offplan.online — Plan Changelog

Источники: CONV-34 SPEC-AMEND patch session, Themes 3+4 (Audit immutability + GDPR retention + Ownership transfer billing precision). 11 HIGH findings из business review (CONV-33) addressed via inline patches к plans/permission-and-tenancy-model.md + 2 new ADRs (0004 v2 amendment, 0013 proration, 0014 MCP wrapper placeholder shell). Sub-plan status: ratified (unchanged — patches, не re-ratification).

• § 2.4.C Storage + retention — insert-only audit_writer Postgres role (INSERT grant only; no UPDATE/DELETE/TRUNCATE) + boot-time grant check + separate audit_admin role for migrations / archival. Monthly hash-chain seal per org_id (audit_seals table); weekly chain-verification cron → operator alert on break. Off-box S3 (Object Lock Compliance mode, cross-account write-only IAM) weekly shipping for rows older than 30 days. pii_class column (none / personal_meta / personal_content / sensitive) + JSONB metadata key registry (audit_metadata_schema.ts) for sensitive-field redaction on archival. Pseudonymisation: actor_user_id → hmac_sha256(user_id || global_pepper) на 12mo archive boundary; original mapping kept в separate vault DB (operator dual-approval; 7yr Cyprus statutory). controller_org_id field auto-populated on every buyer-PII audit event (gate к plans/legal-multi-party-framework.md для Art. 26 framework).
• ADR 0004 v2 — retention amended: 12mo active + archive до 7 years (Cyprus statutory limitation period) + hard delete после 7yr (audited compliance event); insert-only DB role + monthly hash-chain seal Stage 1; off-box S3 Object Lock Compliance; KMS-stored global_pepper с operator dual-approval; PII classification table; WORM hardware media deferred Stage 2. Revisit triggers: Cyprus pivot, WORM regulatory mandate, per-period pepper rotation.
• ADR 0014 placeholder shell (new) — MCP wrapper auth + prompt-injection sanitisation model. Phase 1.5.6 implementation explicitly blocked до full spec. Outlines: per-tool-call org_id propagation (никогда connection-scoped); no connection-scoped data scope; sanitisation of user-controlled content в tool responses; audit trail; rate-limit per agent + per Org. Full spec deferred к dedicated /plan session.
• Architectural risks — expanded: MCP wrapper block (cross-reference ADR 0014); audit log immutability vs DR runbook (schema migrations require coordinated audit_admin escalation + chain re-seal); pseudonymisation vault key custody (global_pepper in KMS — lost pepper = lost de-anonymisation path).

• § 1.8.B Trial → Free Guest auto-downgrade — Stripe customer cleanup spec: existing trial subscription → cancel_at_period_end → immediate; Stripe customer object retained для re-pay restore (payment methods, tax/VAT, addresses); webhook customer.subscription.deleted triggers Org tier flip; failed-card edge case (3 retries → Free Guest); CS notification email.
• § 1.8.C Paid → Suspended — chargeback overrides 14d grace immediately (ADR 0006 wins); Stripe webhook charge.dispute.created → Suspended instantly; cash-basis revenue recognition Stage 1; refunds/chargebacks deducted on charge.refunded / charge.dispute.funds_withdrawn; accrual basis Stage 2 pre-audit milestone.
• § 1.8.F Tier upgrade/downgrade + ADR 0013 (new) Proration policy — asymmetric: Upgrade prorated (Stripe proration_behavior=create_prorations); Downgrade end-of-period (Stripe SubscriptionSchedule, no refund/credit); Trial → Paid = fresh period (no proration); Reverse-invite ownership transfer = new Owner fresh billing clock. Rationale: industry standard, avoids cyclic gaming, no credit-balance UI needed Stage 1. Alternatives rejected: symmetric proration (refund surface complexity), lock-for-period (hostile to growth), custom math (tax edge-case bug surface). Revisit if downgrade-refund tickets >50/month.
• § 1.5.F Ownership transfer — self-serve gate tied к target Organisation's first_successful_payment_at (NOT actor's). Field set on first Stripe invoice.paid; refunds/chargebacks do NOT roll back. Post-payment route → support@ + operator-mediated 4-step verification: identity check (login + 2FA + email-on-file match) + recipient verification (email-clickthrough + 2FA setup) + fraud signal scoring (recent password change · IP-country mismatch · payment-method ownership delta · subscription age <30d → ≥2 signals = 5-day cooldown + manual review) + operator-console commit с mandatory audit reason. SLA: 2 business days. Cool-down: new Owner cannot transfer for 30d. Phase 1.4.7 operator playbook spec.
• § 2.3 Referral attribution — pick 1 amended: 12mo retroactive eligibility cap (sponsor upgrade must occur within 12mo от referee upgraded_to_client_at); pick 5 amended: attribution bound к Organisation created_at (NOT user signup_at) — existing-user new-Org signup with ?ref= now attaches sponsor properly.
• § 1.2.F 2FA-loss recovery — backup codes на enable: 10 single-use 8-char base32 codes, displayed once + PDF download, hashed storage в user_2fa_backup_codes; self-service recovery flow (login → «Lost authenticator» → email + backup code → 2FA disabled + audit event 2fa_recovered_via_backup + forced re-enrollment); operator-mediated disable_2fa_operator_override для backup-codes-lost case (Phase 1.4.7, 1 business day SLA, audit pii_class = sensitive); rate-limit 5/15min per email+IP, 1h lockout.
• § 1.5.C Remove member — server-side session revocation cross-subdomain (per § 1.5.B v4.17 amendment); cascade triage view + batch digest (per § 1.5.E v4.17); operator dashboard per-email lookup screen (Phase 1.4.7) для CS — tenant-facing «не получилось войти» stays generic (security); operator-facing actionable (deactivated / wrong subdomain / unverified email / locked / 2FA-locked / not-member).

• Phase 1.3 callout — sub-plan status updated к «ratified CONV-33 — Part 1 + Part 2 closed · SPEC-AMEND v4.17 + v4.18 patches CONV-34»; ADR references expanded (0004 v2 + 0013 + 0014 placeholder); 21/21 HIGH closed; treatment plan section flipped «pending» → «closed CONV-34».
• Sub-plan frontmatter — anchors expanded к [ADR 0009, ADR 0010, ADR 0008, ADR 0005 v3, ADR 0004 v2, ADR 0013, ADR 0014 placeholder]; spec_amend_patches field added с v4.17 + v4.18 entries.
• Sub-plan changelog — v4.17 + v4.18 entries added; full breakdown of all 21 HIGH findings closure mapped к patched sections.

