--- source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f finding_evidence: - finding: FND-PFM-OPS-001 source: >- specs/PRODUCT-AREAS.md (MOD-PFM-OPS row); react-console tree at baf6dae (no app/(hq) route group; HQ pages under app/(console)/hq; the Applications page at app/(console)/console/[tenantId]/configuration/page.tsx); services-platform modules/tenants/aws/api/tenant-applications.routes.ts - finding: FND-PFM-OPS-002 source: >- services-platform:docs/milestones (no durable jobs, audit or licensing milestone); docs/standards/milestone-development-and-acceptance.md; docs/hq/rhythm-hq-plan.md#K8; docs/proposals/application-access-and-entitlements.md#Status; docs/audit-events.md#2026-10-12 — Final acceptance - finding: FND-PFM-OPS-003 source: >- react-console:lib/hq/job-snapshot.ts (stale read from the snapshot or root); components/console/hq/job/job-detail.tsx; macroservice-libraries:packages/jobs/src/api/job-wire.ts (no stale field); services-platform:modules/jobs - finding: FND-PFM-OPS-004 source: >- react-console:components/console/hq/job/job-retry.tsx (canRetryJob), lib/hq/permissions.ts (hq.jobs.retry); services-platform:modules/tenants/aws/api/tenants.routes.ts:retryTenantProvisioning (HQ_TENANTS_PERMISSIONS.Provision); aws/platform.service.ts:HQ_JOBS_PERMISSIONS (no route requires Retry) - finding: FND-PFM-OPS-005 source: >- macroservice-libraries:packages/jobs/CHANGELOG.md#0.5.0, src/engine/job-engine.ts:cancelJob; services-platform:modules/eligibility/services/population/population-workflow.ts (cancellable true); modules/jobs/aws/api/jobs.routes.ts (read-only); docs/jobs.md#3. What was ported from Tribal; docs/hq/rhythm-hq-plan.md#D12 - finding: FND-PFM-OPS-006 source: >- services-platform:docs/hq/rhythm-hq-plan.md#D12 (5 s, 15 s after 2 minutes); docs/jobs.md#3 (15 seconds); react-console:lib/hq/use-hq-ops.ts:JOB_POLL_INTERVAL_MS, lib/maintenance/use-job-runs.ts - finding: FND-PFM-OPS-007 source: >- services-platform:docs/jobs.md#5. The API a job monitor reads; modules/jobs/aws/api/jobs.routes.ts (header); modules/jobs/tests/e2e/jobs.e2e.spec.js#refuses staff the console list, however wide the grant they carry - finding: FND-PFM-OPS-008 source: >- services-platform:docs/hq/rhythm-hq-plan.md#D12; modules/queries/datasets.ts (platform.jobs dataset); react-console:components/console/hq/jobs-list.tsx, components/console/hq/job/job-header.tsx - finding: FND-PFM-OPS-009 source: >- services-platform:modules/jobs/services/notices/job-notice-email.ts:jobPageUrl; modules/jobs/tests/unit/services/notices/job-notice-email.spec.js; docs/hq/rhythm-hq-plan.md#D11 (2026-10-21 note) - finding: FND-PFM-OPS-010 source: 'services-platform:modules/jobs/aws/lambda/RECONCILER.handler.ts' - finding: FND-PFM-OPS-011 source: >- services-platform:modules/licensing/services/enablement/grant-licence-override.ts:grantLicenceOverride, withdrawLicenceOverride; services/persistence/licence-overrides.ts:createLicenceOverride (own transaction); aws/api/licensing.routes.ts (suspend, resume, retry audit after the change); docs/licensing.md#5. The audit trail - finding: FND-PFM-OPS-012 source: >- services-platform:docs/proposals/application-access-and-entitlements.md#D3; modules/licensing (no renewal notice anywhere) - finding: FND-PFM-OPS-013 source: >- services-platform:docs/licensing.md#2. What this does NOT do, #11. Switching the HubSpot source on; modules/licensing/hubspot/contract-properties.ts (unconfirmed names) - finding: FND-PFM-OPS-014 source: >- services-platform:docs/proposals/licensing-entitlements-billing/17-decision-register.md#1. Decided (E-21, E-23, E-25); docs/proposals/licensing-entitlements-billing/README.md (nothing built) - finding: FND-PFM-OPS-015 source: >- react-console:lib/hq/licensing-types.ts:MIN_LICENSING_REASON_LENGTH, components/console/hq/tenant-licensing-card.tsx, lib/hq/licensing.ts (revoke sends a reason); services-platform:modules/licensing/aws/api/licensing.routes.ts (revoke declares no body), db/licence-overrides.table.ts:LICENCE_OVERRIDE_REASON_MAX_LENGTH - finding: FND-PFM-OPS-016 source: >- react-console:lib/hq/licensing.ts:licensingPaths.application, lib/hq/licensing.test.ts, mocks/handlers/applications.ts; services-platform:modules/licensing/aws/api/licensing.routes.ts (retry_provisioning); docs/licensing.md#4. The routes - finding: FND-PFM-OPS-017 source: >- specs/platform/security/MODULE.md (coverage_catalog listTenantApplicationsForTenant: CAP-PFM-SEC-002); services-platform:modules/tenants/aws/api/tenant-applications.routes.ts; docs/licensing.md#4. The routes - finding: FND-PFM-OPS-018 source: >- services-platform:modules/licensing/db/data-export-entitlements.table.ts, services/persistence/data-export-entitlements.ts; modules/data-exports/aws/api/hq-data-exports.routes.ts; docs/licensing.md (no mention) - finding: FND-PFM-OPS-019 source: >- services-platform:docs/audit-events.md#Retention, #2026-10-12 — Final acceptance (EX-DAT-006, due 2026-11-09) - finding: FND-PFM-OPS-020 source: >- services-platform:docs/audit-events.md#Which record types report views, #2026-10-12 — Final acceptance (Remaining work); modules/audit/registry/viewable-record-types.ts (committees.committees); react-console:components/console/organization/organization-360-live.tsx (useRecordViewTracking); acceptance/crm/inventory/capabilities.json CAP-CRM-AUD-006 status_note - finding: FND-PFM-OPS-021 source: >- services-platform:modules/custom-objects/aws/api/custom-object-records.routes.ts (recordViewEvent on read); docs/audit-events.md#The custom record change event - finding: FND-PFM-OPS-022 source: >- services-platform:docs/audit-events.md#The merge event, #The Commerce intervention event; modules/audit/aws/api/audit.routes.ts (reads filter record.viewed); react-console (no history screen) - finding: FND-PFM-OPS-023 source: >- react-console:components/maintenance/job-runs-screen.tsx (page description); services-platform:modules/jobs/services/kinds/job-kind-labels.ts (Tenant provisioning, Tenant purge, …) - finding: FND-PFM-OPS-024 source: >- react-console:lib/hq/licensing.ts (no company, sync or sync-health call); services-platform:modules/licensing/aws/api/licensing.routes.ts (getHubspotCompanyLicensing, syncHubspotCompanyLicensing, getLicenceSyncHealth) - finding: FND-PFM-OPS-025 source: specs/platform/operations/design/tests (scenarios with provenance proposed); the rules' sources - finding: FND-PFM-OPS-026 source: >- services-platform:modules/jobs/services/persistence/job-notices.ts:claimJobNotice; services-platform:modules/jobs/services/notices/notify-job-requester.ts:notifyJobRequester - finding: FND-PFM-OPS-027 source: >- services-platform:docs/licensing.md#How a window becomes availability; services-platform:modules/licensing/services/availability/application-availability.ts:licenceStateOf - finding: FND-PFM-OPS-028 source: >- services-platform:modules/audit/tests/integration/services/persistence/audit-events.integration.spec.js#answers the event whole, the actor the execution’s caller and the occurrence key minted for it; services-platform:modules/licensing/tests/integration/db/licence-overrides.table.integration.spec.js#leaves a tenant with no overrides at all once its rows are deleted with it - finding: FND-PFM-OPS-029 source: >- services-platform:modules/licensing/services/sync/sync-company-licences.ts:syncCompanyLicences; services-platform:modules/licensing/aws/lambda/LICENCE_SYNC.handler.ts:processLicenceSyncBatch; services-platform:modules/licensing/services/sync/accept-webhook-delivery.ts:acceptWebhookDelivery; services-platform:docs/proposals/application-access-and-entitlements.md#D5 - finding: FND-PFM-OPS-030 source: >- services-platform:modules/licensing/services/enablement/provision-tenant-application.ts:suspendTenantApplication; services-platform:modules/licensing/services/persistence/tenant-applications.ts:setTenantApplicationState - finding: FND-PFM-OPS-031 source: 'services-platform:modules/jobs/aws/lambda/RECONCILER.handler.ts:handler' - finding: FND-PFM-OPS-032 source: >- macroservice-libraries:packages/jobs/src/engine/job-engine.ts:createJob; macroservice-libraries:packages/jobs/src/engine/job-engine.ts:deriveDeclaredProgress; macroservice-libraries:packages/jobs/src/engine/job-engine.ts:recordJobContinuation; macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.ts:handleCandidate - finding: FND-PFM-OPS-033 source: >- services-platform:modules/licensing/services/enablement/provision-tenant-application.ts:provisionTenantApplication, retryTenantApplicationProvisioning; modules/licensing/services/persistence/tenant-applications.ts:setTenantApplicationState - finding: FND-PFM-OPS-034 source: >- services-platform:modules/licensing/aws/api/licensing.routes.ts (file header: licence step deployed shadow); aws/platform.names.ts:PLATFORM_LICENSING_MODE ('enforce'); docs/licensing.md#2. What this does NOT do; modules/licensing/services/sync/reconcile-licences.ts (header versus reconcileLicences body) - finding: FND-PFM-OPS-035 source: >- services-platform:modules/licensing/services/sync/sync-queue.ts:publishLicenceSyncItems, requestCompanySync; services/sync/accept-webhook-delivery.ts; services/sync/reconcile-licences.ts; docs/queued-work.md#1. A queue table holds only work to be done, #2. A dispatcher only moves rows, #10. Known departures - finding: FND-PFM-OPS-036 source: >- specs/CONVENTIONS.md#1 (the hosted-screen rule); specs/platform/console-shell/design/screens/SCR-PFM-CSH-013; specs/platform/console-shell/design/contracts/SVC-PFM-CSH-tenant-applications.md - finding: FND-PFM-OPS-037 source: >- services-platform:modules/licensing/services/enablement/grant-licence-override.ts:grantLicenceOverride, withdrawLicenceOverride; services/enablement/provision-tenant-application.ts:suspendTenantApplication; aws/api/licensing.routes.ts:suspendTenantApplication - finding: FND-PFM-OPS-038 source: >- react-console:lib/record-views/tracking/visit.ts:defaultMintId (non-UUID fallback); services-platform:modules/audit/aws/api/audit-api-mapper.ts (occurrence key must be a UUID) - finding: FND-PFM-OPS-039 source: >- services-platform:modules/tenants/services/provisioning/submit-tenant-provisioning.ts:retryTenantProvisioning (retryJob, then startJobOrLeaveToReconciler; submission identity from the instant); macroservice-libraries:packages/jobs/src/engine/job-engine.ts:retryJob, submitJob; services-platform:docs/jobs.md#2 (step 8) - finding: FND-PFM-OPS-040 source: >- specs/CONVENTIONS.md#9.8 Inference Operation (the charter says in one sentence that the module performs no inference); specs/platform/operations/MODULE.md; services-platform:modules/jobs, modules/audit, modules/licensing (no call into the LLM module or a model provider) evidence: - finding: FND-PFM-OPS-041 source: >- services-platform:modules/jobs/services/persistence/job-notices.ts:recordJobNoticeOutcome; modules/jobs/services/notices/notify-job-requester.ts:notifyJobRequester - finding: FND-PFM-OPS-042 source: >- macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.ts:settleFromReconciliation; packages/jobs/src/engine/job-engine.ts:settleJobFromReconciliation - finding: FND-PFM-OPS-043 source: >- services-platform:modules/licensing/services/sync/sync-company-licences.ts:syncCompanyLicences; modules/licensing/services/persistence/hubspot-contracts.ts:replaceCompanyContracts; modules/licensing/services/persistence/licence-windows.ts:replaceCompanyLicenceWindows - finding: FND-PFM-OPS-044 source: >- services-platform:modules/licensing/services/enablement/seed-development-licences.ts:seedDevelopmentLicenceOverrides, seedDevelopmentLicenceOverridesForTenant - finding: FND-PFM-OPS-045 source: >- macroservice-libraries:packages/jobs/src/engine/start-job-execution.ts:buildExecutionInput; services-platform:modules/licensing/db/licence-windows.table.ts; modules/licensing/db/tenant-applications.table.ts; modules/licensing/services/persistence/tenant-applications.ts:setTenantApplicationState - finding: FND-PFM-OPS-046 source: >- rhythm-v2-docs:briefs/design/platform-operations.brief.md (absent at ebaa2ed03a40067fa987889151011f2f7e69e1ab) - finding: FND-PFM-OPS-047 source: >- rhythm-v2-docs:specs/platform/operations/planning/** (frontmatter status at ebaa2ed03a40067fa987889151011f2f7e69e1ab); specs/CONVENTIONS.md#9 control_gap_evidence: - finding: FND-PFM-OPS-048 controls: - TC-AVL-004 - TC-PI-004 provenance: observed source: >- services-platform:modules/licensing/services/enablement/provision-tenant-application.ts:provisionTenantApplication, retryTenantApplicationProvisioning; modules/licensing/services/persistence/tenant-applications.ts:setTenantApplicationState related_finding: FND-PFM-OPS-033 - finding: FND-PFM-OPS-049 controls: - TC-LOG-001 - TC-AZ-006 - TC-PI-004 provenance: observed source: >- services-platform:modules/licensing/services/enablement/grant-licence-override.ts:grantLicenceOverride, withdrawLicenceOverride; services/enablement/provision-tenant-application.ts:suspendTenantApplication; aws/api/licensing.routes.ts:suspendTenantApplication related_finding: FND-PFM-OPS-037 - finding: FND-PFM-OPS-050 controls: - TC-AVL-004 - TC-PI-002 - TC-PI-003 - TC-PI-004 provenance: observed source: >- services-platform:modules/jobs/services/persistence/job-notices.ts:recordJobNoticeOutcome; modules/jobs/services/notices/notify-job-requester.ts:notifyJobRequester related_finding: FND-PFM-OPS-041 - finding: FND-PFM-OPS-051 controls: - TC-AVL-004 - TC-PI-004 provenance: observed source: >- macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.ts:settleFromReconciliation; packages/jobs/src/engine/job-engine.ts:settleJobFromReconciliation related_finding: FND-PFM-OPS-042 - finding: FND-PFM-OPS-052 controls: - TC-PI-003 provenance: observed source: >- services-platform:modules/licensing/services/sync/sync-company-licences.ts:syncCompanyLicences; modules/licensing/services/persistence/hubspot-contracts.ts:replaceCompanyContracts; modules/licensing/services/persistence/licence-windows.ts:replaceCompanyLicenceWindows related_finding: FND-PFM-OPS-043 testing_coverage_evidence: - finding: FND-PFM-OPS-053 provenance: unknown source: >- ATS-PFM-OPS-001; BR-CAP-PFM-OPS-001-11; INV-DOM-PFM-OPS-001-05; INV-DOM-PFM-OPS-001-06; INV-DOM-PFM-OPS-001-07; INV-DOM-PFM-OPS-001-09; INV-DOM-PFM-OPS-001-10; INV-DOM-PFM-OPS-001-11; INV-DOM-PFM-OPS-001-12; WF-PFM-OPS-001; WF-PFM-OPS-002; WF-PFM-OPS-009 missing_categories: - edge uncovered_rules: - BR-CAP-PFM-OPS-001-11 unbound_scenarios: - ATS-PFM-OPS-001-02 - ATS-PFM-OPS-001-03 - ATS-PFM-OPS-001-08 - ATS-PFM-OPS-001-09 - ATS-PFM-OPS-001-10 - ATS-PFM-OPS-001-11 - ATS-PFM-OPS-001-12 - ATS-PFM-OPS-001-16 - ATS-PFM-OPS-001-17 note: >- Empty declarations, unknown late step reports and the full progress-weight calculation lack complete scenario trace. transition_obligations: - model: STATE-PFM-OPS-001 transition: 3 from: running to: failed provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 4 from: running to: failed provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 5 from: running to: succeeded provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 6 from: pending to: failed provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 7 from: pending to: cancelled provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 8 from: running to: cancelled provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 8 from: queued to: completed provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. object_invariants_requiring_trace: - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-07 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-10 - INV-DOM-PFM-OPS-001-11 - INV-DOM-PFM-OPS-001-12 permission_obligations: [] workflow_scenarios: WF-PFM-OPS-002: - ATS-PFM-OPS-001-16 - ATS-PFM-OPS-003-13 WF-PFM-OPS-009: - ATS-PFM-OPS-001-17 - ATS-PFM-OPS-010-13 - ATS-PFM-OPS-012-19 - ATS-PFM-OPS-015-15 - finding: FND-PFM-OPS-054 provenance: unknown source: >- ATS-PFM-OPS-002; BR-CAP-PFM-OPS-002-09; INV-DOM-PFM-OPS-001-01; INV-DOM-PFM-OPS-001-02; INV-DOM-PFM-OPS-001-03; INV-DOM-PFM-OPS-001-04; INV-DOM-PFM-OPS-001-05; INV-DOM-PFM-OPS-001-06; INV-DOM-PFM-OPS-001-08; INV-DOM-PFM-OPS-001-09; INV-DOM-PFM-OPS-001-10; INV-DOM-PFM-OPS-001-11; INV-DOM-PFM-OPS-001-12; WF-PFM-OPS-003 