fix(seal): carry the paced-target distinction, or the engine fix is inert

The engine now publishes a stream rate that matched the mock's paced upstream
instead of suppressing it. On its own that changes nothing the board shows: the
seal's rule is "a positive value whose flag !== false is SUPPRESSED", so the
value was thrown away one layer later and the fix would have been decoration.
Which is precisely the failure shape this whole audit keeps turning up, so
finding it in my own change an hour after writing about it is worth saying out
loud.

sealMetric takes `paced` now. For the stream metrics the mock's frames/sec is a
TARGET - c streams x one frame per its fixed delta interval, "the pacing is the
model generating tokens" in the mock's own words - so a `true` flag means the
gateway kept up and is carried as a signal beside a published value. For the
throughput metrics nothing changes: a saturating load can genuinely exhaust the
mock, and publishing then ranks the rig instead of the gateway.

`unverifiable` still suppresses on both paths. An unmeasurable reference says
nothing either way, and certifying a number on no evidence is the thing the gate
exists to prevent.

Also closes the freshness fail-open's sibling in the same file, and the test
pins all four corners: paced+bound publishes, capacity+bound suppresses,
unverifiable suppresses on both, clean certifies on both. Confirmed RED against
the old single rule.

Author: MattJackson

site/gen-data.mjs

@@ -395,13 +395,13 @@ function sealStreamRecord(s) {
   // honesty flag. Sealing it UNGATED beside a GATED streams_sustained let the rig-bound rate publish
   // while the count it came from was suppressed. Gate it on the same flag.
   rec.streams_sustained_fps = sealMetric(s.streams_sustained_fps, {
-    gated: true, flag: s.streams_sustained_mock_bound, zeroNote: ZERO_MEASURED_FAIL });
+    gated: true, paced: true, flag: s.streams_sustained_mock_bound, zeroNote: ZERO_MEASURED_FAIL });
   // AUDIT #3: streaming counts - a 0 is a MEASURED FAILURE (offered stream load, sustained none), NOT
   // "not measured". Only a null (absent field) is not-measured. The note names which, and every surface
   // renders the two apart.
   rec.streams_sustained = sealMetric(s.streams_sustained, {
-    gated: true, flag: s.streams_sustained_mock_bound, zeroNote: ZERO_MEASURED_FAIL });
-  rec.cpu_fps = sealMetric(s.cpu_fps, { gated: true, flag: s.cpu_fps_mock_bound, zeroNote: ZERO_MEASURED_FAIL,
+    gated: true, paced: true, flag: s.streams_sustained_mock_bound, zeroNote: ZERO_MEASURED_FAIL });
+  rec.cpu_fps = sealMetric(s.cpu_fps, { gated: true, paced: true, flag: s.cpu_fps_mock_bound, zeroNote: ZERO_MEASURED_FAIL,
     extras: { concurrency: s.cpu_fps_concurrency ?? null } });
   return rec;
 }

