CI fan-out: Cargo.lock-only diffs fail closed to all 85 crates (15% of commits, 56% of crate-builds) #5822

Owner: aprender-a3 (proposed; countermeasure author aprender-flow).

Finding (measured 2026-10-21, last 60 commits on main, cargo metadata reverse-dependency closure, non-dev edges, 85 crates): mean affected set 22.9 of 85 crates. I could NOT reproduce the 49.6 figure from the 13:25Z question; my method differs (per main commit, not per PR), so treat the gap as not_measured until the 49.6 source is cited.

Where the fan-out comes from: 9 of 60 commits (15%) touch root Cargo.toml / Cargo.lock / rust-toolchain.toml; each fails closed to the full 85, i.e. 765 of the 1374 crate-builds counted (56%). Crates with closure >=40 (contracts-macros 56, contracts 54, build-sha 53, present-core 52, present-terminal 45, common 44, simulate 43, gpu 42) were touched by only 5 of 60 commits (contracts 3, simulate 3, build-sha 1).

Five whys

1. Why do PRs build ~half the workspace? A fifth-ish of them fail closed to the full workspace.
2. Why fail closed? scripts/gate_touched_crates.sh treats any root Cargo.toml / Cargo.lock / toolchain touch as "unknown blast radius".
3. Why is the radius unknown? The script maps paths to crates only; a lock diff is not mapped to the packages whose entries changed.
4. Why does the lock change so often? Any dependency add/bump in one crate rewrites Cargo.lock.
5. Why was it never narrowed? Fail-closed was the safe first version (BSE-16); nobody measured its share.

Countermeasure: for a diff that touches only Cargo.lock (and/or a member's Cargo.toml), derive the changed lock packages (git diff of [[package]] name+version), map to workspace members + their reverse deps via cargo metadata; fail closed only for root Cargo.toml [workspace]/toolchain edits or an unmappable lock diff. Target: share of full-85 commits 15% -> <5%; mean affected 22.9 -> <15. Re-measure with the same 60-commit method. Gate content: quorum + non-author seats apply.

LAB until measured on a PR run; no gate change implied by this ticket.