--- id: ATS-PFM-OPS-012 scope: CAP-PFM-OPS-012 product_area: platform module: operations revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-OPS-012-01 title: Resolve only recognized active statuses level: unit proves: - BR-CAP-PFM-OPS-012-01 - INV-DOM-PFM-OPS-003-07 preconditions: 'Active, cancelled and unknown-status contracts exist.' steps: Derive their application windows. expected: Only eligible terms grant access and the unfamiliar status is flagged. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-116 provenance: test source: >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#resolves nothing for a status it has never heard of, and flags it so the vocabulary can be confirmed evidence_candidates: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#resolves nothing for a status it has never heard of, and flags it so the vocabulary can be confirmed category: validation binding_evidence: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#resolves nothing for a status it has never heard of, and flags it so the vocabulary can be confirmed - id: ATS-PFM-OPS-012-02 title: Reject unreadable terms level: unit proves: - BR-CAP-PFM-OPS-012-02 preconditions: 'Contracts have missing start, invalid end or unqualified open-ended terms.' steps: Resolve their windows. expected: Invalid terms grant nothing and qualifying automatic renewal remains open-ended. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-116 provenance: test source: >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#licenses nothing and is flagged when it has no end date and does not renew automatically evidence_candidates: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#licenses nothing and is flagged when it has no end date and does not renew automatically category: validation binding_evidence: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#licenses nothing and is flagged when it has no end date and does not renew automatically - id: ATS-PFM-OPS-012-03 title: Inherit dates independently level: unit proves: - BR-CAP-PFM-OPS-012-03 preconditions: A contract line supplies only an end date. steps: Resolve its application window. expected: The line’s end and inherited contract start are used. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-116 provenance: test source: >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#takes each date independently, so a line may override one and inherit the other evidence_candidates: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#takes each date independently, so a line may override one and inherit the other category: rule binding_evidence: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#takes each date independently, so a line may override one and inherit the other - id: ATS-PFM-OPS-012-04 title: Expand recognized commercial products level: unit proves: - BR-CAP-PFM-OPS-012-04 preconditions: 'Lines identify a bundle, feature, service and unmapped product.' steps: Resolve their grants. expected: >- Mapped outputs are retained, service-only products grant no application and unfamiliar products are flagged. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-116 provenance: test source: >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#licenses nothing and flags the SKU when the map does not cover it evidence_candidates: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#licenses nothing and flags the SKU when the map does not cover it category: rule binding_evidence: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#licenses nothing and flags the SKU when the map does not cover it - id: ATS-PFM-OPS-012-05 title: Distinguish continuity from real gaps level: unit proves: - BR-CAP-PFM-OPS-012-05 preconditions: 'Terms overlap, touch and leave actual gaps.' steps: Resolve each set. expected: Continuous terms merge and separated terms remain separate. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-116 provenance: test source: >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#leaves a real gap between two terms as two windows, because the licence did lapse evidence_candidates: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#leaves a real gap between two terms as two windows, because the licence did lapse category: edge binding_evidence: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#leaves a real gap between two terms as two windows, because the licence did lapse - id: ATS-PFM-OPS-012-06 title: Apply calendar grace to finite terms level: unit proves: - BR-CAP-PFM-OPS-012-06 - INV-DOM-PFM-OPS-003-06 preconditions: Windows end near calendar boundaries and another remains open-ended. steps: Resolve their grace dates. expected: Finite terms gain seven days and the open-ended term has no grace end. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-116 provenance: test source: >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#is the seven days after the end date that decision D3 settled on evidence_candidates: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#is the seven days after the end date that decision D3 settled on category: boundary binding_evidence: - >- services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#is the seven days after the end date that decision D3 settled on - id: ATS-PFM-OPS-012-07 title: Send the accepted renewal warning level: api proves: - BR-CAP-PFM-OPS-012-07 preconditions: A contract is sixty days from its end. steps: Run the intended renewal-notice flow. expected: Workspace administrators receive the coming-end explanation. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: [] provenance: proposed source: FND-PFM-OPS-012 category: failure - id: ATS-PFM-OPS-012-08 title: Preserve the last complete commercial copy level: api proves: - BR-CAP-PFM-OPS-012-08 preconditions: A company has a successful snapshot before a provider outage. steps: Attempt synchronization during the outage. expected: 'Commercial data and last success remain, health records a redacted error and no flush is requested.' negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-108 provenance: test source: >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes no snapshot, no window and no last success evidence_candidates: - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes no snapshot, no window and no last success category: failure binding_evidence: - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes no snapshot, no window and no last success - id: ATS-PFM-OPS-012-09 title: Record missing configuration without replacing licences level: api proves: - BR-CAP-PFM-OPS-012-09 preconditions: A previously synchronized company loses provider configuration. steps: Attempt synchronization. expected: Health becomes unconfigured and its existing windows remain unchanged. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-108 provenance: test source: >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#leaves the licences of a company synced before the key was removed exactly as they were evidence_candidates: - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#leaves the licences of a company synced before the key was removed exactly as they were category: edge binding_evidence: - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#leaves the licences of a company synced before the key was removed exactly as they were - id: ATS-PFM-OPS-012-10 title: Invalidate only when windows differ level: api proves: - BR-CAP-PFM-OPS-012-10 preconditions: 'A first company read, identical repeat and cancellation are available.' steps: Synchronize each state. expected: The initial change and cancellation request flushes and the unchanged repeat does not. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-108 provenance: test source: >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes nothing and asks for no second flush when the read is the same as the last evidence_candidates: - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes nothing and asks for no second flush when the read is the same as the last category: rule binding_evidence: - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes nothing and asks for no second flush when the read is the same as the last - id: ATS-PFM-OPS-012-11 title: Reject unverifiable webhook requests level: api proves: - BR-CAP-PFM-OPS-012-12 preconditions: >- Requests have missing or invalid signatures, altered bytes or address, stale timestamp or absent secret configuration. steps: Deliver them to the webhook. expected: No licence work is queued and verification or configuration refusal is returned. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-080 provenance: test source: >- services-platform:modules/licensing/tests/e2e/hubspot-licensing.e2e.spec.js#refuses a delivery signed for a different URI, so a signature cannot be replayed at another route evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/hubspot-licensing.e2e.spec.js#refuses a delivery signed for a different URI, so a signature cannot be replayed at another route category: validation binding_evidence: - >- services-platform:modules/licensing/tests/e2e/hubspot-licensing.e2e.spec.js#refuses a delivery signed for a different URI, so a signature cannot be replayed at another route - id: ATS-PFM-OPS-012-12 title: Separate staff company reading from synchronization level: api proves: - BR-CAP-PFM-OPS-012-14 preconditions: 'Reader, manager, customer and anonymous contexts are available.' steps: Inspect company data and health and request synchronization. expected: Staff readers can inspect and only managers can synchronize; other contexts are refused. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-080 provenance: test source: >- services-platform:modules/licensing/tests/e2e/hubspot-licensing.e2e.spec.js#refuses a staff member holding only hq.licensing.read on the sync, with 403 evidence_candidates: - >- services-platform:modules/licensing/tests/e2e/hubspot-licensing.e2e.spec.js#refuses a staff member holding only hq.licensing.read on the sync, with 403 category: permission binding_evidence: - >- services-platform:modules/licensing/tests/e2e/hubspot-licensing.e2e.spec.js#refuses a staff member holding only hq.licensing.read on the sync, with 403 - id: ATS-PFM-OPS-012-13 title: Preserve during outage and remove on cancellation level: api proves: - AS-JNY-PFM-OPS-005-01 - AS-JNY-PFM-OPS-005-02 preconditions: A company snapshot grants active application windows. steps: 'Fail a provider read, then synchronize a cancellation.' expected: The failed read preserves data and cancellation removes coverage with invalidation requested. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-108 provenance: test source: >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes no snapshot, no window and no last success evidence_candidates: - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes no snapshot, no window and no last success - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#asks for a flush when a licence is taken away, as fast as when one is given category: interaction binding_evidence: - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes no snapshot, no window and no last success - >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#asks for a flush when a licence is taken away, as fast as when one is given - id: ATS-PFM-OPS-012-14 title: Keep staff exception history through commercial replacement category: interaction level: api proves: - BR-CAP-PFM-OPS-011-03 - BR-CAP-PFM-OPS-012-08 exercises: - CAP-PFM-OPS-012 - CAP-PFM-OPS-011 preconditions: A workspace has a staff grant and its company has copied contracts. steps: Replace the company snapshot and inspect the workspace exception history. expected: Commercial replacement leaves the separate staff decision available for explanation. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#leaves the operational row exactly as it was, because the licence does not decide the state; services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes no snapshot, no window and no last success; CAP-PFM-OPS-011; WF-PFM-OPS-009; WF-PFM-OPS-013; WF-PFM-OPS-014; WF-PFM-OPS-015; WF-PFM-OPS-016 - id: ATS-PFM-OPS-012-15 title: Reflect a cancellation without extending stale coverage category: interaction level: api proves: - BR-CAP-PFM-OPS-012-08 - BR-CAP-PFM-OPS-014-01 exercises: - CAP-PFM-OPS-012 - CAP-PFM-OPS-014 preconditions: A company has current windows and an enabled workspace application. steps: >- Fail one provider read, then successfully synchronize a cancelled contract and resolve availability. expected: >- The failed read preserves the earlier copy; the successful cancellation removes its contribution to access. