---
title: 'Jobs, Audit and Licensing Design Examination'
examined_at: '2026-10-23'
examiner: codex
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
branch: agent/platform-operations-desi-exam-1
examined_artifacts:
  - SVC-PFM-OPS-audit
  - SVC-PFM-OPS-jobs
  - SVC-PFM-OPS-licensing
  - ADR-PFM-OPS-001
  - ADR-PFM-OPS-002
  - ADR-PFM-OPS-003
  - ADR-PFM-OPS-004
  - ADR-PFM-OPS-005
  - ADR-PFM-OPS-006
  - ADR-PFM-OPS-007
  - ADR-PFM-OPS-008
  - ADR-PFM-OPS-009
  - ADR-PFM-OPS-010
  - ADR-PFM-OPS-011
  - ADR-PFM-OPS-012
  - ADR-PFM-OPS-013
  - ADR-PFM-OPS-014
  - ADR-PFM-OPS-015
  - ADR-PFM-OPS-016
  - ADR-PFM-OPS-017
  - DOM-PFM-OPS-001
  - DOM-PFM-OPS-002
  - DOM-PFM-OPS-003
  - DOM-PFM-OPS-004
  - SCR-PFM-OPS-001
  - SCR-PFM-OPS-002
  - SCR-PFM-OPS-003
  - SCR-PFM-OPS-004
  - SCR-PFM-OPS-005
  - STATE-PFM-OPS-001
  - STATE-PFM-OPS-002
  - STATE-PFM-OPS-003
  - STATE-PFM-OPS-004
  - STATE-PFM-OPS-005
  - STATE-PFM-OPS-006
  - WF-PFM-OPS-001
  - WF-PFM-OPS-002
  - WF-PFM-OPS-003
  - WF-PFM-OPS-004
  - WF-PFM-OPS-005
  - WF-PFM-OPS-006
  - WF-PFM-OPS-007
  - WF-PFM-OPS-008
  - WF-PFM-OPS-009
  - WF-PFM-OPS-010
  - WF-PFM-OPS-011
  - WF-PFM-OPS-012
  - WF-PFM-OPS-013
  - WF-PFM-OPS-014
  - WF-PFM-OPS-015
  - WF-PFM-OPS-016
  - WF-PFM-OPS-017
counts:
  artifacts: 52
  domain_objects: 4
  state_models: 6
  workflows: 17
  service_contracts: 3
  screen_contracts: 5
  decisions: 17
  operations: 32
  tables: 11
  source_references: 227
  distinct_source_files: 83
  expanded_test_anchors: 50
  invariants: 60
  transitions: 38
  hops: 73
  new_findings: 7
evidence:
  - >-
    rhythm-v2-docs at ebaa2ed03a40067fa987889151011f2f7e69e1ab: AGENTS.md; specs/CONVENTIONS.md sections 6 and
    9; specs/templates/*;
    specs/platform/operations/{MODULE.md,features,concepts,capabilities,journeys,acceptance,FINDINGS.md,ID_REGISTRY.md};
    specs/platform/RESPONSIBILITIES.md; specs/PRODUCT-AREAS.md.
  - >-
    Missing requested brief: briefs/design/platform-operations.brief.md at the starting documentation commit;
    available planning brief and planning-examination brief were read as context.
  - >-
    services-platform: modules/{jobs,audit,licensing}/**;
    modules/tenants/aws/api/tenant-applications.routes.ts;
    modules/security/services/access/security-context.ts;
    docs/{jobs.md,licensing.md,security/application-access.md,proposals/application-access-and-entitlements.md};
    cited planning records.
  - >-
    macroservice-libraries: packages/jobs/** (engine, persistence, reconciliation, workflow builders,
    execution tasks, publication and notice delivery).
  - >-
    react-console: components/maintenance/job-runs-screen.tsx;
    components/console/hq/{jobs-list.tsx,job/**,tenant-licensing-section.tsx,tenant-licensing-card.tsx,licensing-dialogs.tsx,recent-jobs-card.tsx};
    lib/{maintenance,hq,auth/api.ts}; cited route declarations and tests.
verification_metadata_changes:
  - artifact: SVC-PFM-OPS-jobs
    field: source_module
    before: 'modules/jobs (with the shared engine, macroservice-libraries packages/jobs)'
    after: modules/jobs
  - artifact: SVC-PFM-OPS-jobs
    field: operations.6.permission
    before: platform.jobs.read (console alias maintenance.scheduled-jobs.view)
    after: platform.jobs.read
  - artifact: SVC-PFM-OPS-jobs
    field: operations.7.permission
    before: platform.jobs.read (console alias maintenance.scheduled-jobs.view)
    after: platform.jobs.read
  - artifact: SVC-PFM-OPS-jobs
    field: operations.8.permission
    before: platform.jobs.read (console alias maintenance.scheduled-jobs.view)
    after: platform.jobs.read
  - artifact: SVC-PFM-OPS-jobs
    field: operations.9.permission
    before: platform.jobs.read (console alias maintenance.scheduled-jobs.view)
    after: platform.jobs.read
  - artifact: SVC-PFM-OPS-jobs
    field: operations.10.permission
    before: platform.jobs.read (console alias maintenance.scheduled-jobs.view)
    after: platform.jobs.read
  - artifact: SVC-PFM-OPS-licensing
    field: source_module
    before: >-
      modules/licensing (with modules/tenants/aws/api/tenant-applications.routes.ts for the administrator’s
      read)
    after: modules/licensing
  - artifact: DOM-PFM-OPS-001
    field: attributes.6.required
    before: true
    after: false
  - artifact: DOM-PFM-OPS-001
    field: invariants.5.source
    before: >-
      macroservice-libraries:packages/jobs/src/persistence/job-persistence-columns.ts:jobEventConstraints
      (sequence_uidx, sequence_check); jobEventColumns
    after: >-
      macroservice-libraries:packages/jobs/src/persistence/job-persistence-columns.ts:jobEventConstraints
      (sequence_uidx, sequence_check); jobEventColumns;
      macroservice-libraries:packages/jobs/src/persistence/job-family-repository.ts:nextSequence
  - artifact: DOM-PFM-OPS-001
    field: invariants.8.enforced_at
    before:
      - service
    after: []
  - artifact: DOM-PFM-OPS-002
    field: invariants.0.source
    before: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an
      UPDATE of the event by the application role, so a trail c
    after: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an
      UPDATE of the event by the application role, so a trail cannot be rewritten
  - artifact: DOM-PFM-OPS-002
    field: invariants.1.source
    before: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses a
      row written for another tenant from this tenant’s session,
    after: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses a
      row written for another tenant from this tenant’s session, by the policy’s WITH CHECK
  - artifact: DOM-PFM-OPS-002
    field: invariants.2.source
    before: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an
      event type the store does not hold, by audit_events_event
    after: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an
      event type the store does not hold, by audit_events_event_type_check
  - artifact: DOM-PFM-OPS-002
    field: invariants.3.source
    before: >-
      services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#reports
      the retry as a duplicate rather than refusing it
    after: >-
      services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#reports
      the retry as a duplicate rather than refusing it, because the client has nothing to fix
  - artifact: DOM-PFM-OPS-002
    field: invariants.4.source
    before: >-
