Canonical mode matrix: the single source of truth for which transforms run in which
mode, at what ratio cap, for which task scopes and input formats. secret_redaction is
deliberately absent from this table — it runs unconditionally before the pipeline and
cannot be disabled (see budget::CompressionPolicyBuilder::build).
F-045: reversible evidence store and retrieval (roadmap.md F-045, interfaces.md
“Retrieval Marker Grammar” and the [retrieval]tokenfold.toml schema block).
Fail-closed safety invariants (INTERFACES.md Part 2 “Safety Invariants on Order”). The
pipeline checks these after every transform; a violation rolls that transform back
(pre-transform bytes restored) rather than shipping a corrupted or unsafe output.
Transform implementations. Each submodule exposes a pure function over bytes/text; the
pipeline (crate::pipeline) owns all bookkeeping (token counts, TransformReport,
safety validation/rollback). Canonical IDs and ordering live in crate::modes.