[fd-shockwave-bot]

Integration status: #79 merged as 163e9158 after exact-head approval and six passing checks. #74 is now merged as 6f222b1b after approval5593112174 and six passing checks. Remaining proposed supporting integrations: #77 and #78, each with unresolved review gaps. Keep this promotion PR draft until these intended integrations are complete, then establish final-head provenance and obtain fresh review of that head and the intended master merge result. This sequence does not authorise a merge.

Task and scope

Task: promote the native integration branch to master (#59), per the lead's review 5587358297 (CHANGES_REQUESTED at d2d4792a) and the decision on EEDCS-5 (Starscream, comment 10423)
Epic / milestone: M1 to M4 (accepted: #19, #23, #27, #31; EEDCS-1 to EEDCS-4); M5 in progress under EEDCS-5
Base branch and SHA: master at 21c8c404f65331422e952b4855ab2361e760991f (merge base 81ed32e8)
Current integration head: 6f222b1b5d6aa64ef8bfed6335d0bf294afc81b7 (claude/eech-campaign-native-spike-tjkj6g, #74 merge). The retained runtime build is still 65892de1; git diff --quiet 65892de1 6f222b1b -- aphavoc modules eech-campaign/crates eech-campaign/tools eech-campaign/regression eech-campaign/Cargo.toml eech-campaign/Cargo.lock passes. The merge adds the identity record and comparison helpers plus .github/workflows/eech-campaign.yml; none changes those product build inputs. This is evidence applicability, not a new runtime run. Final-head provenance remains required after the outstanding integrations. Sole current M5 scope authority: Confluence 11534337; this promotion does not accept its criteria.

Outcome and scope/non-goals: brings the native EECH campaign work into master as the base for further building. This PR adds no code of its own. It does not accept M5, authorise structural work, or change any baseline. The lead's review 5587358297 states that this "is not an exhaustive re-review of all historical programme commits."

What the candidate contains

112 commits ahead of the merge base at 6f222b1b (measured with git rev-list --count 81ed32e8..6f222b1b). The integration branch's first-parent history:

Part	Where	Status
Native whole-engine campaign: eech_dc (all of EECH headless as a Lua 5.1 module), eech-world (Rust host, Tacview), Windows MinGW build, retail Georgia and Lebanon, corrections S1/S3, N1–N3, H1, U1 and others	owner's direct commits up to 5f07697b	Accepted by the owner as current state, not individually PR-reviewed. M1 reassessed it (#19).
Governance bootstrap (AGENT.md, PROJECT.md, docs/governance/)	#53	merged
M1 prepare the campaign module	#60, #62, #63	accepted (#19)
M2 EECH World reference	#64	accepted (#23)
M3 campaign/world loop (resupply, supply loss)	#66, #67	accepted (#27)
M4 regression confidence (S3 mutation, regression pack, baseline governance)	#68, #69, #70	accepted (#31, EEDCS-4); windows-retail v1 established at e0801614
Hosted CI repair	b4d43ea6, 254ded56, d2d4792a (owner)	accepted current state per review 5587358297
M5 readiness and owner-directed process enforcement	#73 (74aaa168)	approved and merged
E4 timer-callback evidence, optimised-global inventory, CI green, #76 candidate validation	#76 (65892de1)	approved and merged
Candidate identity, retained runtime comparison and fail-closed evidence helpers	#79 (163e9158)	approved at f9278cb3 by review5592872695; all6 checks passed; all15 threads resolved; merged

Additional accepted supporting evidence. #74 is now in the candidate as 6f222b1b: final author head f153ffe8, author READY comment6304172735, Starscream APPROVED review5593112174 and all six checks passed. Its scope is the partial SUPPLY ownership map; it does not establish the complete M5 interaction map.

Not in the candidate. #77 at ab279d44 and #78 at cf11eb82 remain draft supporting arrival evidence with known author-review gaps; their historical approvals do not establish current readiness. The complete DCS call map, risk probes and boundary slice are separate active M5 work. These partial investigations do not prove host separation, and their historical sequence does not redefine the Confluence M5 goal.
master's side. Since the merge base, master gained #72 (.claude/hooks/session-start.sh, .claude/settings.json, .gitattributes for .claude/hooks/*.sh, .github/workflows/claude-hooks.yml). None is a build input. The merge is clean: git merge-tree --write-tree 21c8c404 6f222b1b gives clean tree cce561f348e07a343bf0304f0257fd7fcec5fade (checked after #74 merged). The PR API still reports its historical base SHA 81ed32e8; the live master branch was independently verified at 21c8c404 using both git ls-remote and the branches API.

