VALIDATION: independent review of the 2026-08-17 Track C wave C1 migration and tidy-up work

[mmcky]

Everything below was verified during the work, by the same agent that did it — same tools, same environment, same URL forms, same mental model that produced the claims. This issue exists to break that.

Bias to test for

Three verification monocultures ran through this session, and the checks below should avoid all three except where a box explicitly says to use one.

scripts/build_audit.py --strict verified most tracker claims — and was itself modified in the same session (#90 added the dual_recorded check). A tool that both changes and grades cannot establish that it grades correctly. Confirm ledger and consistency claims by parsing the YAML directly.

One interpreter produced nearly every numeric claim: /Users/mmcky/anaconda3/bin/python3, Python 3.13.9, pandas 2.3.3. Every profile, every byte comparison, every builder reproduction. Use a different Python and a different pandas.

Every sweep was /usr/bin/grep over local clones or the GitHub Trees API. Both find what they were pointed at. Confirm reader-facing outcomes by fetching the actual URLs and opening the actual artifacts.

What landed

repo	merged PRs
data-lectures	#89, #90, #91, #92, #94, #95
lecture-python-advanced.myst	#372 (repoint), #373 (deletion)

Tags pushed: lecture-python-advanced.myst publish-2026aug17. Issues closed: workspace-lectures#38, #85, #86, and #93 (auto-filed and auto-closed by the CI alert). Issue opened: workspace-lectures#46. Issue reopened: workspace-lectures#41. Bodies edited: workspace-lectures#14, and the merged workspace-lectures#44's body.

1. Reader-facing outcomes

• https://python-advanced.quantecon.org/subjective_beliefs_business_cycles.html and /hansen_jagannathan_1991.html both return 200 and render their figures. Use a browser or a fresh fetch, not a cached local copy.
• The published notebooks at /_notebooks/subjective_beliefs_business_cycles.ipynb and /_notebooks/hansen_jagannathan_1991.ipynb each contain the token data-lectures and zero occurrences of _static/lecture_specific. Grep the basename, never an assembled URL — a URL split across adjacent string literals returns a confident zero to a whole-URL grep, which is how this check gives a false pass.
• Beyond what was tested: actually execute one of those notebooks — open it in Colab from the published page's own launch button and run the data cell. The session confirmed the notebooks contain the new URL; nobody confirmed they run. This is also the last open box on VALIDATION: independent review of the 2026-08-13 Track B migration work (waves B1' and B2') #84.
• The three data URLs return 200 with these exact byte counts: bbh_macro_quarterly.csv 32,217; bbh_michigan_monthly.csv 12,196; hansen_jagannathan_1991_data.json 63,456, at https://github.com/QuantEcon/data-lectures/raw/main/lectures/<file>. Include a never-existed control path and confirm it 404s.
• Beyond what was tested: fetch the same three files over https://raw.githubusercontent.com/QuantEcon/data-lectures/main/lectures/<file> and check access-control-allow-origin. The session used only the github.com/…/raw/ form, which is the CPython form; no browser-runtime fetch was exercised for these files at all.
• The three old paths under python-advanced.quantecon.org/_static/lecture_specific/ still return 200. This is expected, not a regression — the settle policy leaves the site to clear on the weekly cache rebuild plus the next publish. Confirm they are still 200 now, and record the date, so a later check can tell settling from staleness.
• The same three paths on raw.githubusercontent.com/QuantEcon/lecture-python-advanced.myst/main/… return 404.

2. Artifact integrity

• Each of the three files in data-lectures/lectures/ hashes to the integrity.sha256 in its sidecar manifest. Triangulate three ways: a live fetch of the URL, git show origin/main:lectures/<file>, and the value recorded in the manifest. Expected: f14f4256434371877f28da520f1e8b7950187dc23fff78dcc27912e89c0a8d5c, 567efe5a009a30bcfa32c30746bdaa97ce82ba611a98c03d127a662792319426, c81333f372a23465a593db592b04070b7b5732b4919348423d9534942f610029.
• The landed bytes are identical to what lecture-python-advanced.myst held before deletion. Recover the pre-deletion blobs from git history — the deletion merged as f442011, so git show f442011^:lectures/_static/lecture_specific/… gives them — and compare against the data-lectures copies. This is the claim that licenses "the repoint cannot change a figure".
• The figure-equivalence claim, and the question that could void it. The session compared the HTML archives attached to publish-2026aug02 and publish-2026aug17 and found 11/11 and 6/6 figures byte-identical. Re-download both archives and re-derive those hashes independently. Then answer the question the session did not: do any of those 17 figures actually depend on the migrated data? If none of them plot it, 17/17 identical proves nothing about the migration. Identify at least one figure that is computed from bbh_macro_quarterly.csv, bbh_michigan_monthly.csv or the hansen bundle, and confirm that specific figure is among the byte-identical set.
• The session established the aug17 pages were genuinely rebuilt rather than restored from a cached _build/html, via the rendered source: data_path 3→0 and data_url 0→3 in subjective_beliefs_business_cycles.html, data-lectures 0→2 in hansen_jagannathan_1991.html. Re-derive those counts from the archives.

