Phase 40: port the research loop's CV discipline + ship in-fleet pooling

CV protocols move out of /tmp into batteryswap_example/cv.py, with the
champion config itself promoted from /tmp/all48.py into cv.CHAMPION:

all48 full-fleet walk-forward, three-regime scorecard
static the deployment gate - one foreign-fleet fit, no refits, 11s a
seed, ORDERING questions only (this construction manufactures a
sum(p42) undercount; phase 26 believed it and public went
1661 -> 2189)
screen offline model screen grouped by BATTERY, never by scenario/row

models_cv.rank_stats now runs inside walk_forward, so dev/panel/test also
report rec12/rec20, operating-point recall+precision, the count actually
bought, and the median rank of missed deaths beside the cost. Base
reproduces 1661.7 / 2379.7 / 1679.2 / 604.8 byte-exact - the additions are
diagnostic only.

What the new metrics show: the panel's missed deaths sit at median rank 57,
45 ranks past the cut. That is the closed appetite axis as a measurement
rather than an argument. screen shows scenario grouping inflates rf's
margin over logistic 8x on recall@12 (+0.023 -> +0.194); the effective n is
80 batteries with a death, not 1130 positive rows.

Three feature variants measured on both instruments, all rejected:
vrel +138.7, vcorr +32.7, zone +104.9 on all48. vcorr's +32.7 reproduces
the phase-34 +32.8 to within 0.1. vrel is the discipline working - it won
the static gate by the widest margin of the three (-24.6, W143/L66, 4 of 5
seeds) and won it entirely through the count (116 fewer swaps, 3 more
deaths, rec12/rec20 flat), which is the one reading that protocol is
documented as invalid for.

Latent deployment bug fixed: cost_curves and plan_tsroute hardcoded the
evaluator's unobserved_eol_days as 30.0 while the evaluator reads it
per-scenario - and submit.py imports plan_tsroute, so the hardcode shipped.
All 48 train scenarios use 30.0, which is exactly why no local protocol
could catch it: same shape as the hardcoded 42-day park that
repark_for_window exists to undo.

Also ships in-fleet pooling for held-out splits (HELDOUT_POOL, default on):
the target split's own closed-window pairs are pooled with the foreign 82
and refit on a cadence. Rehearsed end-to-end on the 2x held-out fixture -
79560 rows in 287s, pooling active on both splits at 164 own deaths vs 82
foreign, no budget degradation, no fallback. Degrades to the static foreign
fit (the prior champion) on any overrun, never to the pickle.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

EXPERIMENTS.md

@@ -35,6 +35,13 @@ All numbers are mean `total_cost` per scenario from the official `evaluate_plan`
   spent the test block. Per-phase "dev"/"test" columns below refer to these.
 - **Reference points** (test block): shipped example 6779 · defer-everything 2512
   · lowest-voltage-15 heuristic 2034 · oracle (true EOL) 186.
+- **Protocols live in `batteryswap_example/cv.py`** (phase 40), not in `/tmp`:
+  `all48` (full-fleet walk-forward, three-regime scorecard), `static` (the
+  deployment gate - one foreign-fleet fit, no refits, ORDERING questions only),
+  `screen` (offline model screen grouped by BATTERY, never by scenario or row).
+  All three report ranking precision at the operating N beside the cost: cost
+  alone cannot distinguish a change that reordered the list from one that only
+  cut it deeper, and AUC 0.947 has already coexisted with recall 0.000.
 
