Doctrine gap: observation degrades that fold faults into benign values must be visible (class + audit)

[pbean]

Problem

"Observation may degrade, repair writes must raise" is silent on visibility. In practice a degraded observation is routinely folded into the same value a healthy reading produces — [], {}, None, a green status — so the degrade is invisible at the call site and at every surface above it. This is the single most repeated defect shape in the open backlog; the instances below are all open today, and several past incidents (e.g. a faulted scan reading as "nothing to prune") share it.

Known open instances (each remains tracked in its own issue; listed here as the class)

• BaseTmuxBackend.list_window_ids folds every nonzero exit to [], so a failed listing reads as an empty session #525 — BaseTmuxBackend.list_window_ids: one nonzero exit covers session-gone / server-error / bad-format / target-resolution failure, all folded to []. (Transport faults already raise TmuxError; the exit-code conflation is the residual.)
• Untagged sessions still have no ownership proof that outlives the run dir (#419 direction 2, now unhomed) #538 — BaseTmuxBackend.session_options: missing binary, SubprocessError/OSError, and nonzero exit all return {} — one failed read makes every session read untagged at once.
• list_windows folds a transport fault to an empty listing, so a faulted ctl candidate scan reads as "nothing to prune" #562 — mux-seam list_windows: TimeoutExpired/OSError fold to the same [] a windowless session returns, so a faulted ctl-candidate scan reports scan_error: null.
• engine: the reconcile's unknown-status refusal leaves no journal entry #370 — the reconcile's unknown-status refusal arm returns without a journal entry, unlike every sibling arm of the same pass.
• TUI never surfaces sweeps_refused: a refused auto-sweep looks identical to one that ran #603 — tui/data.py reads state via journal.load_state instead of documents.status_document, so sweeps_refused reaches every surface except the dashboard.
• post_dev_verify's command_results stop at the dev phase: the review gate's verify commands are neither journalled nor published #656 — the review-gate leg of [verify] commands executes and discards (verify_commands_outcome); only the dev leg journals.
• Escalation reason truncated at 2000 chars drops the blocker and the operator instructions #734 — escalation detail[:2000] truncates the durable record with no truncation marker, reliably dropping the trailing blocker section.
• env_fault classifier residuals from #324: an unguarded straddler drop, an unpinned evidence clamp, anchor-drift vacuity, and stale docs #508 — env-fault scan: a newline-terminated >64 KiB final line defeats the only-line guard and silently yields no classification.
• validate could name a deferred-work ledger that is neither committed nor gitignored #620 — the ledger's committed / ignored / neither git tri-state is never named at startup; the "neither" configuration surfaces only at first unit merge.
• adapter.extra_args replaces bypass_args rather than extending it, so setting it for any other flag silently drops the permission bypass #740 — a resolved launch argv containing no permission-bypass token passes load, validate, probe, and run-start without a warning.
• Adjacent: Consolidate runs.liveness and runs.engine_liveness into one tri-state reader #690 — runs.liveness swallows ProcessHostError to "unknown" while runs.engine_liveness diverges; whatever consolidation lands should keep the degrade countable, not fold it.

Proposed work

1. Doctrine amendment (AGENTS.md engineering doctrine + wherever observe/degrade is documented): a degrade must be countable — either the return shape carries a reason (tri-state, reason field) or the seam journals/warns at the point of folding. Silent coercion to a healthy-empty value at an observation seam is a defect, not tolerance.
2. Mechanical audit for unfiled instances: sweep the observation seams (adapters/, runs.py, tui/data.py, documents.py, machine.py read paths) for except/nonzero-exit arms returning [] / {} / None / "", and file what falls out as individual issues. (Prove absence in Python, not grep.)
3. Per-seam fixes stay with their member issues. Observation return shapes are compatibility contracts; where a shape must grow a reason channel, that member issue picks up needs-design.

The member issues above stay open and are tracked individually; this issue owns the doctrine text and the audit.