New-feature checklist

1. Is it an area with a registry key, a default (off unless core) and an “off” behaviour (hidden, refused, no reports, no jobs)? Does a purge exist and keep payments?
2. Which capability does it need? Is every list scoped to the tenant and the role, and does the UI hide what the role cannot use?
3. Does every state change write an audit entry, go through the one workflow or availability module, and respect immutable evidence?
4. Is every endpoint in OpenAPI (shown in Swagger UI and ReDoc, passing redocly lint) with typed errors, throttles with Retry-After, and the same authority for web and native? Are the generated types regenerated?
5. Does money record first, in minor units with currency, idempotently, with webhook verification and Stripe, Razorpay and offline paths? Are secrets write-only and encrypted?
6. Does it add analytics as counts-only, tagged client, with any outside provider off until consent?
7. Do public pages hide private fields? Are links opaque? Is anything personal encrypted and classified?
8. Are all strings translatable, both themes checked, tokens only, loader and motion rules followed, the accessibility floor met?
9. Are files under 300 lines, one responsibility each?
10. Are tests added (never deleted), the guide article and docs (with screenshots) updated, the version bumped, and the merge left to the maintainer?
11. Does the installer or update path still work: one-line install, backup first, rollback, and (if it adds a service) the hybrid and no-Redis choices?
12. Is the decision recorded in docs/decisions.md with its reason, and are handover/CONTINUE-HERE.md and handover/TODO.md updated?
13. Does the pipeline cover it (lint, types, unit, integration, contract, guards, e2e, security, build), all green?

Part of Space Works product rules, published from docs/product-rules.md. Edit it there.