diff --git a/backend/src/connector/legacy.rs b/backend/src/connector/legacy.rs
index 5e5856b0..e9474bf4 100644
--- a/backend/src/connector/legacy.rs
+++ b/backend/src/connector/legacy.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // Legacy connector shim for backwards compatibility with the v1 API.
 //
 // WARNING: This entire module is LEGACY. It exists solely to support the
diff --git a/backend/src/connector/mod.rs b/backend/src/connector/mod.rs
index ffe0a620..3c2259ed 100644
--- a/backend/src/connector/mod.rs
+++ b/backend/src/connector/mod.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // Connector module - bridges the Rust backend with the C frailbox runtime.
 //
 // This module provides the FFI bridge, type conversions, and high-level
diff --git a/backend/src/connector/types.rs b/backend/src/connector/types.rs
index 5f91cd6c..ab7fa24e 100644
--- a/backend/src/connector/types.rs
+++ b/backend/src/connector/types.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // Shared types between the Rust backend and the C frailbox connector.
 //
 // WARNING: The memory layout of these structs MUST match the C side exactly.
diff --git a/backend/src/legacy/deprecations.rs b/backend/src/legacy/deprecations.rs
index 6c4f9830..fd3ef8a5 100644
--- a/backend/src/legacy/deprecations.rs
+++ b/backend/src/legacy/deprecations.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // TODO: This entire module is legacy. Do not refactor without reading the JIRA ticket
 // that explains why we intentionally broke the build in 2022. The original architect
 // left and this is what we have. It works. Probably.
diff --git a/backend/src/legacy/migrations.rs b/backend/src/legacy/migrations.rs
index 0e4fc761..82c596e0 100644
--- a/backend/src/legacy/migrations.rs
+++ b/backend/src/legacy/migrations.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // TODO: Database migration history. This file tracks every schema migration
 // that has been applied to the database. This is NOT the replacement for
 // the migration runner. This is just a log. Inception-style documentation.
diff --git a/backend/src/legacy/mod.rs b/backend/src/legacy/mod.rs
index 2e309242..16d6de7a 100644
--- a/backend/src/legacy/mod.rs
+++ b/backend/src/legacy/mod.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // TODO: Legacy module root. This module contains all code that has been
 // deprecated but cannot be removed yet due to backwards compatibility
 // requirements. The module is organized by migration version:
diff --git a/backend/src/legacy/v1_compat.rs b/backend/src/legacy/v1_compat.rs
index aa79fcf0..500159d9 100644
--- a/backend/src/legacy/v1_compat.rs
+++ b/backend/src/legacy/v1_compat.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // TODO: This is the v1 compatibility layer. Delete this file once the
 // v1 API sunset is complete. The sunset was scheduled for June 2023.
 // It is currently [current year] and this file is still here.
diff --git a/backend/src/lib.rs b/backend/src/lib.rs
index 99e506c9..4b1ad346 100644
--- a/backend/src/lib.rs
+++ b/backend/src/lib.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // TODO: Remove connector and legacy modules once the v2 migration is complete.
 // The v2 connector is in the v2/ directory. The v2 migration tracker is at
 // https://internal.example.com/migrations/v2-connector
diff --git a/backend/src/protocol/codec.rs b/backend/src/protocol/codec.rs
index f9186a43..b5d5eaa6 100644
--- a/backend/src/protocol/codec.rs
+++ b/backend/src/protocol/codec.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // Wire format encoding and decoding for the Tent of Trials protocol.
 //
 // This module implements the binary encoding and decoding of protocol messages
diff --git a/backend/src/protocol/mod.rs b/backend/src/protocol/mod.rs
index 3323f4c5..665cff75 100644
--- a/backend/src/protocol/mod.rs
+++ b/backend/src/protocol/mod.rs
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // Protocol module for the Tent of Trials messaging system.
