docs: define live champion continuity boundary (#324)

Co-authored-by: Codex <noreply@openai.com>

Author: Pigbibi

README.zh-CN.md

@@ -32,6 +32,8 @@ QuantRuntimeSettings 是 QuantStrategyLab 的运行配置包。为 QuantStrategy
 
 `default_execution_mode`、`live_configured`、策略生命周期标签、本仓切换 workflow 与 CI 绿灯都只是配置或历史元数据，不是运行、订单、资金或阶段升级授权。P1–P3 的 non-live 数据获取必须有独立、精确的契约，不能从 P0 隐含推导；P4–P6 仍未定义。详见[架构边界](docs/ARCHITECTURE.md#p0p6-runtime-authority-boundary)。
 
+已明确授权、已在运行的旧实盘基线不应因为新的候选正在 P1–P6 验证而被一并停掉。它使用独立、hash 冻结的 `live_continuity` 状态：只有 `ACTIVE_LKG` / `ROLLBACK_LKG` 可进行普通执行；暂停、对账和减风险状态默认拒绝普通下单，但继续保留监控和对账。该状态不会自行启用实盘、扩大风险或绕过 `RUNTIME_TARGET_ENABLED` 硬门。详见 [runtime target 生命周期](docs/runtime_target_lifecycle.md#live-champion-continuity)。
+
 AI 与监测系统只能创建不可变、无订单的 `qsl.research_task.v1` 离线研究请求。该请求绑定证据摘要和受限实验，但不会激活候选，也不会授予 P4–P6 权限。详见[研究任务契约](docs/qsl_research_task_v1.zh-CN.md)。
 
 ## 仓库结构

docs/QSL_P0_P6_CURRENT_STATE_AND_DRIVER_POLICY.zh-CN.md

@@ -21,6 +21,23 @@
 
 P1–P3 是一条连续的 **non-live** 研究链，但它们仍分别拥有唯一 driver 和可验证产物。下表只记录当前可携带事实，不把代码、CI 或合并误写为策略收益、运行或交易资格。
 
+### 既有实盘基线与候选研究必须双轨运行
+
+P0–P6 只描述**新候选**的研究、验证和晋级链，不是已明确授权的既有实盘版本每天都要重新闯关的开关。为避免候选停车误伤原有运行，runtime target 可携带独立的 `live_continuity` 轴：
+
+```text
+已授权 champion（冻结的最后已知良好版本）→ 正常运行、健康监控、对账
+                                                │
+新 challenger → P1 → P2 → P3 → paper/shadow → canary → 才能替换 champion
+```
+
+- `ACTIVE_LKG` / `ROLLBACK_LKG` 才允许普通执行，且仅限 target hash 冻结的旧基线和既有资本/风险边界。
+- `PAUSED`、`RECONCILE_ONLY`、`ACTIVE_REDUCED`、`RISK_REDUCTION_ONLY` 默认拒绝普通下单；仍要保留健康、报告、只读监控和对账。后两类若要执行减仓，必须由平台专用、预先验证的执行器完成，通用开关不能把它误当成普通交易许可。
+- `RUNTIME_TARGET_ENABLED=false` 永远是额外硬门；连续性状态不能绕过它，也不能自行提高资金、杠杆、标的范围或重置硬熔断。
+- 候选 P0–P6 达标也不会自动覆盖 champion。替换、首次/重新启用实盘、提高资本或杠杆、未知订单无法对账、硬熔断恢复与凭证/合规变更仍需既定的人工或独立风控授权。
+
+这只是通用控制契约和平台接线边界，不是任何具体账户、策略、订单或当日运行状态的声明。实际恢复前仍须按目标平台读取持仓、未完成订单、最后回执和部署配置，再只恢复完全匹配的原授权基线。
+
 | 阶段 | 唯一 driver | 当前可携带状态与证据 | 允许的下一步 |
 | --- | --- | --- |
 | P0 | `QuantRuntimeSettings` | 自治运行策略 V2、离线验签门和仅 `RECONCILE_ONLY` 的准入代码已经存在。`binancequant`、`charlesschwabquant`、`firstradequant`、`interactivebrokersquant`、`longbridgequant`、`qslresearchquant` 已各自安装并读取核验一把公开 Cloud KMS P-256 root；这六个 bootstrap root 没有 signer IAM、已签 policy 或接入运行服务。独立 `alpaca-shadow-control`（展示名：`AlpacaShadowControl`）项目另有一把 P5 shadow-control root：仅其专用 policy issuer 对该 key 有最小 signer 角色，risk-gate/ledger/scheduler 三个身份没有项目级角色、用户管理私钥、WIF 或运行绑定；没有 active policy、签名 receipt 或运行服务。retired review caller 的本地清理及其受影响仓库的合并已完成；它只退役 GitHub Codex 自动 PR 审查门槛，普通 CI 仍保留，且不构成 P0 完成或运行资格。 | 仅维护和复核控制面事实；不得从 P0 推导 P1 数据获取、P4–P6 或交易资格。 |

docs/runtime_target_lifecycle.md

@@ -23,3 +23,30 @@ Platform workflows call the reusable
 `actions/publish-runtime-target-lifecycle` action after their existing checks.
 The action only constructs and posts a sanitized status object; it has no
 broker SDK, account material, or command to enable a runtime target.
+
+## Live champion continuity
+
+The P0–P6 lifecycle governs a **new candidate**.  It is not a daily survival
+gate for an already authorised live baseline (the *champion*).  A platform
+target may therefore carry a separately validated `live_continuity` object:
+
+| State | Standard execution | Required behaviour |
+| --- | --- | --- |
+| `ACTIVE_LKG` | permitted | Run the frozen last-known-good baseline. |
+| `ROLLBACK_LKG` | permitted | Run the previously verified compatible baseline after a rollback. |
+| `ACTIVE_REDUCED` | not generically permitted | A platform-specific, pre-validated reduced-risk executor is required. |
+| `RECONCILE_ONLY` | not permitted | Read positions and orders, reconcile unknown results, and submit no new standard order. |
+| `RISK_REDUCTION_ONLY` | not generically permitted | Only a platform-specific, pre-validated risk-reduction executor may act. |
+| `PAUSED` | not permitted | Keep health, reports, read-only monitoring and reconciliation visible; do not submit standard orders. |
+
+`baseline_target_sha256` freezes the exact target identity, while
+`baseline_kind` records whether the baseline is a previously authorised
+legacy target or a release-attested target.  A changed target must receive a
+new, explicitly validated baseline; it cannot silently inherit the former
+champion's authority.
+
+The external `RUNTIME_TARGET_ENABLED` control remains a second hard gate.  A
+continuity state never turns an explicitly disabled target on.  Conversely,
+candidate P0–P6 status does not by itself turn an `ACTIVE_LKG` target off.
+This contract does not create broker permission, increase capital or
+leverage, reset a hard breaker, or approve a new live target.