The Kipas Guide,
start to close.

This guide uses one salon day as the fully worked example. Other service businesses follow the same operating rules. The workspace adapts its language and visible modules to the selected business type.

The owner can further tune which pages staff and managers see, in Settings. When in doubt, keep staff simple: POS and their day.

A new workspace shows setup progress on Overview and a temporary Setup item near the top of the sidebar. Each status opens the matching wizard step. Both disappear after all required checks are ready. You can still open the wizard from Settings. The wizard orders its steps for your business type and removes optional steps when the related workspace module is off. For a non-salon workspace, the owner can also choose the workday pattern in Settings. The pattern changes the order and labels of existing work. It does not create new permissions or routes. In an Other Service workspace, a schedule-led pattern needs Bookings, a counter-led pattern needs Walk-in queue, and a hybrid pattern needs both modules. Setup shows a review warning until the pattern and modules match. The review step still shows each named readiness check.

Selecting a customer shows their notes only when the role can open customer details, so the right things are remembered before the service starts. A salon sees preferred shape, colours, and allergies; a wellness practice sees comfort preferences and methods to avoid; other workspaces see their own service notes. An owner can hide the Customers page for staff or branch managers. This does not stop a POS sale: they can still search by name or phone and see only the buyer's name, phone, package credit, membership, and voucher facts. Profile notes and history stay hidden. A Booking contact can buy services, packages, or memberships in POS, but customer notes, rewards, package credit, member prices, and vouchers stay unavailable until checkout completes.

Each customer has a profile for service needs, preferences, and notes (Admin → Customers → open customer → Edit). Beauty workspaces can record treatment details such as nail shape, colours, sensitivities, and usual staff. Wellness workspaces use service concerns, comfort preferences, methods to avoid, the usual practitioner, and care notes. Other workspaces use client or service notes that match their work. Useful notes appear in POS when the customer is selected and in the booking screen, so the team can prepare. Empty sections stay hidden, and notes never appear for Walk-in.

For Wellness, keep only shared client preferences in the customer profile. Put visit-specific cautions, intake review, consent, and practitioner notes in the Wellness visit. For Professional Services, use the customer profile only for shared communication or meeting preferences. Put the scope, approvals, documents, and restricted notes in the case account. This separation keeps the next worker from treating a general profile note as current consent or approved scope.

Wherever a customer has a phone number, a green WhatsApp button opens your WhatsApp with a prepared message you can edit before sending. On My Day, a reminder stays in place while its action saves and only clears after the record is kept. Mark confirmed also updates the appointment when your role can manage the calendar. Otherwise, Kipas records the note and tells you that the appointment status did not change. On Messages, the status changes as soon as you tap. If saving fails, the previous status returns and an error explains what happened. On the Messages, Reminders, and Walk-ins pages, a blocked new window is not marked opened, and a waiting walk-in is not marked called. Kipas tells you to allow pop-ups and try again. Remember golden rule 1: nothing is ever sent automatically. A no-phone customer is never a problem; they just skip the messaging features.

Open any customer in Admin → Customers for their whole story: package credit balance, membership, recent receipts, upcoming appointments, favourite services, total spend. This is also where the owner can grant package credit manually. Note that a manual grant records no payment; to actually take money for a package, sell it through POS (Chapter 08).

The owner-only Booking contacts view is separate from the customer total, birthday and lapsed lists, ordinary customer export, rewards, promotions, and follow-ups. A booking-contact record shows honest identity and contact details plus recent future, past, cancelled, and no-show appointments. The owner can edit contact details, merge duplicates, anonymize identity, or start checkout. When two records share a name, the duplicate-review panel shows the phone, completed-visit count, and lifecycle label for each record. Customer portal links, service profiles, spend metrics, package grants, memberships, vouchers, and occasion messages stay unavailable until completed checkout makes the person a customer.

Owners can use the customer menu to Send portal link or revoke the current link. If the browser blocks the WhatsApp window, Kipas does not log or claim it as opened; allow pop-ups and try again.

The customer portal puts upcoming appointments first. Packages, membership benefits, and vouchers appear together below the appointment list. A place in a shared group session appears in the same list, marked as a group session; the customer can see it but cannot change or cancel it from the portal, and never sees who else is attending. For their own one-to-one appointments, a customer can confirm that they are coming or book another appointment without entering contact details again. Cancel and reschedule create a request for the business to review. One unresolved request blocks a conflicting second request. After the business acts, the portal shows the result and the applied time for a reschedule. Recent cancelled appointments stay visible.

