The feature floor

The contract governing the externalization migration — moving a capability out of the core must not drop any of these cross-cutting behaviors. The floor items (each backed by an existing spec):

• capability_state gating
• enabled=false but visible degrade
• system-prompt fragment + part_ids + hash contribution (system-prompt-hash-regression)
• ACL (acl-and-quota-granularity)
• quota
• the connector-dep gate (connector-deps)
• Close-hook
• ErrHidden (undiscovered, not rejected)
• mode gating (code/public/byoai)

Floors are enumerated per capability family: booking / retrieval / email / skill / ext-mcp / job-loop / summarize / ask_visitor.

Why it exists: a migration that silently loses a floor item looks green (the capability still works) while a cross-cutting guarantee is gone — the floor list makes the invariants explicit so the migration can be verified against them, not against "it still answers". This is the migration's acceptance spec.