site/seal.mjs

@@ -74,6 +74,9 @@ export function makeSource(kind, sweep, build, measuredAt) {
 // the raw scalar do not survive onto the returned object except as `value` (present only when honest).
 //   value      : the raw number (or null/undefined when not measured)
 //   opts.gated : true for a throughput metric (apply the mock-bound honesty rule)
+//   opts.paced : true when the mock's reference is a PACED TARGET rather than a capacity (the stream
+//                metrics). Matching it is the gateway keeping up, so a `true` flag is carried as a
+//                signal instead of suppressing the value. An absent flag still suppresses.
 //   opts.flag  : the raw *_mock_bound sibling (false = certified, true = rig-bound, null/undefined = unverifiable)
 //   opts.source: the provenance stamp (makeSource)
 //   opts.extras: extra CERTIFIED-only fields to carry (concurrency, sweep array) - dropped when suppressed
@@ -91,16 +94,27 @@ export function makeSource(kind, sweep, build, measuredAt) {
 export const ZERO_NO_CEILING = "no_qualifying_ceiling";
 export const ZERO_MEASURED_FAIL = "measured_failure";
 export function sealMetric(value, opts = {}) {
-  const { gated = false, flag, extras = null, zeroNote = ZERO_NO_CEILING } = opts;
+  const { gated = false, paced = false, flag, extras = null, zeroNote = ZERO_NO_CEILING } = opts;
   if (value == null) {
     return { value: null, certified: false, suppressed: false, reason: "not_measured" };
   }
   const num = Number(value);
   if (gated) {
     // measured-zero: an honest, certified 0 whose NOTE names what the zero means (see zeroNote above).
     if (num === 0) return { value: 0, certified: true, suppressed: false, note: zeroNote };
-    // positive but not certified as gateway-vs-ceiling -> SUPPRESSED, raw number consumed (gone).
-    if (!(num > 0 && flag === false)) {
+    // A PACED metric's flag is not a suppression. The mock paces its stream deltas at a fixed
+    // interval - "the pacing is the model generating tokens", in the mock's own words - so its
+    // frames/sec is a TARGET rate, c streams x one frame per interval, and not a capacity it ran out
+    // of. A gateway forwarding every frame as it arrives lands at ~99% of it, which is the best
+    // possible outcome, and suppressing that threw the number away for the gateways doing best: 24
+    // of 69 cells in the 2026-07-28 run. The flag stays on the envelope as the signal it always was
+    // (this gateway matched the paced upstream), and the value is published beside it.
+    //
+    // A metric that is gated but NOT paced keeps the old rule exactly: for a saturating throughput
+    // load the mock's capacity really can be the limit, and publishing then ranks the rig.
+    // `unverifiable` still suppresses on both paths - an unmeasurable reference tells us nothing
+    // either way, and certifying a number on no evidence is what the whole gate exists to prevent.
+    if (paced ? flag == null : !(num > 0 && flag === false)) {
       const reason = flag === true ? "mock_bound" : "unverifiable";
       return { value: null, certified: false, suppressed: true, reason };
     }

site/test.mjs

@@ -3189,4 +3189,34 @@ test("freshness guard REFUSES a board it cannot date, rather than passing it", (
   assert.ok(msg, "expected gen-data to THROW on a board with no datable measurement, but it succeeded");
   assert.match(msg, /FRESHNESS FAILURE \(undatable board\)/, `expected the undatable-board failure, got: ${msg}`);
 });
+// ---- a paced target is not a capacity, and the seal has to know the difference ------------------
+// The engine publishing a paced-rate match is worthless if the seal still throws it away: the whole
+// point is that the number reaches the board. This pins both halves of that contract.
+test("seal: matching a PACED upstream publishes the value; matching a CAPACITY still suppresses", () => {
+  // Stream metrics: the mock paces deltas, so its frames/sec is the target rate. Reaching it is the
+  // gateway keeping up - 24 of 69 cells were deleted for exactly this in the 2026-07-28 run.
+  const paced = sealMetric(12275, { gated: true, paced: true, flag: true });
+  assert.equal(paced.value, 12275, "a gateway that kept pace must publish its rate");
+  assert.equal(paced.certified, true);
+  assert.equal(paced.suppressed, false);
+
+  // Throughput metrics: the mock's capacity really can be the limit, and publishing would rank the
+  // rig rather than the gateway. Unchanged.
+  const capacity = sealMetric(12275, { gated: true, flag: true });
+  assert.equal(capacity.value, null, "a rig-bound throughput number must still be suppressed");
+  assert.equal(capacity.suppressed, true);
+  assert.equal(capacity.reason, "mock_bound");
+
+  // An UNMEASURABLE reference suppresses on both paths: it says nothing either way, and certifying a
+  // number on no evidence is what the gate exists to prevent.
+  for (const opts of [{ gated: true, paced: true }, { gated: true }]) {
+    const unverifiable = sealMetric(12275, { ...opts, flag: null });
+    assert.equal(unverifiable.value, null, `an unusable reference must suppress (${JSON.stringify(opts)})`);
+    assert.equal(unverifiable.reason, "unverifiable");
+  }
+
+  // A clean, comfortably-under-the-ceiling reading is certified on both paths, as it always was.
+  assert.equal(sealMetric(500, { gated: true, paced: true, flag: false }).value, 500);
+  assert.equal(sealMetric(500, { gated: true, flag: false }).value, 500);
+});