FinBot Activity Update v0.3 — patch for the existing Replay Inputs project

Copy gauntlet.py, host_replay_adapter.py, activity_privacy.py, import_history.py,
monitor.html and test_activity.py into the EXISTING extracted replay project.
Keep its vendor/, data/, runs/, replay_config.json, private strategy module and
all existing databases. This ZIP intentionally contains NO replacement database,
strategy configuration, trading engine or historical dataset.

Stop/restart ONLY the gauntlet supervisor to load the new code. Do not stop the
broker gateway or independent trading process. From the replay directory:
  python3 gauntlet.py --adapter host_replay_adapter --continuous --serve
Use the SAME --db path your current run uses if it is not runs/gauntlet.db.
Monitor: http://127.0.0.1:8890/
Phone access still uses your existing authenticated gateway route. This patch
does not deploy a public route, change login or expose a new public service.

New activity
- Each historical quote and source URL supplied to the adapter.
- Macro context supplied to the strategy; no claim of active external news feeds.
- Start of each strategy evaluation and returned decisions, including HOLD and
  empty instruction arrays. Reasons appear only when the strategy supplies them.
- Simulated submitted instructions, execution results and engine rejections.
- Drawdown/halt checks, protective exits, stop changes and floor evaluations.
- Position/account marks and annual income/target deviation.
- Existing error, lesson and proposed-solution records.
Events are persisted to the same SQLite supervisor database as they occur,
including events emitted before an eventual failed year. created_at is the
actual logging time; activity.at is the historical simulation time.
No hidden model reasoning is requested or exposed. It records observable inputs,
outputs and supplied decision explanations, not everything inside an AI model.

Monitor
One-second polling, searchable by payload/type, chronological cursor pagination,
expandable details, pause/resume VIEW (does not pause trading or replay), complete
JSONL download and exact RUN_BLOCKED cause. Browser displays at most1000 cards;
older events stay in the database and can be searched or downloaded. Ingested
history continues from its cursor; there is no 200-event history truncation.
The status endpoint retains its previous 200-event SUMMARY for compatibility.
Thousands of failed attempts do not imply active trading. Current input blockers
remain blockers; this update makes them visible rather than inventing activity.

Older ledger backfill (optional)
  python3 import_history.py --db runs/gauntlet.db --ledgers runs/replay_ledgers
Use your actual database/ledger paths. Archived events are explicitly marked
IMPORTED_ARCHIVED_LEDGER, with their original simulated timestamps. Imports are
atomic and skipped when the same file hash has already been imported, or when
live activity already exists for that attempt/calendar year. Events that were
never recorded cannot be reconstructed. Order filenames must match
attempt_<number>_year_<calendar-year>.json from the previous adapter.

Privacy
Credential-named fields and URL userinfo/query/fragment are redacted before new
telemetry persistence and on reading old payloads. This does not guarantee
recognition of a secret embedded in arbitrary prose: host strategy explanations
must not contain passwords, credentials or tokens. No credentials are requested.

Historical conversation
Not implemented in this patch. A future replay inspection/chat feature should
bind its answers to a selected attempt and simulated timestamp, retrieve only
records available then, label sources and say when evidence is absent. A modern
language model's pretrained knowledge can contain later history; a system prompt
alone cannot establish that it has forgotten that knowledge. Read-only dialogue
should be kept separate from any explicit instruction to change the strategy.
No 1950 replay, historical chat or neural-model training is claimed here.

Validation
28 tests pass in the combined existing project:20 regression tests plus8 activity
checks for complete pagination, filtering, redaction (including legacy reads),
HTTP/export access, archived-import deduplication, and events visible before a
replay year ends. JavaScript syntax checked. Real browser/phone rendering and
Mac installation remain unverified. Missing historical/strategy inputs from
the preceding delivery are not resolved by an observability patch.
