Data Job Engine: Findings and Decisions Needed
Findings
Every finding remains open unless its text identifies a narrower correction completed in this examination. Evidence references below distinguish recorded reports from observed code; neither establishes product approval.
| id | severity | statement | affects | evidence | kind |
|---|---|---|---|---|---|
FND-PFM-DJE-001 | high | Workspace activation does not consult Data Run readiness. PLAT-M22 A3 requires an activation refusal when blockers remain, but the cited route changes the workspace state without that check; acceptance proof is also absent. | BR-CAP-PFM-DJE-017-07, CAP-PFM-DJE-017, JNY-PFM-DJE-004 | See pinned finding_evidence | defect |
FND-PFM-DJE-002 | medium | The recorded 90-day evidence and rollback window has no matching cleanup mechanism in the scoped engine. Submission-ledger purging exists, but jobs, receipts and refusals are retained, so the intended retention boundary is not enforced. | BR-CAP-PFM-DJE-005-07, BR-CAP-PFM-DJE-008-04 | See pinned finding_evidence | defect |
FND-PFM-DJE-003 | medium | Expiry is evaluated when a validated job is acted upon rather than by a scheduled sweep. A list can consequently show a validated job whose apply window has elapsed; the blocked acceptance record supplies no executable expiry proof. | BR-CAP-PFM-DJE-002-03 | See pinned finding_evidence | debt |
FND-PFM-DJE-004 | medium | CRM-M7 M2-D13 specifies an automatic-role import switch with an off default. The observed schema has no switch and contact import preserves automatic roles; the bound role test does not establish the requested option or its default. | BR-CAP-PFM-DJE-012-10 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-005 | medium | Backend and console rollback support differ. CRM serves organization-update rollback and the engine supports reversing a rollback, while the console exposes contact-update rollback and uses the contacts bulk alias. | BR-CAP-PFM-DJE-008-07, BR-CAP-PFM-DJE-008-09 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-006 | medium | A record changed through custom fields or collections is excluded as a whole from rollback. Ordinary changes on that same record are therefore left in place, although the update surfaces offer those fields without explaining that restoration limit. | BR-CAP-PFM-DJE-008-05, BR-CAP-PFM-DJE-009-04 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-007 | medium | The counted contact-deletion impact omits cleared task references and duplicate-detection rows. The broader cross-module impact contract in CRM-M7 D-41 remains deferred. | BR-CAP-PFM-DJE-007-09 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-008 | low | The CRM guide mixes obsolete limitations with later functionality. Its unbuilt-items and route descriptions conflict with its file-support and bulk-lane sections and with the organization routes; the conflicting guidance needs correction at its source. | BR-CAP-PFM-DJE-012-09, BR-CAP-PFM-DJE-008-07, MOD-PFM-DJE | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-009 | low | Three inherited inventory descriptions lag the observed behavior: previewed edits now have version protection, small-upload digests are measured, and bulk admission uses a capacity-adjusted service share rather than a fixed worker count. | CAP-PFM-DJE-006, CAP-PFM-DJE-011, CAP-PFM-DJE-014 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-010 | medium | When no storage-supplied full-object digest is available, uploads above the 256 MiB measurement limit retain a declared digest without verification. Run registration compares that recorded value with the manifest rather than proving the file bytes; the large-file integrity decision stays open. | BR-CAP-PFM-DJE-011-06, BR-CAP-PFM-DJE-016-03 | See pinned finding_evidence | debt |
FND-PFM-DJE-011 | low | Upload registration permits JSON documents and zip archives, but the inspected readers do not provide corresponding dataset processing or archive extraction. An accepted upload format is consequently not a guarantee that a job can consume it. | BR-CAP-PFM-DJE-014-02 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-012 | medium | The PLAT-M20 rehearsal records configuration actions failing at Apply through the contacts route. This pass did not rerun the pinned browser journeys or establish the fix, so the rehearsal defect remains an unresolved verification item. | CAP-PFM-DJE-010, JNY-PFM-DJE-003, BR-CAP-PFM-DJE-010-04 | See pinned finding_evidence | debt |
