[DanielNetzer]

Closes #185.

What it does.

• Opt-in selection. A Formula baseline check, or an evaluation-plan check, can declare select: affected-packages. Verification then runs go test only for packages whose reverse-dependency closure, including test-only and external-test imports, contains a changed package.
• Full-suite fallback on any uncertainty. The full suite runs instead when any of these apply:
  • the change includes non-Go files or module files (go.mod/go.sum/go.work);
  • the repo has nested modules, vendored code, or excluded directories;
  • go list or git returns an error, or the call times out;
  • a changed path matches the Formula's fullSuiteTriggers (default lab/cmd/**);
  • more than 2,000 packages would be selected, or the argv would exceed 128 KiB.
• Safety.
  • Selection is refused when argv carries flags that change the package graph: -tags, -mod, -modfile, -overlay, -C, or any unknown flag.
  • The analysis can never set select.
  • Approval requires the plan's triggers to match the Formula, and refuses select on checks the Formula didn't declare.
  • Hidden acceptance and setup never select. The evaluation's independent verification always runs the full plan argv, so Correct keeps its meaning.
• Ledger. It records the selected packages and why, or why it fell back.

Verification.

• Built by: Forgecell Molecule mol-185-61e1d66f250ce58b35eb20cc.

• Review: one adversarial round and one verification pass. Both blocking correctness findings were fixed:

  • a false pass under -tags, reproduced in a scratch module;
  • an amended plan able to drop the Formula's triggers or add select.

  One hardening item is tracked in Hardening: plan limits enforced too late (stranded Molecules) and the learn recurrence scan's 40 MB cap #209.

• The cohort test: its fixture now imports calc so the flaky package stays selected. That keeps the test's meaning.

• Onboarding regression: the full-suite baseline also caught a regression where onboarding's bootstrap Formula failed the new validation. It's fixed.

• Hand-delivered. The protected run fails only the base cohort flake test whose fixture this slice intentionally changes.

• Clean suite: passes in a clean shell on current main, 20 of 20 packages.

🤖 Generated with Claude Code