CR-150 O(1) report integration: the engine 1.7.0 line as one commit over main 9eff925de1 - #490

The engine 1.7.0 line as ONE single-parent commit over main 9eff925 (tree bbf37302b915). The squash body is this commit's message verbatim (it names every doc-revert the preflight's doc-reverts check lists).

Evidence: preflight alone rj-20261024t112416-3447c6 PASSED exit 0 (57 stages, 0 advisory) on this exact commit. Candidate legs (release, debug, sanitizers, kernel, private release with fixtures b0b52c3aa5) running from 19:52. src/ and include/ are identical to tree 57bca1031c, on which CR-271 identity (match=312 moved=0) and the memory A/B rows were measured. Backups: o1/line-walk-4628aa8b, o1/line-merge-9eff925de1, o1/line-s4e-0f5072d2c5.

--- commit message (squash body) ---
CR-150 O(1) report integration: the engine 1.7.0 line as one commit over main 9eff925

One squash-equivalent commit: parent = engine main 9eff925 (#463), tree = the CR-150 picks line merged with that main (docs/ci.md the only conflict: the line's clarification paragraph and main's two baseline-promotion paragraphs are adjacent additions, both kept). The squash body at the merge carries this message verbatim.

The 40 documentation sentences below were deleted by commits of the line and are intended: they are the superseded wording of the pages the final 1.7.0 text replaces. scripts/check_doc_reverts.py reads this message for them.

Format per line: file | introducer short sha | start of the deleted sentence. Introducers: dbf56ed (docs/design/arena-bound.md 22), 03b2406 (docs/ci.md 7), c7e6bcb (docs/pages/scratch-tables.md 5), 1fa26e7 (scratch-tables.md 3), b4a3f76 (scratch-tables.md 1), 00dec17 (docs/scratch-store.md 1), 2688775 (docs/pages/abi-stability.md 1).

