v1.11.1 engine train: #797, #801, #789 - #808

Require each release phase to use its own exact-commit CI evidence. Keep the
bump untagged until its checks finish, then authenticate and tag that same
commit. Validate the two-file transition and preserve catalog assets.

Record advisory verification and complete workflow attempt history, bind the
decision to received response bytes, and refuse changed run metadata before
admission. Keep release receipts on refusal and honor declared catalog paths.

Use timezone-aware UTC and keep exact output assertions aligned with each
test input. Preserve every release safety condition and mutation control.

Cover authenticated advisory creators and first-attempt actor refusals.
Reject malformed advisory states before logging them, retain sanitized
unexpected-exception receipts, and distinguish invalid triggering actors
from changed attempt metadata. Keep parity as the only required status.

Carry both strict admission forms in the hosted release workflow, retaining
caller identity, artifact custody and exact-commit release evidence.

Keep historical matrix inputs independent from the phased release workflow
and require both phase and dry-run boundaries on downstream publishing jobs.

Choose the expected guard and message from the complete dispatch declaration,
while retaining strict workflow acceptance and both dry-run boundaries.

…hosted jobs

WorkflowPinTests reads the #768 matrix rebuild of release.yml for its
hosted-matrix contracts. That rebuild keeps the shipped two-phase release
job, a combination the validator correctly refuses, and its single
prebuilt job has no tag-phase guard. Four checks therefore failed. They
now read the shipped workflow:

- test_two_release_phases_stop_before_publication_until_tag_phase pins
  the exact job-level tag-phase if: of prebuilt-x86, prebuilt-arm and
  upload, and the closed job list. The notify-hub, gate, step-condition
  and writer pins are unchanged.
- test_prebuilt_requires_release_success_without_failure_bypasses holds
  the release-success pin for the release job, both build jobs and the
  publishing upload job: needs: release on each build job, upload's exact
  needs: [release, prebuilt-x86, prebuilt-arm], no always(), !cancelled()
  or continue-on-error: outside comments, and no
  release_bump_workflow_findings.
- test_prebuilt_failure_bypass_mutations_are_refused, both subtests,
  inserts each bypass into each build job and into upload and requires
  the same refusal. Each of those jobs first passes with the shipped
  "no continue-on-error" comment in it, so the pin is still shown to
  read keys, not words.

The validator compares every split job header, so the pin now scans the
build jobs and upload before the release job, and a refusal names its
job and bypass. The other WorkflowPinTests tests keep reading the matrix
rebuild.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Scripts that read their closed trades again and again (strategy.closedtrades accessors in a loop) were about 1.9 to 2.0 times slower than on 1.10.0 on histories of 15,500 and 39,456 closed trades. Two things made them slow: every cache hit rewrote the rank of the other entries of its set, and four-way sets spread consecutive trades over four times the pages their rows need.

The cache now follows the number of closed trades. While the ledger holds at most as many rows as the cache has entries (215,070 by default), row n owns slot n: one way, one probe per lookup, and only the pages the rows reach are committed (25,000 closed trades hold 98 pages, 7.8 MB, where four-way sets held 391 pages, 31.2 MB). With more rows the four-way sets apply as before. An append that takes the ledger past the cache's rows, or a rewind back to them, drops every cached row and keeps the allocated pages. In a set, a hit on the most recent entry changes nothing and a hit on any other entry ages only the entries more recent than it, so a full set replaces the entry touched longest ago, as the documentation says. A miss is probed and counted once. Every value a script reads is unchanged: the reports of a 15,500-trade script are identical field by field.

Measured on an aarch64 build host, one pinned core, engine time against 1.10.0 built with the same compiler: a script that scans 15,500 closed trades again and again takes 1.03 of the 1.10.0 time (five rounds; main before this change 1.92); a script that only opens and closes trades is unchanged by this change (1.10 on 150,000 bars, as on main). With 250,000 closed trades, above the cache's rows, a script that scans all of them every 6,000 bars takes 40 s, against 27 s on main before this change and 138 s on 1.10.0 (two rounds). Timings on x86-64 were not measured.

Tests: the placement oracle in tests/ledger_default_cache_rows.hpp now takes the number of rows the ledger holds, and nine tests that compared resident bytes or entry counts with it state both placements; three new tests pin the least-recently-used rule, the single probe of a miss and the placement change.

Documentation: docs/pages/memory-management.md and the header comment describe the placement by row count. Two sentences of the memory page leave in the ledger read cache row: the sentence that began "Storage is private: a global ordinal chooses one four-way set" (introduced by ba14721) is rewritten to state the placement for both populations, and "Page growth preserves entries through the 64/128/256 boundaries." (introduced by 69cddc9) now says that growth preserves entries through every page boundary, every 256 rows within the cache's rows.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Preserve phase-aware release admission while incorporating the current
main toolchain contract. Keep both Eigen flag constants and the mode
parameter, and update the planned-phase fixture to the typed PATH flag.

Co-Authored-By: Codex <[email protected]>

Bring published PR #797 onto engine main a447232 without rewriting
the published kSA commit 653be41. Retain the release and CI changes
and the existing closed-trade cache implementation and regression inputs.

Exact-head CI, parity and official review remain required on this merge.

Retain the tagged VERSION and catalog baseline before exact-head validation.

