…mple capture

The per-PR and nightly compares were relying on a silent behaviour — a
host-class mismatch quietly turning both metrics advisory. That is now a
refusal by default, so both jobs pass --allow-host-mismatch and say why. The
flag is the phase-1 posture and the comment names the condition for dropping
it: a committed ci-ubuntu-latest baseline. Nothing about what these jobs
report changes; what changes is that the downgrade is written down.

bench-capture gains a `capture_samples` dispatch input. At 1 (default) it
behaves as before. At >= 5 it reruns the subset and folds each pass in with
--accumulate, producing the median + MAD the compare gate needs to widen
budgets past runner flap — which is the thing standing between the current
advisory annotations and a baseline that can actually gate on ubuntu-latest.

Both compare/capture steps also clear target/fluree-bench-meta alongside the
mem sidecars. A stale corpus block is worse than a stale timing: it asserts an
input identity for a run that never read that input.

…ly do

Every claim in the file checked against the merged main + #1477 tree. Five
were wrong or stale:

- "Where benches live" pointed at .github/workflows/bench-nightly.yml, which
  has never existed — the file is bench.yml. Both entries also carried
  "lands in bench-5" / "lands in bench-nightly PR" process notes for work that
  landed. Replaced with the real layout, including bench-baselines/ and the
  three target/ directories capture reads.
- The bench table was missing six of the eighteen registered [[bench]]
  entries: query_overlay_matrix, query_hot_bsbm_bi, query_hot_property_path,
  query_hot_whole_graph_agg, annotation_hydration, annotation_planner. (Five
  of those are missing on main; #1477 adds query_overlay_matrix.) Rows written
  from each bench's own module docs. Also says outright that nothing enforces
  this table, unlike the [[bench]] <-> budget reconcile, which is why it rots.
- The env-var table's defaults are right for a laptop and were being read as
  though they described CI. Both jobs pin quick/tiny — the nightly included,
  despite `Full`'s doc calling itself the nightly profile. Noted in the table
  and corrected at the source in runtime.rs, where BenchProfile::Full claimed
  "Nightly CI" and referenced the unbuilt `bench-nightly`.
- bench-baselines/README.md still described the pre-5d9d69513 asymmetric gate
  ("enforces memory across any runner class, time advisory"). That has been
  false on this branch since the gate was made symmetric.

The rest of the section is rewritten for the extensions in the previous
commit: the metric table with its per-metric portability column, the refusal
conditions and their exit codes, the noise-floor accumulation loop, and why
{os}-{arch} is a coarse default rather than a promise.

fluree-bench-support/README.md documented every module except the three the
baseline gate runs on. Adds `mem`/`meta` (what a sidecar is for, which dir,
what it carries) and `baseline`, and corrects the test count, which said 44
against an actual 102.

Review findings from an adversarial pass over the baseline gate. Each of these
produced a clean-looking report for a change that was genuinely worse.

New-phase invisibility (the expensive one). The per-phase loop walked only the
BASELINE's phases, so moving work into a phase the baseline never had made the
old phase's share FALL — reported as "improved" — while the new phase carrying
the cost produced no row at all. A 2x regression exited 0. Phases are now
compared over the union of both sides: a phase new in the current run breaches
when it claims more than the drift threshold, and a phase that vanished
breaches when it used to. Neither emits a phase_time row, because there is no
ratio to report against a missing side and a row reading "ok" against a zero
baseline is worse than no row. Rows are marked (NEW)/(VANISHED).

Timing noise widened the MEMORY budget. One budget was computed per scenario
and handed to every metric, so a baseline with a noisy clock (MAD 100 on a
median of 1000 = a 30% floor) let a +25% peak_bytes regression through a 5%
memory budget. An allocator's peak is near-deterministic for a given workload;
a noisy clock is no reason to forgive it. The floor now reaches time and
phase_time only.

The noise floor is baseline-only. It previously took max(baseline, current),
which lets an erratic run widen its own budget — the worse a run behaves, the
more it is forgiven. The baseline is the controlled measurement and alone gets
to say how much a scenario moves.

The host-mismatch remedy suggested relabelling the host (--host-class /
FLUREE_BENCH_HOST_CLASS "to the class the baseline was captured on"). Renaming
a machine does not make its numbers comparable: following that advice converts
the refusal into a silent, confident ENFORCEMENT against hardware the baseline
never ran on — the exact failure the refusal exists to prevent. The remedy now
leads with --allow-host-mismatch, and the usage text says what --host-class is
and is not for.

Also here, from the same pass:

accumulate now enforces host-class AND corpus identity, and both guards live
in the library rather than in the CLI that happened to call it. Accumulation is
the one operation that DESTROYS the evidence of a mismatch — two populations
blended into a single median/MAD, with the provenance overwritten in the same
breath — so a bench harness calling accumulate() directly must not be able to
skip the check. Returns Result; the doc comment no longer describes protection
that wasn't there.

with_phase_ns MERGES instead of replacing, recomputing shares over the union.
Replacing silently discarded an earlier call's phases while leaving the
remaining shares looking perfectly well-formed — invisible in the output. And
PhaseTiming's docs no longer claim ns and share_pct "can never disagree": that
is a property of the constructor, not an invariant, since both fields are
public and a baseline file is untrusted input. compare now reports a scenario
whose shares don't sum to 100% instead of assuming they do — reported, not
gated, since the drift comparison is still internally consistent.

