FLOW-003 v2.1: fleet hardware + tiered testing, Parts II–III review (R2-1..R2-14), Props 19–20, pv contracts (docs only)

[noahgift]

Docs-only. This is FLOW-003 v2.1: the operator-approved v2.0 (Part II fleet hardware, Part III tiered testing), plus the v1.1 fixes it left for this session, plus a review of Parts II and III. Refs #4514 (PMAT-4514).

Applied from the v1.1 review (Part I)

R-3 (Q1–Q3 [U]), R-4 (Thm 8 citations and $\underline E_{ff}$), R-5 (§6 rows fully parameterised), R-6 (QM-04 moves to EV 0 as QM-00's oracle), R-7 (Q5), R-8 (Thm 2 scope), R-9 (Cor. 4 scope; QM-06 records C, F, φ), R-10 (§7 retries basis = Prop. 10 at B=1, φ* = 0.0512), R-11 (ρ_rel / ρ_MQ), R-12 (q′ and λ′ measurement; q_eff, lambda_eff_per_h in §10).

Review of Parts II–III (R2-1..R2-14, full table in §12.2)

• R2-8 (soundness): the input set 𝓘 from the nightly goes stale at a later base. A code commit after the nightly can include_str! a docs file, and the docs lane is then unsound. Added a validity-at-base rule (INV-BASE) and a QM-10 falsifier.
• R2-9 (soundness): an openat/stat trace can't see directory listings or ENOENT lookups, so adding a file to a globbed directory escapes. The trace now covers getdents64 and failed lookups, and the ad hoc "fixtures directory" rule is dropped.
• R2-10: nextest archives don't carry doctests. There is now a separate doctest job, and the never-down invariant counts doctests separately.
• R2-12: Prop. 18's e_κ counted only what full review missed. It now also counts quorum-caught findings.
• R2-13: the merge-group diff is taken against merge_group.base_sha.
• R2-1..R2-7: t* is 17, not 16 (16 is kept as a stated round-down); assumption (H-a) added to Thm 11; precondition added to Prop. 12a; the LP reads CPU-seconds, with RAM rows under reservation only (P0 thread-only bound 3.8/h); the shard figure is derived (≤ 299 s), and "C ≤ 30 by proof" becomes a CI-given-a-free-slot bound of 15.1–25.1 min; an aging rule so backfill can't starve large jobs; §H.6 rows above λ* labelled transient.
• R2-11: edge notes on Thm 15.
• R2-14: QM number collision, resolved by the cop: FLOW-003 QM-15: measure q per service class (docs / attested-fork / full) — Prop 12/18 inputs (was QM-08 in v1.1 numbering) #4519 → QM-15.

New

• Prop. 19: under sound tier routing at B=1, r=0, ρ_HOL = λ′ Σ s_k q′_k T_k, about 57% lower at the v2.0 mix [C]. It supersedes v1.1 Prop. 11.
• Operator ruling 2026-09-27: the lighter review tier is approved for docs-only PRs and vouched contributors. It switches on per class when Prop. 18 clears, and reverts to full review automatically on the first escape (§7 row 12, QM-15, POLICY-flow-003-queue POST-REV).
• Operator amendment 2026-09-27 (Prop. 20, §7 row 14): rebase before arm (gh pr update-branch N --rebase, then CI, then quorum on the rebased head, then arm; no force-push), and PR age becomes a model input: P(conflict) = 1 − e^(−κ μ_D a). Short PRs keep the queue model's q stationary. QM-01 gains μ_D, PR age p90 and base age p90 (queue_inputs 14 → 17), the scoreboard gains PR age p90 < 24 h and 0 PRs DIRTY > 4 h, and POLICY gains POST-REBASE. Group 1, retries 0, compile once and tiered tests are unchanged.
• §11 pv contracts: DOC-spec-flow-003 (QM-00..QM-16), queue-model-v1 (+POST-P19), queue-inputs-v1, ci-input-set-v1 in full, POLICY-flow-003-queue (one clause per §7 row), and a table for the rest. All are declared, so pv reports Unknown and nothing arms.
• §12: the review record.

QM rows for the cop to mint after merge

QM-00..QM-07 are unchanged from v1.1 (QM-04 moves to EV 0).

• New: QM-08 fleet inputs, QM-12 runner shapes (infra issue), QM-13 fleet LP + sim, QM-14 soundness audit, QM-16 arch-neutral utilisation.
• Already minted: QM-15 review-tier evidence = aprender#4519, renamed, with the R2-12 measurand.
• Already minted (cop, 2026-09-27): QM-09 compile-once = FLOW-003 QM-09: compile-once — one --workspace test build, nextest archive, K shards fanned across all runners (FLOW-003 v2.1 §row QM-09) #4527, QM-10 input set 𝓘 = FLOW-003 QM-10: input set — nightly single-writer ci/input-set.json (dep-info + traced test reads) (FLOW-003 v2.1 §row QM-10) #4528, QM-11 tier router = FLOW-003 QM-11: tier router — T0-only docs / selective affected-crates / T3 nightly full; T0∥T1∥T2 parallel-cancel (FLOW-003 v2.1 §row QM-11) #4529. Their done-whens in §9 carry the R2-8/R2-9/R2-10 falsifiers.

keep-open: #4514 #4519 #4527 #4528 #4529 -- this PR is a spec revision (FLOW-003 v2.1); #4514 is the spec ticket, and #4519, #4527, #4528 and #4529 are QM rows the spec specifies, closed by their own implementing PRs

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=4533 head=e8220cfc98745acd2a48ef3a1c6503f5c031977d verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-4514",
 "head": "325029f1d4075e08fcc2da3431d65b8454927b1a",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 1
  },
  {
   "lane": 2,
   "verdict": "FAIL",
   "findings": 1
  },
  {
   "lane": 3,
   "verdict": "FAIL",
   "findings": 1
  }
 ]
}

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-4514",
 "head": "c163baeb315ad66f77fea9cbae7af7cf0c5b4fca",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-4514",
 "head": "e8220cfc98745acd2a48ef3a1c6503f5c031977d",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "NO-VERDICT",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-4514",
 "head": "e8220cfc98745acd2a48ef3a1c6503f5c031977d",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "NO-VERDICT",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-4514",
 "head": "e8220cfc98745acd2a48ef3a1c6503f5c031977d",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 1
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "FAIL",
   "findings": 3
  }
 ]
}

[noahgift]

Moved into #4605 (PRCAP fold, cop order 14:02Z). Fold = MOVE: head 4cfe2485e492b8d5a4aa423ad9182cd53df032a6 is an ancestor of the pushed fold head, so no work is lost. The branch is kept. Agent: aprender-59