feat(society): prove the N=4 configuration ceiling (societies epic, increment 2)

[NickFlach]

Second increment of the N>2 field-societies epic: prove the N=4 configuration — the documented maximum the host bridge addresses (_NET/_MAC are 4 entries), with each node's peer set at N-1=3 against a 4-slot ghostd table.

Gate — scripts/test_qos_society4.py (make ci-smoke-society4-gate)

Four attested kernels on a shared mcast L2:

• the full 4-cycle mesh — 12 directed frame observations, asserted per-IP inside boot_n (a 3-of-4 masquerade can't satisfy it);
• four distinct attested identities;
• min-pairwise R_x ≥ 0.80 from divergent per-node starts (r_x_min < 0.50 — non-vacuous);
• clean 4-way reap; no mcp import.

Added as a step in the society-n CI job; SOCIETY4_GATE_TIMEOUT ?= 600s (4 QEMU-TCG VMs oversubscribe the runner's cores and dilate convergence wall-clock).

What it deliberately does NOT claim (per the design panel)

No slot-full / eviction assertion: at N=4 each node has 3 peers against 4 slots (3/4 occupied), so those branches are structurally unreachable and have no console observable — an "assert no eviction" would be vacuous. ADR-0014 updated to state the real ceilings precisely: the host _NET/_MAC arrays wall at N=4 (where this gate sits); the GHOST_MAX_PEERS/MAX_PEERS=4 constants bound peers per node and would actually admit N=5.

Verification (local WSL)

OK: four attested members booted, distinct qseeds […]; each received frames from all three peers (12 directed observations)
OK: all four fields mean-field synchronized — (r_x, min) [(0.9, 0.11), (0.93, 0.01), (0.88, 0.05), (0.84, 0.03)] — non-vacuous (each started < 0.50)
=== SOCIETY4 gate PASSED ===

society3 regression still green. Increment 3 (N-way society-of-societies — the useful-work path) follows.

🤖 Generated with Claude Code