Floor: enrolment margin in same-run host-calibrated CPU ms

[gunbai-bot]

Node adhoc-c9504740-637. Decision: sharp-raven-357, with the operator's go-ahead (option A of escalation msg_decc213d).

Problem

The enrolment margin compared a raw CPU reading to a fixed 302 ms budget. On #13168, fifteen parse claims refused with eval steps identical to their green run, while a peer with the same step count went 240 → 426 ms on a runner ~1.75x slower. The verdict depended on which runner the run drew.

Change

• One same-run factor. Each run measures test.claim.floor_eval_step_calibration_specimen_test (its work is fixed in source, 55,011 eval steps) on the same runner. factor = specimen_cpu × pinned_rate × 1000 / specimen_steps. The reference is derived from the existing pin; it adds no new figure.
• Calibrated units. Every enrolment reading (exact or bound) becomes raw × 1000 / factor before the margin, dead-band floor or roster floor is consulted. The same factor applies to every claim, with no per-claim or per-tier adjustment. Raw ms are still printed (raw_cpu_ms=… host_speed_factor_permille=…).
• Fail-closed. A specimen that is absent, not planned, censored, moved (steps ≠ 55,011) or outside the declared range [400, 2500]‰ (for any of the three replicates) refuses the run with cause=HostSpeedCalibrationRefused standing=…. There is no default factor.
• Ruling recorded in v2.workflow.floor_eval_step_calibration, next to fierce-lark-661's ban: dated, scoped to this one consumer, and with its reasons. The step budgets are not rescaled.
• Specimen admitted to required_gate_authored_modules. It was outside the gate, so no run measured it.
• Thresholds re-derived for calibrated readings (review by sharp-raven-357). The p90 cross-runner envelope (1.653x) is withdrawn: once readings are normalised it would count host variance twice. What remains is same-host noise on two independent readings (the claim's and the specimen's). Same-host spread is policy at 1130‰, the worst of three measured specimen samples (authoring container 97–110 ms = 1.134x; CI 138→152 ms = 1.101x; one runner 43–47 ms steady = 1.093x). The residual envelope is 1130²/1000 = 1276‰, giving a margin of 391 ms, dead-band floor 306 ms and roster floor 391 ms, all derived. Not covered: workload mismatch for native-heavy claims. Trigger: re-derive from calibrated per-claim readings at identical steps.
• Fastest of three specimen replicates. On one runner the specimen read 75 ms once (first touch, 1.74x) and then 43–47 ms. A slow specimen reading loosens the gate, and 1.74x is inside the [400, 2500]‰ bound, so the bound alone doesn't catch it. The run therefore measures three replicates (same depth, distinct accumulator seeds so no cross-claim share can serve one from another) and takes the fastest; any refusing replicate refuses the run.
• Seed mirror plus seed-growth receipt gunbc.host_speed_calibration_seed_growth.

Controls

• v2.test.floor_enrolment_margin: same claim gets the same verdict at two synthetic runner speeds, and the raw readings are shown to disagree; a genuinely expensive native claim still refuses at both speeds; missing, censored, withheld, moved and out-of-range specimens all refuse.
• Seed unit tests the_same_claim_gets_the_same_enrolment_verdict_at_two_runner_speeds and the_host_speed_calibration_refuses_without_an_exact_plausible_specimen_reading pass remotely (with the existing dead-band test).

Receipt (PR floor run 37263410184)

[enrolment-margin] host_speed_calibration specimen=…calibration_specimen_performs_its_declared_work standing=calibrated specimen_cpu_ms=84 factor_permille=1103. The specimen's floor eval steps match the pin exactly (any difference would have refused host_speed_specimen_moved). This PR's own new controls were enrolled and judged through the factor (raw_cpu_ms=… host_speed_factor_permille=1103). floor / generated / emit-build / witnesses are all green.

Open, for the reviewer

• v2.test.floor_enrolment_margin sits outside the required gate's executed population, so its controls run when enrolled (as on this PR) or when invoked by hand; this change doesn't touch that admission.

🤖 Generated with Claude Code

Note: with the margin at 391 ms, some existing dead-band and typed cost-debt rows become deletable (readings ≤ 391 ms). That doesn't break anything: those grounds are judged only when an identity is newly enrolled. Pruning them is a follow-up.

[gunbai-bot]

Addressed review 76320 in 4d3af90:

• floor_eval_step_calibration HostSpeedFactor rationale no longer says the runner envelope is kept. It now says timing noise is handled by taking the fastest of three replicates plus the margin's residual same-host envelope, that the native-cost mismatch is not priced by anything yet, and it points at floor_enrolment_margin floor_enrolment_same_host_spread_permille for both and for the re-derivation trigger.
• The duplicated paragraph in floor_enrolment_margin is now one copy, placed above the dead-band floor, stating that it covers both floors and which receipt belongs to which.