FND-PFM-DJE-013 | medium | Address and phone-number type catalogues lack a status field. Their deactivate path is unavailable, and PLAT-M20 D3 leaves the schema decision with Andrew. | BR-CAP-PFM-DJE-010-05 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-014 | low | PLAT-M20 D2 contains a recommendation for engine-backed configuration activation and deactivation without a recorded answer. Observing its implementation supplies evidence but does not confirm the product decision. | BR-CAP-PFM-DJE-010-04 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-015 | low | The recorded organization-dialog design and the console capability registry disagree. PLAT-M20 D4 describes interactive organization updates, whereas the registry and journey send them through the file wizard. | BR-CAP-PFM-DJE-009-11 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-016 | low | CRM job endpoints require bulk permission, preventing a caller without it from exercising the own-jobs-only visibility branch. Platform custom-record routes provide a surface where that distinction can apply. | BR-CAP-PFM-DJE-005-01 | See pinned finding_evidence | debt |
FND-PFM-DJE-017 | medium | The planned server result tools are absent from the inspected service surfaces. PLAT-M19 R3 and PLAT-M21 call for result search, refusal-code totals and generated exports; the console advertises controls that remain disabled. | BR-CAP-PFM-DJE-005-09 | See pinned finding_evidence | defect |
FND-PFM-DJE-018 | low | CRM file jobs have no preview-before-apply path. Input mistakes can therefore emerge as refusals after accepted records have already been written; this limitation does not apply to every Platform uploaded-dataset operation. | BR-CAP-PFM-DJE-002-06 | See pinned finding_evidence | debt |
FND-PFM-DJE-019 | medium | Membership provides structure operation definitions without the engine persistence, execution surfaces or keyed reconciliation needed for a Data Run participant. Its crosswalk export reports that it does not apply. | BR-CAP-PFM-DJE-018-10, BR-CAP-PFM-DJE-016-12 | See pinned finding_evidence | debt |
FND-PFM-DJE-020 | low | The CRM guide understates keyed lookup coverage: activity and activity-type routes exist in addition to the eight collections it lists. | BR-CAP-PFM-DJE-015-07 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-021 | low | The module assignment includes monthly partition maintenance for eligibility and integration history. Data-job receipts are intentionally unpartitioned, leaving the operational ownership question separate from the engine record model. | CAP-PFM-DJE-020, MOD-PFM-DJE | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-022 | low | Several required-proof branches lack a usable binding or a binding that proves the stated requirement. These include lifecycle and partition contracts outside the inspected scope, blocked acceptance work, rollback authorization, and automatic-role configuration; capacity emergency and failed-signal bindings were corrected in pass 2. | BR-CAP-PFM-DJE-003-08, BR-CAP-PFM-DJE-017-01, BR-CAP-PFM-DJE-017-03, BR-CAP-PFM-DJE-017-08, BR-CAP-PFM-DJE-017-06, BR-CAP-PFM-DJE-016-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-010-02, BR-CAP-PFM-DJE-018-04, BR-CAP-PFM-DJE-018-05, BR-CAP-PFM-DJE-018-06, BR-CAP-PFM-DJE-020-03, BR-CAP-PFM-DJE-008-06, BR-CAP-PFM-DJE-012-10 | See pinned finding_evidence | debt |
FND-PFM-DJE-023 | low | The module registry omits dependent console component/client paths, CRM browser specs and later Platform milestone records. This continuation is restricted to module files and actor rows, so the registry correction is still required rather than claimed complete. | MOD-PFM-DJE | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-024 | low | A producer can create another contact by delivering the same person under a new key without raising a duplicate candidate. The inherited acceptance record treats duplicate detection on import as an undecided product behavior. | BR-CAP-PFM-DJE-012-12 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-025 | low | The console capability commentary says regions have no import route, but the CRM route factory exposes region data jobs. The comment is stale evidence rather than an engine limitation. | CAP-PFM-DJE-001 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-026 | low | Typed e-mail spreadsheet columns affect address ordering without persisting the column type on an address. The source guide leaves that additional data model decision unresolved. | BR-CAP-PFM-DJE-013-07 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-027 | low | Non-numeric, non-date revisions use lexical ordering. A token such as v9 can consequently rank above v10, which producers must account for until a revision-format decision changes the contract. | BR-CAP-PFM-DJE-012-02 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-028 | medium | Overwrite-policy deliveries can replace staff edits where no explicit expected-version guard applies. Record history remains available, but the console does not display the policy or distinguish that overwrite in its job view. | BR-CAP-PFM-DJE-006-05 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-029 | low | The Platform adoption guide identifies three pieces duplicated from CRM that could move into the shared engine package. This is a package-boundary debt item, not evidence that those implementations are interchangeable. | CAP-PFM-DJE-018 | See pinned finding_evidence | debt |
