01must proveProposed | Population start and read require population authority plus the dataset query permission; simulation start and read require publish authority plus that dataset permission. | permission | api, service | test |
02must proveProposed | Population runs evaluate an effective or numbered version on its subject dataset, optionally filtered, rejecting compile failures, nonbatch providers, a foreign dataset, more than 250,000 explicit subjects or saved-query output before creating a run. | validation | service | test |
03must proveProposed | Eligible-only runs prune subjects excluded by database conditions, but provider-dependent branches cannot eliminate candidates in advance. | calculation | service | test |
04must proveProposed | Population jobs persist each cursor page once and resume after interruptions, with runs exceeding one million subjects stopped unless explicitly allowed. | invariant | service | test |
05must proveProposed | Completed runs expose state counts and ordered pages of at most 1,000 subject references, comparison gains and losses limited to 10,000 each, unchanged counts and optional reference-and-state exports. | calculation | service | test |
06must proveProposed | Simulations compare a draft and publication over recent decision subjects, derived-role holders and any requested scope, returning state changes and affected bindings and references, with nonbatch providers making results partial. | calculation | service | test |
07must proveProposed | Publication may cite a completed simulation of its current draft or record a skip, rejecting both choices together, foreign simulations, unfinished simulations and results for earlier drafts. | validation | service | test |
08must proveProposed | Population runs have a 90-day retention target and simulations 30 days; the product should enforce expiry, but scheduled cleanup is absent. | lifecycle | service | test |
09must proveProposed | Population and simulation reads conceal other workspaces’ records, and workspace deletion removes their runs and simulations. | invariant | service, database | observed |
10Proposed | The product exposes run lookup by its returned identity but offers neither a run list nor cancellation. | policy | api | test |