# Securities Order Lifecycle and Query Cost E2E SOP

This SOP validates Issue #95 through the standard TiPoC product path. It runs
the Securities workload only; Internet workload queue and route-authority
requirements do not apply. Existing Internet attempt paths must be preserved.

The campaign order is:

```text
candidate build -> logical 1G lifecycle gate -> 50G prepare
                -> 5-minute run -> 30-minute continuation run -> report handoff
```

The logical Securities `1G` fixture may materialize roughly 3.86 GiB because
the TPC-E scale label is a workload contract, not a byte-exact disk-size claim.

## 1. Build identity

Build TiPoC from the Issue #95 worktree that will be reviewed. Do not reuse a
binary from an Internet workload worktree.

```bash
ISSUE95_WORKTREE=/absolute/path/to/tipoc-securities-order-lifecycle
ISSUE95_BIN="${ISSUE95_WORKTREE}/bin/tipoc-issue95"

cd "${ISSUE95_WORKTREE}"
go build -trimpath -o "${ISSUE95_BIN}" ./cmd/tipoc
git rev-parse HEAD
shasum -a 256 "${ISSUE95_BIN}"
```

Record the Git commit and binary SHA-256. The Query Cost deployment attestation
must be an operator/deployer-owned, SHA-pinned document for the exact target
TiDB build and target binding. TiDB self-reporting and Grafana are auxiliary
cross-checks, not authority for a verified attestation.

Use a master TiKV release build for this campaign. Do not use the v8.5.7 binary
that previously hit the `WriteCompactionFilter` SIGSEGV path.

## 2. Common lifecycle contract

The environment renderer owns the YAML shape. Keep the order-flow values
explicit in retained command evidence:

```bash
export TIPOC_SECURITIES_ORDER_FLOW_MODE=lifecycle_coverage
export TIPOC_SECURITIES_ORDER_FLOW_SEED=20260811
export TIPOC_SECURITIES_TMB_WEIGHT=1
export TIPOC_SECURITIES_TMS_WEIGHT=1
export TIPOC_SECURITIES_TLB_WEIGHT=1
export TIPOC_SECURITIES_TLS_WEIGHT=1
export TIPOC_SECURITIES_TSL_WEIGHT=1
export TIPOC_SECURITIES_ORDER_QUANTITIES='100=1'
export TIPOC_SECURITIES_CASH_PERCENT=100
export TIPOC_SECURITIES_LIFO_PERCENT=50
export TIPOC_SECURITIES_SELL_PROBE_LIMIT=16

export TIPOC_QUERY_COST_MODE=latency_and_statement_ru
export TIPOC_QUERY_COST_DEPLOYMENT_ATTESTATION_PATH=/absolute/path/to/deployment-attestation.json
export TIPOC_QUERY_COST_DEPLOYMENT_ATTESTATION_SHA256=sha256:<64-lowercase-hex>
export TIPOC_QUERY_COST_POLL_INTERVAL_SECONDS=5
export TIPOC_QUERY_COST_POLL_TIMEOUT_SECONDS=2
export TIPOC_QUERY_COST_ISOLATION_STATUS=verified_test_environment
export TIPOC_QUERY_COST_ISOLATION_REASON=dedicated_cluster_and_exclusive_securities_campaign_process_audit
```

Do not edit a compiled manifest. If an input is wrong, render a new attempt.
The renderer rejects incomplete lifecycle weights and stale order-flow settings.

## 3. Logical 1G gate

Bind the current mac-mini-2 endpoints and object-store settings through the
existing environment variables, then create the attempt:

```bash
ONE_G_ATTEMPT=/absolute/path/to/securities-lifecycle-1g/attempt-001

TIPOC_PRESSURE_DURATION_SECONDS=300 \
TIPOC_PRESSURE_WARMUP_SECONDS=60 \
TIPOC_PRESSURE_COOLDOWN_SECONDS=30 \
scripts/env/tiup/init-attempt.sh \
  --run-id securities-lifecycle-1g \
  --scale 1G \
  --tipoc "${ISSUE95_BIN}" \
  --out "${ONE_G_ATTEMPT}" \
  --remote-bootstrap plan

"${ONE_G_ATTEMPT}/commands/prepare.sh"
"${ONE_G_ATTEMPT}/commands/run.sh"
```

Do not start 50G until the 1G closeout proves all required paths. Cleanup is a
separate public stage and must preserve evidence:

```bash
"${ONE_G_ATTEMPT}/commands/cleanup.sh"
```

