CR-150 O(1) report integration: the engine 1.7.0 line as one commit over main 9eff925de1 - #491

The engine 1.7.0 release as ONE single-parent commit over main 9eff925 (tree 7d0e84034739). Supersedes #490 (6f8f40e): same src/ and include/ (diff empty), plus the final CHANGELOG known-limits section, two corrected public doc pages (line counts kept) and the test_scratch_arena fixture fallback (O_TMPFILE EOPNOTSUPP -> mkstemp+unlink, test-only, no skip). The squash body is this commit's message verbatim.

Evidence: the eight lab steps + private release with fixtures b0b52c3aa5 are running on this exact commit (submitted 21:16-21:17); the Cloud Run gate sweep for pineforge/parity follows. Final read: REV-CX 14 full reports GO, 0 P0/P1, composition of this commit checked (21:18).

--- commit message (squash body) ---
CR-150 O(1) report integration: the engine 1.7.0 line as one commit over main 9eff925

One squash-equivalent commit: parent = engine main 9eff925 (#463), tree = the CR-150 picks line merged with that main (docs/ci.md the only conflict: the line's clarification paragraph and main's two baseline-promotion paragraphs are adjacent additions, both kept). The squash body at the merge carries this message verbatim.

The 40 documentation sentences below were deleted by commits of the line and are intended: they are the superseded wording of the pages the final 1.7.0 text replaces. scripts/check_doc_reverts.py reads this message for them.

Format per line: file | introducer short sha | start of the deleted sentence. Introducers: dbf56ed (docs/design/arena-bound.md 22), 03b2406 (docs/ci.md 7), c7e6bcb (docs/pages/scratch-tables.md 5), 1fa26e7 (scratch-tables.md 3), b4a3f76 (scratch-tables.md 1), 00dec17 (docs/scratch-store.md 1), 2688775 (docs/pages/abi-stability.md 1).

