protocol: register food-science-engine for an ASK-facing repo-advisor Project role

[apexSolarKiss]

Registers food-science-engine (FSE) for one ASK-facing repo-advisor Project role, and lands the seven overlay requirements its census produced.

Two commits: C1 is the substantive change; C2 appends only this PR's amended_by provenance row, which cannot be written until the PR number exists.

Why this change exists

FSE is already a registered protocol consumer (#190), resolving architecture-uncertain as a separately-operated surface. Standing up a hosted advisor Project for it additionally requires advisor-project-surface, and that profile's applicability is owner metadata — a consumer cannot self-declare it. Until this lands FSE sits in the profile's explicit_exclusions, so a carrier that installed the profile would be failed by check.sh --wave for installing a profile it is excluded from.

The surface-overlay completion gate runs before a carrier is generated. The FSE census produced seven overlay requirements the registry did not hold. Generating a bootstrap first would have shipped requirements the owner did not know — making the coverage report false, and letting a later regeneration silently omit them.

What changed

protocol/manifest.json — moves food-science-engine from explicit_exclusions into applies_to, and rewrites the note so applies_to records a registered hosted-Project role, not a live installation. Live Project installation belongs to the operator state plane: a repo may enter applies_to before its Project configuration lands, and during that interval its missing required profile fails closed.

protocol/profiles/advisor-project-surface.md — the same registration, and the same registered-vs-configured distinction, in the owner-explanation header.

docs/advisor-project-surface-architecture.md — registers OVL-FSE-1 … OVL-FSE-7; scopes the overlay table per hosted Project role rather than per repo, so an overlay absent from one role is not read as a gap in another; and recounts the coverage report (101 registry IDs · 22 surface overlays · FSE 10 PRESERVE · 0 unowned). Also rewrites OVL-ECO-2 as a timeless invariant — it had frozen a current deployed topology into the slowest-aging carrier in the family, where the ecology index and generated bootstrap now own it.

protocol/tests/run-check-fixtures.sh — adds B5c's required-profile-completeness pair. Its NEG case proves that FSE carrying only the opt-in architecture-uncertain profile still omits the newly required advisor-project-surface; its POS case proves that carrying both passes.

Separately, the staged FSE carrier fails against the baseline owner because FSE remains in explicit_exclusions; that is the install-while-excluded negative control. The fixture file also retargets the L3eg mutation anchor removed by the OVL-ECO-2 rewrite.

Two FSE-specific overlays are worth naming, because they are the reason this registration is not a formality. FSE is a private repository with no public fallback, so OVL-FSE-6 requires fetch failure to fail closed — there is no second route to fall back to. OVL-FSE-7 makes private-review capability a standing per-Project acceptance condition: a Stage-2 verdict counts as grounded in repository truth only after that Project has itself passed the private-read path end to end, and the result is non-transferable between Projects.

Validation

Run in this repository, on this branch, at C1, working tree clean:

protocol/check.sh --local              exit 0 · 63 ok · 0 fail · ALL CHECKS PASSED (--local)
protocol/tests/run-check-fixtures.sh   exit 0 · PASS=179 · FAIL=0

Before landing, the same two patches were checked with git apply --check --whitespace=nowarn against a clean 6092565, individually and together. Separately, in a disposable synthetic-consumer worktree, the staged FSE carrier passes check.sh --wave against this amended owner and fails against the baseline owner for the exclusion reason — the install-while-excluded negative control, so the wave result is not vacuous.

What did not change

The profile's fenced distributable body is byte-identical, verified against this repo's own resolved copy in AGENTS.md, so no consumer re-sync obligation is created. The shared execution-protocol core is untouched. No consumer carrier is modified here — FSE installs the profile in its own repository, under its own gates, after this lands.

Nothing in this PR asserts that a hosted FSE Project exists, is configured, or is active. Registration and configuration are deliberately separate states.

Out of scope

Generation of the FSE advisor bootstrap, index, and Instructions carriers; every Project UI operation, which is ASK-owned; and the post-deployment operator-ledger reconciliation this registration will owe — no ledger version is selected, no proposal prepared, and no checkout acquired or sought.

Voice scan

Added prose swept against the operator-side voice owner. Word-boundary form returns zero. The bare-substring form reports only artifacts — cab inside applicable, carrie inside carrier/carried — and two apparent British-spelling hits resolve to REVISE and advise, both correct US spelling.

Learning disposition

No retention. The registration mechanics are owned by docs/advisor-project-surface-architecture.md and protocol/manifest.json; the registered-vs-configured distinction is now stated in both carriers rather than held anywhere private.

Correction recorded in C3

C1's commit message describes B5c as covering the explicit_exclusions predicate. That is false, and C3 corrects it in both the amended_by row and here. C1 is not amended because its SHA is embedded in the provenance row this branch exists to write.

At squash-merge, the message needs a look. This repository's squash commits are built from the commit messages, not from this body, so C1's uncorrected sentence would otherwise reach main alongside C3's correction.