Institutional surface
Read-only first. Explicit boundaries by default.
Public-safe and operator-only fields remain separated. Least-privilege posture governs product design.
Boundary table
Field visibility, replay boundaries, and operator-only surfaces are versioned and explicit.