RELEASE_MIN_TESTS and KERNEL_MIN_TESTS now depend on the private-fixture
overlay, keyed on the environment variable PINEFORGE_PRIVATE_FIXTURES. With
the variable set and non-empty the full floors apply and any ctest row
carrying the private_fixtures label that skips fails the run, naming the row
and the literal it printed; with the variable unset the two run floors are
lowered by the pinned PRIVATE_FIXTURE_ROW_COUNT (112, tests/private_fixture_rows.txt)
so a public run whose placeholders skip is not read as lost rows. The floors
are never lowered further than full minus that count. EXCLUDED_REGISTERED_MIN
is unchanged: ctest -N lists a placeholder's row in both worlds.

scripts/test_ci_verify.py gains red and green controls for both modes plus a
proof that the pinned row list equals the labelled ctest rows, and docs/ci.md
states the overlay-aware rule and names the flag.

…t distributed

Removes the 3,954 private US-equity / non-corpus fixture files from the
public tree. They come from a third-party source and are not distributed in
this repository or in its submodules; the maintainers keep them in a private
repository. Tests that need them report themselves as skipped, naming the
missing file, when it is absent.

LEGAL.md gains a "Data not distributed" section placed after the TradingView
trade-list exports section, and a sentence in the submodule-visibility
paragraph that points to it.

…obes

tests/CMakeLists.txt read fixtures/<root>/tapes.txt at configure time in five
generated-fixture blocks whose files the private-fixture PR removes; file(STRINGS)
on a missing file is a hard CMake error, so the tree would not configure with the
overlay absent. Each read and everything it feeds -- the entry-point list, the
generated module, its sources and its add_test -- is now conditional on the tape
list existing; the absent branch registers the same row as a private-fixtures SKIP
placeholder printing "SKIP private fixtures not present: tests/fixtures/<root>/tapes.txt".
The two roots of the script_rule block are guarded separately, so the module still
builds from the present root. With the files present every target, source and test
is registered as before.

scripts/test_symbol_calendar.py and scripts/test_run_strategy_{mincontract,magnifier,
emit_window}.py built their private-fixture path without the tests/fixtures segment,
so the guard missed the file even with the overlay present and raised unittest.SkipTest
at module import, which exits 1 -- a ctest FAIL, since the rows set SKIP_RETURN_CODE 77
only. Each probe now names tests/fixtures/... and the skip prints the literal and exits
77, the convention the ctest-registered tape rows use.

Every row that skips on the fixture-less tree is now registered with
LABELS private_fixtures and pinned in tests/private_fixture_rows.txt (112 -> 121), and
scripts/ci_verify.py PRIVATE_FIXTURE_ROW_COUNT follows, so the overlay-aware run floors
subtract exactly the rows that skip and no row is lost from the count.

scripts/test_private_fixture_guards.py builds the worlds itself: RED (fixture
absent) must print the skip literal and exit 77, GREEN (fixture present) must
not skip -- one assertion per branch, per probe. Registered as the
test_private_fixture_guards ctest row. The pinned-count comment now names why
the count is 121.

…ations

The guard loop that fails configure when a PINEFORGE_PR_SLOW_TESTS row is not
registered ran before the guarded private-fixture blocks near the end of the
file. One slow row, test_local_time_fields, is registered by its own guarded
block there, not by the TEST_SOURCES loop, so a tree without the private
fixtures aborted with "PR slow row is no longer registered:
test_local_time_fields" before the placeholder could register it.

Move the guard loop and its LABELS slow append, unchanged, to just after the
last guarded block: every slow row is registered by then, on both the
fixture-less (placeholder) and the fixture-present (real test) tree. The list,
the FATAL_ERROR literal and every row's registration are untouched.

… fixture

add_library(outputs_fixture_generated ...) listed the private fixture
tests/fixtures/callback_lifecycle/carried-static-stop/generated.cpp, which the
private-fixture PR removes, so configure aborted at tests/CMakeLists.txt:2571
on a fixture-less tree.

Register the generated module, and the process run that needs both modules,
only when its source exists; register test_run_json_outputs as a
private_fixtures SKIP placeholder when it does not -- the shape the file
already uses for every other fixture-guarded target, so neither the target nor
its add_test exists and nothing references either. The row joins
tests/private_fixture_rows.txt and PRIVATE_FIXTURE_ROW_COUNT moves to 122.

Behaviour with the fixture present is unchanged: the strategy module, the
generated module's compile options, both modules' link and output properties,
and the run are registered exactly as before.

A sweep of every build-file reference to a removed manifest path, and of every
add_library/add_executable in tests/ and runner/, reports no unguarded
reference left.

The seven configure-time generators that read a per-fixture tapes.txt emitted
one "#include \"<case>/generated.cpp\"" per listed case into a generated .inc
and never checked that the file was there. callback_lifecycle/tapes.txt is a
distributed list, so it survives the private-fixture PR while 60 of the 87
cases it names are removed; the emitted callback_lifecycle_tapes.inc named all
60 and the build died on the first of them.

Every case emission is now inside if(EXISTS "<case>/generated.cpp"), so the
generated text never names a file that is not in the tree. Each loop counts
the cases it emitted against the cases its list holds, and the module -- with
the row that reads the whole list -- is registered only when every listed case
is present: a partial module would name cases the run cannot bind, an empty one
no case at all. No list file is edited, no existing guard moves, and the
emitted text is byte-identical when every case is present.

test_callback_lifecycle_tapes is the one row that becomes a private-fixtures
SKIP placeholder on the fixture-less tree (its list survives, its cases do
not), so it joins tests/private_fixture_rows.txt (122 -> 123) and
PRIVATE_FIXTURE_ROW_COUNT follows; the registered population does not move.
pooc_close_fill_view and pooc_close_bar_fills carry no removed file, so their
rows stay real and stay unlabelled.

