1. The canvas is the product. Anything that compromises canvas performance — visual flourishes, deep widget trees, unnecessary state — is the wrong trade‑off.
2. Local‑first, always. No user interaction should depend on a network round‑trip during play.
3. Cultural integrity is non‑negotiable. Cultural review is a publish gate, not a polish step.
4. Accessibility is part of the colouring engine. Numbers, contrast, and tap targets are core, not a settings page.
5. Server‑side trust. Premium gating and receipt validation live on the backend. The client never decides.
6. Onboarding earns every screen. Time‑to‑aha is the only onboarding metric that matters. No feature tours, no signup gates, no paywall in the welcome flow.
7. Small, measurable changes. Every phase has exit criteria. The orchestrator agent should refuse to advance until they’re met.

Final word

The core development risk is not the backend or the library. The critical risk is whether the Flutter canvas engine performs well with real artwork complexity on real devices. The Phase 0 proof of concept must be completed — and signed off against the performance budget in §11.6 — before the project commits fully to production implementation.