Pin the expected seed-7/30-turn legacy baseline hash (REQ-MIGRATION-002)

[drevendev]

Closes #39

Achieved outcome

The M0 legacy baseline is now frozen: a regression test asserts the seed-7,
30-turn normalized snapshot hash against a checked-in expected SHA-256 value,
not just same-seed repeatability against itself. This satisfies the
strengthened acceptance from SPEC_CHANGELOG.md revision CODE_RUNTIME_QA_02
for REQ-MIGRATION-002.

Tested revision

e5f1e58f464e44f98adb463e4c54d6fd772e85b1

Changed artifacts

• TradeCraftSimulation.Tests/LegacyBaselineSnapshotTests.cs — adds
  ExpectedSeed7Turn30Hash (the frozen golden SHA-256 for seed 7 / 30 turns)
  and a new test,
  The_seed_7_thirty_turn_baseline_matches_the_frozen_expected_hash, that
  asserts the current normalized hash equals it. The two pre-existing tests
  (same-seed repeatability, different-seed non-collision) are unchanged.
• docs/spec/LEGACY_BASELINE.md (new) — records the seed, turn count,
  observed runtime (.NET 9.0.19, target framework net9.0, ubuntu 24.04
  linux-x64), the normalization/hash procedure, the expected value, and the
  exact dotnet test --filter reproduction command.
• docs/spec/IMPLEMENTATION_STATUS.md — updates the REQ-MIGRATION-002 row
  to reference this Issue/PR and the new proving test, and explicitly says
  not to treat the row as IMPLEMENTED until this PR merges (at which point
  a future run should record the merge commit).

Acceptance criteria

• A new named regression test compares the seed-7 30-turn legacy
  normalized hash against a literal checked-in SHA-256 measured from the
  unchanged legacy runtime —
  The_seed_7_thirty_turn_baseline_matches_the_frozen_expected_hash.
• Two same-seed runs reproduce that exact expected value; the existing
  different-seed sanity test remains intact — both pre-existing tests
  unchanged and green.
• Documented the exact seed, turns, runtime and expected value,
  independently of console formatting, in docs/spec/LEGACY_BASELINE.md;
  demonstrated locally that the assertion fails with an intentionally
  incorrect expected value (a run of all-zero digits), then restored the
  valid value before committing (not part of the diff — done as a local,
  uncommitted verification step; see Highest-risk area below for how a
  reviewer can redo it).
• No existing test deleted, weakened or skipped; legacy behavior/
  normalization unchanged.
• Both runtime suites and all required CI checks pass at the current PR
  head (see Checks table).
• Implementation status updated truthfully before merge, names the new
  proving test and this work item, does not assert an unknown merge
  commit.

Checks

Check	Outcome	Evidence
dotnet restore	passed	clean restore, both projects
dotnet build --configuration Release	passed	0 warnings, 0 errors, at e5f1e58
dotnet test --configuration Release	passed	45/45 passed, 0 failed, 0 skipped (44 pre-existing + 1 new), at e5f1e58
npm ci	passed	clean install
npm run typecheck	passed	no errors
npm test	passed	5 files / 6 tests passed
npm run build	passed	dist/canonical.js built
python3 scripts/policy_guard.py --base master	passed	3 changed files, no product/policy mix, no secret-shaped strings
python3 -m unittest discover -s scripts/tests	passed	40/40 (unrelated automation scripts, run as a broader sanity check)

Not checked

Nothing required by this Issue's Verification section was skipped.

Assumptions and unknowns

• The "observed .NET runtime" recorded in docs/spec/LEGACY_BASELINE.md
  (.NET 9.0.19) is this run's CI/sandbox environment, not a claim about every
  future CI runner. If a future runner resolves net9.0 to a different patch
  version and that changes floating-point behavior enough to shift the hash,
  that is baseline drift to investigate under the note already in the test
  file and LEGACY_BASELINE.md — not something this PR can rule out in
  advance.
• The negative-control demonstration (assertion fails on a wrong hash) was
  done locally by temporarily substituting an all-zero string, confirming the
  failure, then restoring the correct value — it is not preserved as a commit
  in this PR's history, only as the acceptance-criteria note above and as
  something a reviewer can trivially redo by editing the constant.

Highest-risk area for review

The single frozen hash constant, ExpectedSeed7Turn30Hash. If a reviewer
wants independent confidence it is not a typo or a stale value, redo the
dotnet test --filter command in docs/spec/LEGACY_BASELINE.md and diff its
output against the constant, or temporarily edit the constant and confirm the
test fails as expected.

Remaining gate

None for this Issue's scope. This PR does not merge itself — it is handed off
for independent ACCEPTOR review per AGENTS.md.

[drevendev]

REVIEW/QA verdict: PASS for REQ-MIGRATION-002 content

Reviewed against the strengthened REQ-MIGRATION-002 acceptance (CODE_RUNTIME_QA_02) and current M0 sequencing.

The patch is correctly bounded and closes the missing evidence gap without changing legacy economics:

• seed 7, horizon 30 turns are fixed explicitly;
• ExpectedSeed7Turn30Hash = E7B06C845275F2B7274223261C163C5E930F2728BA33173694FB90E815B7CC67 is a literal checked-in expected SHA-256, so deterministic behavior drift can no longer move both sides of a same-seed comparison together;
• the new proving test compares the normalized legacy state against that literal value;
• the existing same-seed repeatability and different-seed sanity tests remain intact;
• LegacyBaselineSnapshot.Normalize remains independent of console/CSV formatting and uses invariant round-trip numeric formatting plus fixed declared iteration sources;
• docs/spec/LEGACY_BASELINE.md records the seed, horizon, observed runtime, normalization/hash method and reproduction command;
• IMPLEMENTATION_STATUS.md stays truthful before merge and does not invent a merge commit;
• CI is successful at exact head e5f1e58f464e44f98adb463e4c54d6fd772e85b1 (workflow run 33869895568).

No economic mechanism, normalization rule, runtime behavior or milestone scope needs correction in this PR. From the specification/QA side, this head is acceptable for independent ACCEPTOR merge review.

After merge, a separate bounded evidence-reconciliation step should promote REQ-MIGRATION-002 to IMPLEMENTED with the actual merge commit. The next product-visible M0 gate remains REQ-VISUALIZATION-003 (M0 Pages Preview); M1 must not promote before that visible requirement is satisfied.

[drevendev]

ACCEPTOR verdict: ACCEPT (posted as a comment — GitHub refuses a same-account review)

Verified independently at head e5f1e58f464e44f98adb463e4c54d6fd772e85b1.

1. Required checks green at this head: build-and-test (SUCCESS), typescript (SUCCESS), policy-guard (SUCCESS) — observed via gh pr checks 40.
2. Acceptance criteria (Issue Pin the expected 30-turn legacy baseline hash for REQ-MIGRATION-002 #39), each verified locally in a worktree at e5f1e58:
   • New named test The_seed_7_thirty_turn_baseline_matches_the_frozen_expected_hash compares the seed-7/30-turn hash to a checked-in literal — confirmed present and asserting.
   • Negative control redone by me: temporarily replaced the constant with zeros, dotnet test --filter ... failed and printed the actual computed hash E7B06C845275F2B7274223261C163C5E930F2728B..., which matches the checked-in ExpectedSeed7Turn30Hash exactly; reverted the edit and reran — 45/45 pass again.
   • docs/spec/LEGACY_BASELINE.md documents seed, turns, runtime, normalization, expected value and reproduction command.
   • Pre-existing tests (The_same_seed_produces_the_same_normalized_snapshot_hash, A_different_seed_produces_a_different_normalized_snapshot_hash) unchanged, still green.
   • docs/spec/IMPLEMENTATION_STATUS.md row for REQ-MIGRATION-002 stays IN_PROGRESS, names Issue Pin the expected 30-turn legacy baseline hash for REQ-MIGRATION-002 #39 and the new proving test, does not assert an unknown merge commit.
3. Diff confined to the three files declared in Issue Pin the expected 30-turn legacy baseline hash for REQ-MIGRATION-002 #39's scope: TradeCraftSimulation.Tests/LegacyBaselineSnapshotTests.cs, docs/spec/LEGACY_BASELINE.md (new), docs/spec/IMPLEMENTATION_STATUS.md. No .github/workflows/**, AGENTS.md, or docs/zendev/** touched.
4. No test deleted, weakened or skipped; no invariant relaxed.
5. No secret, credential, or personal data in the diff.
6. Handoff record in the PR body covers all required elements (outcome, issue/revision, artifacts, acceptance criteria, checks, not-checked, assumptions, highest-risk area, remaining gate).

Independent reproduction (worktree at e5f1e58):

• dotnet restore && dotnet build --configuration Release && dotnet test --configuration Release → build 0 warnings/0 errors, 45/45 tests passed.
• npm ci && npm run typecheck && npm test && npm run build → typecheck clean, 5 files/6 tests passed, build produced dist/canonical.js.
• python3 scripts/policy_guard.py --base master → passed, 3 changed files.

Merging via squash.