# Account journey release — 2026-09-13

Implemented and deployed user feedback/retry, tenant-scoped identity lifecycle,
last-admin protection, administrator succession, confirmation/stale-state handling,
actual login-name/onboarding/delivery guidance, scoped audit, platform delivery
retry and atomic/retryable first-admin bootstrap.

## Reproducible validation

- `PYTHONDONTWRITEBYTECODE=1 make test`: 210 tests, seven opt-in PostgreSQL skips;
  layer conformance passed.
- Disposable PostgreSQL 16 on local loopback, tmpfs, no production records:
  `USER_ENGINE_POSTGRES_TEST_DSN=postgresql://postgres@127.0.0.1:25432/postgres USER_ENGINE_POSTGRES_TEST_RESET=1 PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src:tests uv run --no-project --with 'psycopg[binary]>=3.2,<4' python -m unittest discover -s tests`
  passed all 210 with zero skips. Covers independent-connection concurrent
  last-admin changes, advisory-lock cleanup, caller-transaction preservation and
  nested bootstrap rollback. Disposable container stopped after validation.
- `make test-journeys JOURNEY_ARGS="--report /tmp/user-engine-journeys.json"`:
  41 tests passed. Durable report: `2026-09-13-journey-report.json`.
- `make test-journeys JOURNEY_ARGS=--require-complete`: tests pass, command fails
  intentionally because 15 of 29 journeys retain named gaps.
- `make test-browser-journeys`: 13 isolated Chromium checks passed against the
  synthetic loopback fixture (user, tenant admin, platform operator).
- Identity provisioner regression: 20 tests passed.
- rapp-user-engine `make check`: four packaging checks passed.
- Portal CI commit 502a8e0: smoke run 141 and journey run 142 succeeded.
  Provider CI commit 84f7635: smoke run 227 and journey run 228 succeeded.
  CI uses pinned Python containers; browser and PostgreSQL acceptance were run
  separately, not claimed as part of dependency-free CI.

## Deployed artifacts

Portal source 1127f852dde8b247bcc7a7f0caff805f25c5f37e, image CI run 138:
`forgejo.coulomb.social/coulomb/user-engine@sha256:b3df548acd23860c2bca3af123ea542d07784ff21340ea2cb0a406e6e7d9c29d`.
Provider source a0cc947bf65241ac93280d1d7c00d8fc8b7a7740, built from exact git archive:
`forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6`.

Provider deployed first, portal second. Image-only patches tested cluster UID,
deployment UID/resource version and predecessor image. Both deployments Ready 1/1.
Canonical provider manifests and portal package pins updated; unrelated hostname
work preserved. In-pod provider inspection confirms tenant_access is present.
Ten live HTTP checks passed (public account/recovery/security, readiness, API denial,
and browser denial with recovery for platform operations and tenant activity).
Twelve fresh live Chromium checks passed, including expired callback recovery,
390px layout, shared sign-out confirmation/POST and final sign-in-only state.
No real user's directory groups or factors were mutated for these checks.
The Recreate portal rollout briefly returned 503 while replacing its single pod;
checks passed after readiness. In-memory sessions and unused provider password
setup grants are reset by restarts.

Rollback images (retain all other deployment configuration):
- Portal: `sha256:558e489f0b6e0b7160ab0d370560a66497e12488b95531bbccca122b46331a6f`.
- Provider: `sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6`.
Rollback portal first if removing the new provider contract; rollback was not needed.

## Live work retained

This is not complete acceptance of all 29 journeys. USER-WP-0028-T02 and
USER-WP-0026-T03 retain authoritative application catalogue/admission integration;
current membership records cannot prove effective access. USER-WP-0028-T03 and
USER-WP-0030-T03 depend on KEY-WP-0035/NK-WP-0033 factor credential custody and
verified enrollment/cancel/replacement/recovery/policy behavior. MFA handoff stays
unavailable; optional OTP enforcement has not been deployed. The coverage report
also names mail delivery/receipt and real identity-switching acceptance gaps.
USER-WP-0027-T06 remains open for complete integrated acceptance, including
VERGABE-WP-0019. Local provider calls and local persistence are not one atomic
transaction: desired-state retry/readback recovers an interruption between them.