Findings and Open Questions: Eligibility, Responsibilities and Attention
Findings
| id | severity | statement | affects | evidence | kind |
|---|---|---|---|---|---|
FND-PFM-ELG-001 | medium | The original source registry omitted hosted eligibility, responsibility and attention surfaces and acceptance evidence. The module scope is corrected so future examinations use the complete boundary. | MOD-PFM-ELG | Structured evidence | inconsistency |
FND-PFM-ELG-002 | low | The responsibility and attention acceptance suite appears in both this module’s source scope and Security’s scope. Its responsibility journeys are bound here; Security’s registry needs to identify the particular journeys it owns rather than claim the entire suite. | MOD-PFM-ELG | Structured evidence | inconsistency |
FND-PFM-ELG-003 | low | The source module document’s opening combines incompatible accounts of whether evaluation, compilation, bulk work and derived roles are implemented. Its later sections describe the implemented behavior more accurately; the introduction needs revision. | MOD-PFM-ELG | Structured evidence | inconsistency |
FND-PFM-ELG-004 | low | The eligibility decision register describes some choices as internally reported, while the milestone record approves the proposal and its decision groups. This layer reads that approval as covering the cited internal choices; Andrew needs to confirm that interpretation. | BR-CAP-PFM-ELG-006-01, BR-CAP-PFM-ELG-004-02, BR-CAP-PFM-ELG-007-05, BR-CAP-PFM-ELG-008-12 | Structured evidence | inconsistency |
FND-PFM-ELG-005 | medium | Retirement permission descriptions promise withdrawing a published version, but no route exposes that action. They also attribute deprecation and archive to write authority although the routes require retire authority, and the published key count differs from its comment. | BR-CAP-PFM-ELG-005-01, BR-CAP-PFM-ELG-005-09, CAP-PFM-ELG-005 | Structured evidence | inconsistency |
FND-PFM-ELG-006 | low | Optional shared-rule publishing approval has no enabling setting or approval operation. The console’s conditional stage therefore never applies despite the approved off-by-default design. | BR-CAP-PFM-ELG-004-13 | Structured evidence | debt |
FND-PFM-ELG-007 | medium | The approved product-card decision requires an enforcement-release notice until Commerce is ready. The card lacks that notice, and Commerce readiness is outside this source boundary. | BR-CAP-PFM-ELG-007-14, JNY-PFM-ELG-002 | Structured evidence | inconsistency |
FND-PFM-ELG-008 | medium | The approved consumer-process architecture has an internal evaluator but no published consumer package. Applications still depend on Platform calls. | BR-CAP-PFM-ELG-008-15 | Structured evidence | debt |
FND-PFM-ELG-009 | high | Platform’s record describes CRM’s younger-than age declaration as producing an at-least comparison. The declaration must be verified in CRM before affected rules can be described as correct. | CAP-PFM-ELG-008 | Structured evidence | defect |
FND-PFM-ELG-010 | medium | Event invalidation awaits CRM registration and event-enabled condition declarations. Route answer caching also lacks subject indexing, so delivered events do not establish complete cache refresh. | BR-CAP-PFM-ELG-010-04, BR-CAP-PFM-ELG-010-01 | Structured evidence | debt |
FND-PFM-ELG-011 | medium | Bulk-run and simulation retention have expiry code without a deployed cleanup schedule. The intended 90-day and 30-day periods are therefore not automatically enforced. | BR-CAP-PFM-ELG-011-08 | Structured evidence | debt |
FND-PFM-ELG-012 | low | Published effective-range overlap is rejected by service validation without the planned database exclusion constraint. | BR-CAP-PFM-ELG-004-04 | Structured evidence | debt |
FND-PFM-ELG-013 | low | Sampled display decisions are persisted after answering without an outbox. A failed write can lose history and produces only a log record. | BR-CAP-PFM-ELG-009-07 | Structured evidence | debt |
FND-PFM-ELG-014 | low | Consumer-transaction evaluation depends on a warm dataset-description cache. A cold process can fail before producing the intended transactional answer. | BR-CAP-PFM-ELG-008-12 | Structured evidence | debt |
FND-PFM-ELG-015 | medium | A missing role binding rejects a whole derived-role evaluation batch. Security cannot update the other holdings in that batch, leaving existing grants until expiry. | CAP-PFM-ELG-010 | Structured evidence | debt |
