Repository navigation
Fix engine execution cases and selected-capacity admission for 1.12.0 - #825
Conversation
Include #797, #804, #817, #801 and #816: closed-trade cache placement, fill-time drawdown halt and flatten, reversal exit sizing, selected-capacity admission, and the percent default quantity cap. Document the intentional replacement of these earlier descriptions: - docs/design/native-feature-parity.md, introduced by 91d65ad: the old `update_risk_state(bar.close)` once per script bar at the close mark description is obsolete after #804. The cell now describes the fill-time peak, closing-fill threshold, halt latch and immediate flatten. Preserve MG10-a and MG10-b as HISTORICAL, measured on engine f5e929d, before the #804 change, with their values, claim status and grade unchanged. - docs/pages/memory-management.md, introduced by ba14721: "Storage is private: a global ordinal chooses one four-way set" no longer describes placement below the cap after #797 (653be41). Row n owns slot n while retained rows fit the cap; above it the existing four-way sets apply. Crossing the cap invalidates hot rows while retaining allocated pages. - docs/pages/memory-management.md, introduced by 69cddc9: "Page growth preserves entries through the 64/128/256 boundaries." is replaced by the current 256-slot page-boundary rule, which preserves entries through every page boundary within the cap. Re-anchor the remaining documentation citations and move the private-fixture registration evidence anchor from line 3470 to the actual token at line 3473. Preserve its row, predicate and reason; no new parity result or closed surface is claimed. Closes #804, closes #805. Co-Authored-By: Claude Opus 5.5 <[email protected]>
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| # Retain the decoy outside the install location; delete no file. | ||
| configure_decoy.rename(root / "retained-configure-decoy") | ||
| self.run_command(["cmake", "--install", str(build)]) | ||
| binary = check_install(configure_prefix, chosen_sha, True) |
| configure() | ||
| build_all() | ||
| self.run_command(["cmake", "--install", str(build)]) | ||
| binary = check_install(configure_prefix, chosen_sha, False) |
| import subprocess | ||
| import sys | ||
| import tempfile | ||
| import unittest |
| while position < len(data): | ||
| count = os.write(input_write, data[position:position + 4096]) | ||
| position += count | ||
| except BrokenPipeError: |
| position += count | ||
| except BrokenPipeError: | ||
| pass | ||
| except BaseException as error: |
| total += len(chunk) | ||
| if total >= len(HEADER): | ||
| resume.set() | ||
| except BaseException as error: |
| self.assertGreater(count, 0) | ||
| written[0] += count | ||
| pending = pending[count:] | ||
| except BaseException as error: |
| if not chunk: | ||
| break | ||
| forwarded.append(chunk) | ||
| except BaseException as error: |
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.
Not checked: tests were not run; formal verification proved 0 of 7 changed function(s) (7 not verified).
Formal verification. PR-changed functions: 0/7 verified (0 proven, 0 may-equivalent, 0 distinguished) · 7 not verified (7 unsupported).
Not verified on this run: resize (unsupported), default\_sizing\_cash (unsupported), on\_applied (unsupported), pooc\_fee\_units (unsupported), reset\_for\_run (unsupported), update\_risk\_state (unsupported), on\_native\_applied (unsupported).
Graphify review — findings
Adds a pineforge-selected-admit helper with a Source stage, installed at fixed literal paths alongside a manifest stamped with version, spec and catalog hashes. An install-time script writes the manifest from values captured at configure time, so it has to stay tied to the helper actually installed next to it. Source-stage allocations are registered in the CR150 bounds gate as three new unreviewed groups. Changes strategy semantics: strategy.risk.max_drawdown is now tested at fills that close units on equity including open positions, and a breach closes everything at that fill, cancels pending orders and blocks later entries, instead of a single per-bar check that only refused new entries. Percent-of-equity quantities above 100 are capped when both margins are 0, and the named exits of a reversing explicit-quantity entry are sized from the new entry, which fixes the never-firing absolute take-profit. Reworks the closed-trade read cache to give each trade the slot of its ordinal while the run fits within capacity (one probe, far fewer pages committed), falling back to four-way sets with a cache drop whenever a run crosses the capacity in either direction.
Worth a look
- Concurrent installs can publish a manifest for the wrong helper —
cmake/PineForgeSelectedAdmitManifest.cmake:114· Escalate · medium- unverified hypothesis — survived the adversarial refute pass; needs human review
Review partial — this diff was larger than one review pass covers, so later files were not reviewed; some findings may be missing.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 4351 functions depend on the 4077 functions this change touches.
Health — this change adds coupling hotspots:
- worse:
native_run_spec_digest()— 17 callers, 3 callees - new:
parse()— 6 callers, 8 callees - worse:
find()— 10 callers, 4 callees - new:
check_install()— 5 callers, 5 callees - worse:
run_driver()— 1 callers, 15 callees - new:
grid_neighbours()— 5 callers, 3 callees - new:
expect_byte_refusal()— 4 callers, 3 callees - new:
render_result()— 1 callers, 11 callees - …and 10 more — each is listed as a finding
Verification — 4351 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 4246 function(s) in the blast radius were not formally verified this run
Test selection
Test selection
1417 of 1417 test file(s) selected (100%) via static blast radius.
