test: harden M3 trusted loop smoke path

scripts/validate-dev-gate-report.mjs

@@ -1386,6 +1386,9 @@ async function validateDevM3Report(report, label) {
   if (Object.hasOwn(report.safetyGates, "dryRunCallsLiveEndpoints")) {
     assert.equal(report.safetyGates.dryRunCallsLiveEndpoints, false, `${label}.safetyGates.dryRunCallsLiveEndpoints`);
   }
+  if (Object.hasOwn(report.safetyGates, "defaultSourceReadOnly")) {
+    assert.equal(report.safetyGates.defaultSourceReadOnly, true, `${label}.safetyGates.defaultSourceReadOnly`);
+  }
 
   assertArray(report.liveChecks, `${label}.liveChecks`);
   assert.ok(report.liveChecks.length >= 8, `${label}.liveChecks must include DEV M3 checks`);
@@ -1499,6 +1502,21 @@ async function validateDevM3Report(report, label) {
     assert.equal(plan.route, "res_boxsimu_1:DO1 -> hwlab-patch-panel -> res_boxsimu_2:DI1", `${label}.dryRunPlan.route`);
     assert.equal(plan.dryRunCallsLiveEndpoints, false, `${label}.dryRunPlan.dryRunCallsLiveEndpoints`);
     assert.equal(plan.liveWriteWillRun, false, `${label}.dryRunPlan.liveWriteWillRun`);
+    if (Object.hasOwn(plan, "failureClassifications")) {
+      assertStringArray(plan.failureClassifications, `${label}.dryRunPlan.failureClassifications`, { minLength: 5 });
+      for (const classification of [
+        "target_missing",
+        "identity_not_distinct",
+        "patch_panel_wiring_missing",
+        "operation_failed",
+        "evidence_missing"
+      ]) {
+        assert.ok(
+          plan.failureClassifications.includes(classification),
+          `${label}.dryRunPlan.failureClassifications missing ${classification}`
+        );
+      }
+    }
     assertStringArray(plan.liveWritePreconditions, `${label}.dryRunPlan.liveWritePreconditions`, { minLength: 4 });
     assertStringArray(plan.evidenceFields, `${label}.dryRunPlan.evidenceFields`, { minLength: 4 });
     assertArray(plan.endpointPlan, `${label}.dryRunPlan.endpointPlan`);