FND-PFM-ELG-016 | medium | Population and simulation implementation exists while its milestone remains proposed. The permission to enumerate qualifying subjects is still an explicit Product question. | CAP-PFM-ELG-011, BR-CAP-PFM-ELG-011-01 | Structured evidence | inconsistency |
FND-PFM-ELG-017 | high | Current reminder delivery and personal timing settings conflict with Andrew’s later Notifications boundary. Attention still sends communications e-mail and retains digest and quiet-hour settings that the approved scope drops. | BR-CAP-PFM-ELG-019-06, BR-CAP-PFM-ELG-019-08, CAP-PFM-ELG-020 | Structured evidence | inconsistency |
FND-PFM-ELG-018 | medium | The shared attention-settings screen and personal preference panel remain absent. List code also retains obsolete comments about server sorting and locally orders loaded results. | BR-CAP-PFM-ELG-020-09, CAP-PFM-ELG-020 | Structured evidence | debt |
FND-PFM-ELG-019 | medium | A declared application reminder policy can enable reminders without administrator action. This differs from the approved default-off decision. | BR-CAP-PFM-ELG-019-07 | Structured evidence | inconsistency |
FND-PFM-ELG-020 | low | The later security milestone still lists system-only purpose refusal as an open choice although eligibility already rejects console requests for those purposes. | BR-CAP-PFM-ELG-008-08 | Structured evidence | inconsistency |
FND-PFM-ELG-021 | low | Attention merge redirection is documented but has no identified proving test within this module boundary. Its acceptance scenario remains proposed. | BR-CAP-PFM-ELG-016-12 | Structured evidence | debt |
FND-PFM-ELG-022 | low | Bulk work exposes no list or cancellation action. Repeated starts create separate runs whose lookup depends on retaining their returned identities. | BR-CAP-PFM-ELG-011-10 | Structured evidence | debt |
FND-PFM-ELG-023 | low | The planned eligibility reporting dataset is not registered. Rule discovery uses its own persistence queries. | BR-CAP-PFM-ELG-002-11 | Structured evidence | debt |
FND-PFM-ELG-024 | low | Attention lifecycle business events remain absent. Portal reads are held, leaving stored member audiences without a presented portal path or proof of the portal slice. | CAP-PFM-ELG-016, CAP-PFM-ELG-017 | Structured evidence | debt |
FND-PFM-ELG-025 | low | The seed acceptance inventory describes an earlier implementation. Several listed gaps are now implemented and conversion is retired, while its unused code and review storage remain. | MOD-PFM-ELG | Structured evidence | inconsistency |
FND-PFM-ELG-026 | low | Responsibility management can be scoped to an area in its permission declaration, but the routes do not yet consume that scoped grant. | BR-CAP-PFM-ELG-013-03 | Structured evidence | debt |
FND-PFM-ELG-027 | low | The architecture’s shared stored tests conflict with the approved browser-only milestone choice. The architecture has not recorded that later override. | BR-CAP-PFM-ELG-003-07 | Structured evidence | inconsistency |
FND-PFM-ELG-028 | low | The requested planning brief is absent from this checkout and local history. Its original directions and scope cannot be independently compared. | MOD-PFM-ELG | Structured evidence | undocumented |
FND-PFM-ELG-029 | high | The checkout specification contains only pending-build failures. It supplies no evidence that Commerce enforces qualification or records checkout refusals. | JNY-PFM-ELG-002 | Structured evidence | debt |
FND-PFM-ELG-030 | medium | Nine cited bulk-work and invalidation files contain unreachable steps or conditional blockers, sometimes alongside real intermediate assertions. Complete-scenario proof is overstated by those whole-file bindings; backend evidence remains and browser boundaries need repair. | ATS-PFM-ELG-010, ATS-PFM-ELG-011 | Structured evidence | debt |
FND-PFM-ELG-031 | medium | Platform binding routes require binding-management authority but do not separately check authority to edit the consumer record. The original draft asserted that additional boundary. | BR-CAP-PFM-ELG-007-01 | Structured evidence | inconsistency |
FND-PFM-ELG-032 | low | The approved tester wording uses Can’t tell, whereas the console presents Unknown and a separate Skipped state. Product terminology needs a consistent recorded choice. | BR-CAP-PFM-ELG-003-06, JNY-PFM-ELG-001 | Structured evidence | inconsistency |
