Findings and Open Questions: Operational Records
Findings
| id | severity | statement | affects | evidence | kind |
|---|---|---|---|---|---|
FND-PFM-OPS-001 | medium | The original read scope names an absent HQ route group and omits the Applications host. The registry now identifies the actual HQ, configuration and supporting evidence paths; overlapping hosts retain their owning-module boundaries. | MOD-PFM-OPS, CAP-PFM-OPS-016 | Structured evidence | inconsistency |
FND-PFM-OPS-002 | medium | Jobs, audit and licensing lack dedicated milestone records. Authority instead comes from the cited approved HQ plan, accepted application proposal and recorded audit acceptance, leaving a gap in milestone traceability. | MOD-PFM-OPS, FEAT-PFM-OPS-01, FEAT-PFM-OPS-02, FEAT-PFM-OPS-03, FEAT-PFM-OPS-04 | Structured evidence | debt |
FND-PFM-OPS-003 | low | The HQ detail page reads a staleness flag absent from backend job responses, so its intended stalled-work warning cannot appear for real jobs. | CAP-PFM-OPS-006, BR-CAP-PFM-OPS-006-08 | Structured evidence | defect |
FND-PFM-OPS-004 | medium | The provisioning-retry button checks jobs retry authority while the called operation checks workspace provisioning authority. Holding only one permission can expose a refused action or hide an otherwise callable action. | CAP-PFM-OPS-004, BR-CAP-PFM-OPS-004-08, JNY-PFM-OPS-002 | Structured evidence | inconsistency |
FND-PFM-OPS-005 | medium | The shared engine supports cancellation and eligibility population opts into it, but Platform has no cancellation route or screen. The jobs guide and HQ plan still describe cancellation as absent from the engine. | CAP-PFM-OPS-004, BR-CAP-PFM-OPS-004-07, OQ-PFM-OPS-003 | Structured evidence | debt |
FND-PFM-OPS-006 | low | The accepted HQ refresh design slows after two minutes, whereas both current monitors keep polling active work every five seconds. The jobs guide describes a different interval again. | CAP-PFM-OPS-005, CAP-PFM-OPS-006 | Structured evidence | inconsistency |
FND-PFM-OPS-007 | low | The jobs guide describes staff-wide results through the customer monitor. Code and tests retain customer scope there and reserve cross-customer inspection for HQ. | CAP-PFM-OPS-005, CAP-PFM-OPS-006 | Structured evidence | inconsistency |
FND-PFM-OPS-008 | low | The HQ plan specifies explorer-based saved views, richer filters and visible retry lineage. The current list supplies status filtering and the detail page omits lineage presentation. | CAP-PFM-OPS-006, BR-CAP-PFM-OPS-006-05 | Structured evidence | inconsistency |
FND-PFM-OPS-009 | low | Requester messages link to staff-only HQ pages. That matches today’s provisioning audience but would not provide a usable destination for future customer-requested notifying kinds. | CAP-PFM-OPS-003, BR-CAP-PFM-OPS-003-07, OQ-PFM-OPS-002 | Structured evidence | debt |
FND-PFM-OPS-010 | low | The jobs schedule also hosts stranded-workspace repair and website reconciliation. These cross-module responsibilities share one invocation and its failure surface. | CAP-PFM-OPS-002, BR-CAP-PFM-OPS-002-10 | Structured evidence | debt |
FND-PFM-OPS-011 | medium | Licensing decisions and state changes commit before their expected audit entries. A later audit failure can leave an access-affecting change without its security-history account. | CAP-PFM-OPS-011, BR-CAP-PFM-OPS-011-06, CAP-PFM-OPS-015, BR-CAP-PFM-OPS-015-05 | Structured evidence | defect |
FND-PFM-OPS-012 | medium | The accepted expiry decision requires renewal warnings beginning sixty days before the term ends. The examined module contains no sender for those warnings. | CAP-PFM-OPS-012, BR-CAP-PFM-OPS-012-07 | Structured evidence | defect |
FND-PFM-OPS-013 | medium | The pinned operating guide records HubSpot activation as unfinished, with no configured token and unconfirmed property names. Stubbed resolver and sync tests therefore do not establish real-provider behavior. | CAP-PFM-OPS-012, JNY-PFM-OPS-005 | Structured evidence | debt |
