release/3.4 perlu menerima:
- security fix A
- bug fix B
- test stabilization C
- config compatibility D
- revert E karena fix B terlalu luas
- follow-up F karena branch lama tidak punya helper baru

Cherry-pick train = ordered patch series + target release branch + verification gate + audit trail

# Biasanya berbahaya untuk release lama
 git switch release/3.4
 git merge main

Maintenance branch menerima selected patches, bukan entire future history.

 git show --stat --patch <sha>
 git log --oneline --decorate --ancestry-path <base>..<sha>
 git branch -r --contains <sha>
 git log -S 'buggySymbol' --all -- path/to/file

train: BACKPORT-2026-07-SEC-1842
target: release/3.4
source: origin/main
base: 8f2a111
owner: release-engineering
risk: high
reason: security + production correctness
patches:
  - source: a1b2c3d
    title: "fix(auth): reject expired delegated token"
    strategy: cherry-pick-x
    required: true
    tests:
      - DelegatedTokenExpiryTest
  - source: b2c3d4e
    title: "test(auth): cover delegated token expiry"
    strategy: adapt-test
    required: true
  - source: c3d4e5f
    title: "refactor(auth): extract token clock"
    strategy: exclude
    reason: "too broad; manual equivalent used"
  - source: d4e5f6a
    title: "fix(auth): inject stable clock"
    strategy: manual-equivalent
    equivalent_commit: TBD
gates:
  - unit
  - integration
  - artifact-smoke
  - security-review

 git fetch origin --prune --tags
 git switch -c backport/3.4/BACKPORT-2026-07-SEC-1842 origin/release/3.4

 git rev-parse HEAD
 git log -1 --decorate --oneline

Stale base = conflict surprise + accidental non-fast-forward PR + wrong test evidence

types/constants -> helper/API -> behavior fix -> test -> documentation/release note

A: add missing enum value
B: fix parser to reject invalid enum transition
C: add regression test
D: update release note

A -> B -> C -> D

# File-level history
 git log --oneline -- path/to/file

# Search introduction of symbol
 git log -S 'TokenClock' --all -- path/to/file

# Show commit parents and context
 git show --summary --pretty=fuller <sha>

# List source range
 git log --oneline --reverse <merge-base>..origin/main -- path/to/file

 git cherry-pick -n <sha1>
 git cherry-pick -n <sha2>
 git status
 git diff --staged
 git commit -m "fix(auth): backport delegated token expiry handling"

 git cherry-pick -x <sha>

Backport-of: <sha1>, <sha2>
Equivalent-to: <sha3>
Excluded: <sha4> because release/3.4 lacks TokenClock abstraction

Backport-train: BACKPORT-2026-07-SEC-1842
Target-release-line: 3.4.x
Source-commit: a1b2c3d
Original-PR: #9231
Issue: AUTH-1842
Security-Advisory: GHSA-xxxx-yyyy-zzzz

 ./gradlew test --tests DelegatedTokenExpiryTest

 ./gradlew test integrationTest

 git config rerere.enabled true
 git config rerere.autoupdate false

 git status
 git diff
 # resolve
 git add <files>
 git cherry-pick --continue

rerere reduces repeated mechanics; it does not replace domain judgment.

# Abort seluruh cherry-pick yang sedang berjalan
 git cherry-pick --abort

# Skip commit bermasalah dalam sequence
 git cherry-pick --skip

# Continue setelah conflict resolved
 git cherry-pick --continue

# Inspect state
 git status
 git rev-parse CHERRY_PICK_HEAD

# 1. Stop; jangan commit random
 git status

# 2. Jika sedang dalam cherry-pick dan ingin kembali ke awal sequence
 git cherry-pick --abort

# 3. Jika sudah ada beberapa commit sukses, buat backup ref
 git branch backup/backport-3.4-before-redo

# 4. Reset ke base train jika memang ingin ulang
 git reset --hard <recorded-train-base>

# 5. Reapply berdasarkan manifest

# Compare source patches not yet in target by patch-id-ish logic
 git cherry -v origin/release/3.4 origin/main

# Show commits in source not reachable from target
 git log --oneline origin/release/3.4..origin/main

# Search exact behavior
 git log -S 'rejectExpiredDelegatedToken' origin/release/3.4 -- path/to/file

+ commit likely not applied upstream/target
- equivalent patch likely already applied

## Cherry-pick Train

Target: `release/3.4`
Train ID: `BACKPORT-2026-07-SEC-1842`
Source: `origin/main`
Base: `<sha>`

## Included Patches

| Source | Strategy | Result Commit | Notes |
|---|---|---|---|
| `a1b2c3d` | `cherry-pick -x` | `111aaaa` | clean |
| `b2c3d4e` | adapted test | `222bbbb` | test harness differs |
| `c3d4e5f` | excluded | N/A | refactor too broad |
| `d4e5f6a` | manual equivalent | `333cccc` | branch lacks TokenClock |

## Verification

- [ ] Unit regression test
- [ ] Integration test
- [ ] Artifact smoke test
- [ ] Security review
- [ ] Release note

## Risk

Explain behavior surface and rollback plan.

20 cherry-picked commits, many intermediate broken states, noisy review.

One giant maintenance commit with 12 unrelated fixes.

One commit per independent fix intent, or one commit per tightly coupled patch group.

# Before rewrite, mark old train
 git branch snapshot/backport-3.4-v1

# Rewrite train
 git rebase -i origin/release/3.4

# Compare old train vs new train
 git range-diff origin/release/3.4...snapshot/backport-3.4-v1 origin/release/3.4...HEAD

A: fix cache expiry
B: optimize cache invalidation
C: revert B because release/3.4 cache library differs
D: add release/3.4-specific guard

 git revert <bad-backport-sha>

 git rebase -i origin/release/3.4

Checkout main, apply patch, run tests.

