Blame for code/offload/launch/windows/PP4-PROMOTE-GATE-V2.md

# PP4 promotion gate × R-PP4 v2 measurement — patch note for `offload/pp4-promote` (R-PP4, 2026-10-27)

Written by R-PP4 on `offload/pp4-win2`; `offload/pp4-promote` is not edited here (S91 checks it, PP4-PROMOTE round 2 owns
it). Read against `offload/pp4-promote` c258296 (`pp4_promote_window.py`).

## Already consistent: LOSS semantics

The promotion's two no-loss checks already use `decision_v2` LOSS semantics, as the coordinator asked:

- **G6, in-window** (`regression`, 67af145): same-HOLD exact production control vs PP4, 3 unpaired repeats per arm,
  `decode_tps` primary + `ttft_s` guard, `decide_window`; any decision-cell `LOSS` (worse than the control's own spread in
  ≥ ceil(2n/3) repeats) or `NOT A CANDIDATE` refuses; WIN and INCONCLUSIVE pass. No change needed.
- **Pre-promotion evidence** (`measurement_gate`, fbbe129): recomputes `decide_window` from the measurement's recorded
  `decision_series` and refuses any decision-cell `LOSS`. R-PP4's summary is built for this: `decision` carries
  `decide_window`'s own top-level fields (`rule`, `status`, `min_gain` 0.02, `decision_cells`, `cells`, `groups`) and
  `decision_series` is top-level, so the recompute matches exactly (tested:
  `test_decision_recomputes_from_its_recorded_series`). A clock-guard override (starts at different GPU clock caps, or
  a thermal dial-back inside the HOLD) sets `status` INCONCLUSIVE, which deliberately does **not** recompute, so the gate
  refuses that measurement as evidence.

## Four changes `measurement_gate` needs to accept an R-PP4 measurement

### 1. Metric set: rate primary; ms/round reported, not a guard

`measurement_gate` today: `ORIENTATION` has no `pooled_rate_tps`, and `MEASUREMENT_METRICS = ('accepted_per_round',
'ms_per_round', 'ttft_s')` must all be in `decision_series`, where every series after the first is a LOSS-capable guard.

R-PP4 writes, per decision cell (`short-b1`, `32k-b1`), `decision_series` = `pooled_rate_tps` (primary,
(rounds + accepted) / decode seconds per repeat), then `accepted_per_round` and `decode_tps` (guards, per WIN2.md), and
`reported_series` = `ms_per_round`, `ttft_s` (each with its own win2-v1 verdict in `decision.reported_metrics`, never
deciding).

Why ms/round cannot be a guard here: PP4 deliberately spends ms per round (+0.31 ms MEASURED for the fused selector) to buy
accepted tokens (+6.9 % MEASURED offline). In the fixed5-vs-fixed5 controlled mode, ms/round barely moves with content, so
the control spread is well under 1 % and +0.8 % would read as a LOSS in every repeat even when tokens per second rise.
In the production-policy mode, adaptive depths 2..5 and fixed 5 draft rounds of different shapes. The promotion file
already says this for G6 ("per-round metrics are not like for like"). The rate charges the ms/round cost in full: it is
the rate's denominator. `decision.checklist_literal` records what ms/round-primary would have said, for review only.

Patch (`pp4_promote_window.py`):

```python
ORIENTATION = {'pooled_rate_tps': True, 'accepted_per_round': True, 'ms_per_round': False, 'ttft_s': False,
               'decode_tps': True}
MEASUREMENT_METRICS = ('pooled_rate_tps', 'accepted_per_round', 'decode_tps')   # decision_series, primary first
REPORTED_METRICS = ('ms_per_round', 'ttft_s')                                    # reported_series: present, non-deciding
...
    for cell in MEASUREMENT_DECISION_CELLS:
        got = [s.metric for s in series if s.cell == cell]
        require(got == list(MEASUREMENT_METRICS), f'PP4 measurement {cell}: decision series {got} differ (primary first)')
    reported = measurement_series(data.get('reported_series'))
    for cell in MEASUREMENT_DECISION_CELLS:
        missing = sorted(set(REPORTED_METRICS) - {s.metric for s in reported if s.cell == cell})
        require(not missing, f'PP4 measurement {cell}: reported series {missing} absent')
```

