innovation register

{
  "id": "P14-I-001",
  "title": "Multi-object RollbackPlan",
  "problem": "Vendors treat rollback as one object; a composition has many",
  "mechanism": "RollbackPlan enumerates code, config, secrets, schema, data, donor revision, surface fallback and connector state as separate objects, each with its own restore procedure",
  "evidence_basis": "wave-1: Vercel does not revert env/config; Fly not fly.toml/secrets/migrations. Local: donor standard says 'Data rollback is separate'",
  "evidence_class": "observed_behavior",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 1,
  "rationale": "Two independent derivations — vendor docs and SISO's own operated donor standard — reached the same structure. Strongest finding in the lane."
}

{
  "id": "P14-I-002",
  "title": "Per-object recovery horizon",
  "problem": "'Can roll back' is treated as a boolean but each object has a time limit",
  "mechanism": "Every rollback object carries a recovery horizon; the composition's true horizon is the minimum across objects, and it is displayed before release",
  "evidence_basis": "wave-1: PlanetScale schema revert is a bounded ~30-min dual-write window while artifact rollback is unbounded",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 2,
  "rationale": "Converts an invisible trap into a stated, checkable property of every release."
}

{
  "id": "P14-I-003",
  "title": "Digest pinning with owned retention",
  "problem": "A pinned tag can resolve to a different image, or be pruned",
  "mechanism": "Pin every artifact by content digest AND retain it in Actionist-owned storage for the declared rollback horizon",
  "evidence_basis": "wave-1: Render re-pulls by tag and may get a different image; Fly may prune images not recently deployed",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 3,
  "rationale": "A pinned reference is worthless if the artifact it names can be garbage-collected by someone else."
}

{
  "id": "P14-I-004",
  "title": "Rollback rehearsal before promotion",
  "problem": "Rollback is first exercised during an incident",
  "mechanism": "Every release rehearses its own rollback in preview before promotion; unrehearsed rollback blocks release",
  "evidence_basis": "local: G5 rollback receipt requires parity, never executed",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 4,
  "rationale": "Makes recovery a tested property rather than a documented intention."
}

{
  "id": "P14-I-005",
  "title": "Surface-level fallback route",
  "problem": "Full rollback is too coarse for one broken surface",
  "mechanism": "Retain the prior surface at an alternate route as a standing fallback",
  "evidence_basis": "local: Teable keeps /tables-native as temporary UI rollback while /tables is canonical",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 5,
  "rationale": "A third rollback object observed in real SISO practice that no vendor census surfaced."
}

{
  "id": "P14-I-006",
  "title": "Forward-fix vs rollback decision record",
  "problem": "Teams thrash between rolling back and patching",
  "mechanism": "Declared policy per failure class, recorded at release time",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-007",
  "title": "Backup-before-migration as a hard gate",
  "problem": "Migrations run without a restore point",
  "mechanism": "No bridge migration without a verified pre-migration dump",
  "evidence_basis": "local: donor standard required-proof list",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-008",
  "title": "Expand-contract migrations only",
  "problem": "In-place schema changes are irreversible",
  "mechanism": "Additive expand, dual-write, then contract, with rollback possible at each stage",
  "evidence_basis": "local: ARCHITECTURE risk row cites pgroll/reshape as prior art",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-009",
  "title": "K concurrent live schema versions",
  "problem": "Tools hold two versions; Actionist needs many long-lived ones",
  "mechanism": "Versioned view layer per app manifest with client pinning via search_path",
  "evidence_basis": "local audit: pgroll/reshape hold two versions during controlled rollout — insufficient for K independently-upgrading clients",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 6,
  "rationale": "Names a known ceiling in the industry prior art rather than assuming the mitigation transfers."
}

