Console shell examination findings and product questions

Findings

id	severity	statement	affects	evidence	kind
FND-PFM-CSH-001	medium	Licensing appears in the shell’s read boundary, while Operations owns the calculation and records. The current scope preserves that separation and claims only the console consumption of the answer.	MOD-PFM-CSH, CAP-PFM-CSH-014, CAP-PFM-CSH-017	Structured evidence	inconsistency
FND-PFM-CSH-002	medium	Source coverage needs the application and workspace integrations as well as the frame. The registered boundary names these implementations so subsequent examinations include their effects.	MOD-PFM-CSH	Structured evidence	inconsistency
FND-PFM-CSH-003	low	Custom Apps is an administrative screen within the registered source boundary, but metadata owns its records and editing policy. This module covers how those records contribute to navigation.	CAP-PFM-CSH-008, BR-CAP-PFM-CSH-008-08	Structured evidence	inconsistency
FND-PFM-CSH-004	low	The inspected acceptance inventories provide no earlier shell capability or journey seed. Existing console tests supply bindings, and the module does not inherit an earlier identifier series.	MOD-PFM-CSH	Structured evidence	undocumented
FND-PFM-CSH-005	medium	The home-page comment describes sample dashboard figures. The live hook actually suppresses the unavailable summary request, so sample figures are restricted to mock mode and the live home explains the missing dashboard connection.	CAP-PFM-CSH-004, BR-CAP-PFM-CSH-004-03	Structured evidence	debt
FND-PFM-CSH-006	medium	Feedback submission displays thanks without delivering the submitted information. The product should connect acknowledgement to durable receipt or explain the current limitation before submission.	CAP-PFM-CSH-005, BR-CAP-PFM-CSH-005-04	Structured evidence	defect
FND-PFM-CSH-007	low	Profile appears among personal actions but has no selection behavior. The product should provide its destination or remove the unusable action.	CAP-PFM-CSH-005, BR-CAP-PFM-CSH-005-05	Structured evidence	defect
FND-PFM-CSH-008	low	The unavailable-page component accepts a detailed explanation, but current callers supply only the console section name. The administrative application view can explain the underlying state while the blocked destination cannot.	CAP-PFM-CSH-015, BR-CAP-PFM-CSH-015-07	Structured evidence	debt
FND-PFM-CSH-009	medium	The recorded renewal decision calls for administrator warnings beginning sixty days before licence expiry. The security context omits the end date needed by that experience, and the shell does not show the agreed warning.	CAP-PFM-CSH-014, CAP-PFM-CSH-017, OQ-PFM-CSH-002	Structured evidence	inconsistency
FND-PFM-CSH-010	low	The accepted application-access design locates the administrator list under licensing. The implemented contract places it alongside workspace resources, leaving the recorded address inconsistent with the service.	CAP-PFM-CSH-017	Structured evidence	inconsistency
FND-PFM-CSH-011	low	The unapproved information architecture describes account notices, recent workspace choices and additional tools and administrative groups that are absent from the console. These proposals remain outside confirmed intent.	CAP-PFM-CSH-001, CAP-PFM-CSH-007, CAP-PFM-CSH-011, BR-CAP-PFM-CSH-007-05	Structured evidence	undocumented
FND-PFM-CSH-012	low	A code comment attributes the built-screen visibility policy to Andrew, but no inspected product record confirms that policy. It remains proposed; planned entries within an eligible section remain part of the current menu.	CAP-PFM-CSH-006, BR-CAP-PFM-CSH-006-04, BR-CAP-PFM-CSH-006-05, OQ-PFM-CSH-003	Structured evidence	undocumented