The fifth configure-through run died compiling test_native_oracle_day_key_l2
at 467/1470: the CMake-level sweeps pinned whole-file references and the
generated .inc lists, but not a quoted #include inside a surviving TU, so
targets whose source reaches tests/oracle/test_oracle_day_key.cpp,
tests/oracle/test_oracle_reversal_same_bar_tx.cpp,
tests/pine_d2c_scenarios_fixture.hpp,
tests/fixtures/coof_forced_waypoint/cases.inc or
tests/fixtures/run_failure_codes/helper_stops/generated.cpp still compiled
with that file absent.

Each affected target now exists only while its removed include does, and the
row is the pinned placeholder printing "SKIP private fixtures not present:
<path>" otherwise: test_native_oracle_day_key_l2 and
test_native_oracle_reversal_same_bar_tx_l2 beside their twin guards,
test_adapter_in_place_reads / test_adapter_runtime_ambient /
test_adapter_settlement_carry in the guarded section,
test_coof_forced_waypoint_tapes before the define loop that consumes its
target, and the test_run_failure_codes executable inside its existing
existence check. tests/private_fixture_rows.txt grows to 129 rows and
PRIVATE_FIXTURE_ROW_COUNT follows it; with every include present the built
targets, rows and commands are unchanged.

…initions

The PR-1 proof box ran five rows that read a removed fixture and failed on
the fixture-less tree. Four of them read a removed file beside a distributed
one, so each splits rather than pinning wholesale: the binary gained a
--private-only mode, the row's own name keeps replaying the distributed part
on every tree, and the removed part is a pinned <row>_private ctest row that
prints "SKIP private fixtures not present: <path>" when the fixture is absent
and otherwise runs the same binary with --private-only. test_carried_trail_open_tapes
reads only the removed tests/fixtures/carried_trail_open files, so its whole
row is pinned. tests/private_fixture_rows.txt grows 129 -> 134 and
ci_verify.py PRIVATE_FIXTURE_ROW_COUNT follows it.

The fixture-dir compile definitions previously ran in if(TARGET ...) blocks
ahead of the guarded private-fixture registrations, so a row registered on a
fixture-present branch compiled without its PINEFORGE_*_FIXTURE_DIR definition
and hit its own #error. The whole definition region (604 lines, unchanged
text) now runs after those registrations, with the ordering contract stated
in a comment: for all 52 pinned rows that carry a fixture-dir definition, the
definition's first line now follows the target's creation.

Files read by file:line and the pinned/split decision per row are recorded in
the lane report (l20/pr1-fix-report.md).

Five checks failed on the fixture-less tree by demanding a file the
private-fixture PR removes. Each now treats exactly the pinned private set as
allowed-absent with a named reason, and stays exact everywhere else:

* check_oracle_sha256.py: the pin (tests/oracle.sha256) moves to schema v2,
  naming the three removed oracle sources under privateFixtureAbsent and
  pinning the aggregate hash of the remaining tree
  (treeSha256WithoutPrivate). Present files must match their pinned hashes,
  unpinned files fail, and a restored private file with other bytes is still
  "content changed".
* check_oracle_twin_census.py: a missing oracle fails unless it is one of the
  three; the CHECK counts and exact-include rules are enforced unchanged for
  every oracle the tree carries.
* check_native_feature_rulings.py: a ruled consumer that is absent is a named
  skip when its row (or a _l4* twin row) is pinned in tests/private_fixture_rows.txt,
  a finding otherwise; present consumers and a tree without the pin file keep
  the previous fail-closed behaviour.
* check_twin_parity.py: an A29 family whose base source the PR removed is
  skipped with a named reason instead of "missing A29 twin"; enforced as
  before when the file is present. This is also what unblocked the real
  source-guard-twin-parity stage, and with it the test_ci_verify driver rows.
* scripts/test_oracle_fixture_checks.py is new: eight controls that build a
  synthetic repo root from this tree and run the two oracle checks for real,
  one green and seven must-fail cases.

…takes

The PR 1b removal moves the remaining 6,242 non-corpus fixture and probe
files (l50/pr1b-inventory.tsv) to the private repository. This commit lands
the guards first, so the tree configures, builds and registers the same
ctest population at every commit of the branch:

- 129 rows whose source .cpp, quoted #include (directly or through a
  surviving header) or fixture data the removal takes are registered by
  EXISTS-guarded blocks with the pinned SKIP placeholder otherwise;
  tests/private_fixture_rows.txt and PRIVATE_FIXTURE_ROW_COUNT move
  129 -> 319 together, and the pinned file's header still names the PR 1
  manifest sha.
- the fixture-fed targets in tests/CMakeLists.txt that compile removed
  sources (checked_settings, strategy_capabilities, qty_step_lot_grid,
  same_calc_bracket, lv_d8_stop_activation, the frozen v1 C header closure,
  the int23 header closure) exist only while their fixture does.
- runner/CMakeLists.txt's checked-settings / strategy-capabilities /
  confirmed-capabilities block is guarded the same way; its
  confirmed_capabilities_policy witness compiles no fixture and stays
  registered beside it.

With the fixtures present every EXISTS is true, so the same targets and rows
register exactly as before and no generated .inc text changes. Sweeps over
the tree report zero unguarded CMake references, zero emitted includes naming
a missing file, zero rows reaching a missing include and zero targets with a
missing source and no guard.

Rebase collision onto 196dbd5 (PR 1's fixes): the four files that carry the
pinned row list met PR 1's 134-row pin in the same regions. Resolved by
script, never by hand:

- tests/private_fixture_rows.txt: the union of PR 1's 134 rows and this
  branch's 319 rows, sorted and de-duplicated -- 324 rows over an overlap
  of 129 shared rows; the header count line moves with it.
- scripts/ci_verify.py: PRIVATE_FIXTURE_ROW_COUNT and its comment move
  319 -> 324 in place; no line is added or removed, so the cited
  ci_verify.py:321 and ci_verify.py:595 anchors do not move.
- runner/CMakeLists.txt: this branch's EXISTS guard block is kept whole
  and PR 1's confirmed_capabilities_refusals.cmake include takes the glob's
  position inside the same guard; the policy witness stays registered.
- tests/CMakeLists.txt: both sides' guards are kept and the fixture-dir
  compile-definition pass moves below the PR 1b guarded registrations.
  Before the move 46 pinned rows' if(TARGET ...) definitions ran ahead of
  their targets and would have been silently dropped; after it every one
  of the 101 defined pinned rows is created before its first definition
  (problems: 0, negative control on the unmoved file: 46).