Escalated to a full run for safety (
noncode-change,uncovered-code) — the selection is not trustworthy on its own (see below). CI should run the whole suite.
benchmarks/tests/test_aggregate.py— full-run-safetybenchmarks/tests/test_check_provenance.py— full-run-safetybenchmarks/tests/test_compare.py— full-run-safetybenchmarks/tests/test_public_names.py— full-run-safetybenchmarks/tests/test_run_all.py— full-run-safetybenchmarks/tests/test_run_strategy_feeds.py— full-run-safetydocker/pineforge_sink_finalize_test.py— full-run-safetydocker/pineforge_sink_replay_rq_test.py— full-run-safetydocker/pineforge_sink_replay_test.py— full-run-safetydocker/pineforge_sink_to_json_test.py— full-run-safetydocker/quota_columns_test.py— full-run-safetydocker/quota_convert_test.py— full-run-safetydocker/quota_finalize_test.py— full-run-safetydocker/replay_rq_engine_test.py— full-run-safetydocker/run_json_artifact_window_test.py— full-run-safetydocker/run_json_bin_test.py— full-run-safetydocker/run_json_bounded_transport_test.py— full-run-safetydocker/run_json_bulk_equity_fuzz_test.py— full-run-safetydocker/run_json_bulk_equity_test.py— full-run-safetydocker/run_json_codes_test.py— full-run-safetydocker/run_json_converter_metadata_test.py— full-run-safetydocker/run_json_converter_session_test.py— full-run-safetydocker/run_json_diagnostics_test.py— full-run-safetydocker/run_json_equity_scan_test.py— full-run-safetydocker/run_json_fused_test.py— full-run-safetydocker/run_json_harnesses_test.py— full-run-safetydocker/run_json_metrics_only_test.py— full-run-safetydocker/run_json_misc2_test.py— full-run-safetydocker/run_json_misc_test.py— full-run-safetydocker/run_json_pfbar_test.py— full-run-safetydocker/run_json_provenance_test.py— full-run-safetydocker/run_json_quota_supervisor_test.py— full-run-safetydocker/run_json_replay_test.py— full-run-safetydocker/run_json_selected_sink_test.py— full-run-safetydocker/run_json_sink_lexical_test.py— full-run-safetydocker/run_json_sink_summary_test.py— full-run-safetydocker/run_json_sink_test.py— full-run-safetydocker/run_json_sink_vectors_test.py— full-run-safetydocker/run_json_spool_work_test.py— full-run-safetydocker/run_json_stringio_test.py— full-run-safetydocker/run_json_symbol_feeds_test.py— full-run-safetydocker/run_json_syminfo_test.py— full-run-safetydocker/run_json_trade_scan_test.py— full-run-safetydocker/run_json_window_budget_test.py— full-run-safetydocker/run_json_wrapper_work_test.py— full-run-safetyinclude/pineforge/native_run_spec.hpp— full-run-safetyscripts/derive_corpus_feeds_self_test.py— full-run-safetyscripts/fingerprint_self_test.py— full-run-safetyscripts/run_corpus_self_test.py— full-run-safetyscripts/test_abi_receipt_skips.py— full-run-safety- … and 1367 more
non-code file(s) changed (
CHANGELOG.md,CMakeLists.txt,ci/cr150-source-bounds.yaml,ci/cr150-source-sites.json,cmake/PineForgeSelectedAdmitManifest.cmake…) → running the full suite for safety (a code graph can't see config/fixture/data deps)
changed code file(s) with no mapped test (
CHANGELOG.md,docs/adr/0001-kernel-adapter-boundary.md,docs/ci.md,docs/design/arena-bound.md,docs/design/consumed-partial-exit-fold.md…) — a coverage gap or a missing link — running the full suite rather than only the selected tests
Selection is safe under the controlled-regression assumption; always-run tests + a periodic full run are the backstops. Advisory — it never changes the check verdict.
Docs that may be stale (advisory)
AGENTS.md§ What this repo is (lines 5-11): references changed symbolssourceAGENTS.md§ Layout (lines 26-41): references changed symbolssourceAGENTS.md§ Local-only tests (no CI job runs them) (lines 71-82): references changed symbolsselectedAGENTS.md§ Conventions (lines 103-116): references changed symbolssourceAGENTS.md§ Safety rules (lines 117-127): references changed symbolssourceCLAUDE.md§ What this repo is (lines 5-11): references changed symbolssourceCLAUDE.md§ Layout (lines 26-41): references changed symbolssourceCLAUDE.md§ Local-only tests (no CI job runs them) (lines 71-82): references changed symbolsselectedCLAUDE.md§ Conventions (lines 103-116): references changed symbolssourceCLAUDE.md§ Safety rules (lines 117-127): references changed symbolssource
…and 10 more.
Formal verification
Could not verify: Could not verify resize.
