01must proveConfirmed | Publishable records begin in draft and accept draft, pending-review, published or unpublished states; entering publication sets its time, leaving it clears the time and nonpublishable objects reject publication. | lifecycle | service, database | test |
02must proveConfirmed | Record archival retains values, files and links while excluding ordinary-list entries and refusing edits, publication and repeated archival until restoration; deletion remains available for an active object. | lifecycle | service | test |
03must proveConfirmed | Permanent deletion requires the current version, removes record and owned value reservations and detaches files for retirement. | lifecycle | service, database | test |
04must proveConfirmed | A restricting link in force prevents deletion without removing anything, including a link whose end date is still current or future. | validation | service, database | test |
05must proveConfirmed | Cascading deletion follows linked custom records through the same safeguards to a maximum depth of ten and rolls back the entire deletion when any member is refused. | invariant | service, database, console | test |
06must proveConfirmed | Deletion announcements order link removals first, cascaded records from deepest to shallowest next and the originating record last. | policy | service, database | test |
07must proveConfirmed | Owner cascades still delete records of archived or draft objects even though direct deletion from those objects is refused. | policy | service, database | test |
08must proveConfirmed | Publication, archival, restoration and deletion record audit events in their transaction, including the chosen publication state. | policy | service | test |
09must proveConfirmed | Authorized record-page actions offer publication, unpublication, archival, restoration and confirmed deletion, explaining restricting links in a refused deletion confirmation. | policy | console | test |
10Confirmed | Direct store deletion consults an optional external deletion check, but no integration registers it and cross-service deletion does not consult it. | policy | service | documented |