Review and select records from a list

Purpose

Support movement between list records and provide the matching record identities for bulk work.

How It Works

A reader opens a record from an ordered list. Platform retains a bounded window of matching identities and supplies neighbouring records. The record screen loads the actual record through its own application. Movement inside the stored window uses retained order. Reaching a window edge can extend or rebuild it from another read, so whole-list stability is not assured. Return state remains useful after navigation expires. For bulk work, selection supplies a bounded list of matching identities. The consuming application decides how to act on that selection and how to handle truncation.

Relationships

Navigation and selection use ordinary query execution. Views describe the list, while another application owns the subsequent bulk change.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Readers can move through retained list identities.Saved return state supports returning to results.Bulk work receives an explicit bounded selection.
Surfaces: consoleapi

Controls

20 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-LOG-004 TC-LOG-005 TC-PI-001 TC-PI-003 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`platform.explorer-views.use`	api	tenant
`<application>.<dataset>.query (the owner's key)`	service	tenant

Business Rules

10 rules, 10 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Proposed	Opening a list record retains an ordered window of matching identities, preserving that window’s order while extensions and rebuilds read results again. proved by `ATS-PFM-QRY-010-01`	invariant	service	observed services-platform:modules/explorer/services/navigation/navigation-sessions.ts:locateInNavigationSession
`02`must prove Proposed	Navigation starts require a record and ordering, reject result columns or missing inputs, and report a conflict when the record no longer matches. proved by `ATS-PFM-QRY-010-02`, `TST-PFM-QRY-208`	validation	api, service	test services-platform:modules/explorer/tests/e2e/explorer-navigation-api.e2e.spec.js#refuses a record the query does not answer as 409
`03`must prove Proposed	Navigation returns position, total and adjacent identities without returning record data. proved by `ATS-PFM-QRY-010-03`, `TST-PFM-QRY-208`	calculation	service	test services-platform:modules/explorer/tests/e2e/explorer-navigation-api.e2e.spec.js#answers the record’s position and the total, which is what "2 of 12" is drawn from
`04`must prove Proposed	Only the initiating person can read a navigation session, and colleagues receive not-found responses even in the same workspace. proved by `ATS-PFM-QRY-010-04`, `TST-PFM-QRY-208`	permission	service	test services-platform:modules/explorer/tests/e2e/explorer-navigation-api.e2e.spec.js#answers 404, not 403, to a colleague of the same tenant
`05`must prove Proposed	An owner can read retained navigation and return state after losing dataset access, but records outside the retained window lack position and neighbours, and window renewal checks dataset access again. proved by `ATS-PFM-QRY-009-13`, `ATS-PFM-QRY-010-05`, `ATS-PFM-QRY-010-13`, `TST-PFM-QRY-208`	policy	service	observed services-platform:modules/explorer/services/navigation/navigation-sessions.ts:extendForward
`06`must prove Proposed	Navigation scans at most twenty thousand identities and retains at most two thousand in a sliding window, refusing work beyond the scan limit. proved by `ATS-PFM-QRY-010-06`, `TST-PFM-QRY-213`, `TST-PFM-QRY-214`	policy	service	test services-platform:modules/explorer/tests/integration/services/navigation/navigation-sessions.integration.spec.js#refuses a navigation whose scan would pass the cap
`07`must prove Proposed	Navigation expires after twelve hours, retains expired return state for seven more days, and removes the owner’s long-expired sessions when a new session is created. proved by `ATS-PFM-QRY-010-07`, `TST-PFM-QRY-213`, `TST-PFM-QRY-214`	lifecycle	service	test services-platform:modules/explorer/tests/integration/services/persistence/explorer-navigation-sessions.integration.spec.js#expires twelve hours after the execution’s own clock, as ISO 8601 UTC
`08`must prove Proposed	Joined recipe navigation counts distinct base records for positions and totals. proved by `ATS-PFM-QRY-010-08`	calculation	service	documented services-platform:docs/explorer.md#4. Navigating a result set
`09`must prove Proposed	Whole-result selection returns ordered record identities and a total without record data, limiting the selection to ten thousand and marking truncation. proved by `ATS-PFM-QRY-010-09`, `TST-PFM-QRY-208`, `TST-PFM-QRY-220`	calculation	service	test services-platform:modules/explorer/tests/integration/services/selection/select-record-ids.integration.spec.js#answers exactly the cap’s worth of ids
`10`must prove Proposed	Navigation creation and selection require the Explorer permission and dataset access, with matching query refusals applied to both. proved by `ATS-PFM-QRY-010-10`, `TST-PFM-QRY-208`, `TST-PFM-QRY-220`	permission	api, service	test services-platform:modules/explorer/tests/e2e/explorer-navigation-api.e2e.spec.js#refuses to freeze one for a caller holding the surface key and not the dataset key, as 403

Scenarios

Id	Given	When	Then	Provenance
`01`	An Explorer query matches thirty-five records within the selection cap.	The client requests every matching identity.	Selection returns the matching identities and reports no truncation.	test services-platform:modules/explorer/tests/e2e/explorer-navigation-api.e2e.spec.js#answers that nothing was cut, so a console may act on the whole list

Planning

Implementation

Review and select records from a list ​

Purpose ​

How It Works ​

Relationships ​