{
  "id": "P14-I-010",
  "title": "Credential revocation as a rollback object",
  "problem": "Rolling back code leaves leaked credentials live",
  "mechanism": "Revocation is a separate, always-available rollback action",
  "evidence_basis": "local: composition architecture lists credential revocation as distinct",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-011",
  "title": "External side-effect compensation",
  "problem": "Sent messages and payments cannot be un-deployed",
  "mechanism": "Side effects require declared compensating actions or are refused",
  "evidence_basis": "local: N-catalogue and idempotency requirements",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-012",
  "title": "Rollback receipt with checksum parity",
  "problem": "Rollback claimed without proof",
  "mechanism": "Restore emits pre/post checksums; mismatch is a kill",
  "evidence_basis": "local: G5 rollback receipt schema",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-013",
  "title": "Prior-known-good pointer always resolvable",
  "problem": "Rollback target may not exist",
  "mechanism": "Maintain an always-valid last-green pointer; releasing without one is refused",
  "evidence_basis": "wave-1: Vercel/Netlify last-good patterns",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-014",
  "title": "Rollback does not silently downgrade data",
  "problem": "Schema rollback can destroy newer rows",
  "mechanism": "Data-loss analysis required before schema rollback is offered",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-015",
  "title": "Donor revision rollback via parent commit",
  "problem": "Donor state drifts from host state",
  "mechanism": "Submodule pointer + manifest updated in the same parent commit; revert restores both",
  "evidence_basis": "local: donor standard update/rollback procedure",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-016",
  "title": "Rollback blast-radius statement",
  "problem": "Operators cannot see what a rollback will undo",
  "mechanism": "Enumerate affected objects and clients before executing",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-017",
  "title": "Partial rollback of one capability",
  "problem": "One bad capability forces whole-app rollback",
  "mechanism": "Per-capability rollback where isolation permits",
  "evidence_basis": "cross-part with P13",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-018",
  "title": "Rollback drills on a schedule",
  "problem": "Rollback rots when unused",
  "mechanism": "Periodic drills producing dated receipts",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-019",
  "title": "Five declared runtime profiles",
  "problem": "Reuse shapes need different runtimes; one profile cannot serve all",
  "mechanism": "Package-in-host, microfrontend, sidecar service, worker, scheduled job — each with its own isolation, health, scaling and failure semantics",
  "evidence_basis": "local: P14 owns exactly these; master synthesis lists them as unknown-which-are-v1",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 7,
  "rationale": "Answers P14's named open question 'Which runtime profiles are v1?' with an enumerated contract rather than a preference."
}

{
  "id": "P14-I-020",
  "title": "Profile declared by packaging mode, not chosen ad hoc",
  "problem": "Runtime chosen per deployment by habit",
  "mechanism": "PackagingProfile deterministically implies the runtime profile",
  "evidence_basis": "local: packaging_mode enum",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-021",
  "title": "Intact service keeps its own data plane",
  "problem": "Forcing donors onto one database creates forks",
  "mechanism": "intact_service retains native store and migrations behind a contract",
  "evidence_basis": "local: donor standard one-owner-per-write-path",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-022",
  "title": "Microfrontend isolation contract",
  "problem": "Mounted UIs collide on styles, routes and globals",
  "mechanism": "Declared style scoping, route namespace and global isolation per mounted surface",
  "evidence_basis": "local: donor standard mounts complete app on own origin",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-023",
  "title": "Worker idempotency mandatory",
  "problem": "Retried jobs double-execute",
  "mechanism": "Every worker declares an idempotency key strategy or is infeasible",
  "evidence_basis": "local: solver idempotency check",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-024",
  "title": "Scheduled jobs declared, disabled by default on import",
  "problem": "Imported schedules fire unexpectedly",
  "mechanism": "Schedules import as disabled declarations",
  "evidence_basis": "local: portability export requires schedules as disabled declarations",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-025",
  "title": "Per-profile health contract",
  "problem": "Health means different things per profile",
  "mechanism": "Each profile defines readiness/liveness semantics",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-026",
  "title": "Cold-start budget per profile",
  "problem": "Editing feels broken when previews are slow",
  "mechanism": "Declared cold-start budgets; memory-preserving pause where available",
  "evidence_basis": "wave-1: E2B ~1s resume, ~4s/GiB pause",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-027",
  "title": "Sandbox reaping policy is ours",
  "problem": "Paused sandboxes accumulate cost indefinitely",
  "mechanism": "Explicit TTL and reaper owned by Actionist",
  "evidence_basis": "wave-1: E2B retains paused sandboxes indefinitely with no auto-kill setting",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 8,
  "rationale": "A vendor's missing default becomes our recurring cost leak unless explicitly owned."
}