FND-PFM-DJE-030 | low | The CRM guide describes finished-batch progress as always zero, contradicting the cited integration assertion that completed planned batches are counted. The progress explanation is outdated. | BR-CAP-PFM-DJE-005-03 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-031 | high | Parent cancellation can finish while a child continues writing. The driver logs and ignores downstream cancellation errors other than access denial, without checking that every child has stopped. | BR-CAP-PFM-DJE-016-13 | See pinned finding_evidence | defect |
FND-PFM-DJE-032 | medium | Readiness detects an accounted total below the manifest count but does not block an excess. A run with an overcount can therefore receive a ready verdict. | BR-CAP-PFM-DJE-016-10 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-033 | medium | Dataset submission errors escape before the driver records a settled step. The parent can remain running with a pending step, so unreachable-service settlement is not guaranteed by this branch. | BR-CAP-PFM-DJE-016-11 | See pinned finding_evidence | defect |
FND-PFM-DJE-034 | low | The planning acceptance set has no scenario for downstream cancellation failure or transient-read grace. Both observed branches require explicit proof before their recovery guarantees can be approved. | BR-CAP-PFM-DJE-016-13, BR-CAP-PFM-DJE-016-14 | See pinned finding_evidence | debt |
FND-PFM-DJE-035 | medium | Registration locks existing run rows and uses a non-unique package index. Those scoped mechanisms do not establish uniqueness when concurrent registrations find no existing row. | BR-CAP-PFM-DJE-016-05 | See pinned finding_evidence | defect |
FND-PFM-DJE-036 | low | Repeated dataset names in upload entries are accepted into a map whose last value wins. Neither the registration code nor the request schema establishes a unique upload entry per dataset. | BR-CAP-PFM-DJE-016-03 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-037 | low | Destination-environment comparison depends on the process having an environment configured. With that setting absent, registration accepts the manifest environment without comparison. | BR-CAP-PFM-DJE-016-03 | See pinned finding_evidence | undocumented |
FND-PFM-DJE-038 | medium | An unrecognized successful progress payload can become a running status instead of a refusal. Repeated responses of that shape can refresh progress while leaving the step unsettled indefinitely. | BR-CAP-PFM-DJE-016-11 | See pinned finding_evidence | defect |
FND-PFM-DJE-039 | medium | Platform custom-record and association loaders have no matching producer-key reconciliation endpoint. Imported-type reconciliation coverage is therefore narrower than a universal lookup promise. | BR-CAP-PFM-DJE-015-07, CAP-PFM-DJE-018 | See pinned finding_evidence | debt |
FND-PFM-DJE-040 | low | The upload guide labels binary-size arithmetic as 200 GB. Its 24 MiB part size and 8,534-part count describe 200 GiB; the scenario now uses the explicit binary unit. | SC-CAP-PFM-DJE-011-01 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-041 | high | Repeated-group detection retains only a bounded set associated with the most recently closed chunk. Distant repeats and resumed invocations can evade it, so whole-file group atomicity lacks both an implementation guarantee and a matching planning proof. | BR-CAP-PFM-DJE-014-03, BR-CAP-PFM-DJE-014-11 | See pinned finding_evidence | defect |
FND-PFM-DJE-042 | medium | This continuation completes final wording and selected semantic corrections, but not exhaustive examination of every indexed operation, table constraint/policy, permission surface, page, infrastructure recovery branch, compound rule, intent authority or complete test suite. The report retains the exact residual suite inventory; selected anchor and assertion review does not discharge that work. Remaining broad bindings, including compound group ordering and combined live-import/merge behavior, require clause-by-clause proof review. | MOD-PFM-DJE | See pinned finding_evidence | debt |