• Roma scaffold kickoff — Track B unblocked (sub-plan + Risks self-contained для tech estimate).
• ADR 0014 full spec — pending dedicated /plan session before Phase 1.5.6 implementation.
• 3 sub-plans pending в очереди: onboarding-trial-mode.md (P0, ADR 0008 numbers) · legal-multi-party-framework.md (P1, jurisdiction-dependent — Art. 26 framework для buyer joint-controller v4.18 gate) · buyer-profile-and-presentation.md (P1, ADR 0012 + Phase 1.11.1-8).
• Cyprus jurisdiction — active review (carry-over; ADR 0004 v2 hooked в 7yr Cyprus statutory floor — pivot would require revisit).
• 2 stale Learnings deprecation в Notion (CONV-7 5-tier model + «Invite клиента» VV legacy) — carry-over CONV-31 / CONV-32 / CONV-33 / CONV-34.
• Workstream relation в Notion Sessions row — 5th session investigation (UUID format / MCP relation field structure).

Источники: CONV-34 SPEC-AMEND patch session, Themes 1+2 (Token mechanics hardening + Session/permission re-eval policy). 10 HIGH findings из business review (CONV-33) addressed via inline patches к plans/permission-and-tenancy-model.md. Sub-plan status: ratified (unchanged).

• § 1.4.A + § 1.4.C Reverse-invite TTL 7d → 30d — extended для Developer B2B evaluation cycles 2-4 weeks (Sales motion HIGH 1). Forward + Personal invites stay 7d.
• § 1.4.C Reverse-invite funnel visibility surface (Sales motion HIGH 2) — Studio Project Settings → Guest Organisations → «Invited Developers» tab; columns: Email · Sent at · Opened at · Signed up at · Free Guest tier · Upgraded at. Audit log events feed view.
• § 1.4.C Reverse-invite legal basis stub (Legal HIGH 3) — ToS warranty-of-rights clause (Studio owns/authorises shared content); rate-limit (10 reverse invites / 24h / Studio Org Stage 1); mandatory Unsubscribe / Report abuse footer (CAN-SPAM / GDPR Art. 14); takedown route → abuse@offplan.online; deep spec gate к plans/legal-multi-party-framework.md.
• § 1.4.D Invite token entropy + rate-limit (Security HIGH 6) — ≥128-bit CSPRNG entropy; SHA-256 hashed storage (raw token only в email URL); constant-time hash compare на lookup; per-IP rate-limit (10 invalid / 5min soft, 30/h hard); per-email lookup cap (5 valid / 15min anti-enumeration); burst alert > 50 invalid / 10min → operator notification. TTL table per type (7d / 30d / 7d / 90d).
• § 1.7.J (new) Buyer tokenised URL mechanics (Security HIGH 2) — ≥128-bit opaque CSPRNG; hashed storage; scope = single (buyer, unit) pair (no org-wide / multi-unit); 90d sliding window; forced rotation on SA loss / unit re-attribution / buyer email change / manual revoke. HTTP headers: X-Robots-Tag: noindex, nofollow, noarchive, nosnippet + Referrer-Policy: no-referrer + Cache-Control: private, no-store + Content-Security-Policy: frame-ancestors 'none'. Buyer cookie scoped к single (buyer_id, org_id) request — никогда *.offplan.online. Rate-limit 30 invalid / 10min per IP + burst alert. Suspension state: read-only до expiry; CTA disabled.

• § 1.5.B Role change session re-eval (Security HIGH 1 + CS HIGH 3 aligned) — server-side sessions.revoked_at = now() cross-subdomain на role change commit; cookie стирается standard expiry path; next request = re-auth required; permission check hits DB на каждый privileged action (write / billing / membership / audit-read); role/scope NEVER cached в JWT/cookie (only user_id + signed CSRF). UI toast «Your role was updated. Please sign in again» on detected revoke.
• § 1.5.B Stock-wipe pre-change confirmation modal (Studios HIGH 2) — role change-to-SA pre-flight: dialog shows current assigned-units count + cascade target preview + «Скачать snapshot» button; pre-change snapshot recorded в audit JSONB (previous_assignments: [unit_ids…]) для Stage 1 manual restore (Phase 1.4.7 operator); UI restore Stage 2.
• § 1.5.E Cascade triage view (Studios HIGH 1) — SA removal с N > 0 → batch digest email («{N} units inherited from {SA Name}: {first 5}…»), NOT per-unit flood; «Inherited assignments» triage screen Phase 1.4.8 (Stage 1 = Stock view filter); bulk re-assign / keep at target / move-to-Internal-pool actions. Email rate-limit: max 1 digest / target / hour. Commission attribution preserved + audit line «Commission preserved to {departing SA}» (per Foundational §4.5).
• § 1.5.F Ownership transfer target-Org gate (Sales motion HIGH 4) — self-serve gate tied к target Organisation's first_successful_payment_at (NOT actor's). Field set on first Stripe invoice.paid, no rollback on refunds/chargebacks. Edge case: target Org payment_at = NULL but actor Tier 1+ via другой Org → still self-serve eligible (gate is target's state).
• § 1.3 Edge cases SA project-switcher non-jarring banner (Studios HIGH 3) — replaces forced redirect когда SA loses last assigned unit. Banner «Ваш доступ к {Project Name} обновлён — последний assigned unit передан {Cascade Target}. Проект read-only для вас на 24 часа, потом скроется.» 24h grace period: download buyer records + complete in-flight conversations. После 24h project silently убирается из dropdown. Manual leave CTA available. Audit «SA {X} lost last assigned unit; grace-period 24h started».

• Sub-plan — Status updated «RATIFIED CONV-33» → «RATIFIED CONV-33 · SPEC-AMEND PATCHES v4.17 + v4.18 CONV-34».
• Sub-plan changelog — v4.17 entry added с full Theme 1+2 breakdown.
• NB: Phase 1.3 callout HTML update + Foundational §2 untouched (Microsoft OAuth already resolved CONV-33).

Источники: /plan session of plans/permission-and-tenancy-model.md (pack-ratify Part 2 Decision Log + Step 4.4 business review + Step 4.5 ratification sweep + Step 5 workstream). Sub-plan status: draft → ratified. Part 2 closed 11 разделов (8 real design + 3 cross-ref closures); 6 new picks consolidated с Foundational §7.5 + §6.1 + §4.2 + §3 + ADR 0004/0005 v3. Workstream phase-1-3-implementation (P0) — created. 21 HIGH findings из business review (6 concern agents — Studios / Sales motion / Customer Success / Legal+Compliance / Security / Finance+Billing) flagged как SPEC-AMEND для CONV-34 patch session.

