Destructive Execution Boundary. The line that separates validation, planning, dry-run behavior, and prepared intent from real mutation that can destroy, overwrite, install, enforce, or otherwise change the outside world.
The CapStart README demonstrates the concept: profiles can be validated, compiled, planned, fetched, and dry-run safely, while real installer mutation is gated behind CAPSTART_INSTALLER_ENV=1 and destructive acceptance tests must run only inside disposable installer VMs. The boundary is enforced through explicit execution modes, not just developer caution.