missing_categories: - validation - concurrency uncovered_rules: - BR-CAP-PFM-OPS-002-09 unbound_scenarios: - ATS-PFM-OPS-002-07 - ATS-PFM-OPS-002-09 - ATS-PFM-OPS-002-10 note: >- Malformed scheduled invocations and competing task-versus-reconciler reports lack complete proof; successful-execution correction retains the previously recorded consequence-ordering defect. transition_obligations: - model: STATE-PFM-OPS-001 transition: 1 from: pending to: running provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 2 from: running to: succeeded provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 3 from: running to: failed provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 4 from: running to: failed provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 5 from: running to: succeeded provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 6 from: pending to: failed provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 7 from: pending to: cancelled provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 8 from: running to: cancelled provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. object_invariants_requiring_trace: - INV-DOM-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-02 - INV-DOM-PFM-OPS-001-03 - INV-DOM-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-08 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-10 - INV-DOM-PFM-OPS-001-11 - INV-DOM-PFM-OPS-001-12 permission_obligations: [] workflow_scenarios: WF-PFM-OPS-003: - ATS-PFM-OPS-004-11 - finding: FND-PFM-OPS-055 provenance: unknown source: >- ATS-PFM-OPS-003; BR-CAP-PFM-OPS-003-11; INV-DOM-PFM-OPS-001-01; INV-DOM-PFM-OPS-001-02; INV-DOM-PFM-OPS-001-03; INV-DOM-PFM-OPS-001-04; INV-DOM-PFM-OPS-001-05; INV-DOM-PFM-OPS-001-06; INV-DOM-PFM-OPS-001-07; INV-DOM-PFM-OPS-001-08; INV-DOM-PFM-OPS-001-09; INV-DOM-PFM-OPS-001-10; INV-DOM-PFM-OPS-001-12; WF-PFM-OPS-002; WF-PFM-OPS-003; WF-PFM-OPS-004 missing_categories: - edge - concurrency uncovered_rules: - BR-CAP-PFM-OPS-003-11 unbound_scenarios: - ATS-PFM-OPS-003-01 - ATS-PFM-OPS-003-04 - ATS-PFM-OPS-003-08 - ATS-PFM-OPS-003-09 - ATS-PFM-OPS-003-13 note: >- Missing jobs or recipient addresses and concurrent senders need complete notification-flow proof, including interrupted delivery-outcome writes. transition_obligations: [] object_invariants_requiring_trace: - INV-DOM-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-02 - INV-DOM-PFM-OPS-001-03 - INV-DOM-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-07 - INV-DOM-PFM-OPS-001-08 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-10 - INV-DOM-PFM-OPS-001-12 permission_obligations: [] workflow_scenarios: WF-PFM-OPS-002: - ATS-PFM-OPS-001-16 - ATS-PFM-OPS-003-13 WF-PFM-OPS-003: - ATS-PFM-OPS-004-11 - finding: FND-PFM-OPS-056 provenance: unknown source: >- ATS-PFM-OPS-004; INV-DOM-PFM-OPS-001-01; INV-DOM-PFM-OPS-001-02; INV-DOM-PFM-OPS-001-03; INV-DOM-PFM-OPS-001-04; INV-DOM-PFM-OPS-001-05; INV-DOM-PFM-OPS-001-06; INV-DOM-PFM-OPS-001-07; INV-DOM-PFM-OPS-001-08; INV-DOM-PFM-OPS-001-09; INV-DOM-PFM-OPS-001-11; INV-DOM-PFM-OPS-001-12; WF-PFM-OPS-003; WF-PFM-OPS-005; WF-PFM-OPS-006 missing_categories: - edge - failure - boundary - concurrency uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-004-02 - ATS-PFM-OPS-004-08 - ATS-PFM-OPS-004-09 - ATS-PFM-OPS-004-10 - ATS-PFM-OPS-004-11 note: >- Failed execution stop, failed retry startup and concurrent stop-versus-completion need proof beyond sequential engine cases. transition_obligations: - model: STATE-PFM-OPS-001 transition: 1 from: pending to: running provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 2 from: running to: succeeded provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 3 from: running to: failed provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 4 from: running to: failed provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 5 from: running to: succeeded provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 6 from: pending to: failed provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 7 from: pending to: cancelled provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 8 from: running to: cancelled provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 1 from: queued to: running provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 2 from: running to: completed provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 3 from: running to: skipped provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 4 from: running to: retrying provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 5 from: retrying to: running provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 6 from: running to: failed provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 7 from: retrying to: failed provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 8 from: queued to: completed provenance: unknown source: FND-PFM-OPS-056 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. object_invariants_requiring_trace: - INV-DOM-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-02 - INV-DOM-PFM-OPS-001-03 - INV-DOM-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-07 - INV-DOM-PFM-OPS-001-08 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-11 - INV-DOM-PFM-OPS-001-12 permission_obligations: - key: hq.jobs.retry where_checked: console provenance: unknown source: FND-PFM-OPS-056 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: hq.tenants.provision where_checked: api provenance: unknown source: FND-PFM-OPS-056 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: WF-PFM-OPS-003: - ATS-PFM-OPS-004-11 WF-PFM-OPS-005: - ATS-PFM-OPS-004-06 - finding: FND-PFM-OPS-057 provenance: unknown source: >- ATS-PFM-OPS-005; INV-DOM-PFM-OPS-001-01; INV-DOM-PFM-OPS-001-02; INV-DOM-PFM-OPS-001-03; INV-DOM-PFM-OPS-001-04; INV-DOM-PFM-OPS-001-05; INV-DOM-PFM-OPS-001-06; INV-DOM-PFM-OPS-001-07; INV-DOM-PFM-OPS-001-08; INV-DOM-PFM-OPS-001-09; INV-DOM-PFM-OPS-001-10; INV-DOM-PFM-OPS-001-11; WF-PFM-OPS-007 missing_categories: - edge - failure - concurrency uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-005-10 note: >- Empty or removed run targets, failed monitor reads and paging while job activity changes need dedicated scenario proof. transition_obligations: [] object_invariants_requiring_trace: - INV-DOM-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-02 - INV-DOM-PFM-OPS-001-03 - INV-DOM-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-07 - INV-DOM-PFM-OPS-001-08 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-10 - INV-DOM-PFM-OPS-001-11 permission_obligations: - key: platform.jobs.read where_checked: api provenance: unknown source: FND-PFM-OPS-057 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: maintenance.scheduled-jobs.view where_checked: console provenance: unknown source: FND-PFM-OPS-057 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: WF-PFM-OPS-007: - ATS-PFM-OPS-005-10 - ATS-PFM-OPS-007-07 - finding: FND-PFM-OPS-058 provenance: unknown source: >- ATS-PFM-OPS-006; INV-DOM-PFM-OPS-001-01; INV-DOM-PFM-OPS-001-02; INV-DOM-PFM-OPS-001-03; INV-DOM-PFM-OPS-001-04; INV-DOM-PFM-OPS-001-05; INV-DOM-PFM-OPS-001-06; INV-DOM-PFM-OPS-001-07; INV-DOM-PFM-OPS-001-08; INV-DOM-PFM-OPS-001-09; INV-DOM-PFM-OPS-001-10; INV-DOM-PFM-OPS-001-11; INV-DOM-PFM-OPS-001-12; WF-PFM-OPS-005; WF-PFM-OPS-007 missing_categories: - validation - failure - boundary - concurrency - invariant uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-006-04 - ATS-PFM-OPS-006-05 - ATS-PFM-OPS-006-06 note: >- Invalid staff list filters, polling boundaries, response privacy and overlapping refresh need complete proof; the real stalled-work flag remains absent. transition_obligations: [] object_invariants_requiring_trace: - INV-DOM-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-02 - INV-DOM-PFM-OPS-001-03 - INV-DOM-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-07 - INV-DOM-PFM-OPS-001-08 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-10 - INV-DOM-PFM-OPS-001-11 - INV-DOM-PFM-OPS-001-12 permission_obligations: - key: hq.jobs.read where_checked: api provenance: unknown source: FND-PFM-OPS-058 