fix: integrate reviewed LES normalization with explicit dev flow pins

tests/unit/test_les_flow_runner.py

@@ -41,45 +41,53 @@ class GuardTests(unittest.TestCase):
         with self.assertRaisesRegex(RuntimeError, "velocity/profile"):
             decode_macros(invalid, w, cx, cy)
 
-    def test_baseline_pins(self):
+    def test_current_corrected_pins(self):
         self.assertEqual(
-            source_guard(ROOT, "baseline")["base_commit"],
-            "cd3a657f9d3833e812c3cca173525f165b48710a",
+            source_guard(ROOT, "corrected", "dev8403956")["base_commit"],
+            "8403956a9afc0b0bb89265cec374392013d89016",
         )
 
     def test_corrected_and_tamper_guard(self):
-        pins = json.loads((HERE / "data/les_flow/source_pins.json").read_text())
+        pins = json.loads((HERE / "data/les_flow/source_pins_dev8403956.json").read_text())
         with TemporaryDirectory() as directory:
             root = Path(directory)
             for name in pins["sources"]:
                 dest = root / name
                 dest.parent.mkdir(parents=True, exist_ok=True)
                 shutil.copyfile(ROOT / name, dest)
-            # Rebuild the reviewed candidate from actual pinned headers, not fixtures.
-            candidate = root / "header_candidate"
-            subprocess.run(
-                [
-                    sys.executable,
-                    str(HERE / "les/prepare.py"),
-                    "--repo",
-                    str(ROOT),
-                    "--output-dir",
-                    str(candidate),
-                ],
-                check=True,
-            )
-            shutil.copyfile(candidate / "patched" / HEADER, root / HEADER)
             with patch(
                 "run_uniform_les_flow.subprocess.check_output",
                 return_value="isolated-fixture\n",
             ):
-                source_guard(root, "corrected")
+                source_guard(root, "corrected", "dev8403956")
                 with self.assertRaisesRegex(RuntimeError, "Source pin mismatch"):
-                    source_guard(root, "baseline")
+                    source_guard(root, "baseline", "dev8403956")
                 target = root / "src/CelerisLab/lbm/kernels/step/one_step_double.cu"
                 target.write_bytes(target.read_bytes() + b"\n// tamper\n")
                 with self.assertRaisesRegex(RuntimeError, "Source pin mismatch"):
-                    source_guard(root, "corrected")
+                    source_guard(root, "corrected", "dev8403956")
+
+    def test_historical_default_and_manifest_unchanged(self):
+        manifest = HERE / "data/les_flow/source_pins.json"
+        self.assertEqual(hashlib.sha256(manifest.read_bytes()).hexdigest(),
+                         "87ca033619da1fc02bee822bfc5681b518a92a155c3c3d1dbbe5265c96066b39")
+        for variant in ("baseline", "corrected"):
+            with self.assertRaisesRegex(RuntimeError, "Source pin mismatch"):
+                source_guard(ROOT, variant)
+
+    def test_named_baseline_accepts_only_reversed_header(self):
+        pins = json.loads((HERE / "data/les_flow/source_pins_dev8403956.json").read_text())
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            for name in pins["sources"]:
+                dest = root / name
+                dest.parent.mkdir(parents=True, exist_ok=True)
+                shutil.copyfile(ROOT / name, dest)
+            subprocess.run(["git", "apply", "--reverse", str(HERE / "les/data/smagorinsky_normalization.patch")], cwd=root, check=True)
+            with patch("run_uniform_les_flow.subprocess.check_output", return_value="baseline-fixture\n"):
+                source_guard(root, "baseline", "dev8403956")
+                with self.assertRaisesRegex(RuntimeError, "Source pin mismatch"):
+                    source_guard(root, "corrected", "dev8403956")
 
     def test_gpu_requires_opt_in_before_import(self):
         with TemporaryDirectory() as directory: