18 — Final Summary

Status: PARTIAL. Verdict: AUTOMATION_REALITY_VERIFIED_WITH_PARTIAL_SOURCES. Mode EXECUTION. Live mutation YES (16 birth-free views; births 1,205,440 == before/after; RC=0). OOM STABLE (no signal-9 since 06:04 UTC). Dual-path PASS.

What changed (engineering)

Registries-Pivot went from "renders current PG views" to "honestly knows its sources." 16 new additive OOM-safe views: source class inventory (21 classes), adapter freshness + v2 coverage dashboard, scanner automation reality, host/fs/kb blind-spot status, db↔host drift detector, trigger source coverage v2, dot/process source coverage v2, process discovery automation reality, action queue reality, UI source reality contract, no-blind-spot-as-zero guard, automation watch, blind-spot action plan, automation scorecard, regression guard.

The honest picture

• Coverage: 16 instrumented sources (15 COVERED + 1 PARTIAL), +5 non-instrumented classes named so the universe isn't overstated.
• Scanner: REAL_AUTOMATION proven live (systemd fired 06-05 02:10 UTC, rc=0) — but wf_scanner_run_log and workflow_scanner_registry.last_run_at are frozen at 06-04 (provenance lie, now detected and routed; UI told to read wf_adapter_run_log).
• Blind spots: 9, all classified; none renders as a silent zero. UNKNOWN ui-source is NULL; 77 host triggers shown HOST_PARTIAL; kb 2-doc subset shown PARTIAL.
• Drift: 4 actionable (35 cron declared-not-scheduled, 101 fs-no-registry, trigger_registry 107-vs-408, provenance) + 2 by-design (job_queue grain, pg_trigger +2).
• Action reality: a real handler exists; 7 safe-triage EXECUTABLE + 132 AI-handleable HANDLER_READY; owner/president actions correctly fail-closed.
• Guards: no-blind-spot 7/7, regression 8/8, OOM 0 landmines.

No-fake audit (UNCHANGED)

official RP 0 · ownership 0 · PROC-OWN votes 0 · axis_active 0 · events active 30 · guard 129 · real_run/execute/emit/operator_runtime all false · all DDL birth-free · no IU/canon/event/REAL_RUN/UI/scheduler mutation.

Exact blockers

1. Operator: UI git push/deploy (feat/rp-current-supervision @ d04d8e5) + 11-route smoke; kb_sop full crawl adapter.
2. Owner: reconcile 35 cron / 101 fs orphans / trigger_registry snapshot; wire candidate discovery.
3. Authority: AX-TRIGGER registration; PROC-OWN president vote (official RP); REAL_RUN flip.
4. T1 safe-eng (deferred to keep scheduler untouched): wire orchestrator to update scanner provenance tables.

No engineering blocker remains for read-true coverage. The one safe-eng task (provenance wiring) plus the 7 executable safe-triage actions define the next macro.