feat: advisory inline guard, posture as the only dial (0.0.45)

[okisdev]

summary

• the inline write guard no longer denies a main loop write in judgment posture: it counts the window and attaches one advisory per budget multiple, so locus stays a judgment call instead of a blocked tool call. 0.0.44 demoted locus in the rules but left the mechanism denying with two escape routes, and both can be unavailable at the same moment: dispatch is gone when the session forbids the Agent tool or the package is structurally stranded, and verification cannot exist before the write, because the write you need is the one being blocked
• FUSION_INLINE_GUARD_MODE is retired rather than documented. a gate that ships an environment variable to switch it off is a gate that should not be blocking, and gate strength now has exactly one control, the posture dial. the audit mode field is derived from posture (strict records enforce, judgment records advisory), so the ledger schema and /fusion:stats read unchanged
• two denials became posture independent, since neither rests on semantics a counter cannot see: a no-op Bash command while Fusion tasks are in flight, and a TaskOutput or TaskStop probe of a worker that already completed and was reaped. both were switchable through the retired variable and are provably useless calls, not locus judgments
• /fusion:stats keeps measuring what the deny used to prevent: the coercion ledger gains inlineSprawlWindows (a window past twice the budget with no verification and no dispatch) and deepestUnverifiedWindow, both derived from advisory depth so they stay populated now that judgment posture emits no denials
• evidence from the guard's own audit ledger (07-14 to 07-30, 107 sessions, 2645 events): 1524 dispatches against 28 write denies, so delegation was never resting on the deny; 24 of 28 denies were followed by a dispatch and 0 by a verification; 0 verification events exist in the whole ledger. the clincher is a session under 0.0.44 where the window had 4 writes and 1136 bytes left, denied a new React component twice on the byte cap, and only moved after the environment variable was set, after which it wrote 20 more files without incident

breaking changes

• FUSION_INLINE_GUARD_MODE is removed. it was the compatibility escape hatch for the blocking guard, and in judgment posture there is nothing left to escape. a setup that relied on it can drop it; a setup that wants the old floors uses /fusion:config set-posture strict
• unreadable guard state now fails open in judgment posture (it still fails closed in strict), because an unreadable counter should never stop the work
• strict posture is byte for byte the 0.0.44 behavior: five writes per dispatch opened window, three tail edits at most 1024 bytes to files already in the window, the zero dispatch relief of ten writes and 16384 bytes, new path Writes and NotebookEdit denied past that

test plan

already verified

• npm test -> 1057 tests, 1056 pass, 0 fail, 1 skip
• claude plugin validate on plugins/codex, plugins/grok, plugins/fusion, and . -> 4/4 passed
• node bench/manifest.mjs --check -> up to date; all 9 JSON manifests parse
• node plugins/fusion/scripts/generate-rules-manifest.mjs -> 36 hashes, rules sync suite 14/14
• repo wide sweep for FUSION_INLINE_GUARD_MODE, reliefWritesInWindow, reliefBytesInWindow, countUnverifiedAccumulations -> no remaining references outside the CHANGELOG
• live behavior on the session that wrote this change: 60 main loop writes, 12 advisories at multiples of five, zero denies, every record mode=advisory posture=judgment

reviewer should verify

• FUSION_POSTURE=strict still denies: five Edits inside a repo, then a sixth new path Write is refused with the dispatch framed reason, and /fusion:stats shows the deny with mode: enforce
• the rules diff is one bullet (plugins/fusion/rules/orchestration.md, the runtime guard line); the load bearing invariants in CONTRIBUTING's rules release checklist are untouched by it

notes

• deferred by judgment: the advisory still escalates on write count rather than user turns. turns are the honest axis for unverified accumulation, but the guard has no reliable turn signal and reading the transcript on every write would buy a worse defect than it fixes
• the 0.0.15 counterfactual is the one real risk here (softened wording once took interactive dispatch to zero), so the post release watch is the next day's dispatch mix in /fusion:stats plus the first inlineSprawlWindows reading