| FND-PFM-ELG-033 | medium | Route and table mapping is complete, but the retained specification citations leave 28 integration files, 21 unit files and 250 eligibility browser files unbound. Some concern other modules or retired conversion; the remaining case-level coverage needs explicit ownership and rule mapping before exhaustive acceptance coverage can be claimed. | MOD-PFM-ELG | Structured evidence | undocumented |
| FND-PFM-ELG-034 | medium | Required proof now includes calculations, refusals and writes previously marked optional. The named rules still need complete acceptance scenarios for paging bounds, decision-write timing and failure, declaration-refresh version refusal, workspace purge, first-use default writes, assignment auditing and paging, derived synchronization, retention with recurrence, and automatic or explicit snooze return; existing narrower tests and documentation do not prove every boundary. | BR-CAP-PFM-ELG-002-05, BR-CAP-PFM-ELG-009-07, BR-CAP-PFM-ELG-010-06, BR-CAP-PFM-ELG-011-09, BR-CAP-PFM-ELG-013-10, BR-CAP-PFM-ELG-013-14, BR-CAP-PFM-ELG-015-08, BR-CAP-PFM-ELG-016-11, BR-CAP-PFM-ELG-018-06, BR-CAP-PFM-ELG-015-09 | Structured evidence | debt | | FND-PFM-ELG-035 | medium | Rule draft saves, deprecation, archiving, deletion, restoration and reference migration proceed against the current record when the caller omits the version it read, contrary to the record-write standard's version rule. The console omits the version on every lifecycle action and re-reads a use's version immediately before Follow Latest, so concurrent changes are overwritten silently. | BR-CAP-PFM-ELG-001-05, BR-CAP-PFM-ELG-005-08, ADR-PFM-ELG-022, SCR-PFM-ELG-007, SCR-PFM-ELG-009 | Structured evidence | inconsistency | | FND-PFM-ELG-036 | low | No code in the module asks a model, so the design layer has no inference operations. The authoring conventions require the module charter to say so in one sentence; the charter is a planning artifact this design job may not edit. | MOD-PFM-ELG | Structured evidence | undocumented | | FND-PFM-ELG-037 | low | Cover can be arranged for a person's derived and template holdings as well as direct ones, and delegating everything includes them, while the planning rules speak of direct holdings only. Derived synchronization ends holdings without ending their cover; effective holder reads require the underlying holding to remain effective, so ended derived holdings no longer supply cover even when the arrangement row remains active. | BR-CAP-PFM-ELG-014-02, BR-CAP-PFM-ELG-014-04, STATE-PFM-ELG-006, WF-PFM-ELG-014 | Structured evidence | inconsistency | | FND-PFM-ELG-038 | medium | Changing a product to another shared rule deletes the old use before binding the new one. When the bind is refused the removal is not reversed, and the product is left with no qualification rule; only the card's message reports it. | BR-CAP-PFM-ELG-007-14, JNY-PFM-ELG-002, WF-PFM-ELG-021, SCR-PFM-ELG-010 | Structured evidence | defect | | FND-PFM-ELG-039 | low | Saving a rule just for one product publishes it from the card, so the person needs publish authority as well as write and binding authority; a pricing manager without it can never complete the save and the card disables Save with a sentence naming the missing permission. Whether pricing managers should receive that authority remains a product question. | BR-CAP-PFM-ELG-007-14, WF-PFM-ELG-021, SCR-PFM-ELG-010 | Structured evidence | undocumented | | FND-PFM-ELG-040 | low | Open items of a retired attention kind are resolved after registration commits and repaired by the sweep for seven days only. Items left open after that stay stored but unseen until their month is dropped. | BR-CAP-PFM-ELG-016-02, WF-PFM-ELG-015 | Structured evidence | debt |