docs/pages/abi-stability.md | 2688775 | "The engine validates/attaches the inherited fixed-fd-5 arena or returns the handle's typed report_sink_failed/arena_backing."
docs/pages/scratch-tables.md | 1fa26e7 | 'A jailed arena must be a sealed memfd with at least F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, and the jailed admission (strategy_require_report_sc' docs/pages/scratch-tables.md | 1fa26e7 | 'Where sealed memfds do not exist (not Linux) the admission accepts the arena the host supplies.' docs/pages/scratch-tables.md | 1fa26e7 | 'With PF_SCRATCH_ARENA_FDset, only exactly"1"enables it; unset or exactly"0"preserves the unjailed backing rules, and every other value (inc' docs/pages/scratch-tables.md | b4a3f76 | 'A jailed arena must be a sealed memfd with at leastF_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL; ordinary files, sealing-disabled memfds and unsupport' docs/pages/scratch-tables.md | c7e6bcb | 'The engine never changes process signal disposition.' docs/scratch-store.md | 00dec17 | 'Below it the drain is held to 4,096 B for every population up to 8,191, where the resident journal events own the definitions the spilled book rows ne' docs/design/arena-bound.md | dbf56ed | 'L18 sibling footer evidence described below; absent from this base' docs/design/arena-bound.md | dbf56ed | 'erased_minima_ include/pineforge/source/pine_adapter.hpp:N;' docs/design/arena-bound.md | dbf56ed | 'remember_erased src/source/pine_adapter.cpp:N' docs/design/arena-bound.md | dbf56ed | 'consumed_partial_exit_cycles_ include/pineforge/source/pine_adapter.hpp:N;' docs/design/arena-bound.md | dbf56ed | 'src/source/pine_adapter.cpp:N' docs/design/arena-bound.md | dbf56ed | 'The exact external file:line evidence is recorded in the lane report; these sources must be merged and their local anchors refreshed before claiming c' docs/design/arena-bound.md | dbf56ed | 'Summing all eleven peaks gives:' docs/design/arena-bound.md | dbf56ed | 'There are eleven persistent regions and up to three extra replacement indexes.' docs/design/arena-bound.md | dbf56ed | 'Each independently rounded region wastes less than C.' docs/design/arena-bound.md | dbf56ed | 'Summing independent peaks and adding fourteen complete chunks is conservative even when their real peak times differ.' docs/design/arena-bound.md | dbf56ed | 'This covers chunk fragmentation, not unlisted stores or a missing population proof.' docs/design/arena-bound.md | dbf56ed | 'At L=64 the position term is **94*T**; each placement data term is **104*D+168*Q**; consumed-cycle data is **169*Q**; the root term is **16*R**.' docs/design/arena-bound.md | dbf56ed | "The contract's eleven coefficients agree with the inspected code and L19l-A/C reports." docs/design/arena-bound.md | dbf56ed | 'No numeric correction to those coefficients was needed. “72..104 bytes/key” in the L19l-C steady-state explanation does not include the rehash overlap' docs/design/arena-bound.md | dbf56ed | 'Each of two placement data files' docs/design/arena-bound.md | dbf56ed | 'Each of two placement index peaks' docs/design/arena-bound.md | dbf56ed | 'Eleven contributions in the table above, including both two-file rows.' docs/design/arena-bound.md | dbf56ed | 'D=32,Q=1,L=1,E=1; both 128-slot rehash peaks are 3072;' docs/design/arena-bound.md | dbf56ed | 'No production header declaration is changed.' docs/design/arena-bound.md | dbf56ed | 'Linux linker wrappers reject write/pwrite/ftruncate on unlinked regular scratch files, while allowing the named report sink.' docs/design/arena-bound.md | dbf56ed | 'The current base still has those owning-port dependencies.' docs/design/arena-bound.md | dbf56ed | 'It must not be reported as corpus proof until they land.' docs/pages/scratch-tables.md | c7e6bcb | 'The report sink stays **OFF**.' docs/pages/scratch-tables.md | c7e6bcb | 'The host neither constructs a temporary sink nor uses the sink verification/transposition/staging files; it uses ordinary report arrays and the in-mem' docs/pages/scratch-tables.md | c7e6bcb | 'Optional recorded outputs use the ordinary retained-output reader.' docs/pages/scratch-tables.md | c7e6bcb | 'Keep the report sink OFF and use the ordinary report route.' docs/ci.md | 03b2406 | 'Push this prepared migration only after both CORE-TOP gates: laneboss posts **"pf-ci-release live"** and the owner answers **REL-HOSTED**.' docs/ci.md | 03b2406 | 'Until then a job on that label with no runners only waits, and nothing is pushed.' docs/ci.md | 03b2406 | 'Each job using these two CI fragments uses the expression verbatim and sets its matching array as a job-level **string** PF_CI_LABELS, merged into a' docs/ci.md | 03b2406 | 'The pre-job hook for those CI fragments also requires the matching PF_CI_LABELSstring.' docs/ci.md | 03b2406 | 'It pins the hosted PR deployment job indocs.yml, the isolated jobs in release.ymlandpromote-baseline.yml, and the complete release matrix wit' docs/ci.md | 03b2406 | 'Both workflows require exact runner values without a fallback and carry no PF_CI_LABELS; unlisted credential-bearing jobs retain the existing hosted' docs/ci.md | 03b2406 | 'A credential-bearing job on a PR pool, a restored hosted label on a moved release job, a PR trigger on release.yml, a pull_request` trigger or chan'

Second list, 14 more deletions: the change is judged against main 9eff925 as one commit, so old main sentences that the 1.7.0 pages replace are deletions too. Introducers 4c78f39, d3cca9e, d093560, 47184e5, 41ca2ee, f48b7c8, a8f84b9, 65c69b0; same format. (Read by ORG-CX from the preflight of the previous single commit.)

