Keep re-admitted transaction plans descriptive for empty payloads

[iperev]

Confirmed Internal Contract Gap

repositorytransaction.AdmitPlanOutput declares that re-admitted public plans cannot be applied because they lack private executable payloads. That implication fails for a zero-byte target: a nil payload and the empty byte sequence have the same content digest and length.

Exact observed source: 50bbd4663b8aed02dec3c0aebf344164adcff42f. The relevant model, executable validation, apply, and output-admission files are byte-identical to base 6b4666ff70a4cca4d89b953cf2d11344f50a0624; this is not introduced by PR #101.

Reproducer

1. Build a plan for a missing regular file with empty content and mode 0644.
2. Call AdmitPlanOutput(plan.JSONValue()).
3. Pass the returned descriptive plan to Apply against the same isolated fixture root.
4. Observe state=applied, appliedCount=1. The nonempty-content control rejects execution.

The isolated Go-overlay assertion failed for precisely the empty-content case. No tracked files were modified. Current production CLI apply uses the native adoption builder, not the re-admitted report; a public CLI exploit is not established.

Required Correction

• Bind executable construction to an unexported capability established only after native plan construction or admitted staged recovery, independent of payload length.
• Preserve descriptive output re-admission and canonical identities. It must not manufacture that capability.
• Test empty/nonempty create, replacement, unchanged targets, mixed plans, JSON round trips, and legitimate staged recovery. Prove rejected execution performs no filesystem/control-state mutation.
• Preserve the existing byte, mode, root, and transaction identity checks; a construction capability does not replace them or authenticate the caller.
• Close this prerequisite before adding absent-after/delete operations for INTEGRATION-01.

Causal Finding

The current proof substitutes payload reconstruction difficulty for a construction boundary. Empty data is a counterexample. The repair belongs to the existing transaction owner, not an installer-specific guard or a second journal.