Validate the environment layer and optional document into the served mount bindings, or the aggregated boot errors. The composition root's single entry: it runs loadConfig (whose policy errors become PolicyBootErrors) and then composeBindings, so policy, missing-adapter, and unresolved-credential failures all surface from one call.

The ecosystem-to-adapter resolver, the wall-clock source, and the rules' boot-bound capabilities are injected (the composition root supplies mountBindingFor, getCurrentTime, and each ecosystem's RuleDeps), so this validation opens no socket. The capabilities are per ecosystem because a mount's rules must borrow their ecosystem's advisory database, never a neighbour's. It is IO only because composeBindings prepares each mount's rules (allocating per-rule engine state once at boot).

Turn a validated Config into the served MountBindings, or the aggregated boot errors. For each mount, in ecosystem order: its credential reference must resolve to an initialised provider, and its ecosystem must resolve to an adapter (through the injected resolver, which the mount's PackumentDeps are built from). Errors aggregate across every mount. The Limits arrive resolved (the byte cap from the memory plan, Ecluse.Composition.MemoryPlan, married to the pinned structural counts) and are carried onto every mount's deps, so the data plane reads each metadata body bounded (security.md invariant 4).

The pure structural validation a boot enforces beyond loadConfig, shared with ecluse check-config so the checker can never pass a configuration the proxy refuses: a served mount whose ecosystem has no registered adapter (MissingAdapter), and the publish policy of every configured publication target (PublishAllowMissing, PublishStaticCredentialNeedsEdge). Pure and side-effect-free: no provider is initialised and no credential minted -- the mirrored-mount credential expectations are already structural on Config itself (each mirrored mount carries the credential loadConfig derived from its target). Only the provider-initialisation check (UnresolvedCredential) stays with composeBindings, which consumes this same function for everything else.

The publish-side byte discipline the composition root builds from the memory plan's publish tenant and hands to every publishing mount: the process-wide aggregate byte-admission and the per-request cap (the chunked-body weight). Present exactly when a publication target is configured -- the tenant and the target derive from the same predicate, so a publishing mount without a budget is unrepresentable at the root.

One ecosystem's resolved publish target: the mirror-target endpoint the mirror worker writes approved artifacts to, paired with the credential provider that mints its bearer token.

This is the publish side of the per-ecosystem composition (the serve side is the mount's PackumentDeps). The worker's single consumer builds a registry-protocol client from these -- the endpoint as its base URL, the provider's token as its bearer -- so the publish client is resolved here at the composition root rather than re-derived per request.

Resolve each configured mount to its publish target, or the aggregated boot errors. The publish side of planMounts: it validates the same config and resolves each mount's mirror-target endpoint and write credential, so the worker's publish client can be built at the composition root.

An unresolved credential reference is the same fail-loud boot error composeBindings reports for the serve side, so the two surfaces never disagree on what is wired.