The runbook that rejected the schema.

One section promised idempotent onboarding. Another explained how an identity could move between tenants. The schema allowed only one row for an identity-provider subject anywhere, so the old relationship could not remain as history while a new one became active.

An instruction to delete the old row before creating the new one would erase history and create a failure window. If creation failed after deletion, the identity would belong nowhere. Operator discipline could not turn that into an atomic transition.

We added lifecycle status and replaced global uniqueness with a partial unique index. PostgreSQL supports enforcing uniqueness only among rows that satisfy an index predicate. The database could now retain historical relationships while rejecting two active owners for the same subject.

The transfer still required a transaction and concurrency tests. The index was an invariant, not a complete workflow.

Local tests and production can use identities with different privileges. We expanded verification to prove idempotent retries, retained history, rejection of a second active row, rollback after interruption, and behavior through a production-like role.