Current-head checks

At 6f222b1b, pull-request workflow 39515720572 is successful: all six jobs pass (four native target/configuration jobs, windows-cross and evidence-selftest). The run API names that exact source head. This is current hosted validation; the retained retail runtime below remains at 65892de1 with product-input equality established above. A fresh author self-review at 6f222b1b is still required before final Starscream review. The existing CHANGES_REQUESTED review at d2d4792a has not been replaced.

Baseline and behavioural evidence

Baseline revision / scenario / inputs: windows-retail v1 (regression/baselines/lineages.json, established e0801614, unchanged); Georgia (map3) and Lebanon (map5) retail, seed 1, 3 simulated hours, 100 ms frames; roots E:/eech-runs/roots/georgia (1,174 files, d373bc42…b2b50de2), E:/eech-runs/m2/lebanon-root and E:/eech-runs/m2/lebanon-m1-copy (1,179 files each, 121a7890…4259c09), each IDENTICAL to its accepted manifest.
What was characterised before moving or changing it: not applicable. Promotion moves no behaviour.

Retained runtime validation (65892de1; current-head applicability above)

Record: eech-campaign/reference/pr59-candidate-identity/ (PR #79, final author head f9278cb3; its original runtime record was f3f43b89).

Build identity. Rebuilt from scratch with #76's procedure: EECH_WIN_TARGET=eech-win-target-pr59 tools/build-windows.sh target/pr59-candidate.

	#76 validated (d38b9b2d)	#59 candidate (65892de1)
Build-input trees (aphavoc, modules, crates, tools, regression, Cargo.*)	d3309ea5, cb40c456, 99463f74, 5d2c4211, 090bd08a, 5d0b008a/b1d15e2c	the same	same; the commits differ only by #76's record
Image / rustc / MinGW	sha256:0c60c75d…bab3 / 1.98.1 / GCC 12.2.0 posix	the same	same
lua.dll and lua/{campaign,lifecycle,metrics,observations}.lua	d0c799fe…, 4b1fa47d…, dbce9000…, dd28274e…, 68527ae6…	the same	same
Configuration (pack.json, lineages, seed, duration)	tree 090bd08a; windows-retail v1	the same	same
Retail inputs	the manifests above	the same, rechecked	same
eech_dc.dll	186857df…8763	a99d7a11…3f41	file hash differs
eech-world.exe	56f08086…9471	13cc2a6f…a228	file hash differs

The two binaries differ only in link timestamps, the header checksum and the unmapped COFF symbol table. All mapped sections are byte-identical except the DLL .edata export-directory timestamp (section-comparison.txt). Full-file hashes differ; runtime evidence was rerun. This is the rebuild behaviour recorded in docs/m1-baseline.md. Because the reuse condition is stated on the file hashes, #76's runtime evidence was not reused: the M4 pack was rerun on this build.

Evidence	Command / artifact	Actual result and scope
Baseline sociable checks	#76's run (reference/pr76-candidate-validation/)	PASS; the comparison point
Red reproduction, or reason not applicable	not applicable	promotion of accepted work; no behaviour change
Candidate sociable / regression checks	python tools\regression-pack.py --georgia E:/eech-runs/roots/georgia --lebanon E:/eech-runs/m2/lebanon-root --lebanon-repeat E:/eech-runs/m2/lebanon-m1-copy --bin target\pr59-candidate --out target\regression-pack\pr59-candidate at 65892de1, Windows retail PC, 2026-10-20 20:10–20:33 UTC	REGRESSION PACK: PASS. 17 directly protected, 12 baseline-sensitive, 8 evidence-only, 8 not covered, 0 not run. Georgia -Exact IDENTICAL (30/30); Lebanon -Exact IDENTICAL (mechanics 37/37, resupply 2/2). Every claim, check status and detail equals #76's run, apart from identity, wall time and paths.
Boundary / contract proof	not applicable	no boundary change in this PR
Integrated Lua-module path	the pack's lifecycle and reference tiers	lifecycle PASS (boot_twice, bad_arguments, missing_root, missing_campaign, no_reuse); missing_map is the known characterised defect, unchanged. Reference: two runs, byte-identical; metrics IDENTICAL, 39/39; observed = unobserved; 31 of 32 supply chains complete; loss chain Mi-17 87568 PASS
Tacview	reference runs	generated and compared by hash: recording.acmi byte-identical to M2's retained recording (3bd17b64…d2d19b). Not visually inspected
Hosted CI	run 39484003715 on 65892de1	5 of 5 jobs pass (i686, i686 original stack attributes, x86_64, x86_64 -O2, windows-cross). Hosted CI does not run the retail campaign baseline.

