CR-150 O(1) report integration: the engine 1.7.0 line as one commit over main 9eff925de1 - #492

The engine 1.7.0 release as ONE single-parent commit over main 9eff925 (tree ca59b12e6974). Supersedes #491 (cad8b4b): adds the R6a-F1 fix in src/source/pine_adapter.cpp (6/6: restores v1.6.3's K1 for dormant unwithdrawn askable-origin legs; without it a 1.7.0 run can book an extra margin-price flatten v1.6.3 does not), its red-first test tests/test_k1_askable_origin_supersessor_erasure.cpp (+ tests/cr150.d/p2cx-k1.cmake, globbed by tests/CMakeLists.txt), and one CHANGELOG known-limits sentence for the dormant re-issue pattern (= v1.6.3 behaviour, 1.7.1 card). The squash body is this commit's message verbatim.

Evidence: the K1 test is RED on cad8b4b (rj-20261024t134042-bcc5dd: ERASE 3 trades vs RETAIN 2) and does not hit on v1.6.3; GREEN with the fix (rj-20261024t140803-0bf6e2, 8/8 incl. the retirement neighbours). REV-CX GO on the fix, the test and the CHANGELOG sentence. The eight lab steps + private release run on this exact commit (submitted 22:18-22:19); the Cloud Run gate sweep follows after registry migration 0077 (workflow #224).

--- commit message (squash body) ---
CR-150 O(1) report integration: the engine 1.7.0 line as one commit over main 9eff925

One squash-equivalent commit: parent = engine main 9eff925 (#463), tree = the CR-150 picks line merged with that main (docs/ci.md the only conflict: the line's clarification paragraph and main's two baseline-promotion paragraphs are adjacent additions, both kept). The squash body at the merge carries this message verbatim.

The 40 documentation sentences below were deleted by commits of the line and are intended: they are the superseded wording of the pages the final 1.7.0 text replaces. scripts/check_doc_reverts.py reads this message for them.

Format per line: file | introducer short sha | start of the deleted sentence. Introducers: dbf56ed (docs/design/arena-bound.md 22), 03b2406 (docs/ci.md 7), c7e6bcb (docs/pages/scratch-tables.md 5), 1fa26e7 (scratch-tables.md 3), b4a3f76 (scratch-tables.md 1), 00dec17 (docs/scratch-store.md 1), 2688775 (docs/pages/abi-stability.md 1).

