# Evidence and safety rules

## Evidence levels

| Level | Meaning | Permitted use |
|---|---|---|
| Observed | Read from live SQL once | Diagnosis only |
| Reproduced | Seen in independent before/after saves | Decoder rule candidate |
| Round-trip proven | Decode → unchanged encode returns identical bytes | Safe read/transform component |
| Activation proven | A human Configurator applied it and active SQL verified it | Controlled `upo_test` writer component |

No rule may be promoted because a name, suffix, or payload shape “looks right”.

## Codec boundary

The configuration-storage specification is the adapter's sole authority for
decoding and encoding. A writer is enabled only when the relevant version of
that specification defines every changed byte and every dependent integrity
atom, and round-trip evidence proves the encoder. Any remaining opaque atom is
preserved byte-for-byte; if a requested edit requires changing it, the write is
unsupported until the specification is extended by a controlled experiment.

## Allowed mutation boundary

- The adapter runtime uses SQL only.
- `upo_test` may receive controlled writes to `ConfigSave` and
  `ConfigCASSave` only.
- `Config`, `ConfigCAS`, and application data are never direct write targets.
- A write must have a live target resolution, optimistic SHA-1 precondition,
  reversible evidence, atomic transaction, and readback verification.
- Repository coordination is a separate policy; an adapter marker is not a
  native repository lock.

## Exact edits

For BSL fragment replacement, provide one of:

- an old fragment occurring exactly once;
- a larger unique surrounding fragment;
- a proven structural container path/offset plus original SHA-1.

If a fragment occurs zero or more than once, do not choose arbitrarily. Return
the count and candidate contexts. Deletion follows the same rule.

## What an agent must report

Every proposal and applied result must state:

- active and saved layers used;
- public target and SQL evidence retained internally;
- original and new SHA-1 values;
- paired files changed;
- exact-match count;
- rollback reference;
- Configurator refresh guidance.