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: WF-PFM-OPS-005: - ATS-PFM-OPS-004-06 WF-PFM-OPS-007: - ATS-PFM-OPS-005-10 - ATS-PFM-OPS-007-07 - finding: FND-PFM-OPS-059 provenance: unknown source: >- ATS-PFM-OPS-007; INV-DOM-PFM-OPS-001-01; INV-DOM-PFM-OPS-001-02; INV-DOM-PFM-OPS-001-03; INV-DOM-PFM-OPS-001-04; INV-DOM-PFM-OPS-001-05; INV-DOM-PFM-OPS-001-06; INV-DOM-PFM-OPS-001-07; INV-DOM-PFM-OPS-001-08; INV-DOM-PFM-OPS-001-09; INV-DOM-PFM-OPS-001-10; INV-DOM-PFM-OPS-001-11; INV-DOM-PFM-OPS-001-12; WF-PFM-OPS-007 missing_categories: - failure - boundary - concurrency uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-007-07 - ATS-PFM-OPS-007-08 note: >- Unavailable publishers, incompatible contract columns and discovery during new view publication need dedicated boundary and failure proof. transition_obligations: [] object_invariants_requiring_trace: - INV-DOM-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-02 - INV-DOM-PFM-OPS-001-03 - INV-DOM-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-07 - INV-DOM-PFM-OPS-001-08 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-10 - INV-DOM-PFM-OPS-001-11 - INV-DOM-PFM-OPS-001-12 permission_obligations: [] workflow_scenarios: WF-PFM-OPS-007: - ATS-PFM-OPS-005-10 - ATS-PFM-OPS-007-07 - finding: FND-PFM-OPS-060 provenance: unknown source: >- ATS-PFM-OPS-008; INV-DOM-PFM-OPS-002-01; INV-DOM-PFM-OPS-002-02; INV-DOM-PFM-OPS-002-03; INV-DOM-PFM-OPS-002-07; INV-DOM-PFM-OPS-002-08; INV-DOM-PFM-OPS-002-09; WF-PFM-OPS-008 missing_categories: - edge uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-008-10 - ATS-PFM-OPS-008-12 - ATS-PFM-OPS-008-13 note: >- Navigation around a removed or newly unreadable target needs additional edge proof; public reporting and immutable storage have separate enforcement boundaries. transition_obligations: [] object_invariants_requiring_trace: - INV-DOM-PFM-OPS-002-01 - INV-DOM-PFM-OPS-002-02 - INV-DOM-PFM-OPS-002-03 - INV-DOM-PFM-OPS-002-07 - INV-DOM-PFM-OPS-002-08 - INV-DOM-PFM-OPS-002-09 permission_obligations: - key: platform.record-views.create where_checked: api provenance: unknown source: FND-PFM-OPS-060 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: crm.contacts.read where_checked: service provenance: unknown source: FND-PFM-OPS-060 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: crm.organizations.read where_checked: service provenance: unknown source: FND-PFM-OPS-060 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: committees.committees.read where_checked: service provenance: unknown source: FND-PFM-OPS-060 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: WF-PFM-OPS-008: - ATS-PFM-OPS-008-13 - finding: FND-PFM-OPS-061 provenance: unknown source: >- ATS-PFM-OPS-009; INV-DOM-PFM-OPS-002-01; INV-DOM-PFM-OPS-002-02; INV-DOM-PFM-OPS-002-03; INV-DOM-PFM-OPS-002-04; INV-DOM-PFM-OPS-002-05; INV-DOM-PFM-OPS-002-06; INV-DOM-PFM-OPS-002-08; INV-DOM-PFM-OPS-002-09 missing_categories: - rule - failure - concurrency - invariant uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-009-07 note: >- Excluding non-visit event types, failed history reads and pagination during new visits need complete category proof. transition_obligations: [] object_invariants_requiring_trace: - INV-DOM-PFM-OPS-002-01 - INV-DOM-PFM-OPS-002-02 - INV-DOM-PFM-OPS-002-03 - INV-DOM-PFM-OPS-002-04 - INV-DOM-PFM-OPS-002-05 - INV-DOM-PFM-OPS-002-06 - INV-DOM-PFM-OPS-002-08 - INV-DOM-PFM-OPS-002-09 permission_obligations: - key: platform.record-views.read where_checked: api provenance: unknown source: FND-PFM-OPS-061 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: platform.audit-events.read where_checked: api provenance: unknown source: FND-PFM-OPS-061 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: {} - finding: FND-PFM-OPS-062 provenance: unknown source: >- ATS-PFM-OPS-010; INV-DOM-PFM-OPS-002-03; INV-DOM-PFM-OPS-002-04; INV-DOM-PFM-OPS-002-05; INV-DOM-PFM-OPS-002-06; INV-DOM-PFM-OPS-002-07; INV-DOM-PFM-OPS-002-08; WF-PFM-OPS-008; WF-PFM-OPS-009 missing_categories: - edge - failure - concurrency uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-010-06 - ATS-PFM-OPS-010-10 - ATS-PFM-OPS-010-11 - ATS-PFM-OPS-010-12 - ATS-PFM-OPS-010-13 note: >- Unattributed mutation events, rollback with the owning business change and simultaneous duplicate writes need complete proof at the activity boundary. transition_obligations: [] object_invariants_requiring_trace: - INV-DOM-PFM-OPS-002-03 - INV-DOM-PFM-OPS-002-04 - INV-DOM-PFM-OPS-002-05 - INV-DOM-PFM-OPS-002-06 - INV-DOM-PFM-OPS-002-07 - INV-DOM-PFM-OPS-002-08 permission_obligations: [] workflow_scenarios: WF-PFM-OPS-008: - ATS-PFM-OPS-008-13 WF-PFM-OPS-009: - ATS-PFM-OPS-001-17 - ATS-PFM-OPS-010-13 - ATS-PFM-OPS-012-19 - ATS-PFM-OPS-015-15 - finding: FND-PFM-OPS-063 provenance: unknown source: >- ATS-PFM-OPS-011; INV-DOM-PFM-OPS-003-05; INV-DOM-PFM-OPS-003-06; INV-DOM-PFM-OPS-003-07; INV-DOM-PFM-OPS-003-08; INV-DOM-PFM-OPS-003-09; INV-DOM-PFM-OPS-003-10; INV-DOM-PFM-OPS-003-11; WF-PFM-OPS-010; WF-PFM-OPS-011; WF-PFM-OPS-016; WF-PFM-OPS-017 missing_categories: - concurrency uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-011-10 - ATS-PFM-OPS-011-12 - ATS-PFM-OPS-011-13 - ATS-PFM-OPS-011-14 - ATS-PFM-OPS-011-15 - ATS-PFM-OPS-011-16 note: >- Concurrent seed selection, competing withdrawals and post-commit follow-up failures need complete flow proof beyond ordinary sequential decisions. transition_obligations: - model: STATE-PFM-OPS-004 transition: 3 from: in force to: revoked provenance: unknown source: FND-PFM-OPS-063 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-004 transition: 4 from: scheduled to: revoked provenance: unknown source: FND-PFM-OPS-063 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-004 transition: 5 from: ended to: revoked provenance: unknown source: FND-PFM-OPS-063 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. object_invariants_requiring_trace: - INV-DOM-PFM-OPS-003-05 - INV-DOM-PFM-OPS-003-06 - INV-DOM-PFM-OPS-003-07 - INV-DOM-PFM-OPS-003-08 - INV-DOM-PFM-OPS-003-09 - INV-DOM-PFM-OPS-003-10 - INV-DOM-PFM-OPS-003-11 permission_obligations: - key: hq.licensing.manage where_checked: api provenance: unknown source: FND-PFM-OPS-063 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: WF-PFM-OPS-010: - ATS-PFM-OPS-011-12 - ATS-PFM-OPS-011-05 WF-PFM-OPS-011: - ATS-PFM-OPS-015-09 WF-PFM-OPS-016: - ATS-PFM-OPS-011-15 - ATS-PFM-OPS-014-12 - finding: FND-PFM-OPS-064 provenance: unknown source: >- ATS-PFM-OPS-012; BR-CAP-PFM-OPS-012-18; BR-CAP-PFM-OPS-012-19; INV-DOM-PFM-OPS-003-01; INV-DOM-PFM-OPS-003-02; INV-DOM-PFM-OPS-003-03; INV-DOM-PFM-OPS-003-04; INV-DOM-PFM-OPS-003-05; INV-DOM-PFM-OPS-003-08; INV-DOM-PFM-OPS-003-09; INV-DOM-PFM-OPS-003-10; INV-DOM-PFM-OPS-003-11; WF-PFM-OPS-009; WF-PFM-OPS-013; WF-PFM-OPS-014; WF-PFM-OPS-015; WF-PFM-OPS-016 missing_categories: - transition - concurrency - invariant uncovered_rules: - BR-CAP-PFM-OPS-012-18 - BR-CAP-PFM-OPS-012-19 unbound_scenarios: - ATS-PFM-OPS-012-07 - ATS-PFM-OPS-012-14 - ATS-PFM-OPS-012-15 - ATS-PFM-OPS-012-16 - ATS-PFM-OPS-012-17 - ATS-PFM-OPS-012-19 note: >- Queue receive and retention limits, missing operational preparation after contract sync, concurrent company snapshots and failed transactional replacement need explicit proof. transition_obligations: - model: STATE-PFM-OPS-005 transition: 1 from: future to: current provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 2 from: current to: in grace provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 3 from: in grace to: expired provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 4 from: current to: replaced provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 5 from: in grace to: replaced provenance: unknown source: FND-PFM-OPS-064 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. object_invariants_requiring_trace: - INV-DOM-PFM-OPS-003-01 - INV-DOM-PFM-OPS-003-02 - INV-DOM-PFM-OPS-003-03 - INV-DOM-PFM-OPS-003-04 - INV-DOM-PFM-OPS-003-05 - INV-DOM-PFM-OPS-003-08 - INV-DOM-PFM-OPS-003-09 - INV-DOM-PFM-OPS-003-10 - INV-DOM-PFM-OPS-003-11 permission_obligations: - key: hq.licensing.read where_checked: api provenance: unknown source: FND-PFM-OPS-064 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: hq.licensing.manage where_checked: api provenance: unknown source: FND-PFM-OPS-064 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: WF-PFM-OPS-009: - ATS-PFM-OPS-001-17 - ATS-PFM-OPS-010-13 - ATS-PFM-OPS-012-19 - ATS-PFM-OPS-015-15 WF-PFM-OPS-016: - ATS-PFM-OPS-011-15 - ATS-PFM-OPS-014-12 - finding: FND-PFM-OPS-065 provenance: unknown source: >- ATS-PFM-OPS-013; INV-DOM-PFM-OPS-003-01; INV-DOM-PFM-OPS-003-02; INV-DOM-PFM-OPS-003-03; INV-DOM-PFM-OPS-003-04; INV-DOM-PFM-OPS-003-05; INV-DOM-PFM-OPS-003-06; INV-DOM-PFM-OPS-003-07; INV-DOM-PFM-OPS-003-08; INV-DOM-PFM-OPS-003-09; INV-DOM-PFM-OPS-003-10; INV-DOM-PFM-OPS-003-11; WF-PFM-OPS-010; WF-PFM-OPS-012 missing_categories: - edge - failure - boundary - concurrency - invariant uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-013-04 - ATS-PFM-OPS-013-06 - ATS-PFM-OPS-013-07 - ATS-PFM-OPS-013-08 - ATS-PFM-OPS-013-09 note: >- Missing author records, exact dialog limits and refreshed historical decisions need additional proof; the panel’s failed-preparation retry address still differs from the served route. transition_obligations: [] object_invariants_requiring_trace: - INV-DOM-PFM-OPS-003-01 - INV-DOM-PFM-OPS-003-02 - INV-DOM-PFM-OPS-003-03 - INV-DOM-PFM-OPS-003-04 - INV-DOM-PFM-OPS-003-05 - INV-DOM-PFM-OPS-003-06 - INV-DOM-PFM-OPS-003-07 - INV-DOM-PFM-OPS-003-08 - INV-DOM-PFM-OPS-003-09 - INV-DOM-PFM-OPS-003-10 - INV-DOM-PFM-OPS-003-11 permission_obligations: - key: hq.licensing.read where_checked: api provenance: unknown source: FND-PFM-OPS-065 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: hq.licensing.manage where_checked: console provenance: unknown source: FND-PFM-OPS-065 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: WF-PFM-OPS-010: - ATS-PFM-OPS-011-12 - ATS-PFM-OPS-011-05 WF-PFM-OPS-012: - ATS-PFM-OPS-013-09 - ATS-PFM-OPS-015-10 - finding: FND-PFM-OPS-066 provenance: unknown source: >- ATS-PFM-OPS-014; INV-DOM-PFM-OPS-004-01; INV-DOM-PFM-OPS-004-02; INV-DOM-PFM-OPS-004-03; INV-DOM-PFM-OPS-004-05; INV-DOM-PFM-OPS-004-06; WF-PFM-OPS-016 missing_categories: - validation - failure - concurrency uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-014-08 - ATS-PFM-OPS-014-09 - ATS-PFM-OPS-014-10 - ATS-PFM-OPS-014-11 - ATS-PFM-OPS-014-12 note: >- Invalid composite-read inputs, failed persistence reads and availability resolved while its inputs change need additional proof. transition_obligations: - model: STATE-PFM-OPS-004 transition: 1 from: scheduled to: in force provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-004 transition: 2 from: in force to: ended provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-004 transition: 3 from: in force to: revoked provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-004 transition: 4 from: scheduled to: revoked provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-004 transition: 5 from: ended to: revoked provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 4 from: current to: replaced provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-005 transition: 5 from: in grace to: replaced provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-006 transition: 1 from: never provisioned to: provisioning provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-006 transition: 2 from: never provisioned to: enabled provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-006 transition: 3 from: provisioning to: enabled provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-006 transition: 4 from: provisioning to: provisioning failed provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-006 transition: 5 from: provisioning failed to: provisioning provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-006 transition: 6 from: enabled to: suspended provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-006 transition: 7 from: suspended to: enabled provenance: unknown source: FND-PFM-OPS-066 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. object_invariants_requiring_trace: - INV-DOM-PFM-OPS-004-01 - INV-DOM-PFM-OPS-004-02 - INV-DOM-PFM-OPS-004-03 - INV-DOM-PFM-OPS-004-05 - INV-DOM-PFM-OPS-004-06 permission_obligations: [] workflow_scenarios: WF-PFM-OPS-016: - ATS-PFM-OPS-011-15 - ATS-PFM-OPS-014-12 - finding: FND-PFM-OPS-067 provenance: unknown source: >- ATS-PFM-OPS-015; BR-CAP-PFM-OPS-015-10; INV-DOM-PFM-OPS-004-03; INV-DOM-PFM-OPS-004-04; INV-DOM-PFM-OPS-004-05; INV-DOM-PFM-OPS-004-07; INV-DOM-PFM-OPS-004-08; WF-PFM-OPS-009; WF-PFM-OPS-010; WF-PFM-OPS-011; WF-PFM-OPS-012; WF-PFM-OPS-016 missing_categories: - rule - boundary - concurrency uncovered_rules: - BR-CAP-PFM-OPS-015-10 unbound_scenarios: - ATS-PFM-OPS-015-01 - ATS-PFM-OPS-015-04 - ATS-PFM-OPS-015-05 - ATS-PFM-OPS-015-08 - ATS-PFM-OPS-015-09 - ATS-PFM-OPS-015-10 - ATS-PFM-OPS-015-11 - ATS-PFM-OPS-015-12 - ATS-PFM-OPS-015-15 note: >- Participant-free and repeated preparation, exact state-reason limits and stale service checks during competing moves need complete proof; insertion safety does not serialize the transition. transition_obligations: - model: STATE-PFM-OPS-006 transition: 2 from: never provisioned to: enabled provenance: unknown source: FND-PFM-OPS-067 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-006 transition: 4 from: provisioning to: provisioning failed provenance: unknown source: FND-PFM-OPS-067 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-006 transition: 5 from: provisioning failed to: provisioning provenance: unknown source: FND-PFM-OPS-067 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. object_invariants_requiring_trace: - INV-DOM-PFM-OPS-004-03 - INV-DOM-PFM-OPS-004-04 - INV-DOM-PFM-OPS-004-05 - INV-DOM-PFM-OPS-004-07 - INV-DOM-PFM-OPS-004-08 permission_obligations: - key: hq.licensing.manage where_checked: api provenance: unknown source: FND-PFM-OPS-067 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: WF-PFM-OPS-009: - ATS-PFM-OPS-001-17 - ATS-PFM-OPS-010-13 - ATS-PFM-OPS-012-19 - ATS-PFM-OPS-015-15 WF-PFM-OPS-010: - ATS-PFM-OPS-011-12 - ATS-PFM-OPS-011-05 WF-PFM-OPS-011: - ATS-PFM-OPS-015-09 WF-PFM-OPS-012: - ATS-PFM-OPS-013-09 - ATS-PFM-OPS-015-10 WF-PFM-OPS-016: - ATS-PFM-OPS-011-15 - ATS-PFM-OPS-014-12 - finding: FND-PFM-OPS-068 provenance: unknown source: >- ATS-PFM-OPS-016; INV-DOM-PFM-OPS-004-01; INV-DOM-PFM-OPS-004-02; INV-DOM-PFM-OPS-004-03; INV-DOM-PFM-OPS-004-04; INV-DOM-PFM-OPS-004-05; INV-DOM-PFM-OPS-004-06; INV-DOM-PFM-OPS-004-07; INV-DOM-PFM-OPS-004-08 missing_categories: - rule - validation - edge - failure - concurrency uncovered_rules: [] unbound_scenarios: - ATS-PFM-OPS-016-04 - ATS-PFM-OPS-016-05 - ATS-PFM-OPS-016-06 note: >- Disabled workspaces, malformed read requests, failed customer reads and refresh during access changes need dedicated proof beyond the normal response and scope checks. transition_obligations: [] object_invariants_requiring_trace: - INV-DOM-PFM-OPS-004-01 - INV-DOM-PFM-OPS-004-02 - INV-DOM-PFM-OPS-004-03 - INV-DOM-PFM-OPS-004-04 - INV-DOM-PFM-OPS-004-05 - INV-DOM-PFM-OPS-004-06 - INV-DOM-PFM-OPS-004-07 - INV-DOM-PFM-OPS-004-08 permission_obligations: - key: platform.tenant-applications.read where_checked: api provenance: unknown source: FND-PFM-OPS-068 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. workflow_scenarios: {} --- # Findings and Open Questions: Operational Records ## Findings | id | severity | statement | affects | evidence | kind | |---|---|---|---|---|---| | `FND-PFM-OPS-001` | medium | The original read scope names an absent HQ route group and omits the Applications host. The registry now identifies the actual HQ, configuration and supporting evidence paths; overlapping hosts retain their owning-module boundaries. | `MOD-PFM-OPS`, `CAP-PFM-OPS-016` | Structured evidence | inconsistency | | `FND-PFM-OPS-002` | medium | Jobs, audit and licensing lack dedicated milestone records. Authority instead comes from the cited approved HQ plan, accepted application proposal and recorded audit acceptance, leaving a gap in milestone traceability. | `MOD-PFM-OPS`, `FEAT-PFM-OPS-01`, `FEAT-PFM-OPS-02`, `FEAT-PFM-OPS-03`, `FEAT-PFM-OPS-04` | Structured evidence | debt | | `FND-PFM-OPS-003` | low | The HQ detail page reads a staleness flag absent from backend job responses, so its intended stalled-work warning cannot appear for real jobs. | `CAP-PFM-OPS-006`, `BR-CAP-PFM-OPS-006-08` | Structured evidence | defect | | `FND-PFM-OPS-004` | medium | The provisioning-retry button checks jobs retry authority while the called operation checks workspace provisioning authority. Holding only one permission can expose a refused action or hide an otherwise callable action. | `CAP-PFM-OPS-004`, `BR-CAP-PFM-OPS-004-08`, `JNY-PFM-OPS-002` | Structured evidence | inconsistency | | `FND-PFM-OPS-005` | medium | The shared engine supports cancellation and eligibility population opts into it, but Platform has no cancellation route or screen. The jobs guide and HQ plan still describe cancellation as absent from the engine. | `CAP-PFM-OPS-004`, `BR-CAP-PFM-OPS-004-07`, `OQ-PFM-OPS-003` | Structured evidence | debt | | `FND-PFM-OPS-006` | low | The accepted HQ refresh design slows after two minutes, whereas both current monitors keep polling active work every five seconds. The jobs guide describes a different interval again. | `CAP-PFM-OPS-005`, `CAP-PFM-OPS-006` | Structured evidence | inconsistency | | `FND-PFM-OPS-007` | low | The jobs guide describes staff-wide results through the customer monitor. Code and tests retain customer scope there and reserve cross-customer inspection for HQ. | `CAP-PFM-OPS-005`, `CAP-PFM-OPS-006` | Structured evidence | inconsistency | | `FND-PFM-OPS-008` | low | The HQ plan specifies explorer-based saved views, richer filters and visible retry lineage. The current list supplies status filtering and the detail page omits lineage presentation. | `CAP-PFM-OPS-006`, `BR-CAP-PFM-OPS-006-05` | Structured evidence | inconsistency | | `FND-PFM-OPS-009` | low | Requester messages link to staff-only HQ pages. That matches today’s provisioning audience but would not provide a usable destination for future customer-requested notifying kinds. | `CAP-PFM-OPS-003`, `BR-CAP-PFM-OPS-003-07`, `OQ-PFM-OPS-002` | Structured evidence | debt | | `FND-PFM-OPS-010` | low | The jobs schedule also hosts stranded-workspace repair and website reconciliation. These cross-module responsibilities share one invocation and its failure surface. | `CAP-PFM-OPS-002`, `BR-CAP-PFM-OPS-002-10` | Structured evidence | debt | | `FND-PFM-OPS-011` | medium | Licensing decisions and state changes commit before their expected audit entries. A later audit failure can leave an access-affecting change without its security-history account. | `CAP-PFM-OPS-011`, `BR-CAP-PFM-OPS-011-06`, `CAP-PFM-OPS-015`, `BR-CAP-PFM-OPS-015-05` | Structured evidence | defect | | `FND-PFM-OPS-012` | medium | The accepted expiry decision requires renewal warnings beginning sixty days before the term ends. The examined module contains no sender for those warnings. | `CAP-PFM-OPS-012`, `BR-CAP-PFM-OPS-012-07` | Structured evidence | defect | | `FND-PFM-OPS-013` | medium | The pinned operating guide records HubSpot activation as unfinished, with no configured token and unconfirmed property names. Stubbed resolver and sync tests therefore do not establish real-provider behavior. | `CAP-PFM-OPS-012`, `JNY-PFM-OPS-005` | Structured evidence | debt | | `FND-PFM-OPS-014` | medium | Later approved entitlement directions replace parts of the current licensing model, including overrides, product mapping and notice audiences. The examined implementation still uses the earlier model. | `CAP-PFM-OPS-011`, `CAP-PFM-OPS-012`, `CON-PFM-OPS-003` | Structured evidence | debt | | `FND-PFM-OPS-015` | low | The HQ panel requires a twenty-character reason beyond the backend’s nonblank requirement. It also requests a revocation reason that the served route neither accepts nor retains. | `CAP-PFM-OPS-013`, `BR-CAP-PFM-OPS-013-05`, `BR-CAP-PFM-OPS-013-06` | Structured evidence | inconsistency | | `FND-PFM-OPS-016` | medium | The console’s failed-application retry address uses a hyphen where the backend uses an underscore. Shared mocks and tests reproduce the console spelling and therefore miss the integration mismatch. | `CAP-PFM-OPS-013`, `BR-CAP-PFM-OPS-013-07`, `CAP-PFM-OPS-015` | Structured evidence | defect | | `FND-PFM-OPS-017` | low | The workspace application read is claimed by both security and operations. Its licensing rule is retained here, but the overlapping corpus ownership needs reconciliation outside this job’s write scope. | `CAP-PFM-OPS-016`, `CAP-PFM-SEC-002` | Structured evidence | inconsistency | | `FND-PFM-OPS-018` | low | Export allowances are stored in licensing while the export module owns their HQ administration. The licensing guide does not explain this boundary. | `CAP-PFM-OPS-011`, `BR-CAP-PFM-OPS-011-10` | Structured evidence | undocumented | | `FND-PFM-OPS-019` | medium | Current activity removal is limited to workspace retirement, leaving view-event growth unbounded. The recorded retention decision remains deferred with its compliance due date. | `CAP-PFM-OPS-010`, `BR-CAP-PFM-OPS-010-10`, `OQ-PFM-OPS-001` | Structured evidence | debt | | `FND-PFM-OPS-020` | low | The audit guide and seed inventory understate registered view targets and organization tracking. Organizations now report views, committees are registered, and no committee reporting screen is established. | `CAP-PFM-OPS-008`, `BR-CAP-PFM-OPS-008-01` | Structured evidence | inconsistency | | `FND-PFM-OPS-021` | low | The custom-record read writes a visit for every accepted API read, using a server-generated key. Its history therefore includes callers beyond console navigation. | `CAP-PFM-OPS-008`, `BR-CAP-PFM-OPS-008-10` | Structured evidence | undocumented | | `FND-PFM-OPS-022` | low | Current public history reads select view events only. Other stored activity types have no corresponding reader here, and the raw person and colleague history capabilities remain without console screens. | `CAP-PFM-OPS-009`, `CAP-PFM-OPS-010` | Structured evidence | debt | | `FND-PFM-OPS-023` | low | The Scheduled Jobs description and several labels expose internal workspace terminology. The product should use workspace wording on these customer surfaces. | `CAP-PFM-OPS-005`, `CAP-PFM-OPS-007` | Structured evidence | inconsistency | | `FND-PFM-OPS-024` | low | Staff company inspection, manual synchronization and feed-health operations exist without matching HQ screens. | `CAP-PFM-OPS-012`, `CAP-PFM-OPS-013`, `BR-CAP-PFM-OPS-013-08` | Structured evidence | debt | | `FND-PFM-OPS-025` | low | The seven proof gaps identified in the draft remain open. Examination also demotes broader partially bound acceptance matrices, retaining their candidate evidence under the separate proof-strength finding. | `CAP-PFM-OPS-001`, `CAP-PFM-OPS-003`, `CAP-PFM-OPS-006`, `CAP-PFM-OPS-008`, `CAP-PFM-OPS-012`, `CAP-PFM-OPS-013` | Structured evidence | debt | | `FND-PFM-OPS-048` | medium | Interrupted application preparation can remain provisioning indefinitely with no reconciliation or permitted staff retry from that state. | `TC-AVL-004`, `TC-PI-004`, `CAP-PFM-OPS-015`, `BR-CAP-PFM-OPS-015-01`, `BR-CAP-PFM-OPS-015-02` | Structured control evidence | control-gap | | `FND-PFM-OPS-049` | medium | Licensing changes commit before security history and refresh; a failed follow-up can omit the audit and leave access dependent on cache expiry. | `TC-LOG-001`, `TC-AZ-006`, `TC-PI-004`, `CAP-PFM-OPS-011`, `BR-CAP-PFM-OPS-011-06`, `BR-CAP-PFM-OPS-011-07`, `CAP-PFM-OPS-015`, `BR-CAP-PFM-OPS-015-05` | Structured control evidence | control-gap | | `FND-PFM-OPS-050` | medium | Requester-notice outcomes have neither an independent retry sweep nor a concurrency claim protecting a delivered result. | `TC-AVL-004`, `TC-PI-002`, `TC-PI-003`, `TC-PI-004`, `SVC-PFM-OPS-jobs`, `WF-PFM-OPS-004` | Structured control evidence | control-gap | | `FND-PFM-OPS-051` | high | A reconciled final job can miss its failed business consequence because later recovery excludes already