-silent-FSE-fallback** assertion (health must RED if a surface quietly falls back instead of showing MIGRATION_MODE); and extend `misV2SurfaceConflictCheck_` (L2692, the `SURFACE_CONFLICT_CHECK` tab, schema L277) to cover the new dual-display surfaces. C also needs a **cache-freshness stamp** so a cached Legacy view can't be mistaken for a live Proposed one.
- **Both:** build the single consolidated `System_Health` tab (spec L258-262) with last-run + cache-age rows before scaling, and remove the hardcoded 16 / 60×60 limits.

**Source trail:** all code cites `MIS/v2/Code.gs`; spec cites `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md`; live data from `fn=health` endpoint 2026-06-04. Confidence high on code behavior (read directly); the BTC stale-but-plausible *specific* path is unverified (inferred from `cbSpot_` L106 having no staleness assertion).

### Agent 12 Security

I have a complete picture. Writing the audit section.

## 12. Security / Secrets — MIS Attack Surface (read-only audit)

**Scope:** tokens, web-app deployment, ops-api Worker secrets, portal exposure, command endpoints. No secret values printed; referenced by name/location. All findings cite file + line. Both `zee78900/MIS` and `zee78900/hookstreet-workspace` confirmed **PRIVATE** via `gh repo view` (verified).

### Secret inventory & where each lives

| Secret | Storage (correct) | Verified |
|---|---|---|
| `RUN_TOKEN` (MIS v2 web-app gate) | `PropertiesService` — `Code.gs:2746`, read at `doGet` | ✅ |
| `FINNHUB_API_KEY` | `PropertiesService` — `Code.gs:466,977,1029,1063` | ✅ |
| `NOTIFY_SECRET` / `NOTIFY_URL` | `PropertiesService` — `Code.gs:570` | ✅ |
| Schwab token (expiry check `misV2SchwabExpiryCheck_`) | `PropertiesService` (referenced `Code.gs:1269`; storage not directly read this pass — **unverified** exact property name) | ⚠️ |
| ops-api: `MIS_V2_TOKEN`, `INBOX_SECRET`, `PLAID_SECRET`, `PLAID_CLIENT_ID`, `OPS_READ_TOKEN`, `FINNHUB_API_KEY`, `NVR_USER/PASS`, `OPENAI/ANTHROPIC` | wrangler secrets via `env.*` — `ops-api/src/index.ts:14-56`, never inlined | ✅ |

The engine (`Code.gs`) and the Worker (`index.ts`) both handle secrets correctly — PropertiesService and wrangler-secret `env.*` respectively. **The leak is entirely in the surrounding Python importers, docs, and one client-side HTML page.**

### 🔴 FINDING 1 (highest severity) — `RUN_TOKEN` is hardcoded in client-side JS on a portal page
`outputs/peek.html:135` embeds the live token in browser JavaScript:
`const MIS_BASE='…/exec?token=mv2-run-7Kq9xP2Lz!!!'`
- The inline comment "auth check happens server-side" is **misleading** — the token ships in page source to every browser that loads peek.html. `peek.html` is the Scope page; `outputs/` auto-publishes to the Cloudflare-Pages portal `ops.hookstreetservices.com` per workspace OUTPUT-FORMAT policy (CLAUDE.md / `docs/STACK_MAP.md`).
- **Mitigating control:** the portal is Cloudflare-Access-gated (Sam-only Google login), so the page isn't anonymously reachable. **But** anyone who passes CF Access (or any future misconfig / shared session / cached page) gets the raw token, and the token grants full MIS v2 web-app access — including `fn=decide` (writes trade state) and `fn=loadcosts` (overwrites Position_Costs). This is a credential printed into a deployed asset, which violates the workspace "never write secret values to a public/deployed surface" rule.
- **Note:** the same token also sits in `outputs/2026-05-29_LIVE_entry-nvda.html` and `…_entry-intc.html` (same Grep hit set) — verify those aren't on the portal index too.

