# Live customizations

A live customization is one canonical `plugin.live.json` containing manifest,
plain JavaScript, scoped CSS, settings schema, revision, parent revision, and
bounded provenance. It does not compile TypeScript/JSX or resolve npm imports.

Every update is compare-and-set against the exact current revision. Thortiq
validates syntax, schema, CSS, permissions, and compatibility, then starts a
side-effect-denying disposable preview before a write or runtime swap. Failure
keeps the last-known-good revision active.

Source may synchronize, but execution approval and exact-origin approval are
device-local. Only reviewed descendants inside the local authority envelope can
auto-admit. Concurrent children remain explicit branches; never text-merge and
execute program source automatically.

Live Markdown blocks are declarative UI lifecycles, not DOM callbacks. Declare
the block with `runtime: "live-sandboxed"` and
`rendererMode: "live-declarative"`, then handle the
`markdown-block-<local-id>` lifecycle mount. Its `initialState` is the
immutable admitted block DTO. Publish through that lifecycle's `ui.setView`;
HTML, scripts, URLs, CSS strings, DOM nodes, and callbacks are rejected by the
same host validator used for live views. Dispose subscriptions and action
listeners when the lifecycle detaches.
