Combine pull requests 774, 764, 765, 773, 772 and 759 - #776

A bounded arena replaced its whole state with a deep copy on every create,
delete and setter: every slot, the text of every label, the directory and the
order, whether or not a script-state checkpoint still shared it. A script that
moves a few of its live drawings on every bar therefore paid time proportional
to the bound on every call, and the first write after each checkpoint paid it
again.

The slots now live in a DrawingRecordStore, the block store the unbound arena
already uses: blocks of 32 that a copy of the state shares, one path copied per
write that reaches a shared block. A copy of the state shares the blocks and
copies only the directory and the order (an integer per occupant), the
directory with room for every slot so a creation never reallocates it.
Creation, deletion and every setter give the arena a state of its own when a
checkpoint shares it, then change it in place. Each does every step that can
allocate or throw (the state's copy, the copy of the slot's block, the
directory's room, the order's growth) before its first change and only steps
that cannot throw after it, so a refused allocation leaves the arena and its
checkpoint as they were. The search for the lowest free slot starts at a
recorded index below which every slot is occupied, so slot reuse order is
unchanged and a creation no longer scans every slot.

The bound, the typed overflow outcome, the stale-handle behaviour and every
value a script reads are unchanged.

The source allocation-bound gate (ci/cr150-source-bounds.yaml) pins every
growable-container site of include/pineforge/**, so its reviewed site
inventory moves with this change: the two groups for the removed whole-state
copies are deleted and the OPEN ceiling drops by two; the groups for the slots
(a block store filled by push_back), the directory and the state's allocation
gain the new site identities. The inventory is the gate's own proposal for this
tree; its differences from the previous one are exactly those sites. The
gate's real-tree test pins the number of OPEN groups, so that pin moves by the
same two.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Main moved to the hosted verification jobs and their documentation since this
branch was cut. No file of this change is touched by those commits and no
conflict arises.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

… lines

A bounded drawing arena's edits and checkpoints do no per-record work in the
bound: they copy only the blocks of 32 records they write. They do not cost
O(changes): the first write after a checkpoint still copies the slot directory
and the creation order (one 8-byte integer per occupant), and deleting the
oldest drawing moves the directory's entries. The test header and the
CHANGELOG now say so, and the test's function is renamed to match.

The source allocation-bound manifest keeps its line fields as diagnostics. The
entries of drawing.hpp that the change moved (U1665, U1669, U1670, U1671,
U1672) carry the first line the gate finds for them again. No identity changes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

The CHANGELOG entry and the cost test header of the bounded drawing change said
that the first write after a checkpoint copies "one 8-byte integer per
occupant". The slot directory holds two 32-bit integers per occupant (the id and
the slot) and the creation order one 32-bit integer, so both now say "a
directory entry and an order index per occupant". Words only: no code, no
assertion and no manifest line changes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Main moved by one commit since the previous merge: the hosted sanitizer builds
get a dedicated data disk (two workflow files). No file of this change is
touched by it and no conflict arises.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assert open and closed short accessors preserve direction from a real fill.

Report signed quantities for open and closed short trades while preserving long,
flat and bounds behavior.

The signed trade-size accessor fix intentionally removes two obsolete public statements from docs/pages/pine-to-native.md. The sentence introduced by 7328f4d is wrong after the fix because Pine's size accessor carries direction in its sign; the sentence introduced by cced2aa is the same obsolete unsigned/raw-quantity description. The replacement rows state positive long and negative short and distinguish raw magnitude fields with is_long.

Name 7328f4d and cced2aa so the doc-reverts guard can verify why those historical sentences were removed.

The accessor bodies already return signed quantities; keep each expression on one source line so the existing documentation citations remain bound to the same header and implementation lines. This preserves the exact signed-size tree behavior while removing the anchor shift.

