A double-assurance mechanism restrains generation of high potential transit-amplifying progenitors during