spec: Assay fleet tier — AssayRollup + AssayStandardRollout (cloud-mesh)

[mdheller]

Makes the Assay the fleet verdict framework for prophet-mesh, and marks the boundary between the two deployment modes. Node-tier lives in #198/#278; this is the tier above it.

Contracts

AssayRollup — fleet/cohort aggregate of ReasoningAssay verdicts over a window:

• ok/sad/bad distribution
• calibration-drift view (standardAdoption) — which AssayStandard versions are actually live across the fleet, and whether any is uncalibrated. A fleet can look green while some nodes verify against a stale/uncalibrated standard; this surfaces it.
• unassayedReasons — why the fleet is amber
• scope.mode: node = single-user local self-view; cohort/fleet = cloud-mesh only

AssayStandardRollout — promotes a new AssayStandard version across cohorts: canary → widen/halt on the observed AssayRollup. Rides the existing release-bundle + lifecycle machinery.

Deployment-mode boundary

	Single-user local	Cloud mesh
locus	local/trusted_private	attested_fog/burst_cloud
aggregation	self-view only (optional)	cohort/fleet rollup
rollout	none	canary→widen
dashboards	none — structural	fleet + per-node

"No fleet dashboards for a single user" is structural: on-device the cohort/fleet aggregation path isn't instantiated, so there's nothing to display or leak.

Enforced invariants (all verified biting)

tools/validate_assay_fleet_examples.py:

• distribution sums to totalAssays; unassayedReasons ≤ sad; standardAdoption node counts match scope.nodeCount; driftDetected agrees with the adoption table
• rolloutPct matches promoted/observing node share; guard.decision consistent with phase; no promotion-by-hope (can't widen past canary without an observed rollup)

Passes the repo referential-integrity gate (336 schemas, all $refs resolve). Unique $ids confirmed. New doc: schemas/assay-fleet.README.md.

The loop

A new verifier standard isn't switched on fleet-wide at once — that would silently re-project every node's verdicts against an unproven judge. Canary emits a rollup, guard.decision reads it, rollout widens or rolls back. Same "measured, not asserted" discipline as the node tier, applied to a fleet-wide change.

Next: prophet-mesh implementation (validators + wiring AssayStandard into the pkg_gate locus resolver) + external dashboard in client-vue.