ARFC-1014: Scope and Sequence Change Impact

Status

Draft Draft Date: 2026-08-08 Last Call Date: — Publication Date: — Version: 0.1

Abstract

A plan is edited constantly. Teachers rename units, reorder them, move lessons between them, cut material that is not working, and restructure whole courses between terms. Most of those edits are harmless. A few can remove a large part of a course’s plan, or change what students are working from in the middle of a term.

This ARFC is the safety layer over ARFC-1013. It classifies edits by what they can actually affect, guarantees that ordinary editing detaches nothing, and requires that anything genuinely consequential be shown to the teacher — with the specific counts, the specific sections, and an explicit statement of what will not change — before it is applied.

One principle does most of the work: a plan states intent, and evidence records what happened. Editing intent never rewrites history. Deleting a unit does not delete its lessons, releasing a claim does not delete an objective, and nothing in this document can destroy a student’s work or the levels already reported from it. Edits detach and retire; they do not erase. That makes most of what teachers fear about restructuring untrue, and it lets the warnings that remain be about the things that genuinely matter.

This is also the platform’s first impact-preview-and-confirm contract, and it is specified to be reusable beyond planning.

Table of Contents

  1. Introduction
  2. Motivation
  3. Specification
  4. Version 1 Scope
  5. Security Considerations
  6. Backward Compatibility
  7. References

1. Introduction

ARFC-1013 specifies what a plan is and how it is built. This document specifies what happens when it changes.

The concern is not hypothetical. A plan accumulates work: units named and arranged over hours, lessons written and placed, objectives claimed, and — once a term begins — students’ progress against all of it. A teacher restructuring a course in March is editing something several sections are actively working from, and something that took an afternoon or a year to build.

Two failure modes matter. The first is silent loss: an edit that quietly detaches lessons from the objectives they were written for, so that a coverage report degrades and nobody notices until an audit. The second is disruption: a change that alters what students see mid-term without anyone being told it would.

The design addresses them differently. Silent loss is prevented by construction — ordinary editing cannot detach anything, and removal detaches rather than erases. Disruption cannot be prevented, because sometimes a mid-term change is exactly what a teacher intends; it is instead made visible, specific, and deliberate.

2. Motivation

Current State

None of this exists, because plans do not exist. There is no unit to delete, no claim to release, and no impact to summarise.

More significantly, the platform has no impact-preview pattern at all. No entity anywhere offers “show me what this will affect, then let me confirm it.” Every destructive action either applies immediately or is refused. This ARFC is therefore establishing a contract, not adopting an existing one.

The nearest existing precedent is narrower and instructive. Publishing a lesson is deliberately a separate act from marking it released, so that finishing material and exposing it to students cannot happen by accident. That is the same instinct — separate the consequential step from the ordinary one — applied to a single decision rather than as a general pattern.

Missing Capabilities

Teachers cannot know what an edit will affect. Deleting a unit containing eleven lessons and twenty claims looks exactly like deleting an empty one until it is done.

Ordinary editing feels dangerous even when it is not. Without a stated guarantee, a teacher has no reason to believe that renaming a unit or reordering a plan is safe, so they avoid improving a plan they would otherwise fix.

Mid-term changes are indistinguishable from planning changes. Editing a plan governing three active sections and editing a draft for next year are the same operation with the same absence of warning.

A failed save leaves unknown state. Without an all-or-nothing guarantee, a teacher whose save fails partway does not know what applied.

Concurrent editing produces confident mistakes. Two curriculum leads working on one plan can each be shown an accurate impact summary, and one of them can then confirm against facts the other has already changed.

Design Goals

  1. Make ordinary editing provably safe, and say so, so teachers restructure freely.
  2. Never destroy evidence. No edit to a plan may remove a student’s work or a level already reported.
  3. Prefer detaching to erasing. Removal should reduce to a reportable state, not a loss.
  4. Show consequences before they happen, with specific counts and specific sections — never a generic warning.
  5. State what will not change, because reassurance is as actionable as warning.
  6. Refuse to act on stale facts.
  7. Apply completely or not at all.
  8. Establish a pattern worth reusing for every future consequential action on the platform.

3. Specification

3.1 Core Principles

A plan states intent; evidence records what happened. These are different kinds of thing, and editing the first cannot rewrite the second. This single distinction is what makes most restructuring safe.

Detach, retire, never erase. Removing something from a plan reduces it to a reportable state — unplaced, unclaimed, retired — rather than deleting it. A teacher can always see what fell out of the plan, and can put it back.

Safety is a guarantee, not an outcome. The safe-edit guarantee in §3.4 is stated so that teachers can rely on it, and so that any implementation violating it is a defect rather than a surprise.

A warning must be specific to be useful. “This may affect other content” changes no behaviour. “This removes eleven lessons from the plan and releases twenty claims, three of which no other unit claims, affecting two active sections” supports a decision.

Say what will not change. A teacher deciding whether to proceed needs the boundary of the change as much as its extent. Every summary states both.

Risk comes from what is affected, not from what is edited. The same edit is unremarkable on a draft and consequential on a plan three sections are working from. Classification accounts for both.

3.2 Evidence Is Never Destroyed

No operation specified in this ARFC or in ARFC-1013 may remove:

This holds regardless of what is deleted from a plan, and it holds for authority-derived and person-added objectives alike. A grade reported in October remains explicable in June even if every unit that organised its teaching has since been dissolved.

The consequence worth stating plainly to teachers: restructuring a plan cannot cost a student their record. That is what makes the rest of this document a set of warnings about planning consequences rather than about data loss.

3.3 Classifying an Edit

Every edit is classified along two independent dimensions.

What the edit does:

Class Examples
Safe renaming a unit, rewording an objective, reordering units, setting hours or padding, renaming the plan
Structural moving a lesson between units, adding or releasing a claim, adding a unit, placing a lesson
Removing deleting a unit, removing a lesson placement, retiring a person-added objective

What the edit reaches:

Reach Meaning
Draft the plan is not active; no section is working from it
Active, no term in progress the plan is active but no section is currently mid-term
Active, term in progress one or more sections are actively working from this plan 
flowchart TB
    E[Edit requested] --> C{Class?}
    C -->|Safe| A1[Apply immediately<br/>guarantee holds, no summary]
    C -->|Structural| R1{Reaches a term<br/>in progress?}
    C -->|Removing| S[Compute impact summary]
    R1 -->|No| A2[Apply immediately]
    R1 -->|Yes| S
    S --> P[Present summary:<br/>what changes · what does not<br/>· which sections]
    P --> CF{Confirmed against<br/>this summary?}
    CF -->|Yes| A3[Apply completely]
    CF -->|No, or stale| REJ[Refuse and explain]

Safe edits are never gated, whatever they reach. Removals are always gated. Structural edits are gated only when a term is in progress.

3.4 The Safe-Edit Guarantee

For any safe edit, the platform guarantees that:

This is possible because a unit’s identity is independent of its name and its position (ARFC-1013 §3.8). Renaming changes a label; reordering changes a presentation order. Neither is what anything else refers to.

The guarantee is stated for a practical reason. Teachers who suspect that reordering might break something do not reorder, and a plan they are afraid to improve stops describing what they actually teach. Making the guarantee explicit is what makes a plan a living document.

Rewording an objective is included here deliberately: it never severs the link to the standard it came from, and the authority’s original wording is retained alongside it (ARFC-1011 §3.4).

3.5 Structural Edits

Structural edits change the plan’s shape without removing anything.

Moving a lesson between units takes the lesson out of one unit and puts it in another. Its alignments, its students’ evidence, and its expected duration are untouched. Both units’ balance changes, and both are reported.

Releasing a claim means a unit no longer asserts that it teaches an objective. The objective is unaffected and remains part of the course’s scope; if no other unit claims it, it becomes unclaimed — a reported planning state, and a readiness defect where the objective is required.

Adding a unit or placing a lesson cannot remove anything and is safe in every respect except balance, which is reported.

Structural edits are applied immediately on a draft, and on an active plan when no term is in progress. Where a term is in progress they are summarised and confirmed, because moving a lesson between units changes what students see the material grouped under while they are working through it.

3.6 What Removal Actually Does

Removal never erases. In each case the removed thing reduces to a reportable state:

Operation What happens What does not happen
Delete a unit its lesson placements are removed, so those lessons become unplaced; its claims are released, so objectives with no other claiming unit become unclaimed no lesson is deleted, no objective is deleted, no evidence is affected
Remove a lesson placement the lesson becomes unplaced the lesson, its missions and challenges, its alignments, and its students’ work are untouched
Retire a person-added objective it leaves the course’s active scope; its claims are released its alignments and the mastery judgements made against it remain, so past reports stay explicable

Authority-derived objectives cannot be retired at all — the floor does not fall (ARFC-1011 §3.4) — so the most consequential removal a teacher might attempt is refused before impact is even considered.

Unplaced and unclaimed are recoverable states. A lesson knocked out of the plan can be placed again; an objective left unclaimed can be claimed again. That is what makes deletion of a unit a planning decision rather than a destructive one, and it is the reason the impact summary can honestly tell a teacher that their work is not lost.

3.7 The Impact Summary

Before any gated edit, the teacher is shown a summary. It states three things.

What will change, with counts and identities rather than magnitudes:

What will not change — explicitly, not by omission:

What follows from it — the readiness consequences, so the teacher sees the plan’s resulting state rather than only the edit: which required objectives will be unclaimed, and whether the plan will still be balanced enough to remain active.

A summary is a read. Requesting one changes nothing, so a teacher may examine the consequences of an edit they then decide not to make.

3.8 Confirmation

A gated edit requires explicit confirmation, and confirmation must reference the summary the teacher was shown.

An attempt to apply a gated edit without that reference is refused with a structured explanation — it states that confirmation is required and what would be affected. It is never silently applied, and never partially applied.

This matters more than a confirmation dialogue in the client. A gate that exists only in the interface is not a gate: a second client, a bulk operation, or an integration would bypass it. The requirement is part of the contract, so every caller meets it.

3.9 Stale Summaries

A confirmation is valid only against the state its summary described.

Where the plan has changed since the summary was computed — because someone else edited it, because a lesson was deleted, because a section’s term ended — the confirmation is refused as stale, and the response says what changed. The teacher requests a fresh summary and decides again.

This is the failure mode that produces confident mistakes. Two curriculum leads working on one plan can each be shown an entirely accurate summary; without staleness detection, the second one’s confirmation applies to a plan that no longer matches what they were told. Refusing is the only correct behaviour, and refusing with the reason is what makes it recoverable rather than merely frustrating.

3.10 Active Instruction

A section is in progress when its term is under way. Because a plan is shared by every section of its course, an edit reaches all of them, and they may be in different states — one mid-term, one not yet begun, one finished.

For any gated edit, the summary names which sections are in progress, so a teacher can see that a change affects the two classes they are teaching now and not the one starting in January.

Current-term progress is preserved absolutely. Editing a plan does not alter what students have completed, what they scored, the conditions recorded, or the levels reported. What changes is how the remaining material is organised and presented.

Where an edit would leave a required objective unclaimed in a course with sections in progress, that is surfaced with particular prominence: it means students are working toward a requirement the plan no longer places anywhere.

3.11 Activating a Plan Mid-Term

Activation is the largest single change available, because it replaces the plan every section is working from in one act.

Activation while any section is in progress is always gated, and its summary is a comparison rather than a description of one edit: which units are added, removed, renamed, or reordered; which claims change; which lessons move or become unplaced; and which required objectives are unclaimed in the incoming plan.

Activation may be deferred to a term boundary. A teacher who has prepared next year’s plan may mark it to take effect when the current term ends, so that no mid-term disruption occurs at all. This is the expected path for ordinary year-over-year planning, and it makes the gated mid-term activation the exception rather than the routine.

Superseded plans are retained. The previously active plan becomes a draft rather than being discarded, so an activation that turns out to be wrong can be reversed by activating the previous plan again — itself a gated edit, summarised the same way.

3.12 Draft Editing Is Unguarded

Editing a draft plan requires no summary and no confirmation for any class of edit, including removal. Nothing is working from a draft, so there is nothing to disrupt.

The distinction must be visible. A teacher editing a draft is told they are editing a draft, and a teacher editing the active plan is told that too, before they begin rather than at the moment of refusal. The absence of warnings on a draft should read as this is safe, not as warnings are broken.

This is what makes the duplicate-then-activate path from ARFC-1013 §3.16 genuinely comfortable: a teacher restructuring next year’s course works entirely unguarded, and meets a single gate at activation.

3.13 All or Nothing

Every edit applies completely or not at all. This holds for edits affecting many things at once — deleting a unit with eleven lessons, or reordering an entire plan — and it holds when an edit fails partway for any reason.

A failed edit leaves the plan exactly as it was. There is no state in which some of a unit’s lessons have been unplaced and others have not, and no state a teacher must inspect to discover what applied.

For reordering specifically, this is what allows a teacher to restore a previous order: the operation takes the intended order as a whole, so a failure leaves the previous order intact rather than a partially rearranged plan.

3.14 No False Success

Success is reported only when the change is durable. Four failures must be distinguishable, and none may present as success:

Outcome Meaning
Applied the change is durable
Refused: confirmation required a gated edit was attempted without a valid confirmation
Refused: stale the summary the confirmation referenced no longer describes the plan
Refused: no longer exists something the edit named has since been deleted
Failed the change could not be applied; the plan is unchanged

The fourth deserves emphasis. An edit naming a unit or lesson that someone else has removed is reported as that specific thing no longer exists — not as a generic failure, and not as a success that quietly did less than asked.

3.15 A Reusable Pattern

The contract in §3.7 through §3.9 is deliberately general, because the platform has no such pattern and will need one repeatedly. Its four elements are:

  1. A summary is a read. Computing consequences never changes anything.
  2. The summary states what will change, what will not, and what follows.
  3. Confirmation references a specific summary, and the contract requires it, so no client can bypass the gate.
  4. A confirmation against changed state is refused with the reason, never applied.

Any future consequential action — withdrawing a published lesson, archiving a course, reassigning a cohort — should adopt this rather than inventing another shape. Consistency here is worth more than local optimisation: teachers learn one interaction and trust it everywhere.

3.16 API Surface

Method Path operationId Description
POST /v2/plans/{plan-eid}/impact/unit-deletion previewUnitDeletionImpactV2 Summary for deleting a unit
POST /v2/plans/{plan-eid}/impact/lesson-removal previewLessonRemovalImpactV2 Summary for removing a lesson placement
POST /v2/plans/{plan-eid}/impact/claim-release previewClaimReleaseImpactV2 Summary for releasing a claim
POST /v2/plans/{plan-eid}/impact/objective-retirement previewObjectiveRetirementImpactV2 Summary for retiring a person-added objective
POST /v2/plans/{plan-eid}/impact/activation previewPlanActivationImpactV2 Comparison summary for activating this plan
POST /v2/plans/{plan-eid}/activate-at-term-end deferPlanActivationV2 Activate when the current term ends, avoiding mid-term change
GET /v2/plans/{plan-eid}/edit-context getPlanEditContextV2 Whether this plan is draft or active, which sections are in progress, and the caller’s permissions

Every gated mutating operation in ARFC-1013 §3.18 accepts a confirmation referencing a summary from the corresponding preview above. A gated call without one is refused per §3.8; the operations themselves are not duplicated here.

getPlanEditContextV2 exists so a client can tell a teacher what kind of plan they are about to edit before they edit it, which §3.12 requires.

3.17 Authorization Model

Requesting a summary requires the authority to read the plan. A summary is a read, and seeing the consequences of a change one may not make is legitimate — a teacher may need to explain to a curriculum lead why a change should happen.

Confirming a gated edit may be restricted more narrowly than editing. An institution may allow instructors to edit a plan while reserving destructive changes, and changes reaching sections in progress, to a curriculum lead. Where a caller may edit but not confirm, the refusal says so specifically rather than presenting as a generic denial.

Activation authority is separate again, per ARFC-1013 §3.19, because it changes what every section of a course is working from.

Every gated edit is attributable. The confirming caller, the summary they confirmed against, and the time are recorded — so a question months later about why a unit disappeared from a course has an answer.

Summaries name sections, and nothing more. They identify which sections are affected so a teacher can judge the reach of a change. They contain no student names, no scores, and no progress data, and must not become a route to them.

4. Version 1 Scope

Included

Excluded

5. Security Considerations

A summary is a disclosure surface. It reveals a plan’s structure and which sections are affected. It is scoped exactly as reading the plan is, and it deliberately contains no student data, so a caller who may see planning consequences does not thereby gain a view of student records.

Confirmation binding prevents a class of substitution. Because a confirmation references the summary it was shown, a caller cannot be presented with the consequences of a small change and then have a larger one applied — whether through a client defect, a race, or deliberate manipulation. This is the security value of §3.9, separate from its usability value.

Gating in the contract rather than the client is what makes it real. A confirmation requirement enforced only in the interface is bypassed by any second client, script, or integration. Placing it in the contract means the gate holds for every caller, including ones written later by someone else.

Attribution matters because plan edits are hard to notice. A deleted unit leaves no error and no failing request — a course simply covers less than it did. Recording who confirmed each gated edit, and against what, is what makes such a change answerable months later.

Refusals must not become an enumeration channel. A refusal reporting that something no longer exists is useful to a teacher and potentially informative to someone probing. Refusals are as specific as the caller’s existing read access already permits, and no more.

6. Backward Compatibility

Nothing exists to be compatible with. Plans, units, and claims are introduced by ARFC-1013, so no current behaviour changes and no existing client is affected.

The pattern is additive where it touches existing behaviour. Publishing a lesson already separates the consequential act from the ordinary one, and this ARFC does not alter it. Where existing destructive actions elsewhere might benefit from the pattern, adopting it is a future change requiring its own compatibility treatment, since a previously ungated operation becoming gated is a breaking change for callers.

Gated operations are gated from the start. No plan operation is ever ungated and then gated later, which would break every existing caller. The confirmation requirement is part of the operations’ contract at introduction.

Nothing in this document can invalidate a reported grade. Because evidence is never destroyed (§3.2) and mastery judgements record the policy in force when they were made (ARFC-1012 §3.13), a grade issued before a restructuring remains both valid and explicable afterwards. Institutions can therefore restructure plans without concern for their reporting history.

7. References

Platform Documentation

Author

ĀYŌDÈ Development Team Codermerlin Academy Architecture