R5 INT19: v19 epoch A (state continuation, closed-row digest, per-pump projection), cohort-close fix, lookup indexes, fp-contract for consumers - #282

…ry (R5 lane V19-C)

PERF-D1 §2.2 / §8 V19-C. The engine fields a run projects from its spec
(capital, point value, FX scalar and curve, tick, commission, the ten
instrument and zone strings) were compared at every callback and
policy-hook boundary and after every batch input. Now:

- NativeExecutionConsumer::PumpScope marks one pump -- a batch's whole
  input loop (pump_batch), or one public stream input (stream_push_bar,
  stream_push_tick, stream_push_ticks, stream_advance_time, the
  finalizing part of stream_end). Inside it check_abort_or_projection
  checks the cooperative abort alone; the pump compares before its first
  input and after its last (a stream: at each public input's two ends).
- Kept immediate: run begin's two compares, and execute_current's guard
  (new check_projection): it is the in-callback execution's own
  precondition -- it must not allocate a point or inspect a written fee,
  FX, tick, calendar or admission setting -- not a callback boundary.
  validate_current_execution / the preview keep their typed
  ConfigurationMismatch refusal.
- pump_batch's log presizing moves into a lambda beside the loop,
  unchanged.

What moves, only for a host that writes a projected field (outside the
contract): the failure latches at the pump's end with operation Input or
Stream and ordinal 0, and the run goes on with the written configuration
until then -- fills, notifications and in-callback executions included.
PERF-D1 §2.2 said only the operation and ordinal move; the tree's
barrier witnesses show the effects move too (finding, reported).

Witnesses rewritten (fail-before on f71cd82, pass-after):
- test_native_projection_witness: 33 cells re-harvested to the
  pump-boundary outcome (op 4, ordinal 0), each marked "expectation
  corrected"; the caught set is the base's (1520 of 1900 writes, 0 lost,
  0 gained); the one field exception is its cell's row now. f71cd82:
  2588 passed, 1254 failed; here 3842 passed.
- test_native_fx_activation: the resolver write (renamed
  ..._fails_at_the_pump_end) and the preview barrier now expect the fill
  the pump made and the Input/0 failure. f71cd82: 7 failures; here 0.
- test_native_current_execution failure_boundaries(2): the physical
  commit's notification is delivered, then the pump fails. f71cd82:
  3 failures; here 0.

ADR-0001 rule 2: (a) mechanism -- a kernel check cadence, identical for
every host, no platform branch; (b) knob -- none, no spec field or hook.

ctest build-on 607/607.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 768a6827481daafe8e220039b305633e2610bd8b)

INT19 conflict resolution: PERF-L1 (slice B) had made check_abort and
check_abort_or_projection inline in native_execution_consumer.hpp with
out-of-line latch_abort / latch_projection_mismatch. Kept that shape (L1
owns it) and carried V19-C's mechanism into it: check_abort_or_projection
returns projection_deferred_ || check_projection(...), and check_projection
is the inline projection_ok + latch_projection_mismatch pair (the same
fail + render V19-C's out-of-line body had); PumpScope and
projection_deferred_ as V19-C wrote them. The out-of-line definitions V19-C
added to the .cpp are dropped; every other hunk applied as written.

…olds closed rows once each -- native-consumer/v9, pineforge-broker-state/v19, stream fingerprint 19 (R5 lane V19-A, step 3)

The continuation (NativeExecutionConsumer::continuation_hash) is a word-wise
fold of the consumer's live state: the cached run-spec digest, the lifecycle,
the book, the live request tables and rosters, the core's two counters, and
three running digests folded once per record when it commits -- a compact
record per committed event (its kind and reason, so a Cancelled receipt's
reason still tells two runs apart), the group-effect receipts (new read-only
WorkingRequestCore accessors) and the cohort receipts. The command history,
the driver log and the account log are no longer folded, so two histories
that reach one state answer one continuation, and a read no longer grows
with the run.

broker_state_hash() folds the closed rows as their count and a running
digest of the six fields v18 walked, each row folded once, when it is final:
once the applied notification of the execution that booked it has returned.
The source host reorders a bar's trailing same-bar bracket exits after
those notifications (sort_same_bar_exit_trades), so it now names the first
row it moved through NativeStrategyHost::native_closed_rows_amended, and the
consumer rewinds to the row before it (one prefix word per row). Rows removed
from the end (a test host's trades_.clear()) are found without a name: the
kernel only appends. Debug builds re-fold every digested row at each run's
end and abort on an unnamed change (verify_closed_rows).

stream_state_hash() folds fingerprint 19.

ADR-0001 rule 2 rulings:
- the state continuation: (a) mechanism -- a fold of the kernel's own
  tables, the same for every host; (b) knob -- none, no option chooses
  what is folded.
- closed-row finality and native_closed_rows_amended: (a) the finality
  point is the kernel's notification boundary, any host's, and a named
  amendment is data (an index); (b) none -- the call reports a change the
  host already made. Row added to "Kernel state the adapter sets".

