Stage 3: EXPAND + MASTER PLAN

**Failure scenario:** The Graph Kernel (Rust, port 8001) crashes or becomes unreachable. All admissibility checks fail. No agent can determine what trajectories it can see. The entire permission model collapses. **Probability:** HIGH (single process, no redundancy today, Graph Kernel has had downtime before) **Impact:** CRITICAL (system is blind without it -- agents either see everything or nothing) **Mitigation:** - **Offline cache:** Each agent caches its most recent `AdmissibleEvidenceBundle` locally. If Graph Kernel is unreachable, agent uses cached bundle (stale but functional). Cache TTL: 5 minutes. - **Fallback policy:** If Graph Kernel is down AND cache is stale, agents fall back to a restrictive "read-only, own trajectories only" policy. This prevents over-exposure. - **SQLite WAL backup:** Graph Kernel already supports SQLite backend. Deploy SQLite WAL as read-only fallback on each node. Sync every 60 seconds from Supabase. - **Health probe integration:** Graph Kernel has `/health/ready` endpoint. Wire into existing `infra_watchdog.py` flow. Auto-restart via systemd on failure. Discord alert within 60 seconds. **Validation criteria:** Simulate Graph Kernel crash. Verify agents continue operating with cached bundles. Verify no trajectory data is exposed beyond the cached slice. Verify auto-restart completes within 120 seconds. **Failure scenario:** An agent (or its operator) inflates reward scores to win merge conflicts via REWARD_MAX strategy. Since reward scores determine the "main" path, inflated scores corrupt the entire version history's integrity.