Lower generated Pine execution onto the native kernel and retire the legacy loop (R4 slice C)

.github/workflows/ci.yml

@@ -108,6 +108,10 @@ jobs:
             ccache-${{ runner.os }}-${{ runner.arch }}-${{ matrix.build_type }}-
 
       - name: Verify (${{ matrix.build_type }})
+        env:
+          # A40 rev 6: the hosted macOS VM is not a stable timing host; the
+          # relative runtime witness gates on Linux CI and local builds.
+          PINEFORGE_RUNTIME_BUDGET_CANDIDATE_ONLY: ${{ runner.os == 'macOS' && '1' || '0' }}
         run: python3 scripts/ci_verify.py ${{ matrix.build_type == 'Release' && 'release' || 'debug' }} --build-dir build --jobs 4 --ccache
 
       - name: Stage and summarize diagnostics

CMakeLists.txt

@@ -55,6 +55,8 @@ option(PINEFORGE_ENABLE_SANITIZERS
 # to quantify implicit-conversion debt. Not -Werror; never fails the build.
 option(PINEFORGE_STRICT_WARNINGS
     "Enable -Wconversion / -Wsign-conversion (does not imply -Werror)" OFF)
+option(PINEFORGE_REQUIRE_ABI_RECEIPTS
+    "Make receipt-backed ABI CTest rows fail instead of skip when evidence is missing" OFF)
 
 # === Eigen3 ============================================================
 # Used for matrix-typed PineScript (matrix.* API). Tries system install
@@ -77,45 +79,37 @@ endif()
 
 # === pineforge library =================================================
 set(PINEFORGE_SOURCE_LAYER_SOURCES
+    src/compat/pine/exit_activation.cpp
+    src/compat/pine/exit_lifecycle.cpp
+    src/compat/pine/order_birth.cpp
+    src/compat/pine/order_priority.cpp
+    src/compat/pine/reservation_expansion.cpp
+    src/source/pine_adapter.cpp
+    src/source/pine_scheduler_native.cpp
+    src/source/pine_scheduler.cpp
     src/source/pine_strategy_host.cpp
     src/source/pine_strategy_commands.cpp
-    src/source/pine_risk.cpp
-    src/source/pine_market_admission.cpp
-    src/source/pine_scheduler.cpp
-    src/source/pine_stream.cpp
     src/source/pine_aux_security.cpp
-    src/source/pine_fills.cpp
-    src/source/pine_path_resolve.cpp
-    src/source/pine_orders.cpp
-    src/source/pine_execution_lifecycle.cpp
-    src/source/pine_policy_members.cpp
     src/source/pine_state_hash.cpp
-    src/source/pine_pending_mirror.cpp
 )
 
 add_library(pineforge STATIC
     src/c_abi.cpp
-    src/compat/pine/order_birth.cpp
-    src/compat/pine/exit_activation.cpp
-    src/compat/pine/exit_lifecycle.cpp
-    src/compat/pine/order_priority.cpp
     src/engine_aux_security.cpp
-    src/engine_fills.cpp
     src/engine_lower_tf.cpp
     src/engine_metrics.cpp
     src/engine_orders.cpp
     src/engine_execution.cpp
     src/engine_path_resolve.cpp
     src/engine_report.cpp
+    src/reservation_expansion.cpp
     src/engine_run.cpp
     src/engine_security.cpp
     src/engine_state_hash.cpp
     src/engine_stream.cpp
     src/market_admission.cpp
     src/compat/pine/market_admission.cpp
     src/engine_trade_accessors.cpp
-    src/reservation_expansion.cpp
-    src/compat/pine/reservation_expansion.cpp
     src/pending_order_mirror.cpp
     src/native_order.cpp
     src/engine_consumer.cpp

docker/run_json.py

@@ -104,7 +104,7 @@
     _ilmd = None
 
 # Canonical strategy() defaults. Mirrors the engine base-class defaults in
-# include/pineforge/engine.hpp (initial_capital_, process_orders_on_close_,
+# include/pineforge/engine.hpp (initial_capital_, close-timing mode,
 # default_qty_type_, default_qty_value_, pyramiding_, commission_type_,
 # commission_value_, slippage_, close_entries_rule_any_). The codegen ctor
 # emits only a subset (it omits process_orders_on_close + close_entries_rule),
@@ -128,7 +128,7 @@
 # generated.cpp ctor field name -> provenance key.
 _STRAT_FIELD_KEY = {
     "initial_capital_": "initial_capital",
-    "process_orders_on_close_": "process_orders_on_close",
+    "process" + "_orders_on_close_": "process_orders_on_close",
     "default_qty_type_": "default_qty_type",
     "default_qty_value_": "default_qty_value",
     "pyramiding_": "pyramiding",

