Product decision
Some users will want TrainerOS to read game progress while never modifying a game save.
Add a global user-facing policy that disables all TrainerOS semantic save mutations while preserving verified read capabilities.
Behavior
When read-only integration is enabled:
- Pokédex/progress reads continue;
- Party/Storage reads continue;
- Journey projections continue;
- ordinary save backups may still be created if they are strictly copy-only;
- restore, healing, purchases, Party/Storage moves, release, trade/import and every other save mutation are unavailable;
- no hidden background feature may bypass the policy.
The provider may still advertise technical write capability, but effective user capability is masked by policy.
UX
Settings should clearly explain that this controls TrainerOS-initiated save modification, not emulator/game writes during normal play.
Write-only actions should disappear or become clearly unavailable with a concise reason.
Do not flood normal screens with warnings.
Safety boundary
Enforce the policy below QML at the shared mutation service so a missed UI check cannot perform a write.
Tests must prove every registered writer is rejected centrally when read-only mode is active.
Acceptance
- One global setting disables every TrainerOS semantic game-save mutation.
- Read-only observations keep working.
- Normal emulator gameplay/save behavior is unaffected.
- Protected restore is also blocked unless the policy explicitly defines it as a separately confirmed recovery exception.
- QML cannot bypass the policy.
- New future write capabilities are denied by default until they pass through the same policy boundary.
- The preference survives restart and Trainer switching according to its chosen device-wide policy scope.
Product decision
Some users will want TrainerOS to read game progress while never modifying a game save.
Add a global user-facing policy that disables all TrainerOS semantic save mutations while preserving verified read capabilities.
Behavior
When read-only integration is enabled:
The provider may still advertise technical write capability, but effective user capability is masked by policy.
UX
Settings should clearly explain that this controls TrainerOS-initiated save modification, not emulator/game writes during normal play.
Write-only actions should disappear or become clearly unavailable with a concise reason.
Do not flood normal screens with warnings.
Safety boundary
Enforce the policy below QML at the shared mutation service so a missed UI check cannot perform a write.
Tests must prove every registered writer is rejected centrally when read-only mode is active.
Acceptance