The verifier did not have enough to check resize, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: unsupported: member function — receiver/self (`this`) not synthesizable from the simple-type literal pools — abstaining rather than guessing a receiver
Could not verify: Could not verify default\_sizing\_cash.
The verifier did not have enough to check default\_sizing\_cash, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: unsupported: member function — receiver/self (`this`) not synthesizable from the simple-type literal pools — abstaining rather than guessing a receiver
Could not verify: Could not verify on\_applied.
The verifier did not have enough to check on\_applied, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: unsupported: member function — receiver/self (`this`) not synthesizable from the simple-type literal pools — abstaining rather than guessing a receiver
Could not verify: Could not verify pooc\_fee\_units.
The verifier did not have enough to check pooc\_fee\_units, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: unsupported: member function — receiver/self (`this`) not synthesizable from the simple-type literal pools — abstaining rather than guessing a receiver
Could not verify: Could not verify reset\_for\_run.
The verifier did not have enough to check reset\_for\_run, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: unsupported: member function — receiver/self (`this`) not synthesizable from the simple-type literal pools — abstaining rather than guessing a receiver
Could not verify: Could not verify update\_risk\_state.
The verifier did not have enough to check update\_risk\_state, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: unsupported: member function — receiver/self (`this`) not synthesizable from the simple-type literal pools — abstaining rather than guessing a receiver
Could not verify: Could not verify on\_native\_applied.
The verifier did not have enough to check on\_native\_applied, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: unsupported: member function — receiver/self (`this`) not synthesizable from the simple-type literal pools — abstaining rather than guessing a receiver
· 14 grounded finding(s) anchored inline below; 4 more finding(s) on lines outside this diff (see the check run).
|
|
||
| } // namespace | ||
|
|
||
| int main() { |
There was a problem hiding this comment.
main()
fans out to 11 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| CHECK(old_rows == 1); | ||
| } | ||
|
|
||
| void check_exits(const Scenario& spec, const std::vector<Bar>& bars, const Observed& got) { |
There was a problem hiding this comment.
check_exits()
fans out to 7 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| got.final_units, got.error.c_str()); | ||
| } | ||
|
|
||
| void run_case(const Scenario& spec) { |
There was a problem hiding this comment.
run_case()
fans out to 6 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
|
|
||
| } // namespace | ||
|
|
||
| int main() { |
There was a problem hiding this comment.
main()
fans out to 6 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| FOUR_HOURS_MS = 4 * HOUR_MS | ||
|
|
||
|
|
||
| def grid_neighbours(start_ms, offset_hours): |
There was a problem hiding this comment.
grid_neighbours()
high coupling complexity (Ca·Ce = 15).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| } | ||
| } | ||
|
|
||
| void empty_source_and_auxiliary_headers_are_charged() { |
There was a problem hiding this comment.
empty_source_and_auxiliary_headers_are_charged()
fans out to 6 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| check_primary_prefix(run, 1); | ||
| } | ||
|
|
||
| void expect_byte_refusal(Run& run, std::uint64_t limit, std::uint64_t used, |
There was a problem hiding this comment.
expect_byte_refusal()
high coupling complexity (Ca·Ce = 12).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| return true; | ||
| } | ||
|
|
||
| inline DecodeStatus decode_descriptor(std::string_view bytes, Stage stage, |
There was a problem hiding this comment.
decode_descriptor()
fans out to 9 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| return j.finish(); | ||
| } | ||
|
|
||
| inline std::string render_result(const Outcome& out) { |
There was a problem hiding this comment.
render_result()
fans out to 11 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| return sc::DriverReason::InternalError; | ||
| } | ||
|
|
||
| inline Outcome execute_stage_source(const Descriptor& d, const Seam& seam = Seam{}) { |
There was a problem hiding this comment.
execute_stage_source()
fans out to 6 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
Include #797, #804, #817, #801 and #816: closed-trade cache placement, fill-time drawdown halt and flatten, reversal exit sizing, selected-capacity admission, and the percent default quantity cap.
Document the intentional replacement of these earlier descriptions:
update_risk_state(bar.close)once per script bar at the close mark description is obsolete afterstrategy.risk.max_drawdown(value, strategy.percent_of_equity): no halt in a strategy that only reverses, and an early halt in a strategy that enters from flat #804. The cell now describes the fill-time peak, closing-fill threshold, halt latch and immediate flatten. Preserve MG10-a and MG10-b as HISTORICAL, measured on engine f5e929d, before thestrategy.risk.max_drawdown(value, strategy.percent_of_equity): no halt in a strategy that only reverses, and an early halt in a strategy that enters from flat #804 change, with their values, claim status and grade unchanged.Re-anchor the remaining documentation citations and move the private-fixture registration evidence anchor from line 3470 to the actual token at line 3473. Preserve its row, predicate and reason; no new parity result or closed surface is claimed.
Closes #804, closes #805.
This is the 1.12.0 batch-1 train as one commit, without #820 (its cases come back in the next batch). It supersedes #824, #822 and #808.
🤖 Generated with Claude Code