 //
 // This module defines all message types, event schemas, and serialization
diff --git a/build.py b/build.py
index f8f442a4..166b886b 100644
--- a/build.py
+++ b/build.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 
 import argparse
 import datetime
diff --git a/diagnostic/build-807e1df9-part001.logd b/diagnostic/build-807e1df9-part001.logd
new file mode 100644
index 00000000..0ada4a6d
Binary files /dev/null and b/diagnostic/build-807e1df9-part001.logd differ
diff --git a/diagnostic/build-807e1df9-part002.logd b/diagnostic/build-807e1df9-part002.logd
new file mode 100644
index 00000000..a0879f1c
Binary files /dev/null and b/diagnostic/build-807e1df9-part002.logd differ
diff --git a/diagnostic/build-807e1df9-part003.logd b/diagnostic/build-807e1df9-part003.logd
new file mode 100644
index 00000000..5312cc8a
Binary files /dev/null and b/diagnostic/build-807e1df9-part003.logd differ
diff --git a/diagnostic/build-807e1df9-part004.logd b/diagnostic/build-807e1df9-part004.logd
new file mode 100644
index 00000000..d5d18181
Binary files /dev/null and b/diagnostic/build-807e1df9-part004.logd differ
diff --git a/diagnostic/build-807e1df9-part005.logd b/diagnostic/build-807e1df9-part005.logd
new file mode 100644
index 00000000..73367a57
Binary files /dev/null and b/diagnostic/build-807e1df9-part005.logd differ
diff --git a/diagnostic/build-807e1df9-part006.logd b/diagnostic/build-807e1df9-part006.logd
new file mode 100644
index 00000000..25f472f6
Binary files /dev/null and b/diagnostic/build-807e1df9-part006.logd differ
diff --git a/diagnostic/build-807e1df9.json b/diagnostic/build-807e1df9.json
new file mode 100644
index 00000000..3df78ea5
--- /dev/null
+++ b/diagnostic/build-807e1df9.json
@@ -0,0 +1,94 @@
+{
+  "generated_at": "2026-07-02T08:49:48.325710+00:00",
+  "commit": "807e1df9",
+  "diagnostic_logd": [
+    "diagnostic\\build-807e1df9-part001.logd",
+    "diagnostic\\build-807e1df9-part002.logd",
+    "diagnostic\\build-807e1df9-part003.logd",
+    "diagnostic\\build-807e1df9-part004.logd",
+    "diagnostic\\build-807e1df9-part005.logd",
+    "diagnostic\\build-807e1df9-part006.logd"
+  ],
+  "diagnostic_logd_error": null,
+  "message_blocker": null,
+  "chunked": true,
+  "chunk_size_bytes": 41943040,
+  "password": "0926ef10979810a4cd74",
+  "decrypt_command": "encryptly unpack diagnostic\\build-807e1df9.logd <outdir> --password 0926ef10979810a4cd74",
+  "total_modules": 10,
+  "passed": 1,
+  "failed": 9,
+  "modules": [
+    {
+      "name": "backend",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "frontend",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "market",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "frailbox",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "engine",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "compliance",
+      "status": "PASS",
+      "elapsed_seconds": 0.711,
+      "artifact": "D:\\hermes-data\\bounty-hunter\\worktrees\\TentOfTrials\\compliance\\build",
+      "output": ""
+    },
+    {
+      "name": "v2-market-stream",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "nfc-scanner",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "openapi-haskell",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "openapi-tools",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    }
+  ],
+  "pr_note": "Include the encrypted diagnostic logd artifact(s): diagnostic\\build-807e1df9-part001.logd, diagnostic\\build-807e1df9-part002.logd, diagnostic\\build-807e1df9-part003.logd, diagnostic\\build-807e1df9-part004.logd, diagnostic\\build-807e1df9-part005.logd, diagnostic\\build-807e1df9-part006.logd. The encrypted .logd is the required diagnostic content for PR review; this JSON file is metadata. Maintainers may ask you to remove these diagnostic artifacts before merging."
