ci(m3h): retire one-time release promoter; verify immutable tag without freezing future main

.github/workflows/m3h-source-main-reconciliation.yml

@@ -42,7 +42,7 @@ jobs:
           git merge-base --is-ancestor "$TAG_COMMIT" HEAD
           echo "PASS: immutable source and official tag are ancestors of this mainline candidate."
 
-      - name: Confirm release-closure mainline has no silent firmware or Studio implementation drift
+      - name: Confirm immutable release tag contains exact accepted firmware/Studio implementation
         shell: bash
         run: |
           set -euo pipefail
@@ -52,13 +52,14 @@ jobs:
           protected = ('CMakeLists.txt','apps/arstack_studio/','embedded/esp32p4_smv_injector/',
                        'include/','src/','tests/','scripts/','tools/')
           readme_exceptions = {'apps/arstack_studio/README.md','embedded/esp32p4_smv_injector/README.md'}
-          changed = subprocess.check_output(['git','diff','--name-only',source,'HEAD'],text=True).splitlines()
+          tag = 'a4b6e53d0dbbcababc55ba8a4ff97ade6f2a6200'
+          changed = subprocess.check_output(['git','diff','--name-only',source,tag],text=True).splitlines()
           drift = [p for p in changed if (p == 'CMakeLists.txt' or
                    any(p.startswith(prefix) for prefix in protected if prefix.endswith('/')))
                    and p not in readme_exceptions]
           if drift:
-              raise SystemExit('M3.H closure rejected: changes to tested runtime source: '+repr(drift))
-          print('PASS: firmware, Studio, runtime, tests and build code match shipped tested source.')
+              raise SystemExit('M3.H tagged release rejected: changes to tested runtime source: '+repr(drift))
+          print('PASS: tagged release firmware, Studio, runtime, tests and build code match shipped tested source. Future mainline development remains allowed.')
           PY
 
       - name: Query GitHub release metadata and immutable asset identities (read only)

docs/integration/M3H_MAINLINE_RELEASE_SOURCE_CLOSURE_2026-10-24.md

@@ -41,7 +41,7 @@ Comparison counts are historical (against shipped `a922e9bd...`), not a current
 
 **Current PR queue:** exactly **8 unrelated Workbench, Browser, IED Simulator PRs** remain open. They belong to different product tracks and were not altered by M3.H SMV cleanup.
 
-**Safety CI:** the old automatic write-capable M3.H source-reconciliation workflow must be retired after merge. A read-only provenance guard checks source/tag ancestry, runtime parity and all five immutable release asset digests; it must never create a merge branch or publish binaries.
+**Safety CI:** [PR #302](https://github.com/masarray/arstack61850/pull/302) merged a strictly read-only source/tag provenance guard after 3/3 PR checks PASS; its [main run](https://github.com/masarray/arstack61850/actions/runs/40079885038) is also SUCCESS. The guard verifies that the tested source and official release tag are ancestors of main, that the **immutable tag** contains the accepted runtime implementation, and that all five asset IDs/sizes/SHA-256 still match. This gate intentionally does **not** freeze future mainline source development. The former write-capable *one-time* release-promotion workflow is retired after Stable publication, so it cannot silently change latest-release metadata or re-promote M3.H when a newer release exists.
 
 ## Issues kept OPEN on purpose — different acceptance targets