A customer record can also hold optional e-invoice details (a TIN, and an NRIC or passport number). These are stored for future individual e-invoices and do not print on today's receipts. Anonymizing a customer removes them.

If a customer asks for identity removal, an owner can choose Anonymize customer from the same menu. Kipas removes contact, tax, booking, queue, portal, and service-profile identity data. Receipts and appointments stay as business records under Former customer. This action cannot be undone and requires a reason.

A staff member's My Day page puts assigned one-to-one and group sessions into one time-ordered agenda for today and the next 7 days. An assigned room, station, or equipment item appears on that session. Group sessions show the active attendee roster. Its WhatsApp tasks card lists tomorrow's reminders and a short follow-up preview: expiring credit and memberships, birthdays this month, unused free visits, and lapsed customers. The full follow-up list, including customers with no next booking, is on Messages > Follow-ups.

The Appointments page opens on the current day. Appointment-led professional workspaces place booking requests and group work before the schedule. Other workspaces keep the day schedule first. A wellness workspace does not enable the walk-in queue by default. If the owner enables it, the queue appears as real work on Overview and My Day. These changes affect presentation only. The same bookings and filters remain available.

Views: List or Calendar, date arrows, and status filters. On Calendar, drag a booking to another time or another staff lane to reschedule it; hold a moment before dragging on a tablet. Kipas checks the new slot exactly as it checks a new booking, so a clash is refused and explained, and a message offers Undo for five seconds. A day that is already past shows its bookings for reference but takes no new ones. From My Day, Home, or Messages, use Open appointment. Users who can manage the calendar jump straight to that record. View-only users open the correct date and can see the appointment in the list. No-phone customers book normally. They do not get WhatsApp reminders. Customers marked Do not contact keep their appointments but do not appear in reminder targets until an owner turns that setting off. This control does not depend on AI. Kipas AI does not write customer-addressed messages in this release. Staff review and edit the prepared reminder before WhatsApp opens the current text. Booking confirmations follow the business-wide Friendly, Short, Formal, or Custom WhatsApp choice in the current Kipas language. If the browser blocks a reminder or confirmation-link window, Kipas stops before creating the link or marking it opened. Allow pop-ups, try again, and keep the new tab open until WhatsApp appears.

When you edit an appointment, the service list stays closed until you type in the service search box. This keeps the customer, staff, date, and time fields easy to reach. After you add a match, the same search stays open so you can add another matching service.

Owners and branch managers can open Business setup → Resources to add rooms, stations, or equipment. The appointment form shows the optional Resource field only when the selected branch has an active resource. Kipas blocks overlapping appointments that use the same resource. Public demo managers can inspect Schedule and the Resources seeded for wellness and professional workspaces. These pages are read-only. Demo staff do not receive these manager-only links.

For a group session, the lead customer uses the first place. Create the appointment, reopen it, and use the roster to add an existing person or quick-add a Booking contact. Kipas will not let the roster exceed the group size. If adding the new contact to the roster fails, the Booking contact stays searchable so you can retry or find it later. Each attendee with an email gets their own appointment reminder, and each can confirm their own place from it.

An owner can publish a saved group session from its roster panel. The public page shows the service, branch, date, time, and number of places left. In Pending requests mode, accepting the request adds the customer to the existing roster. It does not create another appointment. In Auto-book mode, submission adds the customer at once. Kipas locks the group session before it adds a place, so two customers cannot take the same last place.