…ic tree

Remove exactly the 6,242 tests/ paths the PR 1b inventory lists
(l50/pr1b-inventory.tsv, sha256 4c59bcf9e5ec145df37c23f9ac5c63fdd0fc3d97e69ab81b283fc0fb2a90cdec,
built with git rm --pathspec-from-file over field 1; no globs). The private
repository carries them, pinned at 7289c5ae79acec705846c871b97635ee37a93ed4.
docker/run_json_symbol_feeds_test.py stays public by ruling.

The guards landed in the parent commit, so the tree still configures, builds
and registers the same ctest population -- the affected rows register as the
pinned SKIP placeholders instead. Set proof against the parent tree: the
removed set equals the 6,242-path inventory exactly, nothing else
disappeared, and no path outside tests/ was touched.

The private-fixture PRs now cover every non-corpus fixture and probe file the
tests read, not only the US-listed bar series, so the paragraph under "Data
not distributed" states the general rule. The paragraph is inserted from the
campaign's reviewed text byte for byte (sha256
98dd3153110f4d4b3c366ae863178344e0998d4bdebd5f9e42fef9cbd555ffb8), replacing
PR 1's narrower sentence; the "Data not distributed" pointer appended to the
submodule paragraph stays as it is.

…re absent

The private-fixture removal takes tests/fixtures/native_cpp_abi/ and
tests/fixtures/settlement_cpp_abi/ out of the public tree, where
check_settlement_cpp_abi.py read two relocation manifests unconditionally and
prepare_settlement_cpp_abi_base.py maps tests/fixtures/native_cpp_abi/host-*/manifest.json.
Both are now private-aware: before any work they collect the fixture inputs
they read, and when one is absent they print the pinned SKIP literal naming
the missing path and exit 77 -- the code the checker and settlement rows
already carry as SKIP_RETURN_CODE -- instead of failing on read_text();
present, every check runs exactly as before. The gate sits ahead of the
receipt gate, so a fixture-less tree skips in both the manual and the
--require-receipts modes.

scripts/test_ci_verify.py's HistoricalProviderPins class reads the real
host-*/headers.tar bytes (identity() over the fixture path), the one place
among the three suite scripts that does not build its own world; it now
skips when tests/fixtures/native_cpp_abi is absent and runs unchanged with
the overlay. test_ci_docs_only.py and test_verify_corpus_metrics.py name
fixture paths in strings and comments only, inside worlds they build
themselves -- no change.

Controls (all under the lane scratch, logs kept): pre-change checker on the
fixture-less tree -> FileNotFoundError, exit 1; post-change -> the named SKIP
literal, exit 77; with the manifests restored from 87f12832f, verify()
returns the v18->v19 transition (gate opens, checks run); with the manifest's
schema field tampered, verify() still raises "unexpected v18-v19 relocation
schema" (the control can fail). prepare: pre-change -> FileNotFoundError on
the missing host-c3ed455 manifest; post-change absent -> SKIP + 77 before the
build-cache read; post-change present -> proceeds past the gate to the cache
requirement.

…odes

The absent-mode (fixture-less) and present-mode (overlay) S-73 E2E both
stopped before ctest, on defects of one family: a name or a check that
assumes the private files are present.

Name registration (tests/CMakeLists.txt). test_source_buying_power_tapes
was registered twice: the PR 1 split block registered the public row and its
*_private half, and the PR 1b guard block registered the public name again --
absent, add_test refused the duplicate name; present, add_executable refused
the duplicate target. The row now registers once on one EXISTS guard: the
public row and its *_private sibling on the present branch, both pinned SKIP
placeholders with LABELS private_fixtures otherwise. The three other split
rows (test_coof_close_slippage_tapes, test_cross_mechanism_tapes,
test_margin_rules_forward_replay) had the same shape of defect one step
further out: their public rows stayed unconditionally registered although the
private-fixture removals take the whole directory each row reads at run time
(the removed file beside distributed ones in PR 1, the remaining files in
PR 1b), so the fixture-less tree would have run them against absent data.
Each is pinned whole beside its *_private half, exactly as
test_source_buying_power_tapes already was. tests/private_fixture_rows.txt
grows 324 -> 327 and PRIVATE_FIXTURE_ROW_COUNT follows; the two RUN floors
and the EXCLUDED_REGISTERED_MIN counts are unchanged in shape.

Source guards. check_native_cpp_versions.py read
tests/fixtures/native_cpp_abi/host-*/{manifest.json,headers.tar} through
authenticate_historical_host_manifests() and died on read_bytes() when they
were absent; it now collects the same provider inputs the walk reads, and
when one is absent prints the pinned SKIP literal naming the missing path and
exits 77 before any work. check_twin_parity.py's removed_private_test() only
recognized a removed base source; test_small_money_margin_residual keeps its
base source but its only twin tests/test_small_money_margin_residual_l4*.cpp
is removed and pinned, so the family reached find_twin() and failed
(missing A29 twin). The rule now also skips when the base source survives and
the twin is gone and pinned, and the skip report names the removed file
(twin or base) rather than always the base. A removed file without a pinned
row, or a tree with no pin file, still fails closed at every step.

Consumption. ci_verify and ci_preflight accept a source guard's exit 77 as a
named skip only when the pinned literal is in its output -- a bare 77 stays a
failure -- and ci_verify's two new self-tests pin both directions.

