01must proveConfirmed | Execution rejects open required questions and blockers with their details, and accepts defaulted recommendations only when the request explicitly accepts them. no proof recorded yet | validation | api, service | test |
02must proveConfirmed | Before queueing, execution compares the current preview with the stored last-shown plan and rejects participant, dependent-row identity/version or chosen-source changes as stale with refreshed details, including requests without a submitted plan fingerprint. no proof recorded yet | validation | service | test |
03must proveConfirmed | Presentation wording, labels, duration estimates, survivor suggestions and carried dismissals do not affect approval binding. no proof recorded yet | policy | service | test |
04must proveConfirmed | Duplicate or simultaneous execution submissions return the same merge and job, with later requests reporting no new creation. no proof recorded yet | invariant | service, database | test |
05must proveConfirmed | A durable background job exposes plan-check, record-lock, participant-change and merge-commit steps; merge and job creation commit together, and reconciliation starts or fails jobs whose start was lost. no proof recorded yet | lifecycle | service | test |
06must proveConfirmed | Execution re-plans under lock in one transaction and rolls back all changes on stale data, already-merged participants, blockers, participant refusals, ordinary survivor validation or internal failure, recording the reason. no proof recorded yet | invariant | service, database | test |
07must proveConfirmed | Of overlapping merges sharing a participant, only one succeeds; the other reports already merged with record names and numbers, preventing two survivor destinations. no proof recorded yet | invariant | service, database | test |
08must proveConfirmed | A record or owned detail locked against deletion also blocks merging. no proof recorded yet | validation | service | test |
09must proveConfirmed | Merges above 100,000 related writes are rejected; those above 10,000 are classified large and warn about moved records, estimated duration and editing waits. no proof recorded yet | validation | service | test |
10must proveConfirmed | Failure restores the plan's earlier status and decisions; another execution creates a new attempt while preserving the failed merge in history. no proof recorded yet | lifecycle | service | test |
11must proveConfirmed | Workflow retries apply only to transient errors such as lock waits, excluding business refusals. no proof recorded yet | policy | service | observed |
12must proveConfirmed | Every successful participant record receives an audit merge pointer naming the merge, survivor and participant role within the merge transaction. no proof recorded yet | lifecycle | service | test |
13must proveConfirmed | After a contact merge commits, a business event announces the survivor and absorbed identities to subscribers; organization merges publish no corresponding event. no proof recorded yet | lifecycle | service | test |
14must proveConfirmed | Console confirmation identifies the survivor and deleted records, states irreversibility, labels the outcome and polls every second for 30 seconds then every five seconds, while allowing staff to leave. no proof recorded yet | policy | console | test |
15must proveConfirmed | Estimated duration is the rounded sum of half a second and 1.7 milliseconds per estimated touched row, with negative row counts treated as zero and a minimum of one second. no proof recorded yet | calculation | service | observed |