ci(diet): coverage on tags only, perf-gate table path-scoped, model suites nightly, mutants only on .rs, gate's skipped rule tightened (PMAT-3676)

[noahgift]

Refs #3676 #3668 #3658. Not armed. Per the batching process it rides the next batch. It edits .github/workflows/ (ci.yml, coverage-nightly.yml, guards-nightly.yml). Noah approved all five items directly; the operator's words are quoted on #3676.

keep-open: #3676 stays open until done_when item 1 (≥40% fewer intel runner-minutes per 24 h) is measured after merge.

#	Item	Change	Evidence
1	coverage on tags only	skip_coverage: true on the sovereign-ci call. coverage-nightly.yml also runs on push: tags: ['v*'] (COV_FLOOR), with per-ref concurrency.	The job gated nothing (no coverage_min) and measured 0 tests (--lib on the facade root, per the existing NOTE). It cost 237 s per run on main 35563537942.
1′	the rmedia trap	Every consumer enumerated. The dogfood runs make coverage-check and produces its own number; the steward reacts only to failure; the tests read an embedded string or the Makefile; prepare-release.sh runs llvm-cov locally. None reads CI's number. The one output lost is the advisory Codecov upload.	NEW check_coverage_has_producers.sh covers R1–R4 in 10 rows, and each broken link turns RED.
2	book	No change. Already path-filtered. book-contracts watches crates/aprender-core/src/** because the chapters run aprender-core code, and check_workflow_path_filters.sh RULE 2 requires that.	—
3a	perf-gate table	The explicit guard-tree step (405 s) is replaced by NEW check_perf_gate_selftest_scoped.sh. It runs only when the diff vs origin/main touches the derived scope: every $ROOT/ path perf_gate.sh reads, followed transitively (8 paths). Otherwise it prints a SUMMARY skip line. An unknown comparand means RUN. It runs whole every night.	11 rows. Mutants that each go RED: not transitive, renames hiding the old side, unknown → skip, prefix-string match.
3b	model suites	The PR step keeps only falsification_spec_v10_tests, the SATD ratchet vs origin/main and the one property a diff can change. The stress and gpu_state suites run nightly, as they already did.	check_model_tests_wired: all 3 still wired.
4	mutants	The diff step emits has_rs (--no-renames). Image pull, cargo-mutants install, the run and the upload are gated on it.	—
5	gate	On a pull_request, mutants must succeed. skipped passes only on other events, where its own if: skips it. The old rule passed a PR whose mutants never ran.	NEW check_ci_gate_mutants_rule.sh executes the gate's own marked block for 10 (event, result) pairs. The old rule, planted, goes RED.

Not done, stated: T-4 waiting on the tag's coverage run. That is an autopilot change, deliberately not made on the 0.69 cut day. Today a floor breach reds the tag's coverage run but does not stop the cascade.

Gates:

• guard_tree --no-cargo: all PASS except check_fleet_pv_shapes_gate.sh, the lambda-box fleet-pv condition, which is identical on main and fixed in release(0.69): batch — 15 receipted PRs + fleet-pv andon fix, one CI run, one queue slot #3669
• guard_tree_test 23/0
• guards-are-wired, guards-nightly-manifest, no-timing-in-required, model-tests-wired all PASS
• bashrs 0 errors; bashrs-gate PASS
• actionlint: the same 7 shellcheck infos as main
• fmt, deny, contracts 1666

Update 2026-09-21 ~15:45Z (aprender-62, cop ruling): the ci / gate fix, coverage_on: tag on the merged paiml/.github#77 pin

This PR's first spelling, skip_coverage: true on sovereign-ci@70e51ec, turned ci / gate RED on every PR: that reusable's gate counts a skipped coverage job as a mandatory failure ("coverage did not succeed (result: skipped)"). This PR's own run 35585906113 showed it (it was cancelled unread), and batch-1 #3707 hit it and left this row out. Head a738b926c, a fast-forward from e2d12bdd1 that carries the seated f7b25a6c6 plus:

