# Capability map — TM Forum business capabilities → this BSS, and the honest gaps

*2026-07-24. The question a CSP architect asks first: which business
capabilities does this cover, through which TM Forum tech capabilities,
in which component — and what do I still need from elsewhere? Mapped
against the TM Forum framing with the LEVELS kept honest: a **business
capability** is an ability the business needs, phrased verb-first and
implementation-free; a **tech capability** is the IT function enabling
it (an ODA functional block / TMF Open API); a **component** is the
software realizing it. Section headings are eTOM-style DOMAINS, not
capabilities. Legend: ✅ implemented **and proven
by a numbered suite** · ◐ partial / shaped seam (honest note attached)
· ❌ not here — plan another system.*

## 1. Market, Sales & Channel

| Business capability | TMF tech capability | Component / app | Status |
|---|---|---|---|
| Sell & serve consumers digitally (self-service) | Open API consumer over the fleet | `apps/storefront` /shop | ✅ (suites throughout) |
| Serve customers on mobile devices | same | `apps/mobile` (Expo) | ✅ |
| Let business customers self-manage | TMF632/672 org model | `apps/business-console` /biz | ✅ |
| Sell & support through assisted channels | TMF629 customer 360 pattern | `apps/csr-console` /csr | ✅ |
| Sell through indirect channels (retail, telesales) | dealer API + TMF683 logging | SOM dealer module + `apps/dealer-console` | ✅ #48/#51 |
| Plan, run & MEASURE marketing campaigns | TMF Campaign-shaped | `campaign` (journeys, A/B, holdout lift, caps) | ✅ #35–39 |
| Capture & develop sales leads | TMF699 Sales Management | `quote` service | ✅ |
| Reward & retain customers (loyalty) | TMF658 Loyalty Management | `loyalty` (#34) | ✅ #69 (earn on settled bills; burn to DATA at the meter, single-use TMF671 vouchers, TIERS as pricing rules; expiry sweep + liability; tier changes trigger campaigns; storefront + app cards) |
| Let households pick partner benefits with a plan's allowance (Choices) | TMF620 terms + TMF622 orders + TMF637 inventory, house ledger API | `benefit-allowance` (#352) + catalog, ordering, SOM partner seam | ✅ `benefit_choices_test.js` (grants, picks never oversold or spent twice, swaps that wait for the new benefit, the swap limit as policy, downgrade refused with the remedy, holds as law-as-data, care desk + governed actions with receipts, goodwill only by a human, authoring with no JSON under launch governance, partner cost on the journal, "has unused Choices" audience, partner invoices reconciled and settled, no new picks while in collections (a policy rule), a "can I pick this?" preview that never disagrees with the order, the operator's own priority as a Pick, the mobile app on Expo SDK 58 with Choices; per-account pool and merchant of record are honest gaps — `docs/benefit-choices.md`) |
| Sell through AI shopping agents | ACP + MCP over TMF620/663/622 | catalog + cart + gateway | ✅ #64 |
| Be recommendable by AI answer engines | GEO dual-serve + JSON-LD | catalog `/seo` + gateway | ✅ #68 |

## 2. Product & Offer

| Business capability | TMF tech capability | Component | Status |
|---|---|---|---|
| Define & manage sellable offers (bundles, variants) | TMF620 (+CTK) | `product-catalog` | ✅ CTK zero |
| Price offers by configuration | TMF620 `prodSpecCharValueUse` | catalog + policy + billing | ✅ #24 |
| Configure & validate complex offers, any channel | TMF760 Product Configuration v5 | `product-catalog` + policy | ✅ #77/#78 (server-side: both pick bounds, values scoped to the picked option, priced to the pick, policy consulted; agent channel configures → checks → orders with nested items) |
| Govern ordering & pricing with business rules | TMF policy pattern | `policy` (JSON-logic) | ✅ |
| Run promotions & discounts | TMF671 | `promotion` | ✅ |
| Manage product content & imagery | TMF667 + PIM seam | `document` + per-tenant PIM | ✅ #23 |
| Bring your own CMS/DAM for imagery | TMF667 reference mode | `document` (per-tenant `AssetProvider`) | ✅ #89 (opt-in per tenant: Sanity adapter + generic HTTP connector proven on **real self-hosted Strapi**; redirect delivery, renditions, HMAC webhook freshness, fail-open placeholder — the built-in DAM stays default) |
| Author products conversationally (AI-assisted) | governed LLM over TMF620 | `intelligence` | ✅ #25/#53 |
| Full enterprise PIM (authoring workflow, syndication) | — | — | ❌ the catalog is the commercial master, deliberately not a PIM (asset storage can now point at an external DAM; editorial workflow is not built) |

