The deploy repo NetworkPolicy admits :8100 only from named apps and the traefik/cms-proxy namespaces; agent/script pods time out, so state-tx / cp-cli calls silently lost transitions. Invariant now rejects the in-cluster form and pins the ingress URL. Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF