# Create

**Test family:** `CRT`

- **CRT-001** Create from minimal valid, full valid, duplicated submit, stale form, direct request, and concurrent same-identity attempts.
- **CRT-002** Defaults are server-authoritative, visible, role/tenant appropriate, and stable across UI/API/import.
- **CRT-003** Validation failure creates no partial object or external side effect unless explicitly modeled as draft.
- **CRT-004** Success returns/opens the exact created identity and persists after refresh/new session.
- **CRT-005** Cancel/back/close handles unsaved state and cleans temporary uploads/reservations.

## Comprehensive per-item coverage

- **CRT-006** Exercise the action with the smallest valid target, an ordinary target, a boundary-size target, and a target whose display text contains emoticons, emoji, RTL, and combining characters.
- **CRT-007** Attempt the action with missing, stale, deleted, archived, locked, invalid, and partially loaded targets; fail specifically without changing adjacent data.
- **CRT-008** Invoke through every exposed surface—detail, list, bulk, keyboard shortcut, API, import, automation, and mobile—using one authoritative business rule.
- **CRT-009** Verify hidden and disabled presentation matches server authorization; direct requests by an unauthorized role or tenant must still fail.
- **CRT-010** Change role, ownership, policy, or target state between rendering and commit; reauthorize and revalidate at the final write.
- **CRT-011** Single-click, double-click, press Enter repeatedly, resend the request, and retry after timeout; create exactly one intended effect.
- **CRT-012** Race two users performing compatible and conflicting actions; define ordering, conflict reporting, and final state.
- **CRT-013** Interrupt before confirmation, during request, after commit but before response, and during downstream work; distinguish canceled, unknown, failed, and complete states.
- **CRT-014** Force validation, dependency, quota, network, and downstream notification failures; preserve atomicity or expose compensating recovery.
- **CRT-015** Verify confirmation text names the exact target and consequence, safely rendering quotes, markup canaries, emoticons, and long values.
- **CRT-016** Use keyboard, screen reader, switch, touch, and zoom/reflow; expose role, name, disabled/pending state, errors, and returned focus.
- **CRT-017** Translate and lengthen action labels and errors; preserve verb meaning, target identity, shortcuts, and layout in RTL locales.
- **CRT-018** Measure latency at normal and supported bulk sizes; show progress, permit safe cancellation, and avoid blocking unrelated work.
- **CRT-019** Check rate limits, quotas, and abuse controls at the UI and API boundary without turning retries into duplicate work.
- **CRT-020** Verify related counts, caches, search indexes, feeds, summaries, and denormalized records converge after the action.
- **CRT-021** Verify notifications and integrations identify the correct actor, target, tenant, old/new state, and do not leak hidden fields.
- **CRT-022** Record one tamper-resistant audit trail with actor, authority, target, time, request/correlation ID, outcome, and reason—without secrets.
- **CRT-023** Repeat from an old client, stale browser tab, expired session, and replayed signed request; reject obsolete or replayed intent safely.
- **CRT-024** Exercise rollback, undo, restore, or compensating action where promised; preserve dependent data and history.
- **CRT-025** Monitor success, failure, latency, retries, deduplication, stuck jobs, and compensation so silent partial completion is detectable.

[Back to Actions and lifecycle transitions index](../../actions-lifecycle.md)