### 2. Source binding: carried qualification

`measurement_gate` today: `experiment_commit == switch.PP4_COMMIT` (941a3c3 at c258296; its admission stopped on the
near-tie locator defect, so the admitted commit will be PP4 Round15 85b0d96 or later, and `switch.PP4_COMMIT` moves with
it). An R-PP4 measurement runs at R-PP4's own commit (the v2 runner exists only there; it merges 85b0d96) and carries
the admitted commit's QUALIFIED receipt only when every file outside the measurement layer is byte-identical (that
includes `pp4_cells.py`, so the near-tie code is the admitted one) and the runner's remote/runtime units are
AST-identical (`pp4_measure_v2.carried`). Its summary records `experiment_commit` = R-PP4 HEAD, `runtime_commit` = the
admitted commit,
`carried_qualification` = {qualified_commit, head, changed_files, rule} and `qualification_sha256`.

Patch: merge `offload/pp4-win2` (brings `pp4_measure_v2`) and replace the commit check with

```python
from offload.launch.windows import pp4_measure_v2 as mv2
...
    carried = record(data.get('carried_qualification') or {})
    require(data.get('runtime_commit') == switch.PP4_COMMIT and carried.get('qualified_commit') == switch.PP4_COMMIT
            and carried.get('head') == data.get('experiment_commit'), 'PP4 measurement does not carry the admitted source')
    # Re-prove the carried rule now (no trust in the recorded file list): same git diff allowlist + runner unit ASTs.
    mv2.carried(admission_path, switch.PP4_COMMIT, str(data['experiment_commit']), str(data['measure_v2']))
```

(`measurement_gate` needs the admission receipt path for that call; `evidence_gate` already has it.)

### 3. Which measurement: production-policy mode

R-PP4 has two registered modes. `controlled` (s1-A/s2-B/s3-A) is the old fixed5 greedy vs fixed5 sampled comparison;
`production-policy` (s1-P/s2-B/s3-P) compares the PP4 promotion configuration (fixed5 sampled, `PP4-sampled.env` role B)
with production's own adaptive policy (`PP4-production-policy.env`) on the same PP4 runtime. Only the second says
anything about "no loss against production". Patch:

```python
    require(data.get('measure_v2') == 'production-policy', 'promotion evidence must be the production-policy measurement')
    require(data.get('config_sha256') == pf.digest(SAMPLED_CONFIG), ...)   # unchanged: B is PP4-sampled.env
```

### 4. Recorded fields R-PP4 adds (no change needed; listed for the reviewer)

`qualification_sha256` (sha of the `--qualification` receipt), `runtime_commit`, `carried_qualification`, `rng_gate`
(the #61161 verifier-RNG gate receipt validated before host contact; its PP4 kernel sha equals the admission's
prepared verifier), `measure_v2`, `production_policy_config_sha256`, `decision_series`, `reported_series`, `archive`.

## HOLD budget implication

None for the promotion HOLD: the R-PP4 measurements are separate windows before it (ESTIMATED 80.1 min controlled,
80.8 min production-policy with a 333 s pair reserve; measurement ends at 68.1 / 68.8 min). The production-policy
window refuses before host contact if the admission's measured pair reserve exceeds 588 s (600 s dry bound: 85.25 min).
G6 inside the promotion HOLD is unchanged.

## Caveat the reviewer should keep

P is production POLICY on the PP4 runtime (PP4 K2 worker in greedy mode + PP4 verifier overlay), not the production
binary. The exact-binary comparison is G6 inside the promotion HOLD. A production-policy measurement with no LOSS is
necessary evidence, not sufficient; G6 remains the final no-loss gate.