fix(groups): fit the fragment mass calibration once on the pooled deviations

[RobbinBouwmeester]

A grouped search learned a fragment tolerance 35% too wide, and it cost identifications. Measured on the six-file HYE Astral benchmark, same library and the same retention-time model, 100 isolation-window bands against none:

	unbanded	100 bands
frag_ppm_offset	−1.8486	−1.8834
frag_ppm_sigma	8.452	11.400
calibrant deviations	181,196	200,257
residual MAD	0.907	1.035
candidates accepted	4,986,153	6,609,984
peptides at 1%	113,860	110,006
precursors at 1%	126,436	121,966

Why

seed_pool combined the BANDS' fitted scalars by calibrant count. The tolerance is 1.5 × p95(|dev − median|), which does not average: a 95th percentile over one band's ~2,000 deviations has a heavier tail than the same percentile over the union. Each band also selected its calibrants on its own q, whose 1/T floor is looser than the pooled one, so the bands counted 106,088 confident seed PSMs where the pool counts 97,584.

Causal rather than correlated: one band extracted twice, identical in every input except which calibration file it was handed, accepted 12,414 candidates at 11.400 ppm and 8,791 at 8.452. A control arm, unbanded on the same adapted library, reproduced the unbanded arm's 113,860 peptides exactly, which rules out every other difference between the arms.

What changed

The estimator now exists once, in a new masscal module that both the seed and the pool call. A band's seed writes its calibrant deviations beside its calibration: library-wide candidate_id, scan_index, fragment m/z and the ppm deviation, 16 bytes each. seed_pool reads them, keeps the deviations whose PSM the POOLED q accepts, and fits one offset and one tolerance. A band directory without a sidecar still pools on the scalars, warns, and records which path it took in masscal_source.

One thing the implementation found that the diagnosis missed. The band q is not the pooled q in either direction: on small bands it is far STRICTER, and on the CI fixture every band's own q rejects every target, so a strictly q-selected sidecar was empty in all three bands and the pooled fit got nothing, falling back to the same 20 ppm default the change exists to remove. The sidecar therefore also offers the band's best-scoring targets down to a floor of 2,000 PSMs, and the pooled q decides which of them count. On the fixture that gives 1,068 deviations and a calibration digit-for-digit identical to the ungrouped one for the same spectra. A band's own masscal.json still fits on its own confident targets, so calibration: per_group is untouched.

Equality

An ungrouped run is byte-identical: ci/smoke.sh run from this tree and from a816768, all 223 output files hashed, zero content differences, and no calibrant sidecar is written anywhere in an ungrouped run. A grouped run's calibration deliberately moves, and every artifact downstream of it with it.

Per CLAUDE.md this is a correctness fix, the previous value being wrong on its own terms, not a promoted sensitivity default: it still wants entrapment and a second acquisition before anyone quotes it as a sensitivity result. The banded arm is rerunning on this branch now to measure what comes back.

cargo fmt --check, clippy -D warnings, 319 + 80 tests, cargo build --release --locked, ci/smoke.sh → SMOKE_OK, and the three generator checks all pass.

🤖 Generated with Claude Code