Co-Authored-By: Codex <[email protected]>

Complete the selected-capacity production entry and add
pineforge-selected-admit, a small command-line program that checks a caller's
capacity bounds on the Source and the selected inputs of a run before the
first writer consumes them.

Production entry: the five selected-capacity observers are bound through the
native materializer, and actual Source records and CSV bytes are accounted
with the existing reserve primitive. Input-sensitive tests cover the field
limits, the exact failure arguments, the byte accounting and the production
binding.

Helper: it reads a versioned request descriptor (tools/selected_admit/
DESCRIPTOR-V1.md specifies the request, the result and the manifest), takes
custody of each input by descriptor number, size and digest, parses it with
the existing selected-capacity reader, calls the product entry, and answers
with one result document and an exit status. The Source stage forwards each
record only after it is admitted, and refuses a forward descriptor that is the
same file as its stdout or stderr (exit 41); the Selected stage counts the
selected pass and retains nothing. The helper and its manifest (size, sha256,
build identity, schema digests, stages) install to bin/ and share/pineforge/.
The sha256 of the spec is compiled into the manifest, so a change to the spec
changes the manifest. The spec also lists what the Source stage holds in
memory (the record window and the reader's copy of one field, each up to the
record cap, a chunk and the process base) with one measured figure, and what
the helper reads from the environment and the file system: GLIBCXX_TUNABLES at
start, and, for a calendar zone that is not UTC-like, TZ and, per libc, TZDIR
and the zone file under the zone database root.

Tests: descriptor, custody, stage and manifest tests, the Source-stage parity
test, an import-list test and a calendar test. The import-list test reads the
undefined symbols of the built helper with nm and fails if it imports one of
its list of 41 process, thread, session, socket, descriptor-duplication,
signalling, system-call or library-loading functions, other than dlopen (one
RTLD_NOLOAD lookup of the engine's own image) and recvmsg (the run-quota
endpoint). The two allowed names are pinned in the test, a glibc fortified or
internal spelling of a forbidden name counts as the name, an nm line that
cannot be parsed stops it, and a listing without pread, poll and
__cxa_begin_catch, which the helper builds measured so far import, is rejected
as empty, truncated or unrelated; having them proves neither completeness nor
which file nm read. The calendar test runs the Selected stage with New York
four-hour script bars across the two clock changes of 2024: the open of the
date's own season is admitted, the open of the other season is refused with
the neighbouring bar opens that civil-time arithmetic gives, and a zone
database root that holds no zone makes the zone unsupported.

Inventory: the allocation-site inventory gets the three new Source-stage
groups and five site rows, the unreviewed ceiling goes from 1410 to 1413 and
the exact-union pin to 1356 + 57 + 184, the five selected limit routes of the
ownership manifest are corrected, and the CMakeLists.txt line citations in
five documents are re-anchored (three citations that named a neighbouring line
now name the line they describe).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The capture counter starts after the ledger cache has been populated, so
resident cache-page growth must not be required in its working-heap peak.
Restore the symmetric fixed-window comparison while retaining the exact
row-count-dependent cache residency assertions and all output oracles.

Retain the row-count-derived page-growth upper envelope, since Release
can allocate cache pages during capture. Do not require that growth in
the measured peak when pages are already resident. Keep the exact cache
residency, scratch-window, output and profile checks unchanged.

…utral names

The registration file of the helper's unit tests, the fence around its script
tests in tests/CMakeLists.txt, and the CTest label of all seven tests carried a
name derived from a work card. They are now selected-admit-helper and
selected_admit_helper. The registrations are otherwise unchanged, and nothing
else in the tree named the old file or label.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The private-fixture reads check reads the add_test arguments of tests/CMakeLists.txt
and refuses a variable that starts with _pf_ unless it saw that variable set in
the files it reads. The manifest test took its expected stages from
_pf_sa_stages_json, which the root CMakeLists.txt sets, so the check stopped on it
and test_private_fixture_reads and its controls failed in every build that runs
the full suite. The pull request always carries tools/selected_admit/stage_source.cpp,
so the root sets that variable to ["source","selected"]; the test now gets
exactly that text, and it still compares it with the stages in the built
helper's manifest.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…rule

CMakeLists.txt takes the sha256 of tools/selected_admit/DESCRIPTOR-V1.md into the
selected-admit helper's manifest at configure time, so a change to that page changes
a build output. The docs-only rule called every Markdown file outside its excluded
trees documentation, and test_no_cmake_file_reads_documentation (the docs-only-tests
stage of preflight) failed on exactly this page: Lists differ:
['tools/selected_admit/DESCRIPTOR-V1.md'] != []. The page joins PROOF_READS, the
list of documentation inputs that proof jobs read, so a change to it runs every
proof leg. The pinned list in the rule's test, the scan test that now requires the
page among the CMake reads it must see, and the sentence in docs/ci.md that counts
the excluded files are updated with it. A new test replays the page in real git
histories: an edit, a rename away, a rename onto its path and a deletion all run the
proof legs, and another Markdown page of the same directory stays documentation.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ision evidence

docs/ci.md: replaces the release-bump exemption sentence introduced by 72d9fd5 (#486), 'When there is no qualifying merged PR for the current main sha, phase 1 permits one release bump only when all three conditions hold:', with the phased release-bump and tag-admission wording of #789.

Co-Authored-By: Claude Opus 5.5 <[email protected]>