--- id: ATS-PFM-NOT-006 scope: CAP-PFM-NOT-006 product_area: platform module: notifications revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-NOT-006-01 title: Cancel before processing and permit later publication level: api proves: - BR-CAP-PFM-NOT-006-01 preconditions: Prepare a publish held by a not-before time. steps: >- Cancel it by its key; by its supersede key with the publish arriving after; next publish a second time after the cancel. expected: >- The matched pending request becomes cancelled without notices; a later publication is delivered. negative: true data_needs: Use only records created and owned by this suite. bound_to: - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#leaves nobody told and records the request cancelled when the cancel names the publish’s key - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#leaves nobody told when the cancel names only the supersede key, even when the publish arrives after it - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#does not cancel a publish submitted after the cancel - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#records the cancel of a request that has no record as a cancelled request under the publish’s id - >- react-console:acceptance/notifications/playwright/journeys/pipeline/NT-ACC-0208.spec.ts#NT-ACC-0208 - >- react-console:acceptance/notifications/playwright/journeys/inbox/NT-ACC-0005.spec.ts#NT-ACC-0005 - TST-PFM-NOT-009 - TST-PFM-NOT-019 - TST-PFM-NOT-077 provenance: test source: >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#leaves nobody told and records the request cancelled when the cancel names the publish’s key category: transition binding_scope: >- Each binding supplies its own assertions; the aggregate references do not imply that one executable file proves every step. - id: ATS-PFM-NOT-006-02 title: Supersede delivered items without erasing them level: api proves: - BR-CAP-PFM-NOT-006-02 preconditions: Jane's inbox contains a delivered assignment item that remains unread. steps: >- End the source assignment, process its cancellation twice and attempt cancellation of an already-settled request. expected: >- The item remains readable but inapplicable and excluded from unread totals. Repeated cancellation and settled-request cancellation leave state unchanged. negative: false data_needs: Use only records created and owned by this suite. bound_to: - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#marks the instance superseded, leaves it readable and takes it out of the unread count - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#finds the request by the supersede key alone - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#does nothing the second time the cancel is processed - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#leaves a request that had settled as it was - >- react-console:acceptance/notifications/playwright/journeys/inbox/NT-ACC-0004.spec.ts#NT-ACC-0004 - TST-PFM-NOT-008 - TST-PFM-NOT-077 provenance: test source: >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#marks the instance superseded, leaves it readable and takes it out of the unread count category: transition binding_scope: >- Each binding supplies its own assertions; the aggregate references do not imply that one executable file proves every step. - id: ATS-PFM-NOT-006-03 title: Stop pending delivery without recalling completed sends level: api proves: - BR-CAP-PFM-NOT-006-03 preconditions: Prepare a notice with one delivery queued and one already sent. steps: Submit a withdrawal for the originating request. expected: >- Waiting delivery work is cancelled, sent delivery remains sent and the notice becomes superseded. negative: false data_needs: Use only records created and owned by this suite. bound_to: - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#cancels the queued delivery and its work row, and does not recall one that already left - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#leaves a delivery that already left, superseding the instance all the same - >- services-platform:modules/notifications/tests/integration/services/persistence/deliveries.integration.spec.js#refuses a sent delivery being cancelled: what left is not recalled - TST-PFM-NOT-077 - TST-PFM-NOT-085 provenance: test source: >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#cancels the queued delivery and its work row, and does not recall one that already left category: interaction binding_scope: >- Each binding supplies its own assertions; the aggregate references do not imply that one executable file proves every