// simplified current order on the owned patch lane run_fs_write_pre_hooks(..., &req.action).await?; let result = apply_patch_in_dir(...);
Similar rule logic can appear in all three places, but they are not interchangeable. The difference is who owns the write, when rejection happens, and what class of mistake each path is good at catching.
Read for: What changes when the runtime owns the mutation path instead of validating after the fact or on one workstation.

