[masarray]

Need / provenance

GitHub Actions always downloads artifact as ZIP even for one executable; operators specifically request direct portable/installer .exe links for fast FAT handoff. DigSubAnalyzer's direct setup.exe links originate from published GitHub Release assets, not CI artifacts. Existing ARSAS stable v1.6.41 has the same delivery pattern, but cannot be misrepresented as current #659.

Safe implementation (NOT auto-published)

• Manual-only workflow .github/workflows/fat-direct-exe.yml with no PR/push/tag publishing triggers. Requires explicit typed consent PUBLISH PUBLIC NONPRODUCTION FAT EXE, optional reviewer-controlled fat-preview-publication GitHub Environment, and source SHA + successful exact-head Windows Build run.
• Fail closed unless all current exact-SHA checks are completed and successful (>=10). Verify run name, exact source SHA, status, executable PE signatures, compute SHA256, publish receipts/checksums. Optional installer must separately pass the exact same SHA Windows installer gate.
• Only when manually authorized, create an immutable GitHub prerelease tag fat-<sha12> (never latest/stable). Direct asset links ARSAS-FAT-<sha12>-win-x64-portable.exe and optionally matching setup.exe. No overwrite of existing tags, no changes to production release/version/metadata/engine.
• Offline positive/negative Python regression rejects mismatched SHA, uncompleted/failed run, disguised ZIP, invalid PE and wrong workflow.
• Full operator setup and explicit limitation documented at docs/FAT_DIRECT_EXE_DOWNLOADS.md.

Preserve P0 chain

Stacks on existing 11/11 qualified P0 parent #659 1371c2990c40356acb1794bfa42c76e408421b47, which includes confirmed ZIVAVR Quality fix (#658), parent Data Model SG scalar reuse and bounded child-evidence projection. Pin exact ARIEC61850 engine #184 9c7cb40364023a7b217e5ec31ab3105ba90142eb unchanged. PR remains draft; no production promotion or public preview has occurred. This CI infrastructure proposal must be approved before being separately put on default branch, then the user must manually dispatch it to obtain actual EXE asset URLs. Build from #659 is not relabeled as direct EXE before publication.

[masarray]

D28: historical branch retired from the open integration queue by owner direction. Current operator-accepted evidence and published ARSAS baseline replace the old trial/capture workflow. No new capture is requested or required for archiving this PR. Close as not merged, preserve exact old HEAD 6cd9a1d0469071b2fc8dbd3b4a8a2ba1166c0b2d, source diff and all field conversations. Do not interpret closure as verification that unique code from this old candidate is present in the current release or as a waiver of any safety test. Accepted app, GitHub release and trial-engine pin remain unchanged.