• 2.1 Workspace switcher mechanics — closed as cross-ref (Part 1 § 1.3 + UI deep-spec → plans/onboarding-trial-mode.md).
• 2.2 Ownership transfer detail — closed as cross-ref (Part 1 § 1.5.F + Foundational §3 lines 811-826).
• 2.3 Referral attribution rules — 6 new picks (dual-condition credit accrual: referee upgrade + sponsor paid; lazy 6-char base32 code generation; `?ref=` URL param wins on form-field conflict; Free Guest sees disabled referral surface для upgrade motivation; cycle detection server-side at Org creation; payout_amount Phase 4.2).
• 2.4 Audit log scope для Phase 1.3 events — 9 event categories × 5 roles visibility matrix; storage spec (append-only `audit_events` table tenant-scoped via org_id); retention per ADR 0004 (12mo active + indefinite archive); UI surfaces (Org Settings / Project Settings / SA «My activity»).
• 2.5 Naming finalisation — closed без изменений (Sales Manager + Content Editor ratified в v4.7).
• 2.6 Email mismatch wording — closed as verbatim (Foundational §2 line 765).
• 2.7 Subdomain reservation list — 58 entries across 5 categories (Платформа / Инфра / Environments / Functional+brand / Brand+vendor typosquat) + validation rules + storage в `config/reserved-subdomains.json`.
• 2.8 Free Guest → paid conversion — dual trigger (lazy «+ Create project» + explicit Settings → Billing); migration split (preserved vs activated); backwards = only auto (trial expired / suspension), self-trigger downgrade Tier 1+ → Free Guest blocked.
• 2.9 SA dual-Org membership — allowed combinations confirmed (Internal SA в А + External SA в Б OK; two roles per same Org blocked); home_org_id formalisation (set once at first membership, never changes); `home_org_orphaned: true` flag для orphan cases; membership_type derived from `org_id` link.
• 2.10 Open/Closed pool reversibility — both directions allowed; Owner/Admin/SM permission; audit + email на Open → Closed flip; NO auto-assign; Variant A для Reserved-by-External-SA edge case (status preserved + visibility lost, admin manual handover).
• 2.11 Microsoft OAuth resolution — ADR 0005 v3 wins; Foundational §2 patched (Microsoft bullet removed, section retitled «Google + email/password (4)»); Part 1 § 1.2.D table updated (Microsoft + Custom SSO → Stage 2 Tier 3 gate row).

• Token mechanics hardening — reverse-invite TTL 7d → 30d (Developer B2B cycles); buyer token ≥128-bit opaque + scope-to-unit + rotate on SA removal + noindex headers; invite token entropy spec + rate-limit + constant-time compare.
• Session/permission re-eval policy — role-change must invalidate session records cross-subdomain; permission check on every privileged action (не cached); ownership transfer billing boundary tied к target's first_successful_payment_at (не actor's).
• Audit immutability + GDPR-compliant retention — append-only DB role + monthly hash-chain seal + off-box archive shipping; pseudonymise actor_user_id post-12mo; PII classification на JSONB metadata; ADR 0004 amendment.
• Ownership transfer + billing handover precision — Stripe customer record management для Free Guest auto-downgrade; T2 → T1 proration policy (new ADR); referral payout retroactive eligibility cap 12mo; SLA + identity-verification protocol для post-payment support transfers.

• Foundational §2 lines 745-753 — section retitled «Auth methods — Google + Microsoft + email/password (5)» → «Auth methods — Google + email/password (4)»; Microsoft bullet removed; footer note expanded с Microsoft + Custom SSO Stage 2 Tier 3 gate + revenue trigger language.
• Phase 1.3 callout — sub-plan status flip draft (Part 1 ratified) → ratified CONV-33 — Part 1 + Part 2 closed; Part 2 inline summary added; ADR 0004 reference added.
• Workstream phase-1-3-implementation — P0, tags: architecture / ux / security / domain.

• 21 HIGH SPEC-AMEND tickets для CONV-34 patch session (~2-3h, 4 themes выше).
• 2 stale Learnings deprecation в Notion (CONV-7 5-tier model + CONV-?? «Invite клиента» VV legacy) — carry-over CONV-31 / CONV-32 / CONV-33.
• 3 sub-plans pending в очереди: onboarding-trial-mode.md (P0, ADR 0008 numbers) · legal-multi-party-framework.md (P1, jurisdiction-dependent) · buyer-profile-and-presentation.md (P1, ADR 0012 + Phase 1.11.1-8).
• Cyprus jurisdiction — active review (не re-ask, wait для user signal).

Источники: /plan session of plans/permission-and-tenancy-model.md. Pack-mode interview (5 разделов через interview + 5 через consolidation) ratified Part 1 (Behavioural Spec, 10 разделов) для Phase 1.3.1-1.3.12 implementation. Sub-plan status: stub → draft. Audience: Roma (scaffold sync) + Ilya (tech estimate). Part 2 (Decision Log, 10 пунктов + Microsoft OAuth inconsistency) — pending separate session. Step 4.4 / 4.5 / workstream creation — после Part 2.

• 1.1 Signup + onboarding — 3 paths (A paid / B Free Guest reverse invite / C team invite) consolidation Foundational §2 + 4 new picks (magic link verification / automatic trial / single-use decline tokens / explicit «already member» message).
• 1.2 Login surfaces + auth-scoped views — 2 точки входа (branded subdomain + central fallback) + маршрутизация + методы аутентификации + 4 viewer states (Foundational §2 + §5) + 2 new picks (generic error на чужой subdomain без хинта на central / single-cookie logout scope `*.offplan.online`).
• 1.3 Workspace switcher — Organisation switcher (Slack-style, hidden when single-Org, 2 секции Owned + Guest) + Project switcher (1.3.G new — SA visibility = только проекты с ≥1 assigned unit, S·1 consistent). UI deep-spec делегирован в onboarding-trial-mode.md.
• 1.4 Cross-entity invitations — 4 типа (Personal / Forward Org / Reverse / Buyer) + flows (Foundational §4.1) + 3 new picks (Forward invite Owner+Admin only / re-invite auto-revoke + supersede / self-invite blocked).
• 1.5 Role transitions — promote/demote + remove + self-leave + ownership transfer + cascade rules (Foundational §7.1 + §3 + §4.4) + 1 new pick (role change с SA-involvement = clear all stock allocation assignments).
• 1.6 Stock assignment — Closed/Open pool toggle + 3 unit states + bulk UX + S·1 visibility rules (Foundational §4.4 verbatim, ADR 0010 anchor) — pure consolidation, no new picks.
• 1.7 Reserve unit flow + conflict modal — status transitions (forward + reverse) + smart-match logic + reverse-flip policy + race condition + pessimistic lock (Foundational §6.1 + §7.4 + ADR 0010) + 1 new pick (lock release >500ms = fall through to optimistic conflict modal).
• 1.8 Tier transitions — trial→paid / trial expired / paid→suspended / suspended→restore / Free Guest→paid (Foundational §3 + ADR 0008) + 1 new pick (tier downgrade с превышением лимитов = explicit block с message «Удалите N projects/team members перед downgrade»).
• 1.9 Internal vs External SA — operational distinction table (Foundational §4.5 verbatim) + membership_type derivation + 1 new pick (badge «External» рядом с именем external SA в Team list owning Organisation).
• 1.10 Permission matrix — 5 ролей × 14 actions table (Foundational §4.2 verbatim) + View-as-Agent surface (§4.6) — pure consolidation, single source of truth для RBAC implementation.

