ci/woodpecker/pr/ci Pipeline was canceled
- tenancy-FK exemption: canonical workspace_id is the one permitted business->class reference; all other forms forbidden with control test - record class = 4 node tables + hierarchy_grants per A1 8.1.2 - grant uniqueness via UNIQUE NULLS NOT DISTINCT (or 6 partial indexes); NOT NULL on role/granted_by/name/slug - grant FK delete actions split: target cascade, principal RESTRICT - audit parity: REQ-AUD-001 guarantees, same-transaction outbox, deletion-safe snapshot linkage, cascade coverage, rollback witness - roll-up never-a-write restored to full A1 strength (no canonical writes) - ownership invariant completed via contract 2; both-sides transfer rule marked new policy; legacy premise corrected - corrected cardinality witness (one-parent-per-child + sibling control) - provenance fixes: REQ-MIG-001 attribution dropped, projects table described accurately, D8-rank-1 claim removed