 ## Phase 0 - understanding the problem
 
@@ -1796,3 +1803,224 @@ negatives when it has 800+; the effect does not attenuate with data, it
 separates the two. dq_g20 is intrinsically a cold-start mechanism and cannot be
 made always-on - which, given static_uniq=82, means it cannot be made to matter
 in deployment at all.
+
+## Phase 38 - the label process reverse-engineered (2026-08-21)
+
+User question ("the voltage continues past the EOL line - if the battery fails
+we should not have voltage anymore") exposed a documented error and, chasing
+it, the exact rule that generates `eol_times.csv`.
+
+### Correction: post-EOL telemetry is the SAME battery, not a replacement
+
+Phase 16 recorded: "All 82 dead slots keep reporting past EOL (mean 107d, max
+305d): **replacement batteries** under the same device_id", marked
+human-verified. The durations are right (measured: median 85 d, mean 105, max
+305). **The interpretation is wrong.** Median voltage tracked against
+days-since-EOL over all 82:
+
+| window | -90..-61 | -60..-31 | -30..-8 | -7..0 | +1..14 | +15..30 | +31..60 | +91..300 |
+|---|---|---|---|---|---|---|---|---|
+| median V | 2.562 | 2.510 | 2.454 | **2.398** | 2.379 | 2.363 | 2.352 | 2.295 |
+
+Smooth through the line, no discontinuity, and only **3 of 78** devices ever
+reach fresh-battery level (>2.9 V) afterwards. Phase 16's own named example
+`d_57e99ff00802` reports to 2026-05-13 as claimed and never exceeds 2.559 V.
+
+Genuine swaps DO exist and are unmistakable - 34 censored devices jump to
+>=2.95 V and hold (caveat 1 verified, ~30 claimed). They just never occur at
+recorded EOLs. **Consequence**: a feature window spanning a recorded EOL does
+not mix two batteries; segmenting history at recorded EOLs is unnecessary. The
+only genuine two-battery contamination is those 34 censored resets.
+
+### The rule: gated 10-30 C, threshold 2.40 V, sustained crossing
+
+`smooth_series`'s 10-30 C band is the ORGANISERS' default
+(batteryswap_public/utils.py:42) but is never called by the evaluator - we
+reimplemented it and inherited the constants. Never swept until now. Which
+(band, threshold) best reproduces the recorded EOL dates:
+
+| band | median lag at 2.40 | coverage |
+|---|---|---|
+| 0-50 | 6.0 d | 100% |
+| 5-35 | 6.0 d | 100% |
+| 8-32 | 4.0 d | 100% |
+| **10-30** | **3.0 d** | **100%** |
+| 12-28 | 3.0 d | 98% |
+| 15-25 | 5.5 d | 88% |
+
+2.42 is far worse everywhere (10-23 d); 2.38 loses coverage. **(10-30, 2.40)
+is the unique pair with 100% coverage at minimum lag.** The gate and the
+threshold are one definition, not two choices that happen to agree - a voltage
+reading is meaningless without a temperature. Independently, 10-30 is also the
+tightest band retaining all 82 deaths (12-28 drops to 77, 15-25 to 70) and
+peaks voltage AUC at 0.9604.
+
+**EOL marks the SUSTAINED crossing.** Median lag 3 d (IQR 3-6), but 12 of 81
+devices lag >21 d, max 163. Those are not measurement gaps: during the lag they
+have a median of 23 gated readings and **83% go back above 2.40** (mean 57% of
+readings above). They wobble. The lag is NOT predictable from origin-time
+features: RF leave-out Spearman **+0.006** (p=0.95), R2 -0.193, and flagging
+the tail hits base rate exactly. Volatility runs the wrong way (vstd_30 rho
+-0.194). Characterisation, not a lever.
+
+**No calendar structure**: EOL day-of-week is flat (weekend share 26% vs 29%
+chance), so no human/administrative recording process; month is confounded with
+fleet aging by window exposure; 68 distinct dates for 82 deaths is random
+collision. Calendar features rejected as a memorisation trap - fleet-history
+facts cannot transfer to splits at other dates.
+
+**Consequence for relabelling (user-asked): do not.** The evaluator scores
+against `eol_times.csv` verbatim, the label is tight (100% within 7 d of a
+sub-2.40 gated reading, median 0), and the nearest relabelling - adding the ~26
+ghost deaths - was measured harmful at six thresholds in phase 37. Residual
+error is entirely trajectory-forecast error with no label-process component,
+which retro-explains phase 17's label-arrival-hazard rejection: arrival is
+near-deterministic, so there was no hazard to model.
+
+Artifacts: `notebooks/all_batteries.ipynb` (all 461 devices, categorised
+DEAD-SILENT 18 / DEAD-VISIBLE 64 / RESET 34 / GHOST 17 / ADMIN-GONE 67 /
+HEALTHY 261), `notebooks/silent_deaths.ipynb`.
+
+## Phase 39 - four hypotheses closed, four measurement laws (2026-08-21)
+
+Five parallel sessions. Every line closed negative; the durable output is the
+laws.
+
+| hypothesis | verdict |
+|---|---|
+| install-batch death clock | CLOSED on 3 implementations. The famous "AUC 0.91 on silent pairs" rests on **4 positives** (phase 10 already knew: all-covered 0.584, dark bucket 0.426-0.410 - worse than chance). Coverage was never the blocker: 83-95% monthly at late origins. Gated rank-only form measured **+97.9 harm**. |
+| `temp_mean` (30 d, pre-filter) | Mechanism replicates (deaths 18.67 C vs survivors 20.18) but **absorbed**: -1.1pp recall@12 on production. Fifth temperature rejection; the beta correction already occupies the channel. Gains +6.4pp on a champion with no temperature handling. |
+| battery-type clustering | Types are real (13x risk spread surviving level-removal) but miss rate is FLAT across types. Cannot buy recall. |
+| dv42 voltage-drop regression | CLOSED on 4 implementations. **Out-of-time R2 is negative everywhere** (-0.117 / -0.029 / -0.172): the drop cannot be forecast. The score was a differently-parameterised linear classifier anchored on voltage - ties the incumbent at N=12. Censoring-aware variant exactly inert (3% of rows); quantile variant worst on a full panel. Phase 10's wall from the other side. |
+
+### The four measurement laws
+
+All the same shape: **pick the denominator that matches the question.**
+
+1. **Report recall at the operating N, not AUC.** With ~400 negatives/origin,
+   AUC 0.93-0.95 says nothing about a rule taking 12. Silent deaths measured
+   AUC 0.947 ("p42's strongest region") and recall@12 **0.000 of 24**, median
+   rank 60. Same fact, one currency.
+2. **A candidate must beat the incumbent ranker ON ORDERING before any
+   architecture can make blending it safe.** "Gated + rank-only" excludes
+   calibration and count damage but NOT ordering damage: reordering a good list
+   with a chance-level signal costs in proportion to the weight (+97.9 at
+   w=0.05). No safe non-zero weight exists for a ~0.5-AUC feature.
+3. **Condition on the outcome, not row shares.** Any partition (building,
+   cohort, type, room) looks significant against row shares because missed