docs/pages/abi-stability.md | 2688775 | "The engine validates/attaches the inherited fixed-fd-5 arena or returns the handle's typed report_sink_failed/arena_backing."
docs/pages/scratch-tables.md | 1fa26e7 | 'A jailed arena must be a sealed memfd with at least F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, and the jailed admission (strategy_require_report_sc' docs/pages/scratch-tables.md | 1fa26e7 | 'Where sealed memfds do not exist (not Linux) the admission accepts the arena the host supplies.' docs/pages/scratch-tables.md | 1fa26e7 | 'With PF_SCRATCH_ARENA_FDset, only exactly"1"enables it; unset or exactly"0"preserves the unjailed backing rules, and every other value (inc' docs/pages/scratch-tables.md | b4a3f76 | 'A jailed arena must be a sealed memfd with at leastF_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL; ordinary files, sealing-disabled memfds and unsupport' docs/pages/scratch-tables.md | c7e6bcb | 'The engine never changes process signal disposition.' docs/scratch-store.md | 00dec17 | 'Below it the drain is held to 4,096 B for every population up to 8,191, where the resident journal events own the definitions the spilled book rows ne' docs/design/arena-bound.md | dbf56ed | 'L18 sibling footer evidence described below; absent from this base' docs/design/arena-bound.md | dbf56ed | 'erased_minima_ include/pineforge/source/pine_adapter.hpp:N;' docs/design/arena-bound.md | dbf56ed | 'remember_erased src/source/pine_adapter.cpp:N' docs/design/arena-bound.md | dbf56ed | 'consumed_partial_exit_cycles_ include/pineforge/source/pine_adapter.hpp:N;' docs/design/arena-bound.md | dbf56ed | 'src/source/pine_adapter.cpp:N' docs/design/arena-bound.md | dbf56ed | 'The exact external file:line evidence is recorded in the lane report; these sources must be merged and their local anchors refreshed before claiming c' docs/design/arena-bound.md | dbf56ed | 'Summing all eleven peaks gives:' docs/design/arena-bound.md | dbf56ed | 'There are eleven persistent regions and up to three extra replacement indexes.' docs/design/arena-bound.md | dbf56ed | 'Each independently rounded region wastes less than C.' docs/design/arena-bound.md | dbf56ed | 'Summing independent peaks and adding fourteen complete chunks is conservative even when their real peak times differ.' docs/design/arena-bound.md | dbf56ed | 'This covers chunk fragmentation, not unlisted stores or a missing population proof.' docs/design/arena-bound.md | dbf56ed | 'At L=64 the position term is **94*T**; each placement data term is **104*D+168*Q**; consumed-cycle data is **169*Q**; the root term is **16*R**.' docs/design/arena-bound.md | dbf56ed | "The contract's eleven coefficients agree with the inspected code and L19l-A/C reports." docs/design/arena-bound.md | dbf56ed | 'No numeric correction to those coefficients was needed. “72..104 bytes/key” in the L19l-C steady-state explanation does not include the rehash overlap' docs/design/arena-bound.md | dbf56ed | 'Each of two placement data files' docs/design/arena-bound.md | dbf56ed | 'Each of two placement index peaks' docs/design/arena-bound.md | dbf56ed | 'Eleven contributions in the table above, including both two-file rows.' docs/design/arena-bound.md | dbf56ed | 'D=32,Q=1,L=1,E=1; both 128-slot rehash peaks are 3072;' docs/design/arena-bound.md | dbf56ed | 'No production header declaration is changed.' docs/design/arena-bound.md | dbf56ed | 'Linux linker wrappers reject write/pwrite/ftruncate on unlinked regular scratch files, while allowing the named report sink.' docs/design/arena-bound.md | dbf56ed | 'The current base still has those owning-port dependencies.' docs/design/arena-bound.md | dbf56ed | 'It must not be reported as corpus proof until they land.' docs/pages/scratch-tables.md | c7e6bcb | 'The report sink stays **OFF**.' docs/pages/scratch-tables.md | c7e6bcb | 'The host neither constructs a temporary sink nor uses the sink verification/transposition/staging files; it uses ordinary report arrays and the in-mem' docs/pages/scratch-tables.md | c7e6bcb | 'Optional recorded outputs use the ordinary retained-output reader.' docs/pages/scratch-tables.md | c7e6bcb | 'Keep the report sink OFF and use the ordinary report route.' docs/ci.md | 03b2406 | 'Push this prepared migration only after both CORE-TOP gates: laneboss posts **"pf-ci-release live"** and the owner answers **REL-HOSTED**.' docs/ci.md | 03b2406 | 'Until then a job on that label with no runners only waits, and nothing is pushed.' docs/ci.md | 03b2406 | 'Each job using these two CI fragments uses the expression verbatim and sets its matching array as a job-level **string** PF_CI_LABELS, merged into a' docs/ci.md | 03b2406 | 'The pre-job hook for those CI fragments also requires the matching PF_CI_LABELSstring.' docs/ci.md | 03b2406 | 'It pins the hosted PR deployment job indocs.yml, the isolated jobs in release.ymlandpromote-baseline.yml, and the complete release matrix wit' docs/ci.md | 03b2406 | 'Both workflows require exact runner values without a fallback and carry no PF_CI_LABELS; unlisted credential-bearing jobs retain the existing hosted' docs/ci.md | 03b2406 | 'A credential-bearing job on a PR pool, a restored hosted label on a moved release job, a PR trigger on release.yml, a pull_request` trigger or chan'

Second list, 14 more deletions: the change is judged against main 9eff925 as one commit, so old main sentences that the 1.7.0 pages replace are deletions too. Introducers 4c78f39, d3cca9e, d093560, 47184e5, 41ca2ee, f48b7c8, a8f84b9, 65c69b0; same format. (Read by ORG-CX from the preflight of the previous single commit.)

