Deliver recurring query and report files

Purpose

Send recurring files to designated recipients through schedules that record their execution and delivery outcomes.

How It Works

A person sets up recurring delivery for a saved query or report. They choose a timetable, message template and recipients. Query schedules keep a copy of their source; report schedules render the report’s current state. Automatic work uses the schedule owner’s refreshed access. Run Now instead uses the initiating person’s access. Completed work records files and individual delivery outcomes. Retries use run and recipient identities to avoid repeated messages. Access loss or repeated failures can pause a schedule. A manager can take ownership when another person needs to become responsible for its runs.

Relationships

Recurring delivery connects saved questions or reports with file production and the communications service.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Recurring files arrive without manual execution.Automatic delivery stops when owner access is lost.Query schedules retain their chosen source copy.
Surfaces: consoleapijob
Intent sources: services-platform:docs/migrations/query-scheduling-exports/README.md#D2. Schedules use the shared scheduling libraryservices-platform:docs/migrations/query-scheduling-exports/README.md#D3. A schedule runs a pinned copy of the saved query (snapshot), and says when the saved query has changedservices-platform:docs/migrations/query-scheduling-exports/README.md#D4. Whose access a run uses: the schedule's owner, checked fresh at every runservices-platform:docs/migrations/query-scheduling-exports/README.md#D5. Permissionsservices-platform:docs/migrations/query-scheduling-exports/README.md#D6. Recipientsservices-platform:docs/migrations/query-scheduling-exports/README.md#D7. Delivery: one e-mail per recipient with a secure link, through the communications moduleservices-platform:docs/migrations/query-scheduling-exports/README.md#D8. Templates: the communications module's templates, chosen per scheduleservices-platform:docs/migrations/query-scheduling-exports/README.md#D12. Execution records and failuresservices-platform:docs/migrations/query-scheduling-exports/README.md#D13. Rhythm 1.0 schedules: converted paused, activated deliberatelyservices-platform:docs/migrations/query-scheduling-exports/README.md#Remaining differences (accepted by Andrew 2026-10-17)services-platform:docs/milestones/plans/RPT-M1-plan.md#D9

Controls

31 controls apply, from the corpus control catalogue.

TC-AVL-004 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-DAT-005 TC-IAM-001 TC-IAM-006 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`platform.queries.read`	api	tenant
`platform.query-schedules.use`	service	record
`platform.query-schedules.manage`	service	tenant
`platform.query-schedules.external-recipients`	service	tenant
`platform.reports.use (report schedules)`	service	tenant

