PLT-463: schedule_lag gate + run verdict (stacked on #51)

[bdchatham]

Implements PLT-463 (M1.5) — the self-check that proves the open-loop fix is actually open-loop.

⚠️ Stacked on #51 (PLT-459): base is the 459 branch so the diff stays clean. Retarget to main once #51 merges.

What

• schedule_lag = AttemptedSendTime − IntendedSendTime per open-loop tx, recorded into a bounded reservoir (Algorithm R, cap 16384). p99 reported on every run.
• Verdict: VOID if schedule_lag_p99 > threshold × (1/λ) — named const scheduleLagVoidThreshold = 0.10 ('tune from first calibration run'), overridable via config. VALID otherwise; N/A for closed-loop or ramped-λ (p99 still reported). Logged loudly + run-summary fields (ScheduleLagP99, Verdict, VoidReason).
• Prewarm / zero-IntendedSendTime excluded; gated on the real ArrivalModel.

Design forks (flagged for review)

• p99 via bounded reservoir (whole-run representative) vs the tail-trim idiom.
• λ from cfg.Settings.TPS; ramped-λ runs → N/A (not gated).
• threshold as config field, not a CLI flag.

Verify

make lint 0 issues · go build · go test -race ./... green.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes the hot send path (collector lock per tx) and defines pass/fail semantics for benchmark runs; mis-tuned thresholds or wiring bugs could void valid runs or miss generator-bound runs.

Overview
Adds an open-loop self-check that measures whether the load generator kept its own arrival schedule, and labels each run VALID, VOID, or N/A.

Workers record schedule_lag (AttemptedSendTime − IntendedSendTime) when IntendedSendTime is set, into a bounded reservoir sample (Algorithm R) plus exact max and over-bound counters. At shutdown, EvaluateScheduleLag compares p99 to threshold × (1/λ) (default 10%, overridable via scheduleLagVoidThreshold in config) and can also VOID on an unsampled tail fraction (0.5% over bound) when the reservoir p99 would miss late-run degradation. N/A applies for closed-loop, ramped λ, non-fixed TPS, or zero samples; admitted txs with no samples raises an anomaly log.

main arms the VOID bound on fixed-λ open-loop runs, computes the verdict from the actual arrival model, logs it, and extends run summary + OTel gauges (run_schedule_lag_p99, max, over-bound fraction) tagged with verdict.

^{Reviewed by Cursor Bugbot for commit 7caba67. Bugbot is set up for automated code reviews on this repo. Configure here.}