Evidence (lane scratch, logs kept): a two-world registration sweep over
tests/CMakeLists.txt and runner/CMakeLists.txt evaluating every if(EXISTS)
both ways reports duplicate names: 0 and duplicate targets: 0 in the absent
and the present world; the source-guard sweep over every ci_verify
source-guard step reports guards without the private-aware path: 0 with two
controls that can fail (a present-but-drifted stub still fails inside the
unchanged authentication; the twin rule still fails closed with no pin file);
the twin-family sweep over the inventory's 155 families reports families
reaching a removed source without the private-aware path: 0. Every guard
that names no fixture path still exits 0 absent. check_doc_anchors resolves
every anchor; test_ci_verify's RowFloorDriver (13) and PrivateFixtureFloors
(10 of 11; the remaining equality row was red at the branch head for the
same static-regex cause) and test_ci_preflight (25) run on this tree.

The combined box's run 1 died at tests/CMakeLists.txt:2314 (add_executable):
the bare-form foreach over the fifteen stream_security cases registered every
target unconditionally, while the second private-fixture removal takes each
case's fixtures/stream_security/<case>/generated.cpp, so configure could not
find the source. Each case now sits on its own if(EXISTS ...) guard: with the
file present the loop registers exactly what it registered before; absent, the
target does not exist and the case's two rows register as the pinned SKIP
placeholders. The four control rows, which reuse the per-case targets, take
the same guard.

tests/private_fixture_rows.txt grows 327 -> 361 (the 30 case rows plus the 4
control rows) and scripts/ci_verify.py PRIVATE_FIXTURE_ROW_COUNT follows, so
the two RUN floors stay lowered by exactly the rows that skip on the
fixture-less tree; the full floor constants and the doc anchors at
ci_verify.py:321 and ci_verify.py:595 do not move.

The four class sweeps' CMake walker expanded foreach(var IN ITEMS|LISTS ...)
but not the bare foreach(var item ...) form, so no source of this loop was
ever expanded or file-checked. The lane's extended walker (scratch
sweep_ext.py: bare form, IN ITEMS, IN LISTS, nested lists, multi-line
commands, quote-aware comment stripping) names the fifteen unguarded target
sources on the branch head and closes at unguarded references: 0, targets
with a missing source and no guard: 0, emitted includes naming a missing
file: 0, rows reaching a missing include: 0; the two-mode registration sweep
closes at duplicate names: 0 and duplicate targets: 0 in both worlds.

L6's S-73 two-mode round 4 (kernel profile, fixtures absent) found six
Python rows reading files the private-fixture removals take out of the
public tree and failing on read_text()/open(): test_native_cpp_abi
(scripts/check_native_cpp_abi.py reads tests/fixtures/native_cpp_abi/),
test_pending_order_v1_full_prefix and test_pending_order_v1_compiler_prefix
(the check_pending_order_prefix* scripts read
tests/fixtures/script_cpp_abi/basev8 and basev9), test_native_cpp_versions
and test_settlement_cpp_abi_tooling (the native_cpp_abi host manifests) and
test_verify_corpus_metrics (the coof_cascade_identity tape).

Absent, each row now skips with the project's pinned literal naming the
missing path. The three whole-row readers print it and exit 77 under the
row's new SKIP_RETURN_CODE 77, and carry LABELS private_fixtures so their
names join tests/private_fixture_rows.txt (361 -> 364 rows, the count
ci_verify.py pins); the three partial readers raise unittest.SkipTest
through skipUnless around the fixture-reading controls and print the
literal once, so every control that reads only the tree keeps running.
Present, every row runs exactly as before.

scripts/ci_verify.py's floor lowering is grounded in the run it checks:
with the overlay absent the two RUN floors are lowered by the pinned rows
the run itself recorded as skipped (capped at the pinned population, never
below the named PRIVATE_FIXTURE_FLOOR_MINIMUM of 1, which used to read
KERNEL_MIN_TESTS - 364 = -39 and check nothing), so an unpinned row that
stops running still trips the floor and a pinned row that leaves the
registry is not excused by a skip it never showed.

Verification on this tree (fixtures absent): check_native_cpp_abi,
check_pending_order_prefix and check_pending_order_prefix_compiler each
print the literal and exit 77 before any work; test_native_cpp_versions
runs 57 tests OK (skipped=9); test_settlement_cpp_abi OK (skipped=8);
test_verify_corpus_metrics OK (skipped=3). test_ci_verify green at the
head that carries this and the following commit.

…loudly

PrivateFixtureFloors.test_pinned_rows_are_exactly_the_labelled_ctest_rows
failed on its old reader: it regexed single-line set_tests_properties calls
in tests/CMakeLists.txt only (so the 53 runner/CMakeLists.txt rows read as
missing), captured the first row name of a multi-row call, and captured the
unexpanded test_stream_security_${security_case} token as a row name.

The comparison now reads both files through a walker that expands the
constructs these files bind row names with -- set(), list(APPEND), foreach
(literal / IN ITEMS / IN LISTS over a bound list), if(VAR STREQUAL|MATCHES
"lit") and OR-chained forms -- follows include() in the including scope,
and raises with file:line on a variable, foreach list, include or row-name
shape it cannot resolve instead of comparing against a silently smaller
labelled set (the T7 hole: a population that means "I did not look"). An
if() it does not model is walked on both branches, which matches the pinned
file's union over both worlds; a STREQUAL/MATCHES on a bound loop variable
is decided because the branch bodies bind different names.

Controls: the green self-test closes pinned == labelled == 364 over the
real tree (verified). The RED control runs the same walker over tampered
copies and asserts three failures -- a labelled row the pin lacks, a pinned
row whose label is gone, and a row name carrying a variable no loop binds
(ValueError naming file:line). The floor tests gained the matching reds:
an unpinned skip buys no headroom, a vanished pinned row still trips, and
the lowering is capped and floored (see the named minimum).

scripts/check_kernel_python_private_reads.py sweeps the other half of the
same class: every Python ctest row in tests/CMakeLists.txt, its local
import closure, and every absent tests/fixtures|oracle path that closure
names must come with a skip path (the pinned literal plus the row's
SKIP_RETURN_CODE/SKIP_REGULAR_EXPRESSION, or a SkipTest), and the sweep
fails loudly on rows it cannot parse (an add_test with a Python command
and no script, an unexpanded script token, an unreadable import, unittest
discovery over a missing directory). On this tree it names 8 rows whose
closure references absent fixture paths without a skip path; they are
constant definitions in imported helper modules, not mode-B reads --
test_private_fixture_guards, gen_pending_order_mirror --check,
test_pending_intent_view and test_script_cpp_abi all exit 0 on the
fixture-less tree (verified), and the three build-bound rows
(test_ci_preflight, test_aggregate_cpp_versions,
test_l4g_runtime_budget_mutations) cannot be executed build-free on this
host, so the sweep keeps naming them rather than excusing them.