+   deaths concentrate where deaths are. chi2 13.00 -> 2.67 on conditioning.
+4. **Always report the test panel.** Requiring a recent in-band reading on test
+   rows deleted 18% of deaths and swung v_now recall@12 from **0.800 to 0.382**
+   - larger than every modelling effect measured that day, and it reversed the
+   ranking of every arm. A recency filter deletes the silent population by
+   construction.
+
+### Caution on the blind-harness champion lineage
+
+Two sessions independently found raw current voltage BEATS their champion's own
+ranker at the operating N (.721 vs .668; .703 vs .672). On production the
+reverse holds (.572 vs .429, +14.3pp). That lineage was ablated on COST under a
+threshold rule where every feature change moves depth as well as order, so a
+4-feature set losing to `last_voltage` on ordering is more likely over-pruned
+than optimal. **Do not port anything from it without re-running the ablation on
+recall at fixed N.**
+
+## Phase 40 - the research loop's CV discipline, ported into this repo
+
+Every prior phase re-derived its harness in `/tmp` and lost it. The three
+measurement disciplines the blind loop paid leaderboard points to learn are now
+repo-resident in `batteryswap_example/cv.py`, with the champion config itself
+promoted out of `/tmp/all48.py` into `cv.CHAMPION`.
+
+    venv/bin/python -m batteryswap_example.cv all48  [base|vcorr|zone|vrel]
+    venv/bin/python -m batteryswap_example.cv static [variant] [n_seeds]
+    venv/bin/python -m batteryswap_example.cv screen
+
+**1. Ranking precision at the operating N, reported beside the cost.**
+`models_cv.rank_stats` now runs inside `walk_forward`, so `dev`/`panel`/`test`
+and the new protocols all emit rec12, rec20, operating-point recall/precision,
+the count actually bought, and the median rank of missed deaths.
+`summarize()` prints them, pooling caught/deaths over origins rather than
+averaging per-origin ratios (a 1-death origin must not outvote a 12-death one).
+
+Base reproduces **1661.7 / 2379.7 / 1679.2 / 604.8** exactly, so the additions
+are diagnostic only. What they show that eight phases of cost-only reporting
+could not:
+
+| block | n | total | rec12 | rec20 | recall | prec | sched | median miss rank |
+|---|---|---|---|---|---|---|---|---|
+| warmup s_0-7 | 8 | 2379.7 | 0.526 | 0.735 | 0.763 | 0.570 | 19.8 | 30.5 |
+| panel s_8-41 | 34 | 1679.2 | 0.572 | 0.675 | 0.571 | 0.458 | 11.3 | **57.0** |
+| nearend s_42-47 | 6 | 604.8 | 0.837 | 0.935 | 0.893 | 0.250 | 16.7 | 50.8 |
+| ALL-48 | 48 | 1661.7 | 0.597 | 0.718 | 0.641 | 0.453 | 13.4 | 49.2 |
+
+**The panel's missed deaths sit at median rank 57**, 45 ranks past the cut. That
+is the closed appetite axis stated as a measurement rather than as an argument:
+no value of N reaches rank 57, which is why +395 swaps on the real fleet caught
+zero. It also localises the warm-up floor - rec12 0.526 there but recall 0.763,
+i.e. the floor buys catches with depth (19.8 swaps), not with order.
+
+**2. `screen`: leave-BATTERY-out vs leave-SCENARIO-out, side by side.**
+66503 closed pairs, 461 batteries, 1130 positive rows from **80 batteries**.
+The effective n is 80, not 1130.
+
+| model | battery AUC | battery rec12 | scenario AUC | scenario rec12 |
+|---|---|---|---|---|
+| logistic | 0.9669 | 0.541 | 0.9716 | 0.639 |
+| logbag | 0.9669 | 0.535 | 0.9718 | 0.641 |
+| rf | 0.9745 | 0.564 | **0.9946** | **0.832** |
+| gbm | 0.9749 | 0.540 | 0.9921 | 0.786 |
+
+Scenario grouping inflates rf's margin over logistic from +0.008 to +0.023 AUC
+and from +0.023 to +0.194 rec12 - an 8x exaggeration of the tree advantage,
+because holding out a scenario leaves the same batteries in train and test.
+Levels are not comparable across columns (a battery fold ranks ~92 devices, a
+scenario fold ~430); the margin within a column is. Selection reads the battery
+column. This is the offline-screen counterpart of what all-48 already knew: the
+harness rejected `rankavg` (+55.3) after cross-fleet CV had confirmed it at
+-18.4, p=0.0002.
+
+**3. `static`: the deployment gate, made measurable.**
+Fit ONE model on half the buildings' fully-closed pairs, plan every origin of
+the other half with it - no refits, no accumulating own history, cold-start
+floor off (82 foreign deaths keeps gate 20 permanently shut in deployment).
+That is submit.py's held-out branch. 11 s a seed, so variants are screened
+across 5 building splits, not one.
+
+Its levels are NOT comparable to all48 (half the fleet, half the deaths, and
+the count rule scales with the fleet) and its appetite readings are known-bad -
+this construction manufactured the sum(p42) undercount that phase 20 refuted
+and phase 26 believed (public 1661 -> 2189). **Ordering only, variant vs
+variant.** Both facts are enforced in the printout.
+
+### What the two instruments said about three feature variants
+
+| variant | static gate (5 seeds, paired) | mechanism on the gate | all48 | verdict |
+|---|---|---|---|---|
+| `vrel` (+vrel, vmin7_rank) | **-24.6** +/- 9.3, W143/L66 | caught 460 -> 463, **sched 1176 -> 1060**, rec12/rec20 flat | **+138.7** | reject |
+| `vcorr` (+v_corr_last, thresh_dist) | -24.8 +/- 13.5, W115/L98 | caught 460 -> **478**, sched 1176 -> 1191, rec20 +0.007 | **+32.7** | reject |
+| `zone` (+z_days, z_in, z_rate) | +12.3, prec 0.391 -> 0.349 | sched 4.9 -> 5.6 | +104.9 (phase 34) | reject |
+
+Champion unchanged. Two things are worth keeping from the exercise.
+
+`vcorr`'s +32.7 reproduces the phase-34 measurement of +32.8 to within 0.1 - a
+third independent confirmation that the all-48 harness is deterministic and
+sound.
+
+`vrel` is the discipline working. It won the gate by the widest margin of the
+three (W143/L66, 4 of 5 seeds) and it won it **entirely through the count**:
+116 fewer swaps for 3 more deaths, with rec12 and rec20 flat to three decimals.
+The gate's own docstring says a count reading from this protocol is invalid,
+and the native path then charged +138.7 for it. Had the gate been read the way
+phase 26 read its ancestor, this would have shipped.
+
+### Latent deployment bug fixed: `unobserved_eol_days`
+
+`cost_curves` and `plan_tsroute` hardcoded the evaluator's imputed-EOL offset
+as `+ 30.0` while the evaluator reads `settings.unobserved_eol_days`
+per-scenario - and submit.py imports `plan_tsroute` from this module, so the
+hardcode shipped. All 48 train scenarios use 30.0, which is precisely why no
+local protocol could ever catch it: the same shape as the hardcoded 42-day park
+that `repark_for_window` exists to undo. Now a module global that
+`plan_tsroute` overwrites from the settings it is handed; verified to
+propagate (30 -> 90) and to leave all-48 byte-identical at 1661.7.