FND-PFM-DJE-043 | low | The engine security commentary describes receipts as append-only and deletion as mapping-only, but PRIVILEGES grants receipt UPDATE and DELETE on queued batches, submission-ledger rows and mappings. Receipt completion requires mutation; the capability now follows the actual grants and the commentary needs correction. | BR-CAP-PFM-DJE-018-02 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-044 | medium | Upload completion has a recovery gap if storage completes before the database row is saved. The adapter retries multipart completion before HEAD, and the service treats NoSuchUpload as expiry; neither path discovers the already completed object to repair an open session. No crash-recovery behavior test was executed in this examination. | CAP-PFM-DJE-011 | See pinned finding_evidence | defect |
FND-PFM-DJE-045 | low | The design layer found that no service, workflow or screen of this module asks a model anything, so the module has no inference directory; the conventions require the module charter to say so in one sentence, and the charter is a planning artifact this design pass may not edit. | MOD-PFM-DJE | See pinned finding_evidence | undocumented |
FND-PFM-DJE-046 | medium | The console's record-kind registry knows only contacts, organizations and the five configuration catalogues. Regions, activity types, activities, custom field definitions and custom object records have served job routes, but their jobs cannot be started, listed or inspected in Data Imports, and the list reads only CRM's jobs. The list is also read at the contacts address, so a person whose only bulk key is a catalogue's is shown Data Imports but refused its list (inferred from the route keys and the console's alias table). | CAP-PFM-DJE-005, CAP-PFM-DJE-018, SCR-PFM-DJE-002, SCR-PFM-DJE-003, SCR-PFM-DJE-004 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-047 | high | Platform's in-request batch runner claims every queued batch of the workspace, and the claim deletes their queue entries, before running them one by one inside a 30-second function. A request that ends partway leaves pending batches with no queue entry and no schedule to find them; the job reads running, resume and retry refuse a running job, and only cancel settles it. Nothing alerts anyone. | BR-CAP-PFM-DJE-018-05, WF-PFM-DJE-009, ADR-PFM-DJE-019 | See pinned finding_evidence | defect |
FND-PFM-DJE-048 | low | Only CRM calls the 30-day idempotency-ledger purge. Platform's ledger of custom field and custom object record jobs is never trimmed, so its keys answer the original job indefinitely. | BR-CAP-PFM-DJE-005-08, WF-PFM-DJE-018, ADR-PFM-DJE-020 | See pinned finding_evidence | defect |
FND-PFM-DJE-049 | low | The row-level security standard says the data-job refusal rows carry the values a record was refused for, while the engine's refusal record holds codes, field paths, a constraint name and a safe message and never a value. The standard's description needs correcting at its source; the design follows the code and the planning rule. | INV-DOM-PFM-DJE-001-03, BR-CAP-PFM-DJE-003-04 | See pinned finding_evidence | inconsistency |
FND-PFM-DJE-057 | medium | Bulk-job evidence, receipts and refusals have no cleanup enforcing the recorded retention window. | TC-DAT-003, BR-CAP-PFM-DJE-005-07, BR-CAP-PFM-DJE-008-04 | Structured control evidence | control-gap |
FND-PFM-DJE-058 | medium | Migration-package registration protects existing runs but has no uniqueness safeguard for concurrent first registrations. | TC-PI-002, TC-PI-003, BR-CAP-PFM-DJE-016-05 | Structured control evidence | control-gap |
FND-PFM-DJE-059 | medium | A completed multipart object can remain attached to an open upload session after a database failure, and the retry path cannot repair that storage-first result. | TC-AVL-004, TC-PI-004, CAP-PFM-DJE-011 | Structured control evidence | control-gap |
FND-PFM-DJE-060 | high | Concurrent first use of one producer key can create two domain records because the mapping conflict replaces its destination rather than forcing convergence. | TC-PI-002, TC-PI-003, WF-PFM-DJE-007, BR-CAP-PFM-DJE-012-01 | Structured control evidence | control-gap |
| FND-PFM-DJE-050 | high | Two first deliveries of one producer key can both find no mapping and create separate records. The mapping writer updates on conflict, replacing the destination rather than forcing a losing transaction to retry; locking existing rows does not protect absent keys. This contradicts the library commentary and the intended stable producer identity. | INV-DOM-PFM-DJE-004-02, WF-PFM-DJE-007, BR-CAP-PFM-DJE-012-01 | See pinned finding_evidence | defect | | FND-PFM-DJE-051 | medium | Capacity escalation selects the highest level supported by three readings and can enter critical directly from normal. Recovery from emergency restores active stage throttles in a separate tick before stepping down; an active pin also takes precedence over failed signal reads. The design now describes these branches, while the planning narrative still suggests gradual escalation. | STATE-PFM-DJE-006, DOM-PFM-DJE-006, CAP-PFM-DJE-019 | See pinned finding_evidence | inconsistency | | FND-PFM-DJE-052 | low | A concurrent interactive submission that loses the idempotency-key insert rolls back and returns a conflict naming the winning job. Only a subsequent read of the ledger returns that job, so simultaneous identical requests do not both receive the ordinary reuse response. | WF-PFM-DJE-001, CAP-PFM-DJE-001 | See pinned finding_evidence | inconsistency | | FND-PFM-DJE-053 | medium | The requested design brief is absent from this checkout, and the current planning artifacts retain draft status and proposed product intent. Cited approved proposal decisions support selected design choices but do not establish approval of the whole planning layer or readiness for implementation preparation. | MOD-PFM-DJE | See pinned finding_evidence | undocumented | | FND-PFM-DJE-054 | medium | Control actions check the declared transition table, but batch settlement writes state directly. The refusal-rate guard can pause validating work although the table excludes that transition; accepted and completing are declared vocabulary rather than intermediate states written by the examined submission and settlement paths. | INV-DOM-PFM-DJE-001-05, STATE-PFM-DJE-001, WF-PFM-DJE-002, CAP-PFM-DJE-004 | See pinned finding_evidence | inconsistency | | FND-PFM-DJE-055 | low | Collecting all matching records deduplicates independently fetched pages without a shared snapshot token. The collected identifiers are fixed after collection, but the implementation does not establish that they are exactly the query result at one common instant. | SCR-PFM-DJE-008, WF-PFM-DJE-019, CAP-PFM-DJE-009 | See pinned finding_evidence | undocumented |
| FND-PFM-DJE-056 | medium | Bulk menus check the record kind’s bulk permission without checking its update or delete permission. The wizard offers registry-supported kinds under a broad submission alias, rather than filtering kinds by the caller’s keys. These controls can offer actions that the service subsequently refuses; the corrected screen contracts distinguish visibility from authorization. | SCR-PFM-DJE-003, SCR-PFM-DJE-005, SCR-PFM-DJE-006, SCR-PFM-DJE-007, BR-CAP-PFM-DJE-009-01 | See pinned finding_evidence | inconsistency |
| FND-PFM-DJE-061 | medium | Submit an accountable change across many records retains rule, transition, failure, concurrency category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-001, ATS-PFM-DJE-001 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-062 | medium | Review a change before approving its application retains transition, permission, edge, failure, concurrency, invariant category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-002, ATS-PFM-DJE-002 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-063 | medium | Process valid records and report individual refusals retains transition, validation category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-003, ATS-PFM-DJE-003 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-064 | medium | Interrupt a job and recover its unfinished work retains rule, transition, validation, boundary, invariant category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-004, ATS-PFM-DJE-004 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-065 | medium | Inspect job progress and account for its changes retains transition, edge, failure, concurrency category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-005, ATS-PFM-DJE-005 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-066 | medium | Preserve intervening edits during bulk changes retains transition, permission, failure, invariant category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-006, ATS-PFM-DJE-006 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-067 | medium | Approve a counted bulk deletion retains transition, permission, failure, boundary category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-007, ATS-PFM-DJE-007 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-068 | medium | Restore a bulk update while preserving later changes retains rule, transition, failure, invariant category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-008, ATS-PFM-DJE-008 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-069 | medium | Complete selected-record changes from a list dialog retains failure category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-009, ATS-PFM-DJE-009 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-070 | medium | Manage selected configuration items through recorded jobs retains transition, edge, failure, concurrency, invariant category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-010, ATS-PFM-DJE-010 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-071 | medium | Upload a bounded file for reliable job input retains rule, transition, edge, concurrency category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-011, ATS-PFM-DJE-011 