test(discovery): P0-5h ordered mainline merge and post-merge production verification

[masarray]

Purpose

P0-5h is the fail-closed execution phase after P0-5g. P0-5d proves wire behavior, P0-5e locks the physical request budget, P0-5f proves repeatability, P0-5g controls production promotion, and P0-5h performs the ordered mainline merge only after all physical/promotion gates are satisfied, then verifies the merged production state again from main.

Current hard boundary

P0-5g currently remains BLOCKED for exactly one discovery blocker: the real P0-5f physical-finalized authority is not tracked yet. Production switch remains false. Therefore P0-5h MUST NOT merge either PR yet. This is intentional fail-closed behavior, not a CI regression.

On the last pre-P0-5h exact-head audit, every other ARSAS gate was green: Production Promotion Guard, generic Build ARSAS, Field Capture Build, Golden Budget Lock, Golden Provenance, Repeat-Run Stability, installer, IO, SV, and legacy reporting. Mainline Readiness was red only because the physical P0-5f authority is missing.

Engine authority

ARIEC61850 PR #134 validated head remains e05fadc3f69d128e01bac0199910f790de6fc61a; .NET CI #655 is green. Compared with physical discovery baseline 4467124775d8d9d76f3db194f9fbfd97144767a8, only the SCL exporter and its validation test changed; discovery-critical paths remain unchanged.

P0-5h merge target

evidence/smart-discovery-mainline-merge-target.json requires:

• merge method merge (no squash/rebase);
• merge order engine -> arsas;
• exact expected-head SHA protection at merge execution;
• unchanged base SHAs from authorization;
• both PRs open + mergeable;
• zero unresolved review threads;
• no auto-merge;
• no fixture/force bypass;
• post-merge production attestation.

Merge commits are mandatory because physical/promotion evidence binds exact PR commits and post-merge verification must prove those commits remain ancestors of main.

Merge manifest and self-reference boundary

scripts/new-smart-discovery-mainline-merge-manifest.ps1 has no fixture/force bypass. It can run only from:

• P0-5g READY_FOR_REVIEW with zero blockers;
• physical-finalized P0-5f authority;
• production-promoted P0-5g authority;
• enabled production props correctly hash-bound to the authority and validated engine head.

The tracked merge manifest stores the P0-5g validated ARSAS head, exact engine head, both base SHAs, and all authority/provenance hashes.

A tracked manifest cannot contain the SHA of the commit that adds itself. P0-5h therefore explicitly closes that self-reference gap: after the validated ARSAS head, the only allowed source change is evidence/smart-discovery-mainline-merge-manifest.json. At execution time the live final ARSAS PR head is re-fetched, that manifest-only diff is verified, and the live SHA is supplied to GitHub as expected_head_sha.

P0-5g's post-physical allowlist now permits that one P0-5h manifest file; runtime/source changes remain forbidden and would require renewed physical evidence.

Exact merge execution protocol

When P0-5g becomes fully ready:

1. Re-fetch both PRs and review threads.
2. Require recorded base SHAs unchanged.
3. Require engine head exactly equals manifest engine head.
4. Require ARSAS diff since validated head is merge-manifest-only.
5. Merge engine PR Harden release post-publication workflows #134 first using method merge + exact expected_head_sha.
6. Verify engine head is now an ancestor of engine main.
7. Re-fetch ARSAS PR test(discovery): P0-5h ordered mainline merge and post-merge production verification #324 and abort on any head/base/mergeability/review drift.
8. Merge ARSAS PR test(discovery): P0-5h ordered mainline merge and post-merge production verification #324 using method merge + freshly resolved live expected_head_sha.
9. Never enable auto-merge.

