Combine pull requests 781, 758, 780 and 783 with the corpus validation, trade text and RCI changes - #788

A bounded drawing arena replaces its whole state with a deep copy on every
create, delete and setter, whether or not a checkpoint shares it, so a script
that moves a few of its live drawings per bar pays O(bound) per call and the
first write after each checkpoint pays it again. The unbound arena already
shares blocks of 32 records between copies and clones only the blocks a write
reaches; this is the bounded twin of test_coof_drawing_checkpoint_cost.

The test fills an arena to its bound (100 and 1,000), then runs the scheduler's
checkpoint sequence (snapshot, restore, execute, commit) around an execution
that deletes the oldest label, creates one, moves three and changes one text,
all with texts that are never inline so a record copy allocates. Per execution
it checks that the arena shares all but a few blocks of records with its
checkpoint (the same record object through both) and that the heap blocks
allocated do not depend on the bound, that the arena equals a plain model of
the same operations after every execution, and that checkpointing an unwritten
arena allocates the same at both bounds.

The cost row is the row the change that follows must turn from red to green;
the model row and the unchanged-checkpoint row are the guards that change has
to keep green.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

A bounded arena replaced its whole state with a deep copy on every create,
delete and setter: every slot, the text of every label, the directory and the
order, whether or not a script-state checkpoint still shared it. A script that
moves a few of its live drawings on every bar therefore paid time proportional
to the bound on every call, and the first write after each checkpoint paid it
again.

The slots now live in a DrawingRecordStore, the block store the unbound arena
already uses: blocks of 32 that a copy of the state shares, one path copied per
write that reaches a shared block. A copy of the state shares the blocks and
copies only the directory and the order (an integer per occupant), the
directory with room for every slot so a creation never reallocates it.
Creation, deletion and every setter give the arena a state of its own when a
checkpoint shares it, then change it in place. Each does every step that can
allocate or throw (the state's copy, the copy of the slot's block, the
directory's room, the order's growth) before its first change and only steps
that cannot throw after it, so a refused allocation leaves the arena and its
checkpoint as they were. The search for the lowest free slot starts at a
recorded index below which every slot is occupied, so slot reuse order is
unchanged and a creation no longer scans every slot.

The bound, the typed overflow outcome, the stale-handle behaviour and every
value a script reads are unchanged.

The source allocation-bound gate (ci/cr150-source-bounds.yaml) pins every
growable-container site of include/pineforge/**, so its reviewed site
inventory moves with this change: the two groups for the removed whole-state
copies are deleted and the OPEN ceiling drops by two; the groups for the slots
(a block store filled by push_back), the directory and the state's allocation
gain the new site identities. The inventory is the gate's own proposal for this
tree; its differences from the previous one are exactly those sites. The
gate's real-tree test pins the number of OPEN groups, so that pin moves by the
same two.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Main moved to the hosted verification jobs and their documentation since this
branch was cut. No file of this change is touched by those commits and no
conflict arises.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… lines

A bounded drawing arena's edits and checkpoints do no per-record work in the
bound: they copy only the blocks of 32 records they write. They do not cost
O(changes): the first write after a checkpoint still copies the slot directory
and the creation order (one 8-byte integer per occupant), and deleting the
oldest drawing moves the directory's entries. The test header and the
CHANGELOG now say so, and the test's function is renamed to match.

The source allocation-bound manifest keeps its line fields as diagnostics. The
entries of drawing.hpp that the change moved (U1665, U1669, U1670, U1671,
U1672) carry the first line the gate finds for them again. No identity changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The CHANGELOG entry and the cost test header of the bounded drawing change said
that the first write after a checkpoint copies "one 8-byte integer per
occupant". The slot directory holds two 32-bit integers per occupant (the id and
the slot) and the creation order one 32-bit integer, so both now say "a
directory entry and an order index per occupant". Words only: no code, no
assertion and no manifest line changes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Main moved by one commit since the previous merge: the hosted sanitizer builds
get a dedicated data disk (two workflow files). No file of this change is
touched by it and no conflict arises.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Assert open and closed short accessors preserve direction from a real fill.

Report signed quantities for open and closed short trades while preserving long,
flat and bounds behavior.