• Magic link verification flow для Path A signup (вместо 6-digit code).
• Automatic trial activation на signup (без opt-in toggle).
• Single-use decline для invitation tokens (decline ALSO consumes — clean audit, simpler implementation, convention matches Slack/Linear/Figma).
• Explicit «You're already a member of {Org Name}» message при invite того, кто уже member target Org (вместо silent skip).
• Generic error без хинта на центральный login при попытке входа на чужой brandированный subdomain (security minimum — не leak'аем существование аккаунта).
• Single-cookie logout scope (*.offplan.online) = logout со всех subdomain'ов сразу. Per-subdomain logout «log out from this device only» → Stage 2 Settings → Sessions.
• Sales Agent видит в Project switcher только проекты с ≥1 assigned unit (S·1 Closed pool consistent — не leak информацию о существовании других проектов Organisation).
• Forward invite (Developer → Studio/Agency как guest organisation) — только Owner / Admin Developer's Organisation. Sales Manager / Content Editor / Sales Agent — нельзя.
• Re-invite того же email в ту же роль = previous invite auto-revoked + new supersedes (UX «переотправил если первый потерялся в спаме»). Audit log: «Previous invitation superseded by new».
• Self-invite (Owner приглашает member своей же Organisation как guest organisation) — заблокировано с error «Cannot invite member of your own Organisation as guest».
• Role change с участием Sales Agent (CE→SA, SM→SA) = clear все stock allocation assignments автоматически (clean slate per role change). Promote SA→SM сохраняет assignments в DB но они игнорируются (SM bypass-scope); демоут обратно SA — manual reassignment.
• Badge «External» рядом с именем external SA в Team list owning Organisation (admin UX clarity — кто сотрудник, кто guest-org member).
• Tier downgrade при превышении лимитов нового tier'а = explicit block с message «Удалите N projects / M team members перед downgrade'ом» (не auto-freeze лишних, не operator-mediated).
• Pessimistic lock release timeout >500ms (rare) = fall through to optimistic conflict modal (same UX как 1.7.E race — «Только что зарезервировал X в TIMESTAMP — обнови страницу»).

• Status: stub, awaits /plan ratification → draft — Part 1 ratified CONV-32, Part 2 pending.
• Inline сводка Part 1 (10 разделов перечислены) + 14 new picks + Part 2 queue + Microsoft OAuth flag — embedded в callout body для traceability без явного чтения sub-plan'а.

• 10 открытых вопросов queued: workspace switcher mechanics (UI deep-spec — может closure'нуться cross-ref'ом в onboarding-trial-mode) · ownership transfer detail (большую часть закрыли в 1.5.F) · referral attribution rules (data model Stage 1) · audit log scope для Phase 1.3 events · naming finalisation (Sales Manager / Content Editor) · email mismatch wording (фактически verbatim в Foundational §2) · subdomain reservation full list · Free Guest → paid migration (что мигрирует, что новое) · Sales Agent dual-Org membership (Internal в А + External в Б — allowed?) · Open pool mode irreversibility.
• Microsoft OAuth Stage 1 vs Tier 3 Stage 2 inconsistency — Foundational §2 line 748 кладёт Microsoft в Stage 1 (consumer OAuth контекст «корпоративные пользователи»); ADR 0005 v3 кладёт Microsoft в Tier 3 Stage 2 (Azure AD / Entra ID enterprise SSO). Разные технические сценарии (consumer Microsoft Account vs enterprise Azure AD SSO) или реальное противоречие — resolve в Part 2.
• Step 4.4 (Business review — concern agents + scenario traces) после Part 2.
• Step 4.5 (Ratification sweep против Learnings DB) после Part 2.
• Workstream phase-1-3-implementation (P0) — создаётся после полного ratification (Part 1 + Part 2 + 4.4 + 4.5).

• Sub-plan Part 2 ratification (next session, отдельная /plan continuation).
• 3 sub-plan ratifications в очереди после permission-and-tenancy completion: plans/onboarding-trial-mode.md (P0, anchors ADR 0008 — pricing/limits/naming) → plans/legal-multi-party-framework.md (P1, jurisdiction-dependent — pending Cyprus confirmation) → plans/buyer-profile-and-presentation.md (P1, anchors ADR 0012 + Phase 1.11.1-8).
• Roma's parallel git activity — git pull required before push в next session.

Источники: /plan + /build of plans/stage1-chunk-8-adr-placeholders.md (Approach B — Draft-all + single ratification, 3 commits). Wave 2 Chunk 8 — last chunk closes Wave 2 (8/8 chunks done). 5 new ADRs codify ratified architectural decisions из Foundational §1-§5 + Phase 1.3-1.11 deep rewrites; 0005 v3 revision adds Stage 2 Tier 3 SSO scope; ~29 plan callout pointer fixes в Phase callouts/task-deps конвертируют «(pending)» status text + broken hrefs в live links на новые ADR файлы.

• 0008 Tier model + admin mode coupling (Skeleton, ~67 lines) — 4-tier structure (Free Guest / Tier 1 / Tier 2 / Tier 3 Enterprise) + admin mode coupling (Quick Build/Free + Trial → залочен Full Admin) ratified. Pricing / exact limits / naming finalisation (T1/T2/T3 vs Starter/Studio/Agency/Enterprise) / Free Guest expiry / conversion triggers — defer to sub-plan plans/onboarding-trial-mode.md. Status: accepted-structure-pending-numbers.
• 0009 Tenancy & Permission Architecture (Full spec, ~105 lines) — codifies ratified Foundational §1 (Entity model: Client/Organisation/Buyer/Operator) + §2 (Onboarding: 5 Partner roles Owner/Admin/Sales Manager/Content Editor/Sales Agent + hybrid login surfaces) + §4 (Access: auth-scoped views + scoped URL routing + cross-entity invitations Forward/Reverse + Internal/External SA distinction CONV-24). Decisions sufficient для Phase 1.3.1-1.3.12 implementation без дальнейшего sub-plan input.
• 0010 Stock allocation strategy — Closed pool default + S·1 visibility (Full spec, ~71 lines) — Closed pool default + per-project Open mode toggle (Foundational §4.4) + S·1 visibility rules (3 sub-rules from CONV-16 Learning) + pessimistic locking on reserve action + bulk allocation UX. Готов к коду.
• 0011 Email sender architecture (Shell, ~44 lines) — 4 architectures с trade-off table (single-domain / per-Org DKIM self-hosted / hybrid / Resend white-label delegation) + 5 decision criteria (deliverability, ops complexity, white-label fidelity, Tier 2 value prop, vendor lock-in). Resolves at Phase 1.8 ratification + Roman cost ceilings + Илья DKIM complexity assessment. Status: shell-pending-architecture.
• 0012 Real-time sync architecture (Buyer Remote Presentation) (Shell, ~47 lines) — narrow scope per CONV-31 L3 (только use-case A buyer presentation, не unit-status-sync); 4 architectures с trade-off table (Polling / SSE / WebSocket / Managed: Pusher/Ably/Supabase Realtime) + 4 decision criteria (latency, ops cost, scale, build vs buy). Discussion artefact для Илья + команды. Status: shell-pending-tech-estimate.