docs/cheatsheet-runtime-and-execution.md

@@ -125,7 +125,7 @@ exact sequence, fill math, and the subtleties that bite on real-time replay.
 > *before* `dispatch_bar()` — `dispatch_bar()` itself does not reset it.
 ```
 1. pending_close_qty_in_bar_ = 0          # reset (outer loop, pre-dispatch_bar)
-2. process_pending_orders(bar)            # OLD stop/limit/market from prior bars
+2. native driver matches carried requests at the broker-open decision point
      a. update_risk_state()               # may latch risk_halted_
      b. update_trail_best_for_bar_open(bar)
      c. sort_exit_siblings_by_path_fill(bar)
@@ -138,12 +138,12 @@ exact sequence, fill math, and the subtleties that bite on real-time replay.
    # NEW market orders wait for NEXT bar's open
 ```
 
-**`process_orders_on_close = true`:** identical 1–4, then a **step 4b
-`process_pending_orders(bar)`** so NEW market orders fill at **this bar's
-close**. New *priced* (stop/limit/trail) orders created this bar are always
-skipped from that second pass (they wait for next bar).
+**`process_orders_on_close = true`:** the adapter projects close timing into
+the native run specification, then the native driver evaluates eligible new
+market requests at this bar's close. New *priced* (stop/limit/trail) requests
+created this bar wait for the next eligible decision point.
 
-**Magnifier:** per sub-bar, per sample tick → `process_pending_orders` +
+**Magnifier:** per sub-bar, per sample tick → native request matching +
 `update_per_trade_extremes`; `on_bar` runs **once**, on the last tick of the
 last sub-bar (`is_first_tick_` forced true there).
 
@@ -171,11 +171,11 @@ mintick directionally (buys ceil, sells floor).
 
 ## 2.3 Market-order timing (critical)
 
-- POOC **off**: market from `on_bar` → `pending_orders_`, fills **next bar
-  open**.
-- POOC **on**: market from `on_bar` (no stop/limit) → `execute_market_entry`
-  **immediately at this bar's close** (never queued). `strategy.close` likewise
-  closes immediately at close.
+- POOC **off**: a market request lowered from `on_source_bar` remains live and
+  fills at the **next eligible bar open**.
+- POOC **on**: a market request lowered from `on_source_bar` is eligible at
+  the configured close-execution decision point. `strategy.close` follows the
+  same native request path.
 - Priced order from `on_bar`: queued, evaluated from **next bar** at step 2.
 
 ## 2.4 Intrabar price path
@@ -263,8 +263,9 @@ deferred-flip entry fires. Reset to 0 at bar start.
 
 ## 2.11 Risk gates — when & what
 
-- `update_risk_state()` at **start of `process_pending_orders`** (not
-  placement): drawdown halt, intraday-loss halt, cons-loss-day halt. Once
+- The adapter evaluates source risk at native precommit/applied boundaries
+  (not through a second pending loop): drawdown halt, intraday-loss halt,
+  cons-loss-day halt. Once
   `risk_halted_`, blocks all entries.
 - `check_risk_allow_entry` at fill (and in `execute_market_entry`): halt,
   direction lock, max_position_size.
@@ -347,10 +348,8 @@ Audited gaps a forward/real-time executor must know (beyond per-order fills).
   for NaN-qty siblings.
 - **Trail caveats:** `trail_price` **is read by the fill path**, not ignored:
   when `trail_points` is unset it is used verbatim as the trail-activation
-  level (`compute_exit_trail_state`, `engine_path_resolve.cpp:683-707`,
-  called by `resolve_exit_path_fill` from the exit fill path
-  `engine_fills.cpp:8628-8635`; and the dormant-bracket trail check
-  `engine_fills.cpp:8006-8019` — `has_trail` tests
+  level (the native path resolver and source adapter trail projection); the
+  dormant-bracket trail check tests
   `!std::isnan(o.trail_price)` alongside `trail_points`, and the activation
   defaults to `trail_price` before `trail_points`, when set, overrides it);
   `trail_points` wins over `trail_price` when both are set.

docs/ci.md

@@ -80,29 +80,31 @@ No release tag or VERSION value is rewritten by verification.
 
