PR B0: production stage-origin carrier design note (design only)

[gunbai-bot]

Design only. No implementation follows from this note. Per operator ruling 2026-08-04:
write the carrier law now; wait for a closed constructor/consumer denominator before
claiming or implementing class-wide closure.

Two files: the note and its HandAuthoredDocBind row. #7778 is untouched.

The class

FixtureOriginCanMintProductionQualification. Measured on main by execution:

Input to mint_provenanced_rust_artifact	Result
direct_rust_door_inferred_tree (hand-authored)	Accepted
infer(assemble(direct_rust_door_ingest())) (real pipeline)	Rejected

The fixture did not bypass a check. It used a supported API whose signature had already
discarded the epistemic distinction — mint_provenanced_rust_artifact accepts a bare
InferredTree, and nothing in that type says where the tree came from.

What the note locks

1. Production qualification consumes origin-bearing carriers, never a raw InferredTree,
   raw emitted source, a module-path string, or a fixture receipt.
2. Subject continuity is part of the type — each rung consumes the previous rung, so a
   fixture cannot skip into the chain.
3. Origin is derived, never a caller-authored field; the constructor is owned by the
   stage that performed the operation.
4. UnknownOrigin refuses. It never disappears — that fail-open shape is what P0: fixture-origin production qualification origin probe #7786's
   early drafts carried.
5. Local construction prevention is not global closure; the certificate separates
   them.
6. The law is written over an abstract derived population, not today's three known sites,
   so it stays stable whether the census finds three or three hundred.

Claimed rung, deliberately narrow

Mechanically preventable for resolved record-literal construction sites inside the
currently recognized file-identity scope.

The sole_constructor audit (executed) found one call site guarding record literals only,
casts unguarded, a file-identity scope test that contradicts DESIGN section 3 and breaks
under module-identity work, and a fail-open lookup miss. The note carries a ceiling table
and states that the claimed rung is its minimum row. The mechanism is not a wall and
this note does not call it one.

Gates

B0  design only                        <- this PR
B1  covered-form construction admission     after B0 sign
B2  call-occurrence population closure      consumes #7786 successor
B3  production API migration
B4  bypass closure (casts, module identity, fail-open lookup)

Also carries a 10-item mutation contract required before class closure may be claimed.

🤖 Generated with Claude Code