      services-platform:modules/audit/tests/unit/aws/api/audit-api-mapper.spec.ts#refuses a body naming the
      actor, which is how a trail would be written in somebody e
    after: >-
      services-platform:modules/audit/tests/unit/aws/api/audit-api-mapper.spec.ts#refuses a body naming the
      actor, which is how a trail would be written in somebody else’s name
  - artifact: DOM-PFM-OPS-002
    field: invariants.6.source
    before: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an
      instant finer than a millisecond, by audit_events_occurre
    after: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an
      instant finer than a millisecond, by audit_events_occurred_at_precision_check
  - artifact: DOM-PFM-OPS-002
    field: invariants.8.source
    before: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an
      INSERT by that role, because the grant is SELECT and noth
    after: >-
      services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an
      INSERT by that role, because the grant is SELECT and nothing else
  - artifact: DOM-PFM-OPS-003
    field: invariants.2.enforced_at
    before:
      - service
      - database
    after:
      - service
  - artifact: DOM-PFM-OPS-003
    field: invariants.2.source
    before: >-
      services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses to withdraw the same
      override twice, with 409
    after: 'services-platform:modules/licensing/services/persistence/licence-overrides.ts:revokeLicenceOverride'
  - artifact: DOM-PFM-OPS-003
    field: invariants.3.source
    before: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in
      force at the instant it ends, so a replacement starting t
    after: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in
      force at the instant it ends, so a replacement starting there leaves no overlap
  - artifact: DOM-PFM-OPS-003
    field: invariants.4.source
    before: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#lets a
      withhold beat always_available, which is the only way to tak
    after: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#lets a
      withhold beat always_available, which is the only way to take one of those away
  - artifact: DOM-PFM-OPS-003
    field: invariants.5.enforced_at
    before:
      - service
      - database
    after:
      - service
  - artifact: DOM-PFM-OPS-003
    field: invariants.5.source
    before: >-
      services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#is the seven
      days after the end date that decision D3 settled on
    after: 'services-platform:modules/licensing/services/licences/resolve-licence-windows.ts:resolveLicenceWindows'
  - artifact: DOM-PFM-OPS-003
    field: invariants.6.source
    before: >-
      services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#resolves nothing
      for a status it has never heard of, and flags it so the
    after: >-
      services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#resolves nothing
      for a status it has never heard of, and flags it so the vocabulary can be confirmed
  - artifact: DOM-PFM-OPS-004
    field: attributes.1.required
    before: true
    after: false
  - artifact: DOM-PFM-OPS-004
    field: attributes.6.required
    before: true
    after: false
  - artifact: DOM-PFM-OPS-004
    field: invariants.2.enforced_at
    before:
      - database
    after:
      - service
      - database
  - artifact: DOM-PFM-OPS-004
    field: invariants.2.source
    before: >-
      services-platform:modules/licensing/db/tenant-applications.table.ts
      (tenant_applications_first_enabled_check)
    after: >-
      services-platform:modules/licensing/db/tenant-applications.table.ts
      (tenant_applications_first_enabled_check);
      services-platform:modules/licensing/services/persistence/tenant-applications.ts:setTenantApplicationState
  - artifact: DOM-PFM-OPS-004
    field: invariants.3.source
    before: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers the
      available ones, and only those, from the same resolutio
    after: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers the
      available ones, and only those, from the same resolution
  - artifact: DOM-PFM-OPS-004
    field: invariants.4.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/persistence/tenant-applications.integration.spec.js#keeps
      the instant it was first enabled throug
    after: >-
      services-platform:modules/licensing/tests/integration/services/persistence/tenant-applications.integration.spec.js#keeps
      the instant it was first enabled through a suspension and a resumption
  - artifact: DOM-PFM-OPS-004
    field: invariants.5.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/persistence/tenant-applications.integration.spec.js#leaves
      a suspended row suspended, so a redepl
    after: >-
      services-platform:modules/licensing/tests/integration/services/persistence/tenant-applications.integration.spec.js#leaves
      a suspended row suspended, so a redeploy never undoes an operational decision
  - artifact: DOM-PFM-OPS-004
    field: invariants.6.source
    before: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#gives each
      unavailable one the reason its own half of the rule refu
    after: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#gives each
      unavailable one the reason its own half of the rule refused by
  - artifact: SCR-PFM-OPS-002
    field: displays.4.source
    before: listJobsInHq (requester name)
    after: listJobsInHq (requestedBy); the console labels the current staff member’s own jobs
  - artifact: SCR-PFM-OPS-005
    field: patterns
    before:
      - HQ home card
      - CardError state
      - ghost Button link
    after:
      - HqCardHeader
      - Card
      - RowListSkeleton
      - Empty
      - Badge
      - CardError
      - ghost Button link
  - artifact: STATE-PFM-OPS-001
    field: transitions.5.source
    before: >-
      services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles
      it failed, saying the job never sta
    after: >-
      services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles
      it failed, saying the job never started
  - artifact: STATE-PFM-OPS-003
    field: transitions.3.source
    before: >-
      services-platform:modules/jobs/tests/integration/services/persistence/job-notices.integration.spec.js#is
      claimed again, because a notice nobody received is wors
