H8 found it: a module the node could not compose yet got a failed have naming no fingerprint, which counted as run inside the node's own composition, so the next composition took it from its manifest past its build.