fix(quality): anchor quantified registry populations

scripts/gate-history.mjs

@@ -23,6 +23,11 @@ export async function listProspectiveCommits(root, activationCommit, head = 'HEA
 }
 
 export function deriveHistoryBoundary(root, head = 'HEAD') {
+  const targetRef = 'refs/remotes/origin/main';
+  const target = git(root, ['rev-parse', '--verify', targetRef], { allowFailure: true });
+  if (target.status !== 0 || !target.stdout.trim()) {
+    throw new Error(`history boundary cannot be derived: provider target ${targetRef} is absent`);
+  }
   const introductions = git(root, [
     'log',
     '--first-parent',
@@ -40,13 +45,23 @@ export function deriveHistoryBoundary(root, head = 'HEAD') {
     throw new Error('history boundary cannot be derived: registry introduction is absent');
   }
   const introductionCommit = introductions[0];
-  const parent = git(root, ['rev-parse', `${introductionCommit}^`], { allowFailure: true });
-  if (parent.status !== 0 || !parent.stdout.trim()) {
+  const headOnTarget = git(root, ['merge-base', '--is-ancestor', head, targetRef], {
+    allowFailure: true,
+  });
+  const activation =
+    headOnTarget.status === 0
+      ? git(root, ['rev-parse', `${head}^`], { allowFailure: true })
+      : git(root, ['merge-base', head, targetRef], { allowFailure: true });
+  if (activation.status !== 0 || !activation.stdout.trim()) {
     throw new Error(
-      `history boundary cannot be derived: registry introduction ${introductionCommit} has no parent`,
+      `history boundary cannot be derived: provider target merge-base for ${head} is unavailable`,
     );
   }
-  return { activationCommit: parent.stdout.trim(), introductionCommit };
+  return {
+    activationCommit: activation.stdout.trim(),
+    introductionCommit,
+    targetRef,
+  };
 }
 
 export async function readManifestAtCommit(root, commit) {
@@ -342,6 +357,13 @@ export async function verifyHistory({ root, manifest }) {
     return { failures, observations };
   }
   const onMain = isMainCommit(root, head);
+  // RM-02 history bootstrap boundary (Builds 1-2), kept adjacent in both directions:
+  // DOES: anchor feature history to the provider target merge-base, sound against an author who
+  // cannot rewrite main.
+  // DOES NOT: establish integrity when main itself is compromised; Builds 1-2 own that residual.
+  observations.push(
+    `RM-02 HISTORY BOOTSTRAP BOUNDARY ${head}: DOES: anchor the audited range to provider target ${boundary.targetRef} at merge-base ${boundary.activationCommit}, sound against a branch author who cannot rewrite main; DOES NOT: protect against compromise or rewrite of main; residual owner Builds 1-2`,
+  );
   // RM-02 execution boundary (RM-60, cross-reference RM-59), kept adjacent in both directions:
   // DOES: run every registered current-tree gate and declared inerting mutation on PR CI,
   // unprivileged and fail-closed.