Repository navigation
AL-2152 — [P28-W06] Qualify whole journeys and the exact Phase 28 release cohort #2152
Description
AL-2152 — [P28-W06] Qualify whole journeys and the exact Phase 28 release cohort
Approved implementation ticket. Plan key: P28-W06. Work only after its real blockers and exact qualification gates are satisfied. Publication does not establish implementation, qualification or activation.
Parent
Phase 28 implementation specification #2064. Canonical specification commit e93e2e9958f32380e28ec0e005d7ef3ee24f7e7a; documentation PR #2065. The full published spec and comments were verified against the canonical source. Preserve the parent’s body, title, labels, state and comments; new native child/dependency relationships are metadata only.
What to build
Representative missionaries, staff, coaches and readers demonstrate the complete phase; product and operations can enable the qualified cohort with traceable evidence and real monitoring owners.
Source of truth and acceptance ownership
- Coaching Resources: part 1 · part 2 · part 3
- Finance Stewardship: part 1 · part 2
- Communications: part 1 · part 2 · part 3 · part 4
- Proof: part 1 · part 2
- Relationships: part 1 · part 2 · part 3 · part 4
- Common safeguards and proof: part 1 · part 2
- Owner reconciliation and later-decision precedence: part 1
- Evidence and existing seam limits: part 1
Primary requirement references: REQ28-C04, REQ28-C05, REQ28-C49, REQ28-F41, REQ28-F42, REQ28-F43, REQ28-F44, REQ28-M32, REQ28-M41, REQ28-M42, REQ28-Q06, REQ28-Q07, REQ28-Q08, REQ28-Q09, REQ28-Q10, REQ28-Q11, REQ28-Q12, REQ28-Q13, REQ28-Q14, REQ28-Q15, REQ28-Q16, REQ28-Q17, REQ28-Q18, REQ28-Q19, REQ28-Q23, REQ28-Q24, REQ28-Q25, REQ28-Q26, REQ28-Q27, REQ28-R01, REQ28-R43. Stories: US28-C04, US28-C05, US28-C49, US28-F41, US28-F42, US28-F43, US28-F44, US28-M32, US28-M41, US28-M42, US28-Q06, US28-Q07, US28-Q08, US28-Q09, US28-Q10, US28-Q11, US28-Q12, US28-Q13, US28-Q14, US28-Q15, US28-Q16, US28-Q17, US28-Q18, US28-Q19, US28-Q23, US28-Q24, US28-Q25, US28-Q26, US28-Q27, US28-R01, US28-R43.
The checked criteria below are this ticket’s primary trace ownership, not a relaxation of the full normative contract. For a requirement split across tickets, this ticket delivers its named behavior and enforces applicable invariants immediately; the other ticket’s full scenario is not claimed complete early. All source-specific state/control, numeric-boundary, owner, monitoring and exclusion sections in the linked volume remain binding. Preserve settled D1–D50 and C01–C20; do not reopen them or import contradictory vendor conventions.
Acceptance criteria
- AC28-C04-03 — Turning a numeric, narrative or next-step sharing module Off fences that module's affected current and pending disclosures without stopping unrelated qualified modules or personal source work.
- AC28-C04-04 — Re-enabling availability does not revive ended grants or previous module inclusions. A still-valid coach need not be invited again merely to make a fresh deliberate module inclusion.
- AC28-C05-04 — Detail can present shared focus/goals, independently qualified support or activity summaries, shared check-ins and selected next steps. Failure of one source leaves independent safe modules usable.
- AC28-C49-01 — Each protected source has exact tenant/subject/episode/version/occurrence ownership, trusted actor attribution and tenant-consistent relationships. Missing/null scope grants no access; invitation validity, positive revisions and valid start/end combinations are enforced. Required authorization history is append-only with attributed corrections and governed retention, not erased by a cascade. Old-state and resulting-state authorization are proved through effective grants, row policies, views/functions, storage, asynchronous readers and privileged paths; a permitted update cannot reparent, widen or revive a forbidden state.
- AC28-C49-02 — Tests exercise duplicate requests, lost responses after acceptance, concurrent Save/Share/Stop, stale Publish after Disable, recipient or subject revocation during release, context switching, restored data and exact before/at/after expiry, including a wait crossing the deadline. Expected results assert durable domain outcomes and current disclosure rather than only implementation calls.
- AC28-C49-03 — Financial tests cover source-line duplication, correction, historical terms, incompatible currencies/calendars, incomplete coverage and inference across retained releases. Activity tests cover the four real outcomes, participant attribution, duplicate representations, calendar precision, quantity revisions, one-off/pause and sharing continuation.
- AC28-C49-04 — Narrative and task tests cover private autosave, captured prompt wording before first save, exact recipient publication, stopped access, limits/Unicode composition, meaning invalidation, due/status-only updates and source-controlled successors. Resource/guide/geography tests cover current bytes, withdrawn references, unsafe metadata, publication races and provider/network disclosure.
- AC28-C49-05 — The real journeys meet WCAG 2.2 AA and Core interaction rules: complete keyboard/screen-reader operation, labels and useful errors, focus restoration, persistent outcomes, non-color meaning, non-excepted 320 CSS-pixel reflow, 200 percent text resizing and 400 percent zoom. Core uses 44-pixel hit areas; this is not misrepresented as WCAG's 24 CSS-pixel minimum and exceptions. RTL, long international names, input methods, reduced motion and safe localized currency/date/zone labels are exercised.
- AC28-C49-06 — Weak-network/device tests prove bounded metadata-first browsing, lazy body/file/map loading, meaningful retry and safe input recovery without a false offline-save promise. No all-record browser filtering, per-card financial fan-out or silent truncation is accepted as complete behavior.