• «Revision 3 (2026-05-09, CONV-31)» note added at top — Stage 2 Tier 3 SSO scope: Microsoft (Azure AD / Entra ID) OAuth2/OIDC + Custom SSO (SAML 2.0 / OIDC через Okta / Entra ID / generic IdP) accepted as Tier 3 Enterprise gate per ADR 0008. Stage 1 scope (Google + email/password) unchanged.
• «Revision 2 (2026-05-07, CONV-17)» note preserved unchanged below — original Google+email/password rationale.
• New «Stage 2 Tier 3 SSO methods (Revision 3)» subsection в Decision area — provider abstraction note + Tier 3 implementation trigger (after first Tier 3 customer commitment).
• Alternatives Considered: Microsoft + Custom SSO re-classified «accepted for Stage 2 Tier 3» (вместо «rejected/deferred»).
• Consequences: Tier 3 gate + Stage 2 implementation trigger added.
• Frontmatter: revised: 2026-05-07 → revised: 2026-05-09.

• Type A (3 broken-pointer fixes на 0005): lines 753 (Foundational §2 SSO callout) / 1388 (Phase 1.2 callout) / 1531 (Phase 1.3 callout) — стейл «0005 update Google + email/password» + «вторая ревизия pending» phrasing → live links + «ADR 0005 v3 (Microsoft + Custom SSO scope для Tier 3 Stage 2)» wording.
• Type B (~26 «pending»/plain-text → live links): Foundational §3 Tier table (788/789/793/807) → ADR 0008 links; §4 ownership transfer (825) → ADR 0009 link; Phase 1.2 (1404) → 0008 link; Phase 1.3 callout + sub-plan ref (1525) → 0009+0010 links; Phase 1.3 task-deps (1538/1574/1648) → 0009 links; Phase 1.7.5 open Q (2323) → 0008 links; Phase 1.7.10 (2510/2515) → 0011 link, drop «pending»; Phase 1.7.11 (2521-2537) → 0008 links, drop «(pending)»/«Will be written в Chunk 8»; Phase 1.8.9 hosting cost (2765/2772/2776) → 0008 link; Phase 1.11 phase-desc (3290) → 0012 link; Phase 1.11.6-7 task-deps (3345/3351/3352) → 0012 links; Cyprus parking-lot (3378) → 0008 link; Pricing tier reminder + naming TBD (3404/3405) → 0008 links.
• Verification (3 sweeps): 0 empty href placeholders ✓ · 0 stale «(pending)» / «(placeholder, write в Chunk 8)» / «вторая ревизия pending» status text ✓ · 0 «Will be written в Chunk 8» / «awaiting ADR XXXX» mentions remaining ✓.

• Chunk 1 (Foundational §1+§2 lead-in cleanup) · Chunk 2 (entity model glossary) · Chunk 3 (onboarding 4-path narrative) · Chunk 4 (visibility presets §5) · Chunk 5 (User Journeys §6) · Chunk 6 (Edge cases §7) · Chunk 7 (Phase 1.7 deep rewrite) · Chunk 7.5 (Phase callouts cleanup sweep 8 фаз) · Chunk 8 (ADR placeholders + 0005 v3 + callout cleanup) ✓ — this entry.

• P0: plans/permission-and-tenancy-model.md (anchors ADRs 0009 + 0010) → plans/onboarding-trial-mode.md (anchors ADR 0008 pricing/limits/naming).
• P1: plans/legal-multi-party-framework.md (jurisdiction-dependent — pending Cyprus confirmation) → plans/buyer-profile-and-presentation.md (anchors ADR 0012 + Phase 1.11.1-8).

• 4 sub-plan ratifications (priority order above) — separate /plan sessions.
• 2 stale Learnings flagged для /handoff update: CONV-7 «Multi-level access 5-tier model» (superseded by Org-based RBAC per ADR 0009); CONV-16 «S·1 Shared default» (reshaped to Closed pool default per CONV-18 + ADR 0010).
• Cyprus jurisdiction confirmation остаётся unresolved (memory says «decided 2026-04-30», CONV-27 user reopened); все ADRs jurisdiction-agnostic.
• Brandbook reconciliation (Sergey atelier vs Roma Skeleton White из CONV-29 parallel track) — отдельная сессия после HTML plan polish.

Источники: /plan + /build of plans/stage1-chunk-7.5-callouts-sweep.md. Phase callouts cleanup sweep across 8 фаз Stage 1 (1.2 / 1.3 / 1.4 / 1.5 / 1.8 / 1.9 / 1.10 / 1.11). Hybrid approach: A — re-label sub-plan-pointer callouts (1.2 / 1.3 / 1.9 / 1.11); B — absorb placeholders в numbered tasks (1.4 / 1.5 / 1.8 / 1.10); collapse cross-link pointers v4.7-v4.10 → один summary v4.13 callout (1.4 + 1.10). Phase 1.11 v4.12 parking-lot нетронут.

• Phase 1.2 — v4.3 (CONV-15) + v4.4 (CONV-17) callouts → 1 re-labelled pointer на plans/onboarding-trial-mode.md. v4.5 Atelier callout с inline v4.8 PIN config — preserved (active design canon).
• Phase 1.3 — v4.4 callout (12 ratified decisions + inline v4.7) → 1 re-labelled pointer на plans/permission-and-tenancy-model.md. Numbered tasks 1.3.1-1.3.12 реализуют spec.
• Phase 1.9 — v4.3 + v4.4 callouts (4 multi-party docs + 5 privacy clauses) → 1 re-labelled pointer на plans/legal-multi-party-framework.md. Phase 1.9 grows 11→15 documents pending lawyer review.
• Phase 1.11 — v4.4 callout (6 buyer-flow decisions + v4.7 Preview-as-Buyer) → 1 re-labelled pointer на plans/buyer-profile-and-presentation.md. v4.12 (CONV-30 parking-lot) — preserved as separate standalone callout.

