ci(conformance): the second environment only looked at a cut

The cross-port conformance workflow ran on release tags and manual dispatch
only. That was a cost decision made when push-to-main coverage moved to the
self-hosted local-ci runner, and on scope it is sound — local-ci's `java-slow`
lane runs the same full reactor (`gate_java_reactor`, `mvn clean install`), so
"the reactor is not run between releases" was never true.

The gap is ENVIRONMENTAL, and it is measured. The two Java test defects fixed
in 1c24b8f and cd01580 were both found by the `v1.0.0-rc.5` tag's run of
this workflow. The 08:17 nightly local-ci run that preceded both fixes reported
`java-slow: success` with both defects live on `main`. One asserts on an NPE
message HotSpot's fast-throw is entitled to stop producing once the path is
hot; the other is two test classes sharing files with nothing declaring their
surefire order. JIT heat and filesystem ordering are precisely the defect
classes a single environment cannot see on its own — and the two runs differ in
exactly that: hosted ubuntu-latest with jacoco ON here, self-hosted with
`-Djacoco.skip=true` there.

So the second environment existed, and a tag-only trigger meant it looked only
at a cut, which is the most expensive moment to find out. A nightly schedule at
04:41 UTC (offset from local-ci's 08:17 so the two full-reactor runs do not
overlap) makes it look every day. Standard runners are free for a public repo;
the second look costs wall-clock and nothing else.

Both live statements of the old trigger set are corrected in the same commit —
AGENTS.md's CI paragraph and fixtures/validation-conformance/README.md — so the
workflow and its documentation cannot disagree about when it runs. The
api-contract README's equivalent sentence is about integration-tests.yml, which
is unchanged, and the plan/spec/CHANGELOG mentions are historical records.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTcEKXTQMYt84fAjuw5A2M

Author: dmealing

.github/workflows/conformance.yml

@@ -1,17 +1,36 @@
 name: conformance
 
 # COST: the cross-port conformance matrix + full Java reactor + drift/mutation gates
-# are heavy, so they NO LONGER run on every push/PR — release gate (tag `v*`) +
-# on-demand (workflow_dispatch) only. Run them LOCALLY before opening/merging a PR:
+# are heavy, so they do NOT run on every push/PR — release gate (tag `v*`), a NIGHTLY
+# schedule, and on-demand (workflow_dispatch). Run them LOCALLY before opening/merging
+# a PR:
 #   scripts/ci-local.sh            # full parity (this + integration suite + drift)
 #   scripts/ci-local.sh --quick    # everything except the docker integration suite
 # The .githooks/pre-push hook also runs the TS build+typecheck gate locally, and the
 # cheap public-repo SECURITY gate (hygiene / leak-scan) still runs on every PR.
-# Push-to-main coverage now comes from local-ci.yml on the self-hosted runner.
+# Push-to-main coverage comes from local-ci.yml on the self-hosted runner.
+#
+# WHY A SCHEDULE, given local-ci already runs nightly: local-ci's `java-slow` lane runs
+# the same full reactor (`gate_java_reactor`, `mvn clean install`) — so "it does not run
+# the reactor" is NOT the gap. The gap is environmental, and it is measured. Two Java
+# test defects (a test asserting on an NPE message HotSpot's fast-throw is entitled to
+# stop producing once the path is hot; two test classes sharing files with nothing
+# declaring their surefire order) were found by the `v1.0.0-rc.5` tag's run of THIS
+# workflow and fixed in 1c24b8f9d / cd0158073. The 08:17 nightly local-ci run that
+# preceded both fixes reported `java-slow: success` with both defects live on `main`.
+# The two runs differ in environment, not in scope — hosted ubuntu-latest with jacoco ON
+# here, self-hosted with `-Djacoco.skip=true` there — and JIT heat and filesystem
+# ordering are exactly the defect classes one environment cannot see on its own. A
+# tag-only trigger meant the second environment looked only at a cut, which is the most
+# expensive moment to find out. Standard runners are free for a public repo, so the
+# second look costs nothing but wall-clock.
 on:
   push:
     tags:
       - 'v*'
+  # Offset from local-ci's 08:17 so the two full-reactor runs do not overlap.
+  schedule:
+    - cron: '41 4 * * *'
   workflow_dispatch:
 
 jobs:

AGENTS.md

@@ -116,7 +116,7 @@ bypasses branch protection. This hook closes that hole locally: when a push touc
 … typecheck` gate CI runs and **blocks the push when it is red** (~6s on a clean tree;
 skipped entirely for non-TS pushes). Bypass in an emergency with `git push --no-verify`
 or `SKIP_TS_TYPECHECK=1 git push`. The Java/C#/Python compile+conformance gates do NOT run on PRs (hosted CI runs
-them on release tags + manual dispatch only, for cost). Instead, every push to
+them on release tags, a nightly schedule, and manual dispatch, for cost). Instead, every push to
 `main` triggers `local-ci.yml` on the maintainer's self-hosted runner: affected
 ports only (via `scripts/ci-affected-ports.sh`), parallel per-port jobs, each
 running `scripts/ci-local.sh --only <port> --strict-toolchains`; a nightly

fixtures/validation-conformance/README.md

@@ -158,8 +158,9 @@ non-Docker conformance job) — TS/C#/Java/Python under the `conformance` matrix
 Kotlin under `conformance-kotlin` — asserting byte-identical boolean verdicts
 across all five generated validation artifacts.
 
-That workflow runs on release tags and on `workflow_dispatch`, not on every PR
-(pull requests get the leak scan only, for hosted-minutes cost). Push-to-`main`
+That workflow runs on release tags, nightly on a schedule, and on
+`workflow_dispatch` — not on every PR (pull requests get the leak scan only, for
+hosted-minutes cost). Push-to-`main`
 coverage comes from the self-hosted `local-ci.yml`, and `scripts/ci-local.sh`
 reproduces the gate locally. See [`docs/CONFORMANCE.md`](../../docs/CONFORMANCE.md).