3. The highest-value claim to re-test: the two recovered builders

Most future work rests on this. builders/bbh_macro_quarterly.py and builders/bbh_michigan_monthly.py are claimed to reproduce their committed CSVs byte for byte from the Zenodo deposit 10.5281/zenodo.10194324, which is what licenses builder_status: committed and integrity.upstream.status: verified on both manifests — and what retires two of PLAN Phase 9's builder-recovery items.

• Clone data-lectures fresh, install requirements.txt, and run both builders on a different machine or at least a different Python and pandas version from 3.13.9 / 2.3.3. Confirm git diff -- lectures/ is empty afterwards. A reproduction that only holds at one pandas version is not a reproduction; the float formatting in a to_csv is exactly where that would break.
• builders/bbh_macro_quarterly.py claims to extract a 169 KB member from a 198.8 MB archive using HTTP range requests — roughly four requests and ~296 KB. Verify it is genuinely ranging rather than silently falling back to a full download: watch the bytes transferred, or read _open_archive()'s fallback path and confirm which branch executes.
• Confirm the builders read the Zenodo deposit and not a cached local artifact. Run in a container or a clean home directory with no prior downloads.
• Corroborate the provenance independently of the builders: the Zenodo record 10.5281/zenodo.10194324 should report license cc-by-4.0, publication date 2023-11-22, and a single file replication package.zip of 198,817,944 bytes with md5 6e33f9b9e70135cbf3304275d1c5d604.
• hansen_jagannathan_1991_data.json is recorded builder_status: unrecovered while its manifest claims the construction is fully specified — all 2,462 cells re-derived from Shiller's workbooks and FRED to within 4 ULP. Spot-check that: pick one of the eleven columns and re-derive it from the named upstream. The manifest also records a recovered level factor of 0.8938191876245914 on annual.consumption; confirm that constant reproduces the column and that the earlier value 0.89381918762459 does not.

4. Records written

• All 36 manifests in lectures/*.yml parse under yaml.safe_load, and each filename field equals its own sidecar name.
• For the three new manifests, every measured shape claim reproduces against the bytes: row counts, column names and dtypes, per-column ranges, null counts and their pattern, and the date coverage. Re-measure; do not read the manifest and agree with it.
• The hansen manifest uses a tables: block rather than schema.columns, because the file is a three-table orient='split' bundle. Confirm the three tables are annual (4 columns × 95 rows), monthly (3 × 334) and quarterly (4 × 270), and that the manifest's per-table descriptions match.
• bbh_michigan_monthly.csv.yml records redistribution: restricted. Re-read the University of Michigan Surveys of Consumers usage agreement at https://data.sca.isr.umich.edu/agreement.php and judge independently whether the manifest's characterisation is fair — and whether restricted or something stronger is right, given the deposit's CC BY 4.0 grant comes from depositors who are not the rights holder.
• The dual_recorded check added in Retire 8 stale annotations and make the manifest-or-annotation rule enforceable #90 actually fires. Re-add one retired annotation entry for a manifested dataset, confirm --strict exits 1 naming that file, then revert. This is the one place using build_audit.py is the point.
• openpyxl==3.1.5 in requirements.txt is a real release and is what the two new builders need; confirm they fail without it and succeed with it.