### 🔴 FINDING 2 — `RUN_TOKEN` committed in plaintext across 3 Python importers + 2 docs + 1 bridge
- `MIS/v2/_import_positions.py:28`, `_import_costs.py`, `_import_realized.py` — `TOKEN = "mv2-run-7Kq9xP2Lz!!!"` (tracked in `zee78900/MIS`, confirmed via `git ls-files`).
- `command-inbox/mis-bridge.gs:14` — `MIS_BRIDGE_DEFAULT_TOKEN_ = 'mv2-run-7Kq9xP2Lz!!!'` (tracked in workspace repo).
- `docs/STACK_MAP.md:152`, `outputs/stack-map.html:174`, `docs/MIS_V2_SETUP_AND_KEYS.md:9` — token written out as a value.
- **Severity tempered** because both repos are private. **But:** (a) it's now in git history of two repos = rotation requires history scrub, not just an edit; (b) `outputs/stack-map.html` is portal-deployable; (c) it directly contradicts CLAUDE.md's "never commit secrets / they live in CONTROL tab or PropertiesService, never git." This token IS in git.

### 🟠 FINDING 3 — `/mis/notify` is an unauthenticated POST relay to Sam's Telegram
`ops-api/src/index.ts:954` — `/mis/notify` checks only that `INBOX_SECRET`/`APPS_SCRIPT_URL` exist server-side; it requires **no caller auth** (it's not in the `OPS_PROTECTED` set, `index.ts:376`). Any internet client can POST arbitrary text (≤3500 chars, `index.ts:961`) and it relays straight to Sam's Telegram via the INBOX→Telegram path. The 3500-char cap limits flood size but not flood frequency. **Risk = spam/phishing into Sam's trusted ops channel**, not data exfiltration. Low data risk, real nuisance/social-engineering risk. (The tappable "Send me this" buttons on the Master Plan Board rely on this open endpoint, so the open design is intentional — but it's unauthenticated by design.)

### 🟡 FINDING 4 — `/mis/peek` is unauthenticated (acceptable, but note the data it joins)
`ops-api/src/index.ts:600` — no `x-ops-key` gate (only `/plaid/balances` + `/plaid/items` are protected, `index.ts:376`). `peek` returns public market data (Finnhub/Yahoo) **plus** an MIS overlay (`fn=peekoverlay`, `index.ts:618`) that exposes `in_universe` + held boolean + verdict for any queried symbol. **MIS_V2_TOKEN stays server-side here (good)** — the Worker holds it, so peek does not leak the token even though it's open. Residual: a small information-leak (which tickers are in Sam's universe / held) to anyone who guesses the workers.dev URL. Low severity; flag only.

### 🟢 Confirmed clean
- `doGet` enforces token equality before any work and returns `unauthorized` on mismatch (`Code.gs:2748`).
- ops-api never inlines a secret; `/health` only returns booleans (`plaid_secret_set: Boolean(...)`, `index.ts:362`) — no value disclosure.
- Camera + Plaid endpoints are properly gated by `OPS_READ_TOKEN` / referer (`index.ts:378,390`).

### Recommended remediation order (for when Sam opens a window — do NOT act now)
1. **Rotate `RUN_TOKEN`** (it's in git history of two repos + a deployed page → assume burned). Set new value only in PropertiesService.
2. **Remove the token from `outputs/peek.html`** — route the MIS_BASE calls through the Worker (which already holds `MIS_V2_TOKEN`) instead of from the browser; the peek page should never carry a write-capable token.
3. **Replace hardcoded `TOKEN`/`MIS_BRIDGE_DEFAULT_TOKEN_`** in the 3 Python files + `mis-bridge.gs` with env/PropertiesService reads; redact the docs.
4. **Add a caller auth/throttle to `/mis/notify`** (shared key or rate-limit) if the open relay isn't worth the Telegram-spam exposure.

**Confidence:** High on Findings 1–4 (all directly read). Unverified: exact Schwab token property name/storage (referenced but not opened this pass); whether `outputs/stack-map.html` + the two LIVE entry HTMLs are currently on the live portal index (`outputs/index.html` is hand-maintained per CLAUDE.md loop 38-K6, so presence ≠ certain).

