fix: upstream merge - preserve gitignored local data, refuse a merge git never opened (4.5.0-beta.3, #30)

Files changed:
- CHANGES.md
- VERSION
- docs/ownership-and-templates.md
- instructions/gates.md
- instructions/private-instance.md
- tools/CONTRACT.md
- tools/chemenu/commands/upstream_cmd.py
- tools/chemenu/tests/test_upstream_cmd.py

instructions/gates.md

@@ -117,9 +117,11 @@ This is not a hole to patch by making `upstream merge` route through the gate: t
 question ("is this too much to publish?") does not apply to a change that only ever touches
 stack-owned paths that are, by definition, not this instance's own content. The check that
 actually matters here is `upstream merge`'s own postcheck - it re-verifies the merge commit
-against `upstream verify`'s logic immediately after committing, and refuses loudly (uncommitted
-state is not rolled back; the commit is left for a human to look at) if anything landed outside
-a stack-owned path. That is the safeguard for this command, not the Mass-Update Gate.
+against `upstream verify`'s logic immediately after committing, and exits 1 with the offending
+paths if anything landed outside a stack-owned one. **The merge commit is deliberately left in
+place** rather than reverted: it exists, a human has to look at it, and a command that quietly
+repaired its own mistake would hide the one event worth seeing. That postcheck is the safeguard
+for this command, not the Mass-Update Gate.
 
 ## Iteration Budget Gate and loop-breaker
 

instructions/private-instance.md

@@ -131,6 +131,12 @@ Everything else under `kb/`, `raw/`, `work/` and `reports/` is yours, `kb/CONVEN
 each `kb/<name>/COLLECTION.md` included - they bind your corpus, and they are exactly what
 `upstream merge` protects.
 
+**Your local, uncommitted-by-design files under those stages survive.** Forcing a content stage
+back to your own state removes only what git tracks, never the directory wholesale - which
+matters because `reports/` is gitignored apart from its contract, so it holds data that is in no
+commit and cannot be recomputed: the telemetry traces `eval score` reads, saved eval reports,
+past lint reports. A merge has no business touching any of it, and does not.
+
 The command itself checks its own result the same way `upstream verify` would, immediately
 after committing, and refuses loudly - without rolling the commit back - if anything landed
 outside a stack-owned path. A refusal there is a bug report, not something to work around by