Fix shard-summary routing precedence for invalid summaries

[Copilot]

Pull Request

For EPIC-branch workflow PRs, use .github/PULL_REQUEST_TEMPLATE/epic-branch-flow.md.
This applies to both feature/* -> epic/* and epic/* -> develop integration PRs.

Target Version (Required)

Target Version: [Unreleased]

The change is a targeted bug fix for the current release line and does not introduce new product surface.

---

Description

The shard-summary coordinator was allowing an unrefreshed freshness record to override an explicitly invalid or stale advisory summary. In mixed-freshness routing, that reclassification could break the summary-first path exercised by CI.

• Routing semantics: preserve explicit summary freshness state (STALE/INVALID) over coordinator record state so invalid summaries keep the intended skip/escalate behavior.
• Behavior alignment: keep shard-summary routing consistent with the existing distributed-tensor contract and the mixed-freshness regression case.
• Scope: surgical change in the coordinator path only; no API or contract changes.

Linked Issues

Issue linkage is handled by repository automation.

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Refactoring (non-breaking)
• Documentation
• Breaking change (requires MAJOR version bump — see VERSIONING.md)
• Security fix
• Other:

Breaking Change Checklist

• MAJOR version bump planned in VERSION and CMakeLists.txt
• Migration guide added in docs/migration/
• Announcement prepared for GitHub Discussions (≥ 2 weeks before release)
• CHANGELOG ### Removed / ### Changed section updated

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• Benchmarks run (if performance-sensitive change)

Security Tiering Impact (Required for Runtime Changes)

• Impacted tier(s):

  • T0 Trusted Core
  • T1 Security & Platform Services
  • T2 Data Plane Engines
  • T3 Interface & Protocol Edge
  • T4 Managed Extension Runtime
  • T5 Plugin Boundary
  • N/A (docs-only / non-runtime)

• Trust-boundary crossings documented in PR description (example: T3 -> T2, T5 -> T4 brokered call)

• Boundary controls validated for affected T3/T4/T5 paths (AuthN/AuthZ, validation, rate limits, audit)

• Boundary-focused tests added/updated or explicit N/A rationale provided

• If trust level/privilege increased, security maintainer approval is attached

📚 Research & Knowledge (wenn applicable)

• Diese PR basiert auf wissenschaftlichen Paper(s) oder Best Practices?
  • Falls JA: Research-Dateien in /docs/research/ angelegt?
  • Falls JA: Im Modul-README unter "Wissenschaftliche Grundlagen" verlinkt?
  • Falls JA: In /docs/research/implementation_influence/ eingetragen?

Relevante Quellen:

• Paper:
• Best Practice:
• Architecture Decision:

AI-Generated Code (KI-generierter Code)

• Symbol-Referenzen mit GetSymbolReferences_CppTools geprüft (siehe .github/instructions/cpp-language-service-tools.instructions.md)
• Keine rohen Pointer und kein new/delete ohne explizites Review eingeführt
• RAII und Exception-Safety für neue/angepasste Pfade geprüft
• Keine unnötig komplexen KI-Abstraktionen eingeführt
• Performance-Metriken geprüft, falls Hotpath betroffen

AI Review Workflow (Required for AI-assisted PRs)

• Findings-first review performed with .github/prompts/pr-diff-findings-review.prompt.md
• Security hardening review performed for security-sensitive/runtime changes with .github/prompts/security-hardening-review.prompt.md (or N/A documented)
• API impact review performed for API/contract changes with .github/prompts/api-change-impact-review.prompt.md (or N/A documented)
• All Critical/High findings are resolved or explicitly accepted with rationale in PR description
• Residual risks and follow-up actions documented in PR description
• Severity policy applied according to .github/copilot/REVIEW_SEVERITY_POLICY.md

High-Finding Exception Record (only if High is accepted)

• High-finding exception claimed in this PR

• Finding reference:

• Maintainer approver:

• Mitigation in current release:

• Target fix milestone:

• Tracking issue:

• Validation evidence:

Release Readiness Gate (Required for release-scoped changes)

• Release readiness reviewed with .github/prompts/release-readiness-check.prompt.md for branch transition scope
• Branch governance validated against BRANCHING_STRATEGY.md and RELEASE_STRATEGY.md
• Versioning/changelog impact validated against VERSIONING.md and CHANGELOG.md

Checklist

• Code follows project style guidelines (clang-format / clang-tidy)
• Self-review completed
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased]
• No new warnings introduced
• Security-sensitive paths reviewed by security maintainer (if applicable)

Scanner and IntelliSense Gates

• IntelliSense/Compiler: no new errors in changed files
• clang-tidy/cppcheck: no new high-risk findings in changed files
• Gap Scanner: no new critical findings in categories security, input_validation, query_correctness, distributed_consistency, concurrency, memory
• Gap Scanner: no new high findings in the same categories (or explicitly approved)
• Gap Scanner delta report attached (baseline vs current), not only absolute totals
• New unknown scanner findings triaged (fixed, re-categorized, or justified)

• Fixes 🔴 Chronic Build Failures — Error Report #6239

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Wave C Policy Gate: Edition & License Validation

Result: ✅ Edition & License Validation PASSED
Workflow run: #33545903667
Triggered by: @Copilot

Checks

• ✅ Edition matrix consistency check
• ✅ License feature gate validation
• ✅ Enterprise/military marker detection
• ℹ️ Target branch: develop

See .github/workflows/gate-pr-edition-license.yml for details.