step. - id: ATS-PFM-NOT-006-04 title: Replace only eligible earlier occurrences level: api proves: - BR-CAP-PFM-NOT-006-04 preconditions: Prepare a open request of an occurrence-superseding definition. steps: >- Publish a later request with the identical supersede key; repeat for a non-superseding definition; repeat with a rejected later request. expected: >- Only the valid later request with replacement enabled supersedes the earlier request. negative: false data_needs: Use only records created and owned by this suite. bound_to: - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#supersedes the earlier request of a definition whose scope is the occurrence, and tells the person the new one - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#leaves the earlier request alone when the definition does not supersede by occurrence - >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#does not supersede the earlier request when the later one is itself refused - TST-PFM-NOT-077 provenance: test source: >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#supersedes the earlier request of a definition whose scope is the occurrence, and tells the person the new one category: transition binding_scope: >- Each binding supplies its own assertions; the aggregate references do not imply that one executable file proves every step. - id: ATS-PFM-NOT-006-05 title: Record stale requests as expired level: api proves: - BR-CAP-PFM-NOT-006-05 preconditions: >- Prepare a request with a past expiry; one older than its definition's window. steps: Process the two expiry fixtures. expected: >- Both expired requests are retained with expiry outcomes and produce no notices. negative: true data_needs: Use only records created and owned by this suite. bound_to: - >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#expires a request published after its expiry - >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#expires a request older than its definition’s expires_after from the instant the producer wrote it - TST-PFM-NOT-079 provenance: test source: >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#expires a request published after its expiry category: boundary binding_scope: >- Each binding supplies its own assertions; the aggregate references do not imply that one executable file proves every step. - id: ATS-PFM-NOT-006-06 title: Wait until the not-before instant level: api proves: - BR-CAP-PFM-NOT-006-06 preconditions: Prepare a request with a not-before two minutes ahead. steps: Process it now; next once due. expected: >- Before due time, processing stores no request result and returns the work; once due, it processes normally. negative: false data_needs: Use only records created and owned by this suite. bound_to: - >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#gives back a request that is not due yet, writing nothing, never processing it early - >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#processes a request whose time has come - >- services-platform:modules/notifications/tests/integration/services/dispatch/process-request-batch.integration.spec.js#gives back a request that is not due with its visibility extended to the moment it is due - TST-PFM-NOT-076 - TST-PFM-NOT-079 provenance: test source: >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#gives back a request that is not due yet, writing nothing, never processing it early category: boundary binding_scope: >- Each binding supplies its own assertions; the aggregate references do not imply that one executable file proves every step. - id: ATS-PFM-NOT-006-07 title: Settle expired requests after pending work ends level: api proves: - BR-CAP-PFM-NOT-006-07 preconditions: >- Use open requests on both sides of expiry, including a request with delivery still pending. steps: Execute scheduled nightly reconciliation for the workspace. expected: >- Expired eligible requests settle and unsent deliveries expire; the still-open request remains open. negative: false data_needs: Use only records created and owned by this suite. bound_to: - >- services-platform:modules/notifications/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#expires the unsent delivery of a request past its expiry, the notification with it, and settles the request - >- services-platform:modules/notifications/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#keeps the notification’s status when another channel had already left - >- services-platform:modules/notifications/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#settles a request past its expiry whose notification was delivered, so a late cancel reaches nothing - >- services-platform:modules/notifications/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#leaves an open request that has not reached its expiry - TST-PFM-NOT-100 provenance: test source: >- services-platform:modules/notifications/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#expires the unsent delivery of a request past its expiry, the notification with it, and settles the request category: transition binding_scope: >- Each binding supplies its own assertions; the aggregate references do not imply that one executable file proves every step. - id: ATS-PFM-NOT-006-08 title: Recheck queued work before sending level: api proves: - BR-CAP-PFM-NOT-006-08 preconditions: Prepare a queued chat delivery. steps: 'Supersede its notice, next deliver; expire its request, next deliver.' expected: >- Superseded work is cancelled and stale work expires, with no provider send. negative: true data_needs: Use only records created and owned by this suite. bound_to: - >- services-platform:modules/notifications/tests/integration/services/dispatch/deliver-delivery.integration.spec.js#cancels, not sends, a delivery whose notification was superseded after it was queued - >- services-platform:modules/notifications/tests/integration/services/dispatch/deliver-delivery.integration.spec.js#expires, not sends, a delivery whose request has passed its expiry - >- services-platform:modules/notifications/tests/integration/services/dispatch/deliver-delivery.integration.spec.js#is not sent after a cancel took the delivery out of the queue - TST-PFM-NOT-074 provenance: test source: >- services-platform:modules/notifications/tests/integration/services/dispatch/deliver-delivery.integration.spec.js#cancels, not sends, a delivery whose notification was superseded after it was queued category: edge binding_scope: >- Each binding supplies its own assertions; the aggregate references do not imply that one executable file proves every step. - id: ATS-PFM-NOT-006-09 title: Withdraw items before and after console delivery level: api proves: - AS-JNY-PFM-NOT-002-01 - AS-JNY-PFM-NOT-002-02 preconditions: >- Use Jane's clerk account in a nonproduction environment with the suite's delay header enabled. steps: Exercise the acceptance workflow end to end. expected: >- The delivered item remains inapplicable and uncounted; the undispatched item never appears and its request records cancellation. negative: false data_needs: The journey's own personas and Northeast unit. bound_to: - >- react-console:acceptance/notifications/playwright/journeys/inbox/NT-ACC-0004.spec.ts#NT-ACC-0004 - >- react-console:acceptance/notifications/playwright/journeys/inbox/NT-ACC-0005.spec.ts#NT-ACC-0005 - >- react-console:acceptance/notifications/playwright/journeys/pipeline/NT-ACC-0208.spec.ts#NT-ACC-0208 - TST-PFM-NOT-008 - TST-PFM-NOT-009 - TST-PFM-NOT-019 provenance: test source: >- react-console:acceptance/notifications/playwright/journeys/inbox/NT-ACC-0004.spec.ts#NT-ACC-0004 category: interaction binding_scope: >- Each binding supplies its own assertions; the aggregate references do not imply that one executable file proves every step. - id: ATS-PFM-NOT-006-10 title: Withdrawal closes pending delivery while preserving remaining history category: interaction level: api proves: - BR-CAP-PFM-NOT-006-03 exercises: - CAP-PFM-NOT-006 - CAP-PFM-NOT-005 - CAP-PFM-NOT-008 - CAP-PFM-NOT-014 preconditions: >- Prepare a folded console item, one queued external delivery and an explicit assignment with a delayed notice. steps: >- Withdraw one folded contributor, end the delayed assignment, run delivery and reconciliation, then inspect the remaining items. expected: >- The surviving contributor keeps its notice. Withdrawn external work does not send, the delayed assignment notice never appears, and reconciled requests cannot be withdrawn again. negative: false data_needs: >- A suite-owned workspace, named staff accounts and unique occurrence keys; external adapters record attempts without shared writes. bound_to: [] provenance: proposed source: - >- rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-006-withdraw-or-expire-a-notice-that-no-longer-applies.md#frontmatter - >- rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-005-fold-quick-repeats-into-one-notice.md#frontmatter - >- rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-008-keep-notifications-whole-when-part-of-the-pipeline-fails.md#frontmatter - >- rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-014-tell-staff-about-changes-to-their-own-responsibilities.md#frontmatter