feat(simulation): qualify S0 time and resource gates

docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md

@@ -57,8 +57,10 @@ Polygon is now a parallel product branch. As of this document:
   PX4/Gazebo/ROS 2/Nav2 stack has been installed without using Docker;
 - PX4 v1.17.0 and the stock Ackermann rover have completed repeated factual
   smoke runs with ROS 2 vehicle status, Gazebo clock and clean shutdown;
-- the complete digest-bound S0 evidence manifest has not been admitted;
-- pause/step/speed and accepted 1×/2× resource evidence remain open;
+- the exact accepted-profile generation has passed pause freeze, one 2 ms
+  single-step, 1×/2× speed and structured resource cases;
+- the complete digest-bound S0 evidence manifest and final target doctor
+  verdict are the remaining S0 admission steps;
 - `actuator_authority=false`;
 - `navigation_or_safety_accepted=false`.
 
@@ -369,7 +371,7 @@ incompatible.
 
 ## 14. Upstream baseline
 
-The S0 candidate line is:
+The S0 accepted line is:
 
 - Windows 11 AI worker;
 - dedicated `MissionCore-Sim` WSL2 Ubuntu 24.04 distribution physically on D;
@@ -382,10 +384,11 @@ The S0 candidate line is:
 - Nav2 Jazzy;
 - PX4 Gazebo stock rover models.
 
-The exact source commits and package versions are resolved in the candidate
-profile. Target installation, PX4 build, DDS telemetry and repeated stock-rover
-smoke evidence now exist, but components do not become `accepted` until the
-remaining S0 behavior/resource cases and digest-bound evidence generation pass.
+The exact source commits and package versions are resolved in the profile.
+Target installation, PX4 build, DDS telemetry, Nav2/ROS package discovery and
+repeated 1×/2× stock-rover evidence have moved every component pin to
+`accepted`. A future pin change creates a new profile generation and invalidates
+evidence tied to the prior SHA-256.
 
 S1 uses direct exact `px4_msgs` integration. The experimental
 `px4-ros2-interface-lib` is evaluated later and is not on the S1 critical path.
@@ -415,6 +418,14 @@ effective exposure remains loopback-only. ROS domain 0 is isolated by the same
 boundary. This distinction is part of the port evidence and must not be
 misreported as a host-wide `127.0.0.1` bind.
 
+The stock rover world declares a 2 ms physics step. S0 pause acceptance permits
+zero simulation-time advance; single-step requires exactly +2,000,000 ns and
++1 iteration. Speed factors 1× and 2× are measured over four seconds with a
+±20% RTF tolerance. Resource sampling runs every 500 ms with an owned-process
+budget of 2 GiB RSS and 800% CPU, at least 8 GiB available WSL memory and the
+existing 200 GiB D stop floor. GPU values are recorded as global co-tenant
+context and are not misattributed to headless S0.
+
 ## 16. Delivery plan
 
 | Phase | Estimate | Exit condition |

docs/adr/0015-simulation-polygon-qualification-boundary.md

@@ -90,6 +90,12 @@ providers, observes ROS 2 vehicle status and Gazebo clock, requests PX4 shutdown
 checks for owned-process residue and writes D-only factual artifacts. It never
 arms the vehicle or sends an actuator command.
 
+`simulation/s0/gazebo_time_control.py` owns the S0 pause/single-step/1×/2× RTF
+and resource acceptance probe. `simulation/s0/build_evidence_manifest.py`
+admits only exact-profile, D-confined, passing 1×/2× runs into the digest-bound
+evidence generation. These scripts are qualification tooling; the S1
+Simulation Orchestrator remains the future product lifecycle owner.
+
 The doctor reports `INCOMPLETE` until it is running on the reviewed target with
 resolved/accepted pins and all required evidence. It cannot infer `GO` from the
 repository state.

docs/runbooks/SIM_S0_AI_WORKER.md

@@ -36,7 +36,7 @@ Copy the reviewed script to the D-only worker source root, then invoke it as
 root inside `MissionCore-Sim` with a unique immutable run ID:
 
 ```bash
-simulation/s0/worker-smoke.sh <UTC-run-id>-stock-rover
+simulation/s0/worker-smoke.sh <UTC-run-id>-stock-rover <1|2>
 ```
 
 The script:
@@ -44,11 +44,15 @@ The script:
 - creates a new network namespace containing only loopback;
 - starts Micro XRCE-DDS Agent, PX4 SITL and the stock Gazebo Ackermann world;
 - verifies the DDS session, `/fmu/out/vehicle_status_v1` and Gazebo `/clock`;
-- records listeners and a non-acceptance resource point sample;
+- proves pause freeze and exactly one 2 ms physics step;
+- measures the declared 1× or 2× real-time factor over four seconds;
+- samples owned CPU/RSS, available RAM, swap, D free space and global co-tenant
+  GPU load at 500 ms intervals;
+- records Gazebo service/topic inventory and runtime listeners;
 - sends the PX4 `shutdown` command and rejects owned-process residue.
 
-Do not reuse a run ID. A failed run remains diagnostic evidence; rerun with a
-new ID after correction.
+Run both factors as separate immutable cases. Do not reuse a run ID. A failed
+run remains diagnostic evidence; rerun with a new ID after correction.
 
 ## Required target inventory
 
@@ -119,6 +123,25 @@ The manifest must contain exactly all IDs from `required_evidence`. Artifact
 paths are relative, confined regular files. The doctor rejects missing,
 additional, changed or cross-generation evidence.
 
+Build the redacted manifest only from two passing runs made with the exact
+accepted profile generation:
+
+```bash
+python3 simulation/s0/build_evidence_manifest.py \
+  --profile /mnt/d/NDC_MISSIONCORE/simulation/source/qualification-profile.yaml \
+  --run-1x /mnt/d/NDC_MISSIONCORE/simulation/artifacts/s0/<accepted-1x-run> \
+  --run-2x /mnt/d/NDC_MISSIONCORE/simulation/artifacts/s0/<accepted-2x-run> \
+  --output-dir /mnt/d/NDC_MISSIONCORE/simulation/artifacts/s0/evidence/<generation> \
+  --d-root /mnt/d/NDC_MISSIONCORE \
+  --source-root /mnt/d/NDC_MISSIONCORE/simulation/source \
+  --repository-commit <full-commit-sha> \
+  --wsl-windows-path 'D:\NDC_MISSIONCORE\simulation\wsl\MissionCore-Sim'
+```
+
+The generator refuses an existing output directory, non-passing runs,
+candidate pins, commit drift, incomplete Nav2/ROS discovery or any input/output
+outside the reviewed D root.
+
 Validate without writing:
 
 ```bash