FND-PFM-CSH-013	low	The console maintains fixed sample-money conversions alongside the separately selected working currency. The product should retire the illustrative conversion mechanism when the live dashboard has an agreed data source.	CAP-PFM-CSH-001, BR-CAP-PFM-CSH-001-07	Structured evidence	debt
FND-PFM-CSH-014	low	Workspace entry, selection and HQ navigation expose internal terminology while other screens use customer-facing wording. The product should adopt consistent customer language across the frame.	CAP-PFM-CSH-010, CAP-PFM-CSH-011, CAP-PFM-CSH-013	Structured evidence	inconsistency
FND-PFM-CSH-015	low	Planned-screen placeholders refer customers to internal migration planning and roadmap material. The product should describe the unfinished destination in customer terms.	CAP-PFM-CSH-009, BR-CAP-PFM-CSH-009-08	Structured evidence	defect
FND-PFM-CSH-016	low	Area-access keys alone do not make an administrative menu useful. The console compensates by checking whether an area contains visible destinations; direct entry still depends on each destination’s guard. This presentation policy has no inspected product decision.	CAP-PFM-CSH-007, BR-CAP-PFM-CSH-007-02	Structured evidence	undocumented
FND-PFM-CSH-017	low	The main shortcut handler is described in a comment as the only keyboard listener, although the sidebar has a separate folding listener. The implementation and comment disagree.	CAP-PFM-CSH-003, BR-CAP-PFM-CSH-003-05	Structured evidence	inconsistency
FND-PFM-CSH-018	low	Navigation writes its fold preference to browser storage but does not restore that preference on a new load. The product should decide whether the stored preference is intended to persist.	CAP-PFM-CSH-002, BR-CAP-PFM-CSH-002-07	Structured evidence	defect
FND-PFM-CSH-019	low	The accepted address record describes a historical designer-width failure on a wide viewport with navigation collapsed. This examination does not rerun that product test, so the present failure state remains unverified.	CAP-PFM-CSH-002, BR-CAP-PFM-CSH-002-06	Structured evidence	debt
FND-PFM-CSH-020	low	The Websites menu link has no application or permission predicate in console navigation. Its owning service therefore remains the authority for any refusal after selection.	CAP-PFM-CSH-006, BR-CAP-PFM-CSH-006-11	Structured evidence	undocumented
FND-PFM-CSH-021	medium	The listed rules lack complete test bindings. Proposed scenarios describe some of the required proof; the remaining rules need scenarios before approval. Source observation does not establish the full browser outcome.	BR-CAP-PFM-CSH-001-04, BR-CAP-PFM-CSH-001-07, BR-CAP-PFM-CSH-002-03, BR-CAP-PFM-CSH-002-05, BR-CAP-PFM-CSH-002-06, BR-CAP-PFM-CSH-002-07, BR-CAP-PFM-CSH-003-01, BR-CAP-PFM-CSH-003-03, BR-CAP-PFM-CSH-004-02, BR-CAP-PFM-CSH-004-06, BR-CAP-PFM-CSH-004-08, BR-CAP-PFM-CSH-005-01, BR-CAP-PFM-CSH-005-02, BR-CAP-PFM-CSH-005-04, BR-CAP-PFM-CSH-005-08, BR-CAP-PFM-CSH-006-06, BR-CAP-PFM-CSH-006-07, BR-CAP-PFM-CSH-006-09, BR-CAP-PFM-CSH-007-02, BR-CAP-PFM-CSH-007-03, BR-CAP-PFM-CSH-007-04, BR-CAP-PFM-CSH-007-06, BR-CAP-PFM-CSH-008-04, BR-CAP-PFM-CSH-008-05, BR-CAP-PFM-CSH-008-06, BR-CAP-PFM-CSH-009-08, BR-CAP-PFM-CSH-010-01, BR-CAP-PFM-CSH-010-03, BR-CAP-PFM-CSH-010-04, BR-CAP-PFM-CSH-010-05, BR-CAP-PFM-CSH-010-08, BR-CAP-PFM-CSH-010-09, BR-CAP-PFM-CSH-010-10, BR-CAP-PFM-CSH-011-01, BR-CAP-PFM-CSH-011-03, BR-CAP-PFM-CSH-011-05, BR-CAP-PFM-CSH-011-07, BR-CAP-PFM-CSH-011-08, BR-CAP-PFM-CSH-012-03, BR-CAP-PFM-CSH-012-04, BR-CAP-PFM-CSH-012-07, BR-CAP-PFM-CSH-013-01, BR-CAP-PFM-CSH-013-02, BR-CAP-PFM-CSH-013-05, BR-CAP-PFM-CSH-013-06, BR-CAP-PFM-CSH-014-02, BR-CAP-PFM-CSH-014-06, BR-CAP-PFM-CSH-015-03, BR-CAP-PFM-CSH-015-05, BR-CAP-PFM-CSH-016-03, BR-CAP-PFM-CSH-016-04, BR-CAP-PFM-CSH-016-05, BR-CAP-PFM-CSH-016-06, BR-CAP-PFM-CSH-017-01, BR-CAP-PFM-CSH-017-08, BR-CAP-PFM-CSH-017-10, BR-CAP-PFM-CSH-017-11, BR-CAP-PFM-CSH-017-12, BR-CAP-PFM-CSH-018-03, BR-CAP-PFM-CSH-018-04	Structured evidence	debt
