Retire broad bans from Web Library facade

docs/dependency-policy.md

@@ -143,9 +143,10 @@ The checked-in rules provide full gate coverage for these dependency claims:
 9. The Inspect Web Library facade cannot expand beyond its current five
    evaluated project edges or its current ten repository assembly edges.
    The separate graph rules preserve those different ceilings while focused
-   #8779 successors retire Metadata-facing composition. The facade retains the
-   broad semantic banned-symbol input until that positive boundary no longer
-   admits low-level product assemblies.
+   #8779 successors retire Metadata-facing composition. Its typed Library
+   operations and positive dependency ceilings own product semantics, so the
+   facade retains only the platform-hazard compiler bans that dependency
+   layering cannot distinguish.
 10. The Inspect Web Catalog facade cannot expand beyond its current six
    evaluated project edges or its current twelve repository and external
    assembly edges. Its home-demo call-graph path reaches the host-neutral

docs/design/inspection-layers.md

@@ -1639,7 +1639,9 @@ canaries:
   immediately into `DotnetInspector.LibraryMetadata` values while
   `ILInspector.Metadata` remains the semantic vocabulary owner. The Browser
   Library facade therefore lowers exact-Library documents without a project or
-  compiled reference to either Metadata assembly.
+  compiled reference to either Metadata assembly. Its typed operation and
+  positive dependency ceilings own product semantics, so its compiler ban
+  input retains only runtime platform hazards.
 - Web Core's Platform-forwarder navigation projects forwarder display fields
   and ordered resolution routes into caller-shaped Browser values. The Package
   facade preserves the generated wire contract without referencing Metadata

docs/design/library-inspection-document.md

@@ -258,7 +258,10 @@ Browser adoption uses the generated input binding rather than adding a
 handwritten TypeScript request shape, flattened interim export, or duplicate
 JSON wrapper. The Browser adapter consumes the detached plan, bounds, and
 Enablements values; it does not construct or project `ILInspector.Metadata`
-contract values.
+contract values. Its exact positive project and assembly ceilings plus this
+typed lowering contract enforce product ownership; its compiler ban input is
+limited to runtime platform hazards that dependency layering cannot
+distinguish, not an open-ended inventory of internal product APIs.
 
 ## Library document
 

src/DotnetInspect.Web.Interop.Library/DotnetInspect.Web.Interop.Library.csproj

@@ -10,7 +10,7 @@
 
   <ItemGroup>
     <InternalsVisibleTo Include="DotnetInspect.Web.Tests" />
-    <AdditionalFiles Include="..\DotnetInspect.Web\BannedSymbols.txt" />
+    <AdditionalFiles Include="..\DotnetInspect.Web\PlatformHazards\BannedSymbols.txt" />
     <ProjectReference Include="..\DotnetInspect.Web.Core\DotnetInspect.Web.Core.csproj" />
     <ProjectReference Include="..\DotnetInspector.Queries\DotnetInspector.Queries.csproj" />
     <ProjectReference Include="..\DotnetInspector.Sections\DotnetInspector.Sections.csproj" />

tests/DotnetInspect.Web.Tests/BrowserEngineLayeringTests.cs

@@ -529,6 +529,9 @@ public void CoreAndRemainingCapabilityProjectsPinBroadLayeringGate()
             .. CapabilityProjectPaths.Where(project =>
                 !project.Equals(
                     CallGraphProjectPath,
+                    StringComparison.OrdinalIgnoreCase)
+                && !project.Equals(
+                    LibraryProjectPath,
                     StringComparison.OrdinalIgnoreCase)),
         ];
 
@@ -554,6 +557,12 @@ public void CallGraphFacadePinsPlatformHazardsNotBroadInventory()
         AssertPinsPlatformHazardsNotBroadInventory(CallGraphProjectPath);
     }
 
+    [Fact]
+    public void LibraryFacadePinsPlatformHazardsNotBroadInventory()
+    {
+        AssertPinsPlatformHazardsNotBroadInventory(LibraryProjectPath);
+    }
+
     static void AssertPinsPlatformHazardsNotBroadInventory(string project)
     {
         IReadOnlyList<string> additionalFiles =
@@ -753,6 +762,12 @@ .. File.ReadAllLines(path)
         "DotnetInspect.Web.Interop.CallGraph",
         "DotnetInspect.Web.Interop.CallGraph.csproj");
 
+    static string LibraryProjectPath => Path.Combine(
+        RepositoryRoot(),
+        "src",
+        "DotnetInspect.Web.Interop.Library",
+        "DotnetInspect.Web.Interop.Library.csproj");
+
     static string BroadBanListPath => Path.Combine(
         Path.GetDirectoryName(EngineProjectPath)!,
         "BannedSymbols.txt");