---
id: ADR-PFM-OPS-012
title: 'A company’s contract copy is replaced whole after a complete read, or not at all'
product_area: platform
module: operations
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Read a company completely, then replace its contracts, lines, windows and success health atomically;
  provider failure changes health while retaining coverage.
constrains:
  - DOM-PFM-OPS-003
  - STATE-PFM-OPS-005
  - WF-PFM-OPS-013
  - SVC-PFM-OPS-licensing
origin: 'services-platform:docs/proposals/application-access-and-entitlements.md#4.4 (decided by Andrew 2026-10-11)'
alternatives:
  - option: Apply individual notification changes
    why_not: Notifications identify something to reread and do not provide a complete commercial snapshot.
  - option: Remove coverage after a provider failure
    why_not: Provider outages would remove access despite the last successful evidence of coverage.
consequences:
  - Provider errors leave the previous windows available to the resolver.
  - Unchanged windows do not request another cache refresh.
  - Notifications request complete company reads.
  - Atomic replacement does not establish safe ordering of simultaneous snapshots.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/licensing/services/sync/sync-company-licences.ts,
    accept-webhook-delivery.ts; docs/licensing.md §12.
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
---

# A company’s contract copy is replaced whole after a complete read, or not at all

## Context

External commercial data must not become a partial local licensing picture.

## Decision

Complete the provider read before starting replacement. Write the resulting snapshot, resolved windows and success health together; record provider failure separately.

## Alternatives Considered

Incremental notification updates risk incomplete snapshots. Clearing on failure would turn provider reliability into customer access reliability.

## Consequences

Customers retain the last successful commercial picture until a complete replacement succeeds.