[github-actions]

✅ Wave C Policy Gate: Hash & SBOM Integrity

Result: ✅ Hash & SBOM Integrity PASSED
Workflow run: #33545903667
Triggered by: @Copilot

Checks

• ✅ Dependency hash integrity check
• ✅ SBOM generation and registry consistency
• ✅ Edition-correct SBOM composition
• ✅ Private plugin variance detection
• ℹ️ Approved SBOM registry: docs/governance/SBOM_APPROVED_VERSIONS.md

See .github/workflows/gate-pr-hash-sbom.yml for details.

[github-actions]

Target: pr

Doxygen Governance Gate

• Verdict: FAIL
• Base branch: develop
• Changed C/C++ files: 7
• Scoped modules: acceleration, distributed_tensor, query, security, storage, utils
• Release lane: no
• Phase 6 modules in scope: none
• Coverage enforced: no
• Coverage threshold: 95.0%
• Coverage result: skipped
• Coverage waiver active: no
• Approved waivers: none
• Structural findings: 23
• Advisory findings: 2
• Doxygen warnings: 0
• XML generated: yes

Changed source files

• include/utils/concurrent_cache.h
• src/acceleration/cpu_backend_tbb.cpp
• src/distributed_tensor/src/shard_summary_coordinator.cc
• src/query/parallel_executor.cpp
• src/query/query_engine.cpp
• src/security/field_encryption.cpp
• src/storage/backup_manager.cpp

Blocking structural findings

• include/utils/concurrent_cache.h:44 — Doxygen comment for 'insert' is missing @brief
• include/utils/concurrent_cache.h:44 — Doxygen comment for 'insert' is missing @PARAM for: key, value
• include/utils/concurrent_cache.h:50 — Doxygen comment for 'get' is missing @brief
• include/utils/concurrent_cache.h:50 — Doxygen comment for 'get' is missing @PARAM for: key
• include/utils/concurrent_cache.h:50 — Doxygen comment for 'get' is missing @return
• include/utils/concurrent_cache.h:60 — Doxygen comment for 'try_update' is missing @brief
• include/utils/concurrent_cache.h:60 — Doxygen comment for 'try_update' is missing @PARAM for: key, value
• include/utils/concurrent_cache.h:60 — Doxygen comment for 'try_update' is missing @return
• include/utils/concurrent_cache.h:71 — Doxygen comment for 'erase' is missing @brief
• include/utils/concurrent_cache.h:71 — Doxygen comment for 'erase' is missing @PARAM for: key
• include/utils/concurrent_cache.h:71 — Doxygen comment for 'erase' is missing @return
• include/utils/concurrent_cache.h:77 — Doxygen comment for 'contains' is missing @brief
• include/utils/concurrent_cache.h:77 — Doxygen comment for 'contains' is missing @PARAM for: key
• include/utils/concurrent_cache.h:77 — Doxygen comment for 'contains' is missing @return
• include/utils/concurrent_cache.h:83 — Doxygen comment for 'size' is missing @brief
• include/utils/concurrent_cache.h:83 — Doxygen comment for 'size' is missing @return
• include/utils/concurrent_cache.h:89 — Doxygen comment for 'clear' is missing @brief
• include/utils/concurrent_cache.h:95 — Doxygen comment for 'for_each' is missing @brief
• include/utils/concurrent_cache.h:95 — Doxygen comment for 'for_each' is missing @PARAM for: fn
• include/utils/concurrent_cache.h:95 — Doxygen comment for 'for_each' is missing @return
• ... 3 more

Advisory Doxygen findings

• include/utils/concurrent_cache.h:95 — Doxygen comment for 'for_each' is missing @tparam for: Func
• include/utils/concurrent_cache.h:28 — Class 'ConcurrentCache' is missing @tparam for: Key, Value

---

source_workflow: Gate: PR Doxygen Governance
source_run: 33545902544
source_sha: e233afd

[github-actions]

✅ Wave C Policy Gate: Community Fail-Closed Validation

Result: ✅ Community Fail-Closed Validation PASSED
Workflow run: #33545903667
Triggered by: @Copilot

Checks

• ✅ No silent fallback patterns
• ✅ License disclaimers present
• ✅ No unguarded telemetry/tracking
• ✅ No private plugin references in community/minimal scope
• ✅ Community-only build config validation
• ✅ No enterprise secrets leakage

See .github/workflows/gate-pr-community-failclosed.yml for details.

[github-actions]

✅ Wave C Policy Gate: Private Plugin Boundary Enforcement

Result: ✅ Private Plugin Boundary Enforcement PASSED
Workflow run: #33545903667
Triggered by: @Copilot

Checks

• ✅ Private plugin leakage detection
• ✅ Plugin manifest visibility validation
• ✅ Submodule commit-pin enforcement (no branch refs for private)

See .github/workflows/gate-pr-plugin-boundary.yml for details.