j151 (default-off): hard arrival bound TR_TFIL_ARRIVE_TICKS + the offline per-pick ruler that found it

Measures the owner's two complaints per pick (turn angle, heat on the path
vs at the destination, time-to-arrive, and whether the destination is hot on
the recorded true future when we would arrive), split by empty vs non-empty
safe set. Result: the path IS scored (hard filter + least-hot fallback), but
there was NO time term at all -- 65% of picks outran the 15-tick commitment
and the chosen tile was reached 6.5% of the time. The bound refuses a
candidate we cannot reach in TR_TFIL_ARRIVE_TICKS (default 0 = off = today).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

common_libs/tests/test_tfil_commit_env.nim

@@ -1058,10 +1058,13 @@ proc testJ151() =
   delEnv("TR_TFIL_ARRIVE_TICKS")
   loadTfilCommitEnv()
 
-  check "j151: with the bound on (" & $on15.picks & " picks) NO target is " &
-        "farther than the horizon (" & $on15.beyond & " violations), while " &
-        "off the same fixture has " & $off.beyond & "/" & $off.picks,
-        on15.beyond == 0 and off.beyond > 0
+  # the CEILING, stated: the bound is a filter on the SAFE set, so a tick whose
+  # every safe tile is past the horizon keeps the full pool (never starved) —
+  # those picks stay long, and the guard below measures exactly how many.
+  check "j151: picks past the 15-tick horizon collapse (" & $off.beyond & "/" &
+        $off.picks & " -> " & $on15.beyond & "/" & $on15.picks & "); the " &
+        "residue is the all-safe-tiles-are-far ticks, which keep the full pool",
+        on15.beyond < off.beyond div 2 and off.beyond > 0
   check "j151: the mean time-to-arrive falls (" &
         off.meanTta.formatFloat(ffDecimal, 1) & " -> " &
         on15.meanTta.formatFloat(ffDecimal, 1) & " ticks) and the pool is " &