**Source trail:** `MIS/v2/Code.gs` (2746, 2748, 466, 570), `MIS/v2/_import_positions.py:27-28,84`, `ops-api/src/index.ts` (14-56, 376, 600, 618, 954-961), `outputs/peek.html:133-135`, `command-inbox/mis-bridge.gs:14`, `docs/STACK_MAP.md:152`, `docs/MIS_V2_SETUP_AND_KEYS.md:9`. Repo visibility via `gh repo view` (both PRIVATE). Read-only; no writes, no deploys, no endpoint write-calls.

### Agent 13 Dashboard/deferred

I now have full coverage. Compiling the slice.

## 13. Dashboard / Deferred UI — what EXISTS, what's DESIGNED-not-built, what's FROZEN until scale

### A. What EXISTS today (built, live, deployed)

**A1. Google-rendered HTML dashboard (`fn=dashboard&view=1`) — the real, full cockpit. LIVE.**
- Entry point: `doGet` at `MIS/v2/Code.gs:2744`. The `view=1` branch (`Code.gs:2751`) routes `dashboard`/`entry`/`decide` through `HtmlService.createHtmlOutput(...)` (L2754) → a bookmarkable phone page; without `view=1`, `fn=dashboard` returns the same HTML as JSON (L2778). Token-gated against `RUN_TOKEN` (L2746–2748).
- Renderer: `misV2Dashboard_()` (`Code.gs:1338–1362`, dispatched via `runDashboard()` L1363). This is **not** a stub — it composes ~20 sections via `hd(title)` headers (L1337) + cached HTML fragments (`misV2Cached_`, L1341–1359): BLUF, Performance, Cash/Equity/Margin by broker, Portfolio Metrics, Positions, Decision Discipline, Institutional Risk (Sharpe/Sortino/Beta/VaR), Factor Tilt, Stress Test, Backtest gross-vs-net, The Market (L1350), VIX history, Shortlist, "YOUR 2 TICKERS (live charts)" (`card('INTC')`+`card('NVDA')`, L1353), Sectors-today rotation bars, Holdings-with-FSE-stop/target/R:R, News-on-holdings, Signal View, Momentum Digest, and the scale-ready Universe table (L1359).
- It already has the polish the "designed" wishlist describes: inline SVG sparklines (`spark()`, L1303–1306, ~130-day price), Apple-system font stack + safe-area insets (`H1`, L1336), verdict-colored card borders (`COL` map L1307), 52-week-position range bars (L1328), "LIVE · <time> ET" status dot (L1339). **Confidence: HIGH** (read directly).
- Caching/warm path exists: `fn=warm` / `misV2WarmDashboard_` (L2768) and `fn=warmtrig` / `ensureDashboardWarmTrigger_` (L2769). Per `MIS/docs/MIS_SCALING_RESTRUCTURE_PLAN.md:36`, "Separate compute-from-delivery — ✅ DONE (dashboard CacheService @55, brief cache @57)," **pending one manual step**: "Sam installs the warm trigger (one-time editor auth)." So the dashboard is fast now but the warm-trigger auth is an open manual loop. **Confidence: HIGH.**

**A2. Sectors tab — the dashboard's rotation data feed. LIVE (with a caveat).**
- `buildSectorsTab_` (`Code.gs:182`, `fn=sectors` L2773) builds 11 SPDR sectors + SOXX; `misV2FillSectors_` (L198, `fn=fillsectors` L2774) fills it. The dashboard reads the `Sectors` sheet at L1314–1321 and degrades gracefully ("Run the Sectors tab to load…", L1354) when empty.
- **Caveat (from the cross-sweep, not this slice's read):** `Code.gs:250–253` `misV2Cleanup_` *defaults to deleting* the `Sectors` tab as "redundant with Sector_Map." The dashboard's sector section silently empties if cleanup runs. **Confidence: MED** — the delete-default is real in code; whether it's been triggered is unverified.

