[ORESoftware]

Summary

Add the independent black-box acceptance canary required by Linear DEN-3488 for zed-pkg/zed-cli#315.

The canary builds the exact pinned zed executable and drives the public command against:

A@1 -> B@1 -> A@2 -> B@0 -> A@2

Public-CLI assertions

The Linux and macOS matrix verifies that:

• the product checkout exactly matches immutable SHA ebe42c6385aacdbfe3d37d17a253e900db1bc8a1
• the release zed binary builds from that SHA
• zed graph materialize keeps A1/A2 and B1/B0 as four exact nodes
• terminal output names A2, B0, the closing edge, and canonical-node symlink reuse
• the generation contains exactly four canonical node directories
• all dependency edges and source payloads are symlinks, not recursive copies
• the closing B@0 -> A@2 link targets the first canonical A2 node
• a second run reuses the same generation and materialization digest
• copy mode rejects the cyclic graph before creating zed_modules
• the product's own executable regression runs at the same pinned SHA

Failure diagnostics are bounded and uploaded for seven days.

Scope boundary

This canary exercises the public exact resolved-graph materializer. It does not claim ordinary .zpkg.toml constraint solving or .zpkg.lock v1 have completed the multiversion migration; that follow-up remains documented in the product PR.

Validation

Shell syntax and immutable-pin preflight passed before enabling the matrix:

• https://github.com/zed-pkg-test/zed-pkg-e2e/actions/runs/33786319421

The enabled Linux/macOS product run is attached here:

• https://github.com/zed-pkg-test/zed-pkg-e2e/actions/runs/33787087339

Linear: DEN-3488
Product PR: zed-pkg/zed-cli#315
Independent model PR: zed-pkg-test/version-solver-e2e#3
Logger prerequisite: ores-otel/ores.otel.log#45

[linear-code]

DEN-3488

[ORESoftware]

DEN-3488 exact-head refresh

This canary now pins product integration commit 86d499aff19807cee3500777ee4a9e48ea646821, the two-parent zed-pkg/zed-cli#315 head that is ahead-only on current product main (5d0cbc0609703e7516e2185ea3c1749c9feda482).

The prior red macOS product-regression step ran against stale pin ebe42c6385aacdbfe3d37d17a253e900db1bc8a1. Its independent black-box symlink assertions passed; the subsequent product regression exposed the macOS /var versus /private/var canonical-path issue that was repaired before 8c0537e… and retained in current head 86d499a….

Promotion criteria for this PR:

• independent executable fixture passes on Linux and macOS;
• terminal output includes the deterministic cycle witness and exact A2/B0 identities;
• exactly four canonical payload nodes and four symlink dependency edges are observed;
• the closing B0→A2 edge resolves to the original A2 node;
• second materialization reuses the generation/digest;
• copy mode fails before producing a recursively copied tree;
• pinned product regression suite passes on the same exact SHA.

This PR does not claim ordinary manifest/lockfile-v1 multiversion solving; it certifies the explicit exact-graph contract.