fix: 修复迁移预检状态误判（09-06-release-gate-integrity）

.trellis/spec/hyb-oa/deployment-trialrun.md

@@ -2441,6 +2441,12 @@ run_logged_deploy_stage "build-init" "${compose_cmd[@]}" build init
   stop before Compose config and Prisma status.
 - Status output missing/unreadable, failed/rolled-back/diverged history or an
   unknown pending migration -> `PAUSED`; do not reset or resolve in place.
+- Status predicates use one `status_matches` helper with direct here-string
+  input, not `printf | grep -q` under pipefail. An early-exiting consumer can
+  yield producer=141/consumer=0 and falsely skip unknown-pending rejection.
+  Matcher exit 0 means match, 1 means no match, any other status immediately
+  fails with `PROD_MIGRATION_STATUS_UNREADABLE`. Preserve candidate/history
+  reconciliation; do not infer safety from the absence of parsed pending IDs.
 - Non-zero remote exit with a safe `code=...`, with or without a Prisma marker
   -> propagate that code and stop. Non-zero exit without a parseable code ->
   `PRODUCTION_PREFLIGHT_REMOTE_FAILED`; never continue to marker validation.
@@ -2484,6 +2490,11 @@ run_logged_deploy_stage "build-init" "${compose_cmd[@]}" build init
 - `bash -n deploy/trialrun/production-preflight-remote.sh`.
 - `node deploy/trialrun/validate-env-contract.js`.
 - `cd server && npm test -- tests/unit/scripts/deployment-safety-contract.test.js`.
+- Inject the observed producer 141 into the actual status parsing/rejection
+  source; restored old-predicate mutation must demonstrate lost rejection.
+  Cover safe/allowlisted/unknown/unsafe/unreadable states, 96 KiB trailing output
+  and matcher failure. The multi-subprocess remote fixture has a bounded 15 s
+  test budget (not a production timeout change); assertions are unchanged.
 - Static ordering must prove production preflight precedes `deploy.sh`, and the
   remote status marker precedes migration-history reconciliation. Fixtures must
   reject loopback/staging target identities without invoking SSH.