refactor: make production gate impact only

release-gate/report.test.mjs

@@ -187,5 +187,44 @@ test('impact report rejects missing core coverage and unmapped non-full paths',
   });
   assert.equal(result.valid, false);
   assert.match(result.errors.join('\n'), /missing core scenarios: AUTH-05/);
-  assert.match(result.errors.join('\n'), /unmapped runtime paths require a full Gate/);
+  assert.match(result.errors.join('\n'), /unmapped runtime paths block the impact Gate/);
+});
+
+test('policy version 2 rejects a full production impact strategy', async () => {
+  const catalog = await loadScenarioCatalog();
+  const selection = {
+    ...selectImpactScenarios({
+      catalog,
+      changedPaths: ['memory-v2-lifecycle.mjs'],
+    }),
+    strategy: 'full',
+    base_commit: 'c'.repeat(40),
+  };
+  const selected = new Set(selection.selected_ids);
+  const report = createGateReport({
+    commitSha: COMMIT,
+    branch: 'main',
+    artifactSha256: ARTIFACT,
+    artifact: { path: '.runtime/portal', kind: 'directory-tree' },
+    mode: 'impact',
+    selection,
+    scenarios: catalog
+      .filter((scenario) => selected.has(scenario.id))
+      .map((scenario) => ({
+        id: scenario.id,
+        name: scenario.name,
+        status: 'passed',
+        cleanup_status: 'not_required',
+        evidence: ['fixture'],
+      })),
+    completedAt: new Date('2026-07-26T10:00:00.000Z'),
+  });
+
+  const result = validateGateReport(report, {
+    expectedCommit: COMMIT,
+    expectedArtifactSha256: ARTIFACT,
+    now: new Date('2026-07-26T11:00:00.000Z'),
+  });
+  assert.equal(result.valid, false);
+  assert.match(result.errors.join('\n'), /impact strategy must be core or impact/);
 });