FND-PFM-CSH-022	low	Test bindings result from reading pinned test titles and assertions. This job runs corpus validation rather than the product suites, so these bindings do not certify passing product tests.	MOD-PFM-CSH	Structured evidence	debt
FND-PFM-CSH-023	low	The shared route-level application check recognizes registered application domains. Administrative areas, tools and HQ destinations depend on their own guards; the shared check does not establish their individual authority.	CAP-PFM-CSH-015, BR-CAP-PFM-CSH-015-05	Structured evidence	undocumented
FND-PFM-CSH-024	low	The compatibility catalogue has a retirement condition requiring Andrew’s confirmation that earlier links are no longer held. No inspected record supplies that confirmation.	CAP-PFM-CSH-012, BR-CAP-PFM-CSH-012-06, OQ-PFM-CSH-001	Structured evidence	debt
FND-PFM-CSH-025	medium	Some original bindings name existing tests that prove only part of a scenario or a different example. Unsupported bindings are removed and the scenarios remain proposed; browser state and cache transitions need direct evidence.	MOD-PFM-CSH	Structured evidence	debt
FND-PFM-CSH-026	medium	A switcher comment describes cache clearing before the destination answer. URL entry clears caches after a successful answer, and the confirmation appears before entry succeeds. The product should decide the intended transition timing and require browser proof.	CAP-PFM-CSH-011	Structured evidence	inconsistency
FND-PFM-CSH-027	medium	An application entry defaults to available whenever its flag is not exactly false, including missing and malformed values. The product should decide whether incomplete answers may offer configuration links and prove that policy.	CAP-PFM-CSH-017, BR-CAP-PFM-CSH-017-11	Structured evidence	defect
FND-PFM-CSH-028	low	Configuration always displays the Command shortcut label while Quick Search adapts to the device. The product should present command hints consistently.	CAP-PFM-CSH-003	Structured evidence	inconsistency
FND-PFM-CSH-029	medium	The original corpus omits the shared record-reference destination catalogue. The added capability covers built-in refusal, encoding and custom fallback; custom fallback checks general read authority without a record-type scope.	CAP-PFM-CSH-018	Structured evidence	undocumented
FND-PFM-CSH-030	low	Reading security context can update the authentication record at a throttled interval. Application refresh also resolves the full security context. Security owns these effects and should examine them as reads with possible writes.	MOD-PFM-CSH	Structured evidence	undocumented
FND-PFM-CSH-031	low	Portal, payment and report-print routes use the shared route library outside the console frame. Operations owns licensing synchronization, reconciliation, export work and its database tests; the shell does not claim those implementations.	MOD-PFM-CSH	Structured evidence	undocumented
FND-PFM-CSH-032	medium	The application-list hook starts before its page guard renders, leaving service refusal necessary even for a denied page. Refresh also shares an in-flight request across workspace changes, so a new refresh can wait on an old result that is discarded. Both transitions need browser proof.	CAP-PFM-CSH-016, CAP-PFM-CSH-017	Structured evidence	debt
FND-PFM-CSH-033	medium	Mock dashboard percentages divide by regional totals or event capacity without a zero guard. Empty totals can produce unreadable percentages. The product should define the empty-total presentation and prove the arithmetic boundaries.	CAP-PFM-CSH-004, BR-CAP-PFM-CSH-004-08	Structured evidence	defect