batteryswap_example/cv.py

@@ -0,0 +1,347 @@
+"""Repo-resident CV protocols (ported from the blind research loop, 2026-08-21).
+
+This replaces the ad-hoc `/tmp/all48*.py` scripts that every prior phase had to
+re-derive, and folds in the three measurement disciplines the blind loop paid
+real leaderboard points to learn.
+
+**1. Report ranking precision at the operating N, not AUC.**
+   A model can hold AUC 0.947 and recall 0.000 on the subgroup that drives the
+   late cost (the voltage-silent deaths: median rank 60 of ~450). Mean cost
+   hides whether a change reordered the list or just cut it deeper. Every
+   protocol here prints rec12/rec20, the operating-point precision, and the
+   median rank of missed deaths beside the cost. Implemented in
+   `models_cv.rank_stats`, so `dev`/`panel`/`test` get it too.
+
+**2. Group by BATTERY, not by scenario or row.**
+   Each battery contributes one near-duplicate row per closed origin (~3600
+   rows from ~460 batteries), so holding out a SCENARIO leaves the same
+   batteries in train and test and tree models score their own memorised
+   signatures. Measured in the blind loop: leave-scenario-out put HGB ahead of
+   linear (AUC .9907 vs .9843); leave-battery-out REVERSED it (.9769 vs .9845)
+   and the cost harness agreed with the clean split. The effective sample size
+   is ~460, not ~3600. `screen` runs both groupings side by side so the gap
+   stays visible.
+
+**3. The deployment gate: would this fire in the static branch?**
+   The scored splits are fleets the model has never seen; on them `submit.py`
+   fits ONE model on the foreign train pool and never refits - no per-origin
+   refit, no accumulating own history, no cold start (the pool always holds 82
+   deaths, so every `train_deaths < 20` gate is permanently shut). The walk-
+   forward harness does the opposite. A mechanism can be worth tens of points
+   at `all48` and exactly zero where it is scored; that has already happened
+   once (a validated -49.8 warm-up mechanism, structurally unreachable in
+   deployment). `static` runs the deployment protocol locally on a foreign
+   half-fleet so the gate is measurable instead of argued.
+
+   Validity boundary, learned twice the hard way: the half-fleet construction
+   manufactures a sum(p42) undercount that does NOT exist on the real held-out
+   fleet (phase 20 refuted a foreign floor with it; phase 26 adopted
+   ALPHA_STATIC=1.5 from it and public went 1661 -> 2189). Use `static` for
+   ORDERING questions only. Never read an appetite/count decision off it.
+
+Usage
+    venv/bin/python -m batteryswap_example.cv all48  [variant]
+    venv/bin/python -m batteryswap_example.cv static [variant]
+    venv/bin/python -m batteryswap_example.cv screen
+"""
+import sys
+import time
+from pathlib import Path
+
+import numpy as np
+import pandas as pd
+
+from batteryswap_public.evaluate import evaluate_plan
+
+from batteryswap_example import models_cv as mc
+
+WINDOW_DAYS = int(mc.WINDOW_DAYS)
+# pinned at import: variants build off this, never off the possibly
+# already-mutated mc.FEATURES (a second seed used to append twice)
+BASE_FEATURES = list(mc.FEATURES)
+
+# The deployed champion, in the repo instead of in a /tmp script.
+# Mirrors submit.py's rolling branch: logbag / tsroute alpha 0.8 + break-even
+# top-up (ec_margin 0.8, ec_pmax 25) + 7d building split + censor-aware
+# pricing + the gated cold-start floor (k=2.5, gate 20).
+CHAMPION = dict(model='logbag', planner='tsroute', p_star=0.8, day_q=0.05,
+                ec_margin=0.8, ec_pmax=25.0, split_days=7,
+                floor=2.5, floor_gate=20, floor_zone=1)
+
+BLOCKS = (('warmup  s_0-7', lambda o: o <= 7),
+          ('panel   s_8-41', lambda o: (o >= 8) & (o <= 41)),
+          ('nearend s_42-47', lambda o: o >= 42),
+          ('ALL-48', lambda o: o >= 0))
+
+
+def load_table(dataset_path=Path('dataset')):
+    """The one table build. Every protocol starts here so a variant can never
+    silently differ from the champion by a feature-prep line."""
+    t = mc.load_features(dataset_path)
+    t['v_proj'] = t['v_last'] + t['slope_lastk'] * t['staleness']
+    # within-origin fleet ranks: leak-free (data <= origin only)
+    t['r_vlast'] = t.groupby('origin_idx')['v_last'].rank(pct=True)
+    t['r_tau'] = t.groupby('origin_idx')['tau_projected'].rank(pct=True)
+    return t
+
+
+def scorecard(df, label):
+    """Three-regime scorecard with ranking precision beside the cost."""
+    print(f'\n=== {label} ===')
+    hdr = (f"{'block':16s} {'n':>3s} {'total':>8s} {'late':>7s} {'early':>6s} "
+           f"{'rec12':>6s} {'rec20':>6s} {'recall':>6s} {'prec':>5s} "
+           f"{'sched':>5s} {'miss':>5s}")
+    print(hdr)
+    for name, sel in BLOCKS:
+        d = df[sel(df['origin'])]
+        if d.empty:
+            continue
+        deaths, caught = d['n_deaths'].sum(), d['caught'].sum()
+        sched = d['n_sched'].sum()
+        print(f"{name:16s} {len(d):3d} {d['total_cost'].mean():8.1f} "
+              f"{d['late_swap'].mean():7.1f} {d['early_swap'].mean():6.1f} "
+              f"{d['rec12'].mean():6.3f} {d['rec20'].mean():6.3f} "
+              f"{caught / max(deaths, 1):6.3f} {caught / max(sched, 1):5.3f} "
+              f"{d['n_sched'].mean():5.1f} "
+              f"{d['miss_rank'].median():5.1f}")
+
+
+# --------------------------------------------------------------------------
+# protocol 1: full-fleet walk-forward, s_0..s_47
+# --------------------------------------------------------------------------
+
+def run_all48(variant='base', origins=range(48), dataset_path=Path('dataset')):
+    t = load_table(dataset_path)
+    mc.FEATURES = list(VARIANTS[variant](t))
+    ctx = mc.load_context(dataset_path)
+    df = mc.walk_forward(t, ctx, origins, [dict(CHAMPION)])
+    df['variant'] = variant
+    return df
+
+
+# --------------------------------------------------------------------------
+# protocol 2: the deployment gate - one static fit on a foreign fleet
+# --------------------------------------------------------------------------
+
+def fleet_halves(locations, seed=0):
+    """Split the 24 buildings into two disjoint fleets.
+
+    Split by BUILDING, not by device: rooms and buildings share install
+    batches and thermal environment, so a device-level split leaves the
+    target fleet's own siblings in the training pool and the fit is no longer
+    foreign in the way deployment's is.
+    """
+    b = np.sort(locations['building'].unique())
+    rng = np.random.RandomState(seed)
+    perm = rng.permutation(len(b))
+    a = set(b[perm[:len(b) // 2]])
+    return a, set(b[perm[len(b) // 2:]])
+
+
+def run_static(variant='base', seed=0, origins=range(48),
+               dataset_path=Path('dataset')):
+    """Deployment protocol: fit once on fleet A's fully-closed pairs, then plan
+    every one of fleet B's origins with that single model. No refits, no
+    accumulating own history, no cold-start gate - exactly submit.py's
+    held-out branch."""
+    t = load_table(dataset_path)
+    mc.FEATURES = list(VARIANTS[variant](t))
+    locations, timeseries, eol_times, scenarios = mc.load_dataset(
+        dataset_path / 'train')
+    fleet_a, fleet_b = fleet_halves(locations, seed)
+    dev_bldg = locations.drop_duplicates('battery').set_index('battery')['building']
+    t['bldg'] = t['device_id'].map(dev_bldg)
+
+    # the foreign pool: every fleet-A pair whose 42d window has closed by the
+    # end of the data. Deployment's pool is likewise fully adjudicated at
+    # build time and independent of the target origin.
+    closed = t['origin'] <= t['origin'].max() - pd.Timedelta(days=WINDOW_DAYS)
+    foreign = t[closed & t['bldg'].isin(fleet_a)]
+    model = mc.SklearnRUL(CHAMPION['model']).fit(foreign)
+    uniq = int(foreign.loc[foreign['dies42'] == 1, 'device_id'].nunique())
+    print(f'static foreign fit: {len(foreign)} pairs, {uniq} unique deaths, '
+          f'{len(fleet_a)} buildings | target fleet {len(fleet_b)} buildings',
+          file=sys.stderr)
+
+    p = mc.plan_tsroute
+    p.alpha, p.p_be, p.floor_day, p.p_conf = CHAMPION['p_star'], 0.0, 0, 0.5
+    p.ec_margin, p.ec_pmax = CHAMPION['ec_margin'], CHAMPION['ec_pmax']
+    p.split_days = CHAMPION['split_days']
+    # the cold-start floor is permanently shut in deployment (82 foreign