The signed trade-size accessor fix intentionally removes two obsolete public statements from docs/pages/pine-to-native.md. The sentence introduced by 7328f4d is wrong after the fix because Pine's size accessor carries direction in its sign; the sentence introduced by cced2aa is the same obsolete unsigned/raw-quantity description. The replacement rows state positive long and negative short and distinguish raw magnitude fields with is_long.

Name 7328f4d and cced2aa so the doc-reverts guard can verify why those historical sentences were removed.

The accessor bodies already return signed quantities; keep each expression on one source line so the existing documentation citations remain bound to the same header and implementation lines. This preserves the exact signed-size tree behavior while removing the anchor shift.

…n moved its lines

The bounded drawing checkpoint test adds one source, test_drawing_bound_checkpoint_cost, to the TEST_SOURCES list near the top of tests/CMakeLists.txt, which moves every later line of that file by one. The evidence row for test_pooc_close_fill_view_tapes cites five of those lines: the line the sweep re-reads (3459, now 3460) and four in its reason text (:3443, :3455, :3479 and :3485-3501, now :3444, :3456, :3480 and :3486-3502). test_private_fixture_reads failed with "the token no longer sits on tests/CMakeLists.txt:3459", and test_private_fixture_reads_controls failed with it.

Only those five numbers change; the row's text is otherwise as it was. Each new line was read from the file: 3444 is the EXISTS test of a tape, 3456 the increment of _pf_pcv_emitted, 3460 the condition that is the row's token, 3480 the registration of the test, 3486 the registration of the skipped placeholder.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Use GCC minimal debug information for instrumented Debug profiles while
retaining file and line data, sanitizer flags and the full test selection.
Keep the definition below the cited profile-floor table so existing
documentation anchors remain valid.

This is a measurement step: it lowers debug info only. The pass condition
is at least 20 GB free after Verify on the worst hosted sanitizer shard.
If that margin is not reached, each shard will build only its own targets
next.

Update the margin-call twin assertion digest and register the pyramiding
partial-drain signed-size rewrite in the twin parity inventory. Recompute the
inventory hash so the guard covers both intentional assertion changes.

Build and select the existing ABI layout probe alongside the eleven existing
fast executables. Update the derived membership pin, preserve prior checks,
and exercise removal of the actual ABI row through the real workflow checker.

Documentation replacement: the sentence "names its eleven real executables;
configure refuses" now names twelve executables and explains the existing
probe's Linux x86_64 GNU libstdc++ applicability.

The ABI smoke explanation adds two documentation lines. Correct both exact
line-count expectations from 2060 to 2062 while retaining all substantive
runner, slow-inventory and same-size negative checks.

Accept live_drawings through the existing typed limit helper and publish
its English template, preserving the code identity, since value and prior
limit values. Regenerate the registry and catalog diff and exercise distinct
operator maxima through the real helper contract.

Bring the merged hosted release workflow and its CI documentation and
checks into the candidate without rewriting the existing commits.

Bring the merged hosted release workflow and its CI documentation and
checks into the candidate without rewriting the existing commits.

The merge gate now requires pineforge/parity and treats pineforge/verify
as advisory, so the promotion workflow skipped every engine merge whose
head carried no verify status. Admit on pineforge/parity success alone;
a failed or absent parity still skips.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Retain the ABI smoke selector and its tests alongside the current engine changes.

Retain the runtime limit catalog addition alongside the current engine changes.

Takes in main since 0027d8e (89 commits). The two conflicts were additive: the runner usage text now lists both `--report-jsonl=delta-v2` and `--trade-text`, and the changelog keeps main's entries before the trade text entry. No other file of the companion channel overlaps a main change except runner/CMakeLists.txt and runner/README.md, which merged without conflict.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…site manifest, doc anchors

The merge with main left four checks of the trade text companion failing.

