wip(rm-02): close all success output paths

docs/scratchpads/1029-rm-02-gate-registry.md

@@ -101,3 +101,4 @@ The queue guard's `get_state_from_status_json` runs `python3 - <<'PY'` while pro
 - Current focused evidence before independent review: remediation controls 4/4; verifier/wiring/remediation suite 39/39; canonical `pnpm gate:verify` exits zero while reporting six RM-03-owned `DEFECT` deltas and all seven gate meta-negative controls observed red.
 - Independent Codex code review requested changes on two valid blockers. First, the evidence population control called the subject helper directly rather than traversing production result consumption. It now creates one lightweight executed fixture per required gate, invokes the real `verifyRegistry` path, and fails to observe rejection if the production consumer is removed; a regression mutation proves that coupling. Second, a lexical history blacklist overclaimed structural incapacity. Production output now passes through a closed current-tree observation renderer with no history/ancestry/lineage success class; the exclusion control tests three alternate success wordings plus exact production renderer wiring, and the registered must-fail fixture adds a prohibited class.
 - Codex review test attempts were unrunnable in its read-only sandbox (`EROFS`/`EPERM`); the reviewer disclosed this rather than substituting a passing variant. Local writable-worktree tests remain the runnable evidence.
+- Renderer remediation: every non-error production observation and final summary now routes through the closed current-tree output renderer. The exclusion control additionally requires one stdout sink, exactly two `GATE VERIFY FAILED` stderr sinks, no console sinks, and renderer use for both per-observation and final-summary paths. Regression attacks cover allowlisted history/ancestry/lineage wording, writer assertion removal, direct final-success stdout, and direct success stderr; focused suite 41/41, `pnpm gate:verify` green with six declared RM-03 deltas, and format check green.

scripts/gate-history-exclusion-control.mjs

@@ -20,13 +20,24 @@ const accepted = prohibitedReports.filter((report) => {
 });
 
 const verifier = await readFile(path.join(process.cwd(), 'scripts', 'gate-verify.mjs'), 'utf8');
-const outputWrites = [...verifier.matchAll(/process\.stdout\.write\s*\(/g)].length;
+const stdoutWrites = [...verifier.matchAll(/process\.stdout\.write\s*\(/g)].length;
+const stderrWrites = [...verifier.matchAll(/process\.stderr\.write\s*\(/g)].length;
+const gatedErrorWrites = [...verifier.matchAll(/process\.stderr\.write\(`GATE VERIFY FAILED:/g)]
+  .length;
+const currentTreeWriterCalls = [...verifier.matchAll(/writeCurrentTreeOutput\s*\(/g)].length;
 const productionRendererWired =
-  outputWrites === 2 &&
-  /for \(const observation of observations\) \{\s*assertCurrentTreeObservation\(observation\);\s*process\.stdout\.write/s.test(
+  stdoutWrites === 1 &&
+  stderrWrites === 2 &&
+  gatedErrorWrites === 2 &&
+  currentTreeWriterCalls === 3 &&
+  /function writeCurrentTreeOutput\(output\) \{\s*assertCurrentTreeObservation\(output\);\s*process\.stdout\.write/s.test(
     verifier,
   ) &&
-  !/\bconsole\.(?:log|info|debug)\s*\(/.test(verifier);
+  /for \(const observation of observations\) \{\s*writeCurrentTreeOutput\(observation\);\s*\}/s.test(
+    verifier,
+  ) &&
+  /writeCurrentTreeOutput\(\s*`REGISTRY SUMMARY open behavior deltas:/s.test(verifier) &&
+  !/\bconsole\.(?:log|info|debug|error|warn)\s*\(/.test(verifier);
 
 if (accepted.length > 0 || !productionRendererWired) {
   process.stderr.write(

scripts/gate-remediation.test.mjs

@@ -204,7 +204,17 @@ test('production verification has a closed current-tree observation renderer', a
       '  /^META-NEGATIVE-CONTROL /,',
       '  /^PROVIDER LINEAGE SUCCESS /,\n  /^META-NEGATIVE-CONTROL /,',
     ],
-    ['renderer bypass', '      assertCurrentTreeObservation(observation);\n', ''],
+    ['writer assertion bypass', '  assertCurrentTreeObservation(output);\n', ''],
+    [
+      'final success stdout bypass',
+      '    writeCurrentTreeOutput(\n      `REGISTRY SUMMARY open behavior deltas: ${defects}; required-behavior conformance is not asserted while deltas remain`,\n    );',
+      "    process.stdout.write('COMMIT ANCESTRY VERIFIED\\n');",
+    ],
+    [
+      'direct success stderr bypass',
+      "    const defects = observations.filter((line) => line.startsWith('DEFECT ')).length;",
+      "    process.stderr.write('PROVIDER LINEAGE SUCCESS\\n');\n    const defects = observations.filter((line) => line.startsWith('DEFECT ')).length;",
+    ],
   ];
   for (const [name, find, replace] of attacks) {
     const fixture = await mkdtemp(path.join(os.tmpdir(), 'rm02-history-renderer-'));

scripts/gate-verify.mjs

@@ -410,6 +410,7 @@ const CURRENT_TREE_OBSERVATION_PATTERNS = [
   /^DEPLOYED IDENTITY UNAVAILABLE /,
   /^DEFECT /,
   /^COMPATIBILITY /,
+  /^REGISTRY SUMMARY open behavior deltas: [0-9]+; required-behavior conformance is not asserted while deltas remain$/,
 ];
 
 export function assertCurrentTreeObservation(observation) {
@@ -418,6 +419,11 @@ export function assertCurrentTreeObservation(observation) {
   }
 }
 
+function writeCurrentTreeOutput(output) {
+  assertCurrentTreeObservation(output);
+  process.stdout.write(`${output}\n`);
+}
+
 function validateClosedSchema(
   manifest,
   failures,
@@ -1203,8 +1209,7 @@ async function main() {
     const options = parseArgs(process.argv.slice(2));
     const { failures, observations } = await verifyRegistry(options);
     for (const observation of observations) {
-      assertCurrentTreeObservation(observation);
-      process.stdout.write(`${observation}\n`);
+      writeCurrentTreeOutput(observation);
     }
     if (failures.length > 0) {
       for (const failure of failures) process.stderr.write(`GATE VERIFY FAILED: ${failure}\n`);
@@ -1212,8 +1217,8 @@ async function main() {
       return;
     }
     const defects = observations.filter((line) => line.startsWith('DEFECT ')).length;
-    process.stdout.write(
-      `registry observations matched; open behavior deltas: ${defects}; required-behavior conformance is not asserted while deltas remain\n`,
+    writeCurrentTreeOutput(
+      `REGISTRY SUMMARY open behavior deltas: ${defects}; required-behavior conformance is not asserted while deltas remain`,
     );
   } catch (error) {
     process.stderr.write(`GATE VERIFY FAILED: ${error.message}\n`);