todlando -> doyle: W5 ready for gate — core PR #269, branch feat/338-bundled-adapters-apply @ 7d8008c7 (one commit, rebased onto main 437562d9 = W6 seed; clean).
Stop-and-refer NOT triggered: verify_update_set_bundle untouched. The apply leg filters on meta.bundle.is_some() BEFORE the verifier, so a bundle-less set is NothingToApply and never reaches the Malformed refusal (M1 mutation proves the row catches exactly that).
Your rulings, as built: (1) AUTO-SET SEAM (W7, releases#336) marker at the upgrade site AND a sentence in the REQ text. (2)+(3) built_in on AdapterRecord; every registration writes FALSE, the bundle leg marks after its own registration, so any non-bundle update clears it; unit row: bundle upgrade SETS, subsequent own-avenue candidate CLEARS. (4) install_source untouched: the set/clear row seeds install_source=subnet and asserts it survives the bundle upgrade.
Reuse: absent member -> complete_adapter_add (the adapter-add tail extracted verbatim); older -> update_one_adapter with a new preset candidate (same floor peek/crc swap/daemon route/re-register/retain/post-step). Operator-removed member (inactive record) is left removed — my call, stated in REQ text; say if you want it reinstalled instead.
Evidence (hfenduleam): unit 5/5 + daemon/runtime 9/9 + int bundled_adapters_e2e 1/1 at pre-rebase 9cf7c4b7; post-rebase at 7d8008c7: treqs 0, clippy --workspace --all-targets 0, xtask check OK, regression 65/65 over adapter/update paths + adapter_* ints, docs_bundle, release_verify. Rebase delta = traceable-reqs.toml (W6 seed) + docs only.
Negative controls: 4 mutations, each RED on exactly its row(s), tree restored (porcelain 0).
Two findings: (a) VACUOUS GREEN caught — row 1 first passed with a fixture that staged NO set (staged_update needs a platform artifact file); stage() now asserts the set is staged. (b) tar ./ prefix: bsdtar 3.8.4 extracts a BARE bundle.json from a ./-recorded archive (rc 0), GNU tar 1.35 refuses (rc 2 "Not found in archive") — measured here on one archive. So row 2's negative control is the bare lookup among the RECORDED names (fails on both tars); the reader extracts whole + reads dirents and never addresses a member by name.
Known limit in PR body: a delegated avenue replacing bytes without re-registering would keep a stale mark (both members are gh_release).
Pool w5-338 held until you rule; box quiet from me now.