Saturation: a HARD gate on clamp occupancy

core/tests/suite/saturation.rs runs the same walk over the embedded set and fails the build on any clamp() whose occupancy reaches the threshold. It is the one part of the reachability block that is not advisory, and the reason is the one Plan 0048 Phase 7 supplies: for the whole window between ADR-0049 landing and the retune, every automated signal was green and nobody had cause to run a report. An instrument that requires suspicion to fire does not address the failure that there was nothing to be suspicious of.

The threshold is a measured constant (SATURATED_OCCUPANCY), taken from the retuned library’s own distribution rather than reasoned to, and it therefore has a shelf life: re-measure it whenever the library changes materially.

A clamp() that is supposed to pin — a safety rail whose job is to bind at peak — declares itself in the preset:

[occupancy]
exempt = ["fade"]   # this clamp is a rail, not a gain: pinning is the design

An exemption silences the gate, not the diagnostic: the binding still shows up as a SAT line and in the occ count, so it stays visible in review. That is deliberate — an exemption is a place to hide, and the mitigation is that it is explicit, in the file, and still reported.