## 3. Customer

| Business capability | TMF tech capability | Component | Status |
|---|---|---|---|
| Know the customer (party, account, roles) | TMF632/666/669 (+CTK) | `party-account` | ✅ |
| Authenticate & authorize per tenant | TMF672 over any OIDC | `user-roles` | ✅ |
| Honor privacy rights (consent, export, erasure) | privacy front door | party-account fan-out | ✅ #58 |
| Resolve customer problems | TMF621 | `trouble-ticket` | ✅ |
| Remember every customer interaction | TMF683 | `party-interaction` | ✅ CTK zero (846/846) |
| Notify & message customers | TMF681 + ESP seam | `communication` | ✅ (email/inbox; ◐ no SMS/push gateway — bring an SMSC/push provider) |
| Help customers help themselves | TMF knowledge + pgvector | `knowledge` | ✅ |
| Predict churn & recommend the next best offer | governed AI | `intelligence` | ✅ (rules + trained LR; ◐ GBM/QoE features future) |
| Personalize the shop from the customer's OWN data (usage-aware upsell, interest-ranked grid, returning-visitor rules) | insight + policy + TMF680 + for-you | storefront + `intelligence` + `insight` | ✅ #86 (the next rung of the allowance ladder, never a nag; frequency and full interest profile as rule variables) |
| Stay current with the national person registry (protected addresses, deceased flags) | country-keyed registry seam + event feed | `party-account` | ✅ `norway_rails_test` (idempotent feed cursor; protected addresses masked everywhere — staff consoles, checkout, every export; pickup-point delivery for shielded parties) |
| Honor the number-directory obligation (exposure levels, secret numbers) | directory model + delta exporter | `party-account` | ✅ `norway_rails_test` (secret number free and fully suppressed; a reserved entry can never leak into an export; real directory agreements are per-tenant deployment config) |
| Staff care & back-office with AI workers | MCP + workforce API | `intelligence` + package | ✅ #65–66 |
| Social/community management, NPS/CX survey suite | — | — | ❌ |