{
  "id": "P14-I-028",
  "title": "Provider abstraction validated on the property that justified the choice",
  "problem": "An abstraction can silently forfeit the capability it was meant to preserve",
  "mechanism": "Portability tests must assert memory-preserving pause specifically, not generic sandbox lifecycle",
  "evidence_basis": "wave-1: ComputeSDK portability UNTESTED; providers may expose only filesystem snapshot",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 9,
  "rationale": "The top open question of the lane: the abstraction may degrade to a lowest common denominator and forfeit E2B's justifying property."
}

{
  "id": "P14-I-029",
  "title": "Egress default-deny per profile",
  "problem": "Generated code can call anywhere",
  "mechanism": "Deny-by-default egress with declared allowlist",
  "evidence_basis": "local: default-deny egress harness",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-030",
  "title": "Resource ceilings per capability",
  "problem": "One capability starves the app",
  "mechanism": "Declared CPU/memory/time ceilings enforced by the profile",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-031",
  "title": "Profile-appropriate logging contract",
  "problem": "Logs are unattributable across profiles",
  "mechanism": "Each profile emits a stable capability identifier",
  "evidence_basis": "cross-part with attribution",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-032",
  "title": "No production credentials in preview",
  "problem": "Preview leaks production access",
  "mechanism": "Preview injects ephemeral non-production config only",
  "evidence_basis": "local: ARCHITECTURE preview flow",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-033",
  "title": "Deterministic environment lock",
  "problem": "Unreproducible runtimes make receipts meaningless",
  "mechanism": "Pinned image digest, lockfile and toolchain per release",
  "evidence_basis": "local: environment lock in G5",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-034",
  "title": "Profile migration path",
  "problem": "A capability outgrows its profile",
  "mechanism": "Declared procedure to move package→sidecar→service without re-authoring contracts",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-035",
  "title": "Workflow acceptance gate above build gate",
  "problem": "A green build is presented as a working app",
  "mechanism": "Release requires a complete client workflow to pass, not only build/typecheck",
  "evidence_basis": "local: P14 known 'a passing build is not client workflow proof'; donor standard proves CRUD/views/filters against real persisted data",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "top10",
  "rank": 10,
  "rationale": "The most consequential gate in the lane and the one every incumbent conflates."
}