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-072 | medium | Import records using their producer identities retains transition, validation, permission, edge, concurrency category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-012, ATS-PFM-DJE-012 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-073 | medium | Translate spreadsheet columns into record details retains transition, permission, concurrency, invariant category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-013, ATS-PFM-DJE-013 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-074 | medium | Process file jobs within shared workload limits retains transition, permission category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-014, ATS-PFM-DJE-014 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-075 | medium | Reconcile loaded records using the producer’s keys retains transition, validation, failure, concurrency category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-015, ATS-PFM-DJE-015 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-076 | medium | Load and reconcile a migration package across its owning applications retains transition, concurrency, invariant category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-016, ATS-PFM-DJE-016 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-077 | medium | Reset a loading workspace and review its release retains transition, edge, failure, concurrency category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-017, ATS-PFM-DJE-017 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-078 | medium | Enable product records to use the shared job engine retains transition, concurrency category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-018, ATS-PFM-DJE-018 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-079 | medium | Control capacity protection during database pressure retains transition, edge, concurrency category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-019, ATS-PFM-DJE-019 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-080 | medium | Maintain and retire monthly history partitions retains rule, validation, permission, edge, boundary, concurrency category gaps. Proposed scenarios and the remaining object transition, permission, invariant and crossing-workflow matrix require executable proof before conformance is established. | CAP-PFM-DJE-020, ATS-PFM-DJE-020 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-081 | medium | Compound inherited scenarios combine different test boundaries; selected assertions do not establish every rule clause, domain invariant or full lifecycle transition. The retained bindings describe their existing evidence and require completion of the clause-level audit. | ATS-PFM-DJE-001, ATS-PFM-DJE-002, ATS-PFM-DJE-003, ATS-PFM-DJE-004, ATS-PFM-DJE-005, ATS-PFM-DJE-006, ATS-PFM-DJE-007, ATS-PFM-DJE-008, ATS-PFM-DJE-009, ATS-PFM-DJE-010, ATS-PFM-DJE-011, ATS-PFM-DJE-012, ATS-PFM-DJE-013, ATS-PFM-DJE-014, ATS-PFM-DJE-015, ATS-PFM-DJE-016, ATS-PFM-DJE-017, ATS-PFM-DJE-018, ATS-PFM-DJE-019, ATS-PFM-DJE-020 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-082 | medium | The reset-eligibility and loading-route browser callbacks only record a blocked reason. Their prior bindings are removed; the scenarios remain proposed until runnable fixtures and assertions exist. | ATS-PFM-DJE-017-01, ATS-PFM-DJE-017-07 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-083 | low | Starting a paused run authorizes the remaining steps and resumes running work. The state model omits this start-triggered move although it describes the explicit Resume action; the transition matrix needs a separate start-from-paused check. | STATE-PFM-DJE-004, CAP-PFM-DJE-016 | See pinned testing_gap_evidence | inconsistency | | FND-PFM-DJE-084 | medium | Feature acceptance is defined for all five scenario kinds, but the composed feature scenarios lack complete executable bindings. Constituent capability assertions cannot establish a whole feature chain by themselves. | FAS-PFM-DJE-01, FAS-PFM-DJE-02, FAS-PFM-DJE-03, FAS-PFM-DJE-04, FAS-PFM-DJE-05, FAS-PFM-DJE-06 | See pinned testing_gap_evidence | coverage-gap | | FND-PFM-DJE-085 | medium | Some registered browser files report blocked work or record a guided rehearsal with deviations. Their existence supplies neither completed behavioural assertions nor qualification; they receive no specification bindings. | TST-PFM-DJE-061, TST-PFM-DJE-067, TST-PFM-DJE-072, TST-PFM-DJE-073, TST-PFM-DJE-074, TST-PFM-DJE-076, TST-PFM-DJE-077, TST-PFM-DJE-078, TST-PFM-DJE-102 | See pinned testing_gap_evidence | coverage-gap |
Open Questions
Recommendations are proposed examination advice. The question_evidence entries identify the originating concern; Andrew owns the product decision.
