fix(cgp): six wall-clock assertions, three of them in the REQUIRED check

crates/aprender-cgp/Cargo.toml

@@ -41,6 +41,30 @@ trueno-gpu = { path = "../aprender-gpu", version = "0.67.0", features = ["cuda"]
 [features]
 default = []
 cuda = ["dep:trueno-gpu"]
+# A DURATION ASSERTION IS NOT A CORRECTNESS ASSERTION (#3239, and this repo has
+# paid for it eleven times — see scripts/check_no_timing_in_required.sh, whose
+# registry exists because "policy is what failed the other eleven times").
+#
+# tests/falsify.rs carries two: FALSIFY-CGP-061 (`cgp doctor` < 2 s) and
+# FALSIFY-CGP-060 (`cgp profile compare` < 30 s). Both are real product limits
+# and neither can be asserted on a shared CI box. Measured 2026-09-14 during a
+# full --lib --tests sweep of the workspace:
+#
+#     FALSIFY-CGP-061 FAILED: doctor took 2665ms      (limit 2500, over by 6.6%)
+#
+# The box was running 98,621 tests in parallel. That number measures the LOAD,
+# not `cgp doctor`. Raising the limit is the "clever ratio rewrite" that once
+# blocked all nine open PRs; the fix is to stop asserting duration where
+# duration cannot be measured.
+#
+# check_no_timing_in_required.sh keeps exactly this rule for shell guards, with
+# a declared registry so "adding a timing gate without deciding its placement is
+# impossible". This feature is that registry for Rust targets: nothing enables
+# it, so a timing row cannot reach a required check by accident.
+#
+# Arm it where duration IS measurable -- a dedicated, unloaded runner (perf-solo),
+# at release time. Not in CI's default set, and not in the nightly full surface.
+timing-gate = []
 
 [dev-dependencies]
 proptest = "1.9"

crates/aprender-cgp/src/analysis/diff.rs

@@ -338,10 +338,14 @@ mod tests {
         }
         let elapsed = start.elapsed();
         // 100 diffs should take << 100ms
+        // DURATION ONLY UNDER `timing-gate` (#3239) — see this crate's Cargo.toml.
+        #[cfg(feature = "timing-gate")]
         assert!(
             elapsed.as_millis() < 100,
             "100 diffs took {}ms",
             elapsed.as_millis()
         );
+        #[cfg(not(feature = "timing-gate"))]
+        let _ = elapsed;
     }
 }

crates/aprender-cgp/src/doctor.rs

@@ -400,6 +400,11 @@ mod tests {
         let _ = detect_gpu();
         let _ = check_binary("nonexistent", &[], parse_generic_version);
         let elapsed = start.elapsed();
+        // DURATION ONLY UNDER `timing-gate` (#3239). A shared, saturated runner
+        // cannot measure elapsed time; see this crate's Cargo.toml.
+        #[cfg(feature = "timing-gate")]
         assert!(elapsed.as_secs() < 2, "doctor checks took {:?}", elapsed);
+        #[cfg(not(feature = "timing-gate"))]
+        let _ = elapsed;
     }
 }

crates/aprender-cgp/src/metrics/export.rs

@@ -64,10 +64,14 @@ mod tests {
         let _ = load_json(&path).unwrap();
         let _ = load_json(&path).unwrap();
         let elapsed = start.elapsed();
+        // DURATION ONLY UNDER `timing-gate` (#3239) — see this crate's Cargo.toml.
+        #[cfg(feature = "timing-gate")]
         assert!(
             elapsed.as_millis() < 100,
             "Loading two JSONs took {}ms (should be <100ms)",
             elapsed.as_millis()
         );
+        #[cfg(not(feature = "timing-gate"))]
+        let _ = elapsed;
     }
 }

crates/aprender-cgp/tests/falsify.rs

@@ -447,16 +447,45 @@ fn falsify_cgp_061_doctor_speed_real() {
     let elapsed = start.elapsed();
 
     assert!(output.status.success());
-    // Allow 500ms subprocess overhead on top of the 2s spec limit
+
+    // DURATION ONLY UNDER `timing-gate`. Measured 2026-09-14 on a box running
+    // 98,621 tests in parallel: 2665 ms against this 2500 ms limit -- a 6.6%
+    // miss that says nothing about `cgp doctor` and everything about the load.
+    // See this crate's Cargo.toml for why the feature exists.
+    #[cfg(feature = "timing-gate")]
     assert!(
         elapsed.as_millis() < 2500,
         "FALSIFY-CGP-061 FAILED: doctor took {}ms",
         elapsed.as_millis()
     );
+    #[cfg(not(feature = "timing-gate"))]
+    let _ = elapsed;
 
     let stdout = String::from_utf8_lossy(&output.stdout);
-    // Verify it detected the GPU
-    assert!(stdout.contains("RTX 4090") || stdout.contains("GPU"));
+    // THE STATUS MUST BE DECIDED -- not that this box has a 4090.
+    // `contains("RTX 4090") || contains("GPU")` asserts the RUNNER's hardware,
+    // the class fixed in #3210 across four sibling rows. It passes here only
+    // because this box happens to have one. What CGP-061 actually owes is that
+    // `doctor` reached a verdict about the device and printed it.
+    assert!(
+        !stdout.trim().is_empty(),
+        "FALSIFY-CGP-061 FAILED: doctor printed nothing -- no verdict at all"
+    );
+    let decided = [
+        "GPU",
+        "CUDA",
+        "device",
+        "Device",
+        "no GPU",
+        "not available",
+        "unavailable",
+    ]
+    .iter()
+    .any(|k| stdout.contains(k));
+    assert!(
+        decided,
+        "FALSIFY-CGP-061 FAILED: doctor reached no decision about the device.\nstdout: {stdout}"
+    );
 }
 
 // ══════════════════════════════════════════════════════════════════════
@@ -545,12 +574,18 @@ fn falsify_cgp_060_profile_speed() {
     let elapsed = start.elapsed();
 
     assert!(output.status.success());
-    // 30s spec limit + 500ms subprocess overhead
+
+    // DURATION ONLY UNDER `timing-gate`, for the same reason as CGP-061 above.
+    // 30 s is a real product limit and a shared runner cannot measure it; this
+    // row has simply not been unlucky yet, which is not the same as correct.
+    #[cfg(feature = "timing-gate")]
     assert!(
         elapsed.as_secs() < 31,
         "FALSIFY-CGP-060 FAILED: profile took {}s (limit: 30s)",
         elapsed.as_secs()
     );
+    #[cfg(not(feature = "timing-gate"))]
+    let _ = elapsed;
 }
 
 // ══════════════════════════════════════════════════════════════════════

crates/aprender-cgp/tests/integration.rs

@@ -33,11 +33,15 @@ fn test_doctor_completes() {
     assert!(stdout.contains("cgp System Check"), "Missing header");
     assert!(stdout.contains("CPU"), "Missing CPU detection");
     // Doctor should complete in <2s (FALSIFY-CGP-061), allow 30s for compilation
+    // DURATION ONLY UNDER `timing-gate` (#3239) — see this crate's Cargo.toml.
+    #[cfg(feature = "timing-gate")]
     assert!(
         elapsed.as_secs() < 30,
         "cgp doctor took too long: {:?}",
         elapsed
     );
+    #[cfg(not(feature = "timing-gate"))]
+    let _ = elapsed;
 }
 
 /// cgp roofline --target cuda must show RTX 4090 data.