{
  "id": "P14-I-036",
  "title": "Eight UI states exercised",
  "problem": "Error and denied states ship untested",
  "mechanism": "Loading/empty/ready/stale/error/denied/review/unsupported-version all exercised",
  "evidence_basis": "local: G5 eight declared states",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-037",
  "title": "Two-tenant isolation fixture with zero tolerance",
  "problem": "Cross-tenant leakage is catastrophic and easy to miss",
  "mechanism": "Tenant A/B sentinels; any leakage is NO_SHIP",
  "evidence_basis": "local: cross_tenant_leakage => NO_SHIP proposal",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-038",
  "title": "Deployment contract tests separate from preview",
  "problem": "Preview-green is not production-green",
  "mechanism": "Distinct suite runs against the production build",
  "evidence_basis": "local: vibesdk #313 observed preview/production divergence",
  "evidence_class": "observed_behavior",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-039",
  "title": "Per-capability attribution of test failure",
  "problem": "Failures are attributed to the app, not the component",
  "mechanism": "Every failure maps to a capability ID",
  "evidence_basis": "cross-part with P15 demotion",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-040",
  "title": "Visual receipt is human-terminal, honestly labelled",
  "problem": "Claiming automated visual gating would be false",
  "mechanism": "Human blessing recorded as such; no fabricated threshold",
  "evidence_basis": "local: contradiction X-3 — no numeric threshold exists",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-041",
  "title": "Contract tests per port",
  "problem": "Ports drift silently between capabilities",
  "mechanism": "Consumer/provider contract tests per declared port",
  "evidence_basis": "local: Pact-style precedent in source register",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-042",
  "title": "Negative-path suite is first-class",
  "problem": "Happy-path suites cannot detect over-permissiveness",
  "mechanism": "N01-N15 executed every release",
  "evidence_basis": "local: 15 negative paths defined",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-043",
  "title": "Fixture hashes pinned before run",
  "problem": "Post-hoc fixture changes invalidate results",
  "mechanism": "Fixture manifest hashed and frozen pre-run",
  "evidence_basis": "local: P2 freeze requirement",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-044",
  "title": "Qualification is scope-bound",
  "problem": "Admitted-for-A read as admitted-everywhere",
  "mechanism": "Qualification binds to host scope and tenant",
  "evidence_basis": "local: admitted_scope hole identified in framework",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-045",
  "title": "Re-qualification on edit",
  "problem": "Client edits invalidate prior qualification",
  "mechanism": "Edited surfaces re-qualified before release",
  "evidence_basis": "cross-part with P13",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-046",
  "title": "Re-qualification on upgrade",
  "problem": "Upgrades invalidate prior receipts",
  "mechanism": "Capability upgrade triggers targeted re-qualification",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-047",
  "title": "Receipt orthogonality enforced",
  "problem": "One family's pass inferred from another's",
  "mechanism": "No receipt may be derived from another family",
  "evidence_basis": "local: INV-ORTHOGONAL",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-048",
  "title": "Min-gated evidence tier",
  "problem": "A strong average hides one fatal gap",
  "mechanism": "Tier is the minimum across families",
  "evidence_basis": "local: anti-averaging rule",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-049",
  "title": "Persistence-after-restart check",
  "problem": "State loss discovered in production",
  "mechanism": "Explicit restart-and-verify step",
  "evidence_basis": "local: donor standard requires persistence after database restart",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-050",
  "title": "Realtime/subscription verification",
  "problem": "Realtime silently breaks after mounting",
  "mechanism": "Subscription check in the acceptance suite",
  "evidence_basis": "local: donor standard realtime proof",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-051",
  "title": "Logout revocation verification",
  "problem": "Sessions survive logout across donor boundaries",
  "mechanism": "Explicit revocation test",
  "evidence_basis": "local: donor standard logout revocation proof",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-052",
  "title": "Accessibility and viewport receipts",
  "problem": "A11y regressions ship silently",
  "mechanism": "Declared viewport profiles and AT results per release",
  "evidence_basis": "local: visual receipt fields",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-053",
  "title": "ReleaseManifest pins exact composition",
  "problem": "Releases are described, not pinned",
  "mechanism": "Manifest pins every capability version, binding, token set, schema version and artifact digest",
  "evidence_basis": "local: 'Every release pins exact capability and binding versions'",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-054",
  "title": "Release is immutable and rebuilt clean",
  "problem": "Preview artifacts promoted to production",
  "mechanism": "Clean production rebuild from the approved commit",
  "evidence_basis": "local: ARCHITECTURE release step",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-055",
  "title": "Atomic promotion",
  "problem": "Partial promotion leaves mixed state",
  "mechanism": "Mapping update is atomic with prior mapping retained",
  "evidence_basis": "local: ARCHITECTURE publish step",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-056",
  "title": "Policy gate and human gate both required",
  "problem": "Either alone is insufficient",
  "mechanism": "Deterministic policy pass AND named human approval bound to artifact hash",
  "evidence_basis": "local: approval laundering rule",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-057",
