feat(orchestrator): enforce Page Data validation gate

docs/architecture/memind-orchestrator-boundary.md

@@ -61,6 +61,15 @@ configuration from the Agent Run path, schedule background observations, or
 send data to the Orchestrator. Changing memindadm mode alone therefore cannot
 put existing Native traffic on the Shadow path.
 
+Page Data validation enforcement has a second independent Portal gate:
+`MEMIND_ORCHESTRATOR_PAGE_DATA_VALIDATION_GATE_ENABLED=1`. It is off by
+default and becomes effective only while Shadow wiring is effective. When
+enabled, a Page Data run remains `running` after the Native delivery guards
+finish until the Orchestrator checkpoints a `passed` validation observation.
+`failed`, `inconclusive`, not-selected, timeout, and unavailable outcomes fail
+closed and prevent the run from being marked successful. The Orchestrator still
+does not publish artifacts or receive user content in this mode.
+
 memindadm projects the requested and effective wiring states separately. Canary
 readiness requires `shadow_wiring_enabled=true`, so a saved Shadow mode with a
 closed Portal gate is visible and cannot be mistaken for a collecting Shadow
@@ -187,7 +196,9 @@ workspace paths, dataset contents, credentials, and database identifiers must
 not cross this boundary. The Orchestrator derives and checkpoints a
 `passed`/`failed`/`inconclusive` verdict and emits
 `workflow_validation_observed`. In the initial observation phase this verdict
-does not mutate the Native run result or publication state.
+does not mutate the Native run result or publication state. With the independent
+Page Data validation gate enabled, Portal waits for `passed` before committing
+the Native success transition; the default remains observation-only.
 
 The graph keeps three deterministic control-plane nodes: