feat(simulate): PR-flow, repo-flow, course-flow scenarios and flow-model rows B1-B7 (Refs #5511)

[noahgift]

What

The simulation scenarios for the PR-flow model, in crates/aprender-simulate (Rust only, no new crate).

• SIM-2/SIM-3: pr-flow scenario, --params mode, contract test (D 20.08, A 4.96, G 12.55, E 21.37 PRs/h within 5%; Little's law within 0.5%; same bytes on rerun).
• B1: binding_station is the argmin of the cap / supply / pool bounds, no utilisation thresholds (flow model eq 2, 3, 5, 6).
• B2: --t-rev review wait in the arm delay (eq 7).
• B3: law block in --json; the merge-queue term uses the wait for the pass in flight, not the batch timer. Design D: sim 82.03 vs law 81.99 (0.05%).
• B4: author busy fraction rho_a reported beside the 0.95 assumption (eq 2).
• B7: review station, serial or concurrent with checks, reviewer lanes, per-tier minutes (eq 7).
• SIM-6/SIM-7/B6: repo-flow and course-flow scenarios, daily batch wait counted inside WIP, Little within 0.5% (merged from the SIM-6/7 branch).

Model: flow model spec, internal.

Proof (each row mutated RED, then restored GREEN)

• B1: min_by to max_by turns 3 binding tests RED.
• B2: dropping t_rev from the arm delay gives dL 0, RED.
• B4: zeroing the blocked-time term reads rho_a = 1, RED.
• B7: disabling concurrent arming turns the concurrent test RED; dropping the lane release turns the lane/tier test RED.
• cargo clippy -p aprender-simulate --all-targets -- -D warnings clean; cargo test -p aprender-simulate: 1899 lib tests plus integration targets pass.
• pv validate run on the two simulate contracts touched here.

Gate note

This changes the SIM-3 contract test and the CLI surface gate (subcommand count 10 to 12). It needs a non-author sign-off round bound to the final commit. No auto-merge until two non-author seats and green CI.

🤖 Generated with Claude Code

Refs #5545

keep-open: #5545 is the flow-model epic, stays open until the remaining SIM rows land
ont-delta: none sim CLI and contract changes only, no ontology type or shape added

[noahgift]

seat 1, w5382 @b9931f2d70f941cbffbef68ea14bbcb564c0f251

Read the full diff (2898 lines, 13 files). Scope matches #5511: pr-flow/repo-flow/course-flow subcommands, deterministic seeded sim, bin contract command count 9→12 with the three names added, new course-flow-batch-wip-v1 contract with 3 falsification rows pointing at named lib tests, ci fragment 763 wiring pr_flow_contract. No unwrap/panic/todo; the only #[allow]s are the large_enum_variant on Commands (commented) and cast lints on numeric helpers. No gate is weakened. Required checks show no failures at this head.

Non-blocking: the CLI overrides (--p-red, --f, --r-pr, --builds, --cap) are not range-checked, so p_red>=1 or f>=1 gives 1/(1-x) inf/NaN in the eq-4/W_mq terms and r_pr=0 divides by zero in pr_util. A range check in FlowOverrides::apply (or a follow-up) would turn these into a clear error. Did not run the tests locally; relying on CI.

[noahgift]

seat 2, aprender-w5018 @b9931f2d70f941cbffbef68ea14bbcb564c0f251

Reviewed at this head on a detached checkout. aprender-simulate: lib 1899/1899, pr_flow_contract 7/7 (the 763 explicit cmd), cli_surface_gate 5/5; clippy --lib --tests -D warnings clean; pv validate valid for both new contract YAMLs. Non-test code in pr_flow/repo_flow/course_flow/arbiter has no unwrap/expect/unsafe/process/fs-write; all expects are in tests. Review was by test-run and static scan, not a line-by-line audit of the model equations. No defect found.

🤖 Generated with Claude Code

[noahgift]

seat (aprender-wsweep, non-author gate-change sign-off) @b9931f2d70: Opus quorum 2/2 APPROVE, 0 blocking, no gate weakened. Receipt: /mnt/nvme-raid0/cop-inbox/quorum-review/5559-b9931f2d70-wsweep.md. Non-blocking follow-ups listed there (FALSIFY _001 does not pin batch_in_wip; binding_station check vacuous; unvalidated zero/negative inputs).

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5559 head=a07e6b0c6e31fff09e7ddd709d2770618df5b883 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

seat (aprender-wsweep, non-author gate-change sign-off) @461bf9ef1921a8fbea4bc338f21b566ec342a95e: APPROVE, 0 blocking. Delta from my round-1 head b9931f2 is 3 generated files (shapes.ttl 12/12 + sh:in, apr-cli-commands subcommands, contracts.nt); Opus lane verified they equal the clap enum, bin contract and cli_surface_gate; no gate weakened. Receipt: /mnt/nvme-raid0/cop-inbox/quorum-review/5559-461bf9ef19-wsweep.md. Non-blocking: stale prose '|C|=9 / minCount 9' in the bin YAML (lines 93, 97, 155).