FND-PFM-OPS-014 | medium | Later approved entitlement directions replace parts of the current licensing model, including overrides, product mapping and notice audiences. The examined implementation still uses the earlier model. | CAP-PFM-OPS-011, CAP-PFM-OPS-012, CON-PFM-OPS-003 | Structured evidence | debt |
FND-PFM-OPS-015 | low | The HQ panel requires a twenty-character reason beyond the backend’s nonblank requirement. It also requests a revocation reason that the served route neither accepts nor retains. | CAP-PFM-OPS-013, BR-CAP-PFM-OPS-013-05, BR-CAP-PFM-OPS-013-06 | Structured evidence | inconsistency |
FND-PFM-OPS-016 | medium | The console’s failed-application retry address uses a hyphen where the backend uses an underscore. Shared mocks and tests reproduce the console spelling and therefore miss the integration mismatch. | CAP-PFM-OPS-013, BR-CAP-PFM-OPS-013-07, CAP-PFM-OPS-015 | Structured evidence | defect |
FND-PFM-OPS-017 | low | The workspace application read is claimed by both security and operations. Its licensing rule is retained here, but the overlapping corpus ownership needs reconciliation outside this job’s write scope. | CAP-PFM-OPS-016, CAP-PFM-SEC-002 | Structured evidence | inconsistency |
FND-PFM-OPS-018 | low | Export allowances are stored in licensing while the export module owns their HQ administration. The licensing guide does not explain this boundary. | CAP-PFM-OPS-011, BR-CAP-PFM-OPS-011-10 | Structured evidence | undocumented |
FND-PFM-OPS-019 | medium | Current activity removal is limited to workspace retirement, leaving view-event growth unbounded. The recorded retention decision remains deferred with its compliance due date. | CAP-PFM-OPS-010, BR-CAP-PFM-OPS-010-10, OQ-PFM-OPS-001 | Structured evidence | debt |
FND-PFM-OPS-020 | low | The audit guide and seed inventory understate registered view targets and organization tracking. Organizations now report views, committees are registered, and no committee reporting screen is established. | CAP-PFM-OPS-008, BR-CAP-PFM-OPS-008-01 | Structured evidence | inconsistency |
FND-PFM-OPS-021 | low | The custom-record read writes a visit for every accepted API read, using a server-generated key. Its history therefore includes callers beyond console navigation. | CAP-PFM-OPS-008, BR-CAP-PFM-OPS-008-10 | Structured evidence | undocumented |
FND-PFM-OPS-022 | low | Current public history reads select view events only. Other stored activity types have no corresponding reader here, and the raw person and colleague history capabilities remain without console screens. | CAP-PFM-OPS-009, CAP-PFM-OPS-010 | Structured evidence | debt |
FND-PFM-OPS-023 | low | The Scheduled Jobs description and several labels expose internal workspace terminology. The product should use workspace wording on these customer surfaces. | CAP-PFM-OPS-005, CAP-PFM-OPS-007 | Structured evidence | inconsistency |
FND-PFM-OPS-024 | low | Staff company inspection, manual synchronization and feed-health operations exist without matching HQ screens. | CAP-PFM-OPS-012, CAP-PFM-OPS-013, BR-CAP-PFM-OPS-013-08 | Structured evidence | debt |
FND-PFM-OPS-025 | low | The seven proof gaps identified in the draft remain open. Examination also demotes broader partially bound acceptance matrices, retaining their candidate evidence under the separate proof-strength finding. | CAP-PFM-OPS-001, CAP-PFM-OPS-003, CAP-PFM-OPS-006, CAP-PFM-OPS-008, CAP-PFM-OPS-012, CAP-PFM-OPS-013 | Structured evidence | debt |
FND-PFM-OPS-048 | medium | Interrupted application preparation can remain provisioning indefinitely with no reconciliation or permitted staff retry from that state. | TC-AVL-004, TC-PI-004, CAP-PFM-OPS-015, BR-CAP-PFM-OPS-015-01, BR-CAP-PFM-OPS-015-02 | Structured control evidence | control-gap |
FND-PFM-OPS-049 | medium | Licensing changes commit before security history and refresh; a failed follow-up can omit the audit and leave access dependent on cache expiry. | TC-LOG-001, TC-AZ-006, TC-PI-004, CAP-PFM-OPS-011, BR-CAP-PFM-OPS-011-06, BR-CAP-PFM-OPS-011-07, CAP-PFM-OPS-015, BR-CAP-PFM-OPS-015-05 | Structured control evidence | control-gap |