Scheduled → Confirmed → In progress → Completed (or Cancelled / No-show). Accepting an online request creates a Scheduled appointment and reserves the time. The customer confirmation link changes it to Confirmed when the customer says they are coming. Update status from the appointment itself when staff confirm by another channel. The new status appears immediately. Reversible changes include Undo for five seconds. If saving fails, the previous status returns. A wrong tap into Cancelled or No-show is not stuck: an owner or branch manager can use Restore from the same appointment, on the Appointments page or in POS, at any time afterward, not just within the five-second window; it always asks before changing the record. Restore marks the appointment Confirmed. Kipas automatically marks a Scheduled appointment No-show once its time passes with nobody updating it, so a past appointment restored straight back to Scheduled would only be swept to No-show again; Confirmed avoids that and is one tap closer to Start Service besides. On My Day, the Appointments page, or from POS itself, use Open in POS for today's appointment. POS selects its branch and expands the exact appointment. Review it, then use Confirm or Start Service as needed. Opening it does not change its status. Anyone working the counter can check a customer out of any of today's appointments at that branch, not only the staff member it is assigned to; POS still shows who it was booked with. A one-person sale completing marks it Completed. If a customer is selected into an empty cart by search and they also have an open appointment today, POS offers Start from appointment so the sale still links back to it. If the selected customer has more than one open appointment today, choose the correct appointment before POS fills the cart. An active walk-in or job must be completed or detached with Change before an appointment can start. Either way, POS verifies every booked service before it changes the appointment to In progress; a service deactivated after booking still enters the cart, named for review, and a booked service that cannot be verified stops the handoff with no services added and no status change.

For a multi-branch counter user, Open in POS switches to the appointment's assigned branch before it opens, when that branch is assigned to you. It never moves an active sale, so finish or clear that sale first.

For a group session, POS asks which attendee is checking out. Complete one sale and one receipt for that person. The appointment stays In progress while another booked attendee is waiting. The last attendee checkout marks the session Completed. You can still complete the appointment directly when the session ends without another checkout.

When a customer asks to cancel through their portal, use Cancel appointment in Customer change requests. For a reschedule request, use Reschedule appointment, review the requested time, and apply it. Kipas updates the appointment and closes the request together. Use Decline request when the appointment must stay unchanged. Use Close as handled only when the team completed the work another way; that action does not change the appointment. After a cancellation or a declined request, Kipas emails the customer automatically when an address is on file, and the confirmation toast offers a one-tap WhatsApp message with the same outcome.

New customers and customers without a personal portal link use the public link from Settings to request a one-to-one appointment or a published group session. Customers with a portal link can book another appointment without entering contact details again. In Pending requests mode, your team reviews each request. Accepting a one-to-one request reserves the time, creates a Scheduled appointment, and creates its customer confirmation link. Accepting a group-session request adds the person to the existing roster. If no matching phone identity exists, acceptance creates a Booking contact. The record becomes a customer only after completed checkout.

Requests with the same phone, branch, service, and time stay together. Kipas marks each later copy as Duplicate request. After you accept one request, its matching copies show Already booked and no longer show Accept. If another appointment uses the same time, the request shows Time may be full, but Accept stays available and verifies staff capacity. If no staff remain, the request changes to Slot no longer available. Reply on WhatsApp so the customer can pick another time, then decline the old request.

In Auto-book mode, a one-to-one request inside your rules creates the appointment at once. A group-session request takes a place at once when capacity remains. Kipas checks the slot or group capacity again inside the booking transaction.

You do not have to watch the page for new requests. Every new booking request emails the workspace owners within about a minute, with the customer, the service, and the time they asked for. One email per request: replying to a request or opening the page never triggers another.

When customer emails are on in Settings and the requester has an email on file, accepting or declining also emails them the outcome. An accepted one-to-one request includes the same confirmation link as the WhatsApp message. An accepted group-session request confirms the place but does not include a link that can change the shared appointment. The customer must contact the business to change a group-session place. The toast notes whether the email went out or was skipped.

Every reminder and booking-outcome email ends by telling the customer how to reach you. It offers a reply only when your workspace has a reply-to address on file; otherwise it gives your branch phone number, and when neither exists it simply asks them to contact the business. Keep the branch phone filled in under Settings so a customer who wants to change or cancel always has a way through.

The booking form also has an optional email field with a consent tick box for birthday and offer emails. When you accept the request, that email and consent are saved to the matched record, but only if the record has no email yet. Anything your staff typed is never overwritten.

Not for: a customer coming back days later unhappy; that's a refund (next chapter). Void means this sale was a mistake.

Every refund records the tender returned (cash/card/e-wallet) and a reason. Credit and free visits attached to refunded lines restore automatically. Commission reverses on the refund date; history is never rewritten, it grows a correction. A refund linked to a repair receipt also appears as a negative entry on that Repair Job Account and reopens the exact balance. Record a reasoned waiver when the refund is an intentional concession rather than money still owed.

Closed too early or need to fix something? Open that date → Reopen → make the correction (void, refund) → close again. The day re-locks with the correction inside.