…xemption

The sweep's first run named 8 rows whose import closure references absent
fixture paths. Two rules separate a real mode-B read from a reference:
a path named only by a closure module that gates its own reads (the pinned
literal plus a 77 exit -- the settlement-ABI family's gate) is already
private-aware and counts as neither; and one row,
test_private_fixture_guards, is exempt with its evidence printed on every
run -- the paths it names are temp-world payloads (PROBES), not reads:
under a sys.addaudithook(open) trace it opens 0 files under the real
tests/fixtures/ and exits 0 on the fixture-less tree.

Closes on this tree at `kernel python rows reading an absent private file:
0` (exit 0) with the exemption line printed. RED control: a scratch row
whose script reads tests/fixtures/symbol_calendar/.../calendar.json with no
guard is named with file:line and the run exits 1 -- the sweep can fail.
Loud-fail controls: an add_test running Python with no readable script, an
unexpanded ${TREE_ROOT} script token and unittest discovery over a missing
directory each exit 2 naming file:line.

…less tree

L3A_LEGACY_OWNER_TEST_SOURCES intersected with _pf_private_fixture_rows is
17 base-named targets that main never compiles: the REMOVE_ITEM at line 726
takes every legacy-owner base out of TEST_SOURCES, and only their
_l4a/_l4b/_l4c/_l4d twins run, because the bases carry legacy member names
that only the twins' prelude maps. PR 1b's guard blocks registered all 17
(11 public bases, 6 private ones incl. test_coof_resting_stop_siblings), so
a fixture-less configure registered 17 rows main does not have. The guard
blocks are dropped and the names leave tests/private_fixture_rows.txt and
PRIVATE_FIXTURE_ROW_COUNT together (364 -> 347); every twin keeps its guard.

The drop also supersedes the private-repo fix for
test_coof_resting_stop_siblings: with no registration left and main's
REMOVE_ITEM keeping the base out of TEST_SOURCES, the base compiles in
neither world, so the overlay pin stays 7289c5ae.

Verified by reading only (no configure, build or ctest on this host): the
labelled private-fixtures population and the pin agree at 347 --
PYTHONPATH=scripts python3 -B scripts/test_ci_verify.py
PrivateFixtureFloors.test_pinned_rows_are_exactly_the_labelled_ctest_rows:
Ran 1 test, OK.

PRIVATE_FIXTURE_FLOOR_MINIMUM = 1 lowered the overlay-absent RUN floor to a
count that cannot fail: any nonempty run cleared it. Replace it with the
bound the ruling names: the floor never reads below the absent-mode
population the run itself proves -- its own registered count minus the
pinned private-fixture rows it skipped minus this profile's stated
registry/ran margin (release 1, kernel 2, each stated with its derivation).

Controls in scripts/test_ci_verify.py: the absent floor now fails a run one
public row short, on the release floor and on the kernel floor; and a
registered run whose rows nearly all skip fails a floor the replaced
constant of 1 would have passed.

Absent the seven ABI-provider manifests the preparer skips (exit 77, pinned
literal), so test_script_cpp_abi, test_settlement_cpp_abi,
test_aggregate_cpp_versions_runtime and test_l4g_runtime_budget could only
fail their missing receipts under --require-receipts and be named failures by
scripts/check_abi_receipt_skips.py although their input is simply absent.
Register each on the EXISTS guard over the manifests its providers gate on:
present, today's registration unchanged; absent, the pinned SKIP placeholder
(the literal, LABELS private_fixtures, SKIP_RETURN_CODE 77 kept). The four
names join tests/private_fixture_rows.txt (347 -> 351) with their own pinned
accounting.

The preparer's 77+literal is now a skip everywhere it is read: prepare() in
scripts/check_abi_receipt_skips.py reports the role skipped instead of a
failed preparation, and ci_verify.ensure_prepared_provider accepts it as the
action 'skipped'. A bare 77 without the literal stays a failure.

Controls (scripts/test_abi_receipt_skips.py, hand-written rows, no ctest):
absent -> the four are placeholders, no receipt-gated row, exit 0, and
--prepare reports the seven roles skipped; present -> all four gated and
running; the guard sweep reads the real tests/CMakeLists.txt and closes the
10 (row, provider) pairs.

… rows

The private-row re-registration blocks registered their targets on the
fixture guard alone, while the kernel-only filter removes every
TEST_SOURCES row whose include closure reaches pineforge/source (or
compat/pine) -- and the private rows are REMOVE_ITEM'd from TEST_SOURCES
before that loop, so the filter never saw them. With the private fixtures
present the kernel profile therefore built private targets against the
kernel-only archive and died at link with undefined source-layer symbols.

The predicate is now computed once, as the list _pf_kernel_absent_rows,
by pineforge_test_is_source_bound -- the one function the kernel-only
filter also calls, memoised per entry -- and every one of the 228 guarded
private blocks reads it on both branches: a source-layer-bound private row
registers nothing in a profile that does not build the source layer (no
target, no row, no placeholder, no label), and registers through its
private-fixture guard in every profile that does. A row whose public TU
the private-fixture removal took is named by the predicate exactly when
the overlay restores that TU, so it leaves the kernel profile only in the
mode whose target would not link.

scripts/check_kernel_profile_rows.py sweeps it: one predicate definition,
every guarded private block reading the list, the per-profile pinned rows
derived by the same predicate (release 228, kernel 109 on the
fixture-less tree, 119 source-bound rows kernel-absent), both states of
each preparer/row pair (10 checked), closing at
`kernel targets linking without their prerequisites: 0` /
`blocks not reading the predicate list: 0`; it fails loudly (file:line,
exit 2) on a construct it cannot parse. Its controls run the real file
plus tampered copies (a guard removed, a placeholder guard removed, a
receipt guard naming the wrong provider manifest, an unterminated
if(EXISTS), a lost predicate list) and assert each verdict.

