Make embedding calibration GPU-only and correct true-idle timing

[TheGreenCedar]

Problem

CodeStory supports accelerated embeddings only. The calibration control plane still carried a hosted Linux CPU lane and could spend repeated packaged-harness runs measuring qualification work that does not select runtime constants.

The same calibration cycle must also repair true_idle_exit: the measurement began when a later snapshot noticed an already-idle scheduler instead of when the final product request completed. That understated the observed idle interval.

Product decision

• CPU embeddings are unsupported. Calibration and release proof must reject backend: cpu, cpu_explicit, and CODESTORY_EMBED_ALLOW_CPU=1.
• Protected Apple Silicon Metal is the sole required calibration cell.
• Protected Linux Vulkan may supply optional parallel evidence. Missing Linux hardware must not block calibration assembly or trigger a fallback.
• Lifecycle, fault, true-idle, memory, retrieval-quality, and accelerator qualification belong to frozen-candidate qualification, once per available GPU platform.

Acceptance

• Calibration measures only the raw values that feed the seven runtime-constant groups.
• Three independent clean records use three fresh server generations and one sample per named metric per generation.
• Each cell authenticates and unpacks one archive, prepares projects and requests once, reuses one materialized model, and reuses one shared Cargo build/package result.
• Runtime-constant freezing does not invent or rewrite thresholds for omitted measurements.
• true_idle_exit begins at completion of the final product request and is qualified against the fixed 60-second product timeout plus an explicit observation grace.
• Full lifecycle and fault qualification run once on the frozen candidate per available GPU platform.
• Workflow-policy mutations fail if they reintroduce CPU, qualification work during calibration, 3x3 sampling, repeated setup/build/package, or Linux-gated assembly.
• One independently accepted exact-head source proof precedes calibration. The generated constant set is the sole source change after calibration.

Calibration-input digest reuse is useful follow-up work, but it does not block this repair.

[TheGreenCedar]

Calibration source 8f5f7991a20b8c4d656cefcbca47b2218658f5bb is accepted and fixed on codex/1558-true-idle-boundary.

• Exact-head source run 30434598183 passed complete workspace compilation, all-target/all-feature lint, and the complete workspace test suite.
• Fresh calibration run 30437725369 is active against that exact unfrozen tree.
• The protected Metal lane completed all three independent runs successfully. The hosted Linux three-run lane is still collecting evidence.
• No frozen constants have been applied, and nothing has been released or published.

Next proof target: authenticate the assembled six-run bundle, commit its generated constant set as the only post-calibration file change, then require exact-head source proof and full frozen-candidate package/lineage/platform qualification before merging PR #1597.

[TheGreenCedar]

Calibration run 30437725369 is no longer active. It failed twice at the same pre-measurement Linux harness boundary; a third equivalent rerun was not attempted.

• The initial two-host cold search succeeded in both attempts. The later calibration-only request re-entered the unchanged full checkout, returned 340 preparation envelopes, and expired at attempt 341 under the shared 1,800-second bound.
• All three Metal measurements completed, but no six-run bundle or frozen constant was produced.
• Issue #1598 and PR #1600 now own the harness correction. Their exact committed head has passed the packaged-proof self-test and an independent seven-mutant refutation; full exact-head source CI is running.
• Issue #1599 separately tracks the product defect in repeated activation of a ready, unchanged project. The calibration repair does not hide or close it.

No constant has been applied, and nothing has been released or published. Next proof target: land #1600 on development, merge that head into PR #1597 with rerere disabled, establish and source-prove a new exact calibration head, then dispatch a completely fresh Linux CPU plus Metal six-run calibration.

[TheGreenCedar]

New exact calibration source: a73c25c266c82ff9fabf466a4cab919f345b278f on codex/1558-true-idle-boundary.

• Parent 1 is the reviewed true-idle/unfrozen head 8f5f7991a20b8c4d656cefcbca47b2218658f5bb.
• Parent 2 is landed development 10344e9b3e871ce0a5b4c0b2a70201aede5dfa28, containing the calibration-harness repair from PR Keep draft calibration off full-project reactivation #1600.
• An independent both-parent audit proved all six true-idle blobs and all three harness blobs are byte-identical to their reviewed owners. git merge-tree and the combined diff show no conflict or rerere resolution.
• The constant set remains unfrozen with freeze_record: null; the canonical values and thresholds digest is unchanged.
• Packaged-proof self-test, focused true-idle tests, workflow policy, version validation, Python compile, and diff checks pass locally.
• Exact-head source run 30454756899 is active on this exact merge commit.

No calibration has been dispatched against the new source, no constant has been applied, and nothing has been released. Next proof target: source run 30454756899 must pass, then dispatch one completely fresh six-run Linux CPU plus Metal calibration against a73c25c2.

[TheGreenCedar]

Exact-source proof is green for the new calibration source a73c25c266c82ff9fabf466a4cab919f345b278f: run 30454756899 passed full-source-gate.

Fresh calibration run 30456979543 is now dispatched against PR #1597 in calibration mode. It consumes no prior run or bundle. Acceptance requires three hosted Linux CPU measurements, three protected Apple Silicon Metal measurements, successful assembly, and the exact artifact embedding-calibration-bundle-a73c25c266c82ff9fabf466a4cab919f345b278f.

https://github.com/TheGreenCedar/CodeStory/actions/runs/30456979543

[TheGreenCedar]

Calibration run 30456979543 stopped before measurement assembly. The first Metal run failed at the live bootstrap guard because the resident server's successful-encode counter did not advance across the two-host retrieval step. The workflow retained embedding-calibration-macos-0.16.3 failure evidence.

The Linux cell was cancelled once Metal failure made assembly impossible; no identical rerun is planned. This now requires source-level diagnosis. In parallel, issue #1601 owns the newly blocking repair to the serialized retrieval-generalization test architecture before another broad source gate.

https://github.com/TheGreenCedar/CodeStory/actions/runs/30456979543

[TheGreenCedar]

Calibration source e5d029520d04c0ccd5af68cefc9e79294f9ffcb2 is independently accepted and exact-head source-green.

• Exact-head source proof: https://github.com/TheGreenCedar/CodeStory/actions/runs/30467309927
• Workspace: 2,346 passed, 29 skipped, zero failed
• Retrieval generalization: green in 37 seconds
• Independent refutation: the old cached project-B query fails the encode-counter guard; six proof-tier weakening mutations and two true-idle boundary mutations all fail
• Merge audit: the rerere-disabled dev merge preserved both disjoint parents exactly

Fresh six-sample calibration is now running:
https://github.com/TheGreenCedar/CodeStory/actions/runs/30468908281

The PR remains draft and the constant set remains unfrozen. A successful generated constant-set file must be the sole post-calibration source change before frozen-head source proof and full qualification.