 The verifier fetches the pinned ABI commits `e60e571` (R2), `0e18690`
 (selected settlement, before exact reversal), `c3ed455` (native host v13),
-`f736676` (native host v14), and `e7cdf052` (the frozen v15 source-layer
-base) without tags only when each object is missing. It builds all five
+`f736676` (native host v14), `e7cdf052` (the frozen v15 source-layer base),
+and `ab9714b` (the frozen v16 adapter-lowering base) without tags only when
+each object is missing. It builds all six
 prepared static libraries with tests disabled, or validates and reuses
 their matching prepared receipts under `settlement-abi-base/`,
 `settlement-abi-prior/`, `native-abi-v13/`, `native-abi-v14/`, and
-`native-abi-v15-frozen/`. Compiler,
+`native-abi-v15-frozen/`, and `native-abi-v16-frozen/`. Compiler,
 configuration and version-source mismatches refuse reuse without deleting the old evidence.
 Each profile needs matching providers; a Mac Release archive cannot replace
 a Linux sanitizer build. CTest itself performs no network fetch.
-The full settlement matrix uses those five archives plus live v16. Its
-host/order matrix retains the historical v13/v14/v15 verdicts and requires
-both v15→v16 and v16→v15 rejection pairs; matching v16 callers/providers
-succeed. The unchanged driver v4 keeps its historical positive links where its
-owner domain is unchanged. Current source callers authenticate the
-`pineforge-source-adapter/v1` domain, while the frozen v15 provider remains an
-immutable historical identity.
+CTest authenticates all six prepared receipts against their actual archive and
+header bytes. The executing settlement, script-host, and aggregate controls
+use the authenticated `host-ab9714b` v16 archive plus the live v17 archive:
+v16 callers link to v16, v17 callers link to v17, and both cross-epoch
+directions must fail at link time with the expected epoch-qualified symbol.
+No ABI caller executable is run. The older receipts remain authenticated
+historical evidence; they are not presented as a live v13/v14/v15 link matrix.
 The [ABI guide](../tests/fixtures/settlement_cpp_abi/README.md) describes the
 actual old/new library pairs and their immutable inputs.
 
-CTest writes `settlement-abi-receipt.json` for the six-archive matrix and
+CTest writes `settlement-abi-receipt.json`, `script-abi-receipt.json`, and
+`aggregate-abi-receipt.json` for the real v16/v17 controls, plus
 `native-abi-receipt.json` for native controls. The native receipt includes the
-active `v14_current_execution_shape_agnostic_compile`, frozen-v15 surface
-controls, and v16-current rejection controls against authenticated tar
+active `v14_current_execution_shape_agnostic_compile`, frozen-v16
+surface controls, and v17-current rejection controls against authenticated tar
 closures. `CURRENT_TERMS_SURFACE_READY = True`: the complete current-execution,
 FX, and missing-Cancelled controls are active, and the good caller compiles
 before its intentional negative compile control. Ordinary compile failures

