From 56d06bd6cc6d692eea46f4a987c570d6d0ef4a72 Mon Sep 17 00:00:00 2001
From: whyour <imwhyour@gmail.com>
Date: Thu, 13 Aug 2026 12:45:45 +0800
Subject: [PATCH] test(ql3): fail closed on PostgreSQL HA gates

---
 scripts/ql3-postgres-ha-contract.cjs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/scripts/ql3-postgres-ha-contract.cjs b/scripts/ql3-postgres-ha-contract.cjs
index 259c11b7..79eba3ae 100644
--- a/scripts/ql3-postgres-ha-contract.cjs
+++ b/scripts/ql3-postgres-ha-contract.cjs
@@ -12303,7 +12303,7 @@ async function main(argv = process.argv.slice(2)) {
           pluginPackageQuarantine.promptExecution.afterPromotion.catalog
             .found &&
           pluginPackageQuarantine.promptExecution.afterPromotion.catalog
-            .publicationState === 'active' &&
+            .publicationState === 'withdrawn' &&
           pluginPackageQuarantine.promptExecution.afterPromotion.catalog
             .templateFieldAbsent &&
           pluginPackageQuarantine.promptExecution.afterPromotion.catalog
@@ -12615,6 +12615,13 @@ async function main(argv = process.argv.slice(2)) {
         'domain COMMIT-response-loss faults are injected at the PostgresClient boundary, not by dropping raw PostgreSQL protocol packets',
       ],
     };
+    assert.deepEqual(
+      Object.entries(report.gates)
+        .filter(([, passed]) => passed !== true)
+        .map(([name]) => name),
+      [],
+      'PostgreSQL HA gates must all pass before evidence publication',
+    );
   } catch (error) {
     const logs = {};
     for (const containerName of [names.primary, names.standby]) {