| FND-PFM-ELG-041 | low | The requested design brief is absent from this checkout and its local branch history. Its instructions cannot be independently compared; the supplied job, templates and approved planning records define this examination. | MOD-PFM-ELG | Structured evidence | undocumented | | FND-PFM-ELG-042 | medium | Personal attention actions lock existing response rows but do not lock missing rows or recheck occurrence and audience inside the write transaction. Concurrent first actions can collide, and closure or audience changes can race an accepted action. | STATE-PFM-ELG-008 | Structured evidence | defect | | FND-PFM-ELG-043 | medium | Direct-holding uniqueness compares identical validity endpoints rather than excluding overlapping windows. Distinct overlapping windows can create duplicate effective holdings, contrary to the planning rule. | BR-CAP-PFM-ELG-013-05 | Structured evidence | inconsistency | | FND-PFM-ELG-044 | high | Reminder delivery checks item, personal state, policy and address but does not resolve current audience membership. A former holder can receive a queued reminder after losing responsibility or cover. | WF-PFM-ELG-018 | Structured evidence | defect | | FND-PFM-ELG-045 | medium | The bell estimates required unread totals by subtracting acknowledged items from the small summary sample instead of using the authoritative unread totals. Acknowledged items outside that sample can inflate the badge. | SCR-PFM-ELG-003 | Structured evidence | defect | | FND-PFM-ELG-046 | medium | Communication acceptance and reminder sent stamps do not share a transaction. The delivery key hashes the complete due-row cohort, so a changed cohort after a stamp failure can repeat an already accepted reminder. | WF-PFM-ELG-018 | Structured evidence | defect | | FND-PFM-ELG-047 | low | Closed attention keys are deleted after fourteen idle months. Republishing after deletion can reuse generation one, so generation permanence does not hold across cleanup even though occurrence identity remains distinct. | INV-DOM-PFM-ELG-005-01 | Structured evidence | inconsistency | | FND-PFM-ELG-048 | medium | Delegation checks the underlying holding stored status and end but does not constrain the cover start to the holding start. Future or temporally lapsed holdings still stored active may pass creation checks, although effective holder reads suppress ineffective coverage. | WF-PFM-ELG-013 | Structured evidence | defect | | FND-PFM-ELG-049 | low | My Responsibilities exposes bulk delegation but no single-holding delegation control, and ending cover has no confirmation. The product card confirms private-rule removal but changes and removes shared uses directly. The draft screen contracts overstated the built controls. | SCR-PFM-ELG-004, SCR-PFM-ELG-010 | Structured evidence | inconsistency | | FND-PFM-ELG-050 | medium | Platform merge code redirects subjects, audiences and personal responses but does not move the provider-owned about reference. A helper exists to resolve an occurrence; no provider merge hook or guaranteed later repair is established within the permitted source boundary. | WF-PFM-ELG-020 | Structured evidence | undocumented | | FND-PFM-ELG-051 | low | The approved architecture calls for consumer-process evaluation; the unpublished package and hosted interim path are observed implementation, without a cited product decision approving that deferral. The corresponding decision record is proposed. | ADR-PFM-ELG-002 | Structured evidence | inconsistency | | FND-PFM-ELG-052 | medium | The SQL-only transactional check returns state, reasons and trace without inserting decision history. Indeterminate display answers selected for recording are deferred and can be lost. Universal transactional-history and before-answer uncertainty guarantees therefore exceed implementation. | BR-CAP-PFM-ELG-009-07, WF-PFM-ELG-005 | Structured evidence | inconsistency |
| FND-PFM-ELG-053 | medium | Draft authoring lacks a separate negative write-authority case and injected save failures. Immutable release editing and draft replacement under a concurrent lifecycle change need explicit proof. | ATS-PFM-ELG-001, CAP-PFM-ELG-001 | Structured evidence | coverage-gap | | FND-PFM-ELG-054 | medium | Explorer paging needs exact default and maximum page sizes, cursor traversal and concurrent dependency changes. The reporting promise has no executable dataset proof. | ATS-PFM-ELG-002, CAP-PFM-ELG-002 | Structured evidence | coverage-gap | | FND-PFM-ELG-055 | medium | Saved browser examples, subject-name-only projection and trial failures during data access need detailed scenarios. Concurrent trial and publication consistency is not specified by the current trial cases. | ATS-PFM-ELG-003, CAP-PFM-ELG-003 | Structured evidence | coverage-gap | | FND-PFM-ELG-056 | medium | Publication audit failure and post-commit role queue failure need injected-failure