Post-merge production verification

Smart Discovery Post-Merge Production Verification runs on pushes to ARSAS main and may be manually dispatched. It requires tracked production authorities, clones engine main, and verifies:

• validated engine PR head is an ancestor of engine main;
• P0-5g validated ARSAS head is an ancestor of ARSAS main;
• production switch remains true;
• production props remain bound to exact promotion-authority SHA and validated engine head;
• engine source hygiene + restore/build/tests pass from main;
• ARSAS restore/build/tests pass from main.

It emits P0-5H-post-merge-production.json; P0-5h is complete only when this mainline attestation reports PASS after both ordered merges.

P0-5h CI guard

Smart Discovery Merge Execution Guard validates the P0-5h target/scripts/docs and runs ARSAS regression tests. If a tracked merge manifest later exists, it also validates manifest phase/status/order/method and confirms it does not self-bind a future ARSAS commit SHA.

Review state

Keep PR #324 Draft. Do not mark Ready for Review, enable auto-merge, or merge either repository while P0-5f physical authority is missing or any exact final-head gate is unresolved.

[masarray]

R3 consumer hardening is now on test/smart-ied-discovery-pr134.

Current head includes:

• 445d3c9: smart capture uses engine single-flight and ARSAS _mmsIoGate exclusion;
• 7399811: engine pin moved to ARIEC61850 1b7cbbe8af3dfbc2a15086cb2c3e5eff02e006bb;
• 1b375f5: field CI validates the R3 invariants;
• c82cdbd: cancellation edge case fixed so the app MMS gate remains held until the shared directory flight itself has completed.

Engine CI is green. ARSAS Smart Discovery Field Capture Build run #15 (35124221168) has been triggered for the current head. PR remains draft/test-only and unmerged.

[masarray]

P0-5g implementation checkpoint

Current exact code head: 8ee7c6276cc2826f97b4429282e7f9a599fd7d06.

P0-5g now separates two CI responsibilities:

• Smart Discovery Production Promotion Guard must stay green while the project is fail-closed. With no physical P0-5f authority it must produce a valid BLOCKED readiness result, keep SmartDiscoveryProductionPromoted=false, build/test the normal legacy route, and independently build/test the explicit smart-route candidate.
• Smart Discovery Mainline Readiness is a deliberate hard blocker. It must stay red until a real tracked P0-5f-authority (physical-finalized) plus a valid P0-5g-authority (production-promoted) exist and the verifier returns exactly READY_FOR_REVIEW with the production switch authority-bound.

The StrictMode crash in fail-closed promotion props was fixed: optional SmartDiscoveryPromotionAuthoritySha256 and SmartDiscoveryValidatedEngineHead are now safely absent while promotion is false; they become mandatory only when the production switch is enabled.

Engine readiness audit: ARIEC61850 PR #134 head e05fadc3f69d128e01bac0199910f790de6fc61a, .NET CI #655 success. Compared with physical evidence baseline 4467124775d8d9d76f3db194f9fbfd97144767a8, only the authoritative SCL exporter and its validation test changed; no P0-5g discovery-critical engine path changed.

Both PR #324 and engine PR #134 currently have zero unresolved review threads. Keep PR #324 Draft; do not enable auto-merge while Mainline Readiness is blocked.

[masarray]

P0-5h checkpoint (exact head 608abc7759e5bac8df5ff42b2285f7fe79d176c5): ordered merge + post-merge verification tooling is installed. Current execution remains intentionally BLOCKED because the tracked P0-5f physical-finalized authority does not exist yet; no merge/auto-merge action was taken. P0-5h now requires merge-commit method, engine->ARSAS order, immutable base SHAs, exact engine head, live ARSAS expected-head resolution after a manifest-only post-authorization diff, zero unresolved review threads, and post-merge ancestry/build/test attestation from main. Both PR #324 and engine PR #134 currently have zero unresolved review threads; engine head e05fadc3f69d128e01bac0199910f790de6fc61a remains green on .NET CI #655. Mainline merge will be executed only after P0-5g becomes READY_FOR_REVIEW and the P0-5h live preflight passes.