Witness: tests/test_native_state_continuation.cpp (kernel-only; new row):
completeness differential over every folded member, equal state/equal
value, two histories/one state, Cancelled-reason kept, scaling (4x bars
3.8x CPU; continuation read x0.85 late vs early) and closed-row finality.
Fail-before on f71cd82: the TU does not compile (20 errors, first
"'state_' is a private member"); its public-surface variant fails 6 of 63
(history independence x4, recording 14.4x for 4x the bars, an unnamed
final-row amendment moving the value).

Re-pinned once, each with an "expectation corrected" note: test_native_match_hash_witness,
test_native_intrabar_lower_lookup, test_native_batch_log_presize,
test_native_host_hash_extension, test_native_continuation_view,
test_adapter_report_relower, test_adapter_recording_hash_witness,
test_adapter_host_view_memo_data.hpp, test_adapter_receipts_in_place,
test_adapter_continuation_view; history-dependence expectations inverted
(!= -> ==) in test_native_host_repairs, test_native_resting_replay_contract,
test_native_selected_requests, test_native_limit_fill_through,
test_native_anchored_legs, test_native_anchored_trail_absent_arm.
Trades unchanged: no trade-row field is read by any change here.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 7140fd8cbca2833bb0140244b1c0a0fe671b9ea9)

INT19 conflict resolution: one hunk, invoke_applied_callback. PERF-L1
(slice B) builds the notification frame in place
(current_frame_.emplace(...), with its comment); V19-A inserts the
closed-row finality rewind before the frame is set. Kept both: V19-A's
rewind block, then L1's emplace. Every other hunk applied as written
(the changed lines equal 7140fd8c's patch line for line).

…F-P1's view reverted (R5 lane V19-A, step 4)

PERF-P1 latched the terminal continuation as a view -- the fold's bytes, the
command history's and the driver log's digests left as holes -- because the
v18 fold was those two logs, about a fifth of a Pine run. The v19 fold
(native-consumer/v9) is the consumer's live state alone, so a view records
as many words as the fold mixes, one multiply-xorshift each, and saves
nothing a reader does not pay back.

PineStrategyHost::capture_script_continuation_hash and both
broker_state_hash_projection overrides are the pre-P1 eager latch again;
capture_continuation_view, latched_continuation, fold_continuation_view,
drop_continuation_view, continuation_view_pending, defer_continuation_views,
the StateRecord sink and its buffer growth are deleted, and
continuation_hash() folds straight into its StateFold. What still pays is
kept: the sink-templated hash helpers, which hash_spec instantiates for the
FNV spec digest and the StateFold continuation both.

No value moves: tests/test_native_continuation_view.cpp (kernel-only) and
tests/test_adapter_continuation_view.cpp keep every scenario and every pin
(re-pinned once for v19 in step 3), now run twice each against the pins
instead of eager against deferred.

ADR-0001 rule 2 ruling (the latched-continuation row, rewritten): (a)
mechanism -- any host latches its continuation the same way; (b) knob --
none, the deleted switch was internal. Design §3.8 row C and its paragraph
record the revert.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit d8561ae6b638404dabc1b54d71e406585371c9fc)

INT19 conflict resolution: (1) NativeStrategyHost::
broker_state_hash_projection -- PERF-L1 (slice B) reads the consumer off
the engine slot (NativeExecutionConsumer::bound(*this)); V19-A takes the
latched value itself. Kept V19-A's eager latch
(last_script_continuation_hash_) and L1's slot read on the unlatched arm:
NativeExecutionConsumer::bound(*this).continuation_hash(). (2)
docs/design/native-feature-parity.md -- the base had only re-anchored the
digits of the PERF-P1 paragraph this commit replaces; took V19-A's text.

…w finality, the eager latch; citations re-anchored (R5 lane V19-A, step 5)

- native-engine.md: a section on what the continuation and the broker-state
  hash fold (native-consumer/v9, pineforge-broker-state/v19, stream
  fingerprint 19): live state, not history; the closed-row finality rule and
  NativeStrategyHost::native_closed_rows_amended; the eager latch. The
  recording paragraph and the host-surface table say what a row now costs.
- abi-stability.md: the finality contract and the C++-only amendment call;
  PERF-P1's view reverted with no value moving.
- ADR-0001: the reproducibility bullet's cohort-receipt citation now names
  the once-per-receipt fold.
- design §3.8: row B resolved (each closed row folds once), and the census
  of post-booking writers corrected -- the same-bar exit order reorders final
  rows, and names them now.
- Every citation the lane's source edits moved re-anchored by an exact
  difflib line map from f71cd82 (the tree the pages were anchored against
  at INT17): 270 claimed and 29 unclaimed anchors carried, each claimed one
  accepted only where check_doc_anchors' own judge passes; one rewritten by
  hand (the cohort receipts, above) and two unclaimed ones moved to the
  domain literal's new line.

check_doc_anchors: every documentation anchor resolves to its symbol.
check_doc_lint: 0 offenders.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 301b6c47764424714af9ac0852b2d73abb5befe7)

INT19 conflict resolution (docs only, 64 hunks): 61 where both INT18 and this
commit re-anchored the same citations -- digits only on both sides -- keep
the base's (INT18) digits; the one ADR hunk where this commit changed
words takes this commit's text; the two design hunks where the base changed
words take the base's text. With every digit blanked, each page equals the
3-way merge of its base, INT18 and this commit. The citations are
re-anchored once, at the end of INT19.