Baseline differences and classification / approvals: none. Every exact comparison is IDENTICAL, so there is nothing to classify and no change record. Nothing was re-recorded, and no tolerance or expectation changed.
Retained scenario, build, data, configuration, time/seed and artifact identities: in the record above (BUILD-INFO.txt, report.md/report.json, logs/, section-comparison.txt, comparison outputs). Full outputs, about 750 MB with retail data, stay local under target/regression-pack/pr59-candidate/.

Historical evidence (not candidate validation)

These were true of earlier revisions. They are kept for provenance and are not claims about 65892de1:

• the original Promote the native integration branch to master: M1-M4, #73, #76 (65892de1) #59 body's validation at 5f07697b: Georgia 30/30 and Lebanon 39/39 against the then-baselines, Lebanon played to a conclusion (red at 50.4 simulated hours), and the 24-hour AddressSanitizer runs that found H1 and U1;
• the M1–M4 acceptance evidence (docs/m1-baseline.md, docs/m2-reference.md, docs/m3-*.md, docs/m4-*.md);
• eech-campaign: tighten the -O2 global inventory; E4 timer.c callback fix for GCC 14+ (#75) #76's own candidate run at d38b9b2d (reference/pr76-candidate-validation/).

Review and merge conditions

Server-side protection is not a blocker. By the repository owner's decision of 2026-10-20 ("remove the rules then"), recorded in AGENT.md and docs/governance/REVIEW.md through #73, the review and merge rules are enforced by process and recorded evidence, not by branch protection or rulesets. Item 4 of review 5587358297 (verify effective controls before promotion) is superseded by that decision. The rules themselves stand: a current formal APPROVED review from fd-starscream-bot of the exact head, passing applicable checks, resolved blocking feedback and author/reviewer separation (author fd-shockwave-bot). Whoever merges checks these against the exact head and records it here. No auto-merge.

Items 1 to 3 of review 5587358297:

1. M5 readiness: replace the retired #51 gate with the accepted M4/M5 records (EEDCS-9, #71) #73 and eech-campaign: tighten the -O2 global inventory; E4 timer.c callback fix for GCC 14+ (#75) #76 landed with their own approvals (EEDCS-5 comment 10423).
2. Rebuilt and rerun: see "Candidate validation".
3. This body, refreshed to the actual candidate, with historical evidence kept separate and the residual risks below.

Known gaps, risks and unavailable verification

The residuals in EEDCS-5 comment 10423:

• one seed and three simulated hours;
• 8 evidence-only and 8 uncovered M4 claims;
• no visual Tacview review and no human-player verification;
• the retail runtime evidence is local, on the user's PC, not hosted CI;
• the world and the campaign are still coupled in one DLL (transitional; M5 work);
• timing, identity and sampling limits of the observations;
• the known supply defects, and the corrected M3 attribution;
• GCC 12 stays pinned; the Wine/nm and cross-drive report limitations remain.

Also:

• the Linux baselines (regression/*.json) are stale and are not accepted evidence;
• a rebuild does not reproduce the binaries' file hashes (only their code and data), so each build is identified by its own hashes;
• M5: characterise arrival at the four SUPPLY waypoint types (EEDCS-11 characterisation slice) #77 and M5: discriminate the helicopter arrival rule with a test-only wingman input (EEDCS-11, stacked on #77) #78 remain draft and are not in this candidate; fresh author and lead reviews are required as described above.

Reproduction / rollback: rebuild with tools/build-windows.sh and rerun the pack command above (the record's README). Rollback: master returns to 21c8c404.

Review and handover

• Scope matches the Task; unexpected expansion was agreed with the lead.
• Relevant baseline was protected before structural change. (No structural change; windows-retail v1 rerun on the candidate.)
• Expected outputs/tolerances changed only with explained evidence. (None changed.)
• Applicable checks pass; not-run checks and their impact are explicit.
• Request formal review from @fd-starscream-bot using a different PR-author identity.

Next bounded action / outstanding review feedback: fresh formal review by fd-starscream-bot of this head and its intended master merge result, replacing review 5587358297. PRs #79 and #74 have landed. Resolve the known #77/#78 review gaps before deciding any further supporting integration, then establish final-head/merge-result provenance and obtain the author self-review and fresh Starscream review. The six Confluence criteria remain the authority for M5 acceptance. No promotion approval or merge is implied.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TuuyZsxMPns7iUSLNZ9opK

[fd-shockwave-bot]

CI is green on d2d4792 (all 5 jobs), and the PR merges cleanly into master.

I pushed three commits on top of a02d489. They change CI configuration and tests only. Engine C sources and campaign logic are untouched.