    after: >-
      services-platform:modules/jobs/tests/integration/services/persistence/job-notices.integration.spec.js#is
      claimed again, because a notice nobody received is worse than one that arrives twice
  - artifact: STATE-PFM-OPS-004
    field: transitions.0.source
    before: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in
      force at the instant it ends, so a replacement starting t
    after: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in
      force at the instant it ends, so a replacement starting there leaves no overlap
  - artifact: STATE-PFM-OPS-004
    field: transitions.1.source
    before: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in
      force at the instant it ends, so a replacement starting t
    after: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in
      force at the instant it ends, so a replacement starting there leaves no overlap
  - artifact: STATE-PFM-OPS-005
    field: transitions.0.source
    before: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers
      expired the day after the grace ends, which is when a licen
    after: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers
      expired the day after the grace ends, which is when a licence really runs out
  - artifact: STATE-PFM-OPS-005
    field: transitions.1.source
    before: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers
      expired the day after the grace ends, which is when a licen
    after: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers
      expired the day after the grace ends, which is when a licence really runs out
  - artifact: STATE-PFM-OPS-005
    field: transitions.2.source
    before: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers
      expired the day after the grace ends, which is when a licen
    after: >-
      services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers
      expired the day after the grace ends, which is when a licence really runs out
  - artifact: STATE-PFM-OPS-005
    field: transitions.3.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes
      nothing and asks for no second flush when
    after: >-
      services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes
      nothing and asks for no second flush when the read is the same as the last
  - artifact: STATE-PFM-OPS-005
    field: transitions.4.source
    before: >-
      services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#leaves a real
      gap between two terms as two windows, because the licence
    after: >-
      services-platform:modules/licensing/tests/unit/licences/resolve-licence-windows.spec.ts#leaves a real
      gap between two terms as two windows, because the licence did lapse
  - artifact: STATE-PFM-OPS-006
    field: transitions.0.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#says
      which participant could not run,
    after: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#says
      which participant could not run, in the reason an operator reads
  - artifact: STATE-PFM-OPS-006
    field: transitions.1.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/persistence/tenant-applications.integration.spec.js#leaves
      a suspended row suspended, so a redepl
    after: >-
      services-platform:modules/licensing/tests/integration/services/persistence/tenant-applications.integration.spec.js#leaves
      a suspended row suspended, so a redeploy never undoes an operational decision
  - artifact: STATE-PFM-OPS-006
    field: transitions.2.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#says
      which participant could not run,
    after: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#says
      which participant could not run, in the reason an operator reads
  - artifact: STATE-PFM-OPS-006
    field: transitions.3.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#says
      which participant could not run,
    after: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#says
      which participant could not run, in the reason an operator reads
  - artifact: STATE-PFM-OPS-006
    field: transitions.4.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#refuses
      every move for an application
    after: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#refuses
      every move for an application the tenant has never been provisioned for
  - artifact: STATE-PFM-OPS-006
    field: transitions.6.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/persistence/tenant-applications.integration.spec.js#keeps
      the instant it was first enabled throug
    after: >-
      services-platform:modules/licensing/tests/integration/services/persistence/tenant-applications.integration.spec.js#keeps
      the instant it was first enabled through a suspension and a resumption
  - artifact: WF-PFM-OPS-001
    field: hops.1.source
    before: 'services-platform:docs/jobs.md#2. Adding a job: tenant-portal onboarding as the example (step 8)'
    after: 'services-platform:docs/jobs.md#2. Adding a job: tenant-portal onboarding as the example'
  - artifact: WF-PFM-OPS-001
    field: hops.3.source
    before: >-
      services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles
      it failed, saying the job never sta
    after: >-
      services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles
      it failed, saying the job never started
  - artifact: WF-PFM-OPS-002
    field: hops.0.source
    before: >-
      services-platform:modules/jobs/tests/integration/services/job-snapshot/job-snapshot.integration.spec.js#takes
      that catalog from the published event rather than
    after: >-
      services-platform:modules/jobs/tests/integration/services/job-snapshot/job-snapshot.integration.spec.js#takes
      that catalog from the published event rather than the declaration, which the event itself carries
  - artifact: WF-PFM-OPS-002
    field: hops.3.source
    before: >-
      macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.spec.ts#applies it before the
      settlement, so a consequence that fails leaves the job for the
    after: >-
      macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.spec.ts#applies it before the
      settlement, so a consequence that fails leaves the job for the next pass
  - artifact: WF-PFM-OPS-003
    field: hops.3.source
    before: >-
      services-platform:modules/tenants/tests/integration/lifecycle/reconciled-job-failure.integration.spec.js#tells
