- reproduced the defect first: python3 helm-render.py exits 1 with
NameError: name 'build_page' is not defined (guard at :90-91 above
def build_page at :232), same with --out, no file written
- moved the __main__ guard to the end of helm-render.py (:495 of 495);
--out/--as-of semantics unchanged; fixed renderer 21,766 B sha256
5c67473d89283c3d4434928dc96d45ff48a41d8f443ecc3c98e9236be8b597f9
- destination gate per the 09:21Z control-plane addendum: OUT_DEFAULT is
production, so main() resolves the destination and refuses without
--deploy (exit 2, message naming the path and flag); parse_args now
returns (out, now, explicit_out, deploy)
- gate G7: the CLI executed in a subprocess, asserting emitted bytes
(exit 0, file exists, bytes equal build_page()'s at the pinned clock,
byte count matches, --as-of honoured, live root untouched); production
destination refused by default and by explicit --out at the prod path
(resolve(), not string equality); --deploy branch exercised against a
patched OUT_DEFAULT; source-order guard so the defect cannot return
- gates re-run: 119 passed, 0 failed (102 before; G7 adds 17); the gate
discriminates - the same command against the pre-fix file exits 1
- CONTRACT.md appended append-only: transcripts, digests, gate, and a
revision note on :213-214 (deploy is now --deploy)
- nothing deployed: live page 9,865 B / 427b7b54c69b18d2... and snapshot
aa842b0fd88037f8... unchanged before and after every run; --deploy
alone never executed
