docs(t0): pretraining protocol freeze — skeleton, NOT_FROZEN

[PhysShell]

status: NOT_FROZEN · collection_authorized: false — deliberately. Content is complete; the freeze is its own review and its own commit.

Stacked on #353 (T0-0), which revokes the automatic step-7 collection authority this document then gates.

The decision function

Per gate, two coordinates and no synthetic scalar:

PASS          iff  relative_regression <= M_pass
               OR  absolute_regression <= A_pass
FAIL          iff  relative_regression >= M_fail
              AND  absolute_regression >= A_fail
otherwise     NO_DECISION

The leaf is the cell — one canonical workload, on one stratum, in one regime, for one resource — and the same operator rolls up twice:

cell verdicts  -> class verdict     any FAIL => FAIL; else any NO_DECISION => NO_DECISION; else PASS
class verdicts -> overall verdict   the same operator over the eight classes

One failing workload fails its class however many others pass. INVALID is not a roll-up verdict at either level: admissibility is settled before a roll-up exists.

Checked by enumeration at both levels: a class over 12 cells is total and single-valued across all 531441 combinations, and the overall roll-up over 8 class verdicts across all 6561. The 6561 figure is the second level only — it is not a check of the whole primary decision space, which has 8 x 12 = 96 leaves.

The eight primary gate classes

They are classes, not leaves: each covers the canonical decisive workloads, and the acceptance decision happens per workload cell inside it. Identity carries its stratum, because since #355 the memory quantity is platform-local. Four gates per stratum; U_linux and U_windows are never pooled and no ratio is formed across them.

linux   / launcher-e2e / process-cold / elapsed                     (ms)
linux   / launcher-e2e / warm         / elapsed                     (ms)
linux   / launcher-e2e / process-cold / max_process_peak_resident   (bytes)
linux   / launcher-e2e / warm         / max_process_peak_resident   (bytes)

windows / launcher-e2e / process-cold / elapsed                     (ms)
windows / launcher-e2e / warm         / elapsed                     (ms)
windows / launcher-e2e / process-cold / max_process_peak_commit     (bytes)
windows / launcher-e2e / warm         / max_process_peak_commit     (bytes)

The budgets — by resource, not by regime

Each family below applies to both regimes of its resource. The pass pair and the fail pair belong to the same gate: no regime owns one of them, and process-cold does not get "the pass budget" while warm gets "the fail budget".

family	applies to	M_pass	A_pass	M_fail	A_fail
time	both strata, both regimes — four gates	0.05	50 ms	0.10	100 ms
linux max_process_peak_resident	both regimes on Linux — two gates	0.10	33 554 432 B (32 MiB)	0.20	67 108 864 B (64 MiB)
windows max_process_peak_commit	both regimes on Windows — two gates	0.10	33 554 432 B (32 MiB)	0.20	67 108 864 B (64 MiB)

The two memory families carry identical numbers and are not the same budget: resident bytes and committed bytes are different physical quantities, priced alike today because both came from one product budget before any data existed. Either may move without the other. resident == commit is asserted nowhere.

No compensation in any direction — not between regimes, not between time and memory, not between strata.

The population is owned here

Gates are computed over exactly the decisive workloads of the D7-bound manifest that the launcher-e2e rung admits, counted as canonical identities: 13 manifest entries resolve to 12 canonical identities, because large-solution-control is alias_of oss-ShareX.sln — the same path at the same pin — and an alias earns no second vote. Calibration workloads never enter a cutover gate. A missing canonical identity, a missing engine side, an unexpected extra cell, a duplicate canonical identity or a calibration cell inside the set each make the attempt INVALID: a missing cell is not a smaller denominator. The instrument's applicability rule implements this sentence rather than being its source, so two readers cannot answer differently about which cells a gate covers.

How this lands in the accepted D7 payload

D7_CELL_DIMENSIONS = (phase, workload_id, platform, regime) and D7_ROLLUP_LEVELS = (workload_class, phase, overall_g3) — 8 phases x 12 canonical workloads x 2 platforms x 2 regimes = 384 cells, each needing a rule or an explicit not_applicable. The time classes are the end-to-end-csharp phase; memory is not a phase but each cell's rss_policy; the seven non-gating phases carry not_applicable with a reason, so a diagnostic surface stays non-gating and completeness is still satisfied. Nothing here asks perf_baseline.py to change, so the harness digest does not move.

Numeric domain and sample completeness

Every quantity a gate consumes must be defined, real and finite, with medians strictly positive, and this is checked before the rule — otherwise the OR would let relative = NaN, absolute = 10 ms through on the strength of the other coordinate. None, NaN or an infinity anywhere in R or either coordinate makes the attempt INVALID.

A primary cell holds exactly N samples, each finite, positive and carrying its stratum's declared metric kind. One null, one missing sample or one unexpected metric kind invalidates the session; a median over the surviving subset is forbidden by name, because the instrument's summariser drops absent memory samples silently.

Replacement and retry continuity

Six replacement conditions, closed — no "other environmental reason". A performance outcome is never one of them. The retry budget belongs to the stratum, not the host: replacement does not reset it, a valid outcome-bearing session closes the stratum and is retained forever, and re-measurement requires a previous INVALID and remaining budget. A new binding starts a campaign beside the old one and erases nothing.

Also resolved earlier in this PR

T0-1 pairing by cell with index pairing forbidden · T0-5 deterministic two-dimensional gray zone, not a bootstrap across cells · T0-6 session as the unit of invalidation, retry_budget: 1, fresh manifest per session · T0-7 host predicate in two evidence classes, AC and DC on Windows, a really-waited 120 s quiesce · T0-9 training derives N and nothing else.

Hostile review

The hostile-review questions are in the document; each is answered there with the clause that closes it. None remains open that a decision could close — the one permitted item, a repeated quiesce attempt, produces no evidence and so cannot select an outcome.

🤖 Generated with Claude Code

https://claude.ai/code/session_018xhcg5opoFbSTdYHpkSXCh

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}