| FND-PFM-CSH-034 | low | The Orders navigation test attributes its exclusion of Price Schedules to a product ruling, but the inspected source boundary contains no decision record confirming that ruling. The menu behavior remains proposed and the owning product module should supply the decision source. | CAP-PFM-CSH-007, BR-CAP-PFM-CSH-007-10 | Structured evidence | undocumented |

| FND-PFM-CSH-035 | low | RS-20 approved Forge planning moves Accounting within the application registry and preserves the ordering of the remaining entries through existing visibility checks. The delta adds one rule to the existing application-menu capability and three proposed scenarios for rendered adjacency, registry preservation and filtered presentation. The pinned implementation still places Accounting after Marketing; no executed ticket proof is claimed. The design delta is pending approval: Forge has an unapproved design draft, and this module has no design layer to amend. Earlier closed-list planning is superseded by revision two and supplies no obligation here. No journey, feature membership or cross-module contract changes. | CAP-PFM-CSH-006, BR-CAP-PFM-CSH-006-13, ATS-PFM-CSH-006-08, ATS-PFM-CSH-006-09, ATS-PFM-CSH-006-10 | Structured evidence | ticket |

| FND-PFM-CSH-036 | medium | The shell has no service module of its own. Its service contract lists the Security, Metadata and Operations reads it depends on as a consumer, and the application object it designs is the console's view of records Operations owns. When those modules gain a design layer, their contracts become the home of these operations and this contract should cite them rather than describe them. | SVC-PFM-CSH-console-shell, DOM-PFM-CSH-004, ADR-PFM-CSH-001 | Structured evidence | undocumented |

| FND-PFM-CSH-037 | low | The administrator's application read is declared beside the workspace's other routes, computed by licensing, and governed by rules in this module. The registry assigns the declaring module to Security and Workspace Lifecycle and the computation to Operations. Its service contract sits here provisionally until Product names one home; Operations is the recommended owner. | SVC-PFM-CSH-tenant-applications, CAP-PFM-CSH-017 | Structured evidence | inconsistency |

| FND-PFM-CSH-038 | medium | Every read of the security context the shell makes can write: a throttled sign-in stamp, and settlement of ended staff grants inside the same transaction. The application refresh described as a cheap read computes the whole context. Workflows treat these reads as reads with side effects; Security should state the write budget and confirm the throttle covers refresh on focus and after refusals. | WF-PFM-CSH-001, WF-PFM-CSH-002, WF-PFM-CSH-004, WF-PFM-CSH-005, FND-PFM-CSH-030 | Structured evidence | inconsistency |

| FND-PFM-CSH-039 | low | The module asks no model a question; the assistant it hosts belongs to the LLM module. The conventions ask the module charter to say so in one sentence, and this design job may not edit the charter. The next planning revision should add the sentence. | MOD-PFM-CSH | Structured evidence | debt |

| FND-PFM-CSH-040 | low | The console reads the security context's contract version but never compares it with the version it was built for, so a changed contract would be parsed as if it were the known one. The product should refuse or flag an unknown version at start-up. | WF-PFM-CSH-001, DOM-PFM-CSH-001, ADR-PFM-CSH-002 | Structured evidence | defect |

| FND-PFM-CSH-041 | medium | A returning tab and an application refusal refresh only the applications and features. A role or permission withdrawn elsewhere stays in the console's copy until a reload or a workspace change, so the menu can keep offering destinations the services now refuse; those refusals carry no application code and start no refresh. The accepted access design describes refreshing the security context. | WF-PFM-CSH-005, STATE-PFM-CSH-003, ADR-PFM-CSH-006, OQ-PFM-CSH-005 | Structured evidence | inconsistency |

| FND-PFM-CSH-042 | low | The design now carries the RS-20 ordering of Accounting immediately after CRM as a navigation invariant. The pinned registry still places Accounting after Marketing, so the invariant is designed but not built; this resolves the missing design layer noted for RS-20 and leaves the implementation gap open. | DOM-PFM-CSH-002, CAP-PFM-CSH-006, BR-CAP-PFM-CSH-006-13, FND-PFM-CSH-035 | Structured evidence | inconsistency |

| FND-PFM-CSH-043 | low | The console keeps a programmatic workspace switch that no screen calls; the switcher changes the address instead. The two paths treat an out-of-service workspace differently: the unused switch lands in the default workspace with a notice, while address entry shows the unavailable page. The unused path should be removed, or both should share one rule. | WF-PFM-CSH-003, STATE-PFM-CSH-001, SVC-PFM-CSH-console-shell | Structured evidence | debt |

| FND-PFM-CSH-044 | low | The named design brief is absent, the checked-in module still awaits planning approval, and the external ordering approval record is unavailable in this job. Examination proceeds from the pinned planning snapshot and cited product records without granting approval. | MOD-PFM-CSH, ADR-PFM-CSH-002 | Structured evidence | undocumented |

| FND-PFM-CSH-045 | medium | Retry repeats start-up while the failure screen remains visible. Leaving for Rhythm HQ clears the selected workspace after cache clearing without setting the busy flag. The draft lifecycle incorrectly treated both as loading or busy transitions; the design now separates them. | STATE-PFM-CSH-001, WF-PFM-CSH-004, SCR-PFM-CSH-002 | Structured evidence | inconsistency |

