NO-FALLBACK-0: a plan records completed decisions, and an ineligible candidate has no eligible cause

[briansrls]

NO-FALLBACK-0 for boot artifact delivery. A delivery plan must name one transport and state, for every other candidate, why it is not one — never leave a second usable transport sitting in the plan for an executor to try when the first fails. Ordered fallback is the workflow this model exists to refuse.

What was wrong

Solving asks "is this candidate eligible"; a plan answers "this is the transport, and here is why every other candidate is not one". Those are different questions and they shared one type, so a plan could carry a second CandidateEligible verdict beside the selected one. An executor holding that plan reads it as the next thing to attempt.

What changed

Plan dispositions are their own vocabulary. BootDeliveryPlanCandidateDisposition = PlanCandidateSelected | PlanCandidateOutrankedBy { selected } | PlanCandidateIneligible { cause }. A candidate the policy outranked is recorded as outranked by the transport that was chosen, naming it, so the row states a completed decision rather than a standing offer. There is deliberately no arm meaning "eligible and not selected". BootDeliveryEligibilityProvenance.considered now carries these plan verdicts.

Ineligibility is a refusal-only coproduct. BootDeliveryCandidateIneligibility holds every named refusal cause and has no eligible inhabitant; BootDeliveryCandidateStanding = CandidateEligible | CandidateIneligible { cause }. The plan's ineligible arm carries the refusal-only type, so an ineligible candidate whose cause is that it was eligible — a contradictory row asserting a spare available transport inside a plan — has no constructor rather than merely no producer. This is construction where the previous cut left validation: the old type admitted the state and relied on the producer not to emit it.

Selection is named for what it is. first_eligible_boot_artifact_delivery became selected_boot_artifact_delivery; "first eligible" is the fallback vocabulary this change removes.

Evidence

• The refusal-only wall is proven where its RED is authorable. The violation can no longer be written in the accepted corpus, so asking for the refusal inside the corpus would be a permanently-green decoration (DESIGN §4b). It is instead expressed as source handed to the compiler by a fixture in test.claim.machine_intake.no_fallback_plan_ineligibility_wall_test: the RED places CandidateEligible in the plan's ineligible arm and is refused with a blocking TypeMismatch; the positive control places a real ineligibility cause and still compiles, so a green RED cannot be attributed to a typo or a broken import. Both execute.
• The existing boot delivery witnesses, including the two-eligible execution control and the contradictory-probe refusal, run against the migrated types.
• 29 production and 24 witness construction sites migrated to the refusal-only cause.

Not claimed

This does not make every fallback-shaped state unwritable across the delivery model; it closes the plan-disposition class named above. The reviewing authority's remaining items for this PR are tracked in the machine-intake ruling thread.