[luisleo526]

Keep the cohort admission order intact when a new cohort is requested.

The table ticket and the existing-id cadence are now taken before any host
allocation, the fresh cohort is admitted before cohort_open, and the host
handle is placed only afterwards. A refused admission therefore no longer
consumes a host cohort handle.

Tests:

• test_cohort_for_admission_io_refusal: a refused cohort_for must not
  consume a host handle (fails before this change, passes after).
• test_cohort_for_live_limit_new_id and test_cohort_for_existing_id_cadence:
  guards for the live-limit refusal of a new id and the per-call history of an
  existing id; both must stay green.

The source-site inventory and gate baseline register the new placement sites
and drop a stale index identity; the documentation anchors are updated for the
moved lines.

🤖 Generated with Claude Code

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

Not checked: tests were not run; no formal proof of the changed code.

---

Graphify review — findings

Splits DiskResidentIdTable::emplace into admit, which runs the refusal and spill checks and opens the scratch file through the new DiskIdTable::open_for_insert, and place, which inserts the index record and resident row and throws an engine-invariant error if the key is already present. PineExecutionAdapter::cohort_for now drives this admit-then-place sequence, so the admission checks live only in admit, place enforces none of them itself, and anything created between the two calls has to be unwound if place fails. Updates the CR150 source-bounds inventory (unreviewed count drops to 1402) and the arena-bound.md line reference to match.

Worth a look

• Public place() skips all admission checks unless admit() was called first — include/pineforge/detail/disk_resident_id_table.hpp:456 · Escalate · medium
  • NOT verified (no proof, no reproducing execution) — needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 998 functions depend on the 911 functions this change touches.

Health — grade B; 10 existing hotspot(s) in the area this change touches (pre-existing, not introduced here):

• consume_matched_request — 2 callers, 43 callees (high)
• source_trigger_threshold() — 12 callers, 7 callees (high)
• match_path — 2 callers, 35 callees (high)
• execute_current — 2 callers, 24 callees (high)
• invoke_callback — 4 callers, 12 callees (high)
• deliver_confirmed_script — 2 callers, 23 callees (high)
• pump_batch — 4 callers, 11 callees (high)
• directional_tick() — 10 callers, 4 callees (high)
• …and 2 more

Verification — 998 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 950 function(s) in the blast radius were not formally verified this run