**A3. Scope page (`peek.html`) — the single-ticker sanity card. LIVE on the portal.**
- `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\outputs\peek.html` — served at `ops.hookstreetservices.com/peek.html`, hits Worker `/mis/peek` (peek.html:133). This is the only "portal" MIS surface. It is **explicitly NOT the dashboard and NOT the FSE verdict** — labeled "Sanity card — NOT FSE" in the hero (peek.html:103). Has: dark-mode toggle (L509–520), TTS Speak + voice picker (L500–539), voice ticker input (L552–576), a 5-name "Research/Consider" workspace with Telegram relay via `/mis/notify` (L198–246), recent-tickers, after-hours dual-price card (L414–417). **Confidence: HIGH** (read fully).
- It is single-ticker overlay only. Per the analysis sweep (`outputs/2026-06-04_19-57_research_mis-v2-analysis-sweep.md` §5 item 2), peek "cannot return full holdings/exposure" — so it is a **complement** to the dashboard, not a replacement.

**A4. Test Entry / Decide pads (`fn=entry`/`fn=decide`, `view=1`).** Also real, rendered HTML (`misV2EntryPad_`, L2753/L2781) — peek.html's "Set up Trade →" CTA links straight to `&view=1&fn=entry` (peek.html:465). Live.

### B. What is DESIGNED-not-built (the deferred wishlist)

The themed/Apple-style/split-screen "Command Center" language refers to a **future re-skin/consolidation** of the surfaces in §A, not a missing engine. Source: `MIS/docs/MIS_SACS_CALIBRATION_MODULE.md:181–188`:

> "🖥️ DASHBOARD / COCKPIT = DEFERRED future work (Sam 2026-06-04, scope guard — do NOT build early): The user-facing dashboard (macro/positions/action-cards/light-dark/Apple-style charts/broker views — the **master-plan Step 6 'Test Entry / Command Center'**) was **deferred, not abandoned.** It is built LAST, AFTER 50→183→250 scale validation, and **consumes the proven outputs** (System_Health · proposed actions · reason codes · Durability/Trend/Setup · positions · cash · macro/news)."

So the DESIGNED-not-built items are:
- **A themed/consolidated Command Center** ("master-plan Step 6 'Test Entry / Command Center'") — a unified action-card cockpit, distinct from today's long single-column `misV2Dashboard_` HTML. Not built. **Confidence: HIGH** (named explicitly as deferred future work).
- **Light/dark + Apple-style charts + broker views** as a *cohesive themed surface* — note peek.html already ships dark-mode + SVG charts piecemeal, and `misV2Dashboard_` ships sparklines + range bars; the "designed" item is the *unified, themed* version, not the primitives. **Confidence: MED** (the doc lists these as the deferred dashboard's features; the primitives exist but the themed cockpit doesn't).
- **Split-screen Command Center / "themed dashboardjson"** — referenced in the task framing; I found **no `dashboardjson` artifact, no split-screen layout file, and no Stitch/themed-cockpit mock** in `MIS/` (grep returned only Code.gs's HTML renderer + the legacy `scripts/mobile_command_center.js` and `audits/.../Command_Center_Static_Values.csv`, which are **v11-era legacy artifacts**, not the v2 plan). Treat split-screen/dashboardjson as **DESIGNED-in-concept-only, no artifact exists.** **Confidence: MED-HIGH** (absence of file confirmed by grep; concept lives in prose).

Also flagged as deferred-but-prioritized: **`Factor_Diagnostics`** ("build FIRST — higher priority than half the dashboard," `MIS_SACS_CALIBRATION_MODULE.md:390`). It's a diagnostics tab, not UI, but the doc ranks it *above* dashboard work.

### C. The boundary — dashboard MUST NOT be touched until scale passes (crystal clear)

Three independent locks, all primary-source:

1. **Gate table** (`MIS_SACS_CALIBRATION_MODULE.md:93`): `Production swap · 50 · 250 · dashboard | 🔒 BLOCKED`. Dashboard is grouped with production-swap and the 50/250 scale tests as a single blocked bucket.
2. **Priority lock** (`MIS_SACS_CALIBRATION_MODULE.md:870`): "Scale / **dashboard** / swap = BLOCKED."
3. **Next-deploy-window instruction, locked** (`MIS_SACS_CALIBRATION_MODULE.md:880–881`): *"Execute B.75, then C, exactly against the coherence gate. STOP after C. **No D, no scale, no swap.**"* — dashboard sits past that stop line.
4. **Scope-guard prose** (`MIS_SACS_CALIBRATION_MODULE.md:183–188`): built **LAST, AFTER 50→183→250 scale validation**; *"Building it before the engine truth settled would be 'a prettier version of the wrong thing.' **Next session: do NOT touch the dashboard except to confirm what currently exists.**"*
5. **Analysis-sweep punchlist** (`outputs/2026-06-04_19-57_research_mis-v2-analysis-sweep.md:218–219`) puts dashboard in the "still 🔒 BLOCKED — do NOT pull forward" tail, after C → D → absolute-score → 50→183→250 scale tests; "Production swap = NO until ALL gates + parallel-run."

**The order is unambiguous: B.75 → C → D → (absolute-score, M-queue) → 50/183/250 scale tests → production swap → THEN dashboard.** The dashboard is the *last* build, gated on scale validation passing, and consumes the already-proven engine outputs. The only sanctioned dashboard action before then is **read-only confirmation of what exists** (exactly this slice). The use-case anchor the future cockpit must satisfy (`MIS_SACS_CALIBRATION_MODULE.md:187–188`): *"I heard something on Bloomberg — what matters to MY book right now?"* — NOT "show me every market statistic."

### Net for slice 13
- **EXISTS / LIVE:** full Google-rendered `misV2Dashboard_` cockpit (`Code.gs:1338`, `fn=dashboard&view=1`) with ~20 sections + sparklines/range-bars/system-dot; Sectors feed; Scope page `peek.html` (sanity card, explicitly not-FSE); Entry/Decide pads; cache+warm path (warm-trigger auth pending).
- **DESIGNED-not-built:** the themed/consolidated "Step 6 Command Center" re-skin, unified light-dark + Apple-style charts + broker views, split-screen / "dashboardjson" — concept only, **no artifact file found** in v2.
- **FROZEN:** dashboard is the LAST build, 🔒 BLOCKED until 50→183→250 scale validation + all gates pass; locked next-window instruction = STOP after C. Touch it this cycle **only to confirm what exists**.
- **Unverified:** Sectors-tab delete-default in `misV2Cleanup_` (could silently empty the dashboard's sector section); warm-trigger install status; whether any "themed cockpit" mock exists outside the repo (Stitch/chat) — none found on disk.

### Agent 14 Productization

I have what I need. Both sources are clear, and my slice is explicitly a separate "productization signal" note — not a build-plan input. Let me also quickly confirm the cashflow thesis framing to keep the wall clean.

The two memories give me everything. Here is my output.

## 14. Productization Signal — What the MIS/Stack Teaches Hook Street Services

> **Scope guard (per task instructions + `resource-monetization` SKILL):** This is a *signal note only*. It is STRICTLY SEPARATE from the MIS engineering tiers (B.75→C→D, scale, swap). Nothing here should re-order, re-prioritize, or otherwise touch the build plan. The MIS engine is a **WEALTH COMPOUNDER**; the productized methodology is a **RESOURCE GENERATOR** — `resource-monetization/SKILL.md` ("never blur it"). They live on opposite sides of the wall.

### The core teaching: the *methodology*, not the engine, is the product
The sellable asset is not the MIS engine, the FSE, or the SACS calibration module. Per `project_operator_cockpit_offer.md` ("What's 'the product'"): **the product is the operating rhythm**, delivered through portal + bot + briefing. MIS is one *instance* of that rhythm applied to a single domain (trading). What it demonstrates — and what a buyer pays for — is the repeatable pattern, not the trading content. *(High confidence — directly stated in both source memories.)*

### Three reusable patterns MIS proves out (each maps to a sellable Lane-3 module)
The MIS architecture, as converged tonight, is a working **proof-mode case study** of the cockpit doctrine. Specific transferable patterns I observed in this sweep's context (cite-level confidence noted):

1. **Single source of decision truth.** MIS's locked principle — "no surface independently classifies tickers," one engine owns the verdict (`docs/MIS_FSE_ARCHITECTURE.md`, FSE design) — is exactly the cockpit's "one Next-Best-Action surface" gap that ChatGPT flagged as missing (`project_operator_cockpit_offer.md`, "The 5 things Sam still hasn't done" #1). MIS is where Sam *solved* that problem for one domain. That solved pattern is the demonstrable skill. *(High confidence — architecture principle is explicit; the mapping to the cockpit gap is my inference, marked.)*

