All state derives exclusively from immutable events. No destructive updates. No silent overwrites. Projections are derivative, never authoritative.

Errors are corrected only via compensating events. Original events are never deleted or rewritten. Corrections require reason, actor, and timestamp linkage.

No forced partnerships or embedded advertising. Equal support for all microchip brands. Data export always available. No technical or contractual lock-in.

Critical daily workflows MUST NOT exceed: ≤3 clicks post-context, ≤1 form screen, 0 mandatory free-text fields when structured options exist. Violations are defects.

Offline commands are first-class. Idempotent command handling is mandatory. Conflicts MUST surface to users. Silent failure is prohibited.

Approved adoptions MUST be resumable at any step. Payment, documents, and handoff MUST be atomic from the user perspective.

Time from intake to first care action MUST be measurable. KPI MUST be reportable, auditable, and ledger-traceable.

Sandbox data MUST never leak to production. Training mode MUST be visually distinct and technically isolated. Ambiguity fails closed.

Hard invariants: Page load p95 <2s, API response p95 <200ms, Search p95 <500ms. Violations are defects.