5. Tracker consistency

• Parse migration.yml as YAML — never grep, a prose comment inflates any grep by one — and confirm 36 datasets, all status: repointed, zero landed. Re-derive the count rather than confirming 36.
• Each of the three C1 records names QuantEcon/data-lectures#92 as its landing PR and QuantEcon/lecture-python-advanced.myst#372 as its repoint.
• CATALOG.md regenerates unchanged from scripts/build_catalog.py, and it renders exactly three consumer warning markers — for caron.npy, nom_balances.npy and us_adult_heights.csv, the workspace-lectures#46 readers. The three C1 consumer notes were removed in Flip wave C1 to repointed — the three advanced.myst datasets (Track C) #95; confirm none remain.
• No manifest contains the retired phrase FROM THIS REPO. Backfill the CI-invisible consumers across 16 manifests #91 removed it from eight manifests and Land wave C1 — the three advanced.myst datasets that needed no rename (Track C) #92 reintroduced it in one before Flip wave C1 to repointed — the three advanced.myst datasets (Track C) #95 fixed it; a grep returning zero is the standing regression test.
• scripts/audit_annotations.yml has zero overlap with the set of lectures/*.yml basenames.
• The audit-dashboard and consumed-file-check workflows are green on data-lectures main.

6. Known blind spots

• workspace-lectures#46 records two consumers still reading migrated datasets locally: test-actions-lecture-intro's french_rev.md at lines 709-710 (np.load('datasets/caron.npy') and the same for nom_balances.npy, while the three .xlsx reads at 73-75 in the same file were repointed), and lecture-intro.zh-cn's prob_dist.md:76. Verify both are real, at those lines.
• Verify the stated reason the canary's case is invisible: french_rev is absent from its lectures/_toc.yml, and _config.yml sets only_build_toc_files: true.
• Does the sweep that found these share the blind spot it documents? The count came from grepping four repos outside SCAN_REPOS. Ask what a fifth unlisted consumer would look like and whether the method could see it — the session enumerated lecture-intro.zh-cn, lecture-python.zh-cn, test-actions-lecture-intro and lecture-stats, and that list was not itself derived from anything, it was inherited.
• The deletion-time org sweep covered 277 of 278 repos over the Trees API on default branches only, and Trees matches paths, not content. So a repo that references the files by URL without holding a copy, or holds one on a non-default branch, is invisible to it. Probe that margin: content-search a plausible subset, or check at least one non-default branch.
• The session claimed a lecture-repo merge can turn data-lectures main red "with nothing reporting it". That is wrong as stated — audit-dashboard: the strict build is failing #93 was auto-filed by github-actions when the strict build failed, and auto-closed when it went green. Confirm that alerting path exists and works, and correct the record in Annotate the new bivariate_dist yfinance read — main is red without it #94's PR body and in this repo's notes if it is misdescribed there.

7. Decisions settled today

• dataBHS.mat is 5,588 bytes, MATLAB v5, and holds exactly three (236,1) float64 arrays c, rb, rs. It is 404 on the published site while /_notebooks/five_preferences.ipynb is 200 and calls loadmat('dataBHS.mat') — the basis for calling its conversion a bug fix rather than tidying. Re-check both.
• No filename collision exists in the org for fred_data.csv or acs_data_summary.csv, which is what allowed deferring the Batch rename for the §5.1 generic filenames, paired with their prose edits #87 renames. Re-derive.
• Byte-identical duplicates of acs_data_summary.csv sit in lecture-dp, lecture-dp.monorepo and 2026-tom-course, and of dataBHS.mat in lecture-tools-techniques, python-lecture-sandpit.myst and lecture-mapping. lecture-tools-techniques is public, published, and reads its own copy from its own five_preferences.md. Confirm by blob SHA, and confirm the reads.
• The legacy QuantEcon/lecture-python-advanced is not archived and has no Pages site, contrary to what the work plan asserted.

8. Deliberately not done

• The dead local-path fallback branch in hansen_jagannathan_1991.md's _load_bundle() is unreachable now that DATA_URL is always a URL, and was left in place. Confirm it is genuinely unreachable and that this was recorded as a decision in #372's description rather than missed.
• The three old paths still served by the published site are a settle-policy decision, recorded on workspace-lectures#40, not an incomplete deletion.
• workspace-lectures#41's prune fix is implemented in zero repos and the issue is open. Confirm that is still true and that mpd2020.xlsx: record the repoint (hold until the lecture PRs merge) #41 records the current reasoning.
• The deploy preview on lecture-python-advanced.myst serves no content — every path returns the same 3,449-byte 404, including pages that must exist — so the session could not use it to demonstrate mpd2020.xlsx: record the repoint (hold until the lecture PRs merge) #41. Confirm the preview is genuinely empty rather than that the wrong URL was used.