      the staff member who asked for the tenant that it
    after: 'macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.ts:settleFromReconciliation'
  - artifact: WF-PFM-OPS-003
    field: hops.4.source
    before: >-
      services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#corrects
      the job to failed, never succeeded
    after: >-
      services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#corrects
      the job to failed, never succeeded, keeping the progress its steps earned
  - artifact: WF-PFM-OPS-004
    field: hops.1.source
    before: >-
      services-platform:modules/jobs/tests/integration/services/persistence/job-notices.integration.spec.js#answers
      nothing at all to the second claim, so nothing is
    after: >-
      services-platform:modules/jobs/tests/integration/services/persistence/job-notices.integration.spec.js#answers
      nothing at all to the second claim, so nothing is sent twice
  - artifact: WF-PFM-OPS-004
    field: hops.2.source
    before: >-
      services-platform:modules/jobs/tests/unit/services/notices/job-notice-email.spec.js#refuses to send at
      all when the sending address is unset, naming both variab
    after: >-
      services-platform:modules/jobs/tests/unit/services/notices/job-notice-email.spec.js#refuses to send at
      all when the sending address is unset, naming both variables
  - artifact: WF-PFM-OPS-006
    field: hops.1.source
    before: >-
      macroservice-libraries:packages/jobs/src/engine/job-cancellation.spec.ts#records the request on the root
      and in its history, then stops the execution with the c
    after: >-
      macroservice-libraries:packages/jobs/src/engine/job-cancellation.spec.ts#records the request on the root
      and in its history, then stops the execution with the cause
  - artifact: WF-PFM-OPS-007
    field: hops.1.source
    before: >-
      services-platform:modules/jobs/tests/integration/services/snapshots/cross-service-jobs.integration.spec.js#does
      not find a schema that holds the same job and pu
    after: >-
      services-platform:modules/jobs/tests/integration/services/snapshots/cross-service-jobs.integration.spec.js#does
      not find a schema that holds the same job and publishes no view
  - artifact: WF-PFM-OPS-007
    field: hops.2.source
    before: >-
      services-platform:modules/jobs/tests/integration/services/snapshots/cross-service-jobs.integration.spec.js#pages
      across the two macroservices, the cursor of one
    after: >-
      services-platform:modules/jobs/tests/integration/services/snapshots/cross-service-jobs.integration.spec.js#pages
      across the two macroservices, the cursor of one continuing into the other
  - artifact: WF-PFM-OPS-007
    field: hops.3.source
    before: >-
      services-platform:modules/jobs/tests/integration/services/subjects/job-subject.integration.spec.js#names
      the subject null, and still answers it, for a tenant th
    after: >-
      services-platform:modules/jobs/tests/integration/services/subjects/job-subject.integration.spec.js#names
      the subject null, and still answers it, for a tenant that no longer reads
  - artifact: WF-PFM-OPS-008
    field: hops.2.source
    before: >-
      services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#refuses
      a record type the registry does not hold, naming
    after: >-
      services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#refuses
      a record type the registry does not hold, naming the types it does
  - artifact: WF-PFM-OPS-008
    field: hops.4.source
    before: >-
      services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#reports
      the retry as a duplicate rather than refusing it
    after: >-
      services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#reports
      the retry as a duplicate rather than refusing it, because the client has nothing to fix
  - artifact: WF-PFM-OPS-009
    field: hops.1.source
    before: >-
      services-platform:modules/audit/tests/integration/services/persistence/audit-events.integration.spec.js#is
      refused by the database, so the purger is never a del
    after: >-
      services-platform:modules/audit/tests/integration/services/persistence/audit-events.integration.spec.js#is
      refused by the database, so the purger is never a delete-by-tenant tool
  - artifact: WF-PFM-OPS-010
    field: hops.3.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#leaves
      the operational row exactly as
    after: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#leaves
      the operational row exactly as it was, because the licence does not decide the state
  - artifact: WF-PFM-OPS-010
    field: hops.4.source
    before: >-
      services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#asks for none when the second
      revocation of the same override is refused, because nothing ch
    after: >-
      services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#asks for none when the second
      revocation of the same override is refused, because nothing changed
  - artifact: WF-PFM-OPS-012
    field: hops.0.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#refuses
      every move for an application
    after: >-
      services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#refuses
      every move for an application the tenant has never been provisioned for
  - artifact: WF-PFM-OPS-013
    field: hops.0.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#leaves
      the licences of a company synced before the
    after: >-
      services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#leaves
      the licences of a company synced before the key was removed exactly as they were
  - artifact: WF-PFM-OPS-013
    field: hops.4.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes
      nothing and asks for no second flush when
    after: >-
      services-platform:modules/licensing/tests/integration/services/sync/sync-company-licences.integration.spec.js#changes
      nothing and asks for no second flush when the read is the same as the last
  - artifact: WF-PFM-OPS-014
    field: hops.1.source
    before: >-
      services-platform:modules/licensing/tests/e2e/hubspot-licensing.e2e.spec.js#refuses a delivery signed
      for a different URI, so a signature cannot be replayed at
    after: >-