The V19-C kernel commit (768a6827) carried its rule-2 ruling in its message
only. "Kernel state the adapter sets" now holds it as a row beside the v19
closed-row and latched-continuation rows: the engine fields a run projects
from its spec are compared at run begin, before every in-callback
execution and at the two ends of every pump; (a) a check cadence of the
kernel's own, identical for every host; (b) no knob. What moves, and only
for a host that writes a projected field: the failure's operation and
ordinal, and the effects the pump makes before its end.

check_doc_anchors, check_doc_lint, check_kernel_residuals (0 findings),
check_design_inventory and check_native_feature_rulings pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 6211dc94686aaa27ffb5eadf8ccb43bd2727a987)

…at the same close bound without a roster books (R5 lane K-COHORT, witness)

test_native_cohort_sliced_close drives a bare NativeStrategyHost through a
realtime stream. Entry A is a limit for three units capped at one a print
(PointBudget), so it books one lot per slice under its one incarnation; a
host-sized close bound to a roster (BindCohort) then closes it. 264 shapes:
long and short; A alone, beside an entry B off the roster, or with B
enrolled; A filled whole (the control), in three slices, or in two with the
third still working at the close; a full and a partial close; no sibling, an
OCA pair of roster closes under either group effect, or a bracket on B;
per-unit and percent fees. Each cohort run is judged against the same close
bound by BindOpenings over the members (rows, book, fill and events equal bit
for bit) and by one BindOpening per member (rows equal lot for lot, under
binary-exact fees). The host's terms facts and a read-only preview of the
same close must name each member once.

Fail-before on d292f19 (the TU compiles against that tree's own headers
with no diagnostic; it uses only existing API): 176 of the 264 cohort runs
abort with code=6 (SettlementFailure) operation=6 (Settlement)
discriminator=8 (InvalidCloseTarget), last_error "native settlement
inspection failed"; the 88 whole-fill controls complete and match both
twins; the four previews answer readiness 8 (InvalidCloseTarget) against the
selected twin's 0 (Applied) in runs that complete. 3264 checks, 196 failures.

Source-free: the kernel-only profile registers the row too.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit d17abfe8160df2b45da0424c525536d148364168)

…er many lots its fills left (R5 lane K-COHORT, fix)

read_target built a CohortClose's target from the book lot by lot: every open
lot whose opening the roster holds added that opening's handle. An opening
that filled in several slices (a PointBudget entry) holds one lot per slice,
so the target listed its incarnation once per lot; inspect_candidate handed
that SelectedOpeningSet to settlement with the duplicates, and
inspect_selected_opening_set refused it with InvalidCloseTarget -- its
documented contract (docs/native-settlement.md: "zero or duplicate
identities ... are refused before effects"; test_native_selected_settlement
pins {11,11}) -- so the run failed "native settlement inspection failed".
The loop dates from 73817c1 (R4 slice C), which introduced the cohort
authority.

read_openings answers the rows in incarnation order, so one opening's rows
are adjacent and identical: keep the first of each run. The cohort close now
selects each opening once and settles all of its lots in roster FIFO order,
as BindOpenings over the same openings and one BindOpening per opening do
(test_native_cohort_sliced_close: 264 shapes, 8668 checks, 0 failures; on
d292f19 176 of its cohort runs aborted).

What moves: only a roster holding an opening with two or more open lots.
Every other roster's rows are already unique and std::unique leaves them
untouched, so a run without such a roster is byte-identical by
construction. With one, the run failed at that close until now; two
read-only observations of such a close also change: the host's
NativeExecutionTermsFacts::scope names the opening once (it named it per
lot), and an inspect_current_execution preview answers Applied (it answered
InvalidCloseTarget without failing the run).

ADR-0001 rule 2: generic. (a) Mechanism: a roster names openings by
identity, and how many physical lots an opening's fills left is a book fact
every venue shares; nothing here names Pine or branches on a platform.
(b) Knob: none -- no spec field, hook, hash input, public header, layout or
epoch; the selection now meets settlement's existing contract. The Pine
adapter emits ImmediateRemaining only, so no Pine opening fills in slices.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit a15f479faa5d1edda956e542c7e2b14e41ccd6f9)

INT19 conflict resolution: PERF-L5 (slice B) moved read_target's body into
read_target_into, where the cohort branch keeps the same per-lot loop and
fills out.openings through read_openings_into (rows still ordered by
incarnation, ties in handle order). Kept L5's read_openings_into call and
applied this commit's std::unique + erase to out.openings right after it --
no allocation, so L5's allocation-free matcher scratch
(scratch_cohort_side reads through read_target_into) is unchanged.
read_target, cached_cohort_target, cohort_side and scratch_cohort_side all
read through read_target_into, so every cohort-close selection names each
opening once. placement_scope_units' BindCohort branch still builds the
per-lot list, but only tests membership while summing each lot once, so
its duplicates change nothing (as K-COHORT found); left as it is.

