fix: publish the cost window's own load, and drop the aborted run's orphan row

AUDITING THE FIRST COST-CARRYING SNAPSHOT FOUND A NUMBER NOBODY COULD CHECK.

one-api published cpu_us_per_request 13,207 and cost_core_utilisation 2.56%. Those two are consistent
only if the cost window carried about 7.75 rps - but the sweep's rung at the SAME concurrency carried
35. Both readings are defensible and they mean opposite things: either the gateway is genuinely cheap,
or that window simply did less work than the sweep did. Nothing in the artifact could separate them,
because `cpu_us_per_request` is CPU divided by a request count that was published NOWHERE.

A number that re-derives from nothing is the thing this project refuses to ship. `cost_window_ok` and
`cost_window_rps` now publish the window's own completed count and rate, so the cost divides by
something a reader can see.

Worth recording, because it nearly passed: my first check of these figures was
`cpu_us_per_request x rps_per_cpu_second == 1,000,000`, and it "passed". It is TAUTOLOGICAL - the two
are the same quantity inverted, so the product is a million by construction whatever the data says. A
check that cannot fail told me the numbers were sound while the real question went unasked.

ALSO REVERTED: the aborted run's one-api row (525f9c5). Killing a run mid-flight left one gateway
published at engine 26c7436 while the other thirteen sat at dd58497 - a mixed board, and a row
measured by a run that was stopped before it could be trusted. R3 caught it immediately ("the board is
rendering from a stale/mis-selected run"), which is the freshness guard doing exactly its job. An
aborted run must leave nothing behind.

514 engine tests, clippy/fmt clean, 206 site tests, check-consistency clean, auditor fixtures pass.

Author: MattJackson

audit-every-metric.py

@@ -38,7 +38,7 @@
     # (`procsample::cost` returns HarnessError rather than subtracting into a negative) - so if one
     # ever reaches the artifact, the refusal has been bypassed and this is the second line of defence.
     "cpu_us_per_request", "rps_per_cpu_second", "cost_window_conc", "cost_threads",
-    "cost_core_utilisation",
+    "cost_core_utilisation", "cost_window_ok", "cost_window_rps",
     "cost_nonvol_ctxt_per_request", "cost_majflt",
 }
 # THERE IS NO p50<=p99 CHECK HERE, AND THE ONE THAT USED TO BE WAS UNSOUND.

engine/src/metric.rs

@@ -1764,6 +1764,8 @@ impl Metric for Cost {
             "cpu_us_per_request",
             "rps_per_cpu_second",
             "cost_window_conc",
+            "cost_window_ok",
+            "cost_window_rps",
             "cost_core_utilisation",
             "cost_threads",
             "cost_nonvol_ctxt_per_request",
@@ -1825,6 +1827,16 @@ impl Metric for Cost {
                 "cost_window_conc",
                 Measurement::Measured(f64::from(COST_WINDOW_CONCURRENCY)),
             ),
+            // THE WINDOW'S OWN LOAD, published so the cost is CHECKABLE.
+            //
+            // Without these, `cpu_us_per_request` is unverifiable: it can only be re-derived from the
+            // request count it was divided by, and that count lived nowhere. Auditing the first
+            // cost-carrying snapshot, I could not tell whether a low utilisation meant the gateway
+            // was cheap or the window had simply carried less load than the sweep's rung at the same
+            // concurrency - two opposite readings of the same number, with nothing in the artifact to
+            // separate them. Every published number must re-derive from what is published beside it.
+            ("cost_window_ok", Measurement::Measured(stats.ok as f64)),
+            ("cost_window_rps", Measurement::Measured(stats.rps())),
             // THE READING THAT SAYS WHETHER THE PEAK IS A CEILING. At ~1.0 the gateway had filled the
             // cores it was given and the throughput number is a wall; well below it, the limit is
             // somewhere else and the peak means something else.

engine/src/record.rs

@@ -427,6 +427,16 @@ pub struct CellPerf {
     pub cost_window_conc: Measurement<i64>,
     /// Threads in the gateway's tree during the cost window. Not a rate: it is the shape of the
     /// concurrency model, thread-per-connection against async, on evidence rather than on a claim.
+    /// Requests the cost window actually completed, and the rate it carried.
+    ///
+    /// PUBLISHED SO THE COST IS CHECKABLE. `cpu_us_per_request` is CPU divided by this count, and
+    /// without it the figure re-derives from nothing. It also separates two opposite readings of a
+    /// low utilisation - a genuinely cheap gateway, or a window that simply carried less load than
+    /// the sweep did at the same concurrency - which are indistinguishable without knowing the load.
+    #[serde(default = "measurement_default")]
+    pub cost_window_ok: Measurement<f64>,
+    #[serde(default = "measurement_default")]
+    pub cost_window_rps: Measurement<f64>,
     /// Utilisation of the cores the gateway was PINNED to, across the cost window. 1.0 = every
     /// pinned core fully busy.
     ///
@@ -870,6 +880,8 @@ mod tests {
             cpu_us_per_request: Measurement::Measured(37.5),
             rps_per_cpu_second: Measurement::Measured(26_666.0),
             cost_window_conc: Measurement::Measured(8),
+            cost_window_ok: Measurement::Measured(2048.0),
+            cost_window_rps: Measurement::Measured(341.0),
             cost_core_utilisation: Measurement::Measured(0.97),
             cost_threads: Measurement::Measured(9.0),
             cost_nonvol_ctxt_per_request: Measurement::Measured(0.25),

engine/src/suite.rs

@@ -210,6 +210,8 @@ fn judge_cost(
     out.cpu_us_per_request = f("cpu_us_per_request");
     out.rps_per_cpu_second = f("rps_per_cpu_second");
     out.cost_window_conc = as_i64(metrics.get("cost_window_conc"));
+    out.cost_window_ok = f("cost_window_ok");
+    out.cost_window_rps = f("cost_window_rps");
     out.cost_core_utilisation = f("cost_core_utilisation");
     out.cost_threads = f("cost_threads");
     out.cost_nonvol_ctxt_per_request = f("cost_nonvol_ctxt_per_request");
@@ -1335,6 +1337,8 @@ fn withhold_refuted_perf(p: CellPerf, why: &str) -> CellPerf {
         cpu_us_per_request: withheld_f(),
         rps_per_cpu_second: withheld_f(),
         cost_window_conc: withheld(),
+        cost_window_ok: withheld_f(),
+        cost_window_rps: withheld_f(),
         cost_core_utilisation: withheld_f(),
         cost_threads: withheld_f(),
         cost_nonvol_ctxt_per_request: withheld_f(),