README.md | 4c78f39 | 'The counts below include recorded outputs and describe the released 1.5.0 API.'
docs/design/native-feature-parity.md | d3cca9e | 'sha256:H c_abi.cpp:N, sha256:H check_c_abi_runtime.py:N, c_abi.cpp:N, sha256:H c_abi.cpp:N, sha256:H c_abi.cpp:N, sha256:H c_abi.cpp:N, sha' docs/native-refactor-progress.md | d093560 | 'WorkingRequestCore::history (include/pineforge/native_order.hpp:N) hands out the whole vector and the core holds history_ (include/pineforge/na'
docs/native-refactor-progress.md | d093560 | "decompose_ms_local (src/session_time.cpp:N) reads two thread-locals per call on a zoned clock, and the prepared order storage's free_blocks (sr" docs/pages/index.md | 4c78f39 | 'The counts below include recorded outputs and describe the released 1.5.0 API.' docs/pages/index.md | 47184e5 | '- <pineforge/execution_observer.h>and<pineforge/selected_window.h>— three each: the six of the 80 runtime implementations thatpineforge.h do' docs/pages/native-engine.md | 41ca2ee | 'closed_trade(i)is the row itself, by reference — the objectget_trade(i)andget_report_trade(i)read at the same index and the rowfill_repor'
docs/pages/native-engine.md | f48b7c8 | "A run that began owns its rows whatever became of it: a Completed report and a started-then-failed run's partial rows are published unchanged."
docs/pages/native-engine.md | d093560 | 'A C++ host reads a closed row whole, at any time, every Trade field included.'
docs/pages/report-schema.md | a8f84b9 | 'pf_report_t is the single output of every backtest.'
docs/pages/report-schema.md | a8f84b9 | 'This page maps each field to its meaning and units.'
docs/pages/report-schema.md | a8f84b9 | 'Heap array, ordered by exit time ascending.'
docs/pages/run-failure-codes.md | 47184e5 | 'The other 38 codes retain their released 1.4.0 status.'
docs/pages/run-failure-codes.md | 65c69b0 | 'Machine memory; retryable, capped.'

Also in this commit: S4E's tag-time follow-up 6dfe9da (tests and two doc paragraphs; no src/ or include/ change). Its own message follows verbatim so scripts/check_doc_reverts.py reads the sentences it rewrites or qualifies in docs/design/o1-report-contract.md and docs/pages/run-failure-codes.md.

tests, docs: REV's follow-ups on the scratch series: the sink_fd rows name their real subject and cause, the capability row's cells are meaningful and disclosed, the predicate scan covers the signed spellings, the docs state the ENOTSUP exception

tests/test_run_json_sink_fd.py: the comment of the unjailed TMPDIR row now says the pre-series failure came from the native writer opening work/bad.sink in the mode-0555 work directory (sink_io), not from TMPDIR; new row test_native_fd_fsize_zero_path_sink_refused_in_read_only_work restores that subject (work 0555, TMPDIR 0755, report_sink_failed sink_io, nothing created); the TMPDIR-cause row runs without an arena, without PINEFORGE_COMMAND_SCRATCH_DIR and PINEFORGE_RUN_JSON_PROFILE, and proves DAC enforcement with an os.open probe first (visible pytest.skip with its reason otherwise). tests/test_default_scratch_effective_credentials.cpp nonroot_row() only (row() and main() unchanged): the setreuid outcome check can fail (EPERM or EINVAL accepted, credentials verified on both branches), the disclosure text is a pure fixture function pinned in test_scratch_capability_parse (every omitted cell " omitted ()", "missing, unreadable or malformed"), four more parser cases (0x80, -80, +80, space after the colon). tests/test_scratch_filesystem_predicate.py: the scan and its self-test also cover -2054924042(L) and 0xffffffff858458f6. docs/design/o1-report-contract.md and docs/pages/run-failure-codes.md: one paragraph each states the ENOTSUP exception (no probe, or a real errno 95 from stat/faccessat/statfs, keeps the default candidate as in 1.6.3 with no tmpfs claim and no note; /var/tmp selected without the rejected-candidate note when its probe answers ENOTSUP) and qualifies, with "except as described below", the sentences "A failed filesystem query stops default resolution with its syscall errno and names the failed candidate at every create wrapper; it never permits fallback." and "If creation in the selected /var/tmp fails, the detail names that directory, the rejected first candidate and set TMPDIR to a disk-backed directory." (o1-report-contract.md) and "A failed query stops resolution with its syscall errno and names the failed candidate." and "failures and all-memory refusals" (run-failure-codes.md); the other sentences keep their words and only their line wrapping changed (same number of lines in each block). No production code changed. Mutations m15 (setreuid EFAULT) and m16 (signed magic).