…s, pinned on f71cd82 (R5 lane PERF-P7, step 1)

The lane turns four history walks into indexes: the applied-reversal purge
and bracket_belongs_to_reversal (every origin a cohort ever had), the
closed-row walk of consume_closed_trade_rows, exit()'s consumed-leg check
(every leg an exit family ever placed), and WorkingRequestCore::definition_for
(a backward history scan per replace-chain link at every cohort_add).

test_adapter_lookup_index_witness pins what four scenarios built to drive
them produce -- reversals between cohorts with brackets live on both sides
and an id that opens on both sides (Flip); two quantity brackets per origin
re-issued every bar, a leg bound to its parent only when the parent fills, a
bracket cancelled and re-issued (Brackets); a far stop re-issued for the
whole run and a limit re-priced every bar, joined to their cohort at every
re-issue (Chains); a leveraged position through margin calls (Margin): every
recorded broker-state row, a read after every bar, the final scalar and
every trade, fresh, on a reused host and with recording off. Harvested by
this TU compiled with -DPINEFORGE_P7_HARVEST against the f71cd82 library;
it passes there (404 checks) and must pass unchanged after every step.

Tests only; no library change.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 27e6adcd5ba416ed9fa79cfe753b1b3d6f0a222e)

…umer's incarnation -> definition index (R5 lane PERF-P7, P7a)

WorkingRequestCore::definition_for answers a request that is no longer
working by scanning the command history backwards for the newest event
naming it, and cohort_add canonicalizes an origin through its whole replace
chain with one such scan per link. A request re-issued for a long time made
every cohort_add walk ever further back: slot 055 (a far stop re-issued daily
and joined to its cohort at each re-issue) spent 70 % of its time there.

The consumer now keeps an incarnation -> definition index over requests_'s
history (src/native_definition_index.hpp, internal): per incarnation, the
position of the newest Accepted/Replaced event naming it and which of its
definitions does, folded in history order with a replace's successor before
its predecessor, so a later fold overwrites exactly as the scan ranks (the
newest event wins; inside a replace the predecessor wins). It only extends
over the events appended since the last sync and is reset with requests_. A
lookup is verified against the history (the entry must name an event whose
definition carries that very handle) and answers only while the index covers
the whole history; anything else falls to the scan, so the answer is the
scan's by construction. Debug builds assert it equals the scan.

WorkingRequestCore gains no member and native_order.hpp is unchanged
(native_order_v6's layout stays frozen until V19-B): the consumer publishes
the index to the core through a thread-local pointer naming the core, only
around the calls that canonicalize or test membership -- cohort_add,
cohort_remove, and the cohort_contains loops of read_target and
placement_scope_units -- and definition_for reads it before its scan. Memory:
one word per incarnation the history names.

ADR-0001 rule 2: (a) mechanism -- a lookup over the core's own history with
no host policy in it; every host's cohort calls take it. (b) knob -- no spec
field, no hook, nothing hash-visible: the index is derived state folded into
nothing, and set_definition_index is a test switch no host reaches. A kernel
implementation change with no calibrated behaviour, so no ADR table row.

Evidence: test_native_definition_index (new, source-free, kernel profile
too) runs 24 randomized books of test_native_match_row_reuse (every intrabar
path, fill recalculation, the price grid) and 8 replace-chain hosts twice,
index on and off: continuation at every bar and fill, broker hash, trades,
event census, every cohort receipt and roster equal; 1,278,769 lookups
answered by the index, none in the reference runs. Fail-before: the TU does
not compile on f71cd82 ("no member named 'set_definition_index' in
'pineforge::NativeExecutionConsumer'"). test_adapter_lookup_index_witness
passes unchanged. Slot 055 (magnifier on, macOS, load 15): 6,100 -> 1,165
ns/bar, broker hash unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 298f95c4a5505877ce2394f0d98538a2503a3655)

INT19 conflict resolution (native_execution_consumer.hpp, additive on both
sides): slice B added set_match_band_precheck (PERF-L5) and
set_point_guards (PERF-L1) where this commit adds set_definition_index /
definition_index_answers / request_core, and its own scratch members where
this commit adds definition_index_ and its switch; kept slice B's
declarations, then this commit's, all at the class tail (none is run
state). The .cpp publication for the cohort loop landed in L5's
read_target_into, the body read_target now delegates to.

…dex, and a closed row visits only the origins carrying units (R5 lane PERF-P7, P7b)

purge_brackets_after_applied_reversal asked, for the from_entry cohort of
every live exit and then for every cohort, whether any origin the cohort
ever accepted is an opening on the side the reversal closed -- a walk of the
cohort's whole roster, which keeps every origin the id ever had -- and
bracket_belongs_to_reversal asks the same for a declined reversal. For a
long/short turn detector (slot 030) that walk ran at every reversal over the
other side's entire history: 26 % self on spark, super-linear in the bars.
consume_closed_trade_rows then walked the trade's roster again for the few
origins that still carry units (21 % inclusive).