  "title": "Approval expires",
  "problem": "Stale approvals authorise unreviewed artifacts",
  "mechanism": "Approvals carry expiry and scope",
  "evidence_basis": "local: approval_event shape",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-058",
  "title": "Canary one tenant first",
  "problem": "Schema or capability change breaks many clients at once",
  "mechanism": "Canary release to one tenant before fleet-wide",
  "evidence_basis": "local: ARCHITECTURE critical risk mitigation",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-059",
  "title": "Dependent-manifest check before destructive migration",
  "problem": "One migration breaks N generated apps",
  "mechanism": "Block destructive migration until all dependent manifests are upgraded",
  "evidence_basis": "local: ARCHITECTURE critical risk row",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-060",
  "title": "Release-linked error attribution",
  "problem": "Errors cannot be tied to a release",
  "mechanism": "Every release tagged in telemetry",
  "evidence_basis": "wave-2 observability lane",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-061",
  "title": "Subdomain mapping is a release object",
  "problem": "Edge mapping drifts from artifact",
  "mechanism": "Tenant→artifact mapping versioned with the release",
  "evidence_basis": "local: ARCHITECTURE edge risk",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-062",
  "title": "On-demand TLS with an ask endpoint",
  "problem": "Unbounded certificate issuance is an abuse vector",
  "mechanism": "ask endpoint gates issuance against the custom-domains table",
  "evidence_basis": "local: Caddy on_demand_tls decision",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-063",
  "title": "Distributed certificate storage verified before fleet",
  "problem": "Multi-node TLS fails without shared storage",
  "mechanism": "Verify shared storage support before multi-node deployment",
  "evidence_basis": "wave-1: shared cert-storage backends reportedly not in official Caddy builds — SECONDARY, unconfirmed",
  "evidence_class": "secondary",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-064",
  "title": "Release notes generated from the manifest diff",
  "problem": "Clients cannot see what changed",
  "mechanism": "Human-readable diff derived from manifest",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-065",
  "title": "Rights obligations as release gates",
  "problem": "Copyleft obligations discovered post-release",
  "mechanism": "License notices and source-offer obligations block release",
  "evidence_basis": "local: donor standard names these as release gates",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-066",
  "title": "SBOM per release",
  "problem": "Dependency provenance unknown at incident time",
  "mechanism": "SBOM generated and retained per release",
  "evidence_basis": "local: G2 requirements",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-067",
  "title": "Release freeze windows",
  "problem": "Releases during incidents compound failures",
  "mechanism": "Declared freeze policy",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-068",
  "title": "Exit packet per release",
  "problem": "Client cannot leave with a working artifact",
  "mechanism": "Export manifest with schema, assets, permissions and auth placeholders",
  "evidence_basis": "local: portability proof requirements",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-069",
  "title": "Stable capability identifier in all telemetry",
  "problem": "Failures cannot be attributed per capability",
  "mechanism": "Every capability emits a stable ID across logs, traces and errors",
  "evidence_basis": "cross-part with P15",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-070",
  "title": "Minimum instrumentation contract in HostContract",
  "problem": "Attribution is retrofitted and therefore incomplete",
  "mechanism": "HostContract mandates the identifiers, deploy correlation and ownership metadata attribution requires",
  "evidence_basis": "wave-2 observability lane deliverable",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-071",
  "title": "Per-capability error budget",
  "problem": "One flaky capability degrades the app invisibly",
  "mechanism": "Budgets per capability with breach signals to P15",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-072",
  "title": "Deploy-correlated anomaly detection",
  "problem": "Regressions attributed to the wrong cause",
  "mechanism": "Correlate anomalies with release boundaries",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-073",
  "title": "Ownership metadata per capability",
  "problem": "Nobody owns a failing component",
  "mechanism": "Declared maintenance owner per capability; absence is a blocker",
  "evidence_basis": "local: N15 stale-source/owner-absent negative",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-074",
  "title": "Freshness window per capability",
  "problem": "Stale capabilities silently rot",
  "mechanism": "Declared freshness window and drift probe",
  "evidence_basis": "local: maintenance receipt fields",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-075",
  "title": "Upstream advisory monitoring",
  "problem": "Donor security advisories missed",
  "mechanism": "Watch upstream releases and advisories per pinned revision",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-076",
  "title": "Maintenance cost recorded per capability",
  "problem": "Maintenance burden invisible until it hurts",
  "mechanism": "Track repair/upgrade hours per capability",
  "evidence_basis": "cross-part with P15",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-077",
  "title": "Incident record links capability, release and rollback",
  "problem": "Incidents do not feed learning",
  "mechanism": "Structured incident record joining all three",
  "evidence_basis": "cross-part with P15",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-078",
  "title": "Cost per accepted release",
  "problem": "Cost measured per call, not per outcome",
  "mechanism": "Denominator is the accepted release",