- AC28-C49-07 — Before activation, owners declare and measure supported cardinalities, concurrency, request/query/memory, latency/freshness and recovery bounds against production-shaped data. The exact ratified operational thresholds below are preserved; unspecified budgets require owner qualification rather than invented universal numbers.
- AC28-C49-08 — Migration and mixed-version tests preserve existing choices, prevent inferred historical enrollment/publication/grants, fence incompatible old writers and prove containment without deleting independent source history or reviving ended access. When old software cannot represent accepted new history, recovery uses a safe forward correction rather than unsafe rollback.
- AC28-C49-09 — Retention for drafts, accepted narratives, source evidence, preferences and copies is finite and classification-owned where required; access expiry is not retention expiry. Activation requires the actual schedules and restore behavior without importing an unrelated phase's duration.
- AC28-C49-10 — Decision, glossary, source-owner contracts, requirements, design, implementation work, tests and release evidence agree on role names, states, periods, defaults and exact limits. Documentary checks, synthetic examples and read-only code inspection are not reported as deployed authorization, provider or usability proof.
- AC28-C49-11 — Each applicable signal in the following operating table has a working route to its named owner and the stated response. Monitoring never supplies permission to launch a known incorrect or unsafe journey.
- AC28-C49-12 — Protected durable history records the actual actor, subject, purpose, reviewed scope/version, transition cause and stable effect identity, separately from technical logs and narrative bodies. Diagnostic events do not copy protected prose or invitation proof; an audit reference retained after access ends grants no right to read the former shared content.
- AC28-F41-01 — Hostile requests cannot substitute another tenant, Legal Entity, Party, owner, source revision or approver through any exposed or privileged path, including updates to previously permitted rows.
- AC28-F41-02 — Database/command tests prove forbidden cross-tenant references, duplicate current goal heads, duplicate purpose coverage and destructive attribution changes are rejected, not merely hidden by the UI.
- AC28-F41-03 — Current hosted grants/RLS and service-path evidence qualify the intended boundary independently of migration text or a passing mock test.
- AC28-F42-01 — A failure after source commit but before task projection is repaired from the original durable intent into one task member without reposting money or generating another purpose.
- AC28-F42-02 — Revocation or material source correction winning the acceptance order rejects a stale action even if its initial check passed; harmless unrelated changes do not unnecessarily invalidate the reviewed scope.
- AC28-F42-03 — Duplicate/out-of-order delivery and restore preserve consumed purpose identities, current Off policies and completed human history; replay cannot recreate effects from deleted personal data.
- AC28-F43-01 — Actual phone and assistive journeys can find a reason, inspect exact reviewed members, complete permitted work and recover an unknown result without a hidden hover-only control, color-only state or duplicate action.
- AC28-F43-02 — Users can correctly distinguish goal Save from publication, gift report from financial posting, Done from sending, and notices Off from erasing financial facts in observed task-based usability checks.
- AC28-F43-03 — Switching tenant/account during an outstanding response neither displays the old private result nor submits its action in the new context.
- AC28-F44-01 — Activation evidence includes positive/negative source proofs, actual database and alternate-path authorization tests, exact-unit boundaries, controlled acceptance races, idempotent recovery, restore, accessibility and source-shaped performance results for the specific enabled lane.
- AC28-F44-02 — Unproved historical rows are quarantined for owner resolution without guessed money units, campaign origin or new follow-up; independently qualified rows and ordinary authorized work remain usable.
- AC28-F44-03 — Failure exercises trigger the stated owner response below and preserve financial facts, source history and purpose identities during recovery.
- AC28-M32-01 — Given a connection whose actual grant also supports calendar, when Stop email is chosen, then new local mail admissions stop immediately without falsely claiming remote scope revocation or automatic removal of calendar data.
- AC28-M32-02 — Given Remove provider access affects a shared grant, when the action is confirmed through the owner flow, then affected local purposes are fenced first and actual impact is disclosed without another Tenant’s private connection details.
- AC28-M32-03 — Given calendar-only reconnect returns accumulated provider scopes, when local purposes are evaluated, then stopped mail remains stopped, mail scopes are not newly requested for calendar convenience, and no old send or readable body returns.
- AC28-M41-01 — Given supported keyboard, touch, assistive technology, 320-CSS-pixel reflow, zoom, long translation, RTL or IME use, when a complete representative journey is performed, then controls and state are perceivable and operable without color/toast-only success or hidden destructive action.
- AC28-M41-02 — Given a network delay, permission change or context switch during a save, admission or protected read, when the response arrives, then only current permitted state is shown and no optimistic timer or stale response presents false success or protected content.
- AC28-M41-03 — Given no JavaScript on public intake or missing minimal script on the protected link, when the supported journey is used, then its qualified path or safe help is provided and the protected verifier protocol is never weakened to obtain apparent completion.
- AC28-M42-01 — Given missing exact producer qualification, unsupported contract version, invalid legacy provenance or a rollback, when affected work attempts activation or dispatch, then it is fenced while permitted manual work, withdrawal and durable accepted/unknown evidence remain usable.
- AC28-M42-02 — Given a database restore lacks post-snapshot authority or external-attempt evidence, when protected reads or effect workers resume, then quarantine and Recovery unknown persist until source reconciliation; no new create/send or body resurrection is inferred from absence.
- AC28-M42-03 — Given any operating signal reaches its adopted threshold, when bounded fault injection or an actual incident exercises it, then the named accountable owner receives body-free actionable evidence and the specified containment/recovery occurs without provider replay, bulk consent edits or secret-filled diagnostics.
- AC28-M42-04 — Given implementation is proposed for release, when its proof pack is reviewed, then actual source/SQL, restricted-role UI, editor and exact provider seams prove applicable positive, denial, concurrency, expiry, failure, recovery, restore and retention behavior; historical synthetic evidence and a passing generic helper test cannot substitute.