docs/pages/abi-stability.md | 2688775 | "The engine validates/attaches the inherited fixed-fd-5 arena or returns the handle's typed report_sink_failed/arena_backing."
docs/pages/scratch-tables.md | 1fa26e7 | 'A jailed arena must be a sealed memfd with at least F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, and the jailed admission (strategy_require_report_sc' docs/pages/scratch-tables.md | 1fa26e7 | 'Where sealed memfds do not exist (not Linux) the admission accepts the arena the host supplies.' docs/pages/scratch-tables.md | 1fa26e7 | 'With PF_SCRATCH_ARENA_FDset, only exactly"1"enables it; unset or exactly"0"preserves the unjailed backing rules, and every other value (inc' docs/pages/scratch-tables.md | b4a3f76 | 'A jailed arena must be a sealed memfd with at leastF_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL; ordinary files, sealing-disabled memfds and unsupport' docs/pages/scratch-tables.md | c7e6bcb | 'The engine never changes process signal disposition.' docs/scratch-store.md | 00dec17 | 'Below it the drain is held to 4,096 B for every population up to 8,191, where the resident journal events own the definitions the spilled book rows ne' docs/design/arena-bound.md | dbf56ed | 'L18 sibling footer evidence described below; absent from this base' docs/design/arena-bound.md | dbf56ed | 'erased_minima_ include/pineforge/source/pine_adapter.hpp:N;' docs/design/arena-bound.md | dbf56ed | 'remember_erased src/source/pine_adapter.cpp:N' docs/design/arena-bound.md | dbf56ed | 'consumed_partial_exit_cycles_ include/pineforge/source/pine_adapter.hpp:N;' docs/design/arena-bound.md | dbf56ed | 'src/source/pine_adapter.cpp:N' docs/design/arena-bound.md | dbf56ed | 'The exact external file:line evidence is recorded in the lane report; these sources must be merged and their local anchors refreshed before claiming c' docs/design/arena-bound.md | dbf56ed | 'Summing all eleven peaks gives:' docs/design/arena-bound.md | dbf56ed | 'There are eleven persistent regions and up to three extra replacement indexes.' docs/design/arena-bound.md | dbf56ed | 'Each independently rounded region wastes less than C.' docs/design/arena-bound.md | dbf56ed | 'Summing independent peaks and adding fourteen complete chunks is conservative even when their real peak times differ.' docs/design/arena-bound.md | dbf56ed | 'This covers chunk fragmentation, not unlisted stores or a missing population proof.' docs/design/arena-bound.md | dbf56ed | 'At L=64 the position term is **94*T**; each placement data term is **104*D+168*Q**; consumed-cycle data is **169*Q**; the root term is **16*R**.' docs/design/arena-bound.md | dbf56ed | "The contract's eleven coefficients agree with the inspected code and L19l-A/C reports." docs/design/arena-bound.md | dbf56ed | 'No numeric correction to those coefficients was needed. “72..104 bytes/key” in the L19l-C steady-state explanation does not include the rehash overlap' docs/design/arena-bound.md | dbf56ed | 'Each of two placement data files' docs/design/arena-bound.md | dbf56ed | 'Each of two placement index peaks' docs/design/arena-bound.md | dbf56ed | 'Eleven contributions in the table above, including both two-file rows.' docs/design/arena-bound.md | dbf56ed | 'D=32,Q=1,L=1,E=1; both 128-slot rehash peaks are 3072;' docs/design/arena-bound.md | dbf56ed | 'No production header declaration is changed.' docs/design/arena-bound.md | dbf56ed | 'Linux linker wrappers reject write/pwrite/ftruncate on unlinked regular scratch files, while allowing the named report sink.' docs/design/arena-bound.md | dbf56ed | 'The current base still has those owning-port dependencies.' docs/design/arena-bound.md | dbf56ed | 'It must not be reported as corpus proof until they land.' docs/pages/scratch-tables.md | c7e6bcb | 'The report sink stays **OFF**.' docs/pages/scratch-tables.md | c7e6bcb | 'The host neither constructs a temporary sink nor uses the sink verification/transposition/staging files; it uses ordinary report arrays and the in-mem' docs/pages/scratch-tables.md | c7e6bcb | 'Optional recorded outputs use the ordinary retained-output reader.' docs/pages/scratch-tables.md | c7e6bcb | 'Keep the report sink OFF and use the ordinary report route.' docs/ci.md | 03b2406 | 'Push this prepared migration only after both CORE-TOP gates: laneboss posts **"pf-ci-release live"** and the owner answers **REL-HOSTED**.' docs/ci.md | 03b2406 | 'Until then a job on that label with no runners only waits, and nothing is pushed.' docs/ci.md | 03b2406 | 'Each job using these two CI fragments uses the expression verbatim and sets its matching array as a job-level **string** PF_CI_LABELS, merged into a' docs/ci.md | 03b2406 | 'The pre-job hook for those CI fragments also requires the matching PF_CI_LABELSstring.' docs/ci.md | 03b2406 | 'It pins the hosted PR deployment job indocs.yml, the isolated jobs in release.ymlandpromote-baseline.yml, and the complete release matrix wit' docs/ci.md | 03b2406 | 'Both workflows require exact runner values without a fallback and carry no PF_CI_LABELS; unlisted credential-bearing jobs retain the existing hosted' docs/ci.md | 03b2406 | 'A credential-bearing job on a PR pool, a restored hosted label on a moved release job, a PR trigger on release.yml, a pull_request` trigger or chan'

Second list, 14 more deletions: the change is judged against main 9eff925 as one commit, so old main sentences that the 1.7.0 pages replace are deletions too. Introducers 4c78f39, d3cca9e, d093560, 47184e5, 41ca2ee, f48b7c8, a8f84b9, 65c69b0; same format. (Read by ORG-CX from the preflight of the previous single commit.)