## 4. Revenue

| Business capability | TMF tech capability | Component | Status |
|---|---|---|---|
| Rate usage | TMF635/677 (+CTKs) | `usage` | ✅ |
| Bill customers (runs, invoices, e-invoice formats, credit notes) | TMF678 (+CTK) | `billing` (crash-resumable) | ✅ #57, #71 (numbered GAPLESS credit notes: unpaid bills reduce, settled refund via PSP, disputes mint their own paper) |
| Deliver bills & apply incoming payments | distribution seam | `billing` | ✅ |
| Say one true thing about a bill's situation, in every channel | `dueDate` on TMF678 + house `billSituation` block beside the standard payload | `billing` (`BillSituations`, pure) | ✅ `bill_situation_test` (eight situations with a fixed precedence computed once, read by four channels that each know all eight; a dispute opened on a bill moves the desk and the shop in the same breath and resolving it puts both back; no channel owns a clock — the claims gate refuses one that grows a date comparison; ◐ the `arrangement` rung is proven only as a unit test — no demo tenant has both a dunning policy and bills; ◐ no dated history, so "was it overdue on the 14th" cannot be asked) |
| Work the revenue lifecycle on one desk | house console IA over TMF678/674 + `/revenue/v1` | `admin-console` islands + `billing` + `revenue` | ✅ `billing_ia_test`, `bills_desk_test`, `billing_overview_test`, `accounting_configuration_test` (six role-gated destinations in lifecycle order; bills as the operational centre with one workspace per bill; counts are the service's judged totals, never a page wearing the book's clothes; live chart-of-accounts changes pass draft→validate→approve→activate; ❌ no four-eyes rule, and the finance roles are still one role) |
| Collect & safeguard payments | TMF676/670 | `payment` + `payment-method` | ✅ (◐ PSP: mock default, Stripe adapter shaped — certify per deployment) |
| Collect overdue debt lawfully (statutory dunning ladder) | collection case + policy over a country statutory pack | `billing` + SOM restrict/suspend | ✅ `collections_test` (remind→warn→restrict→suspend→cure; the statutory pack refuses an undercutting tenant policy — fee gate, fee cap, reminder cap, notice clock, actionable floor; MRC stops during nonpayment suspension; emergency calls stay reachable under restriction; promise-to-pay / dispute / hardship holds; ❌ external collections-agency handoff) |
| Finance devices & run trade-in / upgrade programs | house `/tmf-api/deviceCommerce/v1` (TMF-styled; no TMF device-financing API exists) | `device-commerce` + `revenue` | ✅ `device_commerce_test` (operator-book / third-party-loan / BNPL behind one financing port; IMEI trade-in with grading deltas; 14-day withdrawal from parcel delivery; IFRS 15 subsidy subledger — contract asset, unwind, ETF recovery, residual-value guarantee; ◐ billing-driven instalment ticks are a follow-up) |
| Migrate & sunset the installed base | house `/tmf-api/baseMigration/v1` → TMF622 `modify` per subscriber | `base-migration` | ✅ `base_migration_test` (arm gated on an attached price simulation; statutory 30-day notice enforced as a gate; penalty-free exit on detrimental change, in-binding included; age/promo triggers; snapshot rollback; circuit breaker) |
| Enforce spend & usage policy (pools, caps, the roaming wall) | TMF635/677 meters + policy resources | `usage` | ✅ `usage_policy_test` (household pools reserve-then-commit; content-services cap with free barring above the statutory floor + minor barring; ≈€50 roaming limit with 80/100% cut-off + audited continue; opt-in auto top-up; travel passes as zone-boosts; ◐ RLAH fair-use monitor is a follow-up; zero-rating deliberately absent in the EEA) |
| Distribute bills over national rails & direct debit | bill-distributor channel chain + mandate/claim/OCR loop | `billing` + rail adapters (mocks in dev) | ✅ `norway_rails_test` (e-invoice alias → digital mailbox → print, channel recorded per send; OCR settlement closes bills through the remittance door; real rails are per-tenant config behind the same port) |
| Charge in real time (prepay balance) | TMF654 facade + OCS seam (per-tenant adapter registry) | `usage` + `service-orchestration` + **SigScale OCS** (bundled, `integrations/sigscale-ocs`) / mock-ocs | ✅ #123 `sigscale_ocs_test` — a REAL open-source 3GPP OCS behind the seam: rate plans live in the OCS as TMF620 offerings, activation provisions TMF637 product + TMF638 service (MSISDN identity) over its TM Forum APIs, a real Diameter Gy credit-control session debits the balance, TMF654 projects + tops up (CTK-certified 282/282), the OCS's own balance hub fires the running-low journey, plan change / hold / isolation; ◐ 5G Nchf/CHF waits for a production-grade CHF (see `docs/ocs-seam.md`) |
| Calculate jurisdictional taxes | — | — | ❌ prices are tax-inclusive by convention; jurisdictional tax (VAT/US telecom tax) needs Vertex/Avalara-class |
| Account revenue (GL, rev-rec ASC 606) | subledger journal export (house `/revenue/v1`) | `revenue` (#35) | ✅ #70 the FEED (balanced double-entry journal from billing/payment events, CoA mapping as data, tax split, dispute credits, priced loyalty liability, period close, SAP/NetSuite-shaped CSV, cent-exact reconciliation tie-out); ❌ the LEDGER itself + the rev-rec engine stay in the ERP — by design |
| Settle wholesale / interconnect / roaming | — | — | ❌ carrier-grade settlement is its own product |
| Fight acquisition fraud (party/order risk) | TMF696 Risk Management | `intelligence` risk engine | ✅ #82 (transparent additive score from real signals — unpaid bills, credit notes, velocity, tenure, verified session; threshold enforced as a policy rule, reversibly) — plus a country-keyed **credit-decision port** at checkout: a bureau freeze answers as its own state so the shop offers prepaid; only the decision is stored, never the report (`norway_rails_test`) |
| Assure revenue (usage reconciliation, leakage) | — | — | ❌ specialist tooling (the audit trails feed one nicely) |

