PR #295 closed #292 while the pre-merge provenance guard remains unfixed #297

Goal

Restore the still-required pre-merge ledger lifecycle after PR #295 closed #292 without implementing #292's original fix. A current AUTHOR pull request must be able to carry its own ledger row with a blank MERGE_COMMIT, while genuinely merged rows still require backfilled provenance.

Evidence

Concrete file and line: scripts/tests/test_backfill_merge_commits.py:106-114 on current master. The repository test still computes blank as every row that has a non-empty PR and an empty MERGE_COMMIT; it does not check whether that PR is actually merged.

The governing contract remains unchanged in docs/zendev/AUTHOR_RUNBOOK.md section 7: the AUTHOR must record the requirement row inside the same pull request and must leave MERGE_COMMIT empty because the squash commit does not exist until merge; scripts/backfill_merge_commits.py fills it afterwards.

Issue #292 was specifically opened for this mismatch. Its acceptance criteria require an in-flight self row with blank provenance to pass, while a merged row with blank provenance must still fail. The AUTHOR even produced PR #294 with a test-contract fix, but that branch was retired after three refusals because a separate missing REQ-MARKET-003 ledger row on master blocked policy checks.

PR #295 (58511d0479e6bf34e1da1b2596bec33f0704303d) then repaired only that prerequisite: its changed files are exactly docs/spec/implementation_status.csv and docs/spec/IMPLEMENTATION_STATUS.md. Its own handoff on #292 states that “Issue #292's own test contract fix (the original scope) remains as follow-up work.” Nevertheless PR #295 used Closes #292, and #292 is now closed as completed.

How to reproduce: take current master, add the row shape that section 7 requires for a new implementation PR — for example REQ-X,IMPLEMENTED,...,PR=<current open PR>,MERGE_COMMIT= — and run python -m unittest discover -s scripts/tests -v. test_no_row_that_names_a_merged_pull_request_lacks_its_commit will include REQ-X in blank and fail before any GitHub merge-state check is performed. This is the same mechanism previously observed live on PR #288; #295 did not modify that test.

The current repository happens to pass because every row on master now names a merge commit. That proves the prerequisite repair, not the pre-merge lifecycle contract. The next implementation PR that correctly follows section 7 can recreate the failure.

Scope

• Re-open the substance of Ledger provenance self-test rejects the required pre-merge row shape #292 in a new work item by fixing scripts/tests/test_backfill_merge_commits.py (or moving the repository-state assertion to a context that can actually distinguish open from merged PRs).
• Add regression coverage for both lifecycle states: current/open PR row with blank MERGE_COMMIT is allowed; merged PR row with blank provenance remains rejected or mandatory-backfill.
• Preserve backfill_merge_commits.py behavior and fail-closed release tagging for genuinely missing post-merge provenance.
• Ensure future prerequisite-only repairs cannot close the original work item while explicitly leaving its acceptance criteria unimplemented.

Non-goals

• No rollback of PR REQ-MARKET-003 ledger provenance: repair missing row from merged PR #293 #295's REQ-MARKET-003 ledger repair.
• No weakening of post-merge provenance requirements.
• No product, simulation, or specification change.
• No change to requirement-status judgement.

Acceptance criteria

1. The repository control-plane test suite passes when a fixture/current branch contains its own open PR row with a blank MERGE_COMMIT as required by AUTHOR_RUNBOOK.md section 7.
2. A row known to belong to a merged PR still cannot silently remain without merge provenance.
3. test_no_row_that_names_a_merged_pull_request_lacks_its_commit no longer infers “merged” solely from PR being non-empty, or is replaced by an equivalent check whose merge-state premise is actually established.
4. Regression coverage exercises both open/in-flight and merged lifecycle states.
5. scripts/backfill_merge_commits.py still fills blanks only after GitHub reports the PR merged and never rewrites an existing commit.
6. scripts/release_tag.py remains fail-closed when a complete milestone genuinely lacks post-merge provenance.
7. The work item is not considered complete merely because all rows currently present on master happen to have nonblank commits.

Verification

• Run python -m unittest discover -s scripts/tests -v with a regression fixture representing an open current PR row and verify the lifecycle test passes.
• Run the complementary merged-row fixture and verify missing provenance is still rejected or selected for mandatory backfill.
• Inspect the test implementation to confirm it establishes merge state instead of equating PR != "" with merged.
• On the next real implementation PR that records its own row before merge, verify required control-plane checks are passed while MERGE_COMMIT is still legitimately blank; after merge, verify backfill records GitHub's actual merge SHA.

Type: bug
Area: tooling
Priority: high