Where the reasoning lives

data-lectures PLAN.md and AGENTS.md carry the rules and the traps, including the URL-forms table that decides which host each consumer must use. The workspace tracker is workspace-lectures#14; the wave plan and its running commentary are workspace-lectures#45. Per-decision reasoning is in the PR descriptions listed under "What landed" — #92 and #95 in particular carry the reasoning that is not recorded anywhere else.

---

For the validator: work in a session that did not do this work. Do not use the tool named under "Bias to test for" except where a check explicitly says to run it. Re-derive counts rather than confirming them. Where a check can be run against a surface the original session did not exercise, do that too — the margin beyond the checklist is where regressions hide. Deliver: one comment on this issue with a per-item verdict (confirmed / confirmed with caveat / refuted / not completable, with evidence), a new issue for any regression found (do not bury findings in the comment), and leave the checkboxes to the issue owner unless told otherwise.

[mmcky]

Independent validation report — 2026-08-17

Validator independence: this run was done by a session that did none of the C1 work. Interpreters: Homebrew CPython 3.14.7 in fresh venvs (the anaconda 3.13.9 interpreter was never used), pandas 3.0.5 for every re-measurement (plus a second builder run under the pinned 2.3.3 for comparison), and Ruby Psych for one YAML triangulation. scripts/build_audit.py was run exactly once, in the check where running it is the point. All sweeps ran as bash scripts with positive and negative controls in the same pass; reader-facing claims were checked against live fetches, not local copies.

Overall: 41/41 checks completed — 37 confirmed, 4 confirmed with caveat, 0 refuted, 0 not completable. One substantive regression found and filed separately (a fifth unlisted local consumer — see "Regressions filed" below), one documentation discrepancy filed separately, and two of this checklist's own premises needed correction (§6, the #93 item).

1. Reader-facing outcomes

Pages render — CONFIRMED. Both pages 200 (last-modified 2026-08-17 01:56 GMT); every <img> fetched individually — 11 figure PNGs on subjective_beliefs (17,321–167,732 B), 6 on hansen (28,041–43,256 B), zero non-200.

Notebooks carry the new URL — CONFIRMED. Both _notebooks/*.ipynb 200 (115,882 and 56,516 B); token data-lectures = 1 in each, _static/lecture_specific = 0 and even the broader lecture_specific = 0, with positive (import = 13/7) and negative controls in the same pass. The split-URL trap is live in subjective_beliefs (the URL is assembled from data_url + basename), so basenames were grepped too: bbh_macro_quarterly.csv ×1, bbh_michigan_monthly.csv ×1, hansen_jagannathan_1991_data.json ×1.

Notebooks actually run — CONFIRMED WITH CAVEAT. The data-loading cells, extracted verbatim from the downloaded notebooks, execute in a fresh Python 3.14.7 venv: macro_q (260, 14), mich_m (507, 5), DATA_BUNDLE keys annual/monthly/quarterly with shapes (95,4)/(334,3)/(270,4). Caveat: local CPython, not Colab — no headless Colab surface exists. Notable: the pages' launch buttons open the .notebooks mirror repo, not _notebooks/; both mirror copies were fetched and are byte-identical to the _notebooks ones (same sizes, data-lectures = 1, lecture_specific = 0), so the notebook Colab would actually open carries the new URLs. This closes the last open box on #84 to the extent it is closable without a browser.

Data URLs, exact bytes — CONFIRMED. Full downloads via github.com/QuantEcon/data-lectures/raw/main/lectures/: 32,217 / 12,196 / 63,456 bytes by wc -c, exactly as claimed; a never-existed control path 404s through the redirect.

CORS margin — CONFIRMED (as a report). raw.githubusercontent.com serves all three with access-control-allow-origin: *; the github.com/…/raw/ form is a 302 whose first hop carries an empty ACAO header. The notebooks use the github.com form — fine for pandas/urllib, not for an in-browser fetch (consistent with the dl#46 URL-forms table).

Old site paths still 200 (settle policy) — CONFIRMED, dated. As of 2026-08-17 all three _static/lecture_specific/ paths return 200 with byte counts identical to the data-lectures copies (63,456 / 32,217 / 12,196). Expected under the settle policy on workspace-lectures#40; recorded here so a later check can tell settling from staleness.

