fix(quality): record current-tree trust boundary

scripts/gate-history.mjs

@@ -275,9 +275,18 @@ export async function verifyHistory({ root, manifest }) {
     return { failures, observations };
   }
   const onMain = isMainCommit(root, head);
+  // RM-02 execution boundary (RM-60, cross-reference RM-59), kept adjacent in both directions:
+  // DOES: run every registered current-tree gate and declared inerting mutation on PR CI,
+  // unprivileged and fail-closed.
+  // DOES NOT: execute a commit's own verifier in an isolated PR replay. PR-controlled code would
+  // otherwise need the namespace capability intended to contain that same code. That external
+  // trust boundary must be runner/provider-owned before any PR executable or config is evaluated.
+  observations.push(
+    `RM-02 EXECUTION BOUNDARY ${head}: DOES: verify the current tree and declared inerting mutations on every PR, unprivileged and fail-closed; DOES NOT: execute isolated per-commit verifier replay in repository-controlled CI; owner RM-60, cross-reference RM-59`,
+  );
   if (!onMain) {
     observations.push(
-      `PROVIDER ASSERTION DEFERRED ${head}: commit is not yet on main; prospective own-tree replay still runs, while retained merge evidence starts after merge`,
+      `PROVIDER ASSERTION DEFERRED ${head}: commit is not yet on main; retained provider evidence starts after merge and no replay success is inferred`,
     );
   }
 
@@ -302,20 +311,18 @@ export async function verifyHistory({ root, manifest }) {
       );
       continue;
     }
-    const replay = await replayCommit(root, commit);
-    if (replay.status !== 0 || replay.error || replay.signal) {
-      failures.push(
-        `${commit}: own-tree gate replay failed with exit ${String(replay.status)}${replay.signal ? ` signal ${replay.signal}` : ''}${replay.error ? ` error ${replay.error.message}` : ''}: ${(replay.stderr || replay.stdout || '').trim().slice(0, 500)}`,
-      );
-      continue;
-    }
-    observations.push(`TREE REPLAY ${commit}: own-tree gate verifier exited 0`);
+    observations.push(
+      `INTERMEDIATE REPLAY DEFERRED ${commit}: isolated own-tree execution is not performed by repository-controlled CI; owner RM-60, cross-reference RM-59; no success is inferred`,
+    );
     if (!onMain) {
       observations.push(
         `PROVIDER EVIDENCE ${commit}: DEFERRED until the commit is on main; no success is inferred`,
       );
       continue;
     }
+    observations.push(
+      `POST-MERGE DETECTION BOUNDARY ${commit}: protected isolated replay awaits RM-60; when available, a failure requires quarantine/revert and is detection, not pre-merge prevention`,
+    );
     if (evidence.state === 'terminal-failure') {
       failures.push(
         `${commit}: retained provider evidence is not terminal-success (${evidence.detail})`,