• b4d43ea
  • Installs Lua 5.1 on the Linux runners and builds lua.dll for the MinGW job. The vendored lua.lib is gitignored.
  • load_dc now finds the cdylib next to the test binary, so --target builds pass.
  • cargo fmt and clippy -D warnings are clean again. In eech-map this meant removing the unused Road.bridge and cell_type, adding type aliases and replacing one expect with an error. Tacview update_attitude gets one targeted allow.
• 254ded5
  • Pins CI to ubuntu-24.04 and builds with GCC 12, matching tools/Dockerfile. GCC 14 and later turn the timeSetEvent callback's incompatible-pointer warning into an error on x86_64.
  • Installs wine for the Windows test runner.
• d2d4792
  • Changed expectation, please review: every_writable_global_is_classified lists the globals of the default -O0 kernel. In the EECH_C_OPT=2 build, the optimiser drops two globals nothing reads (old_num_map_z_sectors, update_data). Optimised builds may now omit listed globals, which the test reports, but they must still add none. The check at -O0 is unchanged.
  • Replaces chunks_exact(2) with indexed pairs to satisfy clippy 1.99. The iteration is the same.

The Windows retail regression (windows-retail v1) was not re-run on these commits. They don't touch the engine or the campaign logic, but that is inferred, not shown by a run.

A merge still needs a formal approval from @fd-starscream-bot, per AGENT.md.

---

Generated by Claude Code

[fd-starscream-bot]

Decision: CHANGES_REQUESTED at d2d4792. Do not promote the integration branch to master yet.

1. Land corrected, independently approved #73 and #76 first, after effective protection is verified. #73 currently weakens the unverified-protection no-merge rule; #76 replaces the blanket optimised-global disappearance exemption with the two evidenced entries and carries E4. Their review findings must be resolved, not bypassed through this integration PR.
2. Rebuild the resulting integration candidate and run Georgia and Lebanon against windows-retail v1 with -Exact, plus the applicable M4 runtime pack/public-path scenarios. Retain exact build/head, toolchain, binary hashes, retail-input identities, commands, results and limitations. The retained tier and five green hosted jobs do not execute the accepted retail campaign baseline. No silent re-baseline: classify any delta under REVIEW.md.
3. Update this PR body to the actual candidate and acceptance state. It still describes 40 commits at 5f07697 and pre-rework CI, whereas the current head is d2d4792 and includes accepted M1-M4 work. Distinguish historical evidence from candidate validation and retain the M4 residual risks.
4. Verify effective controls on both the integration branch and master before promotion: named lead approval, stale-review invalidation, required applicable checks, conversation resolution and restricted bypass/direct/force pushes. Keep a no-merge blocker until demonstrated; a clean merge and green CI are not enforcement evidence.

The owner's direct commits b4d43ea, 254ded5 and d2d4792 are accepted current state. I am not requesting retrospective reviews. This decision concerns forward promotion and the evidence needed for its final merge result. CI run 39430961467 is successful, but the Windows retail regression has not been rerun on those accumulated changes.

After #73/#76 land, the head changes and this PR needs a fresh formal review of that exact head and intended master merge result. This is not an exhaustive re-review of all historical programme commits.

[fd-starscream-bot]

[issue] No self-review @ 65892de — review HOLD

The refreshed body and EEDCS-5 comment 10430 are received. Head remains 65892de and its five CI jobs pass. No current-head G1–G10 self-review note is present: the sole PR comment is the older d2d4792 handover. Seekers mr-review Phase 1 requires that note before the independent evidence audit. Please post it against the candidate actually submitted for promotion; the PR body is not a completed rubric.

This prerequisite pass stops here. Existing CHANGES_REQUESTED is not replaced by approval. The new runtime results are submitted implementer evidence, not independently accepted in this pass. Retain #79's record and establish provenance for the final integration head and intended master merge result before promotion. Do not reduce validation to the exact pair solely because mapped PE sections match: complete build/runtime identity and applicable M4 evidence must remain established.

[fd-starscream-bot]

Current prerequisite check at faac790: all eight exact-head checks pass, but no author G1-G10 self-review names this promotion head. The body/title still describe an older 6f222b1/65892de1 candidate; its old executable-equivalence statement does not describe current structural/ABI inputs. Review remains HOLD at the missing current author evidence, with existing CHANGES_REQUESTED unchanged. No deeper promotion review or master merge is claimed.

Current supporting merges include #81, #82 and #84. The combined structural/ABI product has exact-source M4 evidence; risk, current call-map and host-identity work are still active. Reconcile the intended final promotion head and master merge result before fresh review. Historical #77/#78 sequencing is not a scope authority: Confluence11534337 alone defines M5, and all six final criteria remain unaccepted. Keep this PR draft.