| 1 | Unrepresentable-by-construction edit model— | Model the ChangePlan so out-of-bounds operations have no encoding: slot types enumerate permitted child capability IDs, so 'insert arbitrary component' cannot be written | observed_behaviortop10 | — |
| 2 | Seven-verb edit algebra— | Define exactly seven typed operations, each with its own upgrade-safety class and inverse; anything outside the algebra is an escalation not an edit | inferencetop10 | — |
| 3 | Intent record separate from mutation— | Every edit persists (intent, target-selector, operation, params); replay on upgrade re-resolves the selector rather than replaying coordinates | observed_behaviortop10 | — |
| 4 | Parameter-vs-code edit classifier— | Deterministic classifier over the edit algebra: an edit is parametric iff it only writes declared contract slots; otherwise it is a code delta requiring the generation path | inferencetop10 | — |
| 5 | Deferred edit outcome— | Fourth outcome alongside allow/deny/escalate: deferred, naming the overriding authority (client design DNA) | first_party_docstop10 | — |
| 6 | Selector stability contract— | Capabilities must export stable semantic anchors (slot IDs, named regions); edits may only bind to exported anchors | observed_behaviortop10 | — |
| — | Edit budget per session— | Declared budget of edits/regenerations per session; exceeding it escalates to a review rather than continuing | first_party_docsregister | — |
| 7 | Escape hatch as explicit contract transition— | Leaving the bounded surface is a recorded state transition (bounded → forked) that changes the capability's upgrade eligibility and is visible to the client | observed_behaviortop10 | — |
| — | Preview parity gate— | Preview must render from the same artifact the release builds; a hand-composited preview is prohibited | secondaryregister | — |
| 8 | Eight-state editor preview— | Editor must render loading/empty/ready/stale/error/denied/review/unsupported-version for every edited surface | first_party_docstop10 | — |
| — | Content-stress preview panel— | Mandatory stress cases: long/short title, empty table, 40-row table, missing avatar, long button label, validation error | first_party_docsregister | — |
| — | Reorder as constrained permutation— | Reorder is permitted only within a slot whose semantics declare order-independence; otherwise it is an escalation | inferenceregister | — |
| 9 | Replace-with-compatible-only— | Replacement candidates are filtered by port compatibility before being offered; incompatible options never appear | first_party_docstop10 | — |
| — | Data-binding edits as capability-scoped— | Binding edits may only target resources already in the release's declared capability scope; new resources require a new plan | first_party_docsregister | — |
| 10 | Text edits bypass regeneration entirely— | Text/content edits write to a content layer with no build step, giving instant preview and zero upgrade risk | first_party_docstop10 | — |
| — | Pre-upgrade settings snapshot + post-upgrade diff— | Snapshot the settings/content layer before capability upgrade, diff after, block publish on unexplained loss | observed_behaviorregister | — |
| — | Upgrade rehearsal in preview— | Every capability upgrade runs first against a preview release with the client's real edit set replayed | first_party_docsregister | — |
| — | Edit-set replay as upgrade test— | The client's stored intent records form a per-client regression suite executed on every candidate upgrade | inferenceregister | — |
| — | Upgrade eligibility as a capability property— | Track edit divergence per capability; heavily forked capabilities lose automatic-upgrade eligibility and require review | first_party_docsregister | — |
| — | Semantic version gate on slot schema— | Slot schemas are versioned; a breaking slot change requires a declared migration for stored edits or the upgrade is refused | inferenceregister | — |
| — | Edit migration functions— | Capability authors ship edit-migration functions alongside schema changes, as database migrations do | inferenceregister | — |
| — | Divergence meter surfaced to client— | Visible indicator of how far the app has diverged from its upgradeable baseline | inferenceregister | — |
| — | Theme edits are always upgrade-safe by construction— | Tokens resolve through one resolver context; theme edits never touch capability source, so they survive any upgrade | first_party_docsregister | — |
| — | No-literal rule enforcement in editor— | Editor refuses to emit literal colour/space values; only token references | first_party_docsregister | — |
| — | Upgrade blast-radius preview— | Show which edited surfaces an upgrade touches before applying | inferenceregister | — |
| — | Pin-and-defer— | Explicit pin with recorded expiry and a maintenance-debt signal emitted to P15 | first_party_docsregister | — |