- AC28-Q06-01 — Turning missionary gift reporting Off blocks new reports while Finance continues the same accepted intake and the reporter retains only currently permitted recovery.
- AC28-Q06-02 — Turning a coaching module/share Off removes that exact access without deleting unrelated duties or reviving an ended share when reenabled; Page signup hide retains its separately adopted pending-request behavior.
- AC28-Q06-03 — Reload and a second permitted session show the actual accepted configuration; permission loss, stale revision and an uncertain save cannot produce a false Saved or effective-On state.
- AC28-Q07-02 — A caller's forged tenant, actor, owner, approval or audit fields are rejected or resolved to trusted permitted context; no accepted history attributes the effect to the forged actor.
- AC28-Q07-03 — The qualified public-reader Join/confirmation path works without a staff profile, while revoked, stale or unqualified identity proof fails safely without granting other product access.
- AC28-Q08-01 — Two differently authorized viewers using the same saved filter receive only their own permitted records, counts, facets and export fields, including after cache reuse.
- AC28-Q08-02 — An anonymous gift whose donor is missing from the returned roster remains anonymous in UI, API, task title, coach view, export and ordinary diagnostics.
- AC28-Q08-03 — Wrong-tenant identifiers, cursors and cache entries expose neither private values nor record existence, and a source failure produces an honest unavailable outcome rather than stale private content.
- AC28-Q09-01 — Loading only part of a roster or gift history does not change a complete qualified total or cause an unsupported “none,” first gift or excess determination.
- AC28-Q09-02 — A failed or incomplete source displays its true limitation instead of zero support, no partners or a fabricated financial conclusion.
- AC28-Q09-03 — Corrections, refunds and delayed observations update authorized source-derived figures without duplicate recognition or received money, while independently authorized continuing relationships remain usable.
- AC28-Q10-01 — Equivalent list, board, detail and shortcut submissions reach the same source validation and yield one consistent authoritative result/history.
- AC28-Q10-02 — A consumer cannot write a source-owned financial, consent, publication or identity fact through a projection, raw table, provider event or direct adapter bypass.
- AC28-Q10-03 — An unavailable dependency blocks only its affected effect and produces no substitute fact; unrelated qualified native work remains usable.
- AC28-Q11-01 — Using actual database roles, an otherwise permitted edit cannot change tenant, owner, author, scope, source reference or authority state outside its contract, including via upsert, RPC, view or privileged path.
- AC28-Q11-02 — Missing/forbidden references, duplicate source effects and invalid state combinations fail atomically; deletion cannot silently cascade away protected evidence or valid dependent work.
- AC28-Q11-03 — The deployed grant/policy matrix demonstrates both intended successful access and denied cross-context access; SQL text assertions and default exposure assumptions are not accepted as this proof.
- AC28-Q12-01 — A committed command with a lost response is retried through different transport attempts and results in one source effect, one required history acceptance and one intended downstream effect.
- AC28-Q12-02 — Fault injection between proposed writes leaves either no accepted source work or durable recoverable required handoff; repeated recovery cannot duplicate the effect.
- AC28-Q12-03 — Reusing an effect identity with changed purpose, recipient or payload conflicts without changing the earlier accepted result; genuinely distinct admitted occurrences remain possible.
- AC28-Q13-01 — Two real database sessions editing the same protected revision produce the permitted serialized outcome and a recoverable conflict, rather than a silent lost update.
- AC28-Q13-02 — A stale contact form can update its still-permitted deliberate changes only under the qualified conflict rule; it cannot restore removed access, overwrite newer unrelated fields or default a foreign address to another country.
- AC28-Q13-03 — Races between action and controlling withdrawal, expiry, disable or permission loss preserve the source's documented order and leave no forbidden later effect.
- AC28-Q14-01 — When an interaction is saved but the next task is not, the UI preserves that exact result and recovery creates only the missing task.
- AC28-Q14-02 — A timeout after source commit presents uncertainty with same-operation recovery, never optimistic completion or a blind fresh submission.
- AC28-Q14-03 — A later revoked viewer cannot retrieve private result details, and an earlier successful subscription receipt does not claim current subscription after withdrawal.
- AC28-Q15-01 — Literal worked examples for supported zero-, two- and three-decimal currencies render and aggregate exactly; compatible scope/period is proved before comparison.
- AC28-Q15-02 — Last-day nonmidnight gifts, leap days, DST and timezone changes retain the owning financial/referral/confirmation boundary without omission or extra validity.
- AC28-Q15-03 — An action waiting across its deadline is denied at the authoritative transition; a later display timezone, resend or retry cannot extend the original period.
- AC28-Q16-01 — Departure with private preparation, shared duty, coaching access and pending newsletter work produces each owner's documented result without exposing private preparation to staff.
- AC28-Q16-02 — Return before or after the applicable deadline, temporary suspension and a same-email replacement are distinguished; only the intended eligible actor can resume selected preparation.
- AC28-Q16-03 — Cleanup, export and restore cannot revive expired private access or delete still-required lawful duty/completion evidence as an unintended cascade.
- AC28-Q17-01 — A representative complete job can be completed by keyboard and on a narrow touch viewport with no inaccessible drag-only, map-only or hover-only step.
- AC28-Q17-02 — Validation exposes labeled field errors; dialogs restore focus; asynchronous failure and recovery are perceivable with a screen reader and do not erase authorized input or list position.
- AC28-Q17-03 — Composed screens pass the applicable automated accessibility checks and manual keyboard, reading-order, zoom, contrast and touch-target review; a component or screenshot pass alone is insufficient.
- AC28-Q18-01 — Long translated text, international names/addresses and supported currencies remain readable and editable without clipping, forced domestic values or loss of meaning.