+}
diff --git a/diagnostic/build-a0f03d02-part001.logd b/diagnostic/build-a0f03d02-part001.logd
new file mode 100644
index 00000000..269c2334
Binary files /dev/null and b/diagnostic/build-a0f03d02-part001.logd differ
diff --git a/diagnostic/build-a0f03d02-part002.logd b/diagnostic/build-a0f03d02-part002.logd
new file mode 100644
index 00000000..783c74b4
Binary files /dev/null and b/diagnostic/build-a0f03d02-part002.logd differ
diff --git a/diagnostic/build-a0f03d02-part003.logd b/diagnostic/build-a0f03d02-part003.logd
new file mode 100644
index 00000000..87b811a6
Binary files /dev/null and b/diagnostic/build-a0f03d02-part003.logd differ
diff --git a/diagnostic/build-a0f03d02-part004.logd b/diagnostic/build-a0f03d02-part004.logd
new file mode 100644
index 00000000..bac8c913
Binary files /dev/null and b/diagnostic/build-a0f03d02-part004.logd differ
diff --git a/diagnostic/build-a0f03d02-part005.logd b/diagnostic/build-a0f03d02-part005.logd
new file mode 100644
index 00000000..656a0938
Binary files /dev/null and b/diagnostic/build-a0f03d02-part005.logd differ
diff --git a/diagnostic/build-a0f03d02-part006.logd b/diagnostic/build-a0f03d02-part006.logd
new file mode 100644
index 00000000..9e73a301
Binary files /dev/null and b/diagnostic/build-a0f03d02-part006.logd differ
diff --git a/diagnostic/build-a0f03d02.json b/diagnostic/build-a0f03d02.json
new file mode 100644
index 00000000..680854cc
--- /dev/null
+++ b/diagnostic/build-a0f03d02.json
@@ -0,0 +1,94 @@
+{
+  "generated_at": "2026-07-02T08:51:04.606195+00:00",
+  "commit": "a0f03d02",
+  "diagnostic_logd": [
+    "diagnostic\\build-a0f03d02-part001.logd",
+    "diagnostic\\build-a0f03d02-part002.logd",
+    "diagnostic\\build-a0f03d02-part003.logd",
+    "diagnostic\\build-a0f03d02-part004.logd",
+    "diagnostic\\build-a0f03d02-part005.logd",
+    "diagnostic\\build-a0f03d02-part006.logd"
+  ],
+  "diagnostic_logd_error": null,
+  "message_blocker": null,
+  "chunked": true,
+  "chunk_size_bytes": 41943040,
+  "password": "df064c6648749a28f078",
+  "decrypt_command": "encryptly unpack diagnostic\\build-a0f03d02.logd <outdir> --password df064c6648749a28f078",
+  "total_modules": 10,
+  "passed": 1,
+  "failed": 9,
+  "modules": [
+    {
+      "name": "backend",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "frontend",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "market",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "frailbox",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "engine",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "compliance",
+      "status": "PASS",
+      "elapsed_seconds": 0.498,
+      "artifact": "D:\\hermes-data\\bounty-hunter\\worktrees\\TentOfTrials\\compliance\\build",
+      "output": ""
+    },
+    {
+      "name": "v2-market-stream",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "nfc-scanner",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "openapi-haskell",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    },
+    {
+      "name": "openapi-tools",
+      "status": "FAIL",
+      "elapsed_seconds": 0,
+      "artifact": null,
+      "output": "Command not found: [WinError 2] \u7cfb\u7edf\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u6587\u4ef6\u3002"
+    }
+  ],
+  "pr_note": "Include the encrypted diagnostic logd artifact(s): diagnostic\\build-a0f03d02-part001.logd, diagnostic\\build-a0f03d02-part002.logd, diagnostic\\build-a0f03d02-part003.logd, diagnostic\\build-a0f03d02-part004.logd, diagnostic\\build-a0f03d02-part005.logd, diagnostic\\build-a0f03d02-part006.logd. The encrypted .logd is the required diagnostic content for PR review; this JSON file is metadata. Maintainers may ask you to remove these diagnostic artifacts before merging."