FND-PFM-OPS-050 | medium | Requester-notice outcomes have neither an independent retry sweep nor a concurrency claim protecting a delivered result. | TC-AVL-004, TC-PI-002, TC-PI-003, TC-PI-004, SVC-PFM-OPS-jobs, WF-PFM-OPS-004 | Structured control evidence | control-gap |
FND-PFM-OPS-051 | high | A reconciled final job can miss its failed business consequence because later recovery excludes already settled jobs. | TC-AVL-004, TC-PI-004, WF-PFM-OPS-003, CAP-PFM-OPS-002 | Structured control evidence | control-gap |
FND-PFM-OPS-052 | medium | Commercial snapshot replacement has no company-wide lock or source-version guard establishing safe ordering of concurrent reads. | TC-PI-003, WF-PFM-OPS-013 | Structured control evidence | control-gap |
| FND-PFM-OPS-026 | medium | Requester notice claiming permits duplicate delivery during simultaneous pending claims or a send followed by a failed outcome write. Its implemented delivery contract falls short of strict once-only intent. | CAP-PFM-OPS-003, BR-CAP-PFM-OPS-003-11 | Structured evidence | defect |
| FND-PFM-OPS-027 | low | The guide prioritizes staff grants over contract windows, but the resolver reports current and grace contract coverage before grants. Availability can agree while source and reported dates differ. | CAP-PFM-OPS-014, BR-CAP-PFM-OPS-014-02 | Structured evidence | inconsistency |
| FND-PFM-OPS-028 | medium | Acceptance matrices often claim several results while naming one narrow assertion. Candidate bindings remain traceable but cannot stand for complete proof; the mutation example does not test business rollback and the purge example directly deletes an override. | CAP-PFM-OPS-010, CAP-PFM-OPS-015, BR-CAP-PFM-OPS-010-06, BR-CAP-PFM-OPS-015-09, BR-CAP-PFM-OPS-002-09, BR-CAP-PFM-OPS-003-09 | Structured evidence | debt |
| FND-PFM-OPS-029 | medium | Contract sync stores new coverage without preparing a missing application despite accepted initialization intent. Recorded provider failure and failed webhook publication also wait for later reconciliation rather than immediate queue retry. | CAP-PFM-OPS-012, BR-CAP-PFM-OPS-012-16, BR-CAP-PFM-OPS-012-17, BR-CAP-PFM-OPS-012-18, BR-CAP-PFM-OPS-012-19 | Structured evidence | defect |
| FND-PFM-OPS-030 | medium | Row insertion handles conflicts, but the wider transition does not lock its initial state check or participant work. Concurrent actions can overwrite later decisions or repeat preparation, without an acceptance matrix establishing safe concurrency. | CAP-PFM-OPS-015, BR-CAP-PFM-OPS-015-08, BR-CAP-PFM-OPS-015-10 | Structured evidence | defect |
| FND-PFM-OPS-031 | medium | Following a successful jobs pass, a stranded-provisioning repair exception prevents website reconciliation and fails the invocation. The draft’s independent-pass claim exceeds the handler’s actual failure isolation. | CAP-PFM-OPS-002, BR-CAP-PFM-OPS-002-10 | Structured evidence | inconsistency |
| FND-PFM-OPS-032 | low | The examination adds omitted progress, continuation and deferred-reconciliation rules. Their acceptance matrices remain open, and submission races inside a caller transaction require caller retry rather than always returning the winning job. | CAP-PFM-OPS-001, CAP-PFM-OPS-002, BR-CAP-PFM-OPS-001-01, BR-CAP-PFM-OPS-001-11, BR-CAP-PFM-OPS-001-12, BR-CAP-PFM-OPS-002-11, BR-CAP-PFM-OPS-002-12 | Structured evidence | debt |
| FND-PFM-OPS-033 | medium | Application preparation writes provisioning, runs its participants and writes its outcome as separate steps. A process that stops between them leaves the application provisioning for ever: nothing reconciles it, staff retry accepts only a failed preparation, and suspension accepts only an enabled one. | CAP-PFM-OPS-015, BR-CAP-PFM-OPS-015-01, BR-CAP-PFM-OPS-015-02, OQ-PFM-OPS-004 | Structured evidence | defect | | FND-PFM-OPS-034 | low | Two code headers contradict the code they describe. The licensing routes say the licence step is deployed in shadow mode everywhere, while the deployed mode and the guide say enforce since 2026-10-13. The nightly reconcile says it enqueues every company without a key, while it