This repository is an educational fault laboratory, not a production trading system. It does not provide authentication, authorization, TLS, Byzantine fault tolerance, regulatory controls, or a hardened network parser.

CRC32 and BLAKE3 fields detect accidental corruption; they do not authenticate an artifact against an attacker who can rewrite both data and checksums. Treat journals, snapshots, configurations, and scenario files as trusted operational inputs unless an integrating system adds signatures or authenticated storage. The built-in size, record, fan-out, and validation-report budgets reduce memory exhaustion risk but are not a substitute for process isolation and admission control.

When the repository is hosted, report exploitable vulnerabilities through the host's private security-reporting channel rather than a public issue. Include a minimal reproducer, affected commit, impact, and whether malformed durable data or untrusted client input is required.

Correctness defects that can duplicate economic effects, bypass risk limits, accept corrupt journal/snapshot data, or permit unfenced publication should be treated as security-relevant even when no memory-safety issue is involved.

Only the latest commit on the default branch is supported during this pre-1.0 phase. Do not deploy this project with real orders or credentials.