feat: expose governed cohort freshness and aperture coverage on live multistatic sensing

Problem

RuView issue 1726 fixed a real governed multistatic failure by selecting only temporally coherent frames before fusion. That preserves correctness when live nodes publish at different rates, but the live status surface does not yet make the quality cost of cohort pruning explicit.

A cycle can therefore succeed after discarding slow nodes while downstream applications cannot distinguish a full coherent aperture from a reduced one.

Why it matters

Fresh research reinforces two coupled requirements.

SafeStep, arXiv 2608.27688, submitted 2026 08 27, makes Age of Information induced downstream degradation directly observable in a live semantic communication system.

Qualcomm's 2026 08 28 Giga MIMO disclosure emphasizes a prototype with 1024 antenna elements and 256 digital ports and describes ISAC testbeds that reuse communication infrastructure. This is vendor evidence, not an independent benchmark, but it reinforces that sensing quality depends on both temporal coherence and effective aperture.

RuField PR 13 now proposes an additive deterministic freshness assessment API with explicit Fresh, FutureSkew, IncoherentCohort, and StaleEvidence dispositions.

Current architecture

wifi-densepose-sensing-server/src/multistatic_bridge.rs already:

1. filters dead nodes with a 10 second liveness threshold
2. selects one timestamp domain for a cycle
3. uses mesh time only when all active nodes can provide a coherent mesh cohort
4. falls back to host arrival time consistently otherwise
5. retains only frames inside the fuser guard relative to the freshest frame

engine_bridge.rs already records the latest witness, effective privacy class, demotion state, recalibration recommendation, and engine error count.

Observed limitation

Liveness, temporal coherence, and aperture coverage are not exposed as separate governed quality dimensions.

A successful two node cycle and a successful eight node cycle can look equivalent to a downstream consumer even when the expected localization or tracking capability is different.

Proposed improvement

After RuField PR 13 lands, add a live CohortQuality assessment with:

active_nodes

selected_nodes

dropped_for_age

dropped_for_guard

timestamp_domain

oldest_age_us

cohort_span_us

guard_interval_us

aperture_coverage_ratio

freshness_disposition

coherence_valid

Expose the assessment in the existing status endpoint and metrics surface. Do not attach raw amplitudes or phase.

The aperture_coverage_ratio initially measures selected nodes divided by active eligible nodes. It must not be marketed as a physical array quality score until geometry weighted validation exists.

Target package

v2/crates/wifi-densepose-sensing-server

Reuse existing RuField integration. Do not create a new protocol.

Expected measurable improvement

The first release is an observability and gating improvement, not an accuracy claim.

Acceptance targets:

1. 100 percent of governed multistatic cycles report selected and active node counts
2. every cycle reports cohort span and timestamp domain
3. injected future skew or out of guard frames cannot be reported as fresh coherent evidence
4. five deterministic replays produce identical cohort decisions and assessments
5. status and metrics overhead remains below 1 percent CPU and below 1 percent wire size on the existing status response
6. no more than 2 percent p95 governed cycle latency regression

A later field benchmark can correlate aperture coverage and evidence age with localization, counting, and tracking error.

Dependencies

RuField PR 13 or an equivalent stable freshness API.

Existing multistatic fuser, EngineBridge, status endpoint, metrics, and witness path.

Security review

1. Metrics use already accepted frame timing and cannot authenticate a source.
2. Future timestamps must fail closed before any freshness or aperture metric is trusted.
3. Never let a client supplied status query alter cohort state.
4. Bound labels and node counts to prevent metric cardinality exhaustion.
5. Do not expose stable hardware identifiers in network wide metrics when a scoped pseudonym can be used.
6. Cohort quality cannot relax privacy class or re enable suppressed raw outputs.

Privacy

Expose aggregate counts and timing quality, not per node RF payloads. Treat node identity as installation scoped data.

Backward compatibility

Additive status fields and metrics. Existing sensing update wire form remains unchanged in phase 1.

Testing

Unit tests for full aperture, slow node pruning, timestamp domain fallback, future skew, and empty cohort.

Property tests for selected nodes never exceeding active nodes and aperture ratio remaining within zero and one.

Replay tests using the existing mixed width and mixed rate cohort fixtures.

Metrics cardinality tests.

Latency benchmark over at least five repeated fixed replays.

Rollback

Disable the new status and metrics fields. Cohort selection behavior from issue 1726 remains unchanged.

Definition of done

A second engineer can replay a fixed mixed rate node trace, observe the same governed fusion output as current main, and additionally see an auditable freshness and aperture assessment that explains which nodes participated and why others were excluded.