## 5. Service & Resource (the thin OSS)

| Business capability | TMF tech capability | Component | Status |
|---|---|---|---|
| Fulfil & activate services | TMF641/640/638 | `service-orchestration` | ✅ thin: mock activation, real state machine |
| Orchestrate & EXPLAIN order processes | TMF701 Process Flow Management | `process` (#36) | ✅ #72 (design intent as data, flows projected from the event stream with their cross-system timeline, STUCK is a state on the bus, operator recovery lever; and failures feed an agent whose MEMORY COMPOUNDS: governed L0 diagnosis to a ticket note, episodic traces w/ mandatory verdicts, runbooks promoted on N recurrences + human approval — the fourth identical failure auto-diagnosed from memory with ZERO model calls, revocation proven as the brake) |
| Manage numbers & SIMs | TMF685 + TMF639 facade + SIM/OTA seams | SOM | ✅ (◐ real HLR/HSS/OTA behind seams; #76: pools + issued ledger honestly faced) |
| Tell the phone what it may use (device entitlements: VoLTE / VoWiFi / SMSoIP / data plan / eSIM ODSA) | GSMA TS.43 Entitlement Configuration Server (`/ts43`, EAP-AKA over HTTP against the AUC seam) + house `/tmf-api/deviceEntitlement/v1` | `device-entitlement` + `service-orchestration` (+ `mock-hss`, `mock-ts43-device` in dev) | ✅ #124 `device_entitlement_test` (15 legs) — the plan's spec decides (VoLTE/VoNR, Wi-Fi calling, SMSoIP, data plan, carrier billing, satellite, private Wi-Fi identity, phone number; RCS on the BSS face), the SIM proves itself (RFC 4187 EAP-AKA, forged answers refused, relay sessions in the database), token reuse, JSON and TS.43 XML, the VoWiFi service flow, companion eSIM activation with an SGP.22 code, the orchestrator binds lines on activation and follows plan changes and SIM swaps, a primary eSIM transfer is granted AND completed by the orchestrator, server-initiated refresh reaches the phone through communication (push/SMS), OIDC sign-in for clients without a SIM, per-tenant AUC, **eSIM profiles ordered from the SM-DP+ over SGP.22 ES2+** (matching id in the activation code, download notifications back), **RCS auto-configuration door (RCC.14, RCC.07 XML)**, console page, tenant isolation; ◐ OEM certification (Apple/Google) is the operator's calendar; hosted RCS (Jibe/Apple) needs the partner contract; see `docs/entitlement-seam.md` |
| Describe the business to people, applications and agents, and gate agent writes through governed actions | Operational ontology (SID/ODA/TMF lineage) + MCP + generated SDK | `ontology` | ✅ #125 `ontology_test` — registry conformance against gateway routes, event sources, realm roles and runtime self-description of the six journey components; ten governed actions (line, order, bill, launch) with receipts, the approval ladder on credits, the outcome sweep, learning contracts on ontology decision points, context resolver, RDF export, MCP, generated SDK and the CSR desk on it; ◐ contracts do not yet gate execution, six components self-describe by source only |
| Port numbers in & out (MNP) | clearinghouse seam | `porting` | ✅ (◐ NRDB shaped, not connected) |
| Detect & resolve service problems | TMF642/656 + TMF653 tests + TMF724 incidents | `assurance` + `service-orchestration` + `intelligence` | ✅ (thin; real FM/PM needs the NMS; #76: diagnose as serviceTest with history, agent memory as standard incidents) |
| Qualify serviceability (commercial) | TMF679 | `qualification` | ✅ |
| Qualify service delivery (technical: technology, bandwidth, alternative) | TMF645 Service Qualification | `qualification` coverage map | ✅ #79/#80 (never a bare no — the best available technology proposed on refusal; ordering gates every placed item at create; the cart names technology + speed) |
| Schedule installations | TMF646 | `appointment` | ✅ per-tenant calendar (timezone, working days, windows, horizon) + technician roster from which window capacity is DERIVED (`scheduleConfig`, `technician`, console Installers pane) + the FIELD-SERVICE SEAM: `provider: tmf646` delegates search/book/cancel to the operator's Workforce Management (TMFC046) over TMF646, dev stand-in `mock-fsm` (❌ vendor-native adapters, slot holds, dispatch/routing — see docs/field-service-seam.md) |
| Customer premises equipment (router/ONT state, restart) | service-orchestration → ACS seam (`CPE_BASE_URL`; mock-acs) | ✅ #129 `cpe_test` — [equipment seam](equipment-seam.md) |
| Ship & install what was sold | TMF700 Shipping Order + TMF697 Work Order | `fulfilment` (#37) | ✅ #73 (parcel + visit as resources, warehouse/installer API, machine completion when both gates pass, milestones on the process timeline; customers track deliveries) |
| Network inventory (physical/logical), mediation (CDR pipelines) | — | — | ❌ real OSS estate — or wrap it (suite #67 pattern) |

