engine 1.8.0: cohort tables with per-event work independent of pending orders, live order-key guard, id admission and session fixes - #541

…g orders, live order-key guard, id admission and session fixes

Part of #452. Credit: the "walk live cohorts only" shape follows the external proposal in #458.

This is the engine side of the 1.8.0 integration: the cohort-table work for runs with many pending orders, the guard on live order keys with its optional run-failure argument, and four smaller fixes. It targets engine 1.8.0.

## Behaviour changes users can see

- Jailed profile: an id longer than 64 bytes is refused before any store mutation with scratch_capacity_exceeded ("id longer than 64 bytes"). The jailed default scratch manifest follows a 64 MiB share (id table 262,144 / 32,768 / 65,536 entries), mirrored in docker/run_json.py. The resident floor of a jailed run rises by about 51 MiB (the slab is zero-filled at construction: 61,128,704 B computed, +52 MB measured as jailed peak RSS on a dense run), a fixed floor, not growth with bars. The jailed ceiling for distinct entry ids moves from 4,096 to 65,536. Unjailed runs are unchanged.
- Two live order keys whose 64-bit hashes collide are refused with engine_invariant instead of one silently replacing the other. engine_invariant gains an optional vocabulary argument `reason` with the single value order_key_hash_collision; every other engine_invariant still carries no argument, no code is added or removed, and hosts should accept (not pin the absence of) the optional argument. The catalog diff shows one changed code.
- Strategy ids, entry selectors and OCA names that contain NUL or the unit separator (0x1f) are refused at admission with pine_invalid_argument (rule unsupported_combination), because composite exit and replacement keys join two user strings with 0x1f.
- A session string with more than eight windows is parsed completely (it stopped at the ninth window, so the daily close fell back to the first window only). Up to eight windows keep the fixed-size storage and allocate nothing.
- The per-chart range vectors of the aux security feed give their capacity back at terminal points of a batch run.

## Cohort tables

- A full close no longer seeks the scratch index once per owner for every bracket family: BracketRoster::remove_selected checks the in-memory incarnation counts first. A close on N owners goes from N(N+1)/2 seeks to 2N+1. On the dense shape the old code counted 8,385 and 33,153 find_key calls where the new code counts 257 and 513 (a test run, counts printed by the test, not seconds).
- DiskResidentIdTable keeps an ordered held set of the resident rows that hold an opening or live units (held_rows()), so the walks that need only those rows no longer visit every pending-only cohort. Credit: the proposal in #458.
- Resident cohort lookup is O(log R) without allocation or disk; the implicit spill is amortised; kMaxResidentCohorts = 4096 non-spillable cohorts, jailed profile only; refusal texts state the live manifest limit and a workaround.

Measured on a release build of this change against engine main, on a 1m ETH-USDT feed, 4 repetitions per cell (2 at 60,000 and 100,000 bars), 600 s cap per run: the dense script at 4,000 bars goes from 83.9 s to 6.4 s jailed and from 85.8 s to 7.4 s unjailed; the same reports are produced (normalised report hashes equal in all 16 cells where both finished). At 10,000 bars and above the dense script does not finish within 600 s on either tree, so this change does not make the dense shape scale: the per-bar retire pass is still Theta(R) in the number of resident rows, and the close event is still Theta(N^2) in cheap in-memory work (only the scratch seeks became linear). A script with many orders and few ids is 13, 12.5 and 16 percent faster jailed at 30,000, 60,000 and 100,000 bars.

## Live order-key guard

Before a live handle is selected or overwritten, the identity captured for the key is compared with the placement ids. Represented spellings are checked on insert, replace, lookup and erase; a spelling the table does not classify keeps the previous hash-only behaviour and never causes a refusal. A new test walks every represented spelling through a public run, and a check confirms the strict missing-spelling diagnostic text is absent from the built library archive in every build configuration.

## Source allocation gate

The source-bounds gate gains entries for the new container sites: the unreviewed ceiling goes from 1,241 to 1,264 and the pinned OPEN count from 1,429 to 1,452. None of the new entries claims a bound; this is not a flat-memory proof.

## Proof

The engine verification steps (preflight, release, debug, sanitizers, kernel, docs, parity, subset) all pass on this tree; parity measures 312 probes with 312 matching the baseline and none moved. The private-fixture rows of the touched tests, including test_run_failure_codes, pass with the fixtures overlaid.

## Replaced documentation text

In docs/pages/scratch-tables.md two texts from commit 91353de are replaced on purpose by the new constants (they are not reverts): the sentence "The key/byte choices came from an admission policy using 4,096 roster entries and 256-byte components; they are aggregate descriptor limits, not a new per-string length check", and the arithmetic `1+96*4096+1048576 = 1,441,793` (now `1+96*65536+4194304 = 10,485,761`).

Co-Authored-By: letiep97 <[email protected]>
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>