1Auth check
2Snapshot check — BLOCKS if no fresh snapshot today (D119)
3Trash lifecycle — processes files in trash/ per retention rules
4Roster compliance — all systems against roster (D110)
5Protected paths guard — confirms required paths exist (D118)
6Results returned