fix(quality): prove criterion binding semantics

scripts/gate-history.test.mjs

@@ -15,6 +15,7 @@ import {
 const fixtureRoot = path.join(process.cwd(), '.mosaic-test-work', `gate-history-${process.pid}`);
 
 function sandboxUnavailable(result) {
+  if (result.sandboxLauncher !== 'bwrap' || result.sandboxEntered === true) return false;
   const detail = `${result.stdout ?? ''}${result.stderr ?? ''}${result.error?.message ?? ''}`;
   const bubblewrapSpawnDenied =
     ['EPERM', 'EACCES', 'ENOENT'].includes(result.error?.code) &&
@@ -56,6 +57,8 @@ test('sandbox refusal classification requires Bubblewrap provenance', () => {
       sandboxUnavailable({
         status: null,
         error: { code, message: `spawnSync bwrap ${code}` },
+        sandboxLauncher: 'bwrap',
+        sandboxEntered: false,
       }),
       true,
     );
@@ -71,6 +74,31 @@ test('sandbox refusal classification requires Bubblewrap provenance', () => {
     sandboxUnavailable({ status: 1, stderr: 'historical verifier said bwrap ENOENT' }),
     false,
   );
+  assert.equal(
+    sandboxUnavailable({
+      status: 1,
+      stderr: 'bwrap: Creating new namespace failed: Operation not permitted',
+      sandboxLauncher: 'bwrap',
+      sandboxEntered: false,
+    }),
+    true,
+  );
+  assert.equal(
+    sandboxUnavailable({
+      status: 1,
+      stderr: 'bwrap: Creating new namespace failed: Operation not permitted',
+    }),
+    false,
+  );
+  assert.equal(
+    sandboxUnavailable({
+      status: 1,
+      stderr: 'bwrap: Creating new namespace failed: Operation not permitted',
+      sandboxLauncher: 'bwrap',
+      sandboxEntered: true,
+    }),
+    false,
+  );
 });
 
 test('prospective history reads each commit own manifest rather than the current tree', async () => {
@@ -261,13 +289,13 @@ test('PR verification states the RM-60 boundary without executing an intermediat
     });
     assert.deepEqual(result.failures, []);
     assert.ok(
-      result.observations.some(
-        (observation) => /DOES:.*current tree.*DOES NOT:.*isolated.*RM-60.*RM-59/i.test(observation),
+      result.observations.some((observation) =>
+        /DOES:.*current tree.*DOES NOT:.*isolated.*RM-60.*RM-59/i.test(observation),
       ),
     );
     assert.ok(
-      result.observations.some(
-        (observation) => /INTERMEDIATE REPLAY DEFERRED.*RM-60.*no success is inferred/i.test(observation),
+      result.observations.some((observation) =>
+        /INTERMEDIATE REPLAY DEFERRED.*RM-60.*no success is inferred/i.test(observation),
       ),
     );
     assert.ok(result.observations.every((observation) => !/INTERMEDIATE INERT/.test(observation)));