Preservation is checked against a declared change allowlist. A file that opens is not proof of it.
For the bounded XLSX workflow, each write names one workbook artifact, worksheet and single-cell A1 reference. Runstamp checks protected values, formulas, cached results, comments and styles after reopening the output. A write with no observable change fails intended-change verification.
Profiles must say how to handle objects the engine keeps but cannot interpret: macros, embedded files, drawings, external links and app-specific package parts. Keeping opaque bytes can be valid. It must be reported, and a stricter policy may reject it.
Use preservation-only checks for a round trip with no edit. Use mutation verification when a change was requested. An allowlist alone does not prove the change happened.