| — | Two-way door labelling— | Every edit is labelled reversible/irreversible at offer time, derived from its inverse existence in the algebra | inferenceregister | — |
| — | Donor-surface edit prohibition— | For intact_fork/intact_service capabilities the editor exposes only host-side seams, never donor internals | first_party_docsregister | — |
| — | Shell-level edits separated from capability edits— | Two distinct edit scopes with different guarantees and different reviewers | first_party_docsregister | — |
| — | Upgrade-safety class printed per operation— | Each of the seven verbs carries a static upgrade-safety class shown in the UI | inferenceregister | — |
| — | ChangePlan as staged hash-bound artifact— | Edits produce a staged ChangePlan bound to an artifact hash; approval binds to that hash | first_party_docsregister | — |
| — | Bounded diff with file allowlist— | Every generated diff is confined to a solver-derived allowlist; out-of-allowlist writes are rejected | first_party_docsregister | — |
| — | Semantic undo over operation log— | Undo pops typed operations, not text diffs; each operation declares its inverse | inferenceregister | — |
| — | Named versions, not just linear history— | Client-nameable checkpoints over the operation log | first_party_docsregister | — |
| — | Branching client edits— | Edit branches over the same release, previewable side by side, merged by operation replay | inferenceregister | — |
| — | Change plan explains cost before applying— | Plan states credits/time/rebuild scope before execution | first_party_docsregister | — |
| — | Batch edits into one review— | Session accumulates edits into a single reviewable plan | inferenceregister | — |
| — | Conflict detection against concurrent upgrade— | Detect and surface conflicts between in-flight edits and pending upgrades | inferenceregister | — |
| — | Operation log as the P15 signal source— | The typed operation log IS the accepted-plan/edit-pattern signal P15 consumes | inferenceregister | — |
| — | Rejected-offer logging— | Log offers the client declined, not only those accepted | inferenceregister | — |
| — | Explain-why-unsupported responses— | Refusals name the violated constraint and the nearest supported alternative | first_party_docsregister | — |
| — | Nearest-supported-alternative suggestion— | On refusal, offer the closest in-algebra operation | inferenceregister | — |
| — | Change plan diff rendered visually— | Render before/after of affected surfaces, not code | first_party_docsregister | — |
| — | Dry-run against stress panel— | Every plan is dry-run against the stress cases before approval | first_party_docsregister | — |
| — | Idempotent edit application— | Every operation carries an idempotency key | first_party_docsregister | — |
| — | Chat proposes, algebra disposes— | Conversational requests are compiled into the seven-verb algebra; anything uncompilable escalates | observed_behaviorregister | — |
| — | Direct manipulation and chat share one operation log— | Both produce identical typed operations | inferenceregister | — |
| — | Chat clarification before mutation— | Ambiguity triggers a clarifying question, not a guess | first_party_docsregister | — |
| — | Show the plan, then execute— | Chat returns a ChangePlan for confirmation | first_party_docsregister | — |
| — | Terminology mapping per industry— | Client vocabulary maps onto capability semantics in the edit layer | first_party_docsregister | — |
| — | Voice/async edit intake— | Same operation algebra reachable asynchronously | secondaryregister | — |
| — | Non-destructive style re-pick— | Theme is a re-attachable versioned link; swapping preserves structure edits | first_party_docsregister | — |
| — | Style before structure ordering— | Elicit style first so structure previews render already-branded | first_party_docsregister | — |
| — | Simultaneous option presentation— | Present variants simultaneously within an axis | secondaryregister | — |
| — | Reorder-safe navigation editing— | Nav edits update route registry transactionally | inferenceregister | — |
| — | Edit provenance attribution— | Every operation records actor (client, agent, upgrade, migration) | first_party_docsregister | — |
| — | Read-only preview links for stakeholders— | Share preview at read authority | first_party_docsregister | — |
| — | Edit-time capability search— | Add operation queries the registry with port filters inline | first_party_docsregister | — |
| — | Client authority ceiling on edits— | Edit surface derives from the session authority ceiling | first_party_docsregister | — |
| — | Role-scoped edit surfaces— | Different roles see different subsets of the algebra | first_party_docsregister | — |
| — | Approval required for irreversible edits— | Irreversible class requires explicit confirmation bound to the plan hash | inferenceregister | — |