Settings has six categories: Personal, Business, Sales and payments, Customers and messages, Team and access, and Setup and data. Search opens the exact section page. Each section keeps its own changes and has its own Save and Discard changes actions. A failed section save keeps the edits on screen and does not submit another section.

Retail and services workspaces use Jobs. At intake, identify the property in generic terms, record any serial or reference number, list accessories received, describe its condition, keep the customer's reported issue separate, and record how the customer acknowledged the intake. Link the customer and assign a team member when available. The form does not assume a bicycle, appliance, phone, or any other repair category. Drag a card within Received, In progress, or Ready to set priority. Drop it into another active stage to open Change stage with that destination selected. Nothing changes until the dialog is confirmed, and all diagnosis, approval, role, and backward-reason checks still apply. Use the card's priority menu when dragging is inconvenient. Simple and Full use the same saved order and stage. Collected and cancelled jobs appear in Archive. For an abandoned item, use Cancel with a clear reason so the property, money, and audit history stay available. Choose where the work happens: in the workshop, or at the customer location with a recorded service address. On-site jobs follow the same account, estimate, and money rules; nothing about the location changes what a payment or a version can do.

The account moves through Received → Diagnosing → Estimate sent → Approved → In progress → Ready → Collected. A valid forward jump is allowed when its diagnosis and approval prerequisites pass. A backward correction always needs a reason and records the actor, time, old stage, new stage, and reason. An owner or branch manager can correct a mistaken collection back to Ready. This clears the mistaken handover and warranty start, but keeps the prior facts in history. Once follow-up work is linked, the original collection cannot be changed.

Record the technician diagnosis before sending an estimate. Add one line for each part, labour item, or fee, set an optional validity date, and define the deposit, instalment, and final-payment steps. Sending and customer approval or decline are separate actions. Recording the send can also open a prepared WhatsApp message that carries the item, the exact total, and the validity date; a blocked pop-up records nothing. A call-out or travel charge is priced as its own fee line, never disguised as labour. Approval records the decision channel, representative name, and note. A material scope or price change creates a new immutable estimate version and makes the earlier approval stale.

Take every repair payment from the Repair Job Account. Each receipt is allocated to its deposit, instalment, or final step. The same retry reference returns the same receipt after a lost response, even when the payment completed the balance. The account shows payments, refunds, voids, waivers, and waiver reversals as one timeline. A void or refund reopens the exact balance. POS is only for a separate counter purchase. Choose the registered customer or Walk-in there; POS never attaches that sale to an open job and cannot receive the job balance. After a payment is recorded, the dialog offers the new receipt straight away: share or download the PDF, send the WhatsApp update, or email it, without leaving Jobs.

When the work is Ready, use Hand back and record who received the property and how they acknowledged it. A fully settled account closes normally. If money is still owed, only an owner or that branch's manager can release it, and a clear reason is required. An optional warranty starts at this collection time, not at intake. The owner can set defaults in Settings and each job can override the enabled state, duration, and terms. After the handover you can send a WhatsApp confirmation that repeats the recorded warranty end date and terms. For an on-site job the same action reads Complete visit, the prepared message is a visit confirmation carrying the address and any promised time, and completing the visit records the same handover facts as a counter collection. The workshop ready email is not offered for on-site work; the completion message says the work finished at the recorded address.

Use Cancel with a reason and the correct money resolution. A no-payment cancellation, a fully refunded cancellation, and a retained-fee cancellation remain distinct. An owner or branch manager can reopen a cancelled account only when retained money no longer remains. A manager can record a balance waiver with a reason, including after collection when a refund or void intentionally becomes a concession.

A return visit is a new linked job, not an edit to the original. Choose Warranty return, Rework, Additional work, or Customer complaint and state the reason. Warranty return is available only while that job's recorded warranty is active. The new job receives its own intake, estimate, payments, stages, and history while the original stays intact.

In a Catering and events workspace, Catering events replaces the ordinary Appointments page. Each event uses an appointment to keep its date, time, branch, customer, and person in charge, while the event stage, original order lines, location, and optional guest count stay on the event record.

Delivery and on-site work require an event location. Pickup shows the catering business location. Each new event gets an Event Account with a booking deposit and final balance. Use Customize plan before the first payment to change the amounts, due dates, or add later instalments. Use Collect next payment so every receipt is assigned to the correct payment.