README.md | 4c78f39 | 'The counts below include recorded outputs and describe the released 1.5.0 API.'
docs/design/native-feature-parity.md | d3cca9e | 'sha256:H c_abi.cpp:N, sha256:H check_c_abi_runtime.py:N, c_abi.cpp:N, sha256:H c_abi.cpp:N, sha256:H c_abi.cpp:N, sha256:H c_abi.cpp:N, sha' docs/native-refactor-progress.md | d093560 | 'WorkingRequestCore::history (include/pineforge/native_order.hpp:N) hands out the whole vector and the core holds history_ (include/pineforge/na'
docs/native-refactor-progress.md | d093560 | "decompose_ms_local (src/session_time.cpp:N) reads two thread-locals per call on a zoned clock, and the prepared order storage's free_blocks (sr" docs/pages/index.md | 4c78f39 | 'The counts below include recorded outputs and describe the released 1.5.0 API.' docs/pages/index.md | 47184e5 | '- <pineforge/execution_observer.h>and<pineforge/selected_window.h>— three each: the six of the 80 runtime implementations thatpineforge.h do' docs/pages/native-engine.md | 41ca2ee | 'closed_trade(i)is the row itself, by reference — the objectget_trade(i)andget_report_trade(i)read at the same index and the rowfill_repor'
docs/pages/native-engine.md | f48b7c8 | "A run that began owns its rows whatever became of it: a Completed report and a started-then-failed run's partial rows are published unchanged."
docs/pages/native-engine.md | d093560 | 'A C++ host reads a closed row whole, at any time, every Trade field included.'
docs/pages/report-schema.md | a8f84b9 | 'pf_report_t is the single output of every backtest.'
docs/pages/report-schema.md | a8f84b9 | 'This page maps each field to its meaning and units.'
docs/pages/report-schema.md | a8f84b9 | 'Heap array, ordered by exit time ascending.'
docs/pages/run-failure-codes.md | 47184e5 | 'The other 38 codes retain their released 1.4.0 status.'
docs/pages/run-failure-codes.md | 65c69b0 | 'Machine memory; retryable, capped.'

Also in this commit: S4E's tag-time follow-up 6dfe9da (tests and two doc paragraphs; no src/ or include/ change). Its own message follows verbatim so scripts/check_doc_reverts.py reads the sentences it rewrites or qualifies in docs/design/o1-report-contract.md and docs/pages/run-failure-codes.md.

tests, docs: REV's follow-ups on the scratch series: the sink_fd rows name their real subject and cause, the capability row's cells are meaningful and disclosed, the predicate scan covers the signed spellings, the docs state the ENOTSUP exception

tests/test_run_json_sink_fd.py: the comment of the unjailed TMPDIR row now says the pre-series failure came from the native writer opening work/bad.sink in the mode-0555 work directory (sink_io), not from TMPDIR; new row test_native_fd_fsize_zero_path_sink_refused_in_read_only_work restores that subject (work 0555, TMPDIR 0755, report_sink_failed sink_io, nothing created); the TMPDIR-cause row runs without an arena, without PINEFORGE_COMMAND_SCRATCH_DIR and PINEFORGE_RUN_JSON_PROFILE, and proves DAC enforcement with an os.open probe first (visible pytest.skip with its reason otherwise). tests/test_default_scratch_effective_credentials.cpp nonroot_row() only (row() and main() unchanged): the setreuid outcome check can fail (EPERM or EINVAL accepted, credentials verified on both branches), the disclosure text is a pure fixture function pinned in test_scratch_capability_parse (every omitted cell " omitted ()", "missing, unreadable or malformed"), four more parser cases (0x80, -80, +80, space after the colon). tests/test_scratch_filesystem_predicate.py: the scan and its self-test also cover -2054924042(L) and 0xffffffff858458f6. docs/design/o1-report-contract.md and docs/pages/run-failure-codes.md: one paragraph each states the ENOTSUP exception (no probe, or a real errno 95 from stat/faccessat/statfs, keeps the default candidate as in 1.6.3 with no tmpfs claim and no note; /var/tmp selected without the rejected-candidate note when its probe answers ENOTSUP) and qualifies, with "except as described below", the sentences "A failed filesystem query stops default resolution with its syscall errno and names the failed candidate at every create wrapper; it never permits fallback." and "If creation in the selected /var/tmp fails, the detail names that directory, the rejected first candidate and set TMPDIR to a disk-backed directory." (o1-report-contract.md) and "A failed query stops resolution with its syscall errno and names the failed candidate." and "failures and all-memory refusals" (run-failure-codes.md); the other sentences keep their words and only their line wrapping changed (same number of lines in each block). No production code changed. Mutations m15 (setreuid EFAULT) and m16 (signed magic).

Co-Authored-By: Claude Sonnet 5.5 [email protected]

🤖 Generated with Claude Code