Ruleset hardening: promote 5 rules from Warning to Error

[Jesper Schulz-Wedde (JesperSchulz)]

Summary

Continues the ruleset hardening work from #10088 and #10209. Promotes 5 rules back to Error by removing their overrides from src/rulesets/base.ruleset.json, and resolves every violation those rules report.

Override count: 100 → 95.

Promoted: AL0547, AL0679, AW0014, AS0058, PTE0007.

Fixed in code

Rule	Fix
AL0679	The Email Logging Install codeunit was missing from the Email Logging - Obj. permission set, so it was not covered by any entitlement. Every other object in the app was already listed.
AW0014	The hidden F&unctions group on the ES Account Schedule Names page contained Export Schedules to ASC format, which is the target of a promoted actionref. Hiding the group made the promoted action unreachable, so the Visible = false is removed.

Accepted with #pragma warning disable

Each suppression is documented in place with the reason.

Rule	Sites	Why it is accepted
AL0547	4	Published integration events declaring GlobalVarAccess. Turning it off would break existing external subscribers.
AS0058 / PTE0007	26	asserterror statements in 11 test library codeunits. These are Subtype = Normal helpers that deliberately wrap asserterror on behalf of test codeunits, which is exactly what these rules flag.

Deferred

These were in the original scope but need real remediation, a dedicated PR, or domain-owner input, so their overrides are retained:

• AS0052 — needs its own PR. 61 app.json manifests have a missing or empty url, 44 of them under src/Layers/W1, each requiring propagation into the localized layers. CI only ever revealed two sites at a time because the build halts at the first project that errors, so the true scope was not visible up front.
• AL0523 — cannot be suppressed. The Posted Deposit Line duplicate-method diagnostic is emitted without a source location (it is a project-level comparison against the Base Application symbol package), so #pragma warning disable has nothing to attach to. Resolving it means renaming released public methods.
• AL0717 — FlowFields with no CalcFormula (Script Editor Line."Has Errors", Statutory Report Data Header."Requisites Quantity" / ."Set Requisites Quantity"). These are actively CalcFields'd, so they silently always return 0/false. Genuine latent bugs; suppressing them would enshrine the bug.
• AL0589 — duplicate report column/data item names across ~27 reports. Renaming columns breaks RDLC and Word layouts.
• AL0520 — references to removed tables (Intrastat, Invoice Post. Buffer, Payment Buffer, VAT Code). Real obsolescence debt.
• AL0749 — public method parameters with Internal types. Resolving means changing accessibility, i.e. an API change.
• AL0719, AW0003, AW0004 — small counts but the sites could not be pinpointed from CI logs alone (CI reports no file/line).

Notes

• CodeCop (AA*) rules are deliberately excluded from this PR. Removing CodeCop entries perturbs AA0021 reporting (observed in Restore Error severity for 13 dead base app ruleset entries #10138), so those get their own PR.
• AL1430 was considered but is defined in the shared ruleset.json, not in the base override list, so it is out of scope here.
• Violation counts were derived from the full 44-job CI matrix rather than local compilation, following the lesson from Promote AA0471, AA0472 and AA0474 to Error in the base ruleset #10209.

Related to AB#640773

[github-actions]

$\textbf{🟠\ High\ Severity\ —\ AppSource}$

The corrected help URL (https://learn.microsoft.com/en-us/dynamics365/business-central/finance-edocuments-overview) is still more than two path levels deep. Per AppSource Copilot grounding guidance, Copilot truncates such URLs to the first two path segments (.../dynamics365), silently grounding on unrelated sibling content instead of this app's documentation.

Knowledge:

• microsoft/knowledge/appsource/keep-copilot-help-url-to-two-path-levels.md

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.33.4}

[github-actions]

$\textbf{🟠\ High\ Severity\ —\ AppSource}$

The corrected help URL (https://learn.microsoft.com/en-us/dynamics365/business-central/finance-edocuments-overview) is still more than two path levels deep. Per AppSource Copilot grounding guidance, Copilot truncates such URLs to the first two path segments (.../dynamics365), silently grounding on unrelated sibling content instead of this app's documentation.

Knowledge:

• microsoft/knowledge/appsource/keep-copilot-help-url-to-two-path-levels.md

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.33.4}

[github-actions]

$\textbf{🟠\ High\ Severity\ —\ Privacy}$

The touched Normal fields "Accumulated Base Amount" and "Accumulated WHT Amount" rely on the table's DataClassification and do not declare field-level DataClassification. Per AppSourceCop AS0016, a table-level DataClassification does not cascade to Normal fields, so these fields remain non-compliant with the field-level classification requirement even after this PR touches them.

Suggested fix (apply manually — could not be anchored as a one-click suggestion):

        field(8; "Accumulated Base Amount"; Decimal)
        {
            Caption = 'Accumulated Base Amount';
            AutoFormatType = 1;
            // The accumulator only ever holds local currency amounts.
            AutoFormatExpression = '';
            DataClassification = CustomerContent;
            ToolTip = 'Specifies the accumulated base amount for the withholding tax threshold accumulator.';
        }
        field(9; "Accumulated WHT Amount"; Decimal)
        {
            Caption = 'Accumulated Withholding Tax Amount';
            AutoFormatType = 1;
            // The accumulator only ever holds local currency amounts.
            AutoFormatExpression = '';
            DataClassification = CustomerContent;
            ToolTip = 'Specifies the accumulated withholding tax amount for the withholding tax threshold accumulator.';
        }

Knowledge:

• microsoft/knowledge/privacy/table-level-data-classification-cascades.md
• microsoft/knowledge/privacy/data-classification-required-on-pii-fields.md

Line mapping was unavailable, so this was posted as an issue comment.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.33.4}

[github-actions]

$\textbf{🟠\ High\ Severity\ —\ Privacy}$

The touched Normal field "Taxable Base Amount" does not declare field-level DataClassification, even though other fields in this same table (e.g. lines 95 and 272) already do. This leaves the field non-compliant with AppSourceCop AS0016 and inconsistent with the table's own established pattern.

Suggested fix (apply manually — could not be anchored as a one-click suggestion):

        field(112; "Taxable Base Amount"; Decimal)
        {
            Caption = 'Taxable Base Amount';
            AutoFormatType = 1;
            AutoFormatExpression = Rec."Currency Code";
            Editable = false;
            DataClassification = CustomerContent;
        }

Knowledge:

• microsoft/knowledge/privacy/table-level-data-classification-cascades.md
• microsoft/knowledge/privacy/data-classification-required-on-pii-fields.md

Line mapping was unavailable, so this was posted as an issue comment.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.33.4}

[github-actions]

$\textbf{🟡\ Medium\ Severity\ —\ Data\ Modeling}$

The new LCY-only AutoFormatExpression ('') on "WHT Threshold Accumulator" fields "Accumulated Base Amount" and "Accumulated WHT Amount" hard-codes these totals as local-currency values, but the accumulator is populated from "Withholding Tax Entry"."Taxable Base Amount", and that source table itself stores a "Currency Code" and uses Rec."Currency Code" for its own AutoFormatExpression in this same PR. This makes the added comment's LCY-only claim architecturally inconsistent with the actual data flow, and risks mislabeling accumulated foreign-currency amounts as local currency in the UI. Either confirm/enforce that only LCY amounts ever flow into the accumulator (e.g. via validation or a comment referencing where that invariant is enforced), or source the AutoFormatExpression from a persisted currency-code field consistent with the source entries.

_{Agent judgement — not directly backed by a BCQuality knowledge article.}

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why · AL review agent v1.33.4}