Confirm solver picks at interval precision instead of flat spread

[plancherb1]

Problem

The fresh-input solver gate added in #38 fails any selected plan whose 9-round max/min spread exceeds the 5% margin and aborts regeneration with "recapture on a quieter GPU". Two independent idle-box captures on the RTX 5090 (one with the desktop compositor's GPU client alive, one with it killed) reproduce the same failing cells with matching medians (±1%) and matching spreads:

• f32 potrf N=4 nvidia_thread/t64: spread 8.60% vs 8.66%, median 0.1689 vs 0.1707 ns — while winning its cell by ~15%; even its slowest raw round beats the fastest native round by more than the margin.
• f32 trsv N=128 warp/w2: spread 5.09% vs 5.31% — a 2.6% choice between two native tiers, exactly the noise the SIMT tie band exists to absorb.
• AGX Orin f32 posv N=96 nvidia/tb256: spread 6.01% while winning by 2.0x.

The spread is a property of those plans, not of the environment, so the flat gate can reject every capture the machine will ever produce — it aborted Capture B on two consecutive nights.

Change

require_stable_solver_picks becomes confirm_solver_picks: stability is judged on the decision, not the spread.

• A selected NVIDIA plan is kept only when its slowest raw round still clears every native plan's fastest raw round by the margin (guaranteed win). An ambiguous vendor pick is demoted to the capture's native winner — the documented asymmetric preference for dependency-free code, applied at interval rather than median precision — and recorded in the emitted table comment.
• A selected native plan never fails: the dependency margin and ±2% SIMT tie band absorb noise in that direction by design; it is reported as a note.
• Missing solver cells still fail closed.

Docs (TUNING.md, tuning.rst) updated to match.

Validation

• 13/13 CPU-only contract tests (test_tuning_tools.py reworked: demotion, guaranteed-win survival, noisy-native-is-not-fatal; test_tune_isolation.py unchanged).
• Offline dry-run regen against the real 2026-09-02 RTX capture pair now succeeds: 12 (dtype,op) groups, 1104 plans, 0 demotions, the two marginal trsv cells reported as notes.

Receipt

Test sources changed, so the receipt verify job stays red until a fresh signed all-shard receipt is attested. The GPU is inside a protected final-capture timing window today; I will re-attest on this branch as soon as it frees, before merge.

🤖 Generated with Claude Code