- test_trade_text_default_bytes took PINEFORGE_VERSION_FULL as the expected
  engine field. The report sink writes PINEFORGE_VERSION_STRING
  (MAJOR.MINOR.PATCH), and the full value gains a describe suffix on a tagged
  checkout, so the row only passed where describe was unavailable. It now takes
  PINEFORGE_VERSION_MMP, which is the value the sink writes in every
  configuration.
- The allocation-bound manifest gets five unreviewed groups for the companion's
  source accessor and writer, its unreviewed ceiling goes from 1407 to 1412, the
  gate test pins 1356 + 56 + 184 open groups, and the site inventory gains the
  eleven concrete sites. No existing inventory record changes.
- The runner's test block moves to the end of runner/CMakeLists.txt so the design
  doc lines that cite that file stay valid, and one main.cpp anchor follows the
  usage text lines to 344.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Require the complete parity-only head predicate while preserving main-copy,
latest-status, pagination, tree, authorization and credential-order checks.
Add Bash and jq status decisions and workflow mutation controls.

Normalize enclosing parentheses around the exact parity-success expression.
Reject compound and malformed predicates, and cover parity-only, verify-only,
combined-status and missing-status cases plus expression wrapping controls.

Point seven documentation citations at the matching catalog fields after the vocabulary additions shifted their lines.

…sult rules

Brings the reviewed final head of the release admission contract into the
branch that adds the corpus validation job variant. The incoming change makes
the data-only admission entry pin the workflow_dispatch trigger and its inputs
of the split release workflow, the repository context of the upload step, the
main-only guard of the prebuilt build job and of its caller step, and the
frozen legacy copies of the two current workflows, and it adds the negative
tests for each of those pins. The merge is textually clean: the changes meet
only in the two preflight files, in places that do not overlap the corpus
variant rules. Nothing under .github or docs changes with it, so the two
length pins of docs/ci.md stay at 2107 lines, which is the length of the
merged document.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Add an end-to-end regression for the map pair limit: a committed, generated
strategy library driven through the ordinary run_json command line in seven
cases (finite boundary and refusal, omitted and explicit zero limit with two
pair counts each, and a negative option), with an oracle that recomputes what
to expect from the inputs. The row is slow-labelled, registered from its
tests/cr150.d lane file with its library in the owning fence, guarded for
sanitizer and coverage builds, and pinned (89 to 90) in the explicit
slow-row policy.

docs/ci.md: the slow-label bound paragraph and the slow-label inventory
paragraph, introduced by 69cddc9 (#679), now state the size of the pinned set
(90 names, including test_cr559_map_capacity_cli) instead of the retired
43 + 28 = 71 breakdown.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…tion

Brings the head of the pull request that registers the rerun controller tests
in the preflight plan into the branch that adds the corpus validation job
variant. The two changes meet in one place: the stage inventory test of the
preflight plan pins how many checks the plan holds (the whole plan, the fast
tier, and the fast tier on the platforms that skip the prebuilt checks). The
corpus change adds four checks and the rerun change adds one, so each of the
three expectations is the sum of both additions: 71, 66 and 64. Every other
hunk combines without a conflict, and no other line is edited by hand.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The census test of the corpus variant module requires every script test module
to be named by a preflight row or to carry an explicit exemption, and it
requires an exemption to be removed once a row names the module. The pull
request that registers the rerun controller tests in the preflight plan names
scripts/test_ci_rerun_preempted.py, so the combination with it fails that test
until the exemption of the module is removed. This commit removes that one
exemption line and changes nothing else.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…the process

The checker's tests exercised the decision function and the exit codes 0 and 2,
but nothing ran the script to a refusal, and nothing pinned the repository, the
check name, the application and the host that the gate trusts. A script whose
main returned 0 after printing a refusal, or whose constants named another
repository or host, passed every test.

This adds, in the checker's test module only:
- a process-level test that runs the script against a local server for each
  refusal (the check missing, failed, pending, from another application id,
  from another application slug, and for another commit) and requires exit
  code 1, one reason line, no traceback and one request;
- a test that the request names the pinned repository and the check name as
  literal text instead of through the script's own constants;
- a test that a run without an explicit API URL asks the pinned repository on
  the pinned host;
- a test that the four constants have their literal values.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…e tools

The validator's build-and-probe stage (configure, build, library check, feed
derivation, probe run and the comparison of each produced trade file's header
with the recorded tape header) had no committed test; only one successful run
on a real corpus checkout exercised it. A change that ignored a failed build or
a failed probe, or stopped comparing headers, passed every test.