      services-platform:modules/licensing/tests/e2e/hubspot-licensing.e2e.spec.js#refuses a delivery signed
      for a different URI, so a signature cannot be replayed at another route
  - artifact: WF-PFM-OPS-014
    field: hops.2.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/sync/accept-webhook-delivery.integration.spec.js#reports
      an event about a contract it has never s
    after: >-
      services-platform:modules/licensing/tests/integration/services/sync/accept-webhook-delivery.integration.spec.js#reports
      an event about a contract it has never seen as unresolved, for the nightly pass to pick up
  - artifact: WF-PFM-OPS-017
    field: hops.0.anchor
    before: >-
      services-platform:modules/licensing/services/enablement/seed-development-licences.ts:seedDevelopmentLicenceOverrides
    after: >-
      services-platform:modules/licensing/services/enablement/seed-development-licences.ts:seedDevelopmentLicenceOverridesForTenant
  - artifact: WF-PFM-OPS-017
    field: hops.0.source
    before: >-
      services-platform:modules/licensing/services/enablement/seed-development-licences.ts:seedDevelopmentLicenceOverrides
    after: >-
      services-platform:modules/licensing/services/enablement/seed-development-licences.ts:seedDevelopmentLicenceOverridesForTenant
  - artifact: WF-PFM-OPS-017
    field: hops.1.source
    before: >-
      services-platform:modules/licensing/tests/integration/services/enablement/seed-development-licences.revoked.integration.spec.js#writes
      no override on the second
    after: >-
      services-platform:modules/licensing/tests/integration/services/enablement/seed-development-licences.revoked.integration.spec.js#writes
      no override on the second pass for the tenant whose grant was revoked
anchor_expansions:
  - id: DOM-PFM-OPS-002
    field: .invariants.0.source
    from: 'refuses an UPDATE of the event by the application role, so a trail c'
    to: 'refuses an UPDATE of the event by the application role, so a trail cannot be rewritten'
  - id: DOM-PFM-OPS-002
    field: .invariants.1.source
    from: 'refuses a row written for another tenant from this tenant’s session,'
    to: 'refuses a row written for another tenant from this tenant’s session, by the policy’s WITH CHECK'
  - id: DOM-PFM-OPS-002
    field: .invariants.2.source
    from: 'refuses an event type the store does not hold, by audit_events_event'
    to: 'refuses an event type the store does not hold, by audit_events_event_type_check'
  - id: DOM-PFM-OPS-002
    field: .invariants.3.source
    from: reports the retry as a duplicate rather than refusing it
    to: 'reports the retry as a duplicate rather than refusing it, because the client has nothing to fix'
  - id: DOM-PFM-OPS-002
    field: .invariants.4.source
    from: 'refuses a body naming the actor, which is how a trail would be written in somebody e'
    to: 'refuses a body naming the actor, which is how a trail would be written in somebody else’s name'
  - id: DOM-PFM-OPS-002
    field: .invariants.6.source
    from: 'refuses an instant finer than a millisecond, by audit_events_occurre'
    to: 'refuses an instant finer than a millisecond, by audit_events_occurred_at_precision_check'
  - id: DOM-PFM-OPS-002
    field: .invariants.8.source
    from: 'refuses an INSERT by that role, because the grant is SELECT and noth'
    to: 'refuses an INSERT by that role, because the grant is SELECT and nothing else'
  - id: DOM-PFM-OPS-003
    field: .invariants.3.source
    from: 'is not in force at the instant it ends, so a replacement starting t'
    to: 'is not in force at the instant it ends, so a replacement starting there leaves no overlap'
  - id: DOM-PFM-OPS-003
    field: .invariants.4.source
    from: 'lets a withhold beat always_available, which is the only way to tak'
    to: 'lets a withhold beat always_available, which is the only way to take one of those away'
  - id: DOM-PFM-OPS-003
    field: .invariants.6.source
    from: 'resolves nothing for a status it has never heard of, and flags it so the'
    to: 'resolves nothing for a status it has never heard of, and flags it so the vocabulary can be confirmed'
  - id: DOM-PFM-OPS-004
    field: .invariants.3.source
    from: 'answers the available ones, and only those, from the same resolutio'
    to: 'answers the available ones, and only those, from the same resolution'
  - id: DOM-PFM-OPS-004
    field: .invariants.4.source
    from: keeps the instant it was first enabled throug
    to: keeps the instant it was first enabled through a suspension and a resumption
  - id: DOM-PFM-OPS-004
    field: .invariants.5.source
    from: 'leaves a suspended row suspended, so a redepl'
    to: 'leaves a suspended row suspended, so a redeploy never undoes an operational decision'
  - id: DOM-PFM-OPS-004
    field: .invariants.6.source
    from: gives each unavailable one the reason its own half of the rule refu
    to: gives each unavailable one the reason its own half of the rule refused by
  - id: STATE-PFM-OPS-001
    field: .transitions.5.source
    from: 'settles it failed, saying the job never sta'
    to: 'settles it failed, saying the job never started'
  - id: STATE-PFM-OPS-003
    field: .transitions.3.source
    from: 'is claimed again, because a notice nobody received is wors'
    to: 'is claimed again, because a notice nobody received is worse than one that arrives twice'
  - id: STATE-PFM-OPS-004
    field: .transitions.0.source
    from: 'is not in force at the instant it ends, so a replacement starting t'
    to: 'is not in force at the instant it ends, so a replacement starting there leaves no overlap'
  - id: STATE-PFM-OPS-004
    field: .transitions.1.source
    from: 'is not in force at the instant it ends, so a replacement starting t'
    to: 'is not in force at the instant it ends, so a replacement starting there leaves no overlap'
  - id: STATE-PFM-OPS-005
    field: .transitions.0.source
    from: 'answers expired the day after the grace ends, which is when a licen'
    to: 'answers expired the day after the grace ends, which is when a licence really runs out'
  - id: STATE-PFM-OPS-005
    field: .transitions.1.source
    from: 'answers expired the day after the grace ends, which is when a licen'
    to: 'answers expired the day after the grace ends, which is when a licence really runs out'
  - id: STATE-PFM-OPS-005
    field: .transitions.2.source
    from: 'answers expired the day after the grace ends, which is when a licen'
