A platform roll is gated on measured loadability on the target, never on floors; a missing bake is a boot compile, not a hold #3651

Rule (maintainer, 2026-09-07): a platform roll is gated on what can LOAD on the target, never on declared floors — and a missing bake is a boot compile, not a hold

Today ReleaseAvailability.Evaluate declines a whole release when any installed package (a) declares a floor above the target tag (ModuleFloorExceedsTarget), or (b) has content but no sealed bake for the target identity (ContentBakeMissing), or (c) the sealed set is inconsistent. On 2026-09-07 (a) held memex-cloud on 8009 for the whole day while every candidate would have loaded; (b) would have held it again because the satellites' bakes for the new identity did not exist, although a boot compile of those courses succeeds on every PR.

Change

• (a) is removed as a blocker (see the floors-advisory issue).
• (b) becomes advisory: "would recompile at boot: education, crm" is reported in the verdict and on the Updates tab, but does not hold the roll. Modules:RequirePrebuilt (the strict mode) keeps its meaning for instances that opt in.
• The only hold on the module lane is measured: for each installed module that has no build published for the target identity, ModulePlatformLink.Check(landed generation bytes, target surface) must say Linkable. This needs the target's surface at gate time: publish-bake-bundles.sh writes platform-surface.json (assembly → exported type names, the same set ModulePlatformSurface.OfRunningProcess builds) beside _complete for every identity; PublishedBundleCatalogue reads it; ReleaseAvailability consumes it. A release with no surface file is Indeterminate for the link check only — and Indeterminate is reported, not treated as clearance and not treated as a hold (the boot-time probe + keep-the-old fallback + readiness stall are the safety net; see the policy page).
• RollSelection.Select therefore walks newest-first and stops at the first release with no UNLOADABLE module; "no complete release" (every candidate has an unloadable module) stays put and names the module.

Tests

SealedSetConsistencyTest/ReleaseGateDenominatorTest: bake-missing rows → advisory; new ReleaseLinkGateTest: a module unlinkable against the target surface holds and names the missing type; surface absent → Indeterminate reported, roll proceeds; RollSelectionTest updated.

Part of the module-adoption policy (Doc/Architecture/ModuleAdoptionPolicy). Depends on the floors-advisory change.