Adapter (src/source/pine_adapter.cpp): cohort_opened_on_side answers the
purge's and bracket_belongs_to_reversal's question from a per-cohort pair of
flags folded over the roster as it grows. Exact because the roster only
grows (one push per accepted opening, after its placement row exists) and an
opening row's `opening`/`is_long` are never written after it is remembered,
so the flags only turn on; the fold is keyed by the cohort's facts, whose
node the cohort map never moves (only reset_for_run clears it, and clears
the index too). The closed-row walk now visits, ascending, just the first
roster position of each origin with a unit row -- the only positions the
whole walk can consume at (after one, the row is drained or nothing
remains) -- through the roster's own position index. Debug builds assert the
side answer equals the walk. No adapter member is added: pine_adapter.hpp
gains only private declarations (the LookupIndex type is defined in the .cpp).

Kernel (src/native_execution_consumer.*): NativeHostCache, one opaque slot a
host may park derived lookup state in because its own layout is fixed by a
generated script's ABI (the adapter is a by-value member of
PineStrategyHost). The consumer owns it, drops it at every begin_ready and
never reads it; set_host_cache(false) refuses it, so the host scans -- the
reference the differential row compares against.
ADR-0001 rule 2: (a) mechanism -- storage with no policy and no host
vocabulary, usable by any host; (b) knob -- nothing hash-visible, no spec
field, no hook answer; the switch is a test switch no host reaches.

Evidence: test_adapter_purge_index (new) runs 36 randomized Pine streams --
reversals between cohorts, an id opening both sides, OCA entries of both
effects, brackets live and issued flat, closes, cancels, leveraged runs with
margin calls and declined reversals; chart and magnifier paths, one and two
pyramiding slots, process_orders_on_close, calc_on_order_fills -- twice,
cache on and off: continuation every bar, broker hash every eighth bar,
final values, trades equal; 6,220 cached answers, none in the reference.
lldb hit counts over it: purge 1,362, cohort_opened_on_side 8,982,
revive_brackets_after_margin 108, suspend_brackets_for_reversal 16
(bracket_belongs_to_reversal itself is reached by no stream and no existing
test: it now delegates to the same predicate). Fail-before: the row does not
compile on f71cd82 ("no member named 'set_host_cache'"). Witness rows pass
unchanged (404 + 360 checks). Slot 030, magnifier on, macOS: 5,697 -> 2,583
ns/bar, broker hash unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit a0e12cfdae5b27d9cad4349c96bfcc1e55cf361e)

…m an index over the retained placement rows (R5 lane PERF-P7)

Before exit() places a missing per-origin quantity leg it asks whether that
origin's leg was already consumed: whether any leg its (exit id,
from_entry) family ever placed for that origin and leg kind is a member
neither working nor suspended. The walk visited every leg of the family,
and a bracket re-issued every bar adds legs every bar, so for probe 044 (two
quantity brackets per entry) it ran every bar over the family's whole
history: the walk and its PlacementTable::find calls were ~25 % self on
spark (PERF-D1: exit() 55 % inclusive). Its calc_on_order_fills recross test
also scanned every retained row for an immediate strategy.close placed on
the current bar.

The adapter's lookup index (kept by the consumer, NativeHostCache) now
folds the placement table as it grows: exit legs by bracket origin and leg
kind, immediate closes by the bar they were placed on. Exact because a row's
family, `immediately` and projection_created_bar are never written after it
is remembered, and its bracket_origin only once, from zero to the parent
whose fill binds it, while the leg works (on_applied): a working leg still
on origin zero waits in `unbound` until it is bound (then filed) or stops
working (a handle never works again, so it is never bound). Rows filling a
slot below the table's high water (an anchored leg adopted at its parent's
fill) are found through the empty slots passed over, the table's row count
saying how many filled since. A lookup reads only the rows filed under its
origin and kind -- the only rows the walk's predicate can accept -- and
verifies each against the family (BracketRoster::count, a new inline
accessor over its existing per-incarnation counts), the working book and
the lifecycle exactly as the walk did. PlacementTable::replace, which could
rewrite a filed row, is unreachable here: every remembered handle is fresh
or a never-remembered anchored leg. Debug builds assert both lookups equal
their walks. The table still retains every row (V19-E's work to erase them);
the index holds one entry per exit leg or immediate close it files, never
more than the table's rows. No adapter member: pine_adapter.hpp gains
private declarations and the inline accessor only.

