instar 1.3.974 → 1.3.976

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.974",
+  "version": "1.3.976",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-26T02:08:55.331Z",
-  "instarVersion": "1.3.974",
+  "generatedAt": "2026-07-26T02:45:59.451Z",
+  "instarVersion": "1.3.976",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "9cda21e349af7f9e1b0817a7a5aba7e54e0325a4c15ab3563ff87637aacb8515",
+      "contentHash": "c55d95e9a2af479f5ae1cbb258308581b4f272b7b7722c5e876f636089d5acce",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.975.md

@@ -0,0 +1,21 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixed the guard-posture summary's false all-clear shape. `GET /guards` now returns `summary.loadBearingUninspectableKeys`, listing load-bearing guards whose existing posture is `missing`, `errored`, `on-stale`, or `off-runtime-divergent`. These guards remain excluded from `loadBearingGapKeys`, and `GuardPostureProbe` keeps emitting only their existing anomaly class, so the read surface becomes complete without changing classification or double-alarming.
+
+## What to Tell Your User
+
+The guard-health readout now distinguishes critical protections that are silently off from critical protections whose condition cannot currently be inspected. A clean critical-gap list no longer looks like proof that every critical protection was checked.
+
+## Summary of New Capabilities
+
+- Guard health now names load-bearing protections whose condition is missing, errored, stale, or contradicted by runtime state.
+
+## Evidence
+
+- Refusal-first unit coverage constructs an errored load-bearing guard and requires exclusion from the gap list, inclusion in the uninspectable list, and exactly one existing errored probe anomaly.
+- Unit coverage pins all four uninspectable posture classes. Integration and end-to-end lifecycle coverage require the new summary field to survive the real authenticated `GET /guards` route.

package/upgrades/1.3.976.md

@@ -0,0 +1,60 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**The projects `/advance` merge-base check no longer reports "not on main" when it was simply not
+allowed to look.** Found 2026-07-25 recording PR #1641 as merged — the step had never once
+succeeded on a dogfooding agent.
+
+- **The read now declares itself a read.** `gitMergeBaseIsAncestor` called
+  `SafeGitExecutor.readSync` without `sourceTreeReadOk: true`. A project's `targetRepoPath` IS an
+  instar source tree on a dogfooding agent, so `SourceTreeGuard` refused the query every time.
+  `merge-base` is already in `SOURCE_TREE_READ_TIER_VERBS` — the permission existed and was never
+  requested.
+- **A refusal is no longer translated into a fact (the load-bearing half).** The old
+  `catch { return false }` turned a guard refusal, a missing binary, a bad revision (exit 128) and
+  a timeout into the same `false`, which the validator surfaced as `MERGE_COMMIT_UNREACHABLE` —
+  "this merge is not on main" — about a merge that demonstrably was. Now ONLY git's documented exit
+  status 1 means "not an ancestor"; every other failure is rethrown and
+  `StageTransitionValidator` returns a new distinct code **`MERGE_BASE_UNVERIFIABLE`** carrying the
+  underlying cause.
+
+Nothing is loosened: a genuine non-ancestor still fails with `MERGE_COMMIT_UNREACHABLE` (asserted
+in its own test so the boundary is not blurred in the other direction).
+
+Reproduced under the server's exact environment before fixing: real merge SHA without the flag →
+`SourceTreeGuardError`; with the flag → ancestor TRUE; a real commit not on main → status 1; a
+nonexistent SHA → status 128 (unanswerable, which the old code also called a negative).
+
+## What to Tell Your User
+
+If you use projects to track work, marking an item as merged should now succeed where it previously
+failed with a confusing "merge commit is not reachable from main" — especially on an agent whose
+target repository is the instar source tree. If the check genuinely cannot run, you now get "could
+not verify" with the reason instead of a wrong factual claim.
+
+## Summary of New Capabilities
+
+- `MERGE_BASE_UNVERIFIABLE` — a new stage-transition refusal code distinguishing "could not check"
+  from "checked and it is not there". The reason string carries the underlying cause.
+
+## Evidence
+
+- `tests/unit/StageTransitionValidator.test.ts` — a throwing helper yields
+  `MERGE_BASE_UNVERIFIABLE`; a helper returning false still yields `MERGE_COMMIT_UNREACHABLE`.
+- `tests/unit/projects-advance-mergebase-wiring.test.ts` — static wiring: the callsite carries
+  `sourceTreeReadOk: true`, the helper tests `status === 1` and rethrows otherwise, the bare
+  `catch { return false }` shape cannot reappear, and the new code comes from a `catch`. Static
+  rather than mocked because mocking `SafeGitExecutor` is how the existing tests masked this gap.
+
+## Known Gap (measured, tracked)
+
+This is the SECOND instance of this bug class (the first, in May, hit failure-learning's git reads;
+its ratchet was scoped to that subsystem only). Measured exposure: **34 of 46**
+`SafeGitExecutor.readSync` callsites in `src/` do not pass `sourceTreeReadOk: true`. Most are
+legitimate (targets that are not the instar source tree). They are deliberately NOT swept here —
+flagging 34 callsites blind would relax a safety guard on evidence nobody has. The follow-up is a
+per-callsite audit then a repo-wide default-plus-declared-exception ratchet. <!-- tracked: CMT-1035 -->

