Constant INHERIT_SOURCE_MISSING_GATE 

pub const INHERIT_SOURCE_MISSING_GATE: StructuralGate;

A Snapshot or Restore whose mover.inheritSecurityContextFrom names a LIVE-pod source that resolved nothing — no pod matched the selector (the workload is scaled to zero, which is precisely when a quiesced backup is most useful), the named container is absent, or the matched pod sets neither a container nor a pod-level securityContext — and whose recipe pins no fallback runAsUser to proceed on (#464).

The run parks at phase: Pending and re-checks on the slow structural cadence. Holding is deliberate: a backup taken as the wrong UID is worse than a backup that did not run. Nothing in kopiur can scale a workload up, fix a label selector, or invent the identity the data expects, so this is squarely “needs a human” — hence Fail, and hence registered: before #464 the hold surfaced as a generic transient MissingDependency with no condition naming the selector that matched nothing.

Its own condition rather than a reason on the advisory SecurityContextInherited — see consts::SECURITY_CONTEXT_RESOLVED_CONDITION for why that distinction is load-bearing for kubectl kopiur doctor.