2. **Two-layer separation (Engine vs. Portfolio/Display).** The locked MIS arch — Engine Layer computes a pure verdict, Portfolio Layer warns but **never mutates the Action** (tonight's converged state: synthV2 consumes only an `isHeld` boolean; GATE-4 contamination is legacy-only) — is a clean, sellable *governance* pattern: "the system that decides is walled off from the system that displays/contextualizes." That maps directly to cockpit **Lane 1 (System Install) vs. Lane 2 (Operating Advisory)** scope wall. *(Medium-high confidence — the two-layer lock is well-evidenced in the task's converged-state summary; the productization mapping is my framing.)*

3. **Migration/coherence discipline (the C-step).** The locked MIGRATION_MODE display + 9-point coherence DoD + "no silent FSE fallback" + conflict-check extension (`misV2SurfaceConflictCheck_`) is a reusable *trust-the-output* discipline. For a client cockpit this is the answer to "how do I know the system isn't lying to me" — i.e., the proof-artifact / Rule-9 doctrine applied. Sellable as a reliability feature, not a trading feature. *(Medium confidence — I'm reading the locked C-step from the task brief, not from primary line-level verification of `misV2SurfaceConflictCheck_` L2692.)*

### The honest-framing guardrail (must travel with this signal)
`resource-monetization/SKILL.md` is blunt: **trading is the dessert, the generators are the meal.** When MIS shows up in a sales/productization conversation, it must appear as **track-record PROOF and methodology demonstration**, NOT as the income engine. The $2M base the thesis assumes "must come from the businesses, not from trading the ~$30K." So the productization use of MIS is: *"here is a working command center I built for my own hardest domain"* — a credibility/proof asset feeding the **Hook Street Operator Cockpit** offer (Phase 0 $750–1,500 / Phase 1 $2,500–5,000 / Phase 2 $1,000–2,500/mo / Lane-3 modules separately scoped). *(High confidence — pricing and framing verbatim from `project_operator_cockpit_offer.md`.)*

### The one concrete productization move MIS unlocks
Per `project_operator_cockpit_offer.md` ("missing core" #5): Sam still has **no proof-mode case study** from his own system. Tonight's MIS work is exactly that raw material — *before:* a $32K phantom equity number, contaminated gates, scattered surfaces; *after:* live $22,135 reconciled equity, a walled two-layer engine, a coherence DoD. That before/after IS a sales asset. **Signal:** when Sam next writes the buyer-facing one-pager, the MIS reconciliation story is a usable "I do this to my own books first" credibility paragraph — *without* exposing any account numbers or the trading thesis itself. *(High confidence on the asset; the "$22,135 vs $32K phantom" figures are from tonight's converged-state brief and I did NOT independently re-verify them against `Portfolio_Reconciliation` — treat as the brief's claim.)*

### What this signal must NOT do (explicit)
- Do **not** let any of the above re-order the locked engineering sequence (B.75 → C → D; scale/swap/dashboard BLOCKED; freeze HOLDS).
- Do **not** turn MIS into a SaaS or sell the engine itself — the offer is install + advisory (`project_operator_cockpit_offer.md`), and concurrency is capped at 1 active install.
- Do **not** present trading returns as the product or the family-resource engine (`resource-monetization` re-anchor rule).

**Source trail:** `C:\Users\ztrei\.claude\projects\C--Users-ztrei-OneDrive-2--Hook-Street-05--2026-BH\memory\project_operator_cockpit_offer.md` · `C:\Users\ztrei\OneDrive\2. Hook Street\05. 2026 BH\hookstreet-skills\resource-monetization\SKILL.md` · MIS arch principle: `docs/MIS_FSE_ARCHITECTURE.md` (FSE single-source-of-truth) · tonight's converged-state summary (two-layer lock, GATE-4 legacy-only, $22,135 recon) — figures cited as the brief's claim, not re-verified against primary endpoints.