Affected-set differential falsifier: SelectionPredictOnly + nightly cadence workflow (signed design, all three items)

[gunbai-bot]

Implements the SIGNED falsifier design (docs/plans/affected-set-differential-falsifier.md — merged #6284; operator signs 2026-07-05: roster authority = existing disposition facts, N=8 counted re-arm, cadence at proposed shape).

Model

• std.realization_schedule: NodeFrontierSelection = SelectionOff | SelectionApplied | SelectionPredictOnly replaces the skip_unaffected_node_frontier Bool on RunnableDiscoveryBatch — a Bool cannot express predict-without-apply and two Bools would conflate the state space. All constructors and pattern sites migrated corpus-wide; equality by match. FLAG for reviewers: this touches a std/ carrier — the mode is the mechanism of the signed design and the note cites it; the rename (not addition) forces every consumer to migrate, no silent old-field defaults.
• gha_workflow.dag: the Schedule trigger arm now carries its payload (schedule: as the GHA-required sequence of cron mappings) — formerly a payload-dropping stub that rendered invalid GHA syntax. First live constructor is this workflow; GHA quirks (UTC-only, 5-min floor) noted on the carrier with the cited syntax authority.
• gunbc.falsifier_workflow: nightly 0 7 * * * UTC + workflow_dispatch; prelude + release build + predict-only cold run over a declared 20-commit window base (GUNBC_CI_DIFF_BASE=HEAD~20 — main-vs-main would be empty and predict skip-everything, which only falsifies rot; the window gives predictions non-trivial structure; checkout is fetch-depth 0 so the window is available). Step budget 120m; job backstop = step-sum + prelude allowance (155m) per the step-budget ruling.
• ci_floor_plan.gunbc_falsifier_batches: one RunnableDiscoveryBatch, SelectionPredictOnly, tree-wide scan dirs, enrolled entries empty. Component 1 (non-hermetic residue) is covered by construction — host-scaffold rows never predict-skip and always run cold; residue-only cadence shape waits on the reads_live_tree classifier defork (noted on carrier).
• generated_artifact: FalsifierYamlArtifact → .github/workflows/falsifier.yml (CommitRequired/GithubActionsWorkflow, yaml-parse extra_valid). Carrier committed from the generator's bytes; drift gate green.

Host

• DiscoveryCorpusOptions.node_frontier_selection (mode enum). PredictOnly: records each per-row prediction (DiscoverySummary.predicted_unaffected — skipped rows previously had NO per-row identity, only a count), runs every row cold, and emits a counted DIVERGENCE attribution when a predicted-unaffected row runs red. The red itself fails the batch through the normal failure channel — divergence is attribution, not a second verdict.
• claim_executor marshal: an absent node_frontier_selection field is a typed refusal — the former Bool defaulted to false when absent, a fail-open where a stale plan silently dropped its declared selection semantics.

Receipts (by execution, ctrl-build remote)

receipt	result
floor_skip_discovery_witness binary — incl. 3 new predict-only witnesses	exit 0
└ red predicted-unaffected → exactly 1 divergence	ok
└ green predicted-unaffected → 0 divergences	ok
└ red predicted-affected → 0 divergences (divergence discriminates, it does not count every red)	ok
falsifier_workflow_witness_holds (cron render + red control, backstop arithmetic, artifact path)	PASS
ci_floor_plan_witnesses (+ falsifier batch shape: 1 batch × 1 runnable × PredictOnly)	PASS
wet regen + generated-artifact drift gate (falsifier.yml generated; ci.yml unchanged)	exit 0
clippy --all-targets, cargo fmt --check	clean

Dissolution (on-carrier)

8 consecutive zero-divergence windows retire the workflow (delete it; receipt = Actions run history); later divergence re-arms another 8-window cycle, itself counted. Cost is bounded per window — one cold run nightly, never multiplied into PRs.

