修复(08-08-production-deployment-execution): 明确终止迁移回滚窗口依据

.trellis/spec/hyb-oa/deployment-trialrun.md

@@ -1611,6 +1611,12 @@ DEPLOY_SERVER=<approved-ssh-target> \
   committed row closes it. Once closed, an old application that does not know
   `terminated` cannot be restored and the new columns are never auto-dropped;
   recovery is roll-forward or a compatible hotfix.
+- Window evidence has two explicit bases. If the termination migration is not
+  in the applied set, do not issue the status query; record
+  `rollbackWindow=OPEN terminatedRows=0 basis=migration_not_applied`. If it is
+  applied, query `contract_registry.status = 'terminated'` and record
+  `basis=terminated_status_count`. Any query/parse failure in the applied branch
+  fails closed; it must never be caught and converted into `OPEN`.
 - The target identity must remain unchanged between the read-only preflight and
   the schema write; if a controlled change freeze cannot be established, stop
   before `deploy.sh` rather than relying on post-status to repair a wrong-target
@@ -1637,6 +1643,13 @@ DEPLOY_SERVER=<approved-ssh-target> \
   complete pre-status result.
 - Pending set differs from the approved allowlist -> `PAUSED` and retain the
   status artifact for human review.
+- Termination migration absent from the candidate manifest ->
+  `PROD_TERMINATION_MIGRATION_NOT_IN_CANDIDATE`; the window basis is unknown.
+- Termination migration not applied -> explicit `OPEN` with
+  `basis=migration_not_applied`, without querying the status value.
+- Termination migration applied but the count query fails or returns a
+  non-integer -> `PROD_TERMINATED_COUNT_UNAVAILABLE` or
+  `PROD_TERMINATED_COUNT_INVALID`; never default to `OPEN`.
 - `terminated` count greater than zero -> record `rollbackWindow=CLOSED` and
   disallow compatibility rollback; this task never creates such a row.
 
@@ -1650,6 +1663,9 @@ DEPLOY_SERVER=<approved-ssh-target> \
   a later approved deployment would activate.
 - Base: the remote helper exits zero with a readable Prisma marker and the
   wrapper continues into migration reconciliation.
+- Base: the approved termination migration is pending, so reconciliation passes
+  and the window is explicitly `OPEN` with `basis=migration_not_applied`; no
+  status query is attempted.
 - Bad: check for a missing marker before checking the remote exit and replace
   the real remote safety code with `PRISMA_STATUS_OUTPUT_MISSING`.
 - Bad: omit build SHA interpolation, use a seven-character Git abbreviation,
@@ -1673,6 +1689,10 @@ DEPLOY_SERVER=<approved-ssh-target> \
   its exact 12-character prefix as `VITE_BUILD_SHA`; reject malformed and
   individually valid-but-mismatched pairs. Static checks must prove there is no
   local-HEAD candidate fallback.
+- Cover both window bases: a pending termination migration must return explicit
+  `OPEN` without issuing the status query; an applied migration must query and
+  distinguish zero/positive counts. Force the applied-branch query to fail and
+  assert `PROD_TERMINATED_COUNT_UNAVAILABLE`, not `OPEN`.
 
 ### 7. Wrong vs Correct
 
@@ -1699,6 +1719,13 @@ provenance-verified commit -> BUILD_SHA + first 12 chars as VITE_BUILD_SHA
 -> interpolated docker compose config
 ```
 
+```text
+# Wrong: a missing column/query error happens -> catch -> assume OPEN.
+
+# Correct: migration not applied -> explicit OPEN without querying;
+# migration applied -> required count query, with any error stopping closed.
+```
+
 ## Scenario: Environment Recovery Classification And Secret Custody
 
 ### 1. Scope / Trigger