enqueues nothing. | CAP-PFM-OPS-012, CAP-PFM-OPS-014, BR-CAP-PFM-OPS-014-08 | Structured evidence | inconsistency | | FND-PFM-OPS-035 | low | Company reads are published straight to the sync queue by the webhook, the nightly pass and the company-link change, without the queue row and dispatcher the queued-work standard requires, and the standard does not list this departure. A refused publication relies on the nightly read for recovery. | CAP-PFM-OPS-012, BR-CAP-PFM-OPS-012-17 | Structured evidence | undocumented | | FND-PFM-OPS-036 | low | The Applications overview screen and the workspace applications read are specified under Console Shell, although the hosted-screen rule gives screens to the module owning their records. This design references them rather than writing a second home; the two modules should agree one home. | CAP-PFM-OPS-016, FND-PFM-OPS-017 | Structured evidence | inconsistency | | FND-PFM-OPS-037 | medium | The two staff licensing flows order their after-commit steps differently. An override writes its security-history entry before preparation and the access refresh, so a history failure also skips both; an application move requests the refresh before its history entry. The same failure therefore leaves different traces, and an override can take effect only on cache expiry. | CAP-PFM-OPS-011, BR-CAP-PFM-OPS-011-06, BR-CAP-PFM-OPS-011-07, CAP-PFM-OPS-015, BR-CAP-PFM-OPS-015-05, OQ-PFM-OPS-005 | Structured evidence | defect | | FND-PFM-OPS-038 | low | When a browser lacks the standard random identifier, the console mints a visit key that is not a UUID. The server refuses it as a client error, the tracker does not retry a refusal, and every visit from that browser is silently lost. | CAP-PFM-OPS-008, BR-CAP-PFM-OPS-008-06, BR-CAP-PFM-OPS-008-09 | Structured evidence | defect | | FND-PFM-OPS-039 | low | The workspace provisioning retry starts its new execution strictly, so a start failure answers an error after the workspace has moved to provisioning and the retry job exists; the reconciler later restores it. Its submission identity is the instant, so two admitted retries would create two jobs. | CAP-PFM-OPS-004, BR-CAP-PFM-OPS-004-01, JNY-PFM-OPS-002 | Structured evidence | inconsistency | | FND-PFM-OPS-040 | low | The module asks no model a question, so it has no inference directory and every design artifact carries an empty inference list. The conventions ask the module charter to say so in one sentence, and the charter lies outside this design job's write scope. | MOD-PFM-OPS | Structured evidence | undocumented |
| FND-PFM-OPS-041 | medium | Requester notices can remain failed or pending indefinitely because no independent retry sweep is declared. Concurrent outcome writers also lack a claim token or state condition and can overwrite a delivered result. Delivery is therefore neither guaranteed nor strictly once-only. | SVC-PFM-OPS-jobs, STATE-PFM-OPS-003, WF-PFM-OPS-004, ADR-PFM-OPS-004 | Structured evidence | defect | | FND-PFM-OPS-042 | high | When reconciliation corrects an execution success to job failure because a step remains running or retrying, it applies the business consequence after settlement. If that consequence throws, the job is already final and later stalled-job passes do not retry it; the universal before-settlement guarantee in the planning layer is stronger than this path. | WF-PFM-OPS-003, STATE-PFM-OPS-001, ADR-PFM-OPS-003, CAP-PFM-OPS-002 | Structured evidence | inconsistency | | FND-PFM-OPS-043 | medium | Company synchronization replaces each snapshot transactionally but has no company-wide lock or source-version check. Safe ordering and convergence of overlapping company reads are unknown; atomic replacement alone does not establish the draft’s serialization guarantee. | WF-PFM-OPS-013, STATE-PFM-OPS-005, ADR-PFM-OPS-012 | Structured evidence | debt | | FND-PFM-OPS-044 | medium | The bulk development seed has no environment guard and its persistence and audit failures propagate. The per-workspace seed checks the environment, but caller-specific suppression is not established