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes no snapshot, no window and no last success; services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers the available ones, and only those, from the same resolution; CAP-PFM-OPS-014; WF-PFM-OPS-009; WF-PFM-OPS-013; WF-PFM-OPS-014; WF-PFM-OPS-015; WF-PFM-OPS-016 - id: ATS-PFM-OPS-012-16 title: Read standing within the administrator’s reach category: interaction level: api proves: - BR-CAP-PFM-OPS-012-14 exercises: - CAP-PFM-OPS-012 - CAP-PFM-SEC-002 preconditions: Two customers have workspaces with different application standing. steps: Read the local workspace and then request the other customer’s application information. expected: The local explanation is available without exposing the other customer’s standing. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/e2e/hubspot-licensing.e2e.spec.js#refuses a staff member holding only hq.licensing.read on the sync, with 403; CAP-PFM-SEC-002; WF-PFM-OPS-009; WF-PFM-OPS-013; WF-PFM-OPS-014; WF-PFM-OPS-015; WF-PFM-OPS-016 - id: ATS-PFM-OPS-012-17 title: Acknowledge recorded outcomes while retrying thrown processing errors category: failure level: api proves: - BR-CAP-PFM-OPS-012-16 preconditions: 'A sync batch contains malformed input, a recorded provider failure and a sync call that throws.' steps: Process the batch with successful execution-context creation and controlled sync-call outcomes. expected: >- Only the thrown sync call enters the returned retry list; malformed input and recorded provider outcomes are acknowledged. negative: true data_needs: Run-owned records and controlled clocks or dependency responses named in the preconditions. bound_to: [] provenance: proposed source: 'services-platform:modules/licensing/aws/lambda/LICENCE_SYNC.handler.ts:processLicenceSyncBatch' - id: ATS-PFM-OPS-012-18 title: Observe refused company publication after webhook acceptance category: failure level: api proves: - BR-CAP-PFM-OPS-012-17 preconditions: A verified delivery resolves a company but its queue publisher refuses the message. steps: Accept the delivery with a rejecting publisher. expected: >- The delivery result identifies the refused company; the request is acknowledged and later reconciliation remains the recovery path. negative: true data_needs: Run-owned records and controlled clocks or dependency responses named in the preconditions. bound_to: - TST-PFM-OPS-106 provenance: test source: >- services-platform:modules/licensing/tests/integration/services/sync/accept-webhook-delivery.integration.spec.js#reports the company it could not enqueue, so the nightly pass is what fixes it - id: ATS-PFM-OPS-012-19 title: Retain shared company evidence after deleting one workspace category: interaction level: api proves: - BR-CAP-PFM-OPS-012-15 - INV-DOM-PFM-OPS-003-11 exercises: - CAP-PFM-OPS-001 - CAP-PFM-OPS-010 - CAP-PFM-OPS-012 - CAP-PFM-OPS-015 workflows: - WF-PFM-OPS-009 preconditions: Two workspaces share a company snapshot and licence windows; one enters deletion. steps: >- Purge the deleting workspace’s operational resources and resolve standing for the surviving workspace. expected: >- The surviving workspace can still use the retained company evidence after the removed workspace’s own records disappear. negative: false data_needs: >- Isolated workspace and run-owned lifecycle records, with a second linked workspace where shared company evidence is checked. bound_to: [] provenance: proposed source: >- services-platform:modules/jobs/services/persistence/tenant-purges.ts:JOB_PURGE_RESOURCES; services-platform:modules/audit/tests/integration/services/persistence/audit-events.integration.spec.js#is refused by the database, so the purger is never a delete-by-tenant tool; services-platform:modules/licensing/services/maintenance/tenant-participant.ts:licensingParticipant evidence: - >- Pinned capability rules, object invariants, state transitions and workflows are reviewed for testing obligations. - >- Executable bindings refer only to existing suites; no module executable suite runs during this documentation job. coverage: rule: covered transition: 'gap: FND-PFM-OPS-064' validation: covered permission: covered edge: covered failure: covered boundary: covered concurrency: 'gap: FND-PFM-OPS-064' invariant: 'gap: FND-PFM-OPS-064' interaction: covered coverage_notes: transition: Lifecycle paths are not fully separated into transition cases. concurrency: >- No controlled overlapping execution proves the capability’s read or write behavior while related state changes. invariant: The object invariants need explicit proof bindings. related_capabilities: - CAP-PFM-OPS-011 - CAP-PFM-OPS-014 - CAP-PFM-SEC-002 workflow_interactions: - WF-PFM-OPS-009 - WF-PFM-OPS-013 - WF-PFM-OPS-014 - WF-PFM-OPS-015 - WF-PFM-OPS-016 coverage_obligations: finding: FND-PFM-OPS-064 uncovered_must_prove: - BR-CAP-PFM-OPS-012-18 - BR-CAP-PFM-OPS-012-19 object_invariants_requiring_explicit_trace: - INV-DOM-PFM-OPS-003-01 - INV-DOM-PFM-OPS-003-02 - INV-DOM-PFM-OPS-003-03 - INV-DOM-PFM-OPS-003-04 - INV-DOM-PFM-OPS-003-05 - INV-DOM-PFM-OPS-003-08 - INV-DOM-PFM-OPS-003-09 - INV-DOM-PFM-OPS-003-10 - INV-DOM-PFM-OPS-003-11 related_scenarios: - capabilities: - CAP-PFM-OPS-012 - CAP-PFM-OPS-011 scenario: ATS-PFM-OPS-012-14 - capabilities: - CAP-PFM-OPS-012 - CAP-PFM-OPS-014 scenario: ATS-PFM-OPS-012-15 - capabilities: - CAP-PFM-OPS-012 - CAP-PFM-SEC-002 scenario: ATS-PFM-OPS-012-16 unbound_scenarios: - ATS-PFM-OPS-012-07 - ATS-PFM-OPS-012-14 - ATS-PFM-OPS-012-15 - ATS-PFM-OPS-012-16 - ATS-PFM-OPS-012-17 - ATS-PFM-OPS-012-19 transition_review: - model: STATE-PFM-OPS-005 transition: 1 from: future to: current provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 2 from: current to: in grace provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 3 from: in grace to: expired provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 4 from: current to: replaced provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 5 from: in grace to: replaced provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. permission_review: - key: hq.licensing.read where_checked: api provenance: unknown source: FND-PFM-OPS-064 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: hq.licensing.manage where_checked: api provenance: unknown source: FND-PFM-OPS-064 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. gap_detail: >- Queue receive and retention limits, missing operational preparation after contract sync, concurrent company snapshots and failed transactional replacement need explicit proof. workflow_scenarios: WF-PFM-OPS-009: - ATS-PFM-OPS-001-17 - ATS-PFM-OPS-010-13 - ATS-PFM-OPS-012-19 - ATS-PFM-OPS-015-15 WF-PFM-OPS-016: - ATS-PFM-OPS-011-15 - ATS-PFM-OPS-014-12 --- # Derive application licences from commercial contracts: Capability Test Specification ## Coverage The category map distinguishes authored scenarios from unresolved proof obligations. A bound scenario names an existing executable suite; its recorded result remains unrun. | Rule | Proof status | |---|---| | `BR-CAP-PFM-OPS-012-01` | `ATS-PFM-OPS-012-01` | | `BR-CAP-PFM-OPS-012-02` | `ATS-PFM-OPS-012-02` | | `BR-CAP-PFM-OPS-012-03` | `ATS-PFM-OPS-012-03` | | `BR-CAP-PFM-OPS-012-04` | `ATS-PFM-OPS-012-04` | | `BR-CAP-PFM-OPS-012-05` | `ATS-PFM-OPS-012-05` | | `BR-CAP-PFM-OPS-012-06` | `ATS-PFM-OPS-012-06` | | `BR-CAP-PFM-OPS-012-07` | `ATS-PFM-OPS-012-07` | | `BR-CAP-PFM-OPS-012-08` | `ATS-PFM-OPS-012-08`, `ATS-PFM-OPS-012-14`, `ATS-PFM-OPS-012-15` | | `BR-CAP-PFM-OPS-012-09` | `ATS-PFM-OPS-012-09` | | `BR-CAP-PFM-OPS-012-10` | `ATS-PFM-OPS-012-10` | | `BR-CAP-PFM-OPS-012-12` | `ATS-PFM-OPS-012-11` | | `BR-CAP-PFM-OPS-012-14` | `ATS-PFM-OPS-012-12`, `ATS-PFM-OPS-012-16` | | `BR-CAP-PFM-OPS-012-16` | `ATS-PFM-OPS-012-17` | | `BR-CAP-PFM-OPS-012-17` | `ATS-PFM-OPS-012-18` | | `BR-CAP-PFM-OPS-012-18` | no scenario: `FND-PFM-OPS-064` | | `BR-CAP-PFM-OPS-012-19` | no scenario: `FND-PFM-OPS-064` | ## Interactions With Related Capabilities Preserve during outage and remove on cancellation. The failed read preserves data and cancellation removes coverage with invalidation requested. Keep staff exception history through commercial replacement. Commercial replacement leaves the separate staff decision available for explanation. Reflect a cancellation without extending stale coverage. The failed read preserves the earlier copy; the successful cancellation removes its contribution to access. Read standing within the administrator’s reach. The local explanation is available without exposing the other customer’s standing. Retain shared company evidence after deleting one workspace. The surviving workspace can still use the retained company evidence after the removed workspace’s own records disappear. ## Evidence and Boundaries Pinned assertion sources support the listed executable bindings. Proposed cases retain the proof required beyond those boundaries. Structured obligations name incomplete object, transition and permission trace; row-level concurrency proof does not establish complete workflow serialization.