## 6. Partner & Enterprise

| Business capability | TMF tech capability | Component | Status |
|---|---|---|---|
| Manage channel partners & their compensation | dealer API | SOM | ✅ |
| Manage customer agreements & commitments | TMF651 | `agreement` | ✅ |
| Honor service-level promises (SLA → credit) | TMF623 SLA Management | `assurance` + `billing` | ✅ #74 (SLA terms as agreement DATA; late-resolved problems mint violations on a capped ledger; billing compensates with the PRE-AGREED credit note — no human decides at breach time) |
| Quote complex B2B deals | TMF648 | `quote` | ✅ (◐ full CPQ: approvals, versioned proposals, e-sign — no) |
| Operate multiple brands / tenants (MVNE) | tenant registry + realm mint | fleet-wide | ✅ #49 |
| Bundle partner services (VAS) | entitlement seam | SOM | ✅ (◐ settlement/rev-share no) |
| Type partnerships & their permitted roles (onboarding) | TMF668 Partnership Type | `agreement` | ✅ #83 (kinds as data; typed partnerships validated at signature) |
| Name & reuse customer/org sites (the address book) | TMF674 Geographic Site | `geographic-address` | ✅ #84 (site = name + owner + lifecycle + stored TMF673 address, embedded; reused on orders end to end) |
| HR / workforce mgmt (human), ERP, procurement | — | — | ❌ enterprise systems |
| BI / data warehouse | — | `insight` events help | ◐ insight is a CDP-ish spine, not a DWH |