## 4. 50G, 5-minute and 30-minute rounds

Prepare 50G once with a new run identity and isolated target state:

```bash
FIFTY_G_ATTEMPT=/absolute/path/to/securities-lifecycle-50g/attempt-001

TIPOC_PRESSURE_DURATION_SECONDS=300 \
TIPOC_PRESSURE_WARMUP_SECONDS=60 \
TIPOC_PRESSURE_COOLDOWN_SECONDS=30 \
scripts/env/tiup/init-attempt.sh \
  --run-id securities-lifecycle-50g \
  --scale 50G \
  --tipoc "${ISSUE95_BIN}" \
  --out "${FIFTY_G_ATTEMPT}" \
  --remote-bootstrap plan

"${FIFTY_G_ATTEMPT}/commands/prepare.sh"
"${FIFTY_G_ATTEMPT}/commands/run.sh"
```

The first standard run is the 5-minute round. Create the 30-minute round only
through the reusable continuation wrapper; do not hand-edit or copy a run
manifest:

```bash
scripts/rerun/run-again.sh \
  --from-attempt "${FIFTY_G_ATTEMPT}" \
  --try auto \
  --duration-seconds 1800 \
  --warmup-seconds 60 \
  --cooldown-seconds 30 \
  --query-cost-poll-interval-seconds 5 \
  --query-cost-poll-timeout-seconds 2 \
  --tipoc "${ISSUE95_BIN}"
```

Label the second round as continuation evidence because it reuses the prepared
target and the predecessor's durable business state. Run cleanup after both
rounds and preserve the attempt tree.

## 5. Acceptance and report checks

For each accepted run, `order-flow-summary.json` must lead with business
identities such as `TO-CPT`, `TR-CT`, `MF-SCLO`, and `TC-CPO`. Technical values
such as `TC-F1-S03` are allowed only in the statement-correlation field.

Required checks:

1. `mode` is `lifecycle_coverage`, and the resolved digest agrees across the
   scenario, manifest, node reports, receipt, summary, and closeout.
2. `TMB`, `TMS`, `TLB`, `TLS`, and `TSL` each have a positive terminal count.
3. Market buy/sell complete immediately; limit buy/sell and stop-loss pass
   through Market Feed before Trade Result.
4. Buy and sell holding paths are both positive, with no quantity underflow or
   duplicate terminal transition.
   A concurrent sell-position depletion is a valid `TR-CIP` terminal rejection
   only when the original side and quantity remain unchanged, the rejection is
   counted by `rejected_insufficient_position_count`, and no holding or financial
   mutation was applied. It must not be counted as Cleanup or as a blocked SQL
   statement. `TR-CIP`/`TR-RPRH` attempts whose transaction rolls back or whose
   commit fails remain attempt telemetry only and must not publish a CNCL
   transition or increment the rejection count.
5. With `latency_and_statement_ru`, every required business path is
   `cost_measured`; `executed` is accepted only by latency-only runs. No
   required path may be `not_reached` or `anomaly`.
6. Every executed required Query Cost unit has positive direct RU or a declared
   positive pessimistic transaction RU owner. A zero direct value attributed to
   that owner stays zero and is never copied or double-counted. `Exec>0 &&
   RU=0` without such an executed positive owner is a hard anomaly. Registered
   `Exec=0` units remain `not_reached` and must not be called measured.
7. Query Cost artifacts include per-business-code latency
   Min/Avg/P50/P75/P90/P99/Max and RU Min/Avg/Max/total details without
   embedding raw SQL text.
8. The 5-second Statement Summary poll and Grafana Resource Control panel are
   auxiliary RU evidence; baseline/terminal Statement Summary deltas remain
   the cost authority.
9. Blocked SQL statements, unresolved business definitions (`UNMAPPED`),
   Query Cost barrier failures, and TiKV panics are zero.
10. Cleanup pending/stranded paths are reported separately. A clean performance
    run need not manufacture failure-only Cleanup work; the atomic failure test
    lane proves rollback and exactly-once cancellation semantics.
11. Every insufficient-position rejection has `TR-CIP` cancellation and
    `TR-RPRH` history evidence. Required sell types must still each have positive
    completed execution counts; rejection counts cannot substitute for coverage.

Useful bounded inspections:

```bash
jq '.required_path_coverage[] | {business_code,business_name,business_purpose,required,execution_count,terminal_status}' \
  "${FIFTY_G_ATTEMPT}/run/try-01/order-flow-summary.json"

jq '[.cost_unit_coverage[] | select(.required and (.terminal_status == "not_reached" or .terminal_status == "anomaly"))]' \
  "${FIFTY_G_ATTEMPT}/run/try-01/order-flow-summary.json"
```

The final handoff includes both 50G round reports, Query Cost artifacts,
business-path coverage, TiDB/TiKV build identity, Grafana link, run durations,
artifact sizes, and SHA-256 values.