engine: fixed-shape O(1) store for Pine collections (A5-STORE) - #515

create() wrote the 16-byte header at the head of the shared chunk buffer and
then reused the same buffer for chunks 1..n, so every data chunk began with the
header bytes instead of zeros. Zero the buffer before the data-chunk loop.
Found by test_o1_store (chunk-boundary read at offset 15, lab row
rj-20261024t154037-8f329c).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The committed-transaction group of check_no_heap_after_open failed on the lab
(rj-20261024t155803-5531ae, REQUIRE(held) at the group end) without saying
which step. Print the step reached and any exception text so the next lab row
names the cause.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The discarded-transaction group created a 48-byte object and expected a
64-byte write to return 64; Store::write clips to the object size. Expect 48.
Lab row rj-20261024t160559-716c38 showed the committed group now passes and
this group fails.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The discarded-transaction group created the object before begin(), so the
rollback could not discard it and `!alive(discarded)` was false. Create it
inside the transaction. Lab row rj-20261024t161347-e68974 (REQUIRE(held) at
the end of the group, the committed group before it passes).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

….txt keeps its line count

An inserted line shifts every later line of CMakeLists.txt and breaks seven doc anchors
(CMakeLists.txt:169, :172, :398 cited by native-engine.md, adr/0001, native-feature-parity.md);
joining the new source onto an existing list line keeps the anchors valid with no doc edit.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ges 1024), refused in the constructor

The chunk buffer and the resident page cache were sized straight from Shape, with only a size_t
overflow guard above. The CR-150/C4 source-bound gate can name a fixed input only if the constructor
itself refuses larger values, so the two limits (values set by CR150-CX) are now named constants and
std::invalid_argument refusals next to the existing Shape checks. New test group check_shape_caps:
a Shape at each cap opens (chunk cap also round-trips a full-size object), one above each cap is refused.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…d onto add_library so line numbers stay put

One kernel source per line is what scripts/measure_detached_comments.py kernel_closure() reads, so the
earlier same-line join broke the detached-comments stage. Listing the source on its own line shifts
the lines below it by one; moving the explanatory comment above add_library to the end of that
line gives the line back. CMakeLists.txt stays at its line count, add_library stays on line 169
and PINEFORGE_KERNEL_SOURCES on 118, so the doc anchors that cite them still hold.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…hored by CR150-CX), ceiling 1237 -> 1241

Applies CR150-CX's gate patch (runner/CR150-CX/gate-patch-p2-a5s2.patch, sha256 a825b090efac2ff6...):
ci/cr150-source-bounds.yaml gains rows U1483-U1486 (state unreviewed, each note names its site and
class, the Shape caps kMaxChunkBytes / kMaxResidentPages are named in the reset group's note),
ceilings.unreviewed 1237 -> 1241; ci/cr150-source-sites.json gains the six site records copied from the
gate's own findings; scripts/test_cr150_source_gate.py pins the OPEN count 1425 -> 1429.
Data authored by CR150-CX, not by the a5s lane; no gate script logic changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…gin() allocate before it opens; tests that can see a per-object leak

REV-CX's two P2 findings on the A5 object layer.
P2-2: lookup/read failures (header lookup/read, chunk lookup/read) threw through throw_status
without marking the open outer transaction rollback-only, so a caller that caught the exception
after an earlier chunk had been written could commit a torn write. throw_status is now a StoreImpl
member and marks rollback_only_ before it builds the exception string. begin() also allocates its
handle BEFORE it opens the ScratchStore transaction, so a bad_alloc cannot leave an active outer
transaction nobody owns. New rows: a read-fault backing that fails the second chunk's value read
after the first chunk's put (write throws, the next mutation throws logic_error, rollback restores
the object byte-exactly) and a refused begin allocation.
P2-1: the growth-gate "resident flat" assertions read ScratchStore's constant workspace size and
cannot see an object-layer heap leak; the growth loop now also asserts that the number of global
allocations equals one Tx handle per begin() at both 100,000 and 1,000,000 bars.
P3: zero-fill assertion after shrink and regrow, contract text (begin() throws while rollback-only,
handles must be destroyed before the next outer begin, single-threaded, one allocation per begin),
the resident-page cap comment (a page-count cap, not a byte cap), the test ceiling's metadata term,
the journal_slots comment, and the debug fprintf lines are gone.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… StoreTx site, throw_status in the class); header contract clause

Applies CR150-CX's re-authored gate data (runner/CR150-CX/gate-patch-p2-a5s2-76fceda8ad.patch, sha256
eb3f0a9fa1f326b4bdb839d31a5e06d7629ff03078b28f67a07a58566a350b64): the <temp:string> record takes the
scope of throw_status as a StoreImpl member, the two new:StoreTx records become one record with the
symbol `transaction` (begin() now allocates its handle once, before the ScratchStore transaction
opens), the notes carry the current lines and the page-COUNT wording of the resident cap (resident =
(resident_pages + 6 work pages + metadata pages) x page_bytes, at most about 1 GiB at ScratchStore's
1 MiB page limit), and the OPEN pin follows the gate's own count (1429 -> 1428). Data authored by
CR150-CX; no gate script logic changes.

o1_store.hpp: the contract now says that a backing failure in any call, including a read-only one,
makes the open outer transaction rollback-only (REV-CX P3). Comment only; the cap lines 54-55 and
every o1_store.cpp line stay where they were.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The gate on 3b6aa07 reports containers=1429 entries=1429 findings=0 (OPEN counts entries, not
sites; the four o1_store rows all match again). The previous commit pinned 1428 from the unmatched
state of one row; scripts/test_cr150_source_gate.py:1218 returns to the value it had before.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

tests/cr150.d/p2cx-a5s.cmake:3 labels test_o1_store "slow;mem" (the test runs about five minutes). The
sharded Debug profile excludes slow rows and refuses any excluded row that is not in
PINNED_SLOW_TEST_ROWS, so the Debug verify leg failed at the ctest-exclusion stage with "CTest excluded
unpinned slow rows: test_o1_store" (lab job rj-20261025t173910-db2c79, release leg green). The policy
comment asks for an explicit change for a new slow row: this adds the one name, after the last existing
entry, so no earlier line of scripts/ci_verify.py moves.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Brings in 6cfea80 (docs: backfill release notes for engine releases, #510): CHANGELOG.md and
README.md only. First parent is 52cd416; no file of the o1::Store change is touched by main.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>