ADR 0377 §3's allowlist names only tools bundles, files no container mounts and holds no data, and manifest fields that recreate nothing. Holds only checked containers, files, directories and processes/services; any other resource type (archive, package, user, network, ...) fell through unheld. Add a default case that holds and names the resource type and id.