…tries

The pin-list reader matched only a line that IS a bare test name, so the
last entry of a set()/list(APPEND) block -- the one written as
test_zero_trail_sibling_stop) with the closing paren on its line -- was
invisible: its guarded block was never checked, and the kernel profile
with the private fixtures overlaid built the row against the kernel-only
archive and died at link with undefined pineforge::source::PineStrategyHost
symbols (A-kernel, iteration 1).

Fix the class in the reader (an optional trailing paren is part of the
entry) and in the block it then flags: test_zero_trail_sibling_stop's
if(EXISTS) guard reads _pf_kernel_absent_rows on both branches, the shape
every other guarded private block already has. The positive control is the
sweep run against the pre-fix tree: it names the row and its line. The
self-test gains the control for the shape (the block reverted to its
if(EXISTS)/else() form): the sweep must fail it, so a paren-terminated pin
entry behind an unread guard cannot recur unseen.

…t found

Iteration 1's fixture-less release run aborted in three rows
(test_coof_marketable_stop_tapes, test_pooc_pending_stop_tapes,
test_pooc_close_bar_fills_tapes): each composes the ORDER_PRINT fixture
root with case literals under a directory the private-fixture removals
take, so every case it replays is absent, and PR 1b's guard set missed
them. Pinning the three instances is not the class.

scripts/check_private_fixture_reads.py is the class, positive control
first: it resolves the paths every registered row names -- from
target_compile_definitions values, quoted #includes, C++ string literals
composed with each fixture root, add_test arguments and the Python tape
drivers' private skip markers -- against tests/private_fixture_paths.txt,
the pinned union of both removal manifests (2,704 removed directories,
10,196 removed files, provenance shas in the header). Every hit must be a
pinned private-fixture row, register only under a guard that names
removed data, or carry a cited proof in tests/private_fixture_reads.evidence
(re-read line by line, so a proof cannot rot). Run against the pre-fix
tree the sweep names the three rows, with the file:line of each literal,
and closes at zero on this tree; the same run names the five driver
markers fixed in the next commit.

The three rows pin whole on a removed file each reads (there is no
distributed half), beside the kernel-absent branch their source-bound TU
needs: pinned rows 351 -> 354, PRIVATE_FIXTURE_ROW_COUNT moving with the
pin file.

…e handed

The private-marker guard added with the SKIP placeholders appended the
fixture directory name to the fixtures argument -- which IS that
directory (add_test passes tests/fixtures/coof_competing_tick and
siblings), so the marker was tests/fixtures/<dir>/<dir>/README.md and
could never exist: each driver printed the pinned SKIP literal and
exited 77 in every mode. The fixture-less runs took that as a correct
skip; the overlay run (A-release, rj-20261011t185619-d9567d) refused the
five skips at its ctest-private-fixtures stage and read them as the
overlay not reaching the tree.

Each marker now names the fixture file relative to the directory the
driver is handed (README.md, or callback_lifecycle's
carried-static-stop/bars.csv), so it is present exactly when the
private-fixtures overlay is and absent without it.
scripts/check_private_fixture_reads.py's marker section is the class
check: it resolves each driver's marker through its add_test argument and
requires a removed file; run against the pre-fix drivers it names all
five, and it closes at zero on this tree.

test_pending_order_v1_canary and test_oracle_stop_snapshot were registered by
pineforge_add_twin_test before their base targets existed (the bases are
private-fixture rows created by guarded blocks further down), so both calls
silently did nothing and the two rows main registers vanished in every world.
Each base now registers inside its own guard together with the twin (the
test_oracle_day_key shape), and the placeholder branch pins the twin too, so
the fixture-absent tree keeps the row as a loud SKIP with the pinned label.
The blocks sit after the label clear that names them: the pinned placeholder
must keep LABELS private_fixtures, which the clear stripped.

…lder

test_pooc_close_fill_view_tapes and test_pooc_close_bar_fills_generated_tapes
registered only inside their present branch, so the fixture-absent tree lost
both rows against nothing, and the 12 confirmed_capabilities refusal shard
rows (requests_1..3, pooc_1..9) had no absent branch at all. Each now
registers the pinned SKIP placeholder naming a removed file it reads; the
shard names derive from the pinned refusal inventory and are listed once.
tests/private_fixture_rows.txt gains the 14 names and PRIVATE_FIXTURE_ROW_COUNT
follows to 368. The 'fully distributed' comment is false and now says what the
guard does.

…re row

Its guard named tests/fixtures/margin_call_rules/bars/f-2025-09-17-2025-09-18.csv,
a file neither of its sources reads; the base row runs the identical command
and passes in every fixture-absent job. Register the twin unconditionally as
main does, drop the pin and move PRIVATE_FIXTURE_ROW_COUNT to 367.

N7: check_abi_receipt_skips.prepare accepted exit 77 plus the pinned literal
even with PINEFORGE_PRIVATE_FIXTURES set, where the overlay IS in the tree
and a manifest the preparer cannot find means the overlay did not reach it.
The skip branch now refuses that shape ("refused: exit 77 ... the overlay
did not reach this provider") and fails the preparation; the absent world's
skip is unchanged, the bare 77 stays a failure.
Control: the new test drives both worlds over the same literal.

…ead, and the overstated statements say what the code does

N8: the file printed the private-fixture skip literal at file scope whenever
tests/fixtures/native_cpp_abi was absent, the signal of a whole-row skip,
while the row is a ctest row of the fixtures-absent public run. The print is
gone: the classes that read the fixtures skip THEMSELVES through
requires_private_fixtures, each stating the pinned literal and the missing
path in its reason, and every tree-reading class -- AbsentModeTextChecks
above all -- runs in both worlds.

