---
id: WF-PFM-QRY-012
title: Page a saved query's records for another application
trigger: Accounting or Marketing requests a population page or count for a named person in a workspace.
product_area: platform
module: queries
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
inference: []
implements:
  - CAP-PFM-QRY-007
crosses:
  - SVC-PFM-QRY-queries
idempotency: >-
  A cursor binds ordering and the query fingerprint; changed criteria reject it. Retrying the cursor
  does not freeze records or guarantee identical values while the underlying data changes.
concurrency: >-
  Accounting has its dedicated single-concurrency invocation boundary; Marketing uses its configured
  environment limit. Population pages obey the statement timeout.
hops:
  - 'n': 1
    actor_or_service: Accounting or Marketing service role
    action: >-
      Invoke the application-specific live function with the operation, workspace, person and source
      question or embedded definition.
    anchor: 'services-platform:modules/queries/aws/logic/queries-record-ids.lambda.ts'
    seam: sync
    on_failure: Function failures or throttling return control to the caller’s retry policy.
    left_inconsistent: This read does not persist a population snapshot.
    observer: the caller
    provenance: observed
    source: 'services-platform:modules/queries/aws/logic/queries-marketing-record-ids.lambda.ts'
  - 'n': 2
    actor_or_service: Record ids invocation
    action: >-
      Validate the invocation and reconstruct an eligible person context before opening the saved
      source.
    anchor: 'services-platform:modules/queries/services/saved-queries/record-ids-invocation.ts'
    seam: sync
    on_failure: Return structured access or payload refusal codes.
    left_inconsistent: No population is returned after refusal.
    observer: the caller; logs carry ids and codes only
    provenance: observed
    source: 'services-platform:modules/queries/services/saved-queries/person-execution-context.ts'
  - 'n': 3
    actor_or_service: Saved query record ids
    action: >-
      Check the current definition and population restrictions, substitute permissible defaults and
      order by record identity.
    anchor: 'services-platform:modules/queries/services/saved-queries/saved-query-record-ids.ts'
    seam: sync
    on_failure: Refuse an invalid population source without execution.
    left_inconsistent: The caller receives no partial successful page.
    observer: the caller
    provenance: observed
    source: 'services-platform:modules/queries/services/saved-queries/saved-query-record-ids.ts'
  - 'n': 4
    actor_or_service: Ordered record ids
    action: >-
      Execute a bounded page or count with its fingerprint and continuation; Marketing field reads
      use the person context too.
    anchor: 'services-platform:modules/queries/services/execute/ordered-record-ids.ts'
    seam: sync
    on_failure: Database faults propagate to the invoking workflow.
    left_inconsistent: Another attempt can observe intervening record changes.
    observer: 'logs of criteria shape, never values or ids'
    provenance: observed
    source: 'services-platform:modules/queries/services/execute/ordered-record-ids.ts'
branches:
  - Remote invocation is enabled only through the corresponding configured lifecycle participant.
waits: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/queries/aws/logic/queries-record-ids.lambda.ts,
    queries-marketing-record-ids.lambda.ts; services/saved-queries/*record-ids*.ts;
    services/execute/ordered-record-ids.ts; docs/queries/marketing-record-ids.md;
    docs/queries/saved-queries-and-recipes.md
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-DAT-001, TC-DAT-003, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Page a saved query's records for another application

## What It Does

Accounting or Marketing requests a population page or count for a named person in a workspace. Remote invocation is enabled only through the corresponding configured lifecycle participant.

## The Flow

```mermaid
sequenceDiagram
  participant C as Request or schedule
  participant H0 as Accounting or Marketing service role
  participant H1 as Record ids invocation
  participant H2 as Saved query record ids
  participant H3 as Ordered record ids
  C->>H0: Invoke the application-specific live function with the operation, workspace, person and source quest
  H0->>H1: Validate the invocation and reconstruct an eligible person context before opening the saved source
  H1->>H2: Check the current definition and population restrictions, substitute permissible defaults and order 
  H2->>H3: Execute a bounded page or count with its fingerprint and continuation
```

Invoke the application-specific live function with the operation, workspace, person and source question or embedded definition. Validate the invocation and reconstruct an eligible person context before opening the saved source. Check the current definition and population restrictions, substitute permissible defaults and order by record identity. Execute a bounded page or count with its fingerprint and continuation; Marketing field reads use the person context too.

## When Something Fails

Function failures or throttling return control to the caller’s retry policy. This read does not persist a population snapshot. Return structured access or payload refusal codes. No population is returned after refusal. Refuse an invalid population source without execution. The caller receives no partial successful page. Database faults propagate to the invoking workflow. Another attempt can observe intervening record changes.

## Idempotency and Concurrency

A cursor binds ordering and the query fingerprint; changed criteria reject it. Retrying the cursor does not freeze records or guarantee identical values while the underlying data changes. Accounting has its dedicated single-concurrency invocation boundary; Marketing uses its configured environment limit. Population pages obey the statement timeout.