package/upgrades/eli16/guard-uninspectable-summary.md

@@ -0,0 +1,35 @@
+# Guard inspectability summary — Plain-English Overview
+
+> The one-line version: the guard-health readout now says when a critical protection cannot be inspected, instead of letting an empty gap list look like proof that every critical path is protected.
+
+## The problem in one breath
+
+The guard inventory has a list of load-bearing guards that are silently unguarded. That list is intentionally narrow: a missing, errored, stale, or runtime-contradicting guard is already alarming under its own posture class, so adding it to the gap class would produce two alarms for one problem. But the read surface did not explain that distinction. A reader could see an empty gap list and honestly conclude that no critical path was unguarded even though a load-bearing guard could not be inspected at all.
+
+## What already exists
+
+- **Guard posture rows** — classify each guard as confirmed, stale, missing, errored, off, dry-run, or runtime-divergent.
+- **Load-bearing gap list** — names critical guards that are silently off by default or stuck in dry-run past their soak window.
+- **Guard posture probe** — alarms missing, errored, stale, and runtime-divergent guards under their existing classes, without duplicating a load-bearing-gap alarm.
+
+## What this adds
+
+The summary returned by the guards read endpoint gains a separate list of load-bearing guards whose posture is uninspectable. The list contains only the four existing loud classes: missing, errored, stale while on, and enabled in configuration while reporting off at runtime.
+
+This is additive observability. It does not change a guard row's classification, enable or disable any guard, alter the load-bearing gap definition, or create another probe anomaly.
+
+## The safeguards
+
+**Prevents a false all-clear.** A clean gap list can now be read beside the uninspectable list, so absence from one class is not mistaken for proof of complete inspection.
+
+**Prevents double-alarming.** The probe remains unchanged. A load-bearing guard with an errored getter still produces one existing errored anomaly and no load-bearing-gap episode.
+
+**Refuses regression at every live seam.** Unit coverage proves all four allowed postures and the no-double-alarm rule. Integration and end-to-end coverage call the real authenticated guards route and require the new list to survive the response.
+
+## What ships when
+
+One additive summary field ships with the existing guards endpoint. Older consumers can ignore it; consumers that need an honest critical-path reading can use it immediately.
+
+## What you actually need to decide
+
+Does the PR preserve the existing classification and alarm behavior while making incomplete load-bearing inspection explicit?