    to: 'answers expired the day after the grace ends, which is when a licence really runs out'
  - id: STATE-PFM-OPS-005
    field: .transitions.3.source
    from: changes nothing and asks for no second flush when
    to: changes nothing and asks for no second flush when the read is the same as the last
  - id: STATE-PFM-OPS-005
    field: .transitions.4.source
    from: 'leaves a real gap between two terms as two windows, because the licence'
    to: 'leaves a real gap between two terms as two windows, because the licence did lapse'
  - id: STATE-PFM-OPS-006
    field: .transitions.0.source
    from: 'says which participant could not run,'
    to: 'says which participant could not run, in the reason an operator reads'
  - id: STATE-PFM-OPS-006
    field: .transitions.1.source
    from: 'leaves a suspended row suspended, so a redepl'
    to: 'leaves a suspended row suspended, so a redeploy never undoes an operational decision'
  - id: STATE-PFM-OPS-006
    field: .transitions.2.source
    from: 'says which participant could not run,'
    to: 'says which participant could not run, in the reason an operator reads'
  - id: STATE-PFM-OPS-006
    field: .transitions.3.source
    from: 'says which participant could not run,'
    to: 'says which participant could not run, in the reason an operator reads'
  - id: STATE-PFM-OPS-006
    field: .transitions.4.source
    from: refuses every move for an application
    to: refuses every move for an application the tenant has never been provisioned for
  - id: STATE-PFM-OPS-006
    field: .transitions.6.source
    from: keeps the instant it was first enabled throug
    to: keeps the instant it was first enabled through a suspension and a resumption
  - id: WF-PFM-OPS-001
    field: .hops.3.source
    from: 'settles it failed, saying the job never sta'
    to: 'settles it failed, saying the job never started'
  - id: WF-PFM-OPS-002
    field: .hops.0.source
    from: takes that catalog from the published event rather than
    to: 'takes that catalog from the published event rather than the declaration, which the event itself carries'
  - id: WF-PFM-OPS-002
    field: .hops.3.source
    from: 'applies it before the settlement, so a consequence that fails leaves the job for the'
    to: 'applies it before the settlement, so a consequence that fails leaves the job for the next pass'
  - id: WF-PFM-OPS-003
    field: .hops.4.source
    from: 'corrects the job to failed, never succeeded'
    to: 'corrects the job to failed, never succeeded, keeping the progress its steps earned'
  - id: WF-PFM-OPS-004
    field: .hops.1.source
    from: 'answers nothing at all to the second claim, so nothing is'
    to: 'answers nothing at all to the second claim, so nothing is sent twice'
  - id: WF-PFM-OPS-004
    field: .hops.2.source
    from: 'refuses to send at all when the sending address is unset, naming both variab'
    to: 'refuses to send at all when the sending address is unset, naming both variables'
  - id: WF-PFM-OPS-006
    field: .hops.1.source
    from: 'records the request on the root and in its history, then stops the execution with the c'
    to: 'records the request on the root and in its history, then stops the execution with the cause'
  - id: WF-PFM-OPS-007
    field: .hops.1.source
    from: does not find a schema that holds the same job and pu
    to: does not find a schema that holds the same job and publishes no view
  - id: WF-PFM-OPS-007
    field: .hops.2.source
    from: 'pages across the two macroservices, the cursor of one'
    to: 'pages across the two macroservices, the cursor of one continuing into the other'
  - id: WF-PFM-OPS-007
    field: .hops.3.source
    from: 'names the subject null, and still answers it, for a tenant th'
    to: 'names the subject null, and still answers it, for a tenant that no longer reads'
  - id: WF-PFM-OPS-008
    field: .hops.2.source
    from: 'refuses a record type the registry does not hold, naming'
    to: 'refuses a record type the registry does not hold, naming the types it does'
  - id: WF-PFM-OPS-008
    field: .hops.4.source
    from: reports the retry as a duplicate rather than refusing it
    to: 'reports the retry as a duplicate rather than refusing it, because the client has nothing to fix'
  - id: WF-PFM-OPS-009
    field: .hops.1.source
    from: 'is refused by the database, so the purger is never a del'
    to: 'is refused by the database, so the purger is never a delete-by-tenant tool'
  - id: WF-PFM-OPS-010
    field: .hops.3.source
    from: leaves the operational row exactly as
    to: 'leaves the operational row exactly as it was, because the licence does not decide the state'
  - id: WF-PFM-OPS-010
    field: .hops.4.source
    from: 'asks for none when the second revocation of the same override is refused, because nothing ch'
    to: 'asks for none when the second revocation of the same override is refused, because nothing changed'
  - id: WF-PFM-OPS-012
    field: .hops.0.source
    from: refuses every move for an application
    to: refuses every move for an application the tenant has never been provisioned for
  - id: WF-PFM-OPS-013
    field: .hops.0.source
    from: leaves the licences of a company synced before the
    to: leaves the licences of a company synced before the key was removed exactly as they were
  - id: WF-PFM-OPS-013
    field: .hops.4.source
    from: changes nothing and asks for no second flush when
    to: changes nothing and asks for no second flush when the read is the same as the last
  - id: WF-PFM-OPS-014
    field: .hops.1.source
    from: 'refuses a delivery signed for a different URI, so a signature cannot be replayed at'
    to: 'refuses a delivery signed for a different URI, so a signature cannot be replayed at another route'
  - id: WF-PFM-OPS-014
    field: .hops.2.source
    from: reports an event about a contract it has never s
    to: 'reports an event about a contract it has never seen as unresolved, for the nightly pass to pick up'
  - id: WF-PFM-OPS-017
    field: .hops.1.source
    from: writes no override on the second
    to: writes no override on the second pass for the tenant whose grant was revoked
validation:
  npm_ci: passed; zero reported vulnerabilities
  npm_run_check: passed; zero errors
  npm_test: 'passed; four tests, zero failures'
  backend_runtime_tests: not run; source and existing test definitions examined
---