A refund reopens that payment and the event balance. An event with money still due cannot be marked fulfilled. Simple mode gives the team a read-only event order board.

A Wellness appointment uses its own guided visit record. Create the visit, record only the minimum intake information, assign the practitioner, create an exact consent-and-price version, and record the client's decision. The panel shows the complete current immutable version, who recorded each authority event, and every linked receipt.

A revised version needs a written reason and supersedes the exact earlier version. The server will not start service without a current accepted version, completed intake review, an assigned practitioner, and any required pre-service payment. Completion also needs a settled balance or an explicit manager waiver.

Use the visit controls for status, assignment, and payment. If POS directs you back to Appointments, use these controls and do not create a second sale. The generic editor keeps the customer, branch, service set, assigned team, and group size locked. Generic appointment status, POS checkout, bulk status, and rebook shortcuts are unavailable for this record.

A Professional Services owner can choose Client sessions, Classes and cohorts, or Sessions and classes in Settings. Client sessions place new booking requests before the schedule. Classes place participant rosters first. The mixed pattern keeps requests, private sessions, and group work together. The same appointment records, access rules, and reports remain in use.

Professional Services workspaces include commissions in setup and reports when the module is enabled. Each team member sees their own month-to-date commission on My Day. Owner and manager access does not change.

A Professional Services workspace uses Cases for work that continues across documents, approvals, external organizations, payments, and follow-up. The case account is the main record. An appointment is optional linked activity, not the case itself. This supports runner and government-service work, consulting, coaching, and other continuing professional work.

Create a new scope version when the work, professional fee, or external advance changes. An approval applies only to the current version. A later version needs a new approval. Register every required document and its review state. Mark sensitive material and physical originals. Record each receipt, move, return, delivery, and correction of an original. Private files use short-lived access links. Never store passwords, OTPs, bank logins, portal credentials, security answers, or login PINs.

Before you upload a private file, Kipas reserves one document record and one file location. If the network stops, retry the same document. Do not create a second record. The document remains incomplete until Kipas confirms the stored file. Stored evidence is immutable after confirmation.

Record planned and completed work with evidence. Link an appointment only when time on a calendar is useful. Move the status to show whether the team, client, or an external party owns the next action. A recorded client update is an audit record. Kipas does not send it for you and does not claim that the client received it.

Keep professional fees separate from external-fee and incidental advances. Assign every payment to one category. Before you lower an approved amount, refund, void, or reverse every payment, waiver, or disbursement that would exceed the new amount. Record disbursement evidence, reversals, waivers, refunds, and void effects in the same account so the team can explain the balance.

If a case-payment response is lost, reopen the same case on the same device and retry the saved payment. Kipas uses the original payment key, scope, and allocation to check the original receipt. It never applies that retry to a later scope version.

If a disbursement, waiver, or reversal response is lost, reopen the same case on the same device and retry the saved financial event. Kipas reuses its original event key, approved scope, case version, time, and details. It returns the original event if it was recorded. It does not apply a retry to a later scope.

The owner can set a default completion wording, client terms, and reminder days. When normal completion has no other reason, Kipas records that wording, saves the client terms with each approval, and shows the deadline reminder dates to the case team. These are record and planning aids, not automatic client messages.

If a receipt is refunded or voided after a case was cancelled, Kipas moves the case to a restricted correction state. Record only the required waiver or disbursement reversal there. You cannot take a new payment, add a new waiver, add a new disbursement, or resume case work. An owner or manager can cancel the case again after reconciliation.

If an owner anonymizes a customer, Kipas removes case contact and narrative fields, deletes restricted notes, and blocks workspace access to private evidence. It also blocks new case changes and new saved payment or financial retries. An existing payment receipt may be retried without writing new information. A held original may be returned or delivered with a generic record. Refunds and voids remain available to reconcile retained money without restoring client text. Money allocations, status history, and custody timing remain for financial and audit continuity.

Before closure, Kipas checks the current scope approval, required documents, original custody, completed work evidence, and unresolved money. If later work needs a separate commitment, create a follow-up case instead of reopening history without a clear boundary.

In an Events and venues workspace, Events and venues replaces the ordinary Appointments page. Every event sits in one of eight states, and the board shows which: Inquiry, Tentative hold, Confirmed, Planning, Event day, Completed, Cancelled, and Archived. When someone calls, tick Quick capture on the new event form: it asks only for the client, a title, and a start time, and takes the rest from your shop defaults.

A Tentative hold reserves rooms, stations, and equipment while the client decides. Those holds expire on their own if the event is never confirmed, so a venue is not blocked by an enquiry nobody chased. Sending a hold back to Inquiry releases its reservations at once.

What Confirmed requires is your rule, not ours. The Confirmation rule on the event decides whether a deposit is enough, or whether an accepted proposal has to come with it. Cancelling releases every active reservation and cancels the open payment requests. A cancelled event can be reopened to Inquiry, but the reservations do not come back: make them again if the client returns.

The Proposal and payments tab holds the priced offer. Every change writes a new version that supersedes the last, so the document the client actually agreed to stays readable after the price has moved on. Record what they agreed with Record acceptance.

Payment requests split the total into a Deposit, any Instalment, and the Balance. Their amounts have to equal what is still owed on the event, so a schedule cannot quietly disagree with the proposal it belongs to. An amendment cannot drop the total below what the client has already paid.

Every event payment writes an ordinary receipt, so event money reaches the same daily closing and the same reports as counter takings. If that branch's business day is already sealed, the payment is refused until someone reopens it.

Reserved resources are the rooms, stations, and equipment the event is holding. A reservation has to cover the whole event rather than part of it. Timeline is the run sheet for the day, and it shows the gaps between items, so an uncovered hour is visible before it arrives rather than after. Partners records the outside suppliers you are relying on.

Guests keeps the list: expected numbers, RSVP replies, and whatever the client tells you. Bring a list in with Import CSV and take one out with Export CSV. The export offers a version that withholds dietary and access notes, for the times you are handing a list to someone who has no business reading health information.

Plan carries the task list, copied from a Workflow template when the event was created. Editing that template later does not rewrite an event already under way, which is what makes it safe to improve. What a colleague sees depends on their venue and their role: an owner sees every event, a manager sees the venues they are assigned, and staff see events at their own venue. A staff member without money access sees that an event exists without seeing the client or the figures.

The pilot uses one live workspace. A platform administrator admits one workspace at a time, and the owner of that workspace must separately opt in under Settings → AI assistance. Neither platform admission nor owner opt-in is sufficient by itself. The fleet safety control and a reviewed route must also allow the request. Restricted-data assistance has a separate owner control. An internal QA workspace remains available as an optional dry run, but it is not a gate before the live pilot. Public demo workspaces cannot use provider AI. Every AI result is a suggestion for a person to review.

The copilot can use selected Kipas Guide passages and records that your current role can already read. Workspace context and pasted text are treated as person-linked data. Professional cases, private files, and restricted records are treated as restricted data. The server raises the privacy class from the facts it retrieves. The browser cannot choose a tenant, lower a privacy class, choose a model or provider, change a route cost setting, or supply evidence facts. The server checks your authority again immediately before a request leaves Kipas. In this release, Kipas AI helps staff with reports, record explanations and summaries, briefings, setup guidance, import and attachment previews, and Guide questions. It does not write messages addressed to customers.

Choose Start over to clear the current panel. Kipas does not keep a server-side AI conversation or store prompts and answers in its AI control tables. Normal business records stay subject to their existing retention rules.

Kipas uses reviewed zero-data-retention routes. A platform administrator can pin a qualified zero-cost profile by hand for public or non-personal work, but Kipas does not search for zero-cost routes or use one as budget continuity. Person-linked and restricted tasks use a paid profile only.

If a model is unavailable, a quota is reached, or the approved budget is exhausted, Kipas returns a named fallback and charges no workspace units. Continue with the ordinary Kipas screen. Core bookings, records, receipts, and reports do not depend on AI.

Supported previews accept up to two private PDF, JPEG, PNG, or WebP files, with a maximum of 8 MiB each. Kipas treats file content as untrusted, uses the native PDF route only when verified, deletes claimed files after the attempt, and runs a retention job to retry deletion failures.

Kipas reviews newer models through a synthetic-only smoke test and bake-off. The platform console tracks exact provider endpoints, approved cost ceilings, discounts, test evidence, cost, route changes, cooldown, rollback, quarantine, key health, tenant limits, and deletion backlog. A newer model does not replace an active model until those checks pass and a platform operator activates it.