• Pin sovereign-ci to f713290c86fcd70d6f26a0faab14e67e6713586f: Add AutoML module with type-safe hyperparameter optimization #74's coverage_on input, plus sovereign-ci: roadmap-fragment-parity arms only once the aggregate is untracked at the base .github#77, which keeps feat: Model evaluation framework for .apr models with retraining support #73's roadmap-fragment-parity NOT-ACTIVE while roadmap.yaml is tracked at the base. aprender still commits it; aprender: stop tracking roadmap.yaml + Pmat-Ticket trailers — the precondition for sovereign-ci roadmap-fragment-parity (A2 of #3676) #3709 migrates it.
• coverage_on: tag replaces skip_coverage: true, and ci.yml gets push: tags: ['v*'], the reusable's second required edit. coverage-nightly's v* tag trigger is removed, so each tag is measured once, by ci.yml.
• scripts/check_coverage_has_producers.sh R3/R5 assert all of this. Self-test 16/16, including "skip_coverage: true instead of coverage_on -> RED". On f7b25a6c6 it reports R3+R5 RED; now it PASSES.
• ci.yml runs check_pr_closes_issue.sh --self-test beside --body (its case table ran in no job; found by aprender-f0), and the comment that claimed guard_tree ran it is corrected.
• Main 225b2a9ab is merged in (roadmap regenerated). Local: guard_tree --no-cargo 82/0.

Proof required before re-folding into batch-2: this PR's own CI green, with the gate logging coverage: NOT MEASURED and roadmap-fragment-parity: NOT-ACTIVE.

keep-open: #3676 stays open until the CI diet is measured on main after this row lands (batch-2); #3668 and #3658 are cited for context and close on their own rows; #3709 is the follow-up migration (stop tracking roadmap.yaml) that arms #73's check.

🤖 Generated with Claude Code

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3676",
 "head": "e2d12bdd1203666f133be3f766d908950e7f4ee0",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "FAIL",
   "findings": 3
  },
  {
   "lane": 2,
   "verdict": "FAIL",
   "findings": 3
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 6
  }
 ]
}

[noahgift]

Non-author measured seat: PASS (aprender-7a, 2026-09-21 11:20Z). I did not author PMAT-3676. Everything ran in /mnt/nvme-raid0/agent-wt/seat-3676 (detached, f7b25a6c6), after git fetch origin main.

#	command	claim	measured
1	check_coverage_has_producers.sh / --self-test	R1–R4 ok, PASS / 10 rows	rc 0: ok R1 (make -n coverage-check reaches llvm-cov), ok R2 (dogfood runs coverage-check), ok R3 (coverage-nightly on schedule AND v* tags), ok R4 (numeric COV_FLOOR), PASS / rc 0 SELF-TEST PASSED: 10 rows ✅
2	check_ci_gate_mutants_rule.sh / --self-test / GATE_RULE_WORKFLOW=/nonexistent … --self-test	10 rows; PR only success passes; off-PR skipped/success pass, failure/cancelled FAIL / old rule RED 3 rows + no-block ENV rc 2 / independent of ci.yml	rc 0. Rows: 1 PR success→pass, 2 PR skipped→FAIL, 3 PR cancelled→FAIL, 4 PR failure→FAIL, 5 mg skipped→pass, 6 push skipped→pass, 7 dispatch skipped→pass, 8 mg success→pass, 9 mg failure→FAIL, 10 mg cancelled→FAIL / ok the OLD rule is RED: 3 row(s) + ok a workflow with no rule block is ENV rc=2 / rc 0 SELF-TEST PASSED ✅
3	check_perf_gate_selftest_scoped.sh --self-test / bare	14 rows / SUMMARY skipped + smoke 109, PASS	rc 0 SELF-TEST PASSED: 14 rows / SUMMARY perf_gate --selftest skipped: the diff vs origin/main touches 264 path(s), none of the 8 the table reads; guards-nightly.yml runs it whole; smoke: 109 case(s) enumerated, then PASS ✅
4	check_workflow_path_filters.sh --self-test / bare / RULE 3 control (main's book.yml checked out)	6/6 / 3 path-filtered, PASS / FAIL book.yml	rc 0 (6/6) / scanned 21 workflow(s), 3 of them path-filtered … PASS … runs nightly / rc 1 FAIL book.yml: path-filtered, but no \schedule:` trigger.`, restored ✅
5	guard_tree.sh --no-cargo	all PASS except check_fleet_pv_shapes_gate	79 checks, 1 failed: only check_fleet_pv_shapes_gate.sh [run]. The 3 new guards ran as both [self-test] and [run], all PASS ✅
6	check_no_timing_in_required.sh	PASS	rc 0 PASS no timing assertion can reach a required status check. ✅
mutation	in ci.yml's rule block, pull_request:skipped) ;; before the pull_request:*) arm, then check_ci_gate_mutants_rule.sh	rc 1, row 2 FAIL	rc 1: FAIL row 2 pull_request skipped wanted 1, got 0. Rows 3/4/9 are still correct. Restored, with 0 tracked changes ✅

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3688 head=a738b926c889c40c27c8e85b81c7b3b0e257bcfe verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.