P3 #144: fail-closed configured-static JIT readback proof

[masarray]

Stacked follow-up to draft PR #145. Base is intentionally fix/144-smart-interop-p0 so this slice does not race or overwrite the parallel P0-P2/canonical-convergence work.

Teamwork boundary

• PR P0-P2 #144: evidence-driven RCB interoperability and canonical static convergence #145 remains owner of P0-P2, canonical static convergence, type-aware mutation, diagnostics, and reduced configured-static eligibility.
• PR discovery: preserve exact primary type semantics in live SCL #138 remains owner of discovery/SCL primary-type semantic refinement/export.
• ARSAS PR #425 and #445 remain untouched.
• This stacked PR owns only configured-static activation proof after planning.

Why

A successful MMS write response is not enough to prove a report-control state transition. Planning evidence can also become stale between plan creation and the actual mutation.

The configured-static path already performed two whole-RCB reads after RptEna=true, but startup returned success without making those readbacks authoritative.

Changes

• add pure MmsConfiguredStaticActivationVerifier;
• pre-write JIT proof requires:
  • whole-RCB read succeeds;
  • exact RptEna=false;
  • no explicit live DatSet contradiction;
• JIT state capture now uses a minimal structure-first hot path instead of the broad diagnostic RCB scan;
• post-enable proof requires one exact JIT readback with RptEna=true; no unconditional duplicate read;
• if the structure read is incomplete, only the required leaves are probed;
• positive busy reservation/Owner evidence blocks; missing metadata remains missing evidence;
• missing DatSet text remains missing evidence unless an exact live DatSet read proves the binding empty;
• explicit DatSet contradiction fails closed;
• if write is accepted but readback is not proven, unregister monitor, disable RCB, release only reservation touched by this session, and return failure;
• no vendor branch, no retry guessing, no DataSet rewrite.

Safety intent

This is transactional/JIT evidence hardening only. It does not loosen dynamic mutation policy, does not change canonical planning, and does not claim InformationReport traffic proof yet. Actual traffic proof remains the next lifecycle/evidence layer.

Regression

Tests cover:

• unknown/already-enabled pre-state rejection;
• failed whole-RCB read rejection;
• positive DatSet contradiction vs missing DatSet evidence;
• one exact post-enable readback is sufficient;
• write-accepted/readback-false rejection;
• positive reservation/ownership blockers and exact-empty DatSet contradiction.

Performance contract

Typical configured-static activation no longer repeats the broad RCB diagnostic probe. The JIT path prefers one complete RCB structure read and falls back only to missing RptEna/DatSet/reservation/Owner leaves. It contains no fixed delay or polling sleep. Receiver registration still occurs before RptEna mutation, and actual InformationReport traffic remains asynchronous post-activation evidence rather than a prerequisite for enabling reporting.

Asynchronous traffic proof

Persistent report sessions now expose:

• ArmedAwaitingTraffic immediately after activation/readback is proven;
• TrafficProven only after a real InformationReport is decoded and routed to that exact monitor;
• FirstRoutedReportAt, LastRoutedReportAt, routed count and first-report latency.

This does not wait for traffic before enabling reporting and does not tear down a healthy armed RCB merely because no spontaneous report has arrived yet. GI/initial-image policy can remain a separately bounded caller decision.

For normal multi-field activation, exact scalar type evidence is prewarmed from one complete RCB TypeSpecification when named components are available; otherwise the existing per-leaf exact preflight remains the safe fallback.

The combined #145/#146/#147 exact integration head was validated in CI-only PR #148; head c0609d5c3f5711bff1a604aefc6f514f17fa502c passed .NET CI #747 end-to-end.