interaction_with: - CAP-PFM-NOT-005 - CAP-PFM-NOT-008 - CAP-PFM-NOT-014 evidence: - >- Pinned evidence inventory 1: services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js; react-console:acceptance/notifications/playwright/journeys/inbox/NT-ACC-0005.spec.ts; services-platform:modules/notifications/tests/integration/services/persistence/deliveries.integration.spec.js; services-platform:modules/notifications/tests/integration/services/dispatch/process-request-batch.integration.spec.js; services-platform:modules/notifications/tests/integration/services/dispatch/deliver-delivery.integration.spec.js - >- Pinned evidence inventory 2: react-console:acceptance/notifications/playwright/journeys/pipeline/NT-ACC-0208.spec.ts; react-console:acceptance/notifications/playwright/journeys/inbox/NT-ACC-0004.spec.ts; services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js; services-platform:modules/notifications/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js coverage: rule: 'gap: FND-PFM-NOT-067' transition: 'gap: FND-PFM-NOT-067' validation: 'gap: FND-PFM-NOT-067' permission: not-applicable edge: covered failure: 'gap: FND-PFM-NOT-067' boundary: covered concurrency: 'gap: FND-PFM-NOT-067' invariant: 'gap: FND-PFM-NOT-067' interaction: covered coverage_notes: permission: >- This capability declares no independent access key; callers enter through the producing or reading capability. rule: >- The specification does not isolate a general positive outcome outside the narrower category cases. validation: Malformed input is not isolated in a dedicated category scenario. failure: The suite lacks an isolated dependency failure and recovery case. concurrency: >- The suite lacks a complete race case with controlled interleaving and post-race assertions. invariant: >- The suite does not isolate every persistent guarantee in a dedicated category scenario. transition: >- The lifecycle matrix records every transition as requiring independent verification of its guard and effects; existing scenarios remain useful candidates. findings: - FND-PFM-NOT-067 transition_coverage: - state_model: STATE-PFM-NOT-002 transition_index: 1 from: queued to: open trigger: The processor accepts queued work. source: >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#writes the console delivery delivered at once and records every other supported channel as not available until its milestone existing_candidates: - ATS-PFM-NOT-006-01 - ATS-PFM-NOT-006-02 - ATS-PFM-NOT-006-04 - ATS-PFM-NOT-006-07 decision: 'gap: independent guard and side-effect proof has not been verified' - state_model: STATE-PFM-NOT-002 transition_index: 2 from: queued to: queued trigger: The processor encounters work scheduled for later. source: >- services-platform:modules/notifications/tests/integration/services/dispatch/process-request-batch.integration.spec.js#replaces a request that is not due with a fresh delayed copy when the next receive would be the last existing_candidates: - ATS-PFM-NOT-006-01 - ATS-PFM-NOT-006-02 - ATS-PFM-NOT-006-04 - ATS-PFM-NOT-006-07 decision: 'gap: independent guard and side-effect proof has not been verified' - state_model: STATE-PFM-NOT-002 transition_index: 3 from: queued to: no recipients trigger: Audience resolution produces an empty result. source: >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#notifies nobody when everyone named is outside the organization, recording no_recipients with the refusal existing_candidates: - ATS-PFM-NOT-006-01 - ATS-PFM-NOT-006-02 - ATS-PFM-NOT-006-04 - ATS-PFM-NOT-006-07 decision: 'gap: independent guard and side-effect proof has not been verified' - state_model: STATE-PFM-NOT-002 transition_index: 4 from: queued to: invalid trigger: Acceptance validation rejects the request. source: >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#records an unknown definition as invalid existing_candidates: - ATS-PFM-NOT-006-01 - ATS-PFM-NOT-006-02 - ATS-PFM-NOT-006-04 - ATS-PFM-NOT-006-07 decision: 'gap: independent guard and side-effect proof has not been verified' - state_model: STATE-PFM-NOT-002 transition_index: 5 from: queued to: expired trigger: Processing or reconciliation detects an elapsed deadline. source: >- services-platform:modules/notifications/tests/integration/services/orchestration/orchestrate-request.integration.spec.js#expires a request older than its definition’s expires_after from the instant the producer wrote it existing_candidates: - ATS-PFM-NOT-006-01 - ATS-PFM-NOT-006-02 - ATS-PFM-NOT-006-04 - ATS-PFM-NOT-006-07 decision: 'gap: independent guard and side-effect