test(dst): stop the milestone driver re-merging a merged branch

[azimafroozeh]

What & why

The DST milestone driver emitted BranchMerge gated only on branch existence, ignoring the model's merge-and-close invariant (BranchSlot::merged). When a sampler merge consumed the milestone branch first, the milestone step merged it again; predict_merge mispredicted conflict on rows the first merge had already adopted, the engine correctly accepted the no-op re-merge, and Store(Claim)/MergePrediction fired a false alarm (2026-09-01 nightly, det shard 2, seed 218120). Harness bug, no engine defect.

• Milestone::MergeBranch now treats a merged (or deleted, never recreatable) milestone branch as satisfied and advances, mirroring the sampler's own filter.
• debug_assert!(!slot.merged) at both prediction sites (apply_world, expects_merge_conflict) makes any future emitter bug fail loudly at the emitter.
• Pin dst_milestone_never_remerges_merged_branch replays the exact nightly universe green: strict replay, zero crashes.

Backing issue / RFC

• No GitHub issue; found by DST nightly triage (accepted RFC: docs/rfcs/0037-deterministic-simulation-harness.md).

Checklist

• Change is focused (one logical change)
• Tests added/updated for behavior changes (new pin; red with the guard reverted, byte-identical to the nightly violation)
• Public docs updated if user-facing surface changed (internal harness, none)
• Reviewed against docs/dev/invariants.md — no Hard Invariant weakened, no deny-list item hit

Local verification

• cargo test -p omnigraph-dst: green (0 failed); the new pin red pre-fix at op 9 with the exact nightly signature
• cargo clippy --workspace --all-targets --locked -- -D warnings -W clippy::dbg_macro and cargo fmt --all --check: clean

Notes for reviewers

• Merge-and-close is enforced at the milestone emitter plus the debug_assert backstop; a single op_is_legal chokepoint for all emitters is the tracked follow-up.
• Pre-fix, benign re-merges occasionally delivered extra window crossings; the reach-census floor still holds, and re-merge coverage returns with the planned weak-oracle follow-up.
• The guard draws no RNG, so pinned op streams are unchanged (full suite confirms). This retires one of the two MergePrediction roots; the born-on-both reds remain until bug: merge duplicates an edge added on both sides of the fork, and plain traversal hides the extra row #583's fix merges.

Greptile Summary

The PR prevents the deterministic simulation milestone driver from emitting a second merge after its branch has already been merged or permanently removed.

• Advances the milestone when its branch is absent or marked merged.
• Adds debug assertions at merge-prediction boundaries to expose invalid emitters.
• Preserves the original conflict prediction when keep-serving arbitration already judged the interrupt.
• Adds a pinned deterministic replay regression scenario for the nightly failure.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/omnigraph-dst/src/harness.rs	Aligns milestone merge emission with the model’s merge-and-close invariant and avoids re-predicting an already-judged interrupt.
crates/omnigraph-dst/tests/scenarios.rs	Adds a deterministic regression pin confirming the milestone branch is merged once with zero crashes and strict replay stability.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into 0094_dst_milest..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Deterministic simulation and fault testing

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.