by these functions; the draft’s universal no-op and never-fails guarantees are unsupported. | WF-PFM-OPS-017 | Structured evidence | inconsistency | | FND-PFM-OPS-045 | low | Several invariant enforcement claims exceeded their sources: the service preserves first enablement and computes exactly seven grace days, while database checks only constrain the permitted shape. The shared engine also accepts arbitrary execution domain fields rather than enforcing the documented identifiers-only boundary. Corrected design preserves these distinctions; stronger proof remains necessary before treating them as database guarantees. | DOM-PFM-OPS-001, DOM-PFM-OPS-003, DOM-PFM-OPS-004 | Structured evidence | debt | | FND-PFM-OPS-046 | low | The requested design-production brief is absent from the starting checkout and the available brief directories. Examination uses the conventions, templates, module charter and cited product records, so conformity to that missing brief cannot be established. | MOD-PFM-OPS | Structured evidence | debt | | FND-PFM-OPS-047 | high | The task describes an approved planning layer, but every feature, concept, capability and journey in the checkout has draft status and every acceptance set is proposed. Existing recorded product decisions still supply authority for their covered choices; formal planning approval must be confirmed by Andrew before implementation preparation. Examination does not promote these statuses. | MOD-PFM-OPS | Structured evidence | inconsistency |
| FND-PFM-OPS-053 | medium | Empty declarations, unknown late step reports and the full progress-weight calculation lack complete scenario trace. | ATS-PFM-OPS-001 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-054 | medium | Malformed scheduled invocations and competing task-versus-reconciler reports lack complete proof; successful-execution correction retains the previously recorded consequence-ordering defect. | ATS-PFM-OPS-002 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-055 | medium | Missing jobs or recipient addresses and concurrent senders need complete notification-flow proof, including interrupted delivery-outcome writes. | ATS-PFM-OPS-003 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-056 | medium | Failed execution stop, failed retry startup and concurrent stop-versus-completion need proof beyond sequential engine cases. | ATS-PFM-OPS-004 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-057 | medium | Empty or removed run targets, failed monitor reads and paging while job activity changes need dedicated scenario proof. | ATS-PFM-OPS-005 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-058 | medium | Invalid staff list filters, polling boundaries, response privacy and overlapping refresh need complete proof; the real stalled-work flag remains absent. | ATS-PFM-OPS-006 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-059 | medium | Unavailable publishers, incompatible contract columns and discovery during new view publication need dedicated boundary and failure proof. | ATS-PFM-OPS-007 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-060 | medium | Navigation around a removed or newly unreadable target needs additional edge proof; public reporting and immutable storage have separate enforcement boundaries. | ATS-PFM-OPS-008 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-061 | medium | Excluding non-visit event types, failed history reads and pagination during new visits need complete category proof. | ATS-PFM-OPS-009 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-062 | medium | Unattributed mutation events, rollback with the owning business change and simultaneous duplicate writes need complete proof at the activity boundary. | ATS-PFM-OPS-010 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-063 | medium | Concurrent seed selection, competing withdrawals and post-commit follow-up failures need complete flow proof beyond ordinary sequential decisions. | ATS-PFM-OPS-011 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-064 | medium | Queue receive and retention limits, missing