incremental-safetylisted

# Incremental Safety > Status: v0.1 baseline draft — derived from the case catalog and axis definitions; awaiting trace evidence from Fable 5.1 case runs. ## When to apply - The change touches 3+ files, crosses a module boundary, or alters a public interface, schema, or wire format. - You are migrating between technologies (framework swap, storage engine, protocol version) while the system must keep running. - The change cannot be verified in one shot — the test suite, a benchmark, or production traffic is the only real oracle. - Rollback matters: the target runs in production, other agents or humans work on the same tree, or the deploy is not atomic. - A refactor started as "small" but the diff keeps growing and you have not committed anything runnable yet. - You are about to do a big-bang rewrite and cannot state what proves the rewrite behaves identically to the original. ## Core loop 1. **Name the end state and the invariant.** Write one sentence for the target and one for what must stay true throughout, e.g. "all existing tests pass", "API responses byte-identical", "p99 within 5% of baseline". The invariant is the operational definition of "safe" for every intermediate state; if you cannot state it, you cannot know a step succeeded. 2. **Find the seam.** Identify the narrowest interface where old and new can coexist: a function boundary, an adapter or facade, a routing layer, a config flag, a duplicated column. If no seam exists, your first change is to