| FND-PFM-CSH-046 | medium | The freshness timestamp starts at provider creation and advances on successful refresh responses before the workspace-ticket check. Boot and entry do not reset it. A superseded success can delay a later refresh, while a failure preserves the old timestamp and can leave the list aged; the corrected model records these timing categories. | STATE-PFM-CSH-003, WF-PFM-CSH-005, DOM-PFM-CSH-004 | Structured evidence | defect |

| FND-PFM-CSH-047 | medium | Several controls navigate without checking the destination permission: the Configuration shortcut, View Applications and Open Configuration. Rhythm HQ entries use staff identity and shell mode rather than a separate permission check. Screen contracts now distinguish these controls from the guards at their destinations; the planning permission descriptions remain unchanged. | SCR-PFM-CSH-001, SCR-PFM-CSH-003, SCR-PFM-CSH-005, SCR-PFM-CSH-012, SCR-PFM-CSH-013 | Structured evidence | inconsistency |

| FND-PFM-CSH-048 | medium | The draft overstated cleanup and transaction guarantees. The provider clears SWR data and remounts its keyed subtree, but this does not prove every browser cache is erased or that all service effects are compensated. The administrative read performs independent reads without a declared shared transaction. Workflow repetition can observe changed authority and can trigger Security bookkeeping. | DOM-PFM-CSH-001, SVC-PFM-CSH-console-shell, SVC-PFM-CSH-tenant-applications, WF-PFM-CSH-002, WF-PFM-CSH-008, ADR-PFM-CSH-013 | Structured evidence | inconsistency |

| FND-PFM-CSH-049 | low | The four objects describe client presentation and have no table or metadata registration of their own. The application object no longer lists Operations tables as its physical storage or claims that the administrative service reads client memory. Its custom-field declaration remains absent under the designated-entity standard. The pinned menu ordering differs from the recorded planning delta and remains an open implementation gap. | DOM-PFM-CSH-002, DOM-PFM-CSH-004, ADR-PFM-CSH-014 | Structured evidence | inconsistency |

Open Questions

id	question	why_it_matters	options	recommendation	affects
OQ-PFM-CSH-001	What event ends support for earlier console addresses?	Compatibility carries maintenance cost and can resolve a context-free link through a remembered workspace.	A: retire immediately; B: retire at the first production release; C: retain without an end date.	The product should retain compatibility during internal use and record retirement at the first production release as a dated decision.	CAP-PFM-CSH-012
OQ-PFM-CSH-002	Where do administrators receive the agreed licence-expiry warning?	Administrators need time to respond before product access ends; a list visited only occasionally may not deliver timely notice.	A: an administrator notice in the frame using published expiry information; B: notifications alone; C: the application overview alone.	The product should use a persistent administrator notice supported by an email notification and publish the required expiry information.	CAP-PFM-CSH-001, CAP-PFM-CSH-014, CAP-PFM-CSH-017
OQ-PFM-CSH-003	How do customers encounter destinations whose screens remain planned?	Visible unfinished work affects expectations of what the product can do.	A: retain every planned entry; B: show planned entries only for development and preview; C: omit them until implemented.	The product should keep planned destinations available for internal review and hide them during ordinary customer use.	CAP-PFM-CSH-006, CAP-PFM-CSH-009
OQ-PFM-CSH-004	Where do the workspace home's figures come from, and what does the live home show until they exist?	The live home explains that its dashboard is unavailable while the sample figures exist only in demonstration mode; customers judge the product by its first page.	A: a Platform dashboard summary service; B: home panels composed from saved queries and dashboards owned by Reports & Dashboards; C: remove the figure panels from the live home and keep greeting and attention work only.	The product should remove the sample panels from the live home now and compose later panels from saved queries and dashboards rather than build a separate summary service.	CAP-PFM-CSH-004, SCR-PFM-CSH-008
OQ-PFM-CSH-005	When a tab returns after a while, or a request is refused, should the console refresh the whole security context or only the applications?	A narrow refresh is cheaper but leaves withdrawn roles and permissions in the menu until a reload; a full refresh repeats the context's writes.	A: applications and features only, as built; B: the whole context on return after five minutes, applications alone after an application refusal; C: the whole context on every refusal.	The product should choose B so a returning tab reflects every access change while a refusal stays cheap.	CAP-PFM-CSH-016, WF-PFM-CSH-005, ADR-PFM-CSH-006