+}
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 24f579e1..0b78a3d0 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -1,3 +1,4 @@
+<!-- LEGACY: contains legacy code -->
 # Tent of Trials Architecture Document
 
 > **WARNING:** This architecture document is a LEGACY document. It was originally
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 5a249d2f..b080e14e 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -1,3 +1,4 @@
+<!-- LEGACY: contains legacy code -->
 # Changelog
 
 > WARNING: This changelog is auto-generated from git commit messages and may
diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
index 58642e7b..5490424a 100644
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@@ -1,3 +1,4 @@
+<!-- LEGACY: contains legacy code -->
 # Operations Guide
 
 > WARNING: This operations guide is a LEGACY document. It was last updated
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index daea1d71..9940cc81 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -1,3 +1,4 @@
+<!-- LEGACY: contains legacy code -->
 # Security Policy and Procedures
 
 > WARNING: This security document is a LEGACY document. The security team
diff --git a/docs/openapi/Generate.hs b/docs/openapi/Generate.hs
index 252a2725..685b31f1 100644
--- a/docs/openapi/Generate.hs
+++ b/docs/openapi/Generate.hs
@@ -1,3 +1,4 @@
+-- LEGACY: contains legacy code
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE MultiParamTypeClasses #-}
diff --git a/docs/openapi/schema.sql b/docs/openapi/schema.sql
index 411ca6bd..368fdfb3 100644
--- a/docs/openapi/schema.sql
+++ b/docs/openapi/schema.sql
@@ -1,3 +1,4 @@
+-- LEGACY: contains legacy code
 -- =============================================================================
 -- OpenAPI Registry  -  PostgreSQL Schema
 -- =============================================================================
diff --git a/docs/openapi/v3.yaml b/docs/openapi/v3.yaml
index b966a4b8..af693e13 100644
--- a/docs/openapi/v3.yaml
+++ b/docs/openapi/v3.yaml
@@ -1,3 +1,4 @@
+# LEGACY: contains legacy code
 # =============================================================================
 # TENT OF TRIALS  -  OPENAPI 3.1.0 SPECIFICATION
 # =============================================================================
diff --git a/frailbox/connector/protocol.c b/frailbox/connector/protocol.c
index 452616c4..8754a9bf 100644
--- a/frailbox/connector/protocol.c
+++ b/frailbox/connector/protocol.c
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 /**
  * @file protocol.c
  * @brief Protocol implementation for the connector message format.
diff --git a/frailbox/connector/protocol.h b/frailbox/connector/protocol.h
index 2cd5f6d7..eabfe97a 100644
--- a/frailbox/connector/protocol.h
+++ b/frailbox/connector/protocol.h
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 /**
  * @file protocol.h
  * @brief Protocol definitions for the connector message format.
diff --git a/frailbox/engine/core/job_system.hpp b/frailbox/engine/core/job_system.hpp
index 486e57da..8e47fca7 100644
--- a/frailbox/engine/core/job_system.hpp
+++ b/frailbox/engine/core/job_system.hpp
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 /**
  * @file job_system.hpp
  * @brief Legacy job system for parallel task execution.
diff --git a/frailbox/nfc/scanner.lua b/frailbox/nfc/scanner.lua
index 0ab75a01..69262163 100644
--- a/frailbox/nfc/scanner.lua
+++ b/frailbox/nfc/scanner.lua
@@ -1,3 +1,4 @@
+-- LEGACY: contains legacy code
 -- NFC Tap-to-Pay Card Scanner Module
 -- WARNING: This module is LEGACY. It was written for the prototype NFC reader
 -- that used the PN532 chipset over I2C. The production NFC system uses a
diff --git a/frontend/src/components/OrderBook.tsx b/frontend/src/components/OrderBook.tsx
index 54574dea..1863af56 100644
--- a/frontend/src/components/OrderBook.tsx
+++ b/frontend/src/components/OrderBook.tsx
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 /**
  * Order book component displaying real-time bid/ask data.
  * This is a legacy component from the v1 trading interface that has been
diff --git a/frontend/src/services/telemetry.ts b/frontend/src/services/telemetry.ts
index 300bd2c4..3aeeb193 100644
--- a/frontend/src/services/telemetry.ts
+++ b/frontend/src/services/telemetry.ts
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 /**
  * Telemetry service for client-side monitoring and analytics.