• Phase 1.4 — v4.3 + v4.4 callouts (5 placeholders) → 5 new numbered tasks: 1.4.9 Fullscreen Org card / 1.4.10 Suspension UI / 1.4.11 GDPR/ADGM erasure / 1.4.12 Stock allocation conflict / 1.4.13 Owner lockout recovery. Reserved subdomain (staff blacklist) note absorbed в 1.4.2 desc. v4.7-v4.10 cross-link pointers collapsed в 1 summary v4.13 callout (links на §4.6 / §5.1 / §6.1 / §6.2 / §7).
• Phase 1.5 — v4.3 callout (2 placeholders) absorbed: 1.5.X (AI file upload PDF→JPEG) → new task 1.5.6; 1.5.Y (VV API audit) merged в 1.5.1 desc как «Илья provides VV API source as starting reference». Cross-ref в §4.4 обновлён 1.5.X → 1.5.6.
• Phase 1.8 — v4.3 callout (3 placeholders) → 3 new numbered tasks: 1.8.7 Two-domain email setup / 1.8.8 DKIM+SPF+DMARC / 1.8.9 Hosting cost projection model.
• Phase 1.10 — v4.3 + v4.4 callouts (9 placeholders, 7 absorbed + 2 deduplicated) → 7 new numbered tasks: 1.10.8 360° rotation Pannellum / 1.10.9 Hotspot navigation / 1.10.10 Buyer-aware unit pages / 1.10.11 Anonymous unit pages / 1.10.12 Status badge rendering / 1.10.13 Status change UI / 1.10.14 Buyer attribution preservation. 1.10.X (3 access modes) covered by Phase 1.7.12 + §5; 1.10.Y refinement absorbed в 1.10.0. v4.7-v4.10 cross-link pointers collapsed в 1 summary v4.13 callout (links на §4.6 / §5.1 / §6.1 / §6.2 / §7.4). Cross-ref в 1.10.0 task-deps обновлён (1.10.BB/CC/EE → 1.10.10/11/13).

• 11 v4.3 / v4.4 / v4.7 / v4.8 / v4.9 / v4.10 callouts из 8 фаз — их content либо в numbered tasks (B), либо в re-labelled sub-plan pointers (A), либо в collapsed v4.13 summaries (C).

• Sub-plan ratifications: plans/onboarding-trial-mode.md (P0), plans/permission-and-tenancy-model.md (P0), plans/legal-multi-party-framework.md (P1), plans/buyer-profile-and-presentation.md (P1) — все остаются status: stub.
• ADR placeholders: 0008 Tier model / 0009 Tenancy / 0010 Stock allocation / 0011 Email sender architecture / 0012 Real-time sync / 0005 v3 update — Chunk 8 candidates.
• Phase 1.11 v4.12 parking-lot (CONV-30 buyer-profile + agent-driven session handover) — preserved untouched, awaits buyer-profile-and-presentation sub-plan ratification.

Источники: user input + 5 screenshots от 2026-05-09 — расширение Phase 1.11 / §6 Buyer flow. Параллельно: Roma в CONV-29 (parallel track) реализовал prototype core buyer-profile capture в design-system/sales/02-exterior.html (Skeleton White register) — quick capture form (имя/фамилия/email/phone + preferences bedrooms/bathrooms/aspect/budget) + Switch agent affordance. Spec ratification и backup/restore + Edit-as-Buyer detail'и — отдельный sub-plan. Новый путь creation buyer-record'а параллельно к существующему «email-send» (Variant E2): agent создаёт buyer прямо с sales-page → tokenised URL с already-persisted state (filters + shortlist). Plus admin backup/restore buyer-state, agent-edits-buyer state (open question — dual-login vs Edit-as-Buyer surface vs privileged-token URL).

• Phase 1.11 callout — bullet v4.12: parking-lot pointer на agent-driven buyer onboarding c sales-page + persisted state (filters + shortlist). Touches §6 (второй путь creation), Phase 1.10 (filter persistence), Phase 1.3 (buyer auth), Phase 1.4 (backup/restore audit), §4.2 (permissions для buyer-state edit), §4.6 (Edit-as-Buyer extension if Option B chosen).

• Sub-plan plans/buyer-profile-and-presentation.md — full /plan interview deferred до Wave 2 close (Chunks 7.5 + 8). Тогда будет ratify open questions: state schema, auth model для buyer login, edit-as-buyer permission, backup/restore granularity, dual-session collision rules.
• 5 screenshots сохранены в memory для reference при /plan'ировании.

Источники: deferred-from-CONV-24 deep rewrite Phase 1.7 «Платёжная инфраструктура + Sales Page». Approach C (Hybrid surgical structure changes) — sub-plan plans/landing-pages-by-audience.md владеет 4-audience landing спекой; Phase 1.7 task = pointer-only. План: plans/stage1-chunk-7-phase17-rewrite.md.

• v4.3 (CONV-15) callout — 4 bullets (1.7.X 4 landings, 1.7.Y demo iframe, 1.7.Z Free tier billing, 1.7.AA custom domain DKIM) — content absorbed into tasks below.
• v4.4 (CONV-17) callout — 6 bullets (1.7.BB Public Visibility UI, 1.7.CC anonymous viewer flow, 1.7.DD subdomain pattern, 1.7.EE stock allocation toggle, 1.7.EE project URL structure, 1.7.AA DKIM clarification) — content absorbed.
• Stock allocation toggle dupe — moved to Foundational §4.4; Phase 1.7 keeps только cross-link в desc.
• Public Visibility detail spec dupe — moved to Foundational §5 + §5.1; Phase 1.7 keeps только task 1.7.12 «config UI + anonymous render».
• Stale resolved Q's в 1.7.5 (без карты vs с картой / block vs read-only — resolved per §3 Trial CONV-24) и 1.7.7 (refund policy ✅ + currency ✅ — resolved per payments-research).

