# Update

**Test family:** `UPD`

- **UPD-001** Change each editable field independently and a meaningful combination.
- **UPD-002** Submit no-op update; define timestamps, audit, notifications, and automations.
- **UPD-003** Partial update does not null omitted fields; explicit null follows contract.
- **UPD-004** Two clients update same/different fields from same version; surface or merge conflict intentionally.
- **UPD-005** Failure after an optimistic UI change rolls back truthfully and preserves retry data.
- **UPD-006** Unauthorized/read-only/terminal-state updates fail on server and do not leak current data.

## Comprehensive per-item coverage

- **UPD-007** Exercise the action with the smallest valid target, an ordinary target, a boundary-size target, and a target whose display text contains emoticons, emoji, RTL, and combining characters.
- **UPD-008** Attempt the action with missing, stale, deleted, archived, locked, invalid, and partially loaded targets; fail specifically without changing adjacent data.
- **UPD-009** Invoke through every exposed surface—detail, list, bulk, keyboard shortcut, API, import, automation, and mobile—using one authoritative business rule.
- **UPD-010** Verify hidden and disabled presentation matches server authorization; direct requests by an unauthorized role or tenant must still fail.
- **UPD-011** Change role, ownership, policy, or target state between rendering and commit; reauthorize and revalidate at the final write.
- **UPD-012** Single-click, double-click, press Enter repeatedly, resend the request, and retry after timeout; create exactly one intended effect.
- **UPD-013** Race two users performing compatible and conflicting actions; define ordering, conflict reporting, and final state.
- **UPD-014** Interrupt before confirmation, during request, after commit but before response, and during downstream work; distinguish canceled, unknown, failed, and complete states.
- **UPD-015** Force validation, dependency, quota, network, and downstream notification failures; preserve atomicity or expose compensating recovery.
- **UPD-016** Verify confirmation text names the exact target and consequence, safely rendering quotes, markup canaries, emoticons, and long values.
- **UPD-017** Use keyboard, screen reader, switch, touch, and zoom/reflow; expose role, name, disabled/pending state, errors, and returned focus.
- **UPD-018** Translate and lengthen action labels and errors; preserve verb meaning, target identity, shortcuts, and layout in RTL locales.
- **UPD-019** Measure latency at normal and supported bulk sizes; show progress, permit safe cancellation, and avoid blocking unrelated work.
- **UPD-020** Check rate limits, quotas, and abuse controls at the UI and API boundary without turning retries into duplicate work.
- **UPD-021** Verify related counts, caches, search indexes, feeds, summaries, and denormalized records converge after the action.
- **UPD-022** Verify notifications and integrations identify the correct actor, target, tenant, old/new state, and do not leak hidden fields.
- **UPD-023** Record one tamper-resistant audit trail with actor, authority, target, time, request/correlation ID, outcome, and reason—without secrets.
- **UPD-024** Repeat from an old client, stale browser tab, expired session, and replayed signed request; reject obsolete or replayed intent safely.
- **UPD-025** Exercise rollback, undo, restore, or compensating action where promised; preserve dependent data and history.
- **UPD-026** Monitor success, failure, latency, retries, deduplication, stuck jobs, and compensation so silent partial completion is detectable.

[Back to Actions and lifecycle transitions index](../../actions-lifecycle.md)
