Calibration: make the empty-room baseline save path work on real hardware

[proffesor-for-testing]

Calibration: make the empty-room baseline save path work on real hardware

Three defects found while driving the Mac Catalyst app against three to four ESP32-C6
nodes, 2026-09-14/15. Each is measured on hardware, each has a test, and each test was
mutation-checked — reverting the fix fails it.

Base: 2c0abcc8 (PR #1903 head, which carries the room-identity receipt this builds on).
Touches one file: wifi-densepose-sensing-server/src/main.rs.

---

1. feat(calibration): emit calibrated presence evidence v2 on the sensing stream

The app gates its held-out empty check on calibrated_presence_evidence
(ruview.calibration.calibrated-presence-evidence.v2). No shipped server has ever emitted
it — measured: 156 frames, 0 carrying the key. So the check bailed on iteration one,
bootstrap/promote was never called, and bootstrap_baseline::store — the only path that
persists a calibration — never ran. A 62-minute, 41,138-frame model was lost on restart.

Emit it, bound to the active model receipt. None unless an explicit calibration is fresh
and the field model scores without a heuristic fallback, so a present value is always
calibrated. The scoring history is extracted into scoring_history() and shared with
person_count_at, so published evidence cannot disagree with the server's own count.

Verified live: 604/604 frames carried it after the fix, and correctly 0/429 while the
model was stale.

2. fix(calibration): only the grid-bound radio may write the single-link baseline

Every bound radio was fed into the single-link field model. Averaging several radios'
amplitude offsets into one baseline flattens the eigenstructure.

bound nodes	eigenvalues	threshold	empty room
4	0	18.90	present 1162/1162
1	5	3.65	absent 604/604 (occupied: present 616/616)

person_count_at already called this "deterministic false occupancy from hardware-specific
amplitude offsets" — but only engaged when exactly one node was bound, so it never fired in
the case it described.

Restricts the baseline write, not the admission. Every bound radio still registers as a
contributor, because calibration_source_nodes_missing refuses to finalize until each one
proves it is live. Gating the whole feed path deadlocks the capture — measured: 43,120
frames over 51 minutes stuck in collecting. There is a regression test for that exact
deadlock.

3. fix(calibration): bind the grid the radio keeps emitting, not the sparse minority

accept_grid locks each node onto the densest grid and rejects the ~16% HT 64-bin minority
a C6 emits alongside HE-SU 256-bin. select_calibration_grid ordered by max_gap_s first —
and a sparse metronomic trickle has a smaller gap than a busy stream with one hiccup. So
selection kept binding the grid admission discards.

Measured: bound 64sc on node 11; every node then locked onto 256sc; the bound grid went
stale, frame_count froze at 10,997, and the capture hung in collecting for 858 s with
both minimums met, no error surfaced, and a flickering UI as the client retried. Both
captures that bound 256sc produced a usable model.

Orders by subcarrier count first, then the existing gap/rate/ppdu ordering.

Same defect class as #1919, measured independently on C6.

---

Verification

316 passed, 1 failed — the single failure is calibration_expiry_tests:: long_running_expiry_is_not_reported_active_for_runtime_or_bootstrap, pre-existing on the
2c0abcc8 base and untouched here (it reports none where the test expects expired).
It is unrelated to these changes and worth its own fix.

Each new test was mutation-checked. One of them initially passed against the unfixed
comparator — the test data did not discriminate — and was rewritten until reverting the fix
failed it with left: 64, right: 256.

Verified on hardware (2026-09-15, four ESP32-C6 nodes, empty room)

One capture exercising all three fixes together:

source_node_ids            [11, 12, 13, 14]   four nodes bound
source_grid                256sc, ppdu_type 1 grid fix picked it, active for all 889 s
baseline_eigenvalue_count  7                  every previous 4-node capture gave 0
variance_explained         0.1493             previous: 0.0816 / 0.0966
frame_count                15,169
missing_source_node_ids    []                 throughout -- no deadlock

Evidence stream: 1,415 of 1,468 frames carried
ruview.calibration.calibrated-presence-evidence.v2, and correctly 0 of 429 while the
model was stale.

bootstrap/promote now runs to completion and returns honest counts:

sample_count 12   stale 0   empty 7   vital_signs 1   -> needs empty >= 10, vitals 0

Not claimed

• The baseline is still not stored. bootstrap_baseline::store has never executed. It
  no longer fails because the path is broken -- every gate works and reports truthfully --
  but because the detector does not meet its own quality bar: 7 of 12 samples read empty
  where 10 are required. That is up from 0 of 12 before these fixes.
• The detector is unstable, and these fixes do not address it. The same model in the
  same empty room, sampled two minutes apart with nobody entering: false positives went
  from 107/1385 (7.7%) to 364/1415 (25.7%).
• The seven baseline eigenvalues are unused. inference_method was
  field_model_perturbation_energy_v1 in all 1,415 frames, because estimate_occupancy is
  the #[cfg(not(feature = "eigenvalue"))] stub in the shipped build. All occupancy is one
  scalar against one frozen threshold. Tracked separately -- it needs a decision alongside
  the Windows build, not a flag flip.

🤖 Generated with Ruflo & AQE

[oga35767-eng]

👍