Implement role-based account journeys with database and browser acceptance suites

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

workplans/USER-WP-0030-platform-admin-journeys.md

@@ -0,0 +1,51 @@
+---
+id: USER-WP-0030
+type: workplan
+title: "Platform administration and operational recovery"
+domain: communication
+repo: user-engine
+status: active
+owner: codex
+topic_slug: communication
+created: "2026-09-13"
+updated: "2026-09-13"
+---
+
+Implements docs/account-journeys.md under USER-WP-0027. A passing local
+suite is not evidence that an external provider flow works live.
+
+## Expose scoped audit and delivery recovery
+
+```task
+id: USER-WP-0030-T01
+status: done
+priority: high
+```
+
+P01/P03/P05/P08/T08: authorized browser views of safe audit metadata and delivery state, reference filtering, CSRF replay with readback, no raw payload/credential/error dumps.
+
+## Make tenant lifecycle and bootstrap recoverable
+
+```task
+id: USER-WP-0030-T02
+status: done
+priority: high
+```
+
+P02/P04/P07: preserve first-admin setup on retry without duplication, explicit tenant lifecycle confirmation, stale-version recovery and validation; verify cross-role isolation.
+
+## Integrate provider policy and credential operations
+
+```task
+id: USER-WP-0030-T03
+status: wait
+priority: high
+```
+
+P04–P06: owner-approved factor credential delivery/renewal and provider recovery/policy control. Depends on KEY-WP-0035/NK-WP-0033; no secret vending through portal or chat.
+
+
+Validation: 210 database-enabled regression tests passed with no skips,
+including independent-connection last-admin protection and nested bootstrap
+rollback. Thirteen isolated Chromium checks passed. Provider OTP and application
+access integration remain explicitly open; no complete-journey claim is inferred.