| id | question | why_it_matters | options | recommendation | affects |
|---|---|---|---|---|---|
OQ-PFM-DJE-001 | What integrity requirement should apply above the upload measurement limit? | Without a supplied full-object digest, a large-file run relies on the producer declaration rather than measured bytes. | (a) Measure in a background completion stage. (b) Check while consuming and refuse mismatches. (c) Explicitly accept declared integrity for large files. | Prefer (a), giving subsequent readers a verified value; this would change the current acceptance of declared-only digests. | BR-CAP-PFM-DJE-011-06, BR-CAP-PFM-DJE-016-03 |
OQ-PFM-DJE-002 | Does Andrew approve engine-backed configuration activation and deactivation under PLAT-M20 D2? | The answer determines whether those status changes use the audited job path. | (a) Use jobs for delete, activate and deactivate. (b) Use jobs only for delete and retain individual status calls. | Prefer (a) for a consistent recorded operation path; the existing implementation is evidence, not approval. | BR-CAP-PFM-DJE-010-04, CAP-PFM-DJE-010 |
OQ-PFM-DJE-003 | Should address and phone-number types gain a status under PLAT-M20 D3? | An in-use type cannot currently be retired through a deactivate action. | (a) Introduce status on both catalogues. (b) Retain their delete-only model. | Prefer (a), subject to the owning module decision, so retirement can preserve existing references. | BR-CAP-PFM-DJE-010-05 |
OQ-PFM-DJE-004 | Where should monthly partition maintenance be specified? | Its current assignment groups operational history maintenance with an engine whose evidence tables are unpartitioned. | (a) Retain this module assignment. (b) Assign Platform jobs, audit and licensing. (c) Establish a separately approved storage module. | Prefer (b) alongside scheduled operational maintenance; no ownership change is made here. | CAP-PFM-DJE-020 |
OQ-PFM-DJE-005 | Should keyed imports request duplicate detection when a new key matches an existing person? | Key changes or another producer can introduce another contact for the same person. | (a) Request detection for ongoing feeds, excluding initial loads. (b) Depend on scheduled rescans. (c) Exclude imports from detection. | Prefer (a), distinguishing routine feeds from an initial package that is reconciled separately. | BR-CAP-PFM-DJE-012-12 |
OQ-PFM-DJE-006 | Should contact e-mail addresses persist the type specified by an import column? | Work and personal labels currently influence ordering without surviving as address metadata. | (a) Add an address type through the owning record model. (b) Preserve ordering-only interpretation. | Prefer (a) if imported and manually edited addresses are expected to retain the same classification. | BR-CAP-PFM-DJE-013-07 |
OQ-PFM-DJE-007 | Should a data job tell its submitter when it finishes, rather than being polled? | Large imports and data runs take hours; today staff and integrations must keep reading the job, and nothing notices a job left paused or failed. | (a) Emit a job-settled business event and let Notifications tell the submitter. (b) Emit the event only, for integrations to subscribe. (c) Keep polling only. | Prefer (a): one event per final state (and per pause by the guard), consumed by Notifications for people and available to integrations. | DOM-PFM-DJE-001, ADR-PFM-DJE-018, CAP-PFM-DJE-005 |
OQ-PFM-DJE-008 | Should the capacity sentinel's emergency stage throttles be switched on in production? | The switch ships off everywhere, so a sustained emergency halves internal write and read factors but never lowers API limits; switching it on protects the database at the cost of refusing callers. | (a) Switch on in production after the load scenarios confirm the thresholds. (b) Keep off and rely on staff pins. (c) Switch on now. | Prefer (a); the approved workload governance values are starting values pending measurement. | DOM-PFM-DJE-006, ADR-PFM-DJE-013, CAP-PFM-DJE-019 |