01must proveProposed | Settings read, update and rebuild use separate permissions plus dataset query access, with inaccessible record types omitted from the settings list. | permission | api, service | test |
02must proveProposed | Reading never-configured settings returns default fields, version zero and unprovisioned state without writing. | policy | service | test |
03must proveProposed | Search field configuration accepts one to thirty distinct eligible dataset fields in three tiers, excludes hidden or unsupported content types, and rejects all detected problems together without writing. | validation | service | test |
04must proveProposed | Configuration updates use the read version, leave unchanged lists and versions alone, and atomically record a changed target with the rebuild it requires. | lifecycle | service | test |
05must proveProposed | Rebuilding fills a new generation while the existing one serves searches, publishes after validation, and coalesces concurrent full rebuild requests for the same record type. | lifecycle | service, database | test |
06must proveConfirmed | Change handling claims record versions before projection, removes documents for missing source records and avoids writing late updates after deletion. | invariant | service | test |
07must proveProposed | Organization renames refresh current affiliates, address changes refresh linked contacts, and fan-out beyond two hundred contacts becomes rebuild work. | calculation | service | test |
08must proveProposed | A workspace’s provider failure affects only its events, while events for unindexed, deleting or missing workspaces settle without provider writes. | policy | service | test |
09must proveProposed | Retired fields degrade the index and trigger rebuilding without the field while remaining visible as unavailable in configuration, and saves retaining them are rejected. | policy | service | test |
10must proveProposed | Repair resubmits owed rebuilds every fifteen minutes with hourly automatic backoff per type, reconciles types nightly in assigned hours, and retains deletion counters for at least fourteen days. | lifecycle | service | test |
11must proveProposed | Provisioning creates workspace index resources and purge removes them, waits for active rebuilds, and suppresses writes during workspace deletion. | lifecycle | service | test |
12Proposed | Provider-setting release changes advance the expected index settings and trigger automatic rebuilds through the repair pass. | policy | service | documented |