README.md | 4c78f39 | 'The counts below include recorded outputs and describe the released 1.5.0 API.'
docs/design/native-feature-parity.md | d3cca9e | 'sha256:H c_abi.cpp:N, sha256:H check_c_abi_runtime.py:N, c_abi.cpp:N, sha256:H c_abi.cpp:N, sha256:H c_abi.cpp:N, sha256:H c_abi.cpp:N, sha' docs/native-refactor-progress.md | d093560 | 'WorkingRequestCore::history (include/pineforge/native_order.hpp:N) hands out the whole vector and the core holds history_ (include/pineforge/na'
docs/native-refactor-progress.md | d093560 | "decompose_ms_local (src/session_time.cpp:N) reads two thread-locals per call on a zoned clock, and the prepared order storage's free_blocks (sr" docs/pages/index.md | 4c78f39 | 'The counts below include recorded outputs and describe the released 1.5.0 API.' docs/pages/index.md | 47184e5 | '- <pineforge/execution_observer.h>and<pineforge/selected_window.h>— three each: the six of the 80 runtime implementations thatpineforge.h do' docs/pages/native-engine.md | 41ca2ee | 'closed_trade(i)is the row itself, by reference — the objectget_trade(i)andget_report_trade(i)read at the same index and the rowfill_repor'
docs/pages/native-engine.md | f48b7c8 | "A run that began owns its rows whatever became of it: a Completed report and a started-then-failed run's partial rows are published unchanged."
docs/pages/native-engine.md | d093560 | 'A C++ host reads a closed row whole, at any time, every Trade field included.'
docs/pages/report-schema.md | a8f84b9 | 'pf_report_t is the single output of every backtest.'
docs/pages/report-schema.md | a8f84b9 | 'This page maps each field to its meaning and units.'
docs/pages/report-schema.md | a8f84b9 | 'Heap array, ordered by exit time ascending.'
docs/pages/run-failure-codes.md | 47184e5 | 'The other 38 codes retain their released 1.4.0 status.'
docs/pages/run-failure-codes.md | 65c69b0 | 'Machine memory; retryable, capped.'

Also in this commit: S4E's tag-time follow-up 6dfe9da (tests and two doc paragraphs; no src/ or include/ change). Its own message follows verbatim so scripts/check_doc_reverts.py reads the sentences it rewrites or qualifies in docs/design/o1-report-contract.md and docs/pages/run-failure-codes.md.

tests, docs: REV's follow-ups on the scratch series: the sink_fd rows name their real subject and cause, the capability row's cells are meaningful and disclosed, the predicate scan covers the signed spellings, the docs state the ENOTSUP exception

tests/test_run_json_sink_fd.py: the comment of the unjailed TMPDIR row now says the pre-series failure came from the native writer opening work/bad.sink in the mode-0555 work directory (sink_io), not from TMPDIR; new row test_native_fd_fsize_zero_path_sink_refused_in_read_only_work restores that subject (work 0555, TMPDIR 0755, report_sink_failed sink_io, nothing created); the TMPDIR-cause row runs without an arena, without PINEFORGE_COMMAND_SCRATCH_DIR and PINEFORGE_RUN_JSON_PROFILE, and proves DAC enforcement with an os.open probe first (visible pytest.skip with its reason otherwise). tests/test_default_scratch_effective_credentials.cpp nonroot_row() only (row() and main() unchanged): the setreuid outcome check can fail (EPERM or EINVAL accepted, credentials verified on both branches), the disclosure text is a pure fixture function pinned in test_scratch_capability_parse (every omitted cell " omitted ()", "missing, unreadable or malformed"), four more parser cases (0x80, -80, +80, space after the colon). tests/test_scratch_filesystem_predicate.py: the scan and its self-test also cover -2054924042(L) and 0xffffffff858458f6. docs/design/o1-report-contract.md and docs/pages/run-failure-codes.md: one paragraph each states the ENOTSUP exception (no probe, or a real errno 95 from stat/faccessat/statfs, keeps the default candidate as in 1.6.3 with no tmpfs claim and no note; /var/tmp selected without the rejected-candidate note when its probe answers ENOTSUP) and qualifies, with "except as described below", the sentences "A failed filesystem query stops default resolution with its syscall errno and names the failed candidate at every create wrapper; it never permits fallback." and "If creation in the selected /var/tmp fails, the detail names that directory, the rejected first candidate and set TMPDIR to a disk-backed directory." (o1-report-contract.md) and "A failed query stops resolution with its syscall errno and names the failed candidate." and "failures and all-memory refusals" (run-failure-codes.md); the other sentences keep their words and only their line wrapping changed (same number of lines in each block). No production code changed. Mutations m15 (setreuid EFAULT) and m16 (signed magic).