- AC28-Q18-02 — Offline or delayed submission never shows false completion; reconnect offers the permitted original-effect recovery instead of silently replaying consent, sends, publication or money actions.
- AC28-Q18-03 — Public intake works under its no-JavaScript contract; missing protected-confirmation script support produces safe useful explanation without consuming proof or inventing an alternate token protocol.
- AC28-Q19-01 — Disabling or withholding one exact unqualified source effect leaves independently qualified relationship/task work usable and presents a real permitted repair route.
- AC28-Q19-02 — An enabled setting with an unqualified producer cannot accept the affected consequential action or display it as ready.
- AC28-Q19-03 — Under the settled D48–D50 policy, an unqualified correction command or attribution/coverage adapter leaves its affected effect or measure unavailable without inferred attribution, posted correction or substitute authority, and its remaining implementation/qualification dependency is explicitly traceable.
- AC28-Q23-02 — Fault injection triggers each applicable adopted signal, routes to its bound owner and demonstrates the specified response through existing operational tooling.
- AC28-Q24-01 — Each implemented journey maps to a real user-level acceptance case plus only the necessary supporting source/DB/provider proof, with named observable success and failure outcomes.
- AC28-Q24-02 — A refactor preserving public behavior does not require rewriting tests merely because private helpers, query ordering or component structure changed.
- AC28-Q24-03 — Required suite manifests distinguish executed, failed, skipped and blocked cases; absent mandatory fixtures cannot produce a qualified release or a skipped-green claim.
- AC28-Q25-01 — Real allowed/denied roles, current permission changes and attempted permitted-row-to-forbidden-state mutations produce the correct outcome through every reached table, RPC, view, storage and privileged path.
- AC28-Q25-02 — Concurrent acceptance/disable, completion/revocation, expiry/resume and confirm/withdraw tests prove one valid serialized business outcome, including a lock wait crossing expiry and response loss after commit.
- AC28-Q25-03 — The genuine qualified verified-address path succeeds while demo/admin/autoconfirm/unknown evidence cannot masquerade as mailbox proof; guest confirmation grants no Auth or workforce privilege.
- AC28-Q25-04 — Scanner/GET/HEAD and abandoned protected landings create no subscription; delayed or repeated provider outcomes cannot create consent, renew proof or replay a terminal effect.
- AC28-Q26-01 — Workloads representing the intended cohort and a larger individual tenant meet the declared owner budgets, with reproducible data, concurrency and plan evidence.
- AC28-Q26-02 — Boundary fixtures around actual gift/donor/task and API page limits preserve complete totals, correct coverage and authorized traversal without missing or duplicated records.
- AC28-Q26-03 — Background expiry/disposition and ordinary recovery remain bounded and do not require scanning unrelated tenant histories or serializing unrelated tenants behind a global lock.
- AC28-Q27-01 — Representative users complete setup/context selection, ordinary work and applicable communication/coaching/recovery jobs; observed confusion and blocking failures are recorded and resolved before affected activation.
- AC28-Q27-02 — Every requirement and acceptance criterion resolves to its current decision/owner and executed proof or explicit incomplete gate, with no historical research result relabeled as new runtime evidence.
- AC28-Q27-03 — Release completion is withheld until the affected source, migration, security, accessibility, capacity and representative-user obligations pass; documentation publication alone cannot satisfy that claim.
- AC28-R01-03 — Given a draft, upload, selected recipient or outstanding response in one context, when Maya changes context or loses its authority, then none is applied to the new context and known-obsolete responses cannot restore protected old content; accepted source effects remain recoverable only under current authority.
- AC28-R43-01 — Given any trigger above crosses its stated threshold, when operations processes the signal, then the assigned owner executes the listed containment/repair response without waiting for a broader trend or weakening current authority.
- AC28-R43-02 — Given activation is requested, when qualification is reviewed, then actual source adapters, finite supported bounds, numeric workload/recovery budgets, minimum samples, copy-disposal evidence and accountable on-call ownership are recorded; missing evidence gates the dependent capability rather than reclassifying a required journey as optional.
- AC28-R43-03 — Given a restore, rollback, retry or repair, when normal reads and jobs resume, then newer restrictions, dispositions, exact accepted cycles/effects and current grants remain authoritative and no private bodies are placed into broad logs to diagnose the issue.
- AC28-R43-04 — Given a representative missionary/staff or accessibility test exposes a listed critical misunderstanding or task blocker, when release is evaluated, then that affected journey does not activate until corrected and retested; vendor examples and planning models are not substitutes for this evidence.
Implementation decisions and slice boundaries
- Aggregate per-slice source/security/accessibility/capacity evidence and execute the remaining composed user journeys through the confirmed seams. Do not reimplement every feature or treat a document/synthetic model as runtime proof.
- Bind adopted signals, thresholds, accountable roles and responses to a real roster; execute bounded fault injection. Source-specific stricter thresholds remain authoritative. An unset required budget/owner or missing mandatory fixture blocks affected activation.
- Recruit actual representative missionary, staff, donor/reader and coach participants including new/experienced, mobile/assistive and restricted-access cases. Record comprehension, errors and repair. An agent cannot fabricate participation or mark a planned pilot complete.
- Preserve D1–D50/C01–C20 and source reconciliation through glossary/ADR/OpenSpec/design/issue/test/release trace. Source PR docs(AL-2064): add Phase 28 implementation specification #2065 integration is an explicit delivery precondition, not proof of feature implementation.
Composed proof boundary
This ticket verifies the whole-system scenario against completed per-slice behavior. It owns evidence aggregation and the concrete operator/user release job, not missing product implementation. Read the linked exact requirements for its full clauses, operation tables and thresholds; do not treat this checklist as the entire spec.
