native order: dormant working book, flat per-point cost for never-filled orders - #578

…led orders

A working order that cannot act at the current point is kept dormant instead of being evaluated at every point. Resident dormant rows are refreshed by one bounded bulk sweep in winner order, and spilled rows carry a stamp so their allowance is projected on read to the exact value the eager path would hold. Rows above 4096 spill to a disk-backed book, and the match path touches only candidates in a resident tier plus O(log n) index steps, so the cost of a point no longer grows with the number of standing orders.

Trades, fills, hashes and refusals are unchanged on every valid input: the dormant tier is an exact cache of the eager allowance (same value, same epoch, same token), any dormant-only failure degrades to the eager path, and a run that cannot use the fast path takes the eager path unchanged.

Tests: a transcript suite compares eager and dormant runs byte for byte (hashes, allowances, fills) across the seven driver classes, spill from the middle inside notification callbacks, held-copy reads, bad_alloc and read-failure degrade paths, and a cost row bounding disk reads per extra spilled row. 43 mutation patches with a manifest name the row each one must turn red. test_native_dormant_book_capacity is added to the pinned slow rows.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Comment-only (plus the text of diagnostic messages) rewrite of the dormant-book tests, the mutation README and manifest, and the new comments in the kernel sources: every passage now says what behaviour it pins and why, with no reviewer, process or row-number names. No executable code, assertion or constant changes. The manifest row for the epoch mutation names the test that actually turns red, and two mutation patches are regenerated against the reworded context.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The dormant-book fixtures used internal-looking ticker labels. They are renamed to TEST:DORMANT (and TEST:UNREACHABLE for the unreachable-book fixture). The ticker is only a symbol label shared by the eager and dormant runs of one test; nothing else changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…und manifest and the doc anchors

The working-book implementation moved into src/native_order_book.hpp, so the reviewed allocation-bound entries and site records that named src/native_order.cpp are relocated (ids, owners and states kept), and the new working-book containers get open, unreviewed entries: their resident vectors, spill tables and byte buffers grow with live work, so none is marked bounded. 117 doc anchors that cite moved source lines are re-pointed to the lines that hold the cited symbol or statement; no doc line is added or removed.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ngine into dormant-working-book

…ing book and refresh the generated site inventory

The first manifest pass missed thirteen sites in src/native_order.cpp (the scratch directory references, retained path text and the opening, live-order and successor-root row vectors). Two entries now cover them, both left unreviewed because their size follows the number of orders; the unreviewed ceiling rises by the same two. ci/cr150-source-sites.json is replaced by the gate's own generated inventory for this tree. The doc-anchor checker's one-line fix to the parity table is applied, and two anchors in the contracts page that landed on comment-only lines point at the calls they describe. No code, bound or behaviour changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…nt of the real-tree gate test

The real-tree gate test pins the number of open manifest entries. The manifest changed in this branch, so the pinned count moves to the number the gate now reports. No other change.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>