Clarify account session controls and add authenticator recovery guidance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

workplans/USER-WP-0027-account-journey-clarity.md

@@ -0,0 +1,97 @@
+---
+id: USER-WP-0027
+type: workplan
+title: "Clear account state and complete user, tenant-admin and platform-admin journeys"
+domain: communication
+repo: user-engine
+status: active
+owner: codex
+topic_slug: communication
+created: "2026-09-13"
+updated: "2026-09-13"
+---
+
+## Establish role-based success, failure and recovery acceptance
+
+```task
+id: USER-WP-0027-T01
+status: done
+priority: high
+```
+
+Defined 29 journeys in docs/account-journeys.md: 13 user, 8 tenant administrator,
+8 platform administrator. Each has success, failure/recovery and current support
+status. The document is the browser acceptance contract, not proof all journeys
+are implemented. Includes OTP state contract and cross-role/isolation checks.
+
+## Make account controls and browser recovery reflect verified state
+
+```task
+id: USER-WP-0027-T02
+status: done
+priority: high
+```
+
+Signed-out/expired sessions show Sign in; verified sessions show identity and
+Log out. Logout uses existing scope confirmation; wrong shared-identity recovery
+stays accessible without implying a portal session. Signed-in registration routes
+to account. Browser errors retain status and gain safe recovery navigation; APIs
+remain JSON. Public /security explains OTP setup/recovery without claiming factor
+state or activation. Fixed HTTPS provider handoff is configurable but disabled by
+default pending provider verification. `make test`: 188 tests, 3 optional skips;
+layer conformance passed. `git diff --check` passed.
+
+## Publish and verify the portal UI cleanup
+
+```task
+id: USER-WP-0027-T03
+status: progress
+priority: high
+```
+
+Publish reviewed source, pin the CI image in rapp-user-engine, deploy with CAS,
+verify readiness, signed-out browser controls, and recovery/security navigation.
+Keep live OTP handoff disabled until T04 dependencies are met.
+
+## Complete provider OTP activation and recovery path
+
+```task
+id: USER-WP-0027-T04
+status: wait
+priority: high
+```
+
+Depends on KEY-WP-0035-T02/T03 and NK-WP-0033 custody handoff. Current owner route
+net-kingdom-privacyidea-admin-token remains non-resolvable. Restore scoped factor
+lookup and verify possession-confirmed enrollment, cancellation, replacement,
+recovery and fresh login; resolve privileged portal policy. Only then configure
+USER_ENGINE_MFA_MANAGEMENT_URL and accept U05–U08/P04–P06. Do not fake a status from
+assurance claims, redirect return parameters or manual step completion.
+
+## Close tenant and platform administrator usability gaps
+
+```task
+id: USER-WP-0027-T05
+status: todo
+priority: high
+```
+
+Implement remaining T02–T08/P02/P04/P07/P08 browser gaps from docs/account-journeys.md:
+clear login-name versus display-name and lifecycle states, delivery confirmation,
+consolidated onboarding diagnosis, scoped lifecycle confirmation/readback, admin
+succession guard review and safe audit/support recovery. Existing headless routes
+are starting points, not browser acceptance. Split into owner workplans as needed.
+
+## Validate all journeys across roles and applications
+
+```task
+id: USER-WP-0027-T06
+status: todo
+priority: high
+```
+
+Execute success/failure/recovery matrix with synthetic user, tenant admin,
+platform operator, expired and wrong-tenant identities. Include invitation/mail,
+actual OTP, shared sign-out, keyboard/mobile, form preservation, and authoritative
+application access (USER-WP-0026-T03). Preserve VERGABE-WP-0019 real-user acceptance.
+Record live evidence and hand off any residuals as live work before closing.