Testing, migration and operating obligations
Every reached layer belongs to this slice: actual source persistence and upgrade behavior, canonical command/query, permitted UI, and executed proof. Reuse native owners, shared Base UI/base-maia components and the established architecture. No parallel CRM, Tasks, consent, sender, permission or retention engine.
Before affected activation, prove current trusted tenant/actor/subject/role and fine-grained purpose/field authority, effective old-row/new-row RLS and grants, same-tenant relationships, applicable uniqueness/history/delete constraints, and every reached view/RPC/storage/service path. Caller identifiers and metadata are never authority. Source revision and privacy checks precede disclosure and are repeated after ordering waits where required.
Implement semantic idempotency, required source history/receipt and durable secondary intent, truthful partial/unknown/lost-response recovery, context-switch/revocation fencing, temporal boundaries and correction lineage. Preserve each adopted default and exact Off/new-work/accepted-work/reenable behavior. Never infer consent, money, completion or actual interaction from a presentation action.
Test through existing Playwright whole-user journeys as the primary boundary; use canonical API Vitest tests, real PostgreSQL roles and at least two concurrent sessions, qualified Auth and existing provider-contract seams where the browser cannot prove the guarantee. Reuse existing account-frame/session-guard, task-recovery, roster/redaction, operation-handler, dispatch/restriction, field-policy SQL and replay proof patterns while retaining their demo/mock limits. No new test framework and no skipped mandatory fixture may count as a pass.
Use persistent truthful outcomes, clear context and next steps, keyboard/screen-reader/touch/list equivalents, narrow-screen reflow, localization, safe international data and honest interrupted-connection recovery. Inventory and fence reached legacy writers/readers, preserve lawful history and unresolved obligations, and qualify mixed versions, restore, retention and containment before activation. Adopt existing source-specific signals/thresholds/owners/responses and measured cohort budgets; do not invent a numeric SLO or defer correctness to monitoring.
Shared requirements Q01–Q27 apply where relevant to every ticket. R43, F41–F44, M41–M42 and C49 apply to their affected lanes. W05/W06 aggregate composed evidence; they are not permission to defer any slice’s safeguards.
Blocked by
A blocker’s closure is not runtime qualification: verify the exact consumed revision and executed proof. Keep independently qualified capabilities useful while an affected effect is unavailable. Integrate the approved specification into the implementation base; the open documentation PR is not evidence that these features exist.
Related approved slices
Short ticket keys in implementation notes resolve here. Published requirement, acceptance, story, decision and completeness codes retain their original meanings.
- P28-C01 / #2130 — Invite, admit and stop one read-only coach
- P28-C20 / #2149 — Enable and browse approved regional ministry listings
- P28-W05 / #2151 — Recover and contain the composed workspace after restore
The full execution index and primary-acceptance ownership map are published with the Phase 28 release-qualification ticket. Every shared safeguard remains mandatory within its implementing slice.
Activity
[-][P28-W06] Qualify whole journeys and the exact Phase 28 release cohort[/-][+]AL-2152 — [P28-W06] Qualify whole journeys and the exact Phase 28 release cohort[/+]cobmojo commentedon Oct 19, 2026
Phase 28 implementation execution index
Approved source: spec #2064, source PR #2065, revision
e93e2e9958f32380e28ec0e005d7ef3ee24f7e7a.This index covers 84 approved tickets, 205 requirements and 768 canonical acceptance criteria. Each ticket contains its applicable normative requirements, exact primary acceptance criteria, implementation boundaries, existing owner contracts, tests and source links. Read the full ticket and applicable source material before coding. The separate acceptance-ownership comment on this issue maps every criterion to its primary proof owner.
Work the frontier: choose a ticket only when its native blockers and exact component-qualification gates are satisfied.
ready-for-agentmeans the ticket is specified; it does not mean upstream work is complete. Publication is not implementation, source qualification, activation or release evidence. Integrate the approved source documentation through its existing PR workflow before relying on a base branch that lacks it.Use the confirmed existing test seams: Playwright user journeys, canonical API tests, real PostgreSQL/RLS/concurrency tests, and qualified Auth/provider contract tests where a browser cannot prove the guarantee. Do not add a parallel framework or count mocks as source qualification. Shared safety, UX, migration and operating obligations belong in every affected slice; W05/W06 aggregate proof and cannot postpone those safeguards.
The table is a valid publication order, not a mandatory serial execution chain. Only the direct blockers listed on each ticket gate that ticket. The native relationships are authoritative execution metadata; the bodies preserve the exact consumed contracts. Plan-key gaps M05 and M19 are intentional approved merges into M06 and M20.
P28-W/R/F/M/C labels are execution-plan keys, not source US28/REQ28/AC28 identifiers. The acceptance-ownership table maps the source criteria to these tickets; matching numeric suffixes alone do not establish ownership.
A missionary enters the correct organization and subject, distinguishes no access from a failed load, and switches safely without exposing another context or requiring optional setup.
Maya creates, edits, defers, completes, reopens or deletes permitted Independent work, sees truthful Home/list/board state, and recovers accepted actions without compulsory interaction logging.
Maya records an actual call, message, conversation or meeting outcome once and can add an explicit next task, with honest partial-success recovery and no fabricated activity.
Staff establish the finite preparation policy; Maya saves and reopens her own incomplete early preparation with a clear restricted audience and safe identity reuse.
Staff configure independent New and Continued periods; Maya records when a referral was actually given and sees its true last follow-up day, Expired result or honest unknown timing.
A missionary creates, reschedules and cancels one timed appointment in Asym and returns to it without connecting a calendar or inventing an actual interaction.
Maya moves from preparation or referral into an Appointment, actual interaction, Request response and next action; source-controlled work ends only through its qualified owner outcome.
Maya reviews the exact contact facts and ordinary staff audience, shares deliberately, and staff discover the canonical contact while private history remains restricted.