This adds, in the validator's test module only, a test class that runs the
stage against a tiny real Git repository whose tracked scripts are stubs, a
fake cmake first on PATH and a plain corpus directory. The fake tools only
decide which step fails. The tests require, for each step, the reported finding
and whether it counts as an error: a failed configure or derivation is an
error with its log shown; a failed build, a probe without exactly one library
and a failed probe are findings; a renamed or missing header column, an
undeclared trailing column and a repeated declared one are findings; the
declared trailing column is accepted; the command helper returns the exit code
and shows the log of a failure. They claim nothing about what a real compiler
does.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The documentation of the corpus repository validation gate said that the
validator measures the selected subset and that a coverage limit is a finding.
The validator compares only the header of each produced trade file with the
recorded tape header and never compares trades, and no code emits a coverage
finding. The section also described the corpus workflow in the present tense
although the workflow is added by a later corpus pull request.

This rewrites the three sentences, quoted here as they were so that the
documentation checker can see them named:
- "The corpus workflow runs the engine's `scripts/validate_corpus_sha.py`
  against the proposed corpus checkout and prints the engine commit it ran."
- "The validator checks recorded bytes and checkout cleanliness, builds the
  probes and measures the selected subset."
- "A coverage limit is a finding; subset measurement does not establish full
  population parity."

The page is two lines longer, 2109 lines, so the two length pins in the
preflight tests move together.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… branch

Plain merge of the source head into the combined branch; nothing was resolved by hand. The source head already contains main (755e665). It makes the preflight admit split release builds and retained smoke output, pins the identities of the split dispatch and of the legacy workflow fixtures, adds credential-withdrawal controls, and requires repository-bound uploads and main-only OIDC callers.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…anch

Plain merge of the source head into the combined branch; nothing was resolved by hand. The source head already contains main (755e665), the release admission contract (130bda2) and the rerun-controller test registration (348a897). It adds the corpus record validator, the corpus gitlink result checker and the writer of the corpus file digest manifest with their tests and fixtures, lets the preflight admit the corpus validation job of the pull-request workflow, combines the preflight stage inventory with the rerun-controller test registration, and drops the census exemption of the rerun-controller tests. Its tests also cover the checker's refusals at process level and the validator's build and probe failures, and its documentation page states what those checks measure.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Plain merge of the source head into the combined branch; nothing was resolved by hand. The source head is the trade text companion branch merged with main (63f3978), where the two arithmetic conflicts of the source allocation-bound gate (the ceiling and the pinned total) were resolved on the source branch itself. It adds the opt-in trade text option of the live runner.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

… into the combined branch

Plain merge of the source head into the combined branch; nothing was resolved by hand. The source head already contains main (755e665). It computes the simple moving average from a correctly rounded window sum, with tests that check the rounded window means, and records the new window container sites in the allocation-bound inventory.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

163abf5) into the combined branch

Plain merge of the source head into the combined branch; nothing was resolved by hand. The source head already contains main (755e665). It adds an end-to-end regression for the map pair limit, driven through the ordinary command line over a committed generated strategy library in seven cases, registers it as a slow-labelled row from its tests/cr150.d lane file, and pins the explicit slow-row count (89 to 90) and the documentation that states it.

docs/ci.md: the slow-label bound paragraph and the slow-label inventory
paragraph, introduced by 69cddc9 (#679), now state the size of the pinned set
(90 names, including test_cr559_map_capacity_cli) instead of the retired
43 + 28 = 71 breakdown.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…ed branch

Plain merge of the source head into the combined branch; nothing was resolved by hand. The source head already contains main (755e665). It stops the RCI oscillator from copying the price history while ranking, and puts the regression test for its workspace in the required technical-analysis unit target.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…sted state (head 000e2da) into the combined branch

Plain merge of the source head into the combined branch; nothing was resolved by hand. The source head already contains main (755e665). It gives the private calculation group, the current execution frame and the margin liquidation of the native execution consumer explicit constructors with the same default values, so that constructing them in place compiles with Clang 18 and libstdc++ 13 in the default build with the tests on, and it moves nine source citations on three documentation pages by the five lines that the constructors add.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>