ci: adopt platform tiers — fast merge-blocking set decides main's color; slow/port lanes post-merge; contributor precheck; unenrolled-test gate

[InauguralPhysicist]

Decision (Jon, 2026-09-22): follow what mature languages already do (Rust tiers + bors, CPython make patchcheck + unstable buildbots, Go TryBots + post-submit builders) rather than invent our own.

Why now. Main CI has not finished green since 2026-09-16 (f532c8d). The last 14 main runs are failure/cancelled; the dominant cause is one lane — macos / macos-15-intel runs on main pushes only and hits its 45-minute timeout, which GitHub reports as cancelled. 01e2b4a passed 6126/6126 and still did not go green. When red is normal on main, a real regression is invisible.

Scope.

1. Tiers. Tier 1 (blocks merge, decides main's color): Linux gcc/clang, ASan+UBSan core, the core suite. Tier 2 (post-merge / nightly; failures open an issue, never color main): macos-15-intel and other slow or port lanes — measure which. The nightly workflow already exists.
2. Contributor precheck (our make patchcheck): one command, under ~30 s, running the static gates — pipefail verdicts, suite labels, child-exit accounting, section plan — documented in CONTRIBUTING.md. PR stdlib: keep args.parse_args working under import args #1260 met these only after a 45-minute CI run.
3. Unenrolled-test gate. A tests/*.sh that no suite section invokes must fail. Three exist today (test_amalgamation.sh, test_args_import.sh — being enrolled in stdlib: keep args.parse_args working under import args #1260 — and test_ci_portability.sh); nothing flags them, while a style rule in the same file fails loudly.

Merge queue (Rust's green-by-construction main) deferred until PR concurrency warrants it.

[InauguralPhysicist]

Measured cost, PR #1260 (a correct 5-line stdlib fix from a returning contributor). Landing it required:

1. rewriting its test's verdicts to the house str_has_line matcher ([99aa], The #1120 pipefail race is latent in six more scripts that decide verdicts with | grep -q #1122) — a real rule, and the error message named the fix;
2. enrolling the test as a suite section — nothing flagged that it would never run;
3. bumping CHILD_SITES_DECLARED 121 → 122;
4. resolving a merge conflict on that same number (main had moved it to 125 meanwhile), which also blocked CI from running at all (mergeable_state=dirty);
5. editing five places in README.md / docs/CI.md that state "263 test sections".

Items 3–5 are pure bookkeeping, and each surfaced only after a ~45-minute CI run. They violate our own rule (mechanical-gates §5: floors for a growing total, exact counts for a declared set) — section count and child-site count are growing totals pinned exactly, in several places.

Added to scope:
4. Growing totals → derived + floor. The child-site count and the section count are computed by the tools; the gate fails only if they DROP (a shrinking suite is still caught; an added test costs nothing and cannot conflict).
5. Docs stop stating derived numbers ("the full suite", or rendered at build time), so the doc-claims gate stops needing hand edits per added test.
6. Exact pins stay only for fixed lists where a mismatch is a real defect (e.g. the 8 byte-pinned matcher copies).

With the precheck (2) and the enrolment gate (3), #1260's items 1–2 are seen locally in ~30 s and items 3–5 stop existing.

[InauguralPhysicist]

Step 1 landed: #1265 (57de58f) moved macos-15-intel to nightly only. Main's CI on 57de58f completed green — 34/34 checks — the first green main since 2026-09-16 (f532c8d). Remaining here: required-check tiering (the rulesets currently require only Black; the Protection list does not include the playground build — a red wasm build can still merge), the contributor precheck, derived counts, and the unenrolled-test gate.

[InauguralPhysicist]

Decision (Jon, 2026-09-23): merge queue — Rust's model (bors / Chromium CQ). PRs keep the fast lane for iteration; GitHub's merge queue runs today's full main lane on merge_group (current main + the PRs queued ahead + this PR) before anything lands, so main is green by construction and the badge means what it says. No rebase-to-update round trips: the queue tests the exact commit main will become. Found by the PR-A round-1 blind critic: required jobs run full suites only on push (35 min on main vs 16 on a PR for macos-latest), so main's colour depended on work no PR had to pass — the macos-15-intel mechanism one level down.

[InauguralPhysicist]

Done. All scope items have landed, following the mature-language model:

• Tiers: macos-15-intel moved to nightly (ci: macos-15-intel only in nightly so main can finish green; CodSpeed badge (#1264 step 1) #1265). .github/required-checks.txt is the tier-1 source of truth; ruleset 17713865 requires exactly those 19 checks, and ci_tier_check.sh enforces it, with a --live read-only drift check (ci: platform tiers — .github/required-checks.txt is the tier-1 source of truth, enforced by tools/ci_tier_check.sh (#1264) #1273).
• Merge queue: live. The queue runs the full main lane on merge_group, so main is green by construction. The first queued merge, ci: make precheck, a test-enrolment gate, growing totals become floors (#1264) #1281, landed as 3130a17.
• Contributor precheck: make precheck, 19 static gates in about 40 s on the worst-case target. CI runs the same list (ci: make precheck, a test-enrolment gate, growing totals become floors (#1264) #1281).
• Unenrolled-test gate: tools/enrolment_check.sh / [99ab] (ci: make precheck, a test-enrolment gate, growing totals become floors (#1264) #1281).
• Growing totals → floors; docs no longer state derived counts (ci: make precheck, a test-enrolment gate, growing totals become floors (#1264) #1281). The stdlib: keep args.parse_args working under import args #1260 shape now touches only the test and its suite section.

Follow-ups filed: #1276 (docs-only PRs run the full queue lane), #1278 (accepted limits of the tier gate), #1279 (precheck critical path, help wanted), #1280 (enrolment and floor decisions). Gate consolidation continues in #1275. One honest gap: the AI-contribution-cost baseline was not taken before these landed, so the #1275 benchmark starts from post-#1264.