Invariance is enforced, not promised
Permanent slots have stable identifiers and are frozen in code. Editing a label, adding vocabulary or promoting a halo word cannot re-index or re-sort the grid. New permanent vocabulary occupies an unused slot; existing positions are untouched and every change is versioned.
Halo-to-permanent promotion is append-only
When a situational word proves itself in the halo, the Companion app can promote it into a free permanent slot. The Vocabulary surface shows exactly which slot will be used before you confirm, and records the change as an audit event.
Model Mode has no write path
Partner input in Model Mode produces transient highlights on a mirrored topology. It cannot append to the communicator's utterance ribbon and cannot trigger speech on their device.
Insights, not surveillance
Reports use derived measures: distinct permanent slots used, proportion of unprompted selections, communicative function mix, unresolved word searches, and corrected selections. Raw utterance history stays local to the communicator's device and is not surfaced here.
Communication-gap reporting
Where a search ended without a selection, EyeSay describes the observable system gap — for example a concept with no reachable vocabulary — rather than guessing what the communicator meant or intended.
Team access with scopes
Guardians, therapists, teachers and support staff each get an access profile: full, vocabulary and routines, or read only. Access changes are recorded.