Control: test_only_the_fixture_reading_classes_carry_the_skip asserts, on the
live module, that AbsentModeTextChecks and the other tree-reading classes
carry no __unittest_skip__ and that the fixture-reading class does while the
fixtures are absent. Absent-world run: Ran 61 tests ... OK (skipped=9), the
absent-mode text checks among the RAN.

The N3 commit (9cacd0f9c) landed with its doc, lint and test half only: the
RED rig's `git checkout dbf6536e6 -- scripts/ci_verify.py` overwrote the
uncommitted code half before it was staged. This commit carries it --
KERNEL_MIN_TESTS and RELEASE_MIN_TESTS derive from
PRIVATE_FIXTURE_PROFILE_FLOORS, the --min-tests help names the table instead
of the stale "defaults to 325 / to 895", and the doc citations follow the
table to ci_verify.py:788 -- together with the N2/N5 text nits in the same
file: the pin comment no longer quotes a name count that went stale (the
file's header and the constant are the sources), and the "lowered by" note
prints only when the table lowered the floor, not when an explicit
--min-tests happens to equal full minus pinned (min_tests_explicit).
Controls: FloorDocsPointAtTheTable (4 assertions incl. the built --help) and
test_the_lowered_note_prints_only_for_the_tables_own_lowering.

The doc-lint reads the kernel/release floor counts from
PRIVATE_FIXTURE_PROFILE_FLOORS now, so its fixtures write that table with
the same numbers and the aliases deriving from it; the three mustfail and
must-not-fire controls over the floor counts pass unchanged.

…eferences them (the proof kit reads them from the tree)

… as paths

PR 1 + PR 1b removal leaves 146 dead paths and 2 dead links over 18
pages; the doc lint fails on every fixture set, tape file and test
source the docs cite. Rewrite each citation to name the thing by what
it is: "the private fixture set X" for fixtures and tapes, "the
private test test_X" for the removed C++ test sources. The witnesses,
claims and sections are unchanged, and no line moved (17 files, 130
lines, 1:1 substitutions). The four PRIVATE_FIXTURE_PROFILE_FLOORS
citations follow the table from ci_verify.py:788 to :794 (table
definition on this branch); re-point them again after any later edit to
scripts/ci_verify.py. check_doc_lint.py and check_doc_anchors.py both
exit 0.

Sentence leaves, named: every sentence this commit rewrites in place is named
by the commit that wrote it. 1e360bd wrote the magnifier_intrabars cascade
count and 74491fa the pyramiding_open_order citation; d093560 wrote the
half_tick_rounding row on both pages, the pyramiding_open_order row, the six
lab tv tapes sentence, the pending_entry_trail pair and row MG3's project()
comment; 0d76a09 wrote the kernel-edge and test_native_session_day_facts
citations, the kc_a310 scratch counts and the two aggregate-path test names;
4b05b62 wrote test_adapter_margin_relower, f064b1c the
test_native_session_day_facts sentence in native-engine.md, 6b77f06
same_open_reversal, 3c41452 exit_binding, b7ed0ee the confirmed_capabilities
README citation. Each sentence leaves because what it cited is not
distributed: the line now says the private fixture set or the private test
the sentence named, keeps every claim and witness, and no line moved.

Co-Authored-By: Claude Code <[email protected]>

…ext (adcc8b2c, byte for byte)

…with its empty trace stated

…it, and the summary names what it could not check

…e skips without the overlay

…ci_verify carries a 3600 s bound

…ral form the tree now fixes

…and one that raised fails the trace

The tracer ran targets through runpy.run_path, which puts no directory on
sys.path for a script FILE, so check_two_world_registration.py died at
`import ci_verify` and its exemption traced vacuously. The tracer now inserts
the target's directory first on sys.path (what `python <script>` does), passes
the row's own argv, runs from a neutral cwd, records the script's exit code,
and exits 4 -- distinct from the 3 of a private open -- when the script raised,
so a script that dies before its work can never trace clean. Every
run_under_trace consumer treats the new code as a failure naming that.

Co-Authored-By: Claude Code <[email protected]>

… is named, and the clean copy traces green

Lane FR's third exemption was traced vacuously: the copied script stopped at
`import ci_verify`, so control 12 passed without it ever running. Control 15
copies check_two_world_registration.py into the scratch dir with the local
modules its imports need (ci_verify, prepare_settlement_cpp_abi_base,
check_private_fixture_reads) and runs it through the fixed tracer with the
row's argv plus --root REPO (the copy's own __file__ would name the scratch
tree). The RED copy additionally opens tests/fixtures/whole_lot_tie/bars.csv
-- absent in both worlds: the pin empties the directory and bars.csv is not
one of its F lines, so the overlay restores no such file, while the hook
records exactly the missing paths under the real private trees. It must be
named, exit 3 and still record the copy's own exit 0, so the RED fails for
the open, never for an import error. The GREEN copy, no open, traces 0/0.

Co-Authored-By: Claude Code <[email protected]>

…IN_TESTS literals

155a46a07 made the two floors plain module-level literals with the table
referencing them, and updated the test fixture but not the checker, which still
read the numbers out of the table tuple. The real tree derived None for both,
so test_doc_lint failed on the lab kernel job (4 failures in
scripts/test_check_doc_lint.py). The checker now reads the two literal lines.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… 337/309

The campaign's floors were measured on 6d7b2bf (release 902/605, 297
pinned; kernel 331/303, 28 pinned). Four Lab jobs at 024fdf92c re-measured
both worlds: release overlay rj-20261012t003156-430909 printed 910 tests with
0 skipped (300 of the 910 in tests/private_fixture_rows.txt) and its absent
twin rj-20261012t003153-098c2a registered the same 910, ran 610, skipped
exactly those 300; kernel overlay rj-20261012t003157-d19ae9 printed 337 with 0
skipped (28 pinned) and its absent twin rj-20261012t003154-1c9988 registered
337, ran 309, skipped those 28. So RELEASE_MIN_TESTS goes 902 -> 910 with the
release pinned count 297 -> 300, KERNEL_MIN_TESTS 331 -> 337 with the kernel
pinned count unchanged at 28, and the derived absent floors become 910 - 300 =
610 and 337 - 28 = 309.

