# Cost-model rail on deployed silicon — 2026-09-27

## Result and scope

Company-authored physical-board engineering evidence: the provisional
NEORV32 admission table (`PROVISIONAL_NEORV32_RTL_V1`, dated 2026-08-27,
its capability entries measured on harness stubs) was tested on the
deployed board with three phases in one volatile-SRAM image: the unchanged
2026-08-27 per-class characterization suite on hardware UART; deployed-
callee cost measurement (a propose through the real monitor, with and
without the per-propose outward line); and admission composition —
representative classes run under the table as the admission model with a
nominal 65,536-credit budget, stopped by credit exhaustion.

**Ordinary instructions hold.** Measured per-step costs (jump 341,
ALU 311–322, loads 300–334, stores 297–325, taken branches 298–308 cycles)
run 0.2–3.6% faster than the retained RTL simulation, and admission
utilization is 71.5–79.4% of charged credits — the table's 1.25×
engineering margin is intact on silicon for every non-call class. The
softcore behaves like its RTL model.

**The capability entries do not.** A propose through the real monitor
costs 13,621 cycles per call (13,940 with the per-propose outward line)
against the 464-credit stub charge, so a call-composed tick overruns its
credited budget by **14.76×**: 65,536 credits actually consumed 967,243
cycles ≈ 80.6 ms at 12 MHz against the intended ≈ 5.5 ms. This quantifies,
on the metal, the caveat the costs module carries in prose — capability
entries were measured on harness stubs and production admission must
replace them with bounded deployed-callee measurements. On the deployed
2026-09-26 fixture path the overshoot is bounded by the mediator's own
cycle-deadline check and the 100 ms lease, not by the VM admission table.

## What this establishes — and does not

It establishes where the admission model holds on deployed silicon (every
ordinary class, with margin) and by how much it does not (the call
entries, ~15× for the deployed propose). It does not establish WCET, does
not measure the seal callee (an `endstop-sign`-linked measurement is the
named next step), and covers one board, one place-and-route seed, one
build. The phase-B sense callee measured ~2× its charge in this harness
(callee-struct and measurement-context effects), noted separately from the
deployed-work propose measurement. Arm-free synthetic holds; no actuator,
product I/O or configuration flash was used.

## Reproducibility

The completed internal record is
`evidence/runs/2026-09-27-ecp5-j4-001/manifest.json`, with the full board
transcript, the bitstream and firmware with SHA-256, the build log, the
fixture source hash, and the phase tables. The comparison baseline is the
retained RTL characterization
`evidence/simulation/2026-08-27-neorv32-rtl-fuel-costs-02/`.