Solver latency clean

The check is solver_latency_clean. It is verify-stage. Severity of a slow slice is warning, not fail. The hop reads persisted per-slice durations for realize, consistency, and vacuity. It does not call Z3. It does not call Kind2. Default budget is one minute.

Two skip gates sit in front of the budget. Sibling proof processes at audit start skip the hop: wall-clock under contention is not solver work. Host load average above 1.5 times CPU count skips the hop the same way. A slice whose fingerprint no longer matches the live spec is dropped. A slice measured under concurrency score greater than one is dropped. Raising project.checks.solver_latency_clean.threshold is a policy change, not a split.

The help file teaches the silent slice first. One realize still prints valid. Nothing in the suite asked whether four minutes is the budget you meant to keep.

# proof realize specs/system auth --format json
# status: valid. duration_ms: 252000. component: auth

# proof audit --check solver_latency_clean
# [VERIFICATION] solver_latency_clean
# 1 slow solver-backed component runs over 1m0s
# realize specs/system/auth took 4m12s
# silent slice: last VALID still on a four-minute realize

Pick one resolution, not a stack of them: split the component on a real boundary, tighten the worst formula, or inspect proof realize JSON for where the time went. Do not raise the threshold in proof.yaml and call that a split. A quieter hop with the same four-minute realize is the same cheat.

proof audit --check solver_latency_clean --verbose

The teaching graph is still one auth component whose last VALID sat on a four-minute realize. Close it by splitting the component on a real architectural boundary, or by tightening the formula that searches poorly. Do not delete the verification cache to make the warning disappear. With no persisted durations the hop reports zero slow slices, and the four-minute realize did not go anywhere. It just stopped being counted.

# after the split: realize specs/system/auth-session took 8s
# realize specs/system/auth-tokens took 11s

# proof audit --check solver_latency_clean
# 0 slow solver-backed components over 1m0s. this hop is quiet

A Kind2 run that is still the solver hop stays on Z3/Kind2 on one function. An unconstrained output while Kind2 still prints realisable stays on gaps clean. A SYS-REQ that still says valid while the lemma cache is timeout stays on formalization lemma verdict consistency. Jama still authors. Proof vs Jama.

Warning, not fail. Not blocking. Zero slow slices is a pass. Concurrent proof processes at audit start is a skip, not a pass: the summary says rerun in isolation. Host load average above 1.5 times CPU count is the same skip. A missing pgrep or load sample bypasses the gate; a missing signal must not hide a regression. Stale fingerprints are dropped. Slices with concurrency score greater than one are dropped. Only realize, consistency, and vacuity steps are timed. The hop does not re-run Kind2. It does not re-run Z3. It does not split the component. It does not prove the Go. Raising the threshold to 300 seconds is a policy change, not a remediation. We have not scored this floor against a frozen Jama pack or a ReqIF export. The loss is named, not scored. Adjacent Ads volume on proof complexity is a CS-theory SERP, not this hop.

The solver hop stays on Z3/Kind2 on one function. The engagement stays on software correctness audit. Jama still authors.

What is solver latency? Same question. Same URL.

Is this Z3 or Kind2 on one function? No. That hop runs the solver. This hop asks whether the last VALID crossed the budget after the solver ran. See Z3/Kind2 on one function.

Is this proof complexity? No. That hop is a slice that is too large or too entangled for the size budget. This hop is wall-clock. A small slice can still be slow.

Is this gaps clean? No. That hop is an unconstrained output while Kind2 still printed realisable. This hop is whether the realize or vacuity step that printed it crossed one minute. See gaps clean.

Does a skip under load prove the slices are cheap? No. The hop refused to count contended wall-clock. Rerun in isolation.

Does a green hop prove the code matches the shall? No. The hop observes durations. It does not prove the Go.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.