Evidence: test_adapter_exit_leg_index (new) runs 36 randomized Pine streams
-- entries of two or three units, two quantity brackets per origin in their
own groups re-issued around the fill price every bar, a percent bracket,
legs issued while the parent is flat, pyramiding, bracket cancels, closes,
reversals; chart and magnifier, flat and leveraged, process_orders_on_close,
calc_on_order_fills -- with the cache on and off: continuation every bar,
broker hash every eighth bar, final values, trades equal; 2,483 cached
answers, none in the reference. Fail-before: does not compile on f71cd82
("no member named 'set_host_cache'"). test_adapter_lookup_index_scaling
(new): 6,000 vs 24,000 bars, best of five, ratio must stay < 5 -- on
f71cd82 it fails (reversals 9.68, brackets 7.68; per bar 10.2 -> 40.0 and
6.4 -> 22.5 us from 6k to 48k bars), here 3.99-4.28 and 3.94-4.12 (8.2 ->
8.6 and 4.9 -> 5.4 us). Witness rows unchanged. macOS, load 12-17, magnifier
off/on, fingerprints (trades, equity, broker hash) identical: 044 1,810 ->
1,551 / 1,784 -> 1,496 ns/bar; 030 5,341 -> 2,408 / 5,533 -> 2,351; 055
5,618 -> 1,093 / 5,988 -> 1,106.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 88dcb52123d8701e1faf849721ef5fead0120bd8)

…ed through a private bound_consumer() (R5 lane PERF-P7)

Steps P7b and exit() declared the index as a private nested type of
PineExecutionAdapter and defined it out of line, `struct
PineExecutionAdapter::LookupIndex ... {`. scripts/check_doc_anchors.py reads
every braced `struct|class <Name>` line as a scope of <Name>, so that
definition became "the" PineExecutionAdapter scope of pine_adapter.cpp and a
citation qualified `PineExecutionAdapter::on_applied` no longer resolved.

The index is now AdapterLookupIndex, a class in pine_adapter.cpp's anonymous
namespace (cohort keys are the facts' addresses as const void*), and the
header declares only the private accessor that reaches the bound host's
consumer, bound_consumer(), next to the lookups. Nothing else changes: the
same folds, the same verified lookups, the same walks when the consumer keeps
no cache. pine_adapter.hpp still adds no member.

test_adapter_purge_index, test_adapter_exit_leg_index,
test_adapter_lookup_index_witness, test_adapter_lookup_index_scaling and
test_native_definition_index pass unchanged (6,372 / 2,483 cached answers,
404 checks); every doc citation carries onto this tree (0 stuck).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 00b329bffd6f3d7b9a80599efc907a8d6bbb1c64)

…on list is empty (R5 lane PERF-P7)

OriginRoster::push_back leaves an incarnation's position list empty when the
roster's own push_back fails to allocate after the position was reserved.
No roster entry carries that incarnation then, so the whole-roster walk never
visits it; the position-ordered walk now skips it too instead of reading
front() of an empty list.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 0bd746aeca07a5b2f63f946a09f4db71a0d2a40b)

…stead of reaching the consumer's cache (R5 lane PERF-P7)

Reaching the adapter's lookup index costs the host downcast, the consumer and
the cache's type check -- more than walking a short roster or exit family.
Measured on spark (instructions:u, rel drivers, 3 runs, magnifier off/on):
slots whose rosters stay short paid up to +0.24 % instructions for the
index (039 +17M/+15M, 008 +4.1M/+3.6M, 014 +2.7M/+1.2M) while the walks
the index replaces cost them nothing. A cohort roster, exit family or
placement table of at most kIndexedFrom = 16 entries is now walked; above
that the index answers. Either answer is the walk's, so the threshold only
moves cost; the index folds from the start the first time a roster crosses
it.

The randomized differential streams run 320 bars (was 200), with a third
leveraged slide, so the index still answers thousands of lookups in them
(purge row 3,377, exit row 1,025) besides the walks under the threshold.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 42edf3d0500deedc7a8c6b789fd1ed0377e0f021)

…d its publication names the core it serves (R5 lane PERF-P7, P7a)

The consumer synced its incarnation index to the history at every
publication -- every cohort_add, cohort_remove and cohort-bound read_target
/ placement_scope_units -- whether or not any lookup inside the call reached
the history (a working request answers from the book first). On spark that
was slot 039's whole lane cost: +15M instructions over three runs (+0.21 %),
publish_definition_index 0.17 % of its samples.

A publication now only sets the thread-local pair (index, core) and restores
it on return; DefinitionIndex::published_lookup answers only for the core it
names, syncing the index to that core's history first, so the fold runs when
a lookup first needs it and never for a call whose lookups all find working
requests. The answers are unchanged: the index still folds every event
before it answers and verifies each entry against the history.

ADR-0001 rule 2: unchanged from 298f95c4 -- a lookup over the core's own
history, no policy, nothing hash-visible.

