Stage E shakedown driver: route the Bug-A tail through the streaming conveyor

[WilfordGrimley]

What

The Phase-3 shakedown driver (manage.py stage_e_shakedown): routes the Bug-A blank-tier-1 tail through the LIVE streaming conveyor, per the owner-ratified sequencing (stage-e-streaming.md §6 item 1: the tail "does not get a batch pass") and §10(c) (batch size ships as a measured output of this shakedown's instrumentation). Closes the loop #463 tracks.

Design (frozen at filing; Tron efficiency+soundness pass per §8 is MANDATORY before any prod run)

1. Cohort: re-derived FRESH per invocation via issue Bug-A re-scan tail: remaining sources after wave-1 measure #418's own pool query (read Bug-A re-scan tail: remaining sources after wave-1 measure #418 for the query; both 6,535 and 17,531 are dated snapshots — never hardcode). --limit N for a bounded pilot run.
2. Driver loop: feed the cohort through dispatch_micro_batch(card_ids=<chunk>, trigger_reason="shakedown", batch_size=<--batch-size>) chunk by chunk. All existing gates bind unmodified: streaming-enabled flag, no-self-resume, fresh envelope sample, concurrency cap, per-batch ledger row. STOP (do not retry) on halted-* and throttled statuses, same posture as the backstop sweep; --max-batches bounds one invocation.
3. Forced re-extraction (the one conveyor change): tail cards carry CURRENT full-manifest evidence with blank values, so _run_stage_c's already-done check skips them today. dispatch_micro_batch gains force_stage_c_reextract: bool = False, threaded ONLY from this driver: skips the already-done exclusion and re-runs compute_card_evidence (persist overwrites, keyed card+content-hash — existing semantics). Also thread the escalation-forcing equivalent of run_image_evidence_cohort --no-shortcircuit (wave-1's re-scan used it; find the exact mechanism in that command and reuse, don't reimplement). Default-False = event/backstop paths byte-identical.
4. Re-invocation must not re-fetch already-re-scanned cards (Google fetch quota is the scarce resource): skip tail cards whose current evidence updated_at postdates --reextracted-after <iso> (required arg; the operator passes the shakedown epoch). A killed run resumes by re-invoking with the same epoch.
5. Evidence-change echo: each re-persisted evidence row fires the evidence-change signal and queues an event dispatch for that card — these land as cheap idempotent no-ops (evidence current, votes already cast → already-voted guards). ACCEPTABLE, but state it in the command's docstring and have the ledger's trigger_reason distinguish shakedown batches from echo dispatches. If Tron judges the echo volume unacceptable at tail scale, the fallback design is a suppress-signals flag on persist — do NOT build that preemptively.
6. Instrumentation: nothing new — per-batch PilotRunLedger rows already carry elapsed_s/stage_c_completed/fetch_failures/peak_rss_mb. run_id prefix stage-e-shakedown-b<batchsize>-<date> so the 25/50/100 waves separate cleanly for the Measure STAGE_E_MICRO_BATCH_SIZE at the next real bulk inflow (25/50/100 protocol) #463 analysis.
7. Drill compatibility (§7): the driver must be kill-safe by construction (item 4's resume). Include in the PR body: the exact invocation sequence for §7(a) (crash_drill.sh at micro-batch granularity — the script's one edit-point is its seeded cohort query, now on master via Graduate crash-drill script, fix test snapshot-sequence pinning #405) and §7(b) (dispatcher-kill mid-driver-run, re-invoke, verify no double-fetch via ledger + updated_at filter). The drills themselves are owner-polled runs, not part of this build.

Out of scope

Envelope bars, consensus/vote code (PROTECTED CORE), backstop sweep, batch-size decision itself (#463 closes only after the waves run and the ledger is analyzed).

Tests

force_stage_c_reextract=False paths byte-identical (existing tests unchanged); force path re-extracts a current-evidence card; driver stops on halt/throttle; --reextracted-after excludes re-scanned cards; chunking honors --batch-size/--max-batches; run_id prefix shape.