---
id: ADR-PFM-OPS-017
title: The commercial source is read-only and off until its key exists; the nightly read is authoritative
product_area: platform
module: operations
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Treat HubSpot as a read source: without a token retain stored coverage, and when configured use
  notifications and nightly reads to request fresh snapshots.
constrains:
  - WF-PFM-OPS-013
  - WF-PFM-OPS-014
  - WF-PFM-OPS-015
  - SVC-PFM-OPS-licensing
  - DOM-PFM-OPS-003
origin: >-
  services-platform:docs/proposals/application-access-and-entitlements.md#4.3 and #10.3 (actions only Andrew
  can take); docs/licensing.md#11. Switching the HubSpot source on
alternatives:
  - option: Notifications as the only trigger
    why_not: Missed subscriptions would leave the local snapshot stale indefinitely.
  - option: Remove all contract coverage when configuration is missing
    why_not: Configuration absence is not evidence that earlier commercial coverage ended.
consequences:
  - Company reads require a token; webhook reception also requires its signing secret.
  - >-
    Nightly recovery depends on successful publication and subsequent reads rather than a strict one-day
    bound.
  - The provider property mapping still needs a real-source validation.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/licensing/hubspot/*, services/sync/*; docs/licensing.md §2, §11,
    §12.
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
---

# The commercial source is read-only and off until its key exists; the nightly read is authoritative

## Context

The pinned operating record describes provider activation as unfinished.

## Decision

Read rather than update HubSpot. Skip provider reads when unconfigured, preserving stored windows. Use signed notifications as hints and the configured nightly pass as recurring recovery.

## Alternatives Considered

Notification-only recovery cannot cover missed messages. Clearing stored coverage would make configuration failures remove access.

## Consequences

Activating credentials enables the feed, but provider behavior and recurring recovery still require operational proof.