scenarios. Persistence-only retirement paths and guard failures are not covered as complete lifecycle transitions. | ATS-PFM-ELG-004, CAP-PFM-ELG-004 | Structured evidence | coverage-gap | | FND-PFM-ELG-057 | medium | Archive and bind races, failed reference republication, self-replacement constraints and all restoration paths need explicit cases. Withdrawal of a numbered release has no public operation. | ATS-PFM-ELG-005, CAP-PFM-ELG-005 | Structured evidence | coverage-gap | | FND-PFM-ELG-058 | medium | Registration needs transport failure, simultaneous changed manifests and whole-manifest rollback at every declaration seam. No staff mutation route exists, so route absence needs proof rather than a positive permission case. | ATS-PFM-ELG-006, CAP-PFM-ELG-006 | Structured evidence | coverage-gap | | FND-PFM-ELG-059 | medium | Binding creation and publication lock races, failed consumer dispatch and every active or suspended deletion path need complete cases. Product changes can lose their former connection after a refused replacement. | ATS-PFM-ELG-007, CAP-PFM-ELG-007 | Structured evidence | coverage-gap | | FND-PFM-ELG-060 | medium | The hosted evaluator lacks a complete cache, history and diagnostic failure chain. The cold transactional dataset cache and SQL-only history path limit equivalence with in-process evaluation. | ATS-PFM-ELG-008, CAP-PFM-ELG-008 | Structured evidence | coverage-gap | | FND-PFM-ELG-061 | medium | History-write ordering needs injected authorization and sampled display failures and a SQL-only control. Exact paging sizes, purge failure and concurrent retention reads need proof. | ATS-PFM-ELG-009, CAP-PFM-ELG-009 | Structured evidence | coverage-gap | | FND-PFM-ELG-062 | medium | Event declaration version refusal, cross-process cache invalidation and queue insertion failure need complete scenarios. Event delivery is not wired across the claimed source boundary. | ATS-PFM-ELG-010, CAP-PFM-ELG-010 | Structured evidence | coverage-gap | | FND-PFM-ELG-063 | medium | Bulk-work failure settlement, all terminal retention paths, cancellation route absence and workspace purge need complete cases. Completed simulations must be checked under racing draft changes and page retries. | ATS-PFM-ELG-011, CAP-PFM-ELG-011 | Structured evidence | coverage-gap | | FND-PFM-ELG-064 | medium | Health-request authority and public build presentation have no detailed cases. Alarm thresholds need below, equal and above controls; delayed or missing diagnostic delivery and concurrent dimensions need proof. | ATS-PFM-ELG-012, CAP-PFM-ELG-012 | Structured evidence | coverage-gap | | FND-PFM-ELG-065 | medium | Unequal overlapping holding periods contradict the planned uniqueness rule. First-use defaults, audit rollback, list paging, derived or default endings and timed lapsed coverage need explicit proof. | ATS-PFM-ELG-013, CAP-PFM-ELG-013 | Structured evidence | coverage-gap | | FND-PFM-ELG-066 | medium | Cover duration tests do not establish holding-start containment. Cover of derived or template holdings, expiry without a sweep, notice failures and competing cover endings need explicit cases. | ATS-PFM-ELG-014, CAP-PFM-ELG-014 | Structured evidence | coverage-gap | | FND-PFM-ELG-067 | medium | Derived synchronization needs complete validation, transactional audit and serialization scenarios. Uncovered-area attention failure, reader refusal and a repeated reconciliation spanning inactive cover need proof. | ATS-PFM-ELG-015, CAP-PFM-ELG-015 | Structured evidence | coverage-gap | | FND-PFM-ELG-068 | medium | Occurrence retention and recurrence, merge redirection, computed query failure and retirement beyond the repair window need explicit proof. Provider refresh and manual resolution races remain unverified. | ATS-PFM-ELG-016, CAP-PFM-ELG-016 | Structured evidence | coverage-gap | | FND-PFM-ELG-069 | medium | Attention summary and bell agreement needs an acknowledgement outside the displayed sample. Read failures, concurrent audience changes during paging and every permission key require independent negative controls. | ATS-PFM-ELG-017, CAP-PFM-ELG-017 | Structured evidence | coverage-gap | | FND-PFM-ELG-070 | medium | Automatic snooze return, retained acknowledgement after expiry and explicit return need independent cases. First-action collisions and closure or audience changes during an action