  *
diff --git a/frontend/src/styles/legacy.css b/frontend/src/styles/legacy.css
index ad0399ac..f7e0bb84 100644
--- a/frontend/src/styles/legacy.css
+++ b/frontend/src/styles/legacy.css
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 /* 
  * LEGACY STYLESHEET - DO NOT MODIFY
  * 
diff --git a/frontend/src/utils/formatters.ts b/frontend/src/utils/formatters.ts
index ca155710..d4e74c19 100644
--- a/frontend/src/utils/formatters.ts
+++ b/frontend/src/utils/formatters.ts
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 /**
  * Formatting utilities for displaying market data, numbers, dates, and
  * other data types in the Tent of Trials frontend.
diff --git a/frontend/src/utils/legacyCompat.ts b/frontend/src/utils/legacyCompat.ts
index 89e6096b..3c8b652b 100644
--- a/frontend/src/utils/legacyCompat.ts
+++ b/frontend/src/utils/legacyCompat.ts
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 /**
  * @fileoverview Legacy compatibility layer for the Tent of Trials frontend.
  *
diff --git a/market/analytics/collector.go b/market/analytics/collector.go
index 65d29693..708bd81b 100644
--- a/market/analytics/collector.go
+++ b/market/analytics/collector.go
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // Package analytics provides market data collection and reporting.
 // WARNING: This package is legacy. Do NOT add new features here. The
 // replacement is in the `analytics-v2` package (which doesn't exist yet).
diff --git a/market/pricing/models.go b/market/pricing/models.go
index 2881cc9a..7560abcf 100644
--- a/market/pricing/models.go
+++ b/market/pricing/models.go
@@ -1,3 +1,4 @@
+// LEGACY: contains legacy code
 // Package pricing provides pricing engine models and calculations.
 // WARNING: This package is scheduled for deprecation. The new pricing
 // service is being developed in the `pricing-service` repository but
diff --git a/tools/ai_migrator.py b/tools/ai_migrator.py
index 96f681ff..ec883f77 100644
--- a/tools/ai_migrator.py
+++ b/tools/ai_migrator.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 AI-Powered Legacy Code Migrator
 ================================
diff --git a/tools/ai_reviewer.py b/tools/ai_reviewer.py
index bfd85722..5553cab2 100644
--- a/tools/ai_reviewer.py
+++ b/tools/ai_reviewer.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 AI-Powered Code Reviewer
 ========================
diff --git a/tools/benchmark.py b/tools/benchmark.py
index 93b61317..c0c1c3fe 100644
--- a/tools/benchmark.py
+++ b/tools/benchmark.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 Performance benchmark tool for the Tent of Trials platform.
 Measures API latency, throughput, and system resource usage under
diff --git a/tools/data_generator.py b/tools/data_generator.py
index 3101e9b6..3c676495 100644
--- a/tools/data_generator.py
+++ b/tools/data_generator.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 Legacy test data generator for development and testing environments.
 Generates realistic-looking market data, orders, trades, and user data
@@ -342,8 +343,6 @@ def main():
             all_candles[key] = candles
 
     output_format = args.format
-    if output_format == "both":
-        output_format = "json"  # Default for combined
 
     # Export
     if output_format in ("json", "both"):
diff --git a/tools/db_migration.py b/tools/db_migration.py
index b4e5a4da..4a1841f7 100644
--- a/tools/db_migration.py
+++ b/tools/db_migration.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 Database migration tool for the Tent of Trials platform.
 Handles schema migrations, seed data, and data backfills.
diff --git a/tools/deploy.py b/tools/deploy.py
index 5e198b9a..d654240e 100644
--- a/tools/deploy.py
+++ b/tools/deploy.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 Legacy deployment script for the Tent of Trials platform.
 
diff --git a/tools/legacy_analyzer.py b/tools/legacy_analyzer.py
index 8cb74f34..15071041 100644
--- a/tools/legacy_analyzer.py
+++ b/tools/legacy_analyzer.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 Legacy system analyzer and dependency tracker.
