The inventory keeps dsh-app-boot an optional, type-only peer, so the walk over an entry's owning groups moves behind ProfileRuntime.userDisables(): a consumer with the runtime asks it, one without reports composition as before. The module graph and the cordis catalog follow.