# Jobs, Audit and Licensing Design Examination

## Scope and Method

This examination covers all fifty-two design artifacts and Operations’ responsibilities row. Source references were checked at the pinned repository commits, then claims were compared with route declarations, persistence constraints, engine and reconciliation paths, scheduled handlers, queue consumers and console components. Existing test definitions provide evidence of intended checks; this job did not execute the service repositories’ integration suites. Verification commits precede separate final-text commits for each artifact.

The requested design brief is absent from the starting checkout. The planning corpus supplies the product baseline, but its features, concepts, capabilities and journeys retain draft status and its acceptance scenarios retain proposed status. This examination does not confer approval or modify planning rules; contradictory implementation behavior remains a finding.

## Counts and Coverage

| Examined kind | Count |
| --- | ---: |
| Domain objects | 4 |
| State models | 6 |
| Workflows | 17 |
| Service contracts | 3 |
| Screen contracts | 5 |
| Decision records | 17 |
| Invariant rows | 60 |
| Transition rows | 38 |
| Workflow hops | 73 |
| Source references | 227 |
| Distinct source files in those references | 83 |
| Expanded test-title anchors | 50 |

| Coverage inventory | Covered | Boundary |
| --- | ---: | --- |
| HTTP route operations | 32 of 32 | Fifteen job reads, three activity operations, ten licensing operations, one workspace-applications read and three health routes. |
| Module tables | 11 of 11 | One notice table, one activity table, seven licence facets and two application tables; job-family tables belong to their domain owners. |
| Published job views | 3 of 3 | Run, step and event views are covered by the jobs object, engine workflows and read contract. |
| Specified console presentations | 5 of 5 | Three standalone job screens and two embedded HQ presentations; the Applications overview remains provisionally specified by Console Shell. |
| Module-owned state machines | 0 of 0 | This module supplies builders and monitors; job-kind owners instantiate execution machines. |
| Queue resources | 2 of 2 | Company synchronization and its dead-letter queue are covered by the company-read workflow. |
| Scheduled passes | 2 of 2 | Five-minute reconciliation and the nightly company-read producer have workflows. |
| Model tasks | 0 of 0 | No model invocation occurs in the examined module paths; contract, workflow and screen inference inventories are empty. |

The inference scan found no task requiring a new inference-operation artifact. The existing finding about the charter’s missing no-inference declaration remains open because planning files are outside this job’s write scope. All route operations remain unpublished to Submissions, and the examined object registrations declare no custom-field capability.

## Changes by Artifact

Every artifact’s body and behavioral text were rewritten after examination. The table records the principal verification outcome; exact changes to protected metadata and expanded source anchors are retained in report frontmatter. Workflow diagrams now show the ordered activities without assigning calls to an actor that does not perform them.