need race tests. | ATS-PFM-ELG-018, CAP-PFM-ELG-018 | Structured evidence | coverage-gap | | FND-PFM-ELG-071 | medium | Default-off intent and the Notifications handoff lack conforming executable proof. Lost audience membership before sending, failed sent stamping and concurrent delivery cohorts need cases. | ATS-PFM-ELG-019, CAP-PFM-ELG-019 | Structured evidence | coverage-gap | | FND-PFM-ELG-072 | medium | Shared disablement must be checked against lists, retained occurrences and delivery together. Private preference races, exact text and cadence bounds and failed audited settings writes need proof. | ATS-PFM-ELG-020, CAP-PFM-ELG-020 | Structured evidence | coverage-gap | | FND-PFM-ELG-073 | medium | Executable files without complete scenario mappings remain registered with empty proof lists. Skipped, blocked and unreachable steps do not establish acceptance outcomes. | MOD-PFM-ELG | Structured evidence | coverage-gap | | FND-PFM-ELG-074 | medium | Existing bindings often cover selected assertions across several files rather than the full stated scenario. The specification narrows identical-holding uniqueness proof and does not count unreachable steps as acceptance proof. | MOD-PFM-ELG | Structured evidence | coverage-gap | | FND-PFM-ELG-075 | medium | Most cumulative feature scenarios have no executable suite that performs their full sequence. Related-capability scenarios specify the seams, but the multi-record purge workflow still lacks joint proof across decision, population, responsibility and attention stores. | MOD-PFM-ELG | Structured evidence | coverage-gap |
Open Questions
| id | question | why_it_matters | options | recommendation | affects |
|---|---|---|---|---|---|
OQ-PFM-ELG-001 | Who should have authority to enumerate a rule’s subjects? | Bulk evaluation can list and export people. The milestone leaves authority undecided, while implementation combines a user-tier population key with dataset query authority. | (a) Retain both population and dataset query authority; (b) require publishing or administrative authority as well; (c) use dataset query authority alone. | The product should retain separate population and dataset query authority: dataset access constrains the records, while the population key lets organizations restrict enumeration independently of individual evaluation. | CAP-PFM-ELG-011, BR-CAP-PFM-ELG-011-01 |
OQ-PFM-ELG-002 | Should staff find and cancel bulk work from its rule? | Lookup needs the identity returned at start, and repeated starts create separate work that cannot be cancelled through this module. | (a) Show runs and simulations in rule history with cancellation; (b) direct staff to the shared job monitor; (c) keep the existing lookup. | The product should add rule history and cancellation when bulk work is planned, because the rule provides staff’s natural context for those runs. | CAP-PFM-ELG-011, BR-CAP-PFM-ELG-011-10 |
OQ-PFM-ELG-003 | Should work that follows a committed write gain durable retries? | Cache clean-up, dispatcher nudges, uncovered-area attention, retired-kind resolution and sampled display decisions run as best-effort follow-ups; scheduled recovery differs by path, retired-kind repair has a seven-day window and lost display history has no recovery. | (a) Keep best effort everywhere and accept the bounded delays; (b) move display decisions and retired-kind resolution to queued work under the queued-work standard, keeping best effort for caches, nudges and attention refresh; (c) queue every follow-up. | Option (b): history and closed items need a durable path, while cache and attention staleness is already bounded by short schedules. | ADR-PFM-ELG-017, WF-PFM-ELG-004, WF-PFM-ELG-015, FND-PFM-ELG-013 |
OQ-PFM-ELG-004 | How should a product change from one qualification rule to another? | The product card removes the old use before binding the new, so a refused bind leaves the product unrestricted. | (a) A Platform operation that repoints a use to another rule in one transaction after fitting it; (b) the card binds the new rule first and removes the old one only after that succeeds; (c) keep the current order and its warning. | Option (a), because it keeps one use per product at every moment and gives every consumer editor the same safe change; option (b) is an acceptable interim repair. | WF-PFM-ELG-021, SCR-PFM-ELG-010, FND-PFM-ELG-038 |