---
id: ADR-PFM-SEC-013
title: Versioned record replacement contract
product_area: platform
module: security
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Carry the cited standard’s complete editable replacement and client-held version requirements into
  preparation, while keeping current missing-version, patch and optional-definition-version deviations explicitly
  recorded.
constrains:
- SVC-PFM-SEC-customers
- SVC-PFM-SEC-tenants
- SVC-PFM-SEC-security
- DOM-PFM-SEC-001
- DOM-PFM-SEC-002
- DOM-PFM-SEC-003
origin: services-platform:docs/standards/record-write-contracts.md (D-05, W1, W2); FND-PFM-SEC-004, FND-PFM-SEC-032,
  FND-PFM-SEC-035
alternatives:
- option: Preserve omitted editable fields during replacement.
  why_not: That would collapse replacement into patch semantics and remove omission-based clearing required
    by the standard.
consequences:
- Current deviations include server faults for missing replacement versions, server-read patch comparisons,
  optional definition versions and metadata changes on no-op saves.
- Workspace lifecycle and commercial-reference changes are protected from ordinary saves; staff status and
  customer commercial fields follow their distinct implemented permissions.
- Replacement clearing needs direct behavioral proof before the implementation can claim conformance.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Versioned record replacement contract

## Context

This record cites an existing write standard, not an implemented guarantee. The service contracts preserve current behavior and its findings rather than silently making the code conform through specification text.

Purpose-specific workspace protection does not imply that every status or commercial field is absent from every customer replacement.

## Decision

Carry the cited standard’s complete editable replacement and client-held version requirements into preparation, while keeping current missing-version, patch and optional-definition-version deviations explicitly recorded.

## Alternatives Considered

Preserve omitted editable fields during replacement. That would collapse replacement into patch semantics and remove omission-based clearing required by the standard.

## Consequences

Current deviations include server faults for missing replacement versions, server-read patch comparisons, optional definition versions and metadata changes on no-op saves.

Workspace lifecycle and commercial-reference changes are protected from ordinary saves; staff status and customer commercial fields follow their distinct implemented permissions.

Replacement clearing needs direct behavioral proof before the implementation can claim conformance.