settled jobs. | `TC-AVL-004`, `TC-PI-004`, `WF-PFM-OPS-003`, `CAP-PFM-OPS-002` | Structured control evidence | control-gap | | `FND-PFM-OPS-052` | medium | Commercial snapshot replacement has no company-wide lock or source-version guard establishing safe ordering of concurrent reads. | `TC-PI-003`, `WF-PFM-OPS-013` | Structured control evidence | control-gap | | `FND-PFM-OPS-026` | medium | Requester notice claiming permits duplicate delivery during simultaneous pending claims or a send followed by a failed outcome write. Its implemented delivery contract falls short of strict once-only intent. | `CAP-PFM-OPS-003`, `BR-CAP-PFM-OPS-003-11` | Structured evidence | defect | | `FND-PFM-OPS-027` | low | The guide prioritizes staff grants over contract windows, but the resolver reports current and grace contract coverage before grants. Availability can agree while source and reported dates differ. | `CAP-PFM-OPS-014`, `BR-CAP-PFM-OPS-014-02` | Structured evidence | inconsistency | | `FND-PFM-OPS-028` | medium | Acceptance matrices often claim several results while naming one narrow assertion. Candidate bindings remain traceable but cannot stand for complete proof; the mutation example does not test business rollback and the purge example directly deletes an override. | `CAP-PFM-OPS-010`, `CAP-PFM-OPS-015`, `BR-CAP-PFM-OPS-010-06`, `BR-CAP-PFM-OPS-015-09`, `BR-CAP-PFM-OPS-002-09`, `BR-CAP-PFM-OPS-003-09` | Structured evidence | debt | | `FND-PFM-OPS-029` | medium | Contract sync stores new coverage without preparing a missing application despite accepted initialization intent. Recorded provider failure and failed webhook publication also wait for later reconciliation rather than immediate queue retry. | `CAP-PFM-OPS-012`, `BR-CAP-PFM-OPS-012-16`, `BR-CAP-PFM-OPS-012-17`, `BR-CAP-PFM-OPS-012-18`, `BR-CAP-PFM-OPS-012-19` | Structured evidence | defect | | `FND-PFM-OPS-030` | medium | Row insertion handles conflicts, but the wider transition does not lock its initial state check or participant work. Concurrent actions can overwrite later decisions or repeat preparation, without an acceptance matrix establishing safe concurrency. | `CAP-PFM-OPS-015`, `BR-CAP-PFM-OPS-015-08`, `BR-CAP-PFM-OPS-015-10` | Structured evidence | defect | | `FND-PFM-OPS-031` | medium | Following a successful jobs pass, a stranded-provisioning repair exception prevents website reconciliation and fails the invocation. The draft’s independent-pass claim exceeds the handler’s actual failure isolation. | `CAP-PFM-OPS-002`, `BR-CAP-PFM-OPS-002-10` | Structured evidence | inconsistency | | `FND-PFM-OPS-032` | low | The examination adds omitted progress, continuation and deferred-reconciliation rules. Their acceptance matrices remain open, and submission races inside a caller transaction require caller retry rather than always returning the winning job. | `CAP-PFM-OPS-001`, `CAP-PFM-OPS-002`, `BR-CAP-PFM-OPS-001-01`, `BR-CAP-PFM-OPS-001-11`, `BR-CAP-PFM-OPS-001-12`, `BR-CAP-PFM-OPS-002-11`, `BR-CAP-PFM-OPS-002-12` | Structured evidence | debt | | `FND-PFM-OPS-033` | medium | Application preparation writes provisioning, runs its participants and writes its outcome as separate steps. A process that stops between them leaves the application provisioning for ever: nothing reconciles it, staff retry accepts only a failed preparation, and suspension accepts only an enabled one. | `CAP-PFM-OPS-015`, `BR-CAP-PFM-OPS-015-01`, `BR-CAP-PFM-OPS-015-02`, `OQ-PFM-OPS-004` | Structured evidence | defect | | `FND-PFM-OPS-034` | low | Two code headers contradict the code they describe. The licensing routes say the licence step is deployed in shadow mode everywhere, while the deployed mode and the guide say enforce since 2026-10-13. The nightly reconcile says it enqueues every company without a key, while it enqueues nothing. | `CAP-PFM-OPS-012`, `CAP-PFM-OPS-014`, `BR-CAP-PFM-OPS-014-08` | Structured evidence | inconsistency | | `FND-PFM-OPS-035` | low | Company reads are published straight to the sync queue by the webhook, the nightly pass and the company-link change, without the queue row and dispatcher the queued-work standard requires, and the standard does not list this departure. A refused publication relies on the nightly read for recovery. | `CAP-PFM-OPS-012`, `BR-CAP-PFM-OPS-012-17` | Structured evidence | undocumented | | `FND-PFM-OPS-036` | low | The Applications overview screen and the workspace applications read are specified under Console Shell, although the hosted-screen rule gives screens to the module owning their records. This design references them rather than writing a second home; the two modules should agree one home. | `CAP-PFM-OPS-016`, `FND-PFM-OPS-017` | Structured evidence | inconsistency | | `FND-PFM-OPS-037` | medium | The two staff licensing flows order their after-commit steps differently. An override writes its security-history entry before preparation and the access refresh, so a history failure also skips both; an application move requests the refresh before its history entry. The same failure therefore leaves different traces, and an override can take effect only on cache expiry. | `CAP-PFM-OPS-011`, `BR-CAP-PFM-OPS-011-06`, `BR-CAP-PFM-OPS-011-07`, `CAP-PFM-OPS-015`, `BR-CAP-PFM-OPS-015-05`, `OQ-PFM-OPS-005` | Structured evidence | defect | | `FND-PFM-OPS-038` | low | When a browser lacks the standard random identifier, the console mints a visit key that is not a UUID. The server refuses it as a client error, the tracker does not retry a refusal, and every visit from that browser is silently lost. | `CAP-PFM-OPS-008`, `BR-CAP-PFM-OPS-008-06`, `BR-CAP-PFM-OPS-008-09` | Structured evidence | defect | | `FND-PFM-OPS-039` | low | The workspace provisioning retry starts its new execution strictly, so a start failure answers an error after the workspace has moved to provisioning and the retry job exists; the reconciler later restores it. Its submission identity is the instant, so two admitted retries would create two jobs. | `CAP-PFM-OPS-004`, `BR-CAP-PFM-OPS-004-01`, `JNY-PFM-OPS-002` | Structured evidence | inconsistency | | `FND-PFM-OPS-040` | low | The module asks no model a question, so it has no inference directory and every design artifact carries an empty inference list. The conventions ask the module charter to say so in one sentence, and the charter lies outside this design job's write scope. | `MOD-PFM-OPS` | Structured evidence | undocumented | | `FND-PFM-OPS-041` | medium | Requester notices can remain failed or pending indefinitely because no independent retry sweep is declared. Concurrent outcome writers also lack a claim token or state condition and can overwrite a delivered result. Delivery is therefore neither guaranteed nor strictly once-only. | `SVC-PFM-OPS-jobs`, `STATE-PFM-OPS-003`, `WF-PFM-OPS-004`, `ADR-PFM-OPS-004` | Structured evidence | defect | | `FND-PFM-OPS-042` | high | When reconciliation corrects an execution success to job failure because a step remains running or retrying, it applies the business consequence after settlement. If that consequence throws, the job is already final and later stalled-job passes do not retry it; the universal before-settlement guarantee in the planning layer is stronger than this path. | `WF-PFM-OPS-003`, `STATE-PFM-OPS-001`, `ADR-PFM-OPS-003`, `CAP-PFM-OPS-002` | Structured evidence | inconsistency | | `FND-PFM-OPS-043` | medium | Company synchronization replaces each snapshot transactionally but has no company-wide lock or source-version check. Safe ordering and convergence of overlapping company reads are unknown; atomic replacement alone does not establish the draft’s serialization guarantee. | `WF-PFM-OPS-013`, `STATE-PFM-OPS-005`, `ADR-PFM-OPS-012` | Structured evidence | debt | | `FND-PFM-OPS-044` | medium | The bulk development seed has no environment guard and its persistence and audit failures propagate. The per-workspace seed checks the environment, but caller-specific suppression is not established by these functions; the draft’s universal no-op and never-fails guarantees are unsupported. | `WF-PFM-OPS-017` | Structured evidence | inconsistency | | `FND-PFM-OPS-045` | low | Several invariant enforcement claims exceeded their sources: the service preserves first enablement and computes exactly seven grace days, while database checks only constrain the permitted shape. The shared engine also accepts arbitrary execution domain fields rather than enforcing the documented identifiers-only boundary. Corrected design preserves these distinctions; stronger proof remains necessary before treating them as database guarantees. | `DOM-PFM-OPS-001`, `DOM-PFM-OPS-003`, `DOM-PFM-OPS-004` | Structured evidence | debt | | `FND-PFM-OPS-046` | low | The requested design-production brief is absent from the starting checkout and the available brief directories. Examination uses the conventions, templates, module charter and cited product records, so conformity to that missing brief cannot be established. | `MOD-PFM-OPS` | Structured evidence | debt | | `FND-PFM-OPS-047` | high | The task describes an approved planning layer, but every feature, concept, capability and journey in the checkout has draft status and every acceptance set is proposed. Existing recorded product decisions still supply authority for their covered choices; formal planning approval must be confirmed by Andrew before implementation preparation. Examination does not promote these statuses. | `MOD-PFM-OPS` | Structured evidence | inconsistency | | `FND-PFM-OPS-053` | medium | Empty declarations, unknown late step reports and the full progress-weight calculation lack complete scenario trace. | `ATS-PFM-OPS-001` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-054` | medium | Malformed scheduled invocations and competing task-versus-reconciler reports lack complete proof; successful-execution correction retains the previously recorded consequence-ordering defect. | `ATS-PFM-OPS-002` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-055` | medium | Missing jobs or recipient addresses and concurrent senders need complete notification-flow proof, including interrupted delivery-outcome writes. | `ATS-PFM-OPS-003` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-056` | medium | Failed execution stop, failed retry startup and concurrent stop-versus-completion need proof beyond sequential engine cases. | `ATS-PFM-OPS-004` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-057` | medium | Empty or removed run targets, failed monitor reads and paging while job activity changes need dedicated scenario proof. | `ATS-PFM-OPS-005` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-058` | medium | Invalid staff list filters, polling boundaries, response privacy and overlapping refresh need complete proof; the real stalled-work flag remains absent. | `ATS-PFM-OPS-006` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-059` | medium | Unavailable publishers, incompatible contract columns and discovery during new view publication need dedicated boundary and failure proof. | `ATS-PFM-OPS-007` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-060` | medium | Navigation around a removed or newly unreadable target needs additional edge proof; public reporting and immutable storage have separate enforcement boundaries. | `ATS-PFM-OPS-008` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-061` | medium | Excluding non-visit event types, failed history reads and pagination during new visits need complete category proof. | `ATS-PFM-OPS-009` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-062` | medium | Unattributed mutation events, rollback with the owning business change and simultaneous duplicate writes need complete proof at the activity boundary. | `ATS-PFM-OPS-010` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-063` | medium | Concurrent seed selection, competing withdrawals and post-commit follow-up failures need complete flow proof beyond ordinary sequential decisions. | `ATS-PFM-OPS-011` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-064` | medium | Queue receive and retention limits, missing operational preparation after contract sync, concurrent company snapshots and failed transactional replacement need explicit proof. | `ATS-PFM-OPS-012` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-065` | medium | Missing author records, exact dialog limits and refreshed historical decisions need additional proof; the panel’s failed-preparation retry address still differs from the served route. | `ATS-PFM-OPS-013` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-066` | medium | Invalid composite-read inputs, failed persistence reads and availability resolved while its inputs change need additional proof. | `ATS-PFM-OPS-014` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-067` | medium | Participant-free and repeated preparation, exact state-reason limits and stale service checks during competing moves need complete proof; insertion safety does not serialize the transition. | `ATS-PFM-OPS-015` | Structured testing evidence | coverage-gap | | `FND-PFM-OPS-068` | medium | Disabled workspaces, malformed read requests, failed customer reads and refresh during access changes need dedicated proof beyond the normal response and scope checks. | `ATS-PFM-OPS-016` | Structured testing evidence | coverage-gap | ## Open Questions | id | question | why_it_matters | options | recommendation | affects | |---|---|---|---|---|---| | `OQ-PFM-OPS-001` | What retention period should govern record visits? | History grows with navigation and the compliance decision is overdue unless addressed by its recorded deadline. | A: retain until workspace retirement; B: delete after a fixed history period; C: retain a bounded recent set per person. | The product should adopt a fixed retention period that preserves a useful review horizon while bounding storage growth. | `CAP-PFM-OPS-009`, `CAP-PFM-OPS-010` | | `OQ-PFM-OPS-002` | Which destination and channels should requester notices use? | Customer-requested work needs a destination the requester can open, and migration to shared notifications should preserve the same audience meaning. | A: retain staff-only HQ notices; B: choose a destination by requester audience; C: defer audience expansion until shared notifications replace email delivery. | The product should select destinations by audience and preserve that choice when notices move to shared notifications. | `CAP-PFM-OPS-003` | | `OQ-PFM-OPS-003` | Who should receive retry and cancellation controls? | Declared engine support and existing permissions do not establish a consistent management contract across job kinds. | A: retain owner-specific actions; B: offer declared eligible actions in HQ; C: also allow customers to stop their own work. | The product should define HQ management for eligible kinds under explicit authority before extending controls to customers. | `CAP-PFM-OPS-004`, `CAP-PFM-OPS-006` | | `OQ-PFM-OPS-004` | How should an interrupted application preparation be recovered? | An application stranded in provisioning cannot be used, retried or suspended, and nobody is told. | A: make preparation a durable job reconciled like any other; B: add a repair to the five-minute pass that moves a preparation silent past a threshold to failed with a reason; C: let staff retry accept a preparation older than a threshold. | Adopt B now, because no licensed application lists participants yet and the repair is one conditional write, and adopt A when the first application with participants arrives. | `CAP-PFM-OPS-015`, `FND-PFM-OPS-033` | | `OQ-PFM-OPS-005` | Should a staff licensing decision and its security-history entry commit together? | An access-changing decision without its history entry weakens the account auditors read, and today the ordering differs between flows. | A: write the history entry in the decision's own transaction; B: keep after-commit writes but make them retried through a durable outbox; C: keep the current order and accept the gap. | Adopt A, because the security history is a local table and no external call sits between the two writes; then request the refresh last in every flow. | `CAP-PFM-OPS-011`, `CAP-PFM-OPS-015`, `FND-PFM-OPS-011`, `FND-PFM-OPS-037` |