proof has not been verified' - state_model: STATE-PFM-NOT-002 transition_index: 6 from: queued to: cancelled trigger: >- Withdrawal arrives before acceptance, or processing discovers a later replacement-key cancellation. source: >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#leaves nobody told and records the request cancelled when the cancel names the publish’s key existing_candidates: - ATS-PFM-NOT-006-01 - ATS-PFM-NOT-006-02 - ATS-PFM-NOT-006-04 - ATS-PFM-NOT-006-07 decision: 'gap: independent guard and side-effect proof has not been verified' - state_model: STATE-PFM-NOT-002 transition_index: 7 from: open to: superseded trigger: An open request is withdrawn or replaced by an accepted occurrence. source: >- services-platform:modules/notifications/tests/integration/services/orchestration/cancel-and-supersede.integration.spec.js#marks the instance superseded, leaves it readable and takes it out of the unread count existing_candidates: - ATS-PFM-NOT-006-01 - ATS-PFM-NOT-006-02 - ATS-PFM-NOT-006-04 - ATS-PFM-NOT-006-07 decision: 'gap: independent guard and side-effect proof has not been verified' - state_model: STATE-PFM-NOT-002 transition_index: 8 from: open to: settled trigger: The nightly sweep completes expired work. source: >- services-platform:modules/notifications/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#settles a request past its expiry whose notification was delivered, so a late cancel reaches nothing existing_candidates: - ATS-PFM-NOT-006-01 - ATS-PFM-NOT-006-02 - ATS-PFM-NOT-006-04 - ATS-PFM-NOT-006-07 decision: 'gap: independent guard and side-effect proof has not been verified' - state_model: STATE-PFM-NOT-002 transition_index: 9 from: open to: cancelled trigger: Registration retires the definition. source: >- services-platform:modules/notifications/services/persistence/requests.ts:cancelOpenRequestsOfDefinition existing_candidates: - ATS-PFM-NOT-006-01 - ATS-PFM-NOT-006-02 - ATS-PFM-NOT-006-04 - ATS-PFM-NOT-006-07 decision: 'gap: independent guard and side-effect proof has not been verified' workflow_coverage: - workflow: WF-PFM-NOT-003 capabilities: - CAP-PFM-NOT-003 - CAP-PFM-NOT-004 - CAP-PFM-NOT-005 - CAP-PFM-NOT-006 - CAP-PFM-NOT-007 - CAP-PFM-NOT-008 scenario_candidate: ATS-PFM-NOT-006-10 coverage: 'gap: FND-PFM-NOT-084' reason: >- The proposed related-capability sequence does not independently isolate every workflow hop, failure seam and interleaving. - workflow: WF-PFM-NOT-004 capabilities: - CAP-PFM-NOT-006 - CAP-PFM-NOT-005 - CAP-PFM-NOT-014 scenario_candidate: ATS-PFM-NOT-006-10 coverage: 'gap: FND-PFM-NOT-084' reason: >- The proposed related-capability sequence does not independently isolate every workflow hop, failure seam and interleaving. - workflow: WF-PFM-NOT-007 capabilities: - CAP-PFM-NOT-008 - CAP-PFM-NOT-006 scenario_candidate: ATS-PFM-NOT-006-10 coverage: 'gap: FND-PFM-NOT-084' reason: >- The proposed related-capability sequence does not independently isolate every workflow hop, failure seam and interleaving. - workflow: WF-PFM-NOT-009 capabilities: - CAP-PFM-NOT-014 - CAP-PFM-NOT-002 - CAP-PFM-NOT-006 scenario_candidate: ATS-PFM-NOT-006-10 coverage: 'gap: FND-PFM-NOT-084' reason: >- The proposed related-capability sequence does not independently isolate every workflow hop, failure seam and interleaving. domain_invariant_coverage: [] --- # Remove notices that have become stale: Capability Test Specification ## Coverage Each scenario names the guarantee it proves. Category coverage describes specified cases; executable bindings retain their narrower assertion boundaries. Lifecycle coverage remains a gap wherever guards and effects lack independent verification. | Rule | Proof | |---|---| | `BR-CAP-PFM-NOT-006-01` | `ATS-PFM-NOT-006-01`, `ATS-PFM-NOT-006-10` | | `BR-CAP-PFM-NOT-006-02` | `ATS-PFM-NOT-006-02` | | `BR-CAP-PFM-NOT-006-03` | `ATS-PFM-NOT-006-03` | | `BR-CAP-PFM-NOT-006-04` | `ATS-PFM-NOT-006-04` | | `BR-CAP-PFM-NOT-006-05` | `ATS-PFM-NOT-006-05` | | `BR-CAP-PFM-NOT-006-06` | `ATS-PFM-NOT-006-06` | | `BR-CAP-PFM-NOT-006-07` | `ATS-PFM-NOT-006-07` | | `BR-CAP-PFM-NOT-006-08` | `ATS-PFM-NOT-006-08` | ## Interactions With Related Capabilities Prepare a folded console item, one queued external delivery and an explicit assignment with a delayed notice. Withdraw one folded contributor, end the delayed assignment, run delivery and reconciliation, then inspect the remaining items. The interaction case combines the producing, processing and reading outcomes named in its frontmatter. It remains proposed until an executable suite performs that complete sequence.