Maya optionally selects eligible staff to receive one informational in-product notice after sharing, with separate share and notice outcomes.
Authorized staff control existing missionary edit permissions; Maya safely changes only selected eligible shared contact values and recovers conflicts without overwriting other facts.
A genuine source-confirmed departure immediately ends the former reader’s access and schedules only the right preparation under its historically applicable finite deadline.
Records operators can see truthful copy outcomes while expired preparation becomes unreadable and eligible bodies/derivatives are disposed under qualified holds and restoration rules.
Maya removes unused unshared preparation from Active, finds it under Archived, and deliberately returns the same entry without changing other work.
A returning original author finds only her eligible retained preparation and resumes selected entries into current work; archived entries retain their working state.
Maya uploads a supported CSV/TSV/TXT file, confirms mapping and exclusions in a recoverable preview, then can discard it; private input expires and is disposed on time.
Maya deliberately imports reviewed eligible contact rows into restricted preparation, sees exact per-row results, and cancels/discards without repeating or deleting accepted work.
Reupload and row retry recover prior accepted effects; changed files show safe discrepancies rather than duplicate, merge or overwrite contact facts.
Rows containing negative or ambiguous contactability evidence can be accepted only when the exact communication owner records and enforces the matching restriction.
Maya can select one worksheet from a supported XLSX workbook, preview and import only intended contact assertions while every advertised format and capacity boundary is enforced.
Maya finds recognizable earlier referral work using an optional Expired filter without receiving old contact details or confusing expiry with donor refusal.
Where the organization permits it, Maya deliberately continues an eligible expired referral with a displayed end date; authorized staff retain their separate lane and recovery never renews it again.
An independently authorized source corrector reviews factual before/after timing and repairs the effective endpoint while preserving original terms and any later continuation.
Maya keeps authorized continuing financial and nonfinancial relationships in ordinary work while recognition views separately describe giving recency and current commitments.
Maya reads received money, recognized support, commitments, planning and any independently permitted balance in the existing workspace with exact subject/currency/period meanings; incomplete sources affect only their own card or conclusion.
Staff configure Staff-managed or Missionary-managed goals, with explicit exact-subject inheritance/overrides; an authorized editor saves one versioned optional workspace goal and understands its scope and non-public effect.
Maya compares qualified received or planned support with the exact compatible goal, sees over-goal progress truthfully, and sees no percentage when a target or source is absent, denied or incompatible.
A permitted goal editor deliberately copies a compatible approved Plan amount, reviews its exact version and saves a goal with provenance; later Plan or goal changes remain independent.
A source-qualified first gift to the exact ministry creates one Independent follow-up; Maya can choose Done or Not needed without recording a fictional interaction, and repairs preserve the permanent purpose.
An authorized staff member or permitted missionary records donor-stated additional support against an eligible gift or exact portion; Maya sees compatible gifts in one existing task and handles only the members she actually reviewed.
Staff may enable one optional amount rule with an exact threshold per supported currency; newly eligible gifts at or above that boundary receive the existing factual follow-up while setting changes preserve accepted work.
Staff can enable one optional organization rule; an eligible donor-confirmed bounded need creates or enriches the same follow-up with a clear safe reason such as Gift for vehicle repairs.
Phase16 proves the exact gift portion above a recorded commitment, and Maya sees that factual reason in the existing follow-up even for one supported minor unit; source corrections preserve conservation.
The source accepts the positive money-derived crossing of an entire fixed promise and creates one separately evidenced Independent follow-up that Maya can handle without completing or modifying money.
Authorized staff choose Combine compatible follow-ups or Keep separate; Maya can review the causally linked gift and fulfilled commitment together and complete either or both with separate exact receipts.
Organizations can turn on a simple missionary doorway for reporting actual offline receipt; Maya records known facts once into the existing intake and sees Awaiting finance or truthful uncertainty, including after reporting is turned Off.
Maya and Finance see the same intake progress into exact recorded money while unresolved physical handling and duplicate/already-recorded resolution remain truthful and independently owned.
Maya sees a source-confirmed missed automatic occurrence and the next regular scheduled gift as separate informational facts, and can deliberately add ordinary follow-up.
Staff can turn new in-product missed-gift notices On or Off while Maya retains authorized financial facts and prior notice history; queued candidates obey the effective choice at publication.
Staff remap a source code prospectively, see Earlier gifts keep their recorded campaign, and new gifts receive the mapping only at their qualified authoritative association event.
Continuing recurring installments inherit their accepted campaign despite map or ordinary schedule changes; authorized staff deliberately amend only eligible future occurrence attribution, while separately recorded matched gifts keep their own origin.
Finance chooses the permitted correction policy and deliberately applies or requests approval for one reviewed correction; current policy and independent-human checks govern final application while append-only history remains intact.
Finance reviews and deliberately applies a campaign-only correction through the existing append-only source command, preserving a correct source code and historical artifacts while current reporting uses the correction.
Staff compare This campaign only with Including sub-campaigns using distinct qualified lines, safely move an open hierarchy, and understand current totals versus preserved closed or issued historical reports.
A permitted missionary can start from an approved layout, edit subject/preheader/prose, save, reopen or restore an eligible version and inspect accurate inert desktop/mobile/plain-text preview without sending or needing AI.
One authorized synthetic native issue test can reach an observable Prepared definitely unsubmitted result with immutable bytes and one durable attempt identity at the sole P6 adapter boundary; fault recovery preserves that exact result.
An author can send the saved revision as clearly marked real test mail to one current access-confirmed reviewer, then see the exact operational outcome without subscribing anyone.
Authorized staff and exact-Page contributors offer a source-ready newsletter invitation; a guest submits Email/optional Name, receives an exact seven-day request and deliberately confirms without a gift or account.