Also in this commit, frozen 2026-10-24 for the 1.7.0 tag (three additions to the tree the CR-150 legs of 6f8f40e measured; src/ and include/ are unchanged):

1. CHANGELOG.md, section "Costs that remain": three new bullets (ORG-CX), 49 lines added and none removed, so no sentence is deleted. They state the costs that remain with the symbols they name: the I/O paths that can terminate or fail silently, the reads of closed trades and cohorts that now cost I/O, and the report-sink cost.

2. tests/test_scratch_arena.cpp (LAB-CX, commit 280c472 on parent 0f5072d, whose tree equals the one measured; test-only, +25/-4): on the CLOUD Batch VM the container filesystem answers open(O_TMPFILE) with errno 95 (EOPNOTSUPP), measured on lab job rj-20261024t121649-2fe44d, so the row failed there with the bare message "create backing descriptor" while it passes on NTU2 (rj-20261024t121045-c354ce). anonymous_regular_backing now falls back to mkstemp + unlink ONLY when the O_TMPFILE open fails with EOPNOTSUPP, so the anonymous regular-file arena shape is still exercised; it prints a NOTE with the errno when it does. Any other errno still fails, now with "errno N (text)" in the message. Nothing is skipped and no assertion is weakened: after the descriptor exists the row runs the same preallocation, attachment, ensure_size and zero-read checks as before. The engine never opens an O_TMPFILE.

Docs addition 3 (ORG-CX R9-F1/F2, docs only, line counts unchanged): three public pages stop promising an envelope run_json never emits and a NULL sink removal that can be refused. Its own message follows verbatim so scripts/check_doc_reverts.py reads the nine sentences it replaces.

docs: three public pages stop promising an envelope run_json never emits and a NULL sink removal that can be refused

REV's read of the frozen tree (R9-F1, R9-F2): the code and the CHANGELOG are right, three pages are not.

report-schema.md (lines 253-267) said explicit-mode JSON carries report_contract/report_capture
and that explicit modes add policy keys and move the fingerprint to version 3. On the run_json.py
transport an explicit --report-mode FULL is the legacy route (docker/run_json.py: "--report-mode
FULL is identical to omitting the option"; only SUMMARY_ONLY and STREAMED are refused as
report_mode_unsupported), so it adds none of those keys; they appear on a host that fills the v1
envelope (C++ fill_report_envelope_v1). o1-report-contract.md (lines 47-55) made the same claim
for every explicit request. abi-stability.md (lines 165-172) listed -1, -2 and -3 for the sink
setters but not that NULL returns -3 while an idle handle still holds a completed run's scratch
curve or sealed rows (src/engine_report.cpp set_report_sink_v1 and set_report_sink_fd_v1), that
an invalid scratch-arena environment returns -1, or that a completed fd generation detaches and
keeps its receipt and summary (include/pineforge/report_sink.h documents all three).

Line counts of all three pages are unchanged (818, 584, 672), so no citation moves.

