- saas_provisioning_inbox with row-lock idempotency (exactly-once)
- SAAS_PIM_MODULE_SECRET exclusively — no generic-secret fallback
- Owner gate requires is_owner===true AND role_code===TENANT_OWNER (both)
- event_id required on /api/internal/events; missing or bad version → 422
- Unsupported event types → 422, never marked PROCESSED
- SSO role loading scoped through Role.tenant_id (cross-tenant safe)
- Migration: single named unique index on event_id (no duplicate inline)
- Soft deprovision preserves all PIM business data
- 23 live receiver tests + 11 unit tests, 0 failures
- Migration up/down verified clean
- PENDING: real SaaS outbox delivery + one-time SSO (ecosystem test)
Inamul-hasan-tec