diff --git a/docs/design/INDEX.md b/docs/design/INDEX.md
index 47ddd1d..d2be39e 100644
--- a/docs/design/INDEX.md
+++ b/docs/design/INDEX.md
@@ -1883,6 +1883,30 @@ non-printable; equality could only be defined over the serialized *data*, of whi
 a drift hazard against the very form #158 content-addresses). The loader stays lenient
 (a trailing newline on input still parses, Tier-1 robustness).
 
+**Enforcement shift — invariant 9 on the data plane (2026-06-30, cycle-0091 analysis,
+adversarially verified).** Lifting topology onto the data plane relocates *where* the
+engine/project boundary (invariant 9, no bespoke node registry/marketplace) is enforced,
+without changing what it forbids. **Pre-C24** a blueprint referencing another project's
+node was a **compile error** — topology was in-process Rust, so cross-boundary node
+resolution was *structurally impossible*, compiler-guaranteed for free. **Post-C24** that
+same reference is a **type-id string in a serialized blueprint**, refused only by the
+injected resolver's closed set (`UnknownNodeType`). The anti-NIH rationale survives intact
+(node *logic* stays cargo+Gitea-only; the format distributes **topology-as-content**, never
+logic — C17), and `std_vocabulary` stays a compiled-in dispatch table, not a registry — but
+its enforcement **degrades from compiler-guaranteed to resolver-seam discipline**. Two
+consequences: (1) **#160** (the guard that the closed vocabulary stays honest) is no longer
+droppable hygiene — it guards the data-plane face of the boundary (its own drift direction
+still fails *safe*, `UnknownNodeType`). (2) The **injected per-project resolver** (C16) is
+the genuinely new, *deferred* invariant-9 surface: nothing structurally stops a project
+resolver from accepting arbitrary type-ids, or a project from layering a blueprint
+*marketplace* (store + type-discovery API) **on top of** the format — one layer *above* the
+engine contract. Invariant 9 holds **at the engine**; the project/ecosystem boundary (what
+an injected resolver may resolve, where closed-set discipline draws the line) is a
+**World/C21-layer charter point**, not an engine fix. Invariant 8 (frozen) is likewise
+reframed by C24/C21: from "topology baked at build time" to "the World may *generate*
+topology at runtime (research plane), the chosen blueprint is frozen into the deploy
+artifact, and any run is deterministic once instantiated" (C1).
+
 ---
 
 ## Open architectural threads not yet resolved