538+570+296+216 lines of change-detectors → 4 files of contract tests: seed catalog valid, bad entries skipped, kill list name-or-repo, live fallback+union; real-git pinned install + sidecar + re-pin; kill list blocks CLI/dashboard/TUI with only the CLI bypass; dashboard merge via sidecar; probe get_config default; extractor live document.