The facet store crate reaches the durable-write API legitimately (atomic writes, containment, malformed-data policy, directory listing) but was not added to the allowed-wrappers list, so the dependency gate failed for every build on the shared branch. Additive: one name, no existing entry changed, the ban itself untouched. entity_resolution_door.json records the owner-visible difference between the two entity-resolution doors over the recorded matching corpus, both columns produced by the native implementation. The routes are served today by the door that does not pre-normalize and silently auto-picks low-confidence matches; moving them onto the mutation-safe path changes 27 of 65 vectors, 19 of which stop guessing and ask instead. None resolves to a different entity. Eight more keep an identical outcome while losing their closest-candidate list, which is the class an outcome-keyed review cannot see -- hence the separate list in the file.