governance: prevent recursive state-only reconciliation loops

[wpessential]

Scope

Prevent continuous AI fallback execution from entering a self-referential post-merge state-sync loop.

Root cause

After a reconciliation PR merges, fields such as observed_main_sha, active PR identity and merge metadata naturally point to the prior source baseline. Treating that expected pointer drift as standalone fallback work can create:
state-sync PR -> merge -> pointer stale again -> another state-sync PR.

Changes

• classify observed_main_sha as a resume anchor, not live Git authority
• forbid recursive post-merge PRs whose only purpose is pointer/merge-metadata synchronization
• keep semantic status drift actionable
• fold expected pointer drift into the next substantive safe source mutation
• narrow fallback docs/state reconciliation to semantic drift
• reconcile durable state and README to merged PR governance: enforce no-idle fallback execution and reconcile state #143 / main 9e6e95082fd8bc5511dc5502a3e3259203667356
• add deterministic claims, tests and supervisor-audit ratchets

Safety

This does not weaken live Git rehydration, README/state semantic synchronization, exact-head certification, review, security, product-scope, migration, provider/production/release or Runner authority.

Verification

Fresh exact-head WorkIntel CI, Code Quality and Windows Certification are required before merge.

[wpessential]

Exact-head Windows Certification failed on 2decd8eaf12dd1dc2506e2852c26df4acc920c10; WorkIntel CI, governance, CodeQL and Pint passed. Run 37773489016 shows /health/live, /app, and authenticated routes served normally, then the PHP dev server became unreachable during the later cross-browser suite (ERR_CONNECTION_REFUSED); no PHP fatal/reload message was captured. This PR changes no app-server or Playwright source. I’m treating this as a separate Windows E2E server-lifecycle defect and will repair the test harness in its own lane before rebasing/re-certifying this PR. No same-head blind rerun.

[wpessential]

Exact-head CI observation for f273a0e858e6713b636b3bf0f9eab12ba632bd5a: WorkIntel CI run 37781307395, Code Quality run 37781307456, and Windows Certification run 37781307536 were still pending/in progress at the consolidated refresh. CodeQL on this SHA passed. The branch includes current protected main dfb4fc7ec9536a304b7df582027968dc60f3e53a (compare reports 15 ahead, 0 behind). No merge until all required checks are terminal green on this exact head.

[wpessential]

Candidate documentation was corrected and pushed with expected-head protection. New exact head: 3a23104eac220806531d5d01694dede95002cb7a; compared with protected main dfb4fc7ec9536a304b7df582027968dc60f3e53a, it is 15 commits ahead and 0 behind. Current exact-head checks are still running: WorkIntel Code Quality 37782643484, Windows Certification 37782643341, and WorkIntel CI 37782643342. No merge until all required checks are green on this SHA. The unrelated trusted-release workflow run 37782632174 ended with no jobs; it is not a required PR check.

[wpessential]

After durable status sync and live Gate A/A2 reconciliation, current candidate is 989ededc74ce6bc72191ca740ae313aae64babde. It includes protected main dfb4fc7ec9536a304b7df582027968dc60f3e53a (17 ahead, 0 behind). Exact-head checks are queued/pending: WorkIntel Code Quality 37782955014, WorkIntel CI 37782955035, Windows Certification 37782954961. The separate trusted-release workflow run 37782944238 failed without jobs and is not a required PR check. PR remains open and mergeable but blocked; no unresolved review threads or submitted reviews were found. Merge only after all required checks turn green on this exact head.

[wpessential]

Merged exact reviewed head 989ededc74ce6bc72191ca740ae313aae64babde to protected main as 33411a06b2585705880181f056d7b42d3bdf7458. All six required PR-head checks were green; no PR reviews or inline comments were present, and GitHub reported mergeable state clean. Resulting-main verification confirms main now points to the merge commit. Post-merge checks on that merge commit are running: WorkIntel CI 37787814097, Code Quality 37787813729, and Windows Certification 37787813699. Per the merged recursion guard, expected pointer/lifecycle drift is recorded here and reconciled in memory; it must not create a state-only follow-up PR.