+    # deaths >= gate 20). Leaving it live here would measure a mechanism the
+    # scored path can never reach.
+    p.floor_scale, p.recent_deaths = 0.0, 0.0
+
+    recs = []
+    for idx, (scenario, locs, cut, eol) in enumerate(mc.iterate_scenarios(
+            locations, timeseries, eol_times, scenarios)):
+        if idx not in origins:
+            continue
+        T = pd.Timestamp(scenario['start_time'])
+        locs_b = locs[locs['building'].isin(fleet_b)]
+        rows = (t[t['origin_idx'] == idx].set_index('device_id')
+                .reindex(locs_b['battery']).dropna(subset=['v_last']))
+        if rows.empty:
+            continue
+        locs_b = locs_b[locs_b['battery'].isin(rows.index)]
+        # the evaluator prices unobserved EOLs off `locations`, so the eol
+        # series has to be cut to the target fleet too
+        eol_b = eol.reindex(locs_b['battery'])
+        pred = model.predict(rows)
+        plan = mc.plan_tsroute(pred, None, locs_b, T, CHAMPION['day_q'],
+                               travel_costs=scenario['travel_costs'],
+                               settings=scenario['settings'])
+        _, _, overall = evaluate_plan(plan, locs_b, scenario['travel_costs'],
+                                      scenario['settings'], eol_times=eol_b,
+                                      start_time=T, verbose=0)
+        rs = mc.rank_stats(pred, plan, eol_b, T)
+        recs.append(dict(overall, **rs, origin=idx, variant=variant, seed=seed))
+        print(f"s_{idx}: total {overall['total_cost']:7.1f} "
+              f"late {overall['late_swap']:6.1f} deaths {rs.get('n_deaths', 0):2d} "
+              f"caught {rs.get('caught', 0):2d}/{rs.get('n_sched', 0):2d} "
+              f"rec12 {rs.get('rec12', float('nan')):.2f}", flush=True,
+              file=sys.stderr)
+    return pd.DataFrame(recs)
+
+
+# --------------------------------------------------------------------------
+# protocol 3: offline model screen, grouped by battery
+# --------------------------------------------------------------------------
+
+def screen(kinds=('logistic', 'logbag', 'rf', 'gbm'), n_folds=5, seed=0,
+           dataset_path=Path('dataset')):
+    """Leave-BATTERY-out vs leave-SCENARIO-out on the same pairs and the same
+    models. The gap between the two columns is the contamination; trust the
+    battery column. Headline is recall at the operating N, AUC secondary."""
+    from sklearn.metrics import roc_auc_score
+
+    t = load_table(dataset_path)
+    mc.FEATURES = list(BASE_FEATURES)
+    closed = t[t['origin'] <= t['origin'].max() - pd.Timedelta(days=WINDOW_DAYS)]
+    devs = np.sort(closed['device_id'].unique())
+    rng = np.random.RandomState(seed)
+    dev_fold = pd.Series(rng.permutation(len(devs)) % n_folds, index=devs)
+    org = np.sort(closed['origin_idx'].unique())
+    org_fold = pd.Series(np.arange(len(org)) % n_folds, index=org)
+
+    n_dev_pos = closed.loc[closed['dies42'] == 1, 'device_id'].nunique()
+    print(f'pairs {len(closed)}  batteries {len(devs)}  origins {len(org)}  '
+          f'positives {int(closed["dies42"].sum())} rows / {n_dev_pos} batteries')
+    print('effective n is the BATTERY count, not the row count - regularisation '
+          'tuned against rows is ~8x too weak here.\n')
+
+    schemes = {'battery': closed['device_id'].map(dev_fold),
+               'scenario': closed['origin_idx'].map(org_fold)}
+    out = {}
+    for scheme, fold in schemes.items():
+        for kind in kinds:
+            aucs, r12, r20 = [], [], []
+            for f in range(n_folds):
+                tr, te = closed[fold != f], closed[fold == f]
+                if te['dies42'].sum() < 3:
+                    continue
+                m = mc.SklearnRUL(kind).fit(tr)
+                p = m.predict(te)['p42']
+                aucs.append(roc_auc_score(te['dies42'], p))
+                # recall at the operating depth, per origin, scaled to the
+                # held-out fleet's size (12/461 of the fleet)
+                for oi, g in te.groupby('origin_idx'):
+                    y = g['dies42'].values
+                    if y.sum() == 0:
+                        continue
+                    n = max(1, int(round(12 * len(g) / 461)))
+                    order = np.argsort(-p.loc[g.index].values)
+                    r12.append(y[order[:n]].sum() / y.sum())
+                    r20.append(y[order[:max(1, int(round(20 * len(g) / 461)))]].sum()
+                               / y.sum())
+            out[(scheme, kind)] = (np.mean(aucs), np.mean(r12), np.mean(r20))
+
+    # LEVELS ARE NOT COMPARABLE ACROSS COLUMNS. A battery fold holds ~1/5 of
+    # the fleet at every origin (recall at depth 12/461 means top-2 of ~92);
+    # a scenario fold holds the whole fleet at 1/5 of the origins (top-11 of
+    # ~430). Same depth fraction, very different discreteness. What IS
+    # comparable is each model's margin over the linear reference WITHIN a
+    # column - that margin is the thing a model-selection decision reads.
+    ref = kinds[0]
+    print(f"{'model':10s} " + ' '.join(f'{s + " " + m:>16s}' for s in schemes
+                                       for m in ('AUC', 'rec12')))
+    for kind in kinds:
+        cells = []
+        for s in schemes:
+            a, r, _ = out[(s, kind)]
+            cells += [f'{a:16.4f}', f'{r:16.3f}']
+        print(f'{kind:10s} ' + ' '.join(cells))
+    print(f'\nmargin over {ref} (the decision-relevant quantity):')
+    for kind in kinds[1:]:
+        cells = []
+        for s in schemes:
+            a, r, _ = out[(s, kind)]
+            a0, r0, _ = out[(s, ref)]
+            cells += [f'{a - a0:+16.4f}', f'{r - r0:+16.3f}']
+        print(f'{kind:10s} ' + ' '.join(cells))
+    print('\nA model whose margin shrinks or reverses when the grouping goes '
+          'from scenario to battery was reading memorised battery identity. '
+          'Selection follows the battery column.')
+    return out
+
+
+# --------------------------------------------------------------------------
+
+def _base(t):
+    return BASE_FEATURES
+
+
+def _zone(t):
+    dbz = t['days_below_245']
+    t['z_days'] = dbz.fillna(-1.0)
+    t['z_in'] = (dbz >= 0).astype(float)
+    t['z_rate'] = np.where(dbz >= 0, (2.45 - t['v_corr_last']) / np.clip(dbz, 1, None), 0.0)
+    return BASE_FEATURES + ['z_days', 'z_in', 'z_rate']
+
+
+def _vcorr(t):
+    return BASE_FEATURES + ['v_corr_last', 'thresh_dist']
+
+
+def _vrel(t):
+    # phase-38 fleet-relative features: a held-out fleet's absolute voltage
+    # scale is not the train fleet's, but its within-fleet ordering is
+    return BASE_FEATURES + [c for c in ('vrel', 'vmin7_rank')
+                            if c in t.columns]
+
+
+VARIANTS = {'base': _base, 'zone': _zone, 'vcorr': _vcorr, 'vrel': _vrel}
+
+
+def main():
+    proto = sys.argv[1] if len(sys.argv) > 1 else 'all48'
+    variant = sys.argv[2] if len(sys.argv) > 2 else 'base'
+    t0 = time.time()
+    if proto == 'all48':
+        df = run_all48(variant)
+        df.to_csv(f'/tmp/cv_all48_{variant}.csv', index=False)
+        scorecard(df, f'all48 / {variant} / full-fleet walk-forward')
+    elif proto == 'static':
+        # one building split is one draw; a variant comparison needs several.
+        # 11s a seed, so there is no excuse for reading a single one.
+        seeds = range(int(sys.argv[3]) if len(sys.argv) > 3 else 5)
+        df = pd.concat([run_static(variant, seed=s) for s in seeds],
+                       ignore_index=True)
+        df.to_csv(f'/tmp/cv_static_{variant}.csv', index=False)
+        for s in seeds:
+            scorecard(df[df['seed'] == s], f'static / {variant} / seed {s}')
+        scorecard(df, f'static / {variant} / DEPLOYMENT GATE, {len(seeds)} '
+                      f'building splits pooled')
+        print('Levels are NOT comparable to all48 (half the fleet, half the '
+              'deaths, and the count rule scales with the fleet). Read this '
+              'protocol only as variant-vs-variant, ORDERING only - never for '
+              'an appetite/count decision (see module docstring).')
+    elif proto == 'screen':
+        screen()
+    else:
+        raise SystemExit(f'unknown protocol {proto}')
+    print(f'\n[{time.time() - t0:.0f}s]')
+
+
+if __name__ == '__main__':
+    main()