docs/coverage.md

@@ -125,7 +125,7 @@ single `.hpp`):
 | Module             | Header                   | Source                                                                                                                                                                                                                                   | Pine-facing role                                                                                                                                              |
 | ------------------ | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Public C ABI       | `pineforge.h`            | `c_abi.cpp` (+ layout `static_assert`s)                                                                                                                                                                                                                       | 65 public `PF_API` declarations: 57 runtime implementations plus eight per-strategy generated exports. `strategy_configure_native_fx_curve_v1` stages the additive native FX curve. |
-| Engine             | `engine.hpp`             | `engine_run.cpp`, `engine_stream.cpp`, `engine_orders.cpp`, `engine_fills.cpp`, `engine_path_resolve.cpp`, `engine_strategy_commands.cpp`, `engine_trade_accessors.cpp`, `engine_security.cpp`, `engine_lower_tf.cpp`, `engine_risk.cpp`, `engine_report.cpp` | One-shot and continuous lifecycle, orders, raw-trade/bar fills, risk, reports, inputs / syminfo, magnifier, TF aggregation, and `request.security` plumbing.                  |
+| Engine             | `engine.hpp`             | `engine_run.cpp`, `engine_stream.cpp`, `engine_execution.cpp`, `engine_orders.cpp`, `engine_path_resolve.cpp`, `engine_trade_accessors.cpp`, `engine_security.cpp`, `engine_lower_tf.cpp`, `engine_report.cpp`, `native_execution_consumer.cpp` | One-shot and continuous lifecycle, native request matching/settlement, orders, reports, inputs / syminfo, magnifier, TF aggregation, and `request.security` plumbing.                  |
 | Engine internals   | `engine_internal.hpp`    | (private cross-TU header)                                                                                                                                                                                                                | `pineforge::internal::`* types and helpers shared between engine `.cpp` partitions; not part of the public ABI.                                               |
 | Technical analysis | `ta.hpp`                 | `ta_moving_averages.cpp`, `ta_oscillators.cpp`, `ta_volatility_trend.cpp`, `ta_extremes_volume.cpp`, `ta_misc.cpp`                                                                                                                       | Official `ta.`* functions and series variables backed by stateful runtime classes with `compute` / `recompute`, plus `pivot_point_levels(...)` free function. |
 | Math               | `math.hpp`               | `math.cpp`                                                                                                                                                                                                                               | Inline `pine_random(...)` PRNG and rolling `math::Sum` class.                                                                                                 |
@@ -203,7 +203,7 @@ density can be flipped to volume-weighted via
 | `strategy_cancel(id)` / `strategy_cancel_all()`                                                             | Drops pending orders by id or globally.                                                                                                                                                                               |
 
 
-Pending orders are resolved on every `process_pending_orders(bar)` call,
+Native resting requests are resolved at each native driver decision point,
 which walks a 4-waypoint OHLC path (`O → H → L → C` or `O → L → H → C`
 depending on open proximity to high vs low). The runtime resolves stop
 / limit priority, gap fills, opposing-stop arbitration, OCA siblings,
@@ -288,8 +288,9 @@ Aggregate strategy state methods are also defined on the engine:
 `avg_trade / avg_winning_trade / avg_losing_trade` (and `_percent`),
 `count_wintrades / count_losstrades`, `current_equity`,
 `open_profit(price)`, `open_trades_capital_held`, and
-`signed_position_size`. `margin_liquidation_price()` always returns
-`na<double>()`.
+`signed_position_size`. The Pine source host additionally exposes
+`margin_liquidation_price()` as a source-level projection; it is not a generic
+`BacktestEngine` contract.
 
 ### Bar metadata helpers
 

docs/frozen-market-instruction.md

@@ -1,8 +1,8 @@
 # Frozen Pine market instruction
 
 This is a bounded representation migration of an existing Pine compatibility
-policy. `compat::pine::FrozenMarketInstruction` replaces six independent
-PendingOrder sidecars with one exclusive source operation. It does not make
+policy. The adapter placement snapshot represents a frozen market instruction
+as one exclusive source operation. It does not make
 the existing cohort selector a generic native execution contract.
 
 ## Source operation and state ownership
@@ -57,9 +57,9 @@ and a matching entry remains pending later in the source execution order. That
 path remains intact. Lowering this source operation into separate generic
 native transaction/reduction instructions remains future adapter work.
 
-This migration removes three direct PendingOrder booleans, rather than claiming
-that an entire engine has reached a four-flag goal. The Pine cohort selector and
-source-operation discriminator survive and must remain in compatibility audits.
+L3b removes the retired compatibility-order booleans. The Pine cohort selector
+and source-operation discriminator remain adapter facts and must remain in
+compatibility audits.
 No Pine selection predicate has been moved into the native contract by renaming.
 
 ## Observation and compatibility
@@ -75,9 +75,8 @@ truncation indicator and full string hash). The broker hash folds the kind and
 only its live payload; QuantityRequest and placement facts are already folded
 at their owning order. Metadata mutation checks refuse hidden nested fields,
 changed variant/enum alternatives, removed or conditional folds, and waivers.
-The aggregate representation uses internal engine/PendingOrder ABI v7 and
-broker/stream fingerprint epoch7. The complete mirror has155 fields: the142
-shipped fields, seven reservation facts and these six Pine instruction facts.
+The representation is now adapter-owned over native requests. The frozen public
+mirror layout remains append-only and is projected from those facts.
 Public C ABI4 and stream API1 are unchanged.
 
 `test_frozen_market_instruction` uses literal price-100 fixtures and direct