docs: sync CLAUDE.md with live-mode hard-disable and CI matrix

[cgfixit]

What

Full verification pass over CLAUDE.md (fact-checked against current source) and the .claude/* skill/command wiring, requested as a repo-setup/config-verification task. Fixed three stale claims found in CLAUDE.md; everything else checked out.

Why

Per CLAUDE.md's own meta-rule: "when this document and the code disagree, the code is right... fix the doc in the same PR." Three same-day merges (PRs #115-#117, all landed 2026-07-13 before this session) changed behavior the doc describes:

1. Tier 3 "known gap" is stale. CLAUDE.md said --mode live CLI override bypasses the load-time private-key check and told agents to "flag, don't fix unprompted." main.py::run_bot (as of commit a2cbffd, PR fix: refuse unsupported CLOB V1 live startup #116) now re-runs validate_live_config() on CLI override and unconditionally raises ConfigError whenever config.mode == "live" — this build's CLOB V1 client is disabled outright for live trading, regardless of credentials. The gap is closed; the doc described a state that no longer exists. Confirmed by tests/test_main.py::test_cli_live_override_revalidates_live_credentials and test_live_mode_refuses_unsupported_clob_v1.
2. CI Python matrix drift. CLAUDE.md's Commands section claimed "CI runs on py3.10/3.11/3.12." .github/workflows/ci.yml:34 only tests ["3.11", "3.12"]. pyproject.toml still declares requires-python = ">=3.10" / target-version = "py310", but 3.10 isn't actually exercised by CI.
3. Imprecise anchor. The mistakes table cited portfolio.py::close_position "(tag C4)," but the C4 comment tag only exists in copier.py (the caller), not on the guard clause itself in portfolio.py.

Also updated the System Map's live-mode sentence to describe the current hard-disable instead of implying live mode is runnable with the right flag/key/preflight.

Everything else verified as accurate (spot-checked via a dedicated code-vs-doc pass): the six-loop run_bot startup wiring and supervise() backoff, rebalance_loop/exit_check_loop behavior, DataClient being dead at runtime, the logger-hierarchy claim, the trader score formula ((4.0·sharpe + 3.5·consistency + 2.5·recency) / 10), _compute_thresholds() TP/SL structure and its three call sites, the full retry matrix (entry/resting/exit), Decimal-via-str() exposure accounting, paper-fill fee/slippage precedence, all other mistakes-table anchors, config wiring (RiskConfig(...), the coupled-slippage model_validator, TestShippedConfigMatchesCodeDefaults), ruff config, and all referenced doc files existing.

Also verified .claude/* structure and wiring (no changes needed):

• 4 skills (api-drift-audit, fact-check, next-chunk, preflight) and 4 commands (deploy-check, next-chunk, optimizer, pr-sweep) are all present, have valid frontmatter/content, and load correctly in this session (confirmed each appears in the session's available skill/command list).
• .claude/settings.json's Stop hook (dirty-tree guard) is intact and correctly configured.
• .claude/commands/optimizer.md redirecting to .codex/skills/optimizer/ is an intentional cross-tool convention (documented in AGENTS.md: "Existing Claude-side audit notes live in .claude/commands/optimizer.md; keep Codex guidance repo-native and tool-agnostic"), not a misconfiguration — confirmed .codex/skills/optimizer/bootstrap.sh exists.
• Both companion shell scripts (probe.sh, preflight.sh) pass bash -n.

Validation

Docs-only change (no code touched), but ran the full local CI parity gate per repo convention:

$ bash .claude/skills/preflight/preflight.sh
GATE|ruff-lint|PASS
GATE|ruff-format|PASS
GATE|mypy|PASS
GATE|pytest|PASS
GREP|async-blocking|CLEAN
GREP|:memory:|CLEAN
GREP|integration-mark|CLEAN
GREP|release_exposure|CLEAN
GATE|config-drift|N/A

READY TO PUSH: yes

Note: one run of the full suite showed a single flaky failure (tests/test_copier.py::TestStructuredEvents::test_position_opened_event_emitted, a wall-clock timing assertion off by 1 microsecond: 0.001672 >= 0.001673). Confirmed pre-existing and unrelated to this change — it passed in 5/5 isolated reruns and in a subsequent full-suite rerun (623/623 passed). Not fixed here per the "pre-existing failures are reported, not bundled" tie-breaker.

Risk to monitor

None — no code changed, only CLAUDE.md prose/anchors. Nothing to monitor at runtime.

---

Generated by Claude Code