优化(08-28-production-arm-backup-transfer-incident): 收窄生产哈希读取

.trellis/spec/hyb-oa/deployment-trialrun.md

@@ -2872,6 +2872,12 @@ current shared mapping -> fine-grained stages + mutation listeners
   bytes and one of `production_single_point` or `no_proven_recovery_point`.
   Off-host staleness alone does not distinguish those two materially different
   production risks.
+- On an online production host, enumerate older local batches with manifest,
+  file-set, identity and byte metadata only. Fully hash exactly the newest
+  metadata-valid candidate; report older hashes as `NOT_RUN`. If that latest
+  candidate fails SHA-256, keep `no_proven_recovery_point` and do not fall back
+  to multi-GiB reads of older candidates during the same probe. ARM archive
+  validation remains full-contract because it is the backup node.
 - Inspect cleanup semantics as executable ordering, not a remembered claim.
   Source publication must precede transfer; local pruning must follow verified
   off-host finalize and success-state publication; generation staging must be
@@ -2959,6 +2965,10 @@ current shared mapping -> fine-grained stages + mutation listeners
   corruption and malformed manifest. Assert the risk classification and
   transition recommendation change without emitting paths, run ids, artifact
   names, raw diagnostics or tracebacks.
+- Fixture two metadata-valid production batches with a same-size hash mutation
+  in the older and then newest candidate. Assert only the newest candidate is
+  fully hashed, older hashes remain `NOT_RUN`, and a newest-candidate hash
+  failure does not trigger fallback reads.
 - Mechanically mutate the wrapper ordering so pruning appears before transfer;
   the cleanup/retention contract must turn false. A prose claim that failure
   retains data is not sufficient regression evidence.