| Artifact | Examination and final-text result |
| --- | --- |
| ADR-PFM-OPS-001 | Retained separate orchestration, shared recording and domain ownership. |
| ADR-PFM-OPS-002 | Distinguished forgiving starts from strict starts after commit. |
| ADR-PFM-OPS-003 | Recorded actual consequence ordering and its unrecovered final-job gap. |
| ADR-PFM-OPS-004 | Replaced delivery certainty with claim reuse, duplicates and missed-attempt risk. |
| ADR-PFM-OPS-005 | Verified customer, workspace and HQ monitoring divisions. |
| ADR-PFM-OPS-006 | Verified read-only publication boundaries across services. |
| ADR-PFM-OPS-007 | Retained append-only activity and workspace isolation evidence. |
| ADR-PFM-OPS-008 | Verified browser occurrence identity and server actor resolution. |
| ADR-PFM-OPS-009 | Kept recent-record presentation with the query owner. |
| ADR-PFM-OPS-010 | Verified reasoned withdrawal and withholding precedence without inventing database immutability. |
| ADR-PFM-OPS-011 | Retained committed decisions when later history or refresh fails. |
| ADR-PFM-OPS-012 | Distinguished transactional replacement from ordering of simultaneous snapshots. |
| ADR-PFM-OPS-013 | Retained the cited availability decision rather than re-deciding it. |
| ADR-PFM-OPS-014 | Verified explicit licence query scope and customer-safe mapping. |
| ADR-PFM-OPS-015 | Verified registrations declare no custom-field capability. |
| ADR-PFM-OPS-016 | Verified every route lacks a Submissions publication binding. |
| ADR-PFM-OPS-017 | Separated read-token and webhook configuration; retained coverage while unconfigured. |
| DOM-PFM-OPS-001 | Distinguished optional timestamps, bounded progress, service write discipline and unenforced domain-input obligations. |
| DOM-PFM-OPS-002 | Expanded exact test anchors and clarified append-only scope, visit deduplication and pre-insert authority checks. |
| DOM-PFM-OPS-003 | Corrected service-only withdrawal and grace guarantees; separated failed-read health from unchanged coverage. |
| DOM-PFM-OPS-004 | Corrected nullable description and change attribution; distinguished first-enablement preservation from database checks. |
| SCR-PFM-OPS-001 | Verified workspace routing, read permission, monitor queries and implemented page states. |
| SCR-PFM-OPS-002 | Corrected requester display to the list identifier with client-side naming for own jobs. |
| SCR-PFM-OPS-003 | Described retry visibility as the implemented kind-name test, retaining service authority. |
| SCR-PFM-OPS-004 | Retained the known retry-route disagreement and composite-save failure boundaries. |
| SCR-PFM-OPS-005 | Named the exact card components and retained the selected-workspace waiting state. |
| STATE-PFM-OPS-001 | Included retrying reconciliation and the after-settlement consequence path. |
| STATE-PFM-OPS-002 | Separated step failure from job settlement and narrowed the queued-step refusal claim. |
| STATE-PFM-OPS-003 | Distinguished guarded claims from unguarded result writes and removed guaranteed retry language. |
| STATE-PFM-OPS-004 | Corrected coverage precedence over a staff grant. |
| STATE-PFM-OPS-005 | Described clock-derived standing and unproven ordering of concurrent company reads. |
| STATE-PFM-OPS-006 | Separated read-time guards from locked writes without starting-state comparison. |
| SVC-PFM-OPS-audit | Separated target authorization from the insert transaction. |
| SVC-PFM-OPS-jobs | Corrected source-module path and workspace permission; narrowed recovery and notice guarantees. |
| SVC-PFM-OPS-licensing | Corrected source-module path and successful-copy versus failure-health consistency. |
| WF-PFM-OPS-001 | Repaired the documentation anchor and replaced a hard convergence deadline with eligibility and schedule. |
| WF-PFM-OPS-002 | Clarified progress reporting, continuation, failure settlement and notice handling. |
| WF-PFM-OPS-003 | Corrected consequence ordering, retry limits and invocation-silence observation. |
| WF-PFM-OPS-004 | Recorded concurrent claim duplication, result overwrites and absence of a retry sweep. |
| WF-PFM-OPS-005 | Distinguished forgiving start from transactional strict retry callers. |
| WF-PFM-OPS-006 | Separated recorded cancellation from best-effort execution stop. |
| WF-PFM-OPS-007 | Verified published-view reads, kind filtering and scope enforcement. |
| WF-PFM-OPS-008 | Verified browser occurrence identity, wire transformation, target authority and server visit capture. |
| WF-PFM-OPS-009 | Verified lifecycle removal ownership and activity/notice removal. |
| WF-PFM-OPS-010 | Preserved commit-before-history and cache-refresh failure boundaries. |
| WF-PFM-OPS-011 | Separated transactional state insertion from later participant preparation and stranded-state recovery. |
| WF-PFM-OPS-012 | Recorded stale pre-write decisions without claiming whole-transition serialization. |
| WF-PFM-OPS-013 | Corrected company concurrency and acknowledged provider failures versus thrown redelivery. |
| WF-PFM-OPS-014 | Verified signature admission, company selection, queue publication and publication-failure response. |
| WF-PFM-OPS-015 | Removed guaranteed daily convergence and corrected invocation-silence observation. |
| WF-PFM-OPS-016 | Explained conditional refresh, cache expiry and permissive missing-setting default. |
| WF-PFM-OPS-017 | Corrected bulk environment selection and propagated seed failures. |

The responsibilities inventory now lists every route separately, retains the four object owners and narrows notice and licensing follow-up guarantees. Other modules’ rows and prose were preserved. The module registry records design examination while artifact approval and intent values retain their prior authority.

## Findings and Decisions Still Open

| Finding | Remaining disagreement |
| --- | --- |
| FND-PFM-OPS-041 | Notice retries lack an independent trigger, and competing outcome writes can overwrite delivery. Decide whether recovery must guarantee another attempt. |
| FND-PFM-OPS-042 | Correction of execution success settles failure before applying its consequence. Decide how a failed consequence is recovered and reconcile the universal before-settlement planning rule. |
| FND-PFM-OPS-043 | Company replacement has no company-wide serialization or source-version ordering. Decide the required result under overlapping snapshots. |
| FND-PFM-OPS-044 | Bulk development seeding has no internal environment guard and seed failures propagate. Establish caller containment and the intended failure policy. |
| FND-PFM-OPS-045 | Several guarantees belong to service discipline rather than database enforcement, and domain-input content is not inspected. Decide whether stronger enforcement is required. |
| FND-PFM-OPS-046 | The requested design brief was not available. Supply or explicitly waive that examination input. |
| FND-PFM-OPS-047 | Planning status fields do not establish approval. Confirm the authoritative product baseline before implementation preparation. |

Earlier findings remain open unless their existing record already establishes resolution. The licensing retry address disagreement, permanently stranded preparation, provisional Applications-read ownership, later entitlement directions and missing charter inference declaration remain relevant preparation limits. No silent planning change resolves them.

## Validation

Dependency installation and corpus conformance passed with zero errors. All four corpus tests passed. These checks establish artifact consistency; they do not prove runtime recovery or provider concurrency under failure.

## Verdict for Andrew

The examined design gives a faithful, qualified account of the pinned implementation, with unsupported guarantees corrected and remaining contradictions recorded. Its weakest areas are recovery after committed outcomes, concurrent commercial reads and the uncertain approval status of the planning baseline. Before implementation preparation, confirm that baseline and decide the required guarantees for consequence recovery, notice retries, application preparation and snapshot ordering.