batteryswap_example/data/train_features.parquet

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:8ca530c2fee4c2e6457ee7a984286fcf2f21f4f8b058c033b653d6a67dd7392b
-size 5216659
+oid sha256:4d7e31ddec4d82eec9e062848ed0c019811068947a3bd6ccf7e42d6f7d8e7376
+size 6159081

batteryswap_example/features.py

@@ -112,6 +112,31 @@ def features_at_origin(daily: pd.DataFrame, devices: pd.DataFrame,
 
     feats['accel'] = feats['slope_30'] - feats['slope_90']
 
+    # ---- fleet-relative encoding -------------------------------------------
+    # Ported from the blind-harness champion, where vrel and vmin7_rank were
+    # the two largest single-feature wins. Both are computed at PLAN time over
+    # the fleet actually in front of the planner, so they absorb a fleet-level
+    # voltage shift that the absolute features (v_last, v_min_30, ...) cannot.
+    # The motivation is TRANSFER to a held-out fleet: on the native fleet there
+    # is no shift to absorb, which is why the one prior local test called them
+    # "redundant with aux features" (EXPERIMENTS.md, in-origin fleet ranks,
+    # 2055). That verdict cannot see the deployment regime.
+    #
+    # Deliberately NOT filled here. The classifier pipeline median-imputes and
+    # then scales, which parks a stale/dark device at "unremarkable" so it is
+    # never selected; three independent measurements found that making those
+    # devices visible instead is a monotone loss. Do not add fillna() or
+    # na_option= to the rank.
+    #
+    # Population note: the denominator is whatever has history at or before the
+    # origin, dead-but-not-yet-dropped devices included. That is identical in
+    # the training-table build and in the runtime path, which is what matters -
+    # both sides see the same population definition.
+    h7 = h[h['day'] > origin - pd.Timedelta(days=7)]
+    feats['v_min_7'] = h7.groupby('device_id')['v'].min()
+    feats['vrel'] = feats['v_last'] - feats['v_last'].median()
+    feats['vmin7_rank'] = feats['v_min_7'].rank(pct=True)
+
     install = devices.set_index('battery')['start_time'].dt.tz_localize(None)
     eff_install = install.reindex(feats.index)
     if swaps is not None and len(swaps):

batteryswap_example/models_cv.py

@@ -23,7 +23,6 @@ Planners turn (p42, day_q) into a plan:
 """
 
 from pathlib import Path
-import itertools
 import os
 import sys
 import warnings
@@ -47,6 +46,14 @@ FEATURES = ['v_last', 'v_drop', 'slope_30', 'slope_90', 'v_min_30',
             'staleness', 'age_days',
             'slope_lastk', 'drop_recent', 'below_frac', 'accel', 'n_30',
             'tau_projected']
+# NOT in FEATURES, deliberately: 'vrel', 'vmin7_rank'. features.py computes
+# both (and v_min_7), and the training table carries them, so enabling them is
+# a one-line change here. Held back from the pooling submission so that
+# submission isolates ONE change and stays attributable - phase 28 stacked four
+# and needed two further phases to untangle the damage. Evidence as of
+# 2026-08-21 is also unsettled: vrel survived a leave-one-out ablation on the
+# blind harness, vmin7_rank was ablated OUT (-12.8), and a static-fit gate
+# showed the whole feature-set swap swinging +55 to -109 depending on fit pool.
 # vstd_30/rng_30 (plunge-precursor volatility, AUC 0.83/0.81 on the silent
 # cohort) rejected as GLOBAL features: dev +17, test -0.7 - the signal is
 # diluted across the healthy majority. Used instead by the SilentFix override.
@@ -1077,6 +1084,15 @@ EARLY, LATE = 0.5, 10.0
 # decisions at near-data-end origins and loses there - the underprice acts as
 # a regularizer against over-including marginal survivors. Keep 45.
 EMERGENCY_DAY = WINDOW_DAYS + 3
+# The evaluator prices a swap on a device with no observed EOL against
+# (location end_time + settings.unobserved_eol_days). That setting is
+# per-scenario and READ FROM THE SCENARIO at runtime; it was hardcoded to the
+# default 30.0 in two places here, and submit.py imports plan_tsroute from
+# this module, so the hardcode shipped. Every train scenario happens to use
+# 30.0, which is exactly why local CV could never catch it - same failure
+# shape as the hardcoded 42-day park that repark_for_window exists to undo.
+# plan_tsroute now overwrites this from the settings it is handed.
+UNOBSERVED_EOL_DAYS = 30.0
 CENSOR_AWARE = True     # price unobservable (post-data-end) deaths via imputation
 PARK_MOBILITY = 0.0     # extra cost per expected emergency (travel/overtime)
 
@@ -1166,7 +1182,7 @@ def cost_curves(pred, locations, start_time, blend=0.0):
     # precede the window, and the evaluator then charges a swap as LATE at
     # 10/day - the old clip(lower=43) made exactly those devices look free
     e_far = ((end.reindex(pred.index) - start_time).dt.total_seconds() / 86400
-             + 30.0).values
+             + UNOBSERVED_EOL_DAYS).values
 
     # censoring-aware: deaths after the split's data end are never in the
     # shipped eol_times, so the evaluator cannot charge late/emergency for
@@ -1418,6 +1434,9 @@ def plan_tsroute(pred, included, locations, start_time, day_q,
            floor_day - defers uncertain insurance swaps that would otherwise
            pay early-replacement for weeks [floor_day 0 = off]
     """
+    if settings is not None:
+        global UNOBSERVED_EOL_DAYS
+        UNOBSERVED_EOL_DAYS = float(settings.unobserved_eol_days)
     psum = pred['p42_sum'].iloc[0] if 'p42_sum' in pred else pred['p42'].sum()
     if plan_tsroute.floor_scale > 0:
         # cold-start inclusion floor: sum(p42) tracks prevalence only once the
@@ -1448,7 +1467,7 @@ def plan_tsroute(pred, included, locations, start_time, day_q,
         # counterfactual cheap-price CV shows -76 where wrong costs ~19.
         end = locations.set_index('battery')['end_time'].dt.tz_localize(None)
         e_far = ((end.reindex(pred.index) - start_time).dt.total_seconds() / 86400
-                 + 30.0).values
+                 + UNOBSERVED_EOL_DAYS).values
         # top-up only fresh devices (imputed EOL beyond the window): for stale
         # ones the survivor branch is a bookkeeping fiction - swapping "on the
         # imputed day" scores ~0 but buys nothing and costs real mobility
@@ -1799,7 +1818,8 @@ def walk_forward(table, scenario_ctx, origins, configs):
             _, _, overall = evaluate_plan(
                 plan, ctx['locs'], ctx['travel_costs'], ctx['settings'],
                 eol_times=ctx['eol'], start_time=origin_time, verbose=0)
-            records.append(dict(overall, origin=idx, **cfg))
+            rs = rank_stats(pred, plan, ctx['eol'], origin_time)
+            records.append(dict(overall, **rs, origin=idx, **cfg))
 
         auc = {m: roc_auc_score(rows['dies42'], p['p42'])
                for m, p in preds.items() if rows['dies42'].sum() > 0}
@@ -1808,6 +1828,49 @@ def walk_forward(table, scenario_ctx, origins, configs):
     return pd.DataFrame(records)
 