Business Rules

15 rules, 15 to be proved before approval. A rule's product intent is derived from its origin: 15 confirmed by a product decision, the rest inheriting this capability's confirmed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Confirmed	Schedule access requires the query surface plus schedule use or manage; users reach their own schedules, managers reach all, and other users receive not found. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D5. Permissions proved by `ATS-PFM-QRY-015-01`, `TST-PFM-QRY-147`, `TST-PFM-QRY-349`	permission	api, service	test services-platform:modules/queries/tests/integration/services/schedules/query-schedule-routes.integration.spec.js#answers a colleague holding only .use 404, as for one that does not exist
`02`must prove Confirmed	Query schedule creation requires a visible compilable source, required values, an active published delivery template, an hourly-or-slower timetable and active organizational user recipients. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D2. Schedules use the shared scheduling library proved by `ATS-PFM-QRY-015-02`, `TST-PFM-QRY-349`	validation	service	test services-platform:modules/queries/tests/integration/services/schedules/query-schedule-routes.integration.spec.js#refuses a schedule more often than hourly (400)
`03`must prove Confirmed	Query schedules run their stored source copy until explicitly refreshed, show later saved-query changes for comparison, and do not silently adopt those edits. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D3. A schedule runs a pinned copy of the saved query (snapshot), and says when the saved query has changed proved by `ATS-PFM-QRY-006-19`, `ATS-PFM-QRY-015-03`, `ATS-PFM-QRY-015-17`, `TST-PFM-QRY-349`	policy	service	test services-platform:modules/queries/tests/integration/services/schedules/query-schedule-routes.integration.spec.js#flags the saved query as changed since the schedule was set up
`04`must prove Confirmed	Automatic runs rebuild owner access and stop delivery, fail the run and pause the schedule when the owner cannot execute its source. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D4. Whose access a run uses: the schedule's owner, checked fresh at every run proved by `ATS-PFM-QRY-015-04`, `TST-PFM-QRY-350`	policy	service	test services-platform:modules/queries/tests/integration/services/schedules/scheduled-delivery.integration.spec.js#pauses the schedule with the reason, on the first such run
`05`must prove Confirmed	Only schedule managers can take ownership, after which later automatic runs use their access. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D4. Whose access a run uses: the schedule's owner, checked fresh at every run proved by `ATS-PFM-QRY-015-05`, `TST-PFM-QRY-140`, `TST-PFM-QRY-349`	permission	service	test services-platform:modules/queries/tests/integration/services/schedules/query-schedule-routes.integration.spec.js#refuses take-ownership to a holder of .use alone (403)
`06`must prove Confirmed	Run Now executes as the initiating person for the existing recipients and can run a paused schedule. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D4. Whose access a run uses: the schedule's owner, checked fresh at every run proved by `ATS-PFM-QRY-015-06`, `TST-PFM-QRY-151`, `TST-PFM-QRY-349`	policy	service	test services-platform:modules/queries/tests/integration/services/schedules/query-schedule-routes.integration.spec.js#is run by the consumer, as the caller, to the schedule’s recipients
`07`must prove Confirmed	Schedules accept at most fifty distinct users or addresses, resolve user addresses at send time, skip unavailable users with reasons and require outside-recipient permission for external addresses. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D6. Recipients proved by `ATS-PFM-QRY-015-07`, `TST-PFM-QRY-143`, `TST-PFM-QRY-349`, `TST-PFM-QRY-350`	permission	service	test services-platform:modules/queries/tests/integration/services/schedules/query-schedule-routes.integration.spec.js#refuses an outside address without platform.query-schedules.external-recipients (403), and writes nothing
`08`must prove Confirmed	Each recipient gets one communications request per run with a personal seven-day link, and run-recipient deduplication prevents duplicate e-mails on retry. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D7. Delivery: one e-mail per recipient with a secure link, through the communications module proved by `ATS-PFM-QRY-014-13`, `ATS-PFM-QRY-015-08`, `ATS-PFM-QRY-015-20`, `TST-PFM-QRY-350`	invariant	service	test services-platform:modules/queries/tests/integration/services/schedules/scheduled-delivery.integration.spec.js#submits nothing new when the same run is run again
`09`must prove Confirmed	Query schedules default to skipping empty results, while report schedules reject that option. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D7. Delivery: one e-mail per recipient with a secure link, through the communications module proved by `ATS-PFM-QRY-015-09`, `TST-PFM-QRY-230`, `TST-PFM-QRY-350`	policy	service	test services-platform:modules/queries/tests/integration/services/schedules/scheduled-delivery.integration.spec.js#ends a skip-when-empty run skipped, its export holding no rows
`10`must prove Confirmed	A scheduled date value stored as today resolves to each run’s workspace day and is recorded on that run’s export. origin: services-platform:docs/queries/exports-and-schedules.md#Schedule (Andrew, 2026-10-17) proved by `ATS-PFM-QRY-015-10`, `TST-PFM-QRY-349`, `TST-PFM-QRY-350`	calculation	service	test services-platform:modules/queries/tests/integration/services/schedules/scheduled-delivery.integration.spec.js#runs the criterion on the day of each run, in the tenant’s zone
`11`must prove Confirmed	Transient errors retry, query and access failures do not, five consecutive failed runs pause the schedule with a reason, and success clears the failure count. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D12. Execution records and failures proved by `ATS-PFM-QRY-015-11`, `TST-PFM-QRY-150`, `TST-PFM-QRY-350`	policy	service	test services-platform:modules/queries/tests/integration/services/schedules/scheduled-delivery.integration.spec.js#pauses the schedule after the fifth, saying why
`12`must prove Confirmed	Report schedules require report use and visibility, render the current report as PDF by default or eligible Excel, flag report changes without pinning them and cannot change into query schedules. proved by `ATS-PFM-QRY-013-15`, `ATS-PFM-QRY-015-12`, `ATS-PFM-QRY-015-19`, `TST-PFM-QRY-230`	validation	service	test services-platform:modules/queries/tests/e2e/query-schedules.e2e.spec.js#refuses Excel for a dashboard (400 at options.format)
`13`must prove Confirmed	Report deletion atomically pauses its schedules as report deleted, preserves their history and permits only their deletion rather than resumption or another run. origin: services-platform:docs/milestones/plans/RPT-M1-plan.md#D9 proved by `ATS-PFM-QRY-011-17`, `ATS-PFM-QRY-015-13`, `ATS-PFM-QRY-015-18`, `TST-PFM-QRY-142`, `TST-PFM-QRY-230`	lifecycle	service, database	test services-platform:modules/queries/tests/e2e/query-schedules.e2e.spec.js#refuses to resume it (400)
`14`must prove Confirmed	Imported legacy schedules start paused and require confirmation that the legacy schedule is disabled before resuming. origin: services-platform:docs/migrations/query-scheduling-exports/README.md#D13. Rhythm 1.0 schedules: converted paused, activated deliberately proved by `ATS-PFM-QRY-015-14`, `TST-PFM-QRY-349`	lifecycle	service	test services-platform:modules/queries/tests/integration/services/schedules/query-schedule-routes.integration.spec.js#refuses a resume without confirmLegacyDisabled (400), saying why
`15`must prove Confirmed	Schedule edits use the read version, duplication creates a paused caller-owned copy, and deletion removes runs and deliveries while exported files retain their expiry. proved by `ATS-PFM-QRY-015-15`, `TST-PFM-QRY-139`, `TST-PFM-QRY-349`	lifecycle	service	test services-platform:modules/queries/tests/integration/services/schedules/query-schedule-routes.integration.spec.js#duplicates it paused, named a copy, owned by the caller

Scenarios

Id	Given	When	Then	Provenance
`01`	A scheduled report’s owner loses access to its source.	Automatic delivery runs and a manager later takes ownership.	The failed run pauses delivery; the manager can restore responsibility for later runs.	test react-console:acceptance/reporting/playwright/journeys/adversarial/RPT-ACC-0496.spec.ts#RPT-ACC-0496

Planning

Implementation

Deliver recurring query and report files ​

Purpose ​

How It Works ​

Relationships ​