The measurement comment block above the literals keeps its line count so
ci_verify.py:794 (the table line three docs pages cite) does not move; it now
names the four jobs and what each printed. Every pin that restated the old
numbers follows: the floor-table pin and FULL_FLOOR/ABSENT_FLOOR literals in
scripts/test_ci_verify.py, its truncated-pin control's row count, the
one-above/one-below shapes (337 - 27 = 310 against the 309 floor; 308 ran with
the websocket allowance), the never-lowered --min-tests case (an explicit 325
still fails 309, an explicit 309 is still verbatim), and docs/ci.md's floors
table plus the sentence citing it. The shrunken-registry RED keeps its
measured shape (901 registered, 298 pinned, 603 ran) and now states the 610
(910 - 300) the rule compares it against.

Co-Authored-By: Claude Code <[email protected]>

…sitory

The Scripted harness executes the real source guards against ROOT, and the
ctest row pins TMPDIR to <build>/tmp (tests/CMakeLists.txt), a path a ctest
build dir puts inside the source tree. check_native_cpp_versions.py refuses
exactly that -- 'system temporary directory is inside the repository', raised
in historical_tempdir before any provider is extracted -- so in the OVERLAY
world the guard exited 1 and ci_verify failed source-guard-native-versions
before configure: every scripted Driver test, the preparation recipe and the
direct guard control died on it (the lab release and kernel overlay jobs, 130
and 88 assertion failures, each summary carrying that one stage). The absent
world never saw it because there the same guard answers its pinned 77 before
it needs a temp area; and the inherited PINEFORGE_PRIVATE_FIXTURES is not the
cause -- setUpModule already pops it for the module's absent-world tests.

guard_environment() now hands each real guard run the temp area its own
contract allows: the environment's own when that already lies outside the
tree, else the platform temp dir the row's pin replaced (TMPDIR/TEMP/TMP
masked for one tempfile lookup and restored immediately). The one Scripted
fallback that executes real .py guards covers every scripted Driver test; the
direct control that runs source_guard_commands(ROOT) takes the same env. The
guards stay real -- same argv, same tree, same literal checks -- and each
still fails the suite when the guard's own work fails: a mutated
check_native_cpp_versions.py body (or a red guard in the overlay world, as
this head was) puts source-guard-native-versions back in the failure list.

Co-Authored-By: Claude Code <[email protected]>

test_absent_manifests_make_the_four_rows_pinned_skips_not_failures builds the
absent world and then drives the real preparer, which reads
PINEFORGE_PRIVATE_FIXTURES live: in Lab's overlay job the inherited flag was
set, so ensure_prepared_provider refused the pinned literal ("refused: exit 77
with 'SKIP private fixtures not present: ' while PINEFORGE_PRIVATE_FIXTURES is
set, so the overlay did not reach this provider") and the test failed -- the
only failure that row had in either overlay job.

The module now declares the world its tests describe: setUpModule pops the
variable and tearDownModule restores it, as scripts/test_ci_verify.py already
does for the same reason, and the absent-manifests test also states it
explicitly around its body. The overlay answer to the same literal keeps its
own test (test_the_overlay_refuses_the_preparer_skip sets the flag itself, and
its second half sets the empty absent world), so both worlds are asserted, not
blurred: with the absent world faked present the pinned-skip assertions go red,
and with the preparer's literal-contract broken they go red in both worlds.

Co-Authored-By: Claude Code <[email protected]>

…s world

PrivateTestCitations' two real-citation controls asserted the removed-tree
shape outright, so with Lab's overlay in the tree test_native_feature_rulings_
mutations failed twice: (ROOT / 'tests/test_native_price_grid.cpp').exists()
was True where the test demanded False, and the checker counted the unit it
found -- the summary read '10 of 10 rulings backed by an executed native
consumer' with no private-consumer note, not the '9 of 10' papered over by the
pin files.

Both now branch on which tree they are describing and each branch asserts its
own whole expectation. Absent: the unit is really gone (a file left at that
path would be a missed removal) and the summary is '9 of 10' plus the note
naming tests/test_native_price_grid.cpp. Present: the unit the pin files name
is the file the tree carries, it really spells the two fields the ruling rules
(price_grid, grid_rounding -- the consumer claim the pinned-unit branch turns
on), and the summary is '10 of 10' with no note. Each branch still fails:
mutate the unit's field text and the present branch goes red; put the file
back in an absent tree and the absent branch does.

Co-Authored-By: Claude Code <[email protected]>

The two rows carried a closure marker whose only witness was the private
test test_native_price_grid; lane FQ's rewrite cites it as "the private
test" with no file name, and check_design_inventory.py refuses a closure
marker that names no source-free witness.

The capability is witnessed in the public tree, by units the checker's own
kernel profile carries: test_native_sizing_price_rule.cpp runs
QuantizeFills + HalfUp on a one-cent tick and checks the sizing basis it
converts at against nearest_tick(c) and nearest_tick(c + slippage);
test_native_acid_composite.cpp runs QuantizeFillsAndTriggers + Directional
and checks the booked resolved_price of buys and sells against
ceil_tick(open) + tick / floor_tick(open) - tick, the trail's running best
against ceil_tick(high), and the trail's exit against floor_tick(level) -
tick; test_native_trail_best_seed.cpp puts an off-ladder trail seed on the
ladder under QuantizeFillsAndTriggers (100.9951 -> the stop reads 100.50).
The private test stays named as the overlay's re-run of the pair. No
verdict, marker or claim text changed.

check_design_inventory.py and check_doc_reverts.py exit 0.

Co-Authored-By: Claude Code <[email protected]>