  "evidence_basis": "local: C_success unit",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-079",
  "title": "Runtime burden per capability",
  "problem": "Runtime cost unattributed",
  "mechanism": "Attribute compute and storage per capability",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-080",
  "title": "Blast-radius map per capability",
  "problem": "Cannot predict impact of a capability failure",
  "mechanism": "Dependency map from the port graph",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-081",
  "title": "Synthetic workflow monitoring",
  "problem": "Only infrastructure is monitored",
  "mechanism": "Run the acceptance workflow continuously in production",
  "evidence_basis": "inference",
  "evidence_class": "inference",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-082",
  "title": "Alert on zero-tolerance events only",
  "problem": "Alert fatigue hides real failures",
  "mechanism": "Page only on cross-tenant, secret-exposure and unapproved-side-effect events",
  "evidence_basis": "local: zero-tolerance classes",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-083",
  "title": "Retention policy per receipt family",
  "problem": "Evidence discarded before it is needed",
  "mechanism": "Declared retention per family",
  "evidence_basis": "local: retention requirements",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-084",
  "title": "Post-incident receipt preserved immutably",
  "problem": "Failures rewritten after the fact",
  "mechanism": "Failing receipts immutable",
  "evidence_basis": "local: preserve the failing receipt",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-085",
  "title": "REJECTED: treating artifact rollback as composition rollback",
  "problem": "Leaves config, secrets and schema behind",
  "mechanism": "Multi-object plan instead",
  "evidence_basis": "wave-1 vendor evidence",
  "evidence_class": "observed_behavior",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-086",
  "title": "REJECTED: tag-based artifact pinning",
  "problem": "Tag may resolve differently or be pruned",
  "mechanism": "Digest pinning with owned retention",
  "evidence_basis": "wave-1: Render/Fly evidence",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-087",
  "title": "REJECTED: single rollback boolean",
  "problem": "Hides differing recovery horizons",
  "mechanism": "Per-object horizon with min-governs rule",
  "evidence_basis": "wave-1: PlanetScale window",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-088",
  "title": "REJECTED: build-green as release criterion",
  "problem": "Not workflow proof",
  "mechanism": "Workflow acceptance gate",
  "evidence_basis": "local P14 known",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-089",
  "title": "REJECTED: claiming automated visual gating",
  "problem": "No numeric threshold exists",
  "mechanism": "Human-terminal, labelled",
  "evidence_basis": "local X-3",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-090",
  "title": "REJECTED: one runtime profile for all reuse shapes",
  "problem": "Different shapes have different failure semantics",
  "mechanism": "Five declared profiles",
  "evidence_basis": "local: A05 rejected",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-091",
  "title": "REJECTED: forcing donors onto one database",
  "problem": "Creates unnecessary forks",
  "mechanism": "Typed data ports; donors keep native stores",
  "evidence_basis": "local: A09 rejected",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-092",
  "title": "REJECTED: inheriting a connector catalogue's storage layer",
  "problem": "OpenConnector exposed global connections",
  "mechanism": "Own the tenant connection store",
  "evidence_basis": "local: A26 rejected",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-093",
  "title": "REJECTED: self-operated sandbox fleet in v1",
  "problem": "Incumbent abandoned its own fleet",
  "mechanism": "Rent behind a provider contract",
  "evidence_basis": "local: Lovable abandoned AWS/K8s fleet for Modal",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-094",
  "title": "REJECTED: Daytona as sandbox provider",
  "problem": "Unmaintained, unlicensed current tree",
  "mechanism": "Excluded; prior stands but unre-tested this wave",
  "evidence_basis": "local: gh api receipt 71868 NONE 2026-07-24",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-095",
  "title": "REJECTED: quoting Northflank one-click rollback",
  "problem": "First-party docs describe only re-triggering a prior run",
  "mechanism": "Excluded from evidence",
  "evidence_basis": "wave-1 correction",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-096",
  "title": "REJECTED: Statsig as an automatic rollback mechanism",
  "problem": "Alerting only by its own docs",
  "mechanism": "Excluded from top 10",
  "evidence_basis": "wave-1 correction",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-097",
  "title": "REJECTED: Rust-first v1 runtime",
  "problem": "Liftable ecosystem is TypeScript",
  "mechanism": "TypeScript control plane; Rust behind a measured SLO trigger",
  "evidence_basis": "local: 45-record sample, TS 12 vs Rust 3",
  "evidence_class": "observed_behavior",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-098",
  "title": "REJECTED: averaging qualification scores",
  "problem": "Hides a fatal gap",
  "mechanism": "Min-gated tier",
  "evidence_basis": "local anti-averaging rule",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-099",
  "title": "REJECTED: silence as approval",
  "problem": "Approval laundering",
  "mechanism": "Explicit event bound to artifact hash",
  "evidence_basis": "local rule",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}

{
  "id": "P14-I-100",
  "title": "REJECTED: preview environment as production",
  "problem": "Preview is not production",
  "mechanism": "Separate clean rebuild and contract tests",
  "evidence_basis": "local: ARCHITECTURE",
  "evidence_class": "first_party_docs",
  "observed_date": "2026-08-27",
  "limitations": "design hypothesis; unimplemented and unmeasured",
  "disposition": "register",
  "rank": null,
  "rationale": null
}