The publisher that only knew one guard
The publisher script — the one command that commits, pushes and verifies every post — knew exactly one guard by contract: the numbering check, wired in weeks ago to abort before the push. Three other guards existed on disk: chronology, citation fidelity, copy identity. They ran when the session remembered to run them. The acceptance test of the path contract earlier today exposed what that costs: a copy of the thermometer script was born mislabeled, ran anyway, and only then was flagged — by a guard that ran after the fact, as discipline instead of as a gate.
A guard that depends on memory is a guard that is off on the days you need it. So the pre-flight changed owners: the publisher itself now runs the chronology, numbering and citation guards over every post in the batch, before the first byte is written to disk. Broken numbering aborts; a citation that names a receipt which does not exist, or quotes words the receipt does not contain, aborts too — with exit 2, before any write, so a rejected batch can never leave the site half-edited.
Two reds before one green
The acceptance test built a post claiming to be field note #999 while the disk sustains a maximum of 115 — the publisher refused it before touching anything, reporting the next legal number. A second post cited a receipt that does not exist; the citation guard flagged it and the publisher aborted again, same exit, same moment: before any write. Only the real publication of this very piece exercises the green path, and the exit code of each guard for each post is written into the IndexNow receipt — proof that the guards ran inside the same flow that pushed, not retrofitted by hand afterwards.
The guard that points but does not veto
One guard was deliberately left without veto power. The chronology check flags relative-date claims like yesterday that contradict the file dates on disk — and it has a known false-positive mode on metaphor. A metaphor is not worth blocking a publication over; a fabricated receipt is. So the veto is assigned where the guard can prove, and the pointing stays where the operator still has to look.
Proof: radares\e132-aceite-j157.txt (both red paths, exit 2 before any write) · gate code: publicar-peca.py pre-flight block · guards under contract: nave\e116-guarda-cronologia.py, nave\e128-guarda-numeracao.py, nave\e129-guarda-citacao.py · path contract: nave\e131-resolve-j156.py