• v4.11 single callout в начале Phase 1.7 — summary deep rewrite + pointer на sub-plan + plan link.
• Phase 1.7 desc updated — cross-link на §4.4 (Stock allocation) + §5 (Public Visibility) + 1.7.12 (config UI).
• 1.7.1 Landing pages — title «Landing page» → «Landing pages (4 audiences)»; desc updated с pointer на sub-plan; 9 → 11 sub-bullets (added: demo iframe per-audience pattern + anonymous viewer rendering on per-Org sales page).
• 1.7.9 Subdomain selection + Project URL structure — 6 todos (subdomain validation real-time + reserved blacklist config + change UI с soft redirect 30d + project slug validation + URL pattern enforced + custom domain interaction). Open Q's: subdomain change frequency limit, fallback после custom domain.
• 1.7.10 Custom domain self-serve flow + DKIM (Tier 2+) — 7 todos (Settings → Domain page + 3-step wizard + DKIM keypair auto-generate + Let's Encrypt SSL via Cloudflare + email routing с fallback + change/removal soft redirect + Tier 2+ gating). Open Q's referencing ADR 0011 (email sender architecture).
• 1.7.11 Free tier billing tracking — 4 todos (schema tier free_guest + conversion funnel events + limits enforcement + upgrade modal triggers). Awaiting ADR 0008 (Free tier scope, pending Chunk 8).
• 1.7.12 Public Visibility — config UI + anonymous render — 9 todos split на Config UI (4: Project Settings preset radio + PIN conditional fields + Object Builder integration + audit log) + Anonymous render (5: routing middleware с 4 preset behaviours + «Request access» CTA + buyer-token bypass + flip-with-active-tokens + heart/inquiry hidden for anonymous). References §5 + §5.1 + §7.4 D.

• ADR 0008 (Free tier scope) — blocks 1.7.11 full spec. Chunk 8 candidate.
• ADR 0011 (Email sender architecture) — blocks 1.7.10 final scope. Chunk 8 candidate.
• Sub-plan plans/landing-pages-by-audience.md activation — отдельная /plan-сессия после Wave 2 close.
• Phase 1.4 + 1.10 callouts cleanup (по 5 v-callouts накопилось — sweep absorb → tasks pattern Chunk 7) — Chunk 7.5 candidate.
• Phase 1.2 / 1.3 / 1.5 / 1.8 / 1.9 / 1.11 callouts cleanup — меньше callouts но тоже sweep — Chunk 7.5 candidate.
• Cyprus jurisdiction confirmation — memory says «decided», user в CONV-27 said «under review» — clarify in next session.
• Subdomain change frequency limit, «Request access» CTA destination, fallback после custom domain — minor open Q's в new tasks.

Источники: закрытый /plan-interview по §7 Edge cases — turn-by-turn проход через все 5 subsections, locked 10 architectural additions. Strategic decision: §7.2 GDPR / ADGM right-to-erasure + §7.3 Multi-jurisdiction compliance — DEFERRED до lock'а jurisdiction (Cyprus default по memory, под review awaiting Roman ratification) + подключения юриста (Cyprus / EU / UAE) + активации sub-plan'а plans/legal-multi-party-framework.md. План: plans/stage1-chunk-6-edges.md.

• Parking-lot callout добавлен в начало §7 (после lead) — visible status «§7.2 + §7.3 DEFERRED, не править до jurisdiction lock + lawyer + sub-plan activation».
• §7.1 User deactivation — 4 additions (4 → 7 bullets):
  • A — Buyer-records persistence: buyer-records деактивированного SA остаются в DB; attribution preserved (commission через handoff per CONV-22); link не воидится — удаление только через GDPR erasure.
  • B — Deactivated user UX: деактивированный = анонимный посетитель. Логин fail'ится generic'ом без указания причины (security: не leak'аем «kicked by colleague»). Прямые ссылки на проекты работают по правилам Public Visibility per §5.
  • C — Self-leave vs Owner-removes: Settings → Leave Organisation с confirmation modal (lose access to N projects, M assigned units cascade up); same downstream flow что Owner-removes, разница только в actor в audit log. Owner self-leave disabled — требуется ownership transfer first per §3.
  • D — Re-invite no auto-restore (amend existing bullet 4): re-invite same email = fresh membership; assignments / buyer-records НЕ auto-restore (manual reassignment by SM/Admin).
• §7.4 Conflict resolution — 3 additions (4 → 7 bullets; «Owner erasure» skipped → defer to GDPR sub-plan):
  • A — Race condition Open pool: два SA одновременно жмут «Mark as Reserved» на same unit (Open pool — оба видят/могут). First-click-wins; loser получает modal «Только что зарезервировал Алексей в 14:23 — обнови». Audit log пишет обе попытки + winner. Появилось после CONV-26 §6.1 verification form.
  • B — Org suspension с active tokens: tokens продолжают работать read-only до 90d expiry. CTA «Связаться со мной» disabled с tooltip. Полный block backfire'нет на buyer experience и сорвёт active deal flow.
  • D — Visibility flip с active tokens: tokens = pre-auth'ed visitor, bypass'ят Visibility setting (consistent с §5.1 PIN bypass + §6 token mechanics). Новый Visibility применяется только к новым anonymous посетителям.
• §7.5 Referral architecture — 3 additions, schema-level (4 → 7 bullets):
  • A — Multi-Org referee: только первая Organisation Client'а с заполненным referred_by_user_id триггерит payout. Schema: Organisation.referred_by_user_id (nullable, set один раз). Защита от gaming: создал 5 Org'ов → payout × 1.
  • B — Cycle prevention: self-ref или reverse-ref → запись в referrals с payout_status: ineligible_cycle. Audit запись остаётся для visibility / detection.
  • C — Sponsor visibility screen (expanded with inline table): Settings → Referrals — top block (свой ref-code + URL + копировать + aggregate metrics) + table (anonymized Org #abc12 / signup date / current status / upgrade date / payout status). НЕ показываем PII (email, имя Owner'а, имя Org / subdomain). Stage 1 не в scope: invite-link generator, ручной revocation/edit, pagination.

• Phase 1.4 (Operator Dashboard) — v4.10 callout: self-leave events distinct actor в audit log; suspension state visibility («N active read-only tokens» в Project drawer); Visibility-flip log («M existing tokens still bypass»); aggregate ineligible_cycle counter (anti-fraud signal для cycle gaming).
• Phase 1.10 (Sales App) — v4.10 callout: Open pool optimistic lock (compare-and-swap → 409 Conflict + collision modal); Suspension Organisation middleware (token paths read-only, authed paths block с banner); Visibility-flip middleware (token bypass до 90d expiry, anonymous получает новый preset).

• §7.2 GDPR / ADGM right-to-erasure proper sweep — sub-plan plans/legal-multi-party-framework.md activation (status: stub) после jurisdiction lock + lawyer.
• §7.3 Multi-jurisdiction compliance proper sweep (AML / sanctions / cookies / data residency / tax) — same parking-lot.
• Access expansion (новые роли / actions / invitation types из Roman call'а) — awaiting jurisdiction lock + lawyer engagement.
• Cyprus jurisdiction confirmation — memory project_legal_entity_cyprus.md говорит «decided», user в CONV-27 сказал «есть вопрос где будет компания открываться» — clarify в next session.
• Wave 2 Chunks 7-8 (Phase callouts deep rewrite включая 1.7 deep rewrite; ADR placeholders 0008 / 0011 / 0012 + 0005 v3 update).
• 6 sub-plans + 5 ADRs — отдельные /plan сессии после Wave 2 close.

