S2.1 — Deterministic milestone-count termination for PRM construction

Superseded 2026-10-08 by S4.1 — PRM milestone budget (E4, 0.9.0) — same intent, redesigned as an additive max_milestones budget in the senior-engineer grilling. Cancelled, not done.

Intent

PRM construction terminates on wall-clock timeout only. Roadmap density therefore depends on machine speed and load — and in oxmpl-py / oxmpl-js, every validity check crosses the FFI/wasm boundary (~122k calls/s measured on pyo3). This caused a deterministic failure in oxmpl-py/tests/test_prm_so3ss.py and a load-dependent flake in oxmpl-js/tests/test_prm_compound.test.js (both root-caused 2026-09-22 during S1.4 verification).

Interim mitigation already merged with S1.4 (in-test set_longest_valid_segment_fraction(0.25), ~4–5× headroom) — but the wall-clock dependence class is NOT eliminated. A slower CI runner can still starve the budget and fail the release gate.

Acceptance criteria

• PRM construction supports a deterministic termination criterion (e.g. max milestone count / sample budget) in addition to the timeout, which remains the safety cap
• New capability exposed consistently across oxmpl, oxmpl-py, and oxmpl-js APIs
• PRM tests in all three crates converted to deterministic budgets — pass/fail no longer depends on wall-clock or machine load
• just test-all green

Notes

• Same theme as S1.3 (timeout-only termination, rrt.rs TODO) — sequence alongside or after it.
• Risk linkage: protects the S1.5 release gate and all future releases. If the gate flakes again before S1.5 closes, pull this into sprint-001.
• Root-cause evidence recorded in S1.4's completion record.