Checkout PR merge result against release/3.4, run release/3.4 pipeline.

[ ] Fetch depth sufficient for merge-base and tags.
[ ] Correct target branch checked out.
[ ] Version metadata generated from target branch/tag policy.
[ ] Test matrix matches release branch dependencies.
[ ] Artifact built as release branch artifact, not main artifact.
[ ] Deployment smoke uses release branch config.

Allowed:
- critical bug fixes
- security fixes
- data-loss fixes
- compatibility fixes required by supported customer environment
- narrowly scoped test fixes needed to verify above

Disallowed:
- new feature behavior
- broad refactor
- dependency upgrades unless required for security/support
- formatting-only changes
- migrations unrelated to the fix
- performance optimization without production incident/risk case

Train: BACKPORT-2026-07-SEC-1842
Target: release/3.4 @ 8f2a111
Branch: backport/3.4/BACKPORT-2026-07-SEC-1842

Patch a1b2c3d: applied as 111aaaa, clean cherry-pick
Patch b2c3d4e: applied as 222bbbb, adapted test harness
Patch c3d4e5f: excluded, refactor too broad
Patch d4e5f6a: applied as 333cccc, manual equivalent

Verification:
- unit: PASS
- integration: PASS
- artifact smoke: PASS
- security review: PENDING

 git rev-parse HEAD
 git log --oneline --decorate origin/release/3.4..HEAD
 git show --stat --format=fuller <commit>
 git branch -r --contains <source-sha>
 git cherry -v origin/release/3.4 origin/main

set -euo pipefail

git fetch origin --prune --tags
git switch -c "$TRAIN_BRANCH" "origin/$TARGET_BRANCH"

for sha in $PATCHES; do
  echo "Applying $sha"
  git cherry-pick -x "$sha" || {
    echo "Conflict while applying $sha"
    echo "Resolve, then run: git cherry-pick --continue"
    exit 1
  }
done

Wave 1: prerequisite compatibility patches
Wave 2: security behavior fixes
Wave 3: tests and release note

[ ] Do I understand why each patch is included?
[ ] Do I understand why excluded source commits are excluded?
[ ] Does order reflect dependencies?
[ ] Are all conflicts resolved semantically?
[ ] Is patch minimal for maintenance branch?
[ ] Are tests relevant to target branch?
[ ] Does commit message preserve source traceability?
[ ] Is forward-port/backport matrix closed?
[ ] Is rollback strategy clear?
[ ] Does release note match actual patch set?

 git show --stat --patch <sha>
 git diff origin/release/3.4..HEAD --stat

 git log -S 'helperName' --all -- path/to/file
 git grep 'helperName' origin/release/3.4

 git branch snapshot/backport-3.4-before-rewrite
 git push --force-with-lease
 git range-diff origin/release/3.4...snapshot/backport-3.4-before-rewrite origin/release/3.4...HEAD

mkdir git-train-lab
cd git-train-lab
git init
mkdir src test
cat > src/auth.txt <<'EOF'
token_ttl=3600
allow_delegated=true
EOF
git add .
git commit -m 'init auth module'

git switch -c release/1.0

git switch main
cat > src/auth.txt <<'EOF'
token_ttl=3600
allow_delegated=true
clock=system
EOF
git add .
git commit -m 'refactor(auth): add token clock config'

cat > src/auth.txt <<'EOF'
token_ttl=900
allow_delegated=true
clock=system
reject_expired_delegated=true
EOF
git add .
git commit -m 'fix(auth): reject expired delegated token'

echo 'test delegated expiry' > test/auth_expiry.txt
git add .
git commit -m 'test(auth): cover delegated token expiry'

git switch -c backport/1.0/auth-expiry release/1.0

# Try direct cherry-pick fix commit
git cherry-pick -x main~1

cat > src/auth.txt <<'EOF'
token_ttl=900
allow_delegated=true
reject_expired_delegated=true
EOF
git add src/auth.txt
git cherry-pick --continue

git cherry-pick -x main

git log --oneline --decorate --graph --all
git show --stat HEAD~1
git show --stat HEAD

Train success is not “all cherry-picks applied cleanly”. Train success is “target release line receives the intended behavior safely”.

[ ] PR review by release owner
[ ] Domain owner approval
[ ] Required CI for target branch
[ ] No direct push
[ ] No force push
[ ] Required signed tags for release
[ ] Required status check for backport manifest completeness

[ ] Traceability to issue/incident/change request
[ ] Approval record
[ ] Test evidence archived
[ ] Artifact digest recorded
[ ] Deployment window recorded

[ ] All required patches included or explicitly excluded with reason.
[ ] All manual equivalents documented.
[ ] Target branch CI green.
[ ] Regression scenario verified.
[ ] Release owner approved.
[ ] Security/compliance approved if applicable.
[ ] Release note prepared.
[ ] Next forward-port/backport work tracked.

[ ] New release tag created.
[ ] Artifact built from tag.
[ ] Runtime version metadata checked.
[ ] Deployment evidence linked.
[ ] Train manifest archived.

Invariant 1: A maintenance train must have explicit target branch and base SHA.
Invariant 2: Patch order must reflect dependency, not convenience.
Invariant 3: Every included patch has a source, strategy, and verification note.
Invariant 4: Every excluded patch has a reason.
Invariant 5: Every manual equivalent patch links back to its semantic source.
Invariant 6: Conflict resolution is reviewed as domain logic.
Invariant 7: CI runs against the maintenance branch context.
Invariant 8: Train revisions after review are explained with range-diff or equivalent summary.
Invariant 9: Public maintenance branch repair uses revert/follow-up, not history deletion.
Invariant 10: Release tag is created only after train merge and verification.