fix(harness): enforce the reconcile's read >= sent//2 floor unconditionally

[wshallwshall]

The load harness's no-loss reconcile documented, in all three copies plus the
test docstring and the 0.3.2 changelog entry, that its unconfirmed-send excusal
"keeps read >= sent // 2 always required". It did not.

The excusal is capped at max(unconfirmed_budget, sent // 2), and every one of
the five call sites passes a CONNECTION COUNT as unconfirmed_budget
(report.py pool_size x targets; connscale/runner.py and estate/runner.py the
step's count verbatim; connscale/remote.py n x count; multishard.py
engines x count_per_engine). max() takes that count as a FLOOR, not a ceiling,
so whenever the connection count exceeds half the sends -- the normal shape of
a short, low-rate step -- the count wins and the bound degrades to
read >= sent - connections. At connscale-smoke's N=100 cell (~105 sends against
100 connections, budget max(100, 52) = 100) that is read >= 5: 95% of the run
excusable, which is the exact vacuity the cap was written to prevent. Nothing
clamps the excusal to sent either, so timeouts > sent degraded it to
read >= 0 outright.

PR #17 did not create this hole. The bound before it was unconfirmed_budget
alone -- the identical value in exactly these cells -- so in the floor-dominated
regime the pre-#17 and post-#17 verdicts are bit-for-bit the same. #17 left the
hole where it was and attached to it a guarantee it does not deliver there.
Nor was the gap detectable: every test used a budget of 2 or 4 against 36 or 90
sends, where sent // 2 always won the max(), so deleting the floor arm from all
three copies left the suite fully green -- a surviving mutant.

The fix asserts the guarantee separately, as an intake floor the excusal cannot
lower:

floor_short = sent // 2 - read

folded into ok in all three copies with its own detail string. The
half-the-run cap and the over_budget systemic-no-ACK determination are
UNCHANGED, so #17's de-flake survives intact (the 84-of-90 red-CI regression
and the 45-of-90 at-cap pin both still pass). The floor is 0 at sent == 0 and
rounds DOWN on an odd sent, so it is never stricter than the documented bound.
In report.py it is deliberately not subject to tolerance: the tolerance is an
operator knob on the shortfall, not a licence to lower the anti-vacuity floor.

Also fixed, found while tracing the call sites: the estate copy lacked the
honest-reporting branch its two siblings have, so a bounded-excused estate run
printed the flat "read>=sent, sink_received>=written, backlog drained" detail
while read was demonstrably below sent -- a claim false on its own numbers. Its
over-budget detail string had drifted from its siblings' too; a new test pins
the three in step, since four comments and the changelog asserted that they were
and nothing enforced it. And five stale comments still recited the "~one
stranded in-flight frame per connection" model #17 retired, including the two
that justify the budget VALUE being passed (connscale/runner.py, multishard.py)
and the rate-SLO sample-floor comment in report.py.

Thirteen new tests pin it, all mutation-verified against the real functions:
the floor-binding regime at connscale-smoke's shape (budget 100 vs 105 sends),
that it is the floor and not the budget doing the work there, exact rounding on
an odd run size (52 of 105 passes, 51 fails), timeouts > sent, an empty run,
tolerance not lowering the floor, estate's detail honesty in both directions,
cross-copy detail parity, and -- guarding the other way -- that ~16% teardown
stranding still passes at each smoke shape. Neutralising the floor kills 7 of
them across all three copies; rounding it up instead of down kills the boundary
pin; dropping estate's suffix kills the parity pin.

Known gap, not addressed here and now stated as such in the code rather than
contradicted by it: over_budget is still gated on the same
max(unconfirmed_budget, sent // 2), so a totally dead ACK path still passes as
clean whenever unconfirmed_budget >= sent (verified: sent=90, timeouts=90,
read=90, budget=100 -> ok=True on all three copies). An intake floor
structurally cannot catch a fault whose signature is high read with no ACKs;
that arm needs the budget itself bounded. Follow-up.

---

🤖 Generated with Claude Code