 
+RANK_NS = (12, 20)
+
+
+def rank_stats(pred, plan, eol, start_time, order_col=None):
+    """Ranking precision at the operating point, per origin.
+
+    Measurement law #1 from the research loop: mean cost and AUC both hide
+    whether a change moved the ORDER or just the depth of the cut. A model
+    can hold AUC 0.947 and still have recall 0.000 on the subgroup that
+    actually drives late cost. So every protocol here reports, alongside the
+    cost:
+
+      rec12/rec20  ordering only - share of the window's deaths inside the
+                   top 12/20 of the score, independent of how many the
+                   planner chose to swap;
+      n_sched      what the planner actually bought (in-window swaps);
+      caught/prec  the operating point: deaths among those swaps, and the
+                   share of swaps that were real deaths;
+      miss_rank    median rank of the deaths that were missed - the number
+                   that says whether a miss was near the cut or invisible.
+    """
+    order = pred[order_col] if order_col and order_col in pred.columns else (
+        pred['rank_score'] if 'rank_score' in pred.columns else pred['p42'])
+    order = order.sort_values(ascending=False)
+    window_end = start_time + pd.Timedelta(days=WINDOW_DAYS)
+    e = eol.reindex(order.index)
+    deaths = set(e.index[(e > start_time) & (e <= window_end)])
+    out = {'n_deaths': len(deaths)}
+    if not deaths:
+        return out
+    ranks = {b: r for r, b in enumerate(order.index, start=1)}
+    dr = sorted(ranks[b] for b in deaths if b in ranks)
+    for n in RANK_NS:
+        out[f'rec{n}'] = sum(1 for r in dr if r <= n) / len(dr)
+    missed = [r for r in dr if r > max(RANK_NS)]
+    out['miss_rank'] = float(np.median(missed)) if missed else np.nan
+    sched = set(plan.loc[plan['day'] <= window_end, 'battery'])
+    out['n_sched'] = len(sched)
+    out['caught'] = len(sched & deaths)
+    out['prec'] = out['caught'] / len(sched) if sched else np.nan
+    out['recall'] = out['caught'] / len(deaths)
+    return out
+
 def load_context(dataset_path):
     locations, timeseries, eol_times, scenarios = load_dataset(dataset_path / 'train')
     ctx = {}
@@ -1845,6 +1908,19 @@ def summarize(df, label):
         if ops:
             dec['ops'] = df.groupby('name')[ops].mean().sum(axis=1)
         print(dec.round(1).reindex(mean.index).to_string())
+    # ranking precision at the operating N (measurement law #1): cost alone
+    # cannot say whether a change reordered the list or just cut it deeper
+    rk = [c for c in ('rec12', 'rec20', 'recall', 'prec', 'n_sched',
+                      'miss_rank', 'n_deaths') if c in df.columns]
+    if rk:
+        g = df.groupby('name')
+        r = g[rk].mean()
+        # pool over origins rather than averaging per-origin ratios: a
+        # 1-death origin must not outvote a 12-death one
+        if {'caught', 'n_deaths', 'n_sched'} <= set(df.columns):
+            r['recall'] = g['caught'].sum() / g['n_deaths'].sum()
+            r['prec'] = g['caught'].sum() / g['n_sched'].sum()
+        print(r.round(3).reindex(mean.index).to_string())
     return mean
 
 

batteryswap_example/submit.py

@@ -1,10 +1,14 @@
 """
 Adaptive submission generator.
 
-Held-out splits (fleet not in the packaged train table): ONE model fitted on
-the full foreign train pool per split (phase 24) - per-origin refits with the
-target's own masked history were a statistical tie in the holdout harness and
-only added runtime/fallback risk.
+Held-out splits (fleet not in the packaged train table): the foreign train pool
+POOLED with the split's own closed-window pairs, refit on a cadence as the pool
+grows. Phase 24b had switched the own-history half off after the half-fleet
+holdout called static-vs-rolling a tie - the instrument later retired, and its
+small target fleet distorts exactly this comparison. Degrades to the plain
+static foreign fit (the prior champion) if the build or the refits run long;
+never to the pickle, which is far below it. Set BATTERYSWAP_HELDOUT_POOL=0 to
+restore the pure static behaviour.
 
 Train-fleet splits: refit at every scenario origin on the split's own
 self-masked history, identical to the walk-forward procedure validated
@@ -43,6 +47,49 @@ from batteryswap_example import models_cv
 
 TRAIN_TABLE = Path(__file__).parent / 'data' / 'train_features.parquet'
 GRID_STEP_DAYS = 4
+# Held-out in-fleet pooling. The static branch (phase 24b) fits ONE model on
+# the 82 foreign train deaths and discards the target split's own history
+# entirely. But that split ships its own eol_times.csv, and every death with
+# eol <= T - and every training pair whose 42d window CLOSED before T - was
+# observable at planning time (iterate_scenarios reads the same file for the
+# same reason). On a ~2x fleet those in-fleet pairs outnumber the foreign 82
+# by the late origins, and they are the only signal that can correct a
+# fleet-level shift the foreign fit never saw.
+#
+# Phase 24b measured static-vs-rolling as a tie and switched this off - on the
+# half-fleet holdout, the instrument later retired precisely because its small
+# target fleet distorts exactly this comparison.
+#
+# NOT LOCALLY MEASURABLE: the panel and all-48 run the ROLLING branch (the
+# train fleet is its own fleet), so the static branch never executes locally
+# and this change is byte-identical on every local metric by construction.
+# It is gated on the phase-27 plumbing rehearsal instead, and on the fail-safe
+# below - never on a local score, because there cannot be one.
+#
+# Runtime is the reason it was affordable to skip: build_split_table at the
+# native 4-day grid was ~17 min for 461 devices, so ~35 for a 2x fleet, twice
+# over, against a 30-minute hard limit. HELDOUT_GRID_STEP_DAYS coarsens the
+# grid for this path only; the pairs it drops are pairs we do not have at all
+# today. If the build overruns HELDOUT_BUILD_BUDGET_S we degrade to the plain
+# static foreign fit - i.e. to the CURRENT CHAMPION - and never to the pickle
+# fallback, which is far below it. Set HELDOUT_POOL=0 to disable.
+HELDOUT_POOL = os.environ.get('BATTERYSWAP_HELDOUT_POOL', '1') != '0'
+HELDOUT_GRID_STEP_DAYS = int(os.environ.get('BATTERYSWAP_HELDOUT_GRID', '16'))
+HELDOUT_BUILD_BUDGET_S = float(os.environ.get('BATTERYSWAP_HELDOUT_BUDGET_S', '360'))
+# Refit cadence. The rehearsal showed the table build is cheap (7s at grid 16d
+# on 461 devices) and the PER-ORIGIN REFITS dominate (~4.5s each x 48). At a
+# ~2x held-out fleet that is ~8 min/split, ~16 for both, against a 20-min
+# budget - too close for comfort when the real fleet size is unobservable from
+# here. Reusing one fit across REFIT_EVERY consecutive origins halves the cost
+# for almost no information: consecutive origins are days apart and the pool
+# grows by a handful of closed pairs between them. 1 = refit at every origin.
+# MEASURED (Docker, 2x fleet of 922 devices/split, both splits): at every-2
+# origins a split costs ~10 min and the pair lands at 20m11s - over budget, and
+# the guard correctly degraded private from s_31 onward, which silently throws
+# away the pooling benefit on a third of that split. Refits are ~23 s each at
+# this fleet size and dominate everything (table build is 22 s). Every-4 halves
+# them again: ~5.5 min/split, ~11 min for the pair, comfortably inside 20.
+HELDOUT_REFIT_EVERY = int(os.environ.get('BATTERYSWAP_HELDOUT_REFIT_EVERY', '4'))
 MODEL_KIND = 'logbag'
 # Inclusion appetite, tuned by local CV: alpha sweep 0.7-1.3 on dev has a clear
 # minimum at 0.8 (beats every alternative on 11-12 of 16 origins), confirmed on
@@ -108,13 +155,21 @@ CLIFF_MIN_N = 20
 
