锁定虚拟HAL宏加载阻断证据

wasm-port/docs/sim-config-coverage-promotion-analysis.md

@@ -254,9 +254,32 @@ Release diagnostics validation now requires
 keep `inventoryBaselineUnchanged === true`, every row must have
 `nonMainFixture === true`, and `standaloneMainViolations` must stay empty.
 
-The next practical slice is to extend this report with one more non-main family
-such as `gscreen/silverdragon/macros/tool_sensor.ngc`, after proving the owning
-machine files and UI/process boundary do not cross into Python UI emulation.
+## 2026-06-18 Macro/Load Blocked Fixture Lock
+
+The macro/load report now also carries a blocked-fixture lock. This is a
+negative evidence gate: it proves selected macro/load paths are not included in
+positive virtual HAL fixtures when their owner boundary is still unavailable or
+outside the virtual HAL scope.
+
+The first blocked fixture rows are:
+
+- `gscreen/silverdragon/macros/tool_sensor.ngc`
+- `gmoccapy/macros/on_abort.ngc`
+
+`tool_sensor.ngc` is intentionally not promoted because the owning
+`gscreen/silverdragon/silverdragon.ini` machine file is not available in the
+vendored manifest, and promoting it would require a Python UI/process boundary
+proof rather than virtual HAL diagnostics alone. `gmoccapy/macros/on_abort.ngc`
+remains locked behind `L4-PYTHON-REMAP` and LinuxCNC-owned Python
+remap/prolog/epilog runtime proof.
+
+Release diagnostics validation now requires
+`blockedFixturePromotionViolations` to stay empty and requires both blocked
+rows to be excluded from positive macro/load fixtures. This prevents virtual
+HAL from accidentally unlocking Python UI or Python remap families.
+
+The next practical slice is to add a machine-readable candidate audit for other
+UI-family macro/load rows before promoting any new positive fixture.
 
 ## Boundary Statement