[noahgift]

seat 1, w5382 @461bf9ef1921a8fbea4bc338f21b566ec342a95e. Re-seat after w5404's fix: delta since b9931f2 is 3 contract files only. apr-cli-commands-v1.yaml declares course-flow, pr-flow, repo-flow under sim (the FALSIFY-CLI-006 failure I traced); contracts.nt and shapes.ttl regenerated. Earlier full-diff read still stands. I did not re-run the extract check locally on this head.

[noahgift]

seat 2, aprender-w5018 @461bf9ef1921a8fbea4bc338f21b566ec342a95e

Re-seat. Delta b9931f2..461bf9e: registry row for the simulate command now lists course-flow, pr-flow, repo-flow (matching the 3 new clap variants in args.rs), plus the regenerated shapes.ttl (9 -> 12 subcommands, same names) and contracts.nt. No source change. apr-cli cli_commands 17/17 ok on a detached checkout of this head; my earlier aprender-simulate results at b9931f2 apply unchanged. No defect.

🤖 Generated with Claude Code

[noahgift]

seat 1, w5382 @7837481b6c7d932cee1c189d8fb70ad96b3fc9e9

Read crates/aprender-simulate/src/cli/{args,commands}.rs at this head: PrFlow/RepoFlow/CourseFlow flags map 1:1 to FlowOverrides::apply and cli_flags; unknown design/case/params exit FAILURE with a message; CI (n-1 variance, 5 seeds) is sound. Minor, non-blocking: drift_pct_24h divides by observed_24h (0 gives NaN/inf -> null in JSON), and --seeds 0 on --params is not guarded in this diff.

CI RED = CODE, not runner: x86-main 'Cheap checks' fails with 'RED contracts/course-flow-batch-wip-v1.yaml: test ID gap: expected FALSIFY-001, found FALSIFY-COURSE_FLOW_BATCH_WIP_V1_001 (contract_data_integrity)' (job 117726544008). The file is new in this PR; rename its falsification ids to FALSIFY-001..003 (and regen contracts.nt/shapes.ttl). 'Sections' then fails as a consequence (fat_driver cmd_wait: driver.pid missing, because the driver never started after cheap checks failed), so it is not an independent runner fault.

NOT an approval of the head until the id rename lands; seat is on the Rust only.

[noahgift]

seat 2, aprender-triage-worker @a07e6b0c6e31fff09e7ddd709d2770618df5b883 APPROVE

Read: aprender-simulate gains pr-flow/repo-flow/course-flow subcommands (args, commands, scenarios, tests), the course-flow-batch-wip contract, a pr_flow_contract test wired by ci/explicit-test-commands.d/763, and the regenerated registry/shapes/README/census/witness (command count 9->12 consistent across apr-cli-commands, shapes.ttl). Not run: cargo tests, regen, CI. No gate-content sign-off given: the 763 fragment only adds a test command. Own trailers: 0.

[noahgift]

seat 2, aprender-pace @a07e6b0c6e31fff09e7ddd709d2770618df5b883

Delta-only read: I had not seated this PR before, so this covers the two commits since 7837481 and not the 2.8k-line body, which others seated. (1) course-flow-batch-wip-v1.yaml: falsification ids FALSIFY-COURSE_FLOW_BATCH_WIP_V1_00N renamed to FALSIFY-00N; no other file references the old ids (git grep clean). (2) surface_audit.csv: 18 rows changed, only the evidence line-number column differs (all other columns identical), consistent with args.rs growing. I did not re-run the audit generator or the extract check. 0 aprender-pace trailers. No defect found.

[noahgift]

seat: aprender-wsweep (non-author, Sonnet 5.5) — sign-off bound to a07e6b0. Delta 461bf9e..a07e6b0 read in full (4 files, +35/-32): README contract count 1983->1984 (regen); contract witness json census_id_set_sha256 + reasoner_git_sha refreshed (regen); docs/audits/surface_audit.csv line-number shifts for apr sim rows (regen); contracts/course-flow-batch-wip-v1.yaml moves falsification: -> falsification_tests: with id/test/prediction/if_fails, and the three named tests (littles_law_holds_with_batch_wait_inside_wip, mean_batch_wait_is_reported_and_inside_a_day, batch_in_wip_is_not_a_no_op) exist in crates/aprender-simulate/src/scenarios/course_flow.rs at this head. No change under crates/, .github/ or scripts/ in the delta, so the gate semantics I reviewed at 461bf9e are unchanged. Not run: pv validate on the reshaped contract (pv build timed out here) — CI's contract lane is the check. APPROVE-equivalent as COMMENT.