M7: bounded replay artifacts and passing execution certification

[PureSaber]

Scope

M7 quant-execution certification candidate only. Adds artifact-retention-bounded deterministic Arrow replay, strict immutable artifact verification, retained evidence, and an explicit representative workload. Preserves Strategy -> RiskGate -> Matching -> Fill/Fee -> ExactAccountLedger -> canonical hashes. No live-order transport.

Contract, dependency and sealed-state closure

• Package candidate version:0.5.0; additive schema:puresaber.execution.replay-artifact-manifest@1.0.0.
• Internal dependency is regenerated and locked to annotated tag quant-data-kit@v0.7.4, dereferencing to commit ecb04bd5834aeefdf79226c15cba484337785f90.
• Existing DeterministicRunEngine.replay remains the compatibility fallback.
• replay_to_sink requires sorted deterministic input; complete manifest publication is canonical, atomic and no-clobber.
• load_stored_artifacts verifies manifest bytes/hash, file size/hash, Arrow schema, contiguous sequence and logical hashes.
• Independent validation found post-finalization mutation gaps. Commits37260ba and23f6b19 close the root cause:finish/abort seal broker and ledger until reset; public restore cannot unseal; engine failure uses an internal trusted rollback; returned positions and instrument/account valuation configuration are read-only.
• Memory claim is limited to controlled memory at the certified10M envelope, not strict O(1).

Verification

• Locked local environment, pip check, Ruff:PASS.
• 201 tests; total coverage95.51%; every core pure branch module>=90%.
• Exact-head GitHub Actions runs33326493195 and33326495235:Python3.10/3.11/3.12 all PASS.
• Fresh independent read-only validation:PASS, P1=0/P2=0 on exact head f43489e.

Formal performance result

Clean source commit23f6b19cc1c4e42fb9df8ce600ad34b254a121a5; evidence commit f43489e. Three fresh processes, each with10,000,000 events,500,000 fills, full risk/matching/fees/exact ledger/Arrow output.

• Throughput:58,221.53 / 63,906.96 / 61,473.01 events/s. Every run passes50,000/s; median61,473.01 events/s.
• Peak working set:max2,248.48MiB. Every run passes16GiB.
• Determinism:logical hashes, every physical Arrow hash and manifest hash match.
• Strict artifact reload:PASS for all runs.
• Artifacts:three retained directories,1,501,955,792bytes each; no automatic deletion.
• Report SHA-256:4dcb33d68126bc454ce68e11ae3d4f4a8475a168bf43b644ee1170c394efc41d.

Remaining risks and rollback

The formal workload has explicit5% fill density. The50%-fill stress path remains below50,000events/s and is disclosed separately. The slowest formal run passes by16.4%; future releases still retain per-run and15% regression gates. Identity sets and broker lookup/idempotency state scale with event/order count. Performance evidence is Windows/Python3.12 host-specific; CI covers functional compatibility on Python3.10-3.12. The benchmark records dirty-tree state but does not yet turn dirty=true into an automatic failure.

Rollback is a Git revert of this merge; the unchanged in-memory replay path remains available. This is a component release candidate, not PureSaber platform GA.