Evidence: test_native_definition_index (1,278,769 indexed answers, equal to
the scan), test_adapter_purge_index, test_adapter_exit_leg_index,
test_adapter_lookup_index_witness and test_adapter_lookup_index_scaling pass
unchanged. Spark instructions:u, rel drivers, 3 runs, magnifier off/on, base
f71cd82 -> this tree: 039 +0.026 %/+0.027 %, 008 +0.10 %/-0.01 %, 014
+0.01 %/+0.01 %, 006 -0.05 %/-0.04 %, 004 -0.06 %/+0.01 %, 044 -41.4 %/-40.9 %;
wah broker hash 235509512418453834.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 19249d07163f392a270810bb2729188f129dabd3)

… PERF-P7)

A non-Release library asserts every indexed lookup equal to the walk it
replaces (pine_adapter.cpp's three lookups, native_order.cpp's
definition_for), which restores the walk's cost by design, so the debug
profile cannot hold test_adapter_lookup_index_scaling's 4x-bars < 5x bound
(it ran 216 s there and read 6.60). As test_l4g_runtime_budget does, the row
now gates its ratio on Release only: tests/CMakeLists.txt sets
PINEFORGE_P7_SCALING_GATE=0 for any other build type, and the row then runs
each workload once at a quarter of the length, checks what it produced and
prints the ratio ungated.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 2e663a307d5f23074a52f574856488e34ef88ec5)

…neforge is (lane FPC)

libpineforge.a and libpineforge_kernel.a are compiled with -ffp-contract=off
(TradingView's runtime has no FMA, so every multiply-add rounds twice), but
the option was PRIVATE: no consumer inherited it. A strategy TU inlines the
header-side arithmetic (ta::*, series math) beside the generated Pine
expressions, and on ARM64 / FMA-enabled x86 it fused them. Measured at
d292f19: 89 of the 312 corpus strategy objects held 194 scalar FMAs on this
Mac (the same 89/194 on spark, GCC 13.3 aarch64), 80 of the 201 bench slots
497; the library objects none.

- CMakeLists.txt: both library targets add -ffp-contract=off as an INTERFACE
  compile option. The library's own flags are unchanged (no library object
  recompiles); every target that links pineforge / pineforge_kernel (corpus,
  bench, tutorial, tests, find_package consumers through install(EXPORT))
  now compiles with it. With it the 312 corpus and 201 bench strategy
  objects hold 0 fused instructions, and their trades are byte-identical to
  before on macOS arm64 and Linux aarch64 (312/312 against
  scripts/corpus_parity_baseline.txt, 201/201 bench slots).
- benchmarks/run_all.sh: the hand-compiled canonical indicator runner, which
  inlines ta::*, gets the flag too.
- cmake/smoke_consumer: the find_package consumer ci_verify builds refuses a
  package whose PineForge::pineforge / PineForge::kernel lost the option,
  and its run fails when its own multiply-add was fused (FMA hosts).
  Fail-before against the d292f19 install: configure stops with
  "PineForge::pineforge does not carry -ffp-contract=off to its consumers
  (INTERFACE_COMPILE_OPTIONS: _pf_options-NOTFOUND)".
- docs: README's Pine -> .so recipe, integration-cmake (what the package
  carries, Makefile / pkg-config recipes), ci.md and install.md (the
  smoke checks; install.md named the binary smoke_consumer, it is
  smoke_version), and two CMakeLists.txt anchors the ten inserted lines
  moved.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
(cherry picked from commit 6ce79fb4a513f72b1899bcd2b20e7f702e99afff)

INT19 conflict resolution (docs only): one design-doc hunk where both INT18
and this commit re-anchored digits (this commit: CMakeLists.txt:427-428 ->
437-438 for the ten lines it adds); kept the base's digits -- the
citations are re-anchored once, at the end of INT19. Every other hunk
applied as written.

…h namespace V19-A moved the consumer into

PERF-L1's test_native_host_reads, test_native_lookup_memos and
test_native_point_checks define NativeExecutionConsumerProbe -- the friend
native_execution_consumer.hpp declares -- inside
`inline namespace engine_script_run_v18`. V19-A's step 1 (d23b9d18) moved
the consumer, the host and the engine to engine_script_run_v19 and moved
the same literal in the eight tests it had; these three were written on
f71cd82 after it branched, so their probe declared a different class the
friend does not name and could not read the consumer's private state.
The namespace literal is the only change (six lines); no assertion, pin
or scenario moves.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… once -- every trade, event, count and source fold they pin holds

Slice B (PERF-L1, -L4, -L5) and PERF-P7 pinned values harvested on
f71cd82, an epoch-18 tree. V19-A moves the continuation
(native-consumer/v9), the broker-state hash (pineforge-broker-state/v19)
and nothing else, so exactly the hash values among those pins move; each
is re-pinned once, with its "expectation corrected: <old> -> <new>,
because v19 <fold>" note, from the tests' own harvest switches:

- test_native_match_band_witness (L5): per scenario the trace digest (the
  continuation read at every bar and applied fill), the final
  continuation and the final broker hash -- 18 values; trades, trade
  digest, events, event digest and the three counters hold.
- test_adapter_command_allocations (L5): the recorded broker-state rows'
  digest and the final broker hash of all 16 runs -- 32 values; the host
  projects a fixed execution hash, so only the closed-row fold enters.
- test_native_lean_path (L1): fold, continuation and broker of the 30
  fixed scenarios -- 90 values; trades and every hook's call count hold.
- test_native_point_checks (L1): the 96 abort outcomes, which fold
  native_continuation_hash().
- test_adapter_quiet_bar_pinned.inc (L4): the recorded rows' digest (the
  136 recording runs) and the final broker hash (all 272) -- 408 values;
  the source-fold digest, the trade digest and the three counts hold.
- test_adapter_lookup_index_witness_data.hpp (P7): every recorded row,
  every per-bar read and the final broker hash of the four scenarios --
  944 + 4 values; the 474 trade values hold.

