CR-150 batch A: L9c + L19o + L19n (integration)

docker/run_json.py

@@ -5282,30 +5282,37 @@ def _new_report_sink(lib, state, args):
 
 
 class _TemporaryReportSink:
-    """An unlinked file, addressed by a private path for the engine's path ABI.
-
-    TemporaryFile uses O_TMPFILE or unlinks immediately. The descriptor path
-    lets the engine open that file with its existing path-only API; no named
-    sink, new wire format or public fd API is introduced. Keep the owner open
-    until both report_free and strategy_free have returned.
+    """A named, owner-only (0600) temporary file, addressed by its real path.
+
+    The engine opens the path itself with its existing path-only API
+    (O_WRONLY | O_CREAT | O_TRUNC, no O_EXCL: src/report_sink_writer.cpp), so
+    the empty file created here is accepted and truncated by it. Every reader
+    opens the same path again and so owns its offset. No descriptor path
+    (/proc/self/fd, /dev/fd) is used: Darwin's /dev/fd/N is a dup that shares
+    the file offset. No named sink, new wire format or public fd API is
+    introduced. close() unlinks the file and may be called again, unless
+    ``keep`` is set (the harness's test-only artifact switch). Keep the owner
+    open until both report_free and strategy_free have returned.
     """
 
     def __init__(self, lib, state, *, directory=None, run_id=""):
         self.directory = os.fspath(directory) if directory is not None else tempfile.gettempdir()
         self.header, self.counts, self.sha256 = {}, {}, ""
+        self.keep, self.closed = False, False
         try:
-            self.file = tempfile.TemporaryFile(mode="w+b", dir=self.directory)
+            handle, path = tempfile.mkstemp(prefix="pineforge-report-sink-", suffix=".sink",
+                                            dir=self.directory)
         except OSError as error:
             raise RunFailure("report sink open failed", "report_sink_failed") from error
+        self.path = os.path.abspath(path)
         try:
-            directory_path = "/proc/self/fd" if sys.platform.startswith("linux") else "/dev/fd"
-            self.path = f"{directory_path}/{self.file.fileno()}"
+            os.close(handle)  # the engine and every reader open the path themselves
             descriptor = ReportSinkC(ctypes.sizeof(ReportSinkC), 1, os.fsencode(self.path),
                                      run_id.encode("utf-8"), os.fsencode(self.directory))
             if lib.strategy_set_report_sink_v1(state, ctypes.byref(descriptor)) != 0:
                 raise _engine_invariant("the fresh strategy refused its temporary report sink")
         except BaseException:
-            self.file.close()
+            self.close()
             raise
 
     def verify(self, lib, state, report):
@@ -5340,7 +5347,13 @@ def records(self, tag=None):
             raise _engine_invariant(f"the engine's report sink is invalid: {error}") from error
 
     def close(self):
-        self.file.close()
+        if not self.closed:
+            if not self.keep:
+                try:
+                    os.unlink(self.path)
+                except FileNotFoundError:
+                    pass
+            self.closed = True
 
 
 def _free_sink_run(lib, state, report, sink):

docs/design/cr150-contracts.md

@@ -218,7 +218,7 @@ references; L15a must maintain these anchors and mechanically pin every current
 | Lower-path digest (count first) and continuation hash | `native_intrabar_path_digest` `src/native_run_spec.cpp:891-919`; `native_intrabar_path_digest` `src/native_execution_consumer.cpp:289` | 371,1223-1224 |
 | Per-script-bar lower-path binary search/walk | `candidate` `src/native_execution_consumer.cpp:8686-8719` | 371,1225 |
 | Scheduler sub-bar lookup and one-bar look-ahead | `PineScheduler::lower_path_bar_at` `src/source/pine_scheduler_native.cpp:265-287`; `next_open` `src/source/pine_scheduler_native.cpp:328-329` | 371,1226-1227 |
-| Lower-path emptiness test | `inactive_sampler_path` `src/source/pine_adapter.cpp:3431-3435` | 371,1228 |
+| Lower-path emptiness test | `inactive_sampler_path` `src/source/pine_adapter.cpp:3430-3434` | 371,1228 |
 
 Every count/digest must fold the same bytes/order for copied and borrowed
 feeds, including cached and uncached paths (2.2:372-375). Views replace storage;

docs/pages/market-admission.md

@@ -25,7 +25,7 @@ broker `OpeningReceipt` Check/Exempt decision, which belongs to a committed fill
 Three historical placement views are fixed when an order is placed and kept in
 the adapter's placement snapshot (`projection_after_close`,
 `projection_over_pyramiding`, `projection_opposite_market_predecessor`
-pine_adapter.hpp:310-312):
+pine_adapter.hpp:302-313):
 
 - The prior-close view compares the original accepted-close
   quantity with the existing quantity tolerance. This describes a source-time

docs/pages/native-engine.md

@@ -502,7 +502,7 @@ five commands through `strategy_native_submit_v1` / `_replace_v1` /
 kernel from C* below.
 
 `native_order::Request` values belong to `native_order_v7`
-(`native_order.hpp:25`); identity types stay `native_order_v1`. Label/comment
+(`native_order.hpp:27`); identity types stay `native_order_v1`. Label/comment
 remain inert text. The market default path still constructs from:
 
 - `order_action::Transact{signed_units}` — finite nonzero
@@ -1496,7 +1496,7 @@ adapter answers `margin_check_allowed` with TradingView's scheduling — which
 includes the post-exit re-size: when a priced bracket leg of the script bar
 fills, the slice resting at that bar's adverse extreme was sized on the
 pre-exit book, and the legacy broker cancelled and re-scheduled it there
-(`margin_check_allowed` `pine_adapter.cpp:17890-17923`), so the adapter admits
+(`margin_check_allowed` `pine_adapter.cpp:17894-17927`), so the adapter admits
 the kernel's own point for that driver point while (and only while) a slice
 rests —
 `resolve_margin_requirement` with its ten-significant-digit money and
@@ -2047,11 +2047,11 @@ The kernel never drops an event its own live state still reads. A queued
 applied notification (and the margin receipt it carries) pins the window at
 its execution, a live deferred group-adjustment chain pins it at its head,
 and the rest of what the journal used to answer is state now: a request's
-replace-chain root is `RequestDefinition::root` (`native_order.hpp:736`) and
+replace-chain root is `RequestDefinition::root` (`native_order.hpp:738`) and
 the order core's chain index, which is all a cohort command reads about a
 request that is no longer working; a trail's arm ordinal
 (`NativeTrailState::activation_ordinal`) is its tracking state's
-(`TrailTrack` `native_order.hpp:650`); the FX-roll margin check reads the
+(`TrailTrack` `native_order.hpp:652`); the FX-roll margin check reads the
 last two driver points' instants; and a group-effect receipt whose outcome
 event was dropped stands on its own record. A host that wants the whole run
 after it has ended asks for `Full` (or `Commands`); the Pine adapter declares
@@ -3696,7 +3696,7 @@ The Pine adapter emits `Sized` for the default-quantity entries above and no
 Pine/generated hosts derive from `pineforge::source::PineStrategyHost`, which
 derives from `NativeStrategyHost`; handwritten native hosts also derive from
 `NativeStrategyHost`. The source adapter/scheduler hash domain is
-`kSourceAdapterDomain` `pine_adapter.hpp:43`
+`kSourceAdapterDomain` `pine_adapter.hpp:46`
 (`"pineforge-source-adapter/v4"`), while the public C ABI remains version 4.
 
 The ownership switch is complete: the compatibility loop and the source