Upstream raw paths 404 — CONFIRMED. All three 404 on raw.githubusercontent.com/QuantEcon/lecture-python-advanced.myst/main/…, with a positive control (the lecture .md itself, 200) proving the 404s are real absences.

2. Artifact integrity

sha256 triangulation — CONFIRMED. 3 files × 3 methods (live fetch, git show origin/main:, parsed sidecar integrity.sha256) = 9/9 agreement with the three expected hashes.

Pre-deletion bytes identical — CONFIRMED. git diff-tree f442011 shows exactly the three deletions; each blob at f442011^ hashes to the same values. Mapping is a pure directory flatten — the hansen file kept its basename.

Figure equivalence, and the voiding question — CONFIRMED. Both publish tags are releases with ~60 MB HTML tarballs; both were re-downloaded, checksum-verified, and re-hashed: 11/11 and 6/6 byte-identical, filenames independently confirmed to equal content sha256. The question the session did not ask has a good answer: the figures do depend on the migrated data. fig-sbbc-belief-wedges and fig-sbbc-wedge-scatter are computed from the two bbh CSVs (via the VAR forecasts and Carlson–Parkin conversion) and map to _images/d6e6f649… and _images/a6454600…, both in the identical set; all six hansen figures compute from DATA_BUNDLE, e.g. fig-annual-imrs-frontier → _images/46576095…, also identical. At minimum 8 of the 17 are direct data-derived plots. The 17/17 claim is substantive, not vacuous.

Genuinely rebuilt, not cached — CONFIRMED. Re-derived from the archives with controls: data_path 3→0 and data_url 0→3 in subjective_beliefs; data-lectures 0→2 in hansen. Since the data-load cell changed, jupyter-cache could not have reused the old execution — the byte-identical figures came from a fresh run reading data-lectures.

3. The two recovered builders

Byte-for-byte reproduction — CONFIRMED, and stronger than claimed. Fresh clone, clean HOME/XDG_CACHE_HOME, Python 3.14.7, run twice: once with the pinned pandas 2.3.3 and once with pandas 3.0.5. Both builders reproduce their CSVs byte-for-byte under both versions (git diff -- lectures/ empty all four runs) — the reproduction is not an artifact of the pinned version, corroborating the requirements.txt comment that the pin records a measurement rather than guarding a sensitivity.

Range requests, not full download — CONFIRMED. Instrumented via a urllib wrapper: bbh_macro_quarterly.py made exactly 4 requests, all Range/206 (EOCD probe 22 B, 42 B, central directory 34,267 B, member 262,144 B), total 296,475 bytes — matching the docstring to the byte; no Range-less GET, no fallback. Caveat on the sibling: bbh_michigan_monthly.py is also genuinely range-based but transfers 824,944 B against its docstring's "~310 KiB" — filed as a doc-only issue (see below).

Zenodo, not cache — CONFIRMED. Only hostname contacted across all instrumented runs: zenodo.org; caches were freshly-created empty dirs, and the logged byte counts account for the full member payloads.

Provenance corroboration — CONFIRMED. zenodo.org/api/records/10194324: doi, license cc-by-4.0, publication date 2023-11-22, exactly one file replication package.zip, 198,817,944 B, md5 6e33f9b9e70135cbf3304275d1c5d604 — all five facts match.

Hansen spot-check — CONFIRMED, to the last digit. The manifest was executable from its own text: Shiller chapt26.xlsx fetched live (sha256 matches the manifest's recorded hash), column C, 1891–1985. Full factor 0.8938191876245914 reproduces annual.consumption to ≤2 ULP (43/95 bitwise identical, max abs diff 3.638e-12 — exactly the manifest's claim); the truncated 0.89381918762459 fails at up to 16 ULP with 0/95 bitwise identical. The per-row ratios span exactly the six distinct doubles the manifest lists.

4. Records written

36 manifests parse, filenames match — CONFIRMED. Count re-derived: exactly 36; all parse under yaml.safe_load (PyYAML 6.0.3, py3.14); all filename fields equal their sidecar basename.

Shape claims re-measure — CONFIRMED, field by field under pandas 3.0.5. Every claimed row count, dtype, range, null pattern and grid verified — including the fine-grained ones: PCEND's 16 nulls contiguous at 1955Q1–1958Q4, CNP16OV down-steps at exactly 2008Q1/2017Q1/2019Q1, Michigan share-sums spanning 94–100 and equal to 100 in 99 of 507 months.