## 7. Cross-cutting (the differentiators)

| Capability | Where | Status |
|---|---|---|
| AI control plane (meter/budget/kill-switch/audit) | `intelligence` | ✅ #59 |
| Govern AI at scale, standards-addressable (TMF915: model contracts, per-scenario brake, ai:admin) | `intelligence` /tmf-api/aiManagement | ✅ #81 (models the ledger proves; contracts with real metrics incl. every refusal class; suspend one scenario without stopping the fleet) |
| Agentic surfaces: GEO / ACP / MCP / workforce / closed loop | gateway + catalog + cart + intelligence + packages | ✅ #64–66, #68 |
| Legacy overlay (wrap an existing BSS) | 3 per-tenant seams | ✅ #67 |
| Event backbone + observability (Live Flow) | Kafka outbox + `flow` | ✅ |
| Let partners SUBSCRIBE to the event stream | TMF688 Event Management | `event-hub` (#38) | ✅ #75 (callback + filter, tenant-walled, delivery ledger w/ backoff retries + dead-letter that keeps its error) |
| Hardening: tick locks, resumable billing, backups, GDPR, PQC-ready | fleet | ✅ #56–58 |
| Sign-in that follows NIST SP 800-63B (length, common-password list, temporary hand-overs, lockout, account mail) | Keycloak realms from `infra/keycloak/security/` + `user-roles` | ✅ `password_policy_test` (the hosted box's login rotation and Microsoft 365 mail are built and proven at the box's next deploy; staff second factor is the next arc) — [docs/password-security.md](password-security.md) |

## The honest summary for a buying CSP

**Complete here**: digital BSS core (catalog→order→activate→bill→cash),
six channels, martech, personalization, the full agentic layer, and
multi-tenant operation — proven by 76 suites and 13 CTKs.

**Bring (or keep) from elsewhere**: a production OCS for real-time
charging, a taxation engine, ERP/GL and rev-rec (now FED by the #70 journal-export seam), wholesale/roaming
settlement, fraud/revenue assurance, full field-service
management, SMS/push gateways, real OSS inventory + mediation, and the
enterprise estate (HR, procurement, BI warehouse). Every one of these
sits behind an existing seam or the overlay pattern (suite #67): the
list is an integration plan, not a wall.

