Production-readiness probes + engine state-reset / finite-fill fixes - #28

…l sizing

Two source-verified latent bugs (no corpus impact — both paths are
unreachable on the clean, fresh-handle corpus; re-verified 233 excellent
+ 1 anomaly, 0 regressions):

1. Handle reuse leaked state. run() only reserved trades_; it never
   cleared trades_/net_profit_sum_/gross sums/counters, open position,
   pending orders, risk latches, intraday/day counters, or source-series
   history. The C ABI advertises reuse-then-rerun (sweeps), so run 2 on a
   reused handle accumulated — could even start already in a position or
   risk-halted. New reset_run_state() resets the full per-run surface
   (configuration preserved) at the top of every run loop.

2. Silent wrong-qty fallback. calc_qty/calc_qty_for_type returned the raw
   percent/cash number as a contract count when fill_price<=0 or NaN (a
   $0/NaN print sized '10% of equity' as 10 contracts). Now reject
   (qty 0). execute_market_entry drops a fill at a non-finite price so a
   bad tick cannot open a position at a NaN/Inf entry. calc_qty_for_type
   moved to protected so the guard test can exercise it directly.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Eight new ctests (+~1450 assertions; 45 -> 53 ctest) pinning claims a
skeptic would challenge, all green, no TradingView needed:

- determinism_reproducibility : bit-identical fresh-handle reruns
- handle_reuse_reset          : reused handle == fresh (guards the fix)
- exit_path_segment_tiebreak  : same-bar TP+SL / gap priority is
                                deterministic (analytic OHLC oracle)
- accounting_reconciliation   : gross+gross==net, counts, independent
                                per-trade PnL recompute
- ta_volume_state_oracle      : MFI/CMO/WPR bounds + OBV/PVT/AccDist
                                forward-sum identities
- market_structure_fills      : mintick FLOOR snap at ES/gold/FX ticks
- calendar_aggregation_wm     : W/M aggregation (leap Feb, year rollover)
- adversarial_ohlcv           : NaN/Inf/zero/empty feeds stay finite,
                                no silent qty fallback (guards the fix)

Plus scripts/verify_self_test.py: the validator-of-the-validator —
proves verify_corpus.py fails on gross-corrupted trade lists, and
discloses its sub-1% / trailing-block-trim tolerances honestly.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…0, unmatched)

verify_corpus.py historically compared 5 of 10 TradeC fields and gated
at p90. It now ALSO parses + reports qty, pnl_pct, MFE, MAE deltas, plus
p100 worst-case and an unmatched-in-window count — report-only, the tier
gate is unchanged (re-verified 233 excellent + 1 anomaly). Immediately
surfaces previously-hidden divergence (e.g. MAE p90 ~200%, a pnl_pct
tail) feeding findings O5/O7. Also corrects the pnl_pct ABI doc to match
the actual gross price-return formula (was: 'net % of entry capital').

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

PINEFORGE_ENABLE_SANITIZERS existed but CI never set it, so the leak /
NaN / double-free probes ran un-instrumented. Adds a dedicated ubuntu
ASan+UBSan job (library built with sanitizers PUBLIC so instrumentation
propagates into every test binary) running ctest under
detect_leaks=1:halt_on_error=1.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ion)

Automated commit security review flagged reset_run_state() as an
incomplete state-reset fanout — a reused handle still leaked:
  - input.source ring buffers _src_ohlc4_ / _src_hlcc4_ (the two newest
    canonical series were missed)
  - trace buffers trace_buffer_ / trace_names_ / trace_name_index_
  - session-predicate state prev_in_session_ / session_ismarket_ /
    session_isfirstbar_ / session_islastbar_
All now reset (trace_enabled_ preserved — it is configuration). Comment
added requiring EVERY _src_*_ member be listed to prevent the same miss
recurring. ctest 53/53; corpus 233 excellent + 1 anomaly, 0 regressions.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/superpowers/ holds maintainer-only process artifacts (not referenced
by README, the docs site, or CI). The production-readiness design spec I
added there is internal; its reader-facing content lives in
docs/production-readiness-findings.md + docs/tv-parity-probe-spec.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Untrack docs/superpowers/ (11 brainstorming plans/specs) and
docs/production-readiness-findings.md and add both to .gitignore, matching
the existing HANDOFF.md / BENCH_REFRESH_HANDOFF.md policy — these are
maintainer-only artifacts not referenced by the README, the docs site
(Doxyfile ships only docs/pages/* + the public header), or CI. Files are
kept on disk locally, removed from tracking only.

Scrub the now-internal findings.md references from the public surface
(pineforge.h pnl_pct doc, verify_corpus.py comment, tv-parity-probe-spec)
so those stay self-contained. No behaviour change; ctest 53/53.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ree)

The ASan lane failed on Linux: test_matrix aborted with AddressSanitizer
'attempting free on address which was not malloc()-ed' at the PineMatrix
destructor. Root cause: sanitizer COMPILE flags were PRIVATE to the
library, so a consumer TU (the test) linked the instrumented lib but
compiled without -fsanitize -> a different Eigen alignment view than
matrix.cpp. An Eigen matrix allocated in the library and freed
(header-inlined) in the test then mis-freed the aligned offset pointer.
macOS's allocator masked it; Linux caught it.

Fix: make -fsanitize compile options PUBLIC so lib + tests + strategy .so
are instrumented identically, and define EIGEN_MAX_ALIGN_BYTES=0 under the
sanitizer build so Eigen uses plain malloc/free (no offset pointers).
Sanitizer-lane only; normal builds keep full alignment. Local ASan/UBSan:
53/53 pass incl. test_matrix.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>