Hansen tables: block — CONFIRMED. Three orient='split' tables at 95×4 / 334×3 / 270×4 (2,462 cells, zero nulls); index semantics verify (positional strings; unbroken month-end grids), and the maturity spread widens monotonically r3→r12 as the descriptions imply.

Michigan restricted — CONFIRMED, independent judgment. The live agreement's no-redistribution-without-written-consent language matches the manifest's quotation word-for-word; restricted is fair, and nothing stronger is expressible — the schema vocabulary is permitted | restricted, so it is already the maximum. The residual concern (CC BY 4.0 granted by depositors who are not the rights holder; ongoing redistribution) is honestly stated in the manifest and correctly escalated to #35 as a policy decision, not a recording defect.

dual_recorded fires — CONFIRMED (the one sanctioned build_audit.py run). Baseline --strict exits 0; re-adding a retired annotation for bbh_michigan_monthly.csv flips it to exit 1 naming that exact file; reverted, tree clean, committed audit.json untouched.

openpyxl — CONFIRMED. 3.1.5 is a real PyPI release (2024-06-28); both builders fail with a clean ImportError without it (writing nothing) and succeed with it.

5. Tracker consistency

migration.yml — CONFIRMED by parse, never grep: exactly 36 dataset entries, distinct statuses {repointed: 36}, zero landed. (The pending key holds one P4 planning stub with an empty dataset list — it does not affect the count.)

C1 records — CONFIRMED. All three carry landed.pr: QuantEcon/data-lectures#92 and a single repoint QuantEcon/lecture-python-advanced.myst#372, both dated 2026-08-17, cutover: null.

CATALOG.md — CONFIRMED. Regenerates byte-identically; exactly 3 consumer warning markers, on caron.npy, nom_balances.npy, us_adult_heights.csv; zero consumer notes remain on the three C1 rows.

FROM THIS REPO — CONFIRMED. Zero hits (also case-insensitive), with a firing positive control in the same script.

Annotation/manifest overlap — CONFIRMED. 5 annotation entries × 36 manifest basenames, intersection empty, with an injection control proving the zero is real.

Workflows green — CONFIRMED WITH CAVEAT. Latest main runs of audit-dashboard (31985857514) and consumed-file-check (31985857383) both success at 01:44Z. Caveat for the record: the "Land wave C1" merge commit itself concluded failure on audit-dashboard (run 31984234688, 01:11Z) before the follow-up went green — the dl#94 merge-order hazard visibly fired, exactly as documented.

6. Known blind spots

The two known local consumers — CONFIRMED at the exact lines: test-actions-lecture-intro french_rev.md:709-710 (np.load('datasets/caron.npy'), nom_balances.npy; the three .xlsx reads at 73–75 repointed via base_url), and lecture-intro.zh-cn prob_dist.md:76 (local us_adult_heights.csv read, plus a stale line-74 comment still naming the never-created QuantEcon/datasets).

Canary invisibility — CONFIRMED. french_rev absent from _toc.yml (whose header comment documents the trimmed five-lecture canary) and _config.yml:21 sets only_build_toc_files: true.

Does the sweep share its own blind spot? — CONFIRMED — and the blind spot is real: a fifth unlisted consumer exists. QuantEcon/tom-econ370-2025 (public, live Pages site) reads datasets/caron.npy and nom_balances.npy locally at french_rev.md:715-716, holds blob-identical copies, and its base_url still points at lecture-python-intro. A sixth holder/reader: python-lecture-sandpit.myst (public, no Pages) carries caron/nom_balances/dataBHS with three french_rev variants. Found by a 278/278-repo Trees sweep plus tarball content-greps of 12 candidate repos; gh search code returned confident zeros throughout, including for the confirmed caron hit (fork non-indexing). Filed separately — see "Regressions filed". Remaining margin: non-default branches org-wide, forks outside the org.

Non-default-branch margin — CONFIRMED by direct probe: all 55 branches of lecture-python-advanced.myst swept; none holds the three deleted paths, but origin/hansen (2026-04-07) holds an older hansen_jagannathan_1991_data.pkl variant — a concrete instance of exactly the margin the checklist describes.

