| Matrix slice | Visible baseline | What supports the conclusion |
|---|---|---|
| `post_created` | 201; Location `/orders/2`; one write | Created body and final rows agree |
| `post_unauthenticated` | 401; Bearer challenge; zero writes | Rejection precedes binding and handler |
| `post_invalid` | 422; typed safe problem; zero writes | Domain rule and response agree |
| `post_replay` / `post_concurrent` | 201 twice; one write | Same returned order; shared effect count |
| `authorization_removed` | Candidate POST policy absent | Prior captures and OpenAPI no longer bind the candidate |