Follow-up from the #590 code review. The Rust deployer's upgrade path only computed Replace + Add cuts (get_facet_cuts), never Remove — so a function deleted from a facet's source stayed routed to its old facet and remained callable after propose-update/update. That's a latent gap for any selector removal; it surfaced because #590 removes backfillPkpOwners but the normal deploy flow wouldn't actually drop it on-chain.

Design: explicit manifest + safe diff detection

A selector is Removed only if it is both:

1. listed in a committed manifest (diamond-removals.json), and
2. detected as orphaned by this upgrade — currently on the old address of a facet we're re-installing, and absent from every new managed facet ABI.

plan_removals() (pure, unit-tested) enforces this. Consequences:

• Core DiamondCut/Loupe selectors are never candidates — none of their selectors are in the managed set, so their addresses are never classified as "managed", so their selectors can't be orphans. No way to brick the diamond.
• A partial/incorrect build that accidentally drops a function can't silently strip it: removal requires an explicit manifest entry.
• An unlisted orphan warns (it'll stay callable — add it to the manifest to drop it).
• A listed-but-not-orphaned entry is refused (guards against removing a live function).
• A selector↔signature mismatch in the manifest is rejected (typo guard).

build_diamond_update emits a single Remove FacetCut (facetAddress 0x0) for the approved selectors, so both update and propose-update (Safe flow) get it.

Wiring

• New --removals <path> arg, default diamond-removals.json; missing file = no removals (backward compatible). Added to the Makefile base/sepolia update + propose recipes.
• diamond-removals.json declares backfillPkpOwners (0x41275609), so the refactor(contracts): remove completed #575 PKP-owner backfill machinery #590 cleanup upgrade drops it on-chain automatically once the WritesFacet build no longer declares it. (If run before that, it's detected as not-orphaned and skipped with a warning — safe either way.)

Tests

6 unit tests for plan_removals (orphan removed; unlisted orphan warned; non-orphan refused; absent selector skipped; mismatch guard; and a guard asserting selector_of("backfillPkpOwners(address[],uint256[])") == 0x41275609). cargo build, cargo test, cargo clippy clean.

Relationship to the other PRs

• Facet-source cleanup (removes backfillPkpOwners + owner==0 fallback from the contracts) is a separate PR.
• This one makes that cleanup's on-chain removal actually happen through the normal deploy flow, and fixes the general "can't remove any selector" gap.

🤖 Generated with Claude Code