Sentences replaced (named for the doc-reverts check):

• "Explicit-mode JSON includes report_contract: "pineforge-report/v1" and report_capture, containing version, the mode name, complete, and all seven sequence objects above."
• "Explicit modes also add report_contract, report_mode, and sequence_capture to applied_runtime and fingerprinted provenance.runtime."
• "Either sink setter replaces the one installed sink, and NULL through either setter removes it."
• "Both return 0 on acceptance, -1 for a bad handle or descriptor prefix (or a negative fd), -2 during a stream and -3 during a batch run or report capture."
• "Run-begin validation and write errors use the existing typed report_sink_failed path."
• "The caller keeps the fd open through execution and report capture, then closes it to signal EOF."
• "The engine never duplicates or closes a borrowed fd, including on failure, replacement or handle destruction."
• "No option keeps the legacy route."
• "An explicit request must either return the requested versioned envelope or fail."

Frozen2 additions (2026-10-24, after REV's P1 on the adapter retirement sweep, R6a-F1): the tree of the first frozen commit cad8b4b plus exactly four changes, nothing else.

1. src/source/pine_adapter.cpp (CR150-CX, commit f5deaf8, parent cad8b4b, 6 insertions and 6 deletions): erase_retired_rows keeps a dormant askable-origin exit leg pinned for its cycle, as v1.6.3's K1 pinned it. The retirement sweep released a dormant askable-origin exit leg A when a later same-family, same-source, same-from_entry exit with different stop bits existed (release_superseded), dropped it from the K2/K3 candidates, and let K3 keep it anyway as the first witness of a live exit Y. A's own supersessor B (released by a later C, nobody's witness, no projection_predecessor link) was then erased. revive_brackets_after_margin decides "superseded" only over retained rows, so with B gone and C's stop bits equal to A's, a margin call restored A as a marketable flatten at the margin price under A's exit id: an extra trade that v1.6.3 never books (v1.6.3 pinned every unwithdrawn lifecycle row for the cycle). held_by_cycle and the matching collection of held legs in the unpinned pre-pass now require the leg's origin NOT to be askable, dormant or not: a dormant askable-origin leg is pinned by pinned_by_itself exactly as in v1.6.3 and is never released. Withdrawn legs, non-askable origins and everything else are unchanged. The cost: a script that keeps re-issuing strategy.exit(qty=) over a dormant askable leg without cancelling retains its rows while the origin stays open, as v1.6.3 did.

2. tests/test_k1_askable_origin_supersessor_erasure.cpp and tests/cr150.d/p2cx-k1.cmake (P2-CX, commit b4c5a42, parent cad8b4b; the registration is the tree's own tests/cr150.d/*.cmake glob, so a clean checkout builds it): the K1 reproduction of REV's R6a-F1 tape runs on two fresh hosts, default ERASE and RETAIN-every-row. Per-bar leg, dormancy and position state is printed for both, controls assert that each tape condition held, and the only oracle is erase trades == retain trades (no literal trade list). A red here (erase books an extra margin-price flatten under "X") proves REV's P1. Green on NTU2 with the fix: job rj-20261024t140803-0bf6e2, 8/8, ERASE == RETAIN.

3. CHANGELOG.md (ORG-CX, patch CHANGELOG-171-DORMANT, sha256 1407fc7f980338d4b11ef31ab25aac5b7df3a9a299e8db09757307b708b0b610): a new last bullet of "Costs that remain", "Re-issued exits on a dormant leg keep one placement row per re-issue" (card ORG-171-DORMANT), and one exception clause in the "placement retirement rules (CR-150)" entry. The sentence it changes (named for scripts/check_doc_reverts.py): "for the dormant exit legs of one origin, exit id, family and entry only the oldest is kept as the representative, with superseded dormant legs released; the retired rows leave the hashed placement sequence, so hash values change wherever such a placement retires;" now reads "..., with superseded dormant legs released (except a dormant leg that was not withdrawn while its origin is still open: it is kept until its position cycle ends, see Costs that remain); the retired rows leave the hashed placement sequence, so hash values change wherever such a placement retires;".

4. The message of the first frozen commit is carried verbatim above, with ONE number corrected: "Line counts of all three pages are unchanged (818, 584, 672), so no citation moves." (the first message said 817; docs/pages/report-schema.md has 818 lines).

Co-Authored-By: Claude Sonnet 5.5 [email protected]

🤖 Generated with Claude Code