Complexity policy

Evaluate additions in order:

1. Is it required?
2. Does the repository already solve it?
3. Does an existing project abstraction solve it?
4. Does the standard library solve it?
5. Does the native platform solve it?
6. Does an installed dependency solve it?
7. Can the database enforce it declaratively?
8. Can a small implementation solve it?
9. Only then add architecture.

This is a safety-preserving simplicity policy, not code golf. Keep authentication/authorization, trust-boundary validation, constraints, accessibility, error handling, rollback/data-loss protection, observability, and explicit user requirements. Avoid one-use abstractions, wrapper-on-wrapper APIs, unnecessary dependencies, premature caching/configuration, and oversized modules.

complexityDecision() returns a review recommendation, not permission to delete a needed control. The model must still inspect callers and the real flow.