malkhut(perf): DuckDB in-memory materialization — sub-µs reads, zero DuckDB overhead

Architecture: DuckDB for persistence + full in-memory materialization for reads.
All reads served from Python dicts (sub-microsecond). DuckDB only hit on writes.

Performance evolution (get_asset benchmark):
  V0 (raw DuckDB):    876µs per call
  V1 (LRU cache):     2.3µs per call (380x)
  V2 (in-memory):     0.2µs per call (4380x)

All reads now sub-microsecond:
  get_asset:      0.2µs (was 876µs)
  query(blockian): 6.6µs (was 2.2ms)
  query(sector):   6.6µs (was 3.2ms)
  exchange lookup: 12.5µs (was 1.5ms)
  full scan:       5.9µs (was 1.8ms)
  behavior:        0.4µs

Write path: sync_from_profiles batch-inserts all data, then materializes
into Python dicts. Resync: 76ms (was 210ms, 2.8x faster).

Data integrity: DuckDB WAL provides crash recovery. In-memory dicts are
reconstructed from DB on every sync/close-reopen cycle. Zero data loss.

prod/clean_arch/dita_v2/rust_backend.py

@@ -674,6 +674,12 @@ class ExecutionKernel:
         self.account = account or AccountProjection()
         self.projection = projection or build_projection(client=projection_client)
         self.zinc_plane = zinc_plane or InMemoryZincPlane()
+        # The venue reads the Rust-committed active exit order so each
+        # multi-leg EXIT submits the current leg size, not the original intent.
+        try:
+            setattr(self.venue, "_kernel_ref", self)
+        except Exception:
+            pass
         self._backend = _get_rust().create(self.max_slots)
         self._control_snapshot = self.control_plane.read()
         self._last_settled_pnl: Dict[int, float] = {}
@@ -762,9 +768,9 @@ class ExecutionKernel:
                 )
 
     def _exit_asset_mismatch_outcome(self, intent: KernelIntent) -> Optional[KernelOutcome]:
-        """UV-FIX 2026-07-11: an EXIT must name the asset its slot holds.
+        """Kernel invariant: an EXIT must name the asset its slot holds.
 
-        All UV promotion intents share slot 0. During the 2026-07-10/11
+        All callers must obey this slot invariant. During the 2026-07-10/11
         phantom-pair incident, an EXIT for asset X arriving while the slot
         held asset Y was accepted asset-blind — closing Y's venue position
         and orphaning Y's own later exit (NO_OPEN_POSITION). Reject the