--- name: protocol-23-layering-enforcement description: Protocol 23 (render only renders; state.js owns state) — the standing ruling that it gets ENFORCED, never reworded to match the code metadata: node_type: memory type: feedback originSessionId: ddc556a5-69b4-4c3b-831d-22b6f8d7d63c --- Protocol 23 states the layering rule: *rendering only renders; state.js owns state; the registry never touches state; api.js handles AI+import; cloud.js handles sync — systems communicate only through established functions.* The 2026-07-13 architecture review found the code was widely violating it, with the render layer acting as a second state manager. **Why:** The standing ruling from that finding is the part worth keeping, and it generalises past this one protocol. **When a stated rule and the code disagree, the fix is ENFORCEMENT — never softening the rule to match the code.** Do not reword Protocol 23 to describe what the code does. A stated rule with no guard is an unlocked door; the answer is to fit a lock, not to redraw the doorway. This one ranks highest for damage because a stray `saveState()` on a render path is a **data-loss / trust risk**, not just a lost afternoon. **How to apply:** When building near render/services, don't add new `saveState()` calls in render files and don't add new service→`render*()` calls — invert the edge (service emits, UI subscribes). The guard that was owed here **was built**: Suite 236 in `tests/arch-conformance-check.js`, live since 2026-07-18, baselining the existing violations so the count can only shrink. *This file previously argued the guard was still outstanding; corrected 2026-07-20.* Note the ratchet only stops NEW violations — draining the baselined ones is separate work, and `QUEUE.md` is the authority on whether it's still queued. Same pattern as [[self-improving-code]].