BL-IS-007: Era Seal and Leakage Guard

Status: RELEASED

Classification: PUBLIC

Revision: 1

Date: 2026-09-07

1. What it enforces

That research never touches sealed data, and that a seal is opened once.

Both halves are enforced in code rather than by convention, because a rule that depends on remembering is a rule with a decay rate, and the moment the temptation peaks is precisely the moment a marginal result needs one more look.

2. The partition

Declared before any research began:

Two sealed eras rather than one, on either side of the research window. That placement is deliberate: a strategy fitted to a middle period can fail forward, backward, or both, and the two seals ask different questions.

Held-out A remains unopened. It sits before 2022 and is not representative of the current market structure, so opening it would answer a question about a market that no longer exists.

3. The guard

Every data access in a research path passes through a boundary check.

guard(requested_range, era_context) -> allowed | raise
 
  In RESEARCH context:  any timestamp outside the research era raises.
  In SEAL context:      permitted once per seal, recorded, and thereafter raises.

The check raises rather than truncating. Silently clipping a request to the permitted range would let a strategy run on less data than it asked for and produce a result nobody could interpret.

4. Single-shot accounting

The seal carries a persistent record of whether it has been opened, against which specification, and on what date.

seal_state(era) -> { opened: bool, opened_at, specification_hash, gates }

The specification hash is the part that makes this more than bookkeeping. The seal is opened against one pre-registered specification, and a second request carrying a different hash is refused even if the seal had never been opened, because a specification that changed after the seal was declared is no longer the one that was pre-registered.

5. What single-shot actually protects

A held-out era opened twice is a research era with extra steps. The second look is informed by the first, so whatever is learned from the failure of attempt one shapes attempt two, and the era stops being out of sample the moment it is observed.

The programme opened its seal once, and the result justifies the whole apparatus.

The hypothesis that reached the gate had survived research-era validation, held under conditioning, and beaten a permutation null by 5.83 sigma with three of three subperiods positive. On the sealed data it returned -8.99 basis points against +8.24 in research [E-0037]. The mechanism had not weakened. It had inverted.

Every gate before the seal had passed. Only the seal caught it, and it could only catch it once.

6. What the seal costs

It is spent. That is the design, not a defect in it.

Held-out B was opened at the gate described above and is no longer available. A momentum family identified later in the programme therefore has no clean out-of-sample data remaining on this substrate to certify against.

That is a statement about where the next measurement comes from rather than about anything that went wrong. A new hypothesis on this substrate has three routes: accept that it cannot be certified out of sample and label it accordingly, run a forward shadow and accumulate genuinely unseen data in real time, or move to a different substrate.

The programme's own recommendation was the second. It is a resource decision rather than a research one.

7. Interface

era_context(era) -> context manager
    all data access inside the block is checked against the era boundary
 
open_seal(era, specification, gates) -> SealReceipt
    raises if the seal is already open
    raises if the specification hash differs from the pre-registered one
    records the opening, the specification and the acceptance gates
 
Raises when:
  a research path requests a timestamp in a sealed era
  a seal is requested twice
  the acceptance gates were not fixed before the request

The last check closes the obvious hole. Opening a seal and then deciding what would count as passing is not an out-of-sample test.

8. What it does not protect against

Leakage that is not temporal. A universe selected with hindsight, an instrument set filtered on outcomes, or a parameter chosen because it worked on research data will all pass this guard cleanly and still contaminate the result.

The rebalance-anchor defect in BL-IN-006 is exactly that case. Every access was inside the research era, the guard raised nothing, and the anchor was still an uncontrolled free parameter across nineteen pre-registrations. BL-IS-004 covers that class.

This instrument enforces one boundary well. It does not certify a result.

9. Cross-references

BL-D-003 section 5. BL-P2-002 sections 6 through 8. BL-D-009 rule R-11 in the programme numbering. BL-SD-045. Evidence E-0037, E-0036.

Copyright (c) 2026 Bijective Labs. All rights reserved.