How the values were checked (INT19-scratch/harvest): each TU compiled with
its harvest switch against three libraries -- 6976a80 reproduces every
committed pin verbatim; INT19's tree and V19-A's own tip (6211dc94) print
byte-identical rows, so these are exactly V19-A's v19 values; and the
non-hash columns of every row are equal on 6976a80 and here (the splice
refuses a row whose non-hash column moved). The two composite folds were
decomposed: with their continuation / broker-state reads masked (the
calls kept), lean_path's fold and every point_checks outcome are
identical on 6976a80 and here, and lean_path's per-hook call counts are
identical on all three trees.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…, release 624 -> 631

Counted with `ctest -N` on the integrated tree in each ci_verify profile
(configured with ci_verify's own argv), not summed from the lanes' reports:

  build-ci-release  624 -> 631 registered, all run
  build-ci-kernel   243 -> 246 registered, 245 run (test_native_live_websocket
                    still skips on a system libcurl)
  build-ci-debug    605 -> 612 registered (no floor)

The seven new names, from a comm(1) of the ctest -N lists against the INT18
tree's (6976a80) in each profile, less lane TA1's five rows that main
already counts (test_ta_alma_floor, test_ta_anchored_vwap, test_ta_kc_basis,
test_ta_kc_range, test_ta_pivot_point_levels -- kernel + release + debug):

  V19-A     test_native_state_continuation      kernel + release + debug
  K-COHORT  test_native_cohort_sliced_close     kernel + release + debug
  PERF-P7   test_native_definition_index        kernel + release + debug
            test_adapter_lookup_index_witness, test_adapter_purge_index,
            test_adapter_exit_leg_index,
            test_adapter_lookup_index_scaling   release + debug
  FPC       none

That is exactly what the four reports claimed (V19-A 1/1, K-COHORT 1/1,
PERF-P7 5/1, release/kernel). No row left any profile. TA1's floor comment
block stays as main has it; INT19's follows it. The six citations of the
floor lines, two in CONTRIBUTING.md and four in contributing-llm.md, follow
them (ci_verify.py:177 -> :186, :242 -> :257).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…ans, not a line range that drifted onto unrelated code

src/source/pine_adapter.cpp's owner_tick_fill comment cited
"native_execution_consumer.cpp:2862-2875" for the limit a resolved fill may
not pass. The range was written at 73817c1 (R4 slice C), where it covered
the InvalidTerms refusal in consume_matched_request; every lane since has
moved that file, and on this tree the range lands on unrelated code (lane
K-COHORT found it, on a sibling lane's file, and left it). The comment now
names the check -- consume_matched_request's InvalidTerms refusal -- so it
cannot drift again. Comment only, the same six lines: the Release object
pine_adapter.cpp.o is byte-identical before and after (md5
8d53c63725fe02311506f8e478f72d5d).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Digits only: with every digit blanked, all four pages are identical and
keep their line counts. After the picks 298 anchors were bad (1626 total);
all 1626 resolve now (check_doc_anchors TOTAL 1626 1626 0 0 0; doc lint 0).

Method -- INT17's exact line map, generalized to this wave's origins
(INT19-scratch/tools/int19_exact_reanchor.py): each citation is carried
from the tree its digits were written against -- main 5e62602 (INT18's
and TA1's re-anchors; INT18's pages are 6976a80's), V19-A's tip 6211dc94
(its step-5 docs re-anchored against its own tree), or FPC's tip 6ce79fb4 --
through a difflib line map of that tree's copy of the cited file onto this
one. A claimed anchor must pass the gate's own judge() at its new span; an
unclaimed one moves only when both its lines survive the map exactly. 380
citations moved (1490 anchors resolved from main, 129 from V19-A, 1 from
FPC, and the six floor citations the floors commit already set on this
tree); 1246 kept. Two historical unclaimed CMakeLists.txt spans (design
doc lines 187 and 323) resolve differently from FPC's tip, which never
carried them past the ten lines it added; they take main's line map
(317-320, 351-352), as INT17 and INT18 carried them.

Cross-checks: 369 of the 380 moved spans cite text identical to their
origin's; the other 11 keep both endpoint lines exactly and cover code
the merged lanes edited inside the cited function (run_rich,
invoke_applied_callback, broker_state_hash, capture_script_continuation_hash,
...). Run independently on the pre-re-anchor tree, check_doc_anchors
--fix + reanchor_doc_citations.py (refs: the base and the four lane tips)
leave 21 anchors for a human and keep 49 claimed spans that still pass
only because their symbol also occurs elsewhere inside a stale window
(e.g. `native_matching` native_execution_consumer.cpp:5489-5536, whose
text now sits at 5213-5260); the exact map resolves all of them. After it,
--fix and reanchor_doc_citations.py (refs: main and the four lane tips)
find nothing left to move.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>