| — | No policy authoring from the editor— | Policy/permission edits are structurally absent from the algebra | first_party_docsregister | — |
| — | Edits never widen tenant scope— | Composition scope is intersection, never union; edits cannot widen it | first_party_docsregister | — |
| — | Secrets never enter the edit surface— | Secret references only; never values | first_party_docsregister | — |
| — | Audit trail of every offered option— | Log offered set, not just selection | inferenceregister | — |
| — | Edit freeze during release— | Editing locks while a release is promoting | inferenceregister | — |
| — | Per-capability edit permission from the contract— | CapabilityContract declares which verbs it supports | inferenceregister | — |
| — | Rights-aware edit restrictions— | Rights state restricts which verbs are offered on that capability | first_party_docsregister | — |
| — | Client-visible edit boundary documentation— | Publish what is editable per capability up front | inferenceregister | — |
| — | Escalation to human builder— | Named escalation path with context handoff | first_party_docsregister | — |
| — | Preview from release artifact— | One artifact serves both | inferenceregister | — |
| — | Per-edit incremental preview— | Parametric edits hot-apply; only code deltas rebuild | inferenceregister | — |
| — | Preview isolation per client— | Preview runs in the tenant's isolation boundary | first_party_docsregister | — |
| — | Preview data is synthetic by default— | Synthetic fixtures unless explicitly authorised | first_party_docsregister | — |
| — | Preview lease with cleanup— | Leased with timeout and deterministic teardown | first_party_docsregister | — |
| — | Warm preview pool— | Pre-warmed sandboxes; memory-preserving pause | first_party_docsregister | — |
| — | Preview URL is unguessable and expiring— | Signed, short-lived preview URLs | inferenceregister | — |
| — | Deterministic preview builds— | Pinned toolchain and lockfile | first_party_docsregister | — |
| — | Preview health distinct from build success— | Health check must pass before preview is presented as ready | first_party_docsregister | — |
| — | Side-by-side before/after preview— | Render both states simultaneously | inferenceregister | — |
| — | Mobile/responsive preview mandatory— | Preview includes declared viewport profiles | first_party_docsregister | — |
| — | Accessibility check in preview— | Automated a11y check on edited surfaces | first_party_docsregister | — |
| — | Edit operations feed capability demotion— | Edit volume/type per capability is a P15 demotion signal | inferenceregister | — |
| — | Edits that always recur become defaults— | Recurring edits promote into capability defaults or a new variant | inferenceregister | — |
| — | Unsupported requests become demand signal— | Refusal log is a roadmap input | inferenceregister | — |
| — | Escape-hatch rate as a health metric— | Track fork rate per capability | inferenceregister | — |
| — | Edit-to-release latency measured— | Instrument edit→preview→release | inferenceregister | — |
| — | Client edit patterns seed cold-start priors— | Aggregate edit patterns by industry as priors | inferenceregister | — |
| — | Editor emits QualificationDossier inputs— | Edited surfaces are re-qualified before release | inferenceregister | — |
| — | Rollback of an edit is a first-class operation— | Individual edits revertible without full release rollback | inferenceregister | — |
| — | Edit history survives capability replacement— | Intent records re-resolve against the replacement's slots where semantics match | inferenceregister | — |
| — | Editor as the only mutation path— | All changes flow through the operation log, including agent and upgrade changes | inferenceregister | — |
| — | REJECTED: free-form code editing in the client editor— | Explicitly out of scope; escape hatch is a state transition instead | first_party_docsregister | — |
| — | REJECTED: DOM-coordinate edit binding— | Superseded by stable semantic anchors | observed_behaviorregister | — |
| — | REJECTED: averaging an edit-quality score— | Min-gating instead | first_party_docsregister | — |
| — | REJECTED: automated visual pass/fail gate— | Human-terminal visual gate, honestly labelled | first_party_docsregister | — |
| — | REJECTED: industry-grouped style galleries— | Vibe/attribute grouping instead | first_party_docsregister | — |
| — | REJECTED: one-at-a-time option wizards— | Simultaneous presentation within an axis | secondaryregister | — |
| — | REJECTED: hand-composited preview thumbnails— | Literal crops of the real rendered artifact | first_party_docsregister | — |
| — | REJECTED: treating a green build as edit acceptance— | Workflow-level acceptance required | first_party_docsregister | — |