package/upgrades/side-effects/guard-uninspectable-summary.md

@@ -0,0 +1,137 @@
+# Side-Effects Review — Guard load-bearing inspectability summary
+
+**Version / slug:** `guard-uninspectable-summary`
+**Date:** `2026-07-25`
+**Author:** `Instar Agent (instar-codey)`
+**Second-pass reviewer:** `guard_uninspectable_review`
+
+## Summary of the change
+
+`src/monitoring/guardPostureView.ts` adds one field to `GuardsSummary`: `loadBearingUninspectableKeys`. `buildGuardInventory` fills it when a load-bearing row retains one of four existing effective postures: `missing`, `errored`, `on-stale`, or `off-runtime-divergent`. The existing row classification, `loadBearingGap` flag, `loadBearingGapKeys`, heartbeat projection, and `GuardPostureProbe` anomaly logic are unchanged. Because `GET /guards` returns `inventory.summary` directly, the additive field reaches the authenticated local and pool read surfaces without a route-specific copy step.
+
+## Decision-point inventory
+
+No block/allow or actuation decision point is added or modified. The change adds a read-only projection over already-derived guard rows. Existing guard classification and probe alert decisions are passed through unchanged.
+
+- `buildGuardInventory` summary assembly — **modify** — adds an orthogonal completeness list from the closed effective-state vocabulary.
+- `GuardPostureProbe` — **pass-through** — consumes guard rows exactly as before; it does not consume the new summary field.
+
+---
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+No block/allow surface — over-block not applicable. Every existing request and guard posture remains accepted and classified as before.
+
+---
+
+## 2. Under-block
+
+**What failure modes does this still miss?**
+
+The requested `GET /guards` surface is complete for the named load-bearing inspectability classes. The compact heartbeat posture is a second rendering of the earlier shape: it carries `loadBearingGapKeys` and aggregate loud-class counts, but not keyed load-bearing inspectability. It remains unchanged by instruction; this finding was reported directly to Echo and was neither fixed nor filed.
+
+The new list also deliberately excludes `diverged-pending-restart`, `on-unverified`, and non-load-bearing rows because the requested closed set is exactly `missing`, `errored`, `on-stale`, and `off-runtime-divergent`.
+
+---
+
+## 3. Level-of-abstraction fit
+
+**Is this at the right layer?**
+
+Yes. `buildGuardInventory` already owns the canonical `GuardsSummary` derived from the complete row inventory. Computing the list there avoids re-deriving state in `routes.ts`, keeps local and pool responses aligned, and leaves the probe's separate anomaly authority untouched. The membership check is a projection over a closed enum, not a new detector or competing classifier.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+**Does this change hold blocking authority with brittle logic?**
+
+- [ ] No — this change produces a signal consumed by an existing smart gate.
+- [x] No — this change has no block/allow surface.
+- [ ] Yes — but the logic is a smart gate with full conversational context (LLM-backed with recent history or equivalent).
+- [ ] ⚠️ Yes, with brittle logic — STOP. Reshape the design.
+
+The new field is an additive observation on a read surface. It cannot enable, disable, classify, alert, suppress, or authorize anything. `GuardPostureProbe` remains the anomaly consumer and sees the same rows it saw before.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No new static heuristic is added at a competing-signals decision point. The four-member set is the request's closed structural definition of "load-bearing but uninspectable"; it does not resolve conflicting evidence or make a behavioral decision. The normative effective-state precedence table remains unchanged.
+
+---
+
+## 5. Interactions
+
+**Does this interact with existing checks, recovery paths, or infrastructure?**
+
+- **Shadowing:** none. The field is assembled after each row has already been classified.
+- **Double-fire:** structurally prevented by leaving `GuardPostureProbe` unchanged. The required errored-row test produces one acute `errored` item and no `guard-posture-loadbearing` item.
+- **Races:** none. `buildGuardInventory` is pure over the caller's one-read snapshot and synchronous registry reads.
+- **Feedback loops:** none. `GET /guards` does not feed the field back into classification or actuation.
+- **Compatibility:** additive JSON field. Consumers that do not know it ignore it; consumers that need completeness can read it.
+
+---
+
+## 6. External surfaces
+
+**Does this change anything visible outside the immediate code path?**
+
+Yes: authenticated callers of `GET /guards` and `GET /guards?scope=pool` see `summary.loadBearingUninspectableKeys`. No row fields, response status codes, authentication rules, persistent files, notices, or external-service calls change. The route's timing remains one linear pass over the existing guard rows.
+
+No operator-facing action is added. This is a read-only diagnostic field; there is no new grant, approval, destructive operation, or phone-only workflow.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No dashboard renderer, approval page, or operator action surface is changed — not applicable. The API field is machine-readable supporting data, not primary dashboard content.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Posture: proxied-on-read.** Each machine derives its own guard truth from machine-local configuration and runtime getters. `GET /guards?scope=pool` already fetches each known peer's plain `GET /guards` response, so the new summary list travels with that peer's full response and remains attributed to the machine that observed it.
+
+The change emits no user-facing notices, holds no durable state, and generates no URLs. Topic transfer cannot strand it because it is recomputed on every read.
+
+The compact heartbeat posture does not gain this keyed list; that separate rendering was reported to Echo without alteration.
+
+---
+
+## 8. Rollback cost
+
+Pure additive code change. Revert the summary interface member, state set, initializer, and push line, then ship a patch. There is no data migration, persistent state cleanup, agent reset, or user-facing repair. During rollback, callers return to the earlier incomplete summary shape.
+
+---
+
+## Conclusion
+
+The change is narrow and correctly layered: it makes the read model honest without perturbing the classifications and alarms that already own these failure states. Refusal-first coverage pins the absent-field defect, all four exact uninspectable classes, no double-alarm behavior, the real authenticated route, and the live HTTP lifecycle. The heartbeat rendering remains an explicitly reported, unchanged finding under Echo's filing authority.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** `guard_uninspectable_review`
+**Independent read of the artifact:** Concur with the review — the only runtime change is an additive summary projection over load-bearing rows in exactly `{missing, errored, on-stale, off-runtime-divergent}`; the precedence/classification and `GuardPostureProbe` code are untouched, the errored case yields one existing acute item and no load-bearing-gap item, and all 54 focused unit/integration/E2E tests pass with no threshold or authority changes.
+
+---
+
+## Evidence pointers
+
+- Refusal evidence: before implementation, `tests/unit/monitoring/guard-posture-probe-loadbearing.test.ts` failed because `loadBearingUninspectableKeys` was absent.
+- Unit: 32/32 across `guard-posture-loadbearing` and `guard-posture-probe-loadbearing`; the broader focused unit run was 62/62.
+- Integration: 18/18 in `tests/integration/guards-route.test.ts`.
+- E2E: 24/24 across `guards-loadbearing-lifecycle` and `guards-endpoint-lifecycle`.
+- Static/build: `npm run lint` and `npm run build` passed.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect and no self-triggered controller change — not applicable.