A reader sees a permitted existing subscription, changes only its channel/purpose choices, unsubscribes without staff/login and deliberately rejoins without clearing stronger restrictions.
An authorized missionary reviews exact content, audience, sender and monitored reply path, Sends once, and sees accurate independent recipient outcomes with safe stop/recovery.
An author deliberately reuses an approved Update and permitted picture/video, reviews its known post-notice overlap, and safely sends the exact reused issue without publishing upstream changes or exposing protected media.
A reader can complete eligible accepted work after Page hide and recover interrupted confirmation or deliberately resend without new consent or a renewed deadline.
A signed-in reader deliberately Joins/Rejoins immediately using current qualified address proof or chooses another address without modifying their account.
An authorized missionary chooses one future instant with timezone, sees Scheduled, and can safely edit, reschedule or cancel definitely unsubmitted work without reviving old authorization.
A missionary reviews an exact current postal audience and downloads a useful print rendition, recipient list and labels without exposing unrelated data or claiming it was mailed.
A missionary permitted by the organization connects their own primary supported mailbox and can stop Asym email or remove actual provider access without hidden calendar side effects.
A missionary connects a supported calendar, deliberately adds one minimal appointment copy to an exact chosen destination, and can reconcile a lost response without creating a duplicate.
A missionary reschedules in Asym, sees whether the same external copy is current, and deliberately stops, removes, disconnects or resumes with truthful effects.
A missionary opens one eligible contact or restricted prospect, writes a private message with exact From/To, and can save/recover it without sending or sharing prose to staff.
A missionary sends exactly the reviewed individual message once through the supported own account, understands Accepted/Not sent/Unknown, and retains only permitted body-free outreach evidence afterward.
Staff deliberately enable the tenant-owned writing purpose with finite allowances; an author requests help for saved selected prose, compares the complete suggestion and Uses or Discards it with bounded cost, privacy and current source authority.
Authors can deliberately Rephrase, Simplify, Shorten, Lengthen or Make more compelling using the same safe selection/review workflow, with independently qualified language/action profiles.
Maya invites an eligible named coach; the intended person proves identity, accepts once, views the exact shared subject read-only under current authority, and can Leave or have the share stopped without losing source work.
A coach browses only their admitted subjects; Maya previews the actual proposed named-recipient disclosure and changes exact module scope while staff can stop a module without ending independent work.
Maya chooses permitted ongoing sharing or an optional Share-through day, sees the actual zone/end, and safely changes the duration without reviving an ended episode.
Maya deliberately shares a current received-support summary; the coach sees exact qualified contribution totals, units and coverage without donor rows or spendable-balance claims.
A coach sees separately labeled qualified expected support derived from actual dated commitment occurrences, with honest unavailable historical terms and no debt or received-money inference.
Maya reviews literal earlier date ranges, and the coach sees current qualified expected/received evaluations within those fixed boundaries, with explicit corrected values and gaps.
Maya creates a voluntary weekly, monthly or one-off Calls made target and sees attributable actual attempts counted once in the correct calendar period, independently of money goals or coaching.
Maya can choose Personal messages and sees a manually recorded actual authored submission or qualified provider-accepted send counted once, while pending/unknown sends remain unavailable.
Maya can choose Conversations or Meetings held and sees actual qualified exchanges/participation reflected once, with overlapping measures shown separately.
Maya changes a target with clear current/future effect, pauses comparisons without stopping recording, and resumes without rewriting history or inventing missed work.
Maya reviews one target and first admitted period; the coach receives a complete compatible numeric comparison and future same-target periods while private labels and activity rows remain hidden.
Maya writes a plain-text check-in with no coach, questions, title, period or target prerequisite; acknowledged autosave and conflict recovery preserve the actual private draft outcome.
Maya explicitly shares one reviewed version to an entire eligible recipient set, edits privately afterward, updates deliberately and stops access independently of draft validity; coaches see only admitted text.
Staff maintain zero to five optional questions; a missionary can use or hide them while exact editor-start wording/order remains attached to saved and later shared answers.
Maya selects an eligible current task and approves a short safe description; the coach reads its live due/status and loses the old description when task meaning changes, without acquiring task powers.
A qualified curator prepares and publishes an audience-safe resource reference; missionaries find and open it in a bounded searchable library, return to place, and stop seeing it after withdrawal.
A curator publishes one scanned, approved immutable file version; authorized missionaries open/download those exact bytes, and replacement/withdrawal remains safe through direct links and delivery infrastructure.
Staff draft, preview, publish, disable and deliberately re-offer one advice-first guide; Maya finds it in Resources, may hide the Home invitation, skip, revisit and use it in any order.
A curator attaches approved resource and workspace destinations, and Maya opens the actual authorized native journey while inaccessible destinations and dependent unsafe wording stay undisclosed.
Staff enable one initially-Off discovery control; Maya browses a complete authorized list of current public ministries by broad region with truthful empty, unavailable and Off states.
Maya switches between the regional list and a functioning lazy-loaded world map with one explicit selection, keyboard controls and safe list fallback when rendering fails.
An operator restores or rolls forward a production-shaped workspace, reconciles later withdrawals and consumed effects, and reopens only safe paths while unrelated work remains usable.
Representative missionaries, staff, coaches and readers demonstrate the complete phase; product and operations can enable the qualified cohort with traceable evidence and real monitoring owners.
Existing owners and exact component gates
Existing #897 gains the approved missing-producer blocker P28-M02 / #2113. Its prior blockers remain intact. The parent spec and existing owner issue retain their body, title, state, labels and comments. There are 184 direct blocker links on new tickets plus this one existing-issue link: 185 added blocking relationships, and 84 native children of the parent spec.