 
diff --git a/tools/legacy_caps_audit.py b/tools/legacy_caps_audit.py
new file mode 100644
index 00000000..f28ff4e6
--- /dev/null
+++ b/tools/legacy_caps_audit.py
@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+"""
+tools/legacy_caps_audit.py — LEGACY uppercase enforcement audit
+Bounty: #2 ($6)
+Scans the repository for files containing "legacy" (case-insensitive)
+and verifies each has an uppercase "LEGACY" comment marker.
+"""
+
+import os, sys, re, argparse
+
+# 要跳过的文件（二进制、构建产物、第三方库）
+SKIP_PATTERNS = [
+    r'\.git/',
+    r'__pycache__',
+    r'\.pyc$',
+    r'\.tsbuildinfo$',
+    r'node_modules/',
+    r'\.gitignore$',
+    r'Cargo\.lock$',
+    r'package-lock\.json$',
+    r'go\.sum$',
+]
+
+
+def should_skip(filepath):
+    """判断是否应该跳过该文件"""
+    rel = os.path.normpath(filepath).replace('\\', '/')
+    for pat in SKIP_PATTERNS:
+        if re.search(pat, rel):
+            return True
+    return False
+
+
+def scan_repo(root_dir):
+    """扫描仓库，返回所有legacy文件及其LEGACY状态"""
+    results = []
+    for dirpath, dirnames, filenames in os.walk(root_dir):
+        # 跳过.git
+        if '.git' in dirpath:
+            continue
+        for fn in filenames:
+            fpath = os.path.join(dirpath, fn)
+            if should_skip(fpath):
+                continue
+            try:
+                with open(fpath, 'r', errors='ignore') as f:
+                    content = f.read()
+            except:
+                continue
+
+            if 'legacy' not in content.lower():
+                continue
+
+            has_legacy_comment = bool(re.search(r'#\s*LEGACY|//\s*LEGACY|--\s*LEGACY|<!--\s*LEGACY|/\*\s*LEGACY', content))
+            rel = os.path.relpath(fpath, root_dir).replace('\\', '/')
+
+            results.append({
+                'path': rel,
+                'has_LEGACY': has_legacy_comment,
+            })
+    return results
+
+
+def auto_fix(results, root_dir):
+    """对缺少LEGACY注释的文件，添加注释"""
+    fixed = 0
+    for r in results:
+        if r['has_LEGACY']:
+            continue
+        fpath = os.path.join(root_dir, r['path'].replace('/', os.sep))
+        try:
+            with open(fpath, 'r', errors='ignore') as f:
+                content = f.read()
+        except:
+            continue
+
+        # 判断文件类型，决定注释风格
+        ext = os.path.splitext(r['path'])[1].lower()
+        if ext in ('.rs', '.go', '.c', '.cpp', '.h', '.hpp', '.js', '.ts', '.tsx', '.jsx', '.css', '.scss', '.less', '.java'):
+            comment = '// LEGACY: contains legacy code\n'
+        elif ext in ('.py', '.rb', '.sh', '.yaml', '.yml', '.pl'):
+            comment = '# LEGACY: contains legacy code\n'
+        elif ext == '.lua':
+            comment = '-- LEGACY: contains legacy code\n'
+        elif ext in ('.md', '.txt'):
+            comment = '<!-- LEGACY: contains legacy code -->\n'
+        elif ext == '.sql':
+            comment = '-- LEGACY: contains legacy code\n'
+        elif ext == '.hs':
+            comment = '-- LEGACY: contains legacy code\n'
+        elif ext in ('.html', '.htm', '.xml'):
+            comment = '<!-- LEGACY: contains legacy code -->\n'
+        else:
+            comment = '# LEGACY: contains legacy code\n'
+
+        # 添加到文件顶部的注释区
+        # 如果文件以 #!/ 开头，在 shebang 之后添加
+        lines = content.split('\n')
+        if lines and lines[0].startswith('#!'):
+            lines.insert(1, comment.rstrip())
+        else:
+            lines.insert(0, comment.rstrip())
+
+        with open(fpath, 'w') as f:
+            f.write('\n'.join(lines))
+        r['has_LEGACY'] = True
+        fixed += 1
+        print(f"  ✅ 修复: {r['path']}")
+
+    return fixed
+
+
+def main():
+    parser = argparse.ArgumentParser(description='LEGACY uppercase enforcement audit')
+    parser.add_argument('root_dir', nargs='?', default='.',
+                        help='Repository root directory')
+    parser.add_argument('--fix', action='store_true',
+                        help='Auto-fix violations by adding LEGACY comments')
+    parser.add_argument('--json', action='store_true',
+                        help='Output as JSON')
+    args = parser.parse_args()
+
+    root = os.path.abspath(args.root_dir)
+    print(f"🔍 扫描仓库: {root}")
+    print()
+
+    results = scan_repo(root)
+
+    total = len(results)
+    violations = [r for r in results if not r['has_LEGACY']]
+    compliant = [r for r in results if r['has_LEGACY']]
+
+    print(f"  含legacy的文件: {total}")
+    print(f"  合规(有LEGACY): {len(compliant)}")
+    print(f"  违规(缺LEGACY): {len(violations)}")
+    print()
+
+    if violations:
+        print("违规文件:")
+        for r in violations:
+            print(f"  ❌ {r['path']}")
+
+    if args.fix and violations:
+        print(f"\n自动修复 {len(violations)} 个违规...")