 
 def build_split_table(locations, eol_times, scen_starts, daily, dall, betas,
-                      log=print):
-    """(device, origin) training pairs from this split's own history."""
+                      log=print, step_days=GRID_STEP_DAYS, deadline=None):
+    """(device, origin) training pairs from this split's own history.
+
+    deadline: wall-clock epoch after which the build aborts with TimeoutError.
+    The held-out path passes one so an overrun degrades to the static foreign
+    fit (the current champion) instead of eating the whole split's budget.
+    """
     t0 = dall['day'].min() + pd.Timedelta(days=120)
-    grid = pd.date_range(t0, max(scen_starts), freq=f'{GRID_STEP_DAYS}D')
+    grid = pd.date_range(t0, max(scen_starts), freq=f'{step_days}D')
 
     rows = []
     for origin in grid:
+        if deadline is not None and time.time() > deadline:
+            raise TimeoutError(
+                f'split-table build exceeded budget at {len(rows)}/{len(grid)} origins')
         alive = eol_times.isna() | (eol_times > origin)
         f = features_at_origin(daily, locations, origin).reindex(eol_times.index[alive])
 
@@ -206,6 +261,7 @@ def adaptive_split_plans(split, split_path, log=print, deadline=None):
                  if base is not None else 1.0)
 
     static_model, static_uniq, cliff_counts = None, 0, None
+    pool = None
     if base is not None and own_fleet < 0.5:
         # PHASE 24 (static fit): on a held-out split, per-origin refits with
         # the target's own masked history are a statistical tie against ONE
@@ -220,6 +276,31 @@ def adaptive_split_plans(split, split_path, log=print, deadline=None):
         log(f'  static foreign fit: {len(foreign)} pairs, {static_uniq} unique '
             f'deaths (own-fleet frac {own_fleet:.2f})')
         cliff_counts = cliff_day_counts(timeseries) if CLIFF_SCALE != 1.0 else None
+
+        # In-fleet pooling for the held-out path. Same label discipline as the
+        # rolling branch: own pairs enter only where the 42d window closed
+        # before T (asserted below), foreign pairs are a different fleet whose
+        # labels were all known when this submission was built. static_model
+        # stays live as the degradation target.
+        if HELDOUT_POOL:
+            t_build = time.time()
+            try:
+                own = build_split_table(
+                    locations, eol_times, scen_starts, daily, dall, betas,
+                    log=log, step_days=HELDOUT_GRID_STEP_DAYS,
+                    deadline=t_build + HELDOUT_BUILD_BUDGET_S)
+                own['foreign'] = False
+                f2 = foreign[np.intersect1d(foreign.columns, own.columns)].copy()
+                f2['foreign'] = True
+                pool = pd.concat([own, f2], ignore_index=True)
+                own_uniq = int(own.loc[own['dies42'] == 1, 'device_id'].nunique())
+                log(f'  in-fleet pooling ON: +{len(own)} own pairs, {own_uniq} '
+                    f'own deaths vs {static_uniq} foreign '
+                    f'({time.time()-t_build:.0f}s, grid {HELDOUT_GRID_STEP_DAYS}d)')
+            except Exception as e:
+                # degrade to the CURRENT CHAMPION, never to the pickle
+                log(f'  WARNING in-fleet pooling skipped ({e}); '
+                    f'staying on the static foreign fit')
     else:
         # target split IS (mostly) the train fleet: keep the rolling
         # walk-forward path - its own labels are the answer key and must stay
@@ -241,8 +322,8 @@ def adaptive_split_plans(split, split_path, log=print, deadline=None):
 
     plans = []
     fitted = {}
-    for scenario, locs, cut, eol in iterate_scenarios(
-            locations, timeseries, eol_times, scenarios):
+    for si, (scenario, locs, cut, eol) in enumerate(iterate_scenarios(
+            locations, timeseries, eol_times, scenarios)):
         T = pd.Timestamp(scenario['start_time'])
 
         if deadline is not None and time.time() > deadline:
@@ -263,22 +344,42 @@ def adaptive_split_plans(split, split_path, log=print, deadline=None):
             log(f'  WARNING {scenario["name"]}: planning_window_days='
                 f'{stg.planning_window_days} != {WINDOW_DAYS}')
 
-        if static_model is not None:
+        # Mid-loop degradation: if the per-origin refits are eating the split
+        # budget, drop to the static foreign fit for the REMAINING origins
+        # rather than letting the loop-level deadline raise, which lands in the
+        # pickle fallback - far below the static champion.
+        if (pool is not None and static_model is not None and deadline is not None
+                and time.time() > deadline - 4 * 60):
+            log(f'  {scenario["name"]}: refit budget low - degrading to the '
+                f'static foreign fit for the remaining origins')
+            pool = None
+
+        if pool is None:
+            # no in-fleet pairs (pooling off, build overran, or budget low)
             model, train_uniq = static_model, static_uniq
-        elif T not in fitted:
-            # LABEL INTEGRITY: own pairs only where the window closed before T
-            # (the split's eol_times is its answer key). Foreign train-fleet
-            # pairs are used in full: masking them was CV hygiene misapplied
-            # to deployment, starving early origins to 3-20 unique training
-            # deaths out of the 82 available (the cold-start mechanism).
-            closed = pool['origin'] <= T - pd.Timedelta(days=WINDOW_DAYS)
-            train = pool[closed | pool['foreign']]
-            own_pairs = train[~train['foreign']]
-            assert (own_pairs['origin'] + pd.Timedelta(days=WINDOW_DAYS) <= T).all()
-            uniq = int(train.loc[train['dies42'] == 1, 'device_id'].nunique())
-            fitted[T] = (SklearnRUL(MODEL_KIND).fit(train), uniq)
-        if static_model is None:
-            model, train_uniq = fitted[T]
+        else:
+            # Cadence applies to the HELD-OUT path only (static_model set).
+            # The train path keeps its per-T key so the all-48 checksum is
+            # untouched. Reusing a bucket's fit at a later origin only ever
+            # uses FEWER closed pairs than were available - conservative, never
+            # a leak.
+            fkey = (si // HELDOUT_REFIT_EVERY) if static_model is not None else T
+            if fkey not in fitted:
+                # LABEL INTEGRITY: own pairs only where the window closed
+                # before T (the split's eol_times is its answer key). Foreign
+                # train-fleet pairs are used in full: masking them was CV
+                # hygiene misapplied to deployment, starving early origins to
+                # 3-20 unique training deaths out of the 82 available (the
+                # cold-start mechanism). This is the assertion that keeps the
+                # held-out path honest now that it reads the split's own
+                # eol_times: every own label used was observable at T.
+                closed = pool['origin'] <= T - pd.Timedelta(days=WINDOW_DAYS)
+                train = pool[closed | pool['foreign']]
+                own_pairs = train[~train['foreign']]
+                assert (own_pairs['origin'] + pd.Timedelta(days=WINDOW_DAYS) <= T).all()
+                uniq = int(train.loc[train['dies42'] == 1, 'device_id'].nunique())
+                fitted[fkey] = (SklearnRUL(MODEL_KIND).fit(train), uniq)
+            model, train_uniq = fitted[fkey]
 
         feats = features_at_origin(daily, locs, T)
         past = betas[betas['week_end'] <= T]['beta']