🤖 Generated with Claude Code

[gunbai-bot]

Post-approval receipts round (two small commits since the approvals, both regen-transport):

1. cursor's three findings — all fixed: the masked witness constructor in realization_schedule_witness_test.dag (my straggler grep's -v filter excluded the very file named for the type — self-inflicted blind spot), the parallel scan-dirs roster (plan now consumes witness_discovery_scan_dirs from ci_layer_roots), and the std_realization_schedule.rs host mirror (regenerated via emit-fresh; per-declaration splice because the fresh emit also carries unrelated measure-tower emitter drift that the hand-synced seed does not yet export — only this change's emitted declarations grafted).

2. Drift-gate red the regen exposed, now green (GATE=0 by execution): regenerating the artifact roster surfaced (a) the pre-push hook gaining falsifier.yml in its fresh-artifact roster — regenerated carrier committed from generator bytes, sha-verified transport; and (b) an inherited main-side model↔carrier drift from Audit: witnesses that never execute their .dag subject #6277: the census-script gitignore allowlist line existed only in the committed .gitignore, not the gitignore model, so any regen deleted it (masked on main by the budget-red floor). The allowlist is now a modeled IgnoreArtifact row (PythonAuditScriptAllowlisted), so model == carrier and the class is unwritable rather than hand-patched.

Full receipt set re-run on head: schedule witness PASS, plan witnesses PASS, floor_skip_discovery_witness exit 0 (all three divergence discriminators), wet regen + drift gate exit 0, clippy/fmt clean.

— sent from gentle-owl-459

[gunbai-bot]

cursor round-3 finding fixed and proven: FalsifierYamlArtifact is enrolled in all four registry-completeness witnesses in generated_artifact_drift_test.dag (count 8, committed, not-ignored-path, GithubActionsWorkflow commit-policy, extra-validation), and the witness runs green by execution on head: PASS generated_artifact_drift_witnesses (wet, exit 0). The finding was fully valid — that witness file was outside this PR's receipt roster, which is exactly the affected-set miss this falsifier exists to make loud.

— sent from gentle-owl-459

[gunbai-bot]

CI-failing disposition, named: the failing check is the composed floor job — 'The action gunbc ci (.dag witnesses + gates) has timed out after 90 minutes' — while rust_tests PASSES in 6m43s on this head (the #6296 warm step working as designed). The timeout is the pre-existing whole-tree floor budget class, red on every recent main run as well (all five latest main runs are failure, including the #6297/#6302/#6304 merge commits), so it is not introduced by this diff. It is, precisely, the corpus-denominated cost this PR's program exists to dissolve: the falsifier here plus the module-grain floor cutover in #6301 are the affected-set mechanism that shrinks the floor from whole-tree to per-change. No fix commit is warranted on this branch; the substantive receipts (all witnesses, wet regen, drift gate) are green by execution per the receipt table and comments above.

— sent from gentle-owl-459

[gunbai-bot]

Both cursor findings fixed on head:

1. Stale carrier: falsifier.yml regenerated from the merged model — job backstop 155→170, build step 30→45 (both flow from sccache warm step before rust gate (cold-storm precheck) #6296's build-step budget bump that the Floor cutover: .dag module-grain query replaces NodeFrontierSeeds #6301 merge brought into this branch), plus the build-step argv narrowing the merged ci_release_build_step carries. Byte-exact, sha-verified transport of the projection output; falsifier_workflow_witness_holds PASS by execution on the same tree.

2. Backstop witness: no longer pins a magic 30 — it consumes gunbc_ci_release_build_step_timeout_minutes and gunbc_ci_prelude_allowance_minutes, the authorities the backstop composes from, so a future budget bump moves witness and model together.

3. Unit modeling: gunbc_falsifier_step_timeout_minutes grounds on std.types.Duration with the same 🟡 value-Measure dissolution trigger as its sibling gunbc_ci_floor_step_timeout_minutes — interim carrier, Int projection stays at the GHA emit seam, dissolves when CI budgets ground on std.measure time.

— sent from gentle-owl-459