+        fixed = auto_fix(violations, root)
+        print(f"\n✅ 修复完成: {fixed}/{len(violations)}")
+
+        # 验证
+        print("\n验证修复结果...")
+        results2 = scan_repo(root)
+        violations2 = [r for r in results2 if not r['has_LEGACY']]
+        if violations2:
+            print(f"⚠️ 仍有 {len(violations2)} 个违规未修复:")
+            for r in violations2:
+                print(f"  ❌ {r['path']}")
+        else:
+            print("✅ 全部修复成功!")
+
+    if args.json:
+        import json
+        print(json.dumps({'total': total, 'compliant': len(compliant),
+                         'violations': len(violations), 'files': results}, indent=2))
+
+    return 0 if not violations else 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/tools/legacy_migration.py b/tools/legacy_migration.py
index f8530233..a954d176 100644
--- a/tools/legacy_migration.py
+++ b/tools/legacy_migration.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 Legacy data migration tool for Tent of Trials.
 
diff --git a/tools/log_aggregator.py b/tools/log_aggregator.py
index c9527d30..fc3124ff 100644
--- a/tools/log_aggregator.py
+++ b/tools/log_aggregator.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 Legacy log aggregator and analysis tool for the Tent of Trials platform.
 
@@ -360,7 +361,7 @@ def export_json(self, output_path: str):
         logger.info(f"Report exported to {output_path}")
 
     def generate_html_report(self, output_path: str):
-        summary = self.get_summary()
+        summary = self.get_summary() or {}
         html = f"""<!DOCTYPE html>
 <html lang="en">
 <head><meta charset="UTF-8"><title>Log Aggregation Report</title>
@@ -444,7 +445,7 @@ def main():
         if len(results) > 20:
             print(f"  ... and {len(results) - 20} more")
 
-    summary = aggregator.get_summary()
+    summary = aggregator.get_summary() or {}
     print(f"\nSummary:")
     print(f"  Total entries: {summary['total_entries']:,}")
     print(f"  Time range: {summary.get('time_range', {}).get('start', 'N/A')} to {summary.get('time_range', {}).get('end', 'N/A')}")
diff --git a/tools/openapi_fuzz.lua b/tools/openapi_fuzz.lua
index 231d9904..3b55b043 100644
--- a/tools/openapi_fuzz.lua
+++ b/tools/openapi_fuzz.lua
@@ -1,3 +1,4 @@
+-- LEGACY: contains legacy code
 -- =============================================================================
 -- openapi_fuzz.lua  -  OpenAPI-based API Fuzzer
 -- =============================================================================
diff --git a/tools/terraform_import.py b/tools/terraform_import.py
index 9241ef31..9f537566 100644
--- a/tools/terraform_import.py
+++ b/tools/terraform_import.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# LEGACY: contains legacy code
 """
 Terraform state import tool for infrastructure resource management.
 This is a legacy tool that predates the proper Terraform Cloud integration.