#93 alerting path — CONFIRMED WITH CAVEAT, and two premise corrections. The alarm is real: #93 was auto-filed by the audit-dashboard notify job (if: failure(), labeled audit-drift, assigned to mmcky), so "nothing reporting it" is wrong as an unqualified claim. But (correction 1) there is no auto-close step — the workflow only files/comments; #93 was closed manually by mmcky at 01:44Z, so this checklist's own "auto-closed when it went green" premise is also wrong. And (correction 2) #94's body needs no edit: its actual sentence is correctly scoped — "…nothing on the lecture-repo side reports it" — and the unqualified phrasing appears nowhere in it.

7. Decisions settled today

dataBHS.mat — CONFIRMED. 5,588 B, MATLAB 5.0 (PCWIN), exactly three (236,1) float64 arrays c/rb/rs by scipy.io.loadmat; today _notebooks/five_preferences.ipynb is 200 and calls loadmat('dataBHS.mat') while the implied /_notebooks/dataBHS.mat (and /, /_downloads/, /_static/ variants) all 404. The bug-fix framing holds.

No filename collision — CONFIRMED, re-derived. Trees basename sweep over 278/278 default branches: fred_data.csv exactly one hit (advanced.myst); acs_data_summary.csv four hits, all the same blob 29a0e219. No same-name-different-content collision anywhere; the #87 deferral stands.

Byte-identical duplicates — CONFIRMED by blob SHA: acs_data_summary.csv = 29a0e219… in lecture-dp, lecture-dp.monorepo, 2026-tom-course; dataBHS.mat = 2fee6622… in lecture-tools-techniques, python-lecture-sandpit.myst, lecture-mapping. lecture-tools-techniques is public with Pages built at tools-techniques.quantecon.org and reads its own copy at five_preferences.md:1882. (Side note: 2026-tom-course's CSV is an orphan — nothing there reads it.)

Legacy repo — CONFIRMED. lecture-python-advanced: archived: false, has_pages: false (/pages 404) — the work plan's assertion was indeed wrong on both counts.

8. Deliberately not done

Dead fallback branch — CONFIRMED. _load_bundle() retains the local-path else: branch; DATA_URL is assigned exactly once to the https URL and is the function's only argument ever passed, so the branch is unreachable. #372's description records it verbatim under "Deliberately not in this PR", including the now-orphaned Path import — a decision, not a miss.

Settle policy recorded — CONFIRMED. workspace-lectures#40 is open and carries the explicit deferral rationale (per-wave chasing = a ~1h50m GPU rebuild each time for no reader-visible benefit), both mechanisms, and the 9-of-11 scope correction.

#41 still unimplemented everywhere — CONFIRMED. Open; verified on three repos' workflows (lecture-python.myst, lecture-python-advanced.myst, lecture-jax — all restore cache artifacts, none prunes restored _build/html; the only removal anywhere is the unrelated .doctrees case #41's own comment carves out). The issue's comments record the full double-auto-close history and the 2026-08-17 re-verification.

Empty deploy preview — CONFIRMED WITH CAVEAT. The claim is true of the deploy-preview alias: deploy-preview-372--….netlify.app returns the identical 3,449-byte 404 for /, intro.html, five_preferences.html and a nonsense path — genuinely empty, not a wrong URL (the commit status still reports success). Caveat: the CI-built preview is intact at the per-deploy permalink URL posted in the PR comment (intro.html 200, 49,071 B there) — so the finding is "the Netlify git-integration alias deploys nothing", not "no preview exists".

Regressions filed

1. Fifth unlisted local consumer — tom-econ370-2025 french_rev.md:715-716 (plus python-lecture-sandpit.myst as holder/reader): QuantEcon/workspace-lectures#47, extending the workspace-lectures#46 list.
2. bbh_michigan_monthly.py docstring understates its network transfer (~310 KiB claimed vs 824,944 B measured; range-reading itself verified): bbh_michigan_monthly.py docstring understates its network transfer (~310 KiB claimed, ~825 KB measured) #97.

Observations for the record (no action required)

• The notebooks read data via the github.com/…/raw/ form — correct for CPython consumers per the URL-forms table, but its 302 hop serves an empty ACAO header, so any future in-browser consumer must switch host, not just path.
• fig-sbbc-belief-wedges' recession shading comes from a live FRED USREC fetch inside the lecture — an input outside data-lectures' integrity guarantees; it happened to be stable across the two builds, so future figure byte-equality is not guaranteed by the migration alone.
• Checkboxes left to the issue owner, per the instructions.