Regression tests come from the reviewer's three repro fixtures and all three
are verified against the real binary, not just the library.

…new rules

The phase and corpus machinery reads in BENCHMARKING.md as though it were
running today. It isn't: no bench in the workspace calls meta::record_scenario,
so no phase or corpus row appears in any report this branch produces. That is
deliberate — the gate has to exist before the benches that depend on it — but a
reader had no way to tell scaffolding from live coverage. Stated up front.

Also documents the rules the fix commit introduced: one-sided phase gating and
why comparing only same-named phases is itself a hiding place; the three bounds
on the noise floor (widening-only, wall-clock-only, baseline-only) each with the
inversion it prevents; and accumulate's refusal to pool across host classes or
corpora.

The compare quickstart now carries --allow-host-mismatch inline. Without it the
copy-pasteable command refuses against the committed baseline, which is exactly
the flag the reader needs to understand — leaving it in the options list taught
the rule only to people who already knew it.

Cargo.lock recorded fluree-bench-virtual at 4.1.3 while the crate inherits
`version.workspace = true` and [workspace.package] declares 4.1.4. The entry
was stale on main itself, not introduced here: any plain `cargo build` or
`cargo metadata` on a main-derived branch rewrites this same line and leaves a
dirty tree.

Nothing enforces it today — no workflow passes --locked or --frozen — so this
is hygiene rather than a fix for a live failure. It rides along with this PR
only because building this branch is what surfaced it; it is one line of
lockfile churn with no dependency resolution change, and it is deliberately a
separate commit so it can be dropped or cherry-picked independently of the
bench work.

Six review items, one theme: a baseline file is untrusted input, and in each
case the gate accepted something it could not verify and exited 0. Grouped in
one commit because they are interleaved edits to the same load/compare path in
baseline.rs; splitting them would mean commits that don't build.

[BLOCKING] Corpus, `(Some, None)` (item 1). `compare` only checked identity
when BOTH sides declared a corpus, so a producer that stopped emitting its
sidecar — or a sidecar write that failed — bypassed the identity gate entirely.
Absence of evidence was read as evidence of the same input. Now: baseline
declares a corpus and the current run declares none is a REFUSAL. The reverse
stays permitted, and that asymmetry is deliberate — a schema-1 baseline
predates corpus blocks, so refusing there would make every old baseline
unusable. Both directions are pinned. `accumulate` had the same hole plus a
worse consequence, since `fresh.clone()` also erased the prior identity while
pooling the sample; it now shares one `corpus_refusal` helper with `compare` so
the two cannot drift apart.

[BLOCKING] Shares (item 2). These were treated as cosmetic — a report line,
never a gate. That is wrong in the one case that matters: on a host mismatch
`phase_share` is the ONLY enforcing metric, so a malformed current sidecar with
every share at 0.0 marked every phase "improved" while the absolute metrics
were merely advisory, and the command exited 0. Shares are now validated before
anything gates on them: non-finite, negative, or a sum more than 1pp off 100 is
a refusal (`MismatchKind::PhaseShares`). Refusing rather than silently
recomputing from `ns` matches the rest of the gate — a file that disagrees with
itself gets "I won't guess", and the remedy names the constructor that derives
shares correctly. The `anomalies` channel is removed; it existed only for this.

accumulate schema guard (item 3). `compare` refused a schema newer than the
binary understands; `accumulate` did not, so an older binary could deserialize
an additive future schema, clone a fresh capture over it, and write it back
having silently dropped every field it didn't recognise.

accumulate revision guard (item 4). Pooling samples across a code change mixes
pre- and post-change populations, relabels every sample as the new revision,
and can widen the MAD enough to hide the change being measured. Differing
non-empty `git_sha`s now refuse unless `--allow-revision-drift` says otherwise.

NoiseStats trust (item 5). `n`, `median_ns`, and `mad_ns` were trusted
independently of the `samples_ns` they claim to summarise, so a hand-edited
file could claim n=5 beside an arbitrary median and MAD and thereby move the
comparison point and widen the budget. They are now recomputed from the samples
at load. A set with too few samples, or any non-finite/non-positive sample,
cannot be recomputed and is returned unusable rather than trusted — losing a
floor is the safe direction, since a floor only ever widens.

Empty-document guard (item 6). Every top-level field carries a serde default so
schema-1 files keep loading, which meant `{}` also deserialized "successfully".
An empty baseline compares against nothing, breaches no metric, and exits 0 —
a gate that passes because it had no reference points. `load_baseline` now
requires schema_version >= 1 and at least one scenario.

`capture_samples: 0` made `seq 1 0` run zero passes, so no baseline was ever
written — and `upload-artifact` only warns on a missing file by default, so the
job went green having produced nothing. A capture job that silently captures
nothing is the worst outcome available here, because the next person assumes an
artifact exists.

Validates a positive integer before the loop, and sets `if-no-files-found:
error` on the upload so the belt has a brace.

The capture job writes `guardrails-pre-ci.json`; both compare jobs read
`guardrails-pre.json`. Following "download the artifact, commit it, and remove
--allow-host-mismatch" literally leaves CI reading the old host_class=local
file with the flag gone — which refuses every run, so phase 2 would land as a
red gate rather than a working one.

Spells out the replace step with the actual command, and notes the alternative
(keep the -ci name, repoint every --baseline path) so the choice is visible
rather than implied.