Load step 8 was enforced at `graph::load` only. `interp::run` took any
`&Graph`, and a lowering's graph, a parsed one or a struct literal reached it
without step 8: in the default build, `lower::int_synth` then `run` decoded the
gradient set to its committed digest while `graph::load` of the same bytes
refused it at Load(8).
- `graph::Loaded` holds a graph that passed every load step; its field is
private and only `graph::load` makes one. `run` takes `&Loaded`.
- A `Graph`, parsed, lowered or built in place, is data. A compile_fail
example (E0308) on `Loaded` shows a lowered graph cannot be passed to `run`.
- The goldens load every lowered graph from its bytes before running it, so
their `uncertified` gate now guards something.
- tests/step8.rs, in every build: each lowered int_synth graph is refused at
Load(8) without the switch and loads with it.
- Cargo.toml says who enables the switch, and that no decoder may.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
5e43805620