chore(runbooks): log merge-guard v4.4.55 post-install live-probe (#1100 CONVERGE-PASS)

[michael-wojcik]

Logs the dual-independent post-install live-probe of the installed v4.4.55 merge-guard retirement (#1100 op+target+bound_flags + the #1110 malformed-bound_flags fail-safe), per the gated-closure discipline.

Result: CONVERGE-PASS

Two clean-room-independent harnesses drove the installed merge_guard_post._retire_token_for_command (both asserted __file__ under the PACT/4.4.55/hooks cache path, not the dev tree) against a real on-disk token store across six scenarios, with full per-scenario agreement and zero exceptions:

• S1 friction-cure — a bare gh pr close 5 does not retire an approved escalated {close,5,[--delete-branch]} token (the merge-guard: raise Layer-1 retirement granularity to op+target+flags (bounded friction refinement) #1100 cure).
• S2/S3 escalated + flagless self-consume retire (.consumed) — the security job is preserved.
• S4a/S4b cross-flag survival, both directions (symmetric non-burn).
• S5 JSON-null bound_flags forced glob-first → skipped, no exception, and a later valid token still retires (no poison-the-loop).
• S6 unhashable [{}] element → skipped, no exception.

Security invariants intact on the shipped artifact: genuine self-consume still retires (no laundering window), the fail-safe never crashes the PostToolUse observer, and the sole residual is a tolerated under-retire backstopped by TTL(300s)+MAX_USES(2); over-block is structurally impossible for a rename-after-success observer.

Discharges the post-install gate for #1100 (fix shipped in #1110 / v4.4.55, squash fa3e876b).

Closes #1100

[Copilot]

Pull request overview

Adds an append-only runbook entry documenting the post-install, dual-independent live-probe results for merge-guard v4.4.55’s #1100 retirement granularity refinement (including the malformed-bound_flags fail-safe), discharging the gated-closure requirement recorded in the PR description.

Changes:

• Appends a new “merge-guard-1100-retirement-flag-axis-post-install-live-probe” section to the runbook.
• Records a 2026-07-05 v4.4.55 installed probe row with S1–S6 outcomes, independence evidence, and operational notes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.