test: tighten M3 preflight blocker classifications

docs/m3-hardware-loop.md

@@ -92,8 +92,9 @@ node scripts/dev-m3-hardware-loop-smoke.mjs --live --confirm-dev --expect-non-pr
 ```
 
 The legacy `--confirmed-non-production` flag is accepted as compatibility, but
-new handoffs should use `--expect-non-prod`. The script refuses the default
-mode and refuses `--dry-run` combined with `--live`.
+new handoffs should use `--expect-non-prod`. Missing or incomplete live
+authorization stays on the source/read-only plan path, and `--dry-run` combined
+with `--live` remains no-write.
 
 The live smoke writes `reports/dev-gate/dev-m3-hardware-loop.json`. It first
 checks the frozen DEV endpoint, `http://74.48.78.17:16667`, and stops at the
@@ -113,9 +114,14 @@ HWLAB_DEV_PATCH_PANEL_URL
 ```
 
 Those targets must be two distinct HWLAB DEV simulator services for each
-simulator kind, plus one HWLAB DEV patch panel, not UniDesk substitutes. The
-script then checks two box simulators, two gateway simulators, active
-patch-panel wiring for
+box/gateway role, plus one callable HWLAB DEV patch panel, not UniDesk
+substitutes. Missing direct targets are classified as `target_missing`,
+duplicated box or gateway identities as `identity_not_distinct`, and missing
+`res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1` wiring as
+`patch_panel_wiring_missing`. Each of those stop conditions keeps
+`liveOperation.status` at `not_run` and prevents the DEV write/read smoke from
+starting. The script then checks two box simulators, two gateway simulators,
+active patch-panel wiring for
 `res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1`, a live direct
 call that reads `DI1=true`, and returned operation, trace, audit, and evidence
 identifiers. Fixture-backed local M3 output is never accepted as live DEV