Also in this commit, frozen 2026-10-24 for the 1.7.0 tag (three additions to the tree the CR-150 legs of 6f8f40e measured; src/ and include/ are unchanged):

1. CHANGELOG.md, section "Costs that remain": three new bullets (ORG-CX), 49 lines added and none removed, so no sentence is deleted. They state the costs that remain with the symbols they name: the I/O paths that can terminate or fail silently, the reads of closed trades and cohorts that now cost I/O, and the report-sink cost.

2. tests/test_scratch_arena.cpp (LAB-CX, commit 280c472 on parent 0f5072d, whose tree equals the one measured; test-only, +25/-4): on the CLOUD Batch VM the container filesystem answers open(O_TMPFILE) with errno 95 (EOPNOTSUPP), measured on lab job rj-20261024t121649-2fe44d, so the row failed there with the bare message "create backing descriptor" while it passes on NTU2 (rj-20261024t121045-c354ce). anonymous_regular_backing now falls back to mkstemp + unlink ONLY when the O_TMPFILE open fails with EOPNOTSUPP, so the anonymous regular-file arena shape is still exercised; it prints a NOTE with the errno when it does. Any other errno still fails, now with "errno N (text)" in the message. Nothing is skipped and no assertion is weakened: after the descriptor exists the row runs the same preallocation, attachment, ensure_size and zero-read checks as before. The engine never opens an O_TMPFILE.

Docs addition 3 (ORG-CX R9-F1/F2, docs only, line counts unchanged): three public pages stop promising an envelope run_json never emits and a NULL sink removal that can be refused. Its own message follows verbatim so scripts/check_doc_reverts.py reads the nine sentences it replaces.

docs: three public pages stop promising an envelope run_json never emits and a NULL sink removal that can be refused

REV's read of the frozen tree (R9-F1, R9-F2): the code and the CHANGELOG are right, three pages are not.

report-schema.md (lines 253-267) said explicit-mode JSON carries report_contract/report_capture
and that explicit modes add policy keys and move the fingerprint to version 3. On the run_json.py
transport an explicit --report-mode FULL is the legacy route (docker/run_json.py: "--report-mode
FULL is identical to omitting the option"; only SUMMARY_ONLY and STREAMED are refused as
report_mode_unsupported), so it adds none of those keys; they appear on a host that fills the v1
envelope (C++ fill_report_envelope_v1). o1-report-contract.md (lines 47-55) made the same claim
for every explicit request. abi-stability.md (lines 165-172) listed -1, -2 and -3 for the sink
setters but not that NULL returns -3 while an idle handle still holds a completed run's scratch
curve or sealed rows (src/engine_report.cpp set_report_sink_v1 and set_report_sink_fd_v1), that
an invalid scratch-arena environment returns -1, or that a completed fd generation detaches and
keeps its receipt and summary (include/pineforge/report_sink.h documents all three).

Line counts of all three pages are unchanged (817, 584, 672), so no citation moves.

Sentences replaced (named for the doc-reverts check):

• "Explicit-mode JSON includes report_contract: "pineforge-report/v1" and report_capture, containing version, the mode name, complete, and all seven sequence objects above."
• "Explicit modes also add report_contract, report_mode, and sequence_capture to applied_runtime and fingerprinted provenance.runtime."
• "Either sink setter replaces the one installed sink, and NULL through either setter removes it."
• "Both return 0 on acceptance, -1 for a bad handle or descriptor prefix (or a negative fd), -2 during a stream and -3 during a batch run or report capture."
• "Run-begin validation and write errors use the existing typed report_sink_failed path."
• "The caller keeps the fd open through execution and report capture, then closes it to signal EOF."
• "The engine never duplicates or closes a borrowed fd, including on failure, replacement or handle destruction."
• "No option keeps the legacy route."
• "An explicit request must either return the requested versioned envelope or fail."

Co-Authored-By: Claude Sonnet 5.5 [email protected]

🤖 Generated with Claude Code