t7 explanation: evidence assembly + one anthropic call behind a strict-json seam

[vlobus]

what

• domain/explanation.py — the trust design: candidates (anomaly + recent news, each sentiment-scored) are built deterministically from stored data and numbered; the LLM returns prose reasoning plus the indices it cites, so it can never mint evidence. ExplainerLLM Protocol is the seam; AnthropicExplainer is the one concrete (SDK import deferred to construction, like FinBERT's torch). Strict pydantic validation of the reply (extra="forbid", index range check, duplicate indices deduped); anything else raises MalformedReply and stores nothing.
• ingest/explain.py — explain_anomaly orchestrator: idempotency check first (an explained anomaly costs no second LLM call), news window [bar_ts - 3d, bar close) so later news can't "explain" an earlier move, sequential to_thread sentiment scoring, one LLM call, commit as one unit of work.
• store/repositories.py — ExplanationRepository (natural-key upsert, on_conflict_do_nothing), NewsRepository.recent_for_symbol with a bounded window.
• config: anthropic_api_key / anthropic_model required, no defaults; .env.example updated.

tests

• LLM mocked everywhere; nothing can hit the live API (no test constructs AnthropicExplainer).
• acceptance proven in integration: mocked LLM → stored Explanation linked to its anomaly by natural key with ≥ 1 EvidenceRef (the anomaly cites itself, so the floor holds even with zero news).
• look-ahead guard: an after-the-fact article seeded past bar close never becomes a candidate.
• idempotency saves the call, malformed reply stores nothing, unknown anomaly raises.
• subagent code review done; the one must-fix (unbounded news window) fixed in the second commit.
• full gate green: ruff, mypy strict, import-linter, pytest (85 passed).