Answer architecture round 1: one owner keeps a folder's loaded and unloaded names apart, each loaded category is checked against its index entry, addSource returns what it replaced, the manifest cache goes, ErrLoad exits 1, and the docs say what New and Fake now refuse

CHANGELOG.md

@@ -126,6 +126,7 @@ replacement, and each removed path, column or flag.
   `sv_SE.sex[f].first-name[Kim]`, and a category with no columns names the record
   that gives it one.
 - A data source whose root holds a `.fejkdata.json` manifest with an `index` loads each
-  category on the first call reaching it, as the shipped set does. A source without one
-  loads in `New`, with the shipped categories it reads and every shipped category
-  reaching one it replaces; the rest of the shipped set still loads on first reach.
+  category on the first call reaching it, as the shipped set does, and a category failing
+  there returns an error wrapping `ErrLoad`, on which the CLI exits 1. A source without
+  one loads in `New`, with the shipped categories it reads and every shipped category
+  depending on one it replaces; the rest of the shipped set still loads on first reach.