W01's existing #667–#670 edges and R12's #680 edge retain the already approved component-coordination exception: keep the native links while the exact consumed component is absent. Release an affected link only with its landed component revision and actual source/consumer proof, without closing the owner or requiring unrelated work. An interface or mock is insufficient. Other tickets retain their exact approved owner gates.
Do not create alternative sources of truth or reinterpret legacy owner wording as a new product decision. In particular: ordinary independent tasks do not require cultivation enrollment; the shared personal connection/grant component does not require personal email to be enabled for calendar use; postal use does not require email opt-in; received and expected financial reads retain independent owners; the communication producer does not depend on its #897 consumer; public-reader admission has its own authorization path.
Use each ticket's actual source readiness, safe disabled states and operational thresholds. Existing upstream issues still require their own qualified implementation; their existence or closure alone is not proof of the consumed component.
cobmojo commentedon Oct 19, 2026
Phase 28 primary acceptance ownership
Source: spec #2064, revision
e93e2e9958f32380e28ec0e005d7ef3ee24f7e7a. The execution-index comment on this issue lists all 84 tickets and their direct blockers.Every one of the 205 requirements and 768 canonical acceptance criteria is represented below. For each row, append the listed two-digit suffix to its explicit AC prefix: for example
AC28-Q01-plus01meansAC28-Q01-01. Each suffix has exactly one primary proof owner. The full unchanged acceptance text is in that owner's ticket; the governing requirement remains applicable to every component it touches.Primary ownership identifies who records the complete proof; it does not excuse other slices from the same safeguard. Component obligations remain within their implementing slices. M02 contributes its five exact approved producer obligations and component proof allocation without inventing canonical AC identifiers. W05/W06 own aggregate evidence only where assigned.
P28-W/R/F/M/C labels identify execution tickets. They are distinct from source US28/REQ28/AC28 identifiers; use this mapping instead of matching numeric suffixes.
AC28-Q01-AC28-Q02-AC28-Q03-AC28-Q04-AC28-Q05-AC28-Q06-AC28-Q07-AC28-Q08-AC28-Q09-AC28-Q10-AC28-Q11-AC28-Q12-AC28-Q13-AC28-Q14-AC28-Q15-AC28-Q16-AC28-Q17-AC28-Q18-AC28-Q19-AC28-Q20-AC28-Q21-AC28-Q22-AC28-Q23-AC28-Q24-AC28-Q25-AC28-Q26-AC28-Q27-AC28-R01-AC28-R02-AC28-R03-AC28-R04-AC28-R05-AC28-R06-AC28-R07-AC28-R08-AC28-R09-AC28-R10-AC28-R11-AC28-R12-AC28-R13-AC28-R14-AC28-R15-AC28-R16-AC28-R17-AC28-R18-AC28-R19-AC28-R20-AC28-R21-AC28-R22-AC28-R23-AC28-R24-AC28-R25-AC28-R26-AC28-R27-AC28-R28-AC28-R29-AC28-R30-AC28-R31-AC28-R32-AC28-R33-AC28-R34-AC28-R35-AC28-R36-AC28-R37-AC28-R38-AC28-R39-AC28-R40-AC28-R41-AC28-R42-AC28-R43-AC28-F01-AC28-F02-AC28-F03-AC28-F04-AC28-F05-AC28-F06-AC28-F07-AC28-F08-AC28-F09-AC28-F10-AC28-F11-AC28-F12-AC28-F13-AC28-F14-AC28-F15-AC28-F16-AC28-F17-AC28-F18-AC28-F19-AC28-F20-AC28-F21-AC28-F22-AC28-F23-AC28-F24-AC28-F25-AC28-F26-AC28-F27-AC28-F28-AC28-F29-AC28-F30-AC28-F31-AC28-F32-AC28-F33-AC28-F34-AC28-F35-AC28-F36-AC28-F37-AC28-F38-AC28-F39-AC28-F40-AC28-F41-AC28-F42-AC28-F43-AC28-F44-AC28-M01-AC28-M02-AC28-M03-AC28-M04-AC28-M05-AC28-M06-AC28-M07-AC28-M08-AC28-M09-AC28-M10-AC28-M11-AC28-M12-AC28-M13-AC28-M14-AC28-M15-AC28-M16-AC28-M17-AC28-M18-AC28-M19-AC28-M20-AC28-M21-AC28-M22-AC28-M23-AC28-M24-AC28-M25-AC28-M26-AC28-M27-AC28-M28-AC28-M29-AC28-M30-AC28-M31-AC28-M32-AC28-M33-AC28-M34-AC28-M35-AC28-M36-AC28-M37-AC28-M38-AC28-M39-AC28-M40-AC28-M41-AC28-M42-AC28-C01-AC28-C02-AC28-C03-AC28-C04-AC28-C05-AC28-C06-AC28-C07-AC28-C08-AC28-C09-AC28-C10-AC28-C11-AC28-C12-AC28-C13-AC28-C14-AC28-C15-AC28-C16-AC28-C17-AC28-C18-AC28-C19-AC28-C20-AC28-C21-AC28-C22-AC28-C23-AC28-C24-AC28-C25-AC28-C26-AC28-C27-AC28-C28-AC28-C29-AC28-C30-AC28-C31-AC28-C32-AC28-C33-AC28-C34-AC28-C35-AC28-C36-AC28-C37-AC28-C38-AC28-C39-AC28-C40-AC28-C41-AC28-C42-AC28-C43-AC28-C44-AC28-C45-AC28-C46-AC28-C47-AC28-C48-AC28-C49-Shared execution obligations
These approved requirement groups must be implemented and verified by each listed affected slice, even when the complete canonical criterion is primarily assigned elsewhere. All 82 feature slices means W01–W04 plus every R, F, M and C ticket in the execution index; W05/W06 are the two aggregate proof tickets.