Источники: закрытый /plan-interview по §6 User Journeys (12 решений) — D+E status-change form unified mechanism (form shape, smart-match logic, triggers + symmetric reverse, buyer-record fate) + G channels (Email / WhatsApp / Copy link через light deep-link approach с ?ch= tracking). Strategic insight: D (status protection) и E (buyer↔unit linkage) объединены в один verification form — заполнение auto-link'ует buyer-record by email lookup (smart-match), убирает излишний шаг ручного linking. F (request-more, F-A buyer browse scope from token) — deferred Open Question с двумя candidate variants для Roman ratification. План: plans/stage1-chunk-5-journeys.md.

• §6 lead intro paragraph — flagging новые subsections §6.1 + §6.2 ниже existing <details> блоков (buyer entity model + token mechanics остаются без изменений).
• Новая §6.1 — Sales Agent status-change form (D+E unified mechanism) (anchor fd-buyer-status) — 4 styled boxes:
  • Form shape (augmented single-click verification) — Trigger = button click («Mark as Reserved» амбер / «Mark as Sold» red) в unit card; Required = buyer email с autocomplete'ом из SA's records; Conditional required = name + phone если email НЕ matches existing record; Optional = notes (free text) + file upload (PDF / JPG signed booking letter, deposit receipt). Status выбирается кликом, не dropdown'ом.
  • Smart-match logic (E side) — 3-step lookup: (1) SA's buyer-records → если match → display banner + auto-link; (2) Organisation-wide records → если match → warning «attributed to other SA» + создаётся новый record для current SA (per CONV-22 «разные records под одним email = разная attribution»); (3) если ни там, ни там → name + phone required, новый buyer-record.
  • Triggers + reverse direction policy — Forward: Available → Reserved · Available → Sold · Reserved → Sold. Reverse: Sold → Reserved · Sold → Available · Reserved → Available. Симметричная policy — same permissions per §4.2 (Owner / Admin / SM / SA own assigned). Reverse-flip → audit log + email notification одну ступень выше (SA → SM, SM → Admin/Owner). Buyer-record остаётся в DB, link воидится; re-flip recreates link если same email.
  • Audit log — Forward-flip: «User X marked unit Y as Reserved/Sold; linked to Buyer Z». Reverse-flip: «User X reverted unit Y from Sold → Reserved at TIMESTAMP. Voided link to Buyer Z». Visible to Owner / Admin / SM (full trail), SA (own actions only). Schema → Phase 1.3 implementation.
• Новая §6.2 — Channels (G) — Email + WhatsApp + Copy link (anchor fd-buyer-channels) — 3 styled boxes:
  • 3 channels (Stage 1) table — Email native через Phase 1.8 infra (SES / Mailgun); WhatsApp через https://wa.me/<phone>?text=<encoded> deep-link (открывает SA's own WhatsApp с предзаполненным message, ноль vendor integrations); Copy link clipboard. Tracking: ?ch=email|wa|link URL parameter.
  • UI flow в Sales Agent admin'е — modal с composeable message + selected units chips + 3 channel buttons. Phone-empty disables WhatsApp с tooltip. Multi-channel одновременно OK (same buyer-token, разный ?ch=).
  • Default message text + locale — Pre-filled на Org locale (English / Russian per ADR 0007). Template editable inline. Per-channel templates → Stage 2.
• Stage 2 channels backlog note — SMS via Twilio (carrier compliance, monthly fee), centralised WhatsApp via Business API (vendor onboarding required).

• §4.2 Permissions matrix — reverse-flip note paragraph под matrix table: reverse направление status change — same permissions как forward; каждый reverse-flip → audit log + email notification одну ступень выше; forward-flip — audit only без notification.
• §1 Sales Agent role definition cross-link refresh — verification form ссылка обновлена с #phase-1-10 на #fd-buyer-status (более precise — спец живёт в §6.1, не в Phase 1.10 implementation level).

• Phase 1.10 (Sales App) — v4.9 callout: status-change verification form UI (button-driven, smart-match autocomplete, auto-fill, optional notes/file upload), 3-channel buyer-link send modal (Email / WhatsApp deep-link / Copy), ?ch= URL parameter tracking, F-A deferred note.
• Phase 1.4 (Operator Dashboard) — v4.9 callout: status-flip audit visibility (forward + reverse) для support troubleshooting, reverse-flip email pipeline через Phase 1.8, anti-abuse aggregate «>20 reverse-flips / 30 дней» highlighted, channel analytics widget (Email / WhatsApp / Copy opens) для product decisions.

• F-A — Buyer browse scope from valid token — Open Question, две candidate variants ((i) Token = elevated to Full sales project-wide vs (iii) Token = Discovery elevation + per-project Owner toggle для Full sales) detail-spec'ed в plan'е. Awaiting Roman call ratification — mini-patch на §6 + Phase 1.10 callout после.
• «Request more options» CTA spec — depends on F-A resolution.
• SMS channel — Stage 2 (carrier compliance, monthly fee).
• Centralised WhatsApp via Business API — Stage 2 (vendor onboarding, audit log, opt-in flows).
• Per-channel templates (different text для Email vs WhatsApp) — Stage 2.
• Arabic locale — Stage 2 (per ADR 0007 i18n).
• Status-change form audit table schema — Phase 1.3 implementation.
• Reverse-flip email templates + opt-out controls — Phase 1.8 implementation.
• WhatsApp phone normalisation — Stage 1 simple regex; libphonenumber → Stage 2 если ошибки накопятся.
• Wave 2 Chunks 6-8 (§7 Edge cases, deep Phase callouts, ADR placeholders).

Источники: закрытый /plan-interview по §5 Visibility (12 решений) — PIN-protected preset spec + Custom preset cleanup. Strategic insight: PIN-protected — не «новый preset», а формализация уже задекларированного 4-го варианта из §1.2 Object Builder; «Custom» удалён из Stage 1 (granular toggles deferred Stage 2). План: plans/stage1-chunk-4-visibility.md.

• §5 lead rewrite — «global per Organisation» → «per-project setting (Object Builder + Project Settings)». Org-default Visibility deferred Stage 2.
• Preset table — 4 чистые rows: Private / Discovery / Full sales / PIN-protected. «Custom» preset удалён. PIN-protected row кратко описывает blur + PIN gate + cross-link на §5.1.
• Advanced overrides <details> → repurpose как Stage 2 deferral note (granular toggles deferred; объяснение почему «Custom