feat(represent): proxy evidence orders promotion without becoming price (R4-F1)

[chrishayuk]

R4-F1 — found by Rung 4's first real search against the Kimi bank.

The defect

The driver printed PROMOTE: e26, matching the pre-registered prediction. Reversing the input list printed PROMOTE: e20, from identical reports.

All four rank keys were byte-identical:

e26/e24/e23/e20   tier=1  within=0.702202900  frugality=-0.000000000

rank_key() = (class.tier(), within, frugality), and within falls back to gpu_ms_saved for any non-Priced class. Every one-step move removed the same bytes ⇒ exact tie ⇒ cmp_rank returns Equal ⇒ a stable sort returns input order.

At diagnostic scale nothing is priceable by design, so this tie is the normal state, not an edge case. Meanwhile both calibrated proxies separated the candidates monotonically and unanimously. The evidence existed and the comparator could not see it.

The invariant

Determinism may order indistinguishable candidates for display; it may never convert indistinguishability into evidence for promotion.

display_order may use identity as its final tie-break. decide_promotion is not given identity at all, so it cannot — structural, not a discipline.

Ordinal, never scalar

An OrderingProxy licenses order and not magnitude, so a numeric proxy term in RankingScore would smuggle magnitude back in through the comparator.

physical economics   can say how much a move buys
proxy evidence       can say A should be tried before B
neither says         "A is 1.7x better than B"

A proxy-dominates B iff no worse on every comparable proxy and strictly better on at least one. Comparability requires both candidates to have observed the statistic and the registry to say it orders at this scale.

The staged comparator: class → proxy ordering → physical gain → frugality. Conflicts are refused, not traded off — no calibration says how many places of kl buy one place of routing, so the frontier returns Ambiguous{ConflictingOrderingProxies}. Physical gain may separate candidates the proxies call equal, recorded as decided_by_physical_gain so a trace never has to guess which stage decided.

Selection is not prediction

The variant is SelectForAuthority, not Promote, and its evidence names the authority dimensions the diagnostic scale could not speak to. Uninformed is eligible by design — authority is the mechanism that resolves those dimensions, so gating it out would silently rewrite the doctrine into "diagnostic must predict every authority dimension before authority may run", which at 256 positions is impossible for the mass tails.

Uninformed  !=  safe
Uninformed  !=  admissible
Uninformed  ==  diagnostic evidence cannot speak about every
                authority dimension

The policy, stated once: Uninformed may be selected for authority iff it is otherwise promotable, the missing dimensions are explicit, and no better-evidenced candidate outranks it. Never Uninformed => refuse, and never Uninformed => assume the missing dimensions are free.

Result on the real reports — no new GPU work

SELECT FOR AUTHORITY: e26      (identical from both permutations)
  reason      : uniquely proxy-dominant on all comparable evidence
  dominates   : ["e20", "e23", "e24"]
  deciding    : ["kl p99", "route flips per position"]
  UNRESOLVED  : ["routed mixture moved at max", "routed mixture moved at p99",
                 "top-1 probability given up", "top-10 mass displaced at p99"]
  readiness   : Uninformed
  by gain?    : false

  MEANING: selected to MEASURE, not predicted admissible.

display_order recovers the pre-registered e26 < e24 < e23 < e20.

Two things the tests caught

The decision was permutation-invariant before the evidence record was — dominated echoed input order, so the same round produced different traces. And sorting the table on cmp_rank alone put the worst candidate first, because every key tied and identity decided.

Also

Statistic moves to its own module with a canonical better()/order() — one derivation of which end is good, since deriving it from a gate's LimitKind only works for statistics a contract bounds, and RouteFlipRate is bounded by nothing. quality.rs also hit 888 lines in #376, over the 800 cap; it is back to 775.

Verification

fmt, clippy -D warnings, E0 (10 passed), full suite (3648 passed, 0 failed), cargo check --workspace --all-targets. Coverage policy passed — statistic.rs 100.00%, decision.rs 96.40%; crate 93.49%.