[stefan-jansen]

Summary

Preserve exact integer tick differences in the existing native returns, log_returns
and delegated percentage_change expressions. Int64 prices above 253 and UInt64
prices near 263 previously produced zero or doubled one-tick changes.

Select the native expression at schema-planning time, widen integer subtraction,
and use a stable logarithm for small changes without corrupting near-total losses.
Float32/Float64 formulas and output dtypes stay unchanged. No Python row callback,
eager data collection, price fill, row compression or new analytical facade.

Breaking dependency boundary: require Polars >=2.0.0 for native schema-time dispatch.
The locked version was already 2.0.0. An isolated 0.20.0 probe confirmed both the
missing APIs and the original tick-loss behavior. This belongs with the next-minor
source migration, not a publication of the previously qualified patch.

Reproduction and checks

• Base: c69e7badaac012ad98b1c4b8aa9a67a952b08f5c.
• Fresh public probe: four failing integer eager/lazy cases, two ordinary controls.
  Signed adjacent prices 9007199254740992/993/994 should return approximately
  1.1102230246251565e-16 each, rather than zero followed by 2.220446049250313e-16.
• Current candidate: e17cfec2e3425d0aeeafce89a16d15a1f88be1ee.
  Numerical implementation and full local source checks below were first qualified
  at 0b35b42d4f2cae585d558fee991cbbd25446bd95; following changes are
  the certifi and Pillow security lock repairs described below. Fresh hosted final-head checks
  remain required and are running at the current candidate.
• Focused regression: 216 passed, covering eager/lazy/grouped streaming, lag1/2,
  Int8/UInt8/Int64/UInt64/Int128 limits, zero denominators, null/NaN, logarithmic
  domains, float dtype compatibility, immutable inputs and atomic invalid-lag errors.
• The traced public producer passes on the repair and fails after restoring its
  original ratio-first arithmetic. Eight declared issue items passed the local
  verification gate, with no waiver or deferral.
• Full source suite: 4911 passed, 57 configured deselections.
• Executable documentation, strict MkDocs, Ruff lint/format, ty and commit hooks passed.
• Wheel/sdist built from the committed source. Isolated Python 3.12/Polars 2.0.0
  installation verified all 200 Engineer and 289 Diagnostic package files against
  their exact wheel bytes, with no editable/source shadowing. The consumed facade
  and native compounding source also match Diagnostic revision 643b94b.
• The actual installed price validation -> grouped returns -> Diagnostic facade
  path preserves nonzero signed/unsigned raw tick returns and keys. Ordinary
  prices 100/101/99 compound to -0.01. Diagnostic's tiny compounded gains round
  to zero in its separate current algorithm; this is not used to certify precise
  compounding or hidden by a loose raw-return tolerance.
• Original0b35b42 qualification wheel SHA256: a796707cce0a520866a9972dc6289fc9feef8dfca2203a9df81e620260f162a0.
• The Diagnostic wheel is an unpublished qualification artifact of its existing
  open PR231, not a claim about published 0.1.9. All supported hosted
  final-revision gates remain required before merge.

Migration

Keep integer prices typed until the expression evaluates and use explicit asset
grouping. Native output retains its leading undefined row; trim only that documented
row if a legacy consumer requires the shorter shape. The maintained feature guide
includes an executable lazy example. No Reloaded runtime dependency is introduced.

AI assistance: Codex implemented the repair, regression tests and documentation and
ran/reviewed the checks above. No independent human review or publication is claimed.

Closes #107

Final merge qualification

All 48 applicable hosted checks pass at head e17cfec2e3425d0aeeafce89a16d15a1f88be1ee;
the one Python 3.15 exception validator is a configured inapplicable skip. This includes
every supported installed-wheel, native stress and shared qualification cell, security,
coverage, types, documentation and final package identity checks. No gate was waived.

Hosted candidate cf04894d75f45b2395b935bbe4761598c276381e has exactly the reviewed head's
tree 6510ca33dbdb560fc7e1f7616915fce75b1cb854. Downloaded candidate metadata and both
artifact hashes pass the actual identity verifier. A fresh isolated install of that
hosted wheel also passes the public Engineer-to-Diagnostic handoff, with all package
files verified against its bytes. Wheel SHA256
6e375d9764c195bf5cc004143ddf99b4d1be0d2a825ebd3251fdcb7e1efd0ed1;
sdist SHA256 4d4cf62c1ad31535f33bae18549de5ac64885413382192f9f1984af1d9fc8102.
Earlier local artifact versions/hashes remain scoped to their stated source builds.

Required-gate security repair

The initial required audit reproduced
GHSA-6q48-6c7w-9gw2
in contributor-only certifi 2026.7.22. Upgrade only that locked package to patched
2026.10.19. Existing dependency PR106 has the same affected certifi and does not
provide this repair; its unrelated six-package update is preserved separately.
Both core and complete exported environments now pass pip-audit locally, and
the 216 numerical regressions pass after the lock update. No audit exclusions
or workflow gates were weakened.

The next hosted audit at a96d32f reported eight Pillow 12.3.0 advisories,
including CVE-2026-112895.
That advisory's API publication timestamp is 2026-10-20T20:50:49Z, after the
earlier clean local audit. A fresh-cache local audit reproduced all eight findings.
The patched Pillow 13.0.0 lock clears the complete contributor audit; only that
package's generated lock entries changed. PR106 also retains Pillow 12.3.0.
The source has no direct Pillow usage; all executable documentation, strict
MkDocs, type checks, hooks and the 216 numerical regressions pass with Pillow 13.
At current e17cfec, the full configured source/coverage suite passes:4911tests,
57configured deselections,17warnings. The actual coverage checker passes95.96%line
and90.08%branch coverage, including every critical module's individual threshold.
All executable docs/strictMkDocs/types/hooks and both current exported audits pass.
Hosted supported-platform/final artifact gates remain pending; this is not a merge claim.

Current committed-source artifacts are 0.1.7.dev32+ge17cfec2e:

• Wheel SHA256: cf201cb464769dd2a8fc068c04c8fefe3c01b5a8bc960d6bcdee600c7aa7cbf5.
• Sdist SHA256: 45e3f193df135f65fb56a4a62eeb577d65841483d1a24f8e678caa54969dc3e3.

A fresh isolated install of that exact wheel repeats the actual public producer/Diagnostic
workflow, verifying all200Engineer and289Diagnostic installed files against their wheels
and the receiver's three implementation files against remote643b94b. The original source
mutation evidence remains applicable because the arithmetic module is byte-identical
between0b35b42and currente17cfec; only the two security lock repairs follow it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.