…n moved its lines

The bounded drawing checkpoint test adds one source, test_drawing_bound_checkpoint_cost, to the TEST_SOURCES list near the top of tests/CMakeLists.txt, which moves every later line of that file by one. The evidence row for test_pooc_close_fill_view_tapes cites five of those lines: the line the sweep re-reads (3459, now 3460) and four in its reason text (:3443, :3455, :3479 and :3485-3501, now :3444, :3456, :3480 and :3486-3502). test_private_fixture_reads failed with "the token no longer sits on tests/CMakeLists.txt:3459", and test_private_fixture_reads_controls failed with it.

Only those five numbers change; the row's text is otherwise as it was. Each new line was read from the file: 3444 is the EXISTS test of a tape, 3456 the increment of _pf_pcv_emitted, 3460 the condition that is the row's token, 3480 the registration of the test, 3486 the registration of the skipped placeholder.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Use GCC minimal debug information for instrumented Debug profiles while
retaining file and line data, sanitizer flags and the full test selection.
Keep the definition below the cited profile-floor table so existing
documentation anchors remain valid.

This is a measurement step: it lowers debug info only. The pass condition
is at least 20 GB free after Verify on the worst hosted sanitizer shard.
If that margin is not reached, each shard will build only its own targets
next.

Update the margin-call twin assertion digest and register the pyramiding
partial-drain signed-size rewrite in the twin parity inventory. Recompute the
inventory hash so the guard covers both intentional assertion changes.

Build and select the existing ABI layout probe alongside the eleven existing
fast executables. Update the derived membership pin, preserve prior checks,
and exercise removal of the actual ABI row through the real workflow checker.

Documentation replacement: the sentence "names its eleven real executables;
configure refuses" now names twelve executables and explains the existing
probe's Linux x86_64 GNU libstdc++ applicability.

The ABI smoke explanation adds two documentation lines. Correct both exact
line-count expectations from 2060 to 2062 while retaining all substantive
runner, slow-inventory and same-size negative checks.

Accept live_drawings through the existing typed limit helper and publish
its English template, preserving the code identity, since value and prior
limit values. Regenerate the registry and catalog diff and exercise distinct
operator maxima through the real helper contract.

Bring the merged hosted release workflow and its CI documentation and
checks into the candidate without rewriting the existing commits.

Bring the merged hosted release workflow and its CI documentation and
checks into the candidate without rewriting the existing commits.

The merge gate now requires pineforge/parity and treats pineforge/verify
as advisory, so the promotion workflow skipped every engine merge whose
head carried no verify status. Admit on pineforge/parity success alone;
a failed or absent parity still skips.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Retain the ABI smoke selector and its tests alongside the current engine changes.

Retain the runtime limit catalog addition alongside the current engine changes.

Require the complete parity-only head predicate while preserving main-copy,
latest-status, pagination, tree, authorization and credential-order checks.
Add Bash and jq status decisions and workflow mutation controls.

Normalize enclosing parentheses around the exact parity-success expression.
Reject compound and malformed predicates, and cover parity-only, verify-only,
combined-status and missing-status cases plus expression wrapping controls.

Point seven documentation citations at the matching catalog fields after the vocabulary additions shifted their lines.

Keep the live drawing vocabulary and documentation corrections with the current cohort admission behavior.

Main now holds the cohort admission change, the run option series_origin_ms and
the other changes since the last merge. The four conflicts are mechanical:
CHANGELOG.md keeps both new entries; the unreviewed ceiling of the
allocation-bound manifest becomes 1404 (main's 1406 less the two groups this
change removes) and the gate test's pin becomes 1356 + 48 + 184; the five line
citations of the private fixture evidence row move down by the one line this
change adds to tests/CMakeLists.txt, each checked against main's line by hash.
The site inventory merged without a conflict and is checked by the gate itself.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Retain the runtime vocabulary change and the current input conversion documentation.

… accessors)

Plain merge of the source head into the combined branch; nothing was resolved by hand.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…footprint)

Plain merge of the source head into the combined branch; nothing was resolved by hand.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…on parity alone)

Plain merge of the source head into the combined branch; nothing was resolved by hand.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

…place and share their slots between checkpoints)

Plain merge of the source head into the combined branch; nothing was resolved by hand. The source head is the pull request branch merged with main c6a61ef.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>