K4 POST /api/security/configure/propose — the configure assistant's charter changes validated as the creator would save them: ConfigureChange and ConfigureChangeParser (SET_ITEM, SET_GROUP, REMOVE_ITEM, SET_FIELD, SET_PLACEMENT, SET_VOICE; INVALID_CHANGE, NOT_IN_SCOPE, HIDE_NOT_OFFERED), ConfigureProposalService (rights per change, registry clamp, item shape, identity-replace apply, list rules with CAP_REACHED, references, up to three resolve passes clamping to inherited bounds and refusing LOCK...