operational preparation after contract sync, concurrent company snapshots and failed transactional replacement need explicit proof. | ATS-PFM-OPS-012 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-065 | medium | Missing author records, exact dialog limits and refreshed historical decisions need additional proof; the panel’s failed-preparation retry address still differs from the served route. | ATS-PFM-OPS-013 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-066 | medium | Invalid composite-read inputs, failed persistence reads and availability resolved while its inputs change need additional proof. | ATS-PFM-OPS-014 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-067 | medium | Participant-free and repeated preparation, exact state-reason limits and stale service checks during competing moves need complete proof; insertion safety does not serialize the transition. | ATS-PFM-OPS-015 | Structured testing evidence | coverage-gap | | FND-PFM-OPS-068 | medium | Disabled workspaces, malformed read requests, failed customer reads and refresh during access changes need dedicated proof beyond the normal response and scope checks. | ATS-PFM-OPS-016 | Structured testing evidence | coverage-gap |
Open Questions
| id | question | why_it_matters | options | recommendation | affects |
|---|---|---|---|---|---|
OQ-PFM-OPS-001 | What retention period should govern record visits? | History grows with navigation and the compliance decision is overdue unless addressed by its recorded deadline. | A: retain until workspace retirement; B: delete after a fixed history period; C: retain a bounded recent set per person. | The product should adopt a fixed retention period that preserves a useful review horizon while bounding storage growth. | CAP-PFM-OPS-009, CAP-PFM-OPS-010 |
OQ-PFM-OPS-002 | Which destination and channels should requester notices use? | Customer-requested work needs a destination the requester can open, and migration to shared notifications should preserve the same audience meaning. | A: retain staff-only HQ notices; B: choose a destination by requester audience; C: defer audience expansion until shared notifications replace email delivery. | The product should select destinations by audience and preserve that choice when notices move to shared notifications. | CAP-PFM-OPS-003 |
OQ-PFM-OPS-003 | Who should receive retry and cancellation controls? | Declared engine support and existing permissions do not establish a consistent management contract across job kinds. | A: retain owner-specific actions; B: offer declared eligible actions in HQ; C: also allow customers to stop their own work. | The product should define HQ management for eligible kinds under explicit authority before extending controls to customers. | CAP-PFM-OPS-004, CAP-PFM-OPS-006 |
OQ-PFM-OPS-004 | How should an interrupted application preparation be recovered? | An application stranded in provisioning cannot be used, retried or suspended, and nobody is told. | A: make preparation a durable job reconciled like any other; B: add a repair to the five-minute pass that moves a preparation silent past a threshold to failed with a reason; C: let staff retry accept a preparation older than a threshold. | Adopt B now, because no licensed application lists participants yet and the repair is one conditional write, and adopt A when the first application with participants arrives. | CAP-PFM-OPS-015, FND-PFM-OPS-033 |
OQ-PFM-OPS-005 | Should a staff licensing decision and its security-history entry commit together? | An access-changing decision without its history entry weakens the account auditors read, and today the ordering differs between flows. | A: write the history entry in the decision's own transaction; B: keep after-commit writes but make them retried through a durable outbox; C: keep the current order and accept the gap. | Adopt A, because the security history is a local table and no external call sits between the two writes; then request the refresh last in every flow. | CAP-PFM-OPS-011, CAP-PFM-OPS-015, FND-PFM-OPS-011, FND-PFM-OPS-037 |