## Market adaptations (per tenant, never per fork)

| Market need | How the platform answers | Reference |
|---|---|---|
| Whole-dollar currency, statutory price note, country-specific address form, national porting | tenants.yml `country`, `price-decimals`, `currency-display`, `price-note`; storefront `COUNTRY_FORMS`; porting `PortingRules` + `CountryPortingRouter` (tenant `porting-gateway` first, then country, then fallback) | docs/markets/guyana.md |
| Mobile-money wallet where cards are rare | Named PSP adapter (`mmg`) + `mock-mmg`; money never rides a generic connector | docs/markets/guyana.md |
| Store collection as the delivery rail | http carrier seam with the operator's stores as pickup points (`mock-logistics /pickup-points`) | docs/markets/guyana.md |
| SIM registration to a government ID | tenants.yml `sim-registration: required` → checkout captures ID type + number as mobile-line characteristics | docs/markets/guyana.md |
| WhatsApp as the service channel | communication `whatsapp` channel (Meta Cloud API shape), per-tenant `whatsapp-url` / `whatsapp-phone-id` / `whatsapp-token-ref`, `mock-whatsapp` | docs/markets/guyana.md |
| Per-price VAT (zero-rated categories beside standard-rated ones) | TMF620 `productOfferingPrice.tax` → TMF678 `appliedTax` on bill lines → per-line ledger posting; tenant `tax` mapping stays the default | docs/markets/guyana.md |
| Delivery tiers by region (coast vs hinterland) | carrier config `etaByPrefix` / `etaDefault`, surfaced on every delivery option and in the cart | docs/markets/guyana.md |
| Shop window (promo banners, coverage check, front-door footer) | TMF667 documents in category `banner` with caption + destination (public `GET /document/banners`), storefront banner strip + `/?tab=` deep links; live TMF645 coverage check on the home page; footer from tenant `support-phone` / `support-whatsapp` / `support-email` / `app-store-url` / `play-store-url` / `privacy-url` / `terms-url`; statutory `price-note` beside prices, not in the hero | docs/markets/guyana.md |
| Network slicing as a product (5G SA): priority tier, add-on, time-boxed boost pass | Catalog spec characteristics `sliceProfile` + `boostHours`; SOM `SliceProvisioningClient` seam (PCF/NSSF or vendor slice manager — `mock-5gc` in dev, `SLICE_BASE_URL`), applied on activation (tier) or on a Top-ups order (pass), idempotent, expiry sweep releases; TMF638 service carries `sliceProfile`/`sliceUntil`; `ServiceSliceChangeEvent`; storefront ⚡ Priority badge; slice-aware charging (`sliceChargingSpecId` → OCS plan swap + "Priority data" uplift line via `/internal/ocs/priorityUsage`); measured guarantee (`guaranteedDlMbps` → core KPI sweep → TMF656 problem → SLA credit); device eligibility (`DeviceDetectedEvent` → refuse on non-SA handsets) | docs/network-slice-offer.md |
- **Desk learning** — the desks report what staff do (never what they see); friction report + suggestions with one-click fixes (presets, holdouts) and an anonymised export for the product team. `docs/desk-learning.md`, suite #116.
- **Journey auto-tuning** — A/B arms on a journey message behind the holdout; a tuner shifts traffic to the winner only on evidence (z-threshold, floor per arm) and writes every judgement to a ledger. `docs/journey-auto-tuning.md`, suite #117.
- **Channel availability** — TMF620 `ProductOffering.channel[]` over a registered channel list (web, app, store, telesales, care, business, partner, AI agents via ACP/MCP/A2A); every front end and agent surface names its channel (`X-Channel`), the catalog enforces sellability per channel server-side, ordering forwards the header and refuses what the channel cannot see; an empty list means everywhere. Suite #118.
- **Launch governance (intent to launch)** — per tenant `launch-governance: none|envelope|always`: pre-approved ENVELOPES (TMF723 allow rules authored with pickers, read back in plain words, live dry-run) let routine offers launch by themselves and ledger the envelope; everything else waits in the Approvals desk (`catalog:approve`), with readiness ticks per owner, hold/resume after approval, substance edits voiding approval, approval expiry, unlaunch, and a TMF701 mirror flow. The TMF620 resource stays standard. AI proposals carry launch window, channels and zero-rated apps and get the same verdict. `docs/launch-governance.md`, suite #119.
- **Contextual help** — a "?" on every console tab, desk page and shop page opens the knowledge shelf tagged for that screen (`pane:*`, `csr:*`, `shop:*`); the audience gate from the token keeps a customer from ever reading a product how-to; search first, then a cached grounded Ask (staff only, FAST tier, invalidated when an article changes); unanswered questions land in a per-tenant gap list with a "Write it" prefill. `docs/contextual-help.md`, suite #120.
- **Decision log + DecisionPoint seam** — every adaptive choice (holdout/arm at enrolment, campaign treatment, next-best-action, tuner judgement, advisor proposal, desk suggestion) goes through one seam — constraints first, a named and versioned policy, a fallback — and lands in insight's decision log with context, eligible actions, chosen action, propensity and, joined by id, the outcome that followed; receipts in plain sentences, a per-point summary, a policy registry. `docs/decision-log.md`, suite #121.
- **Learning contracts + decision desk** — intent per decision point as tenant configuration (objective, guardrails, allowed actions, exploration cap, autonomy, fallback, pause) that the seam applies on every decision and every receipt cites by version, with a dry run; console pages AI & Automation › Decisions (log + receipt) and › Learning contracts (editor + dry run). Suite #122.
| Configuration oracle | TMF760 `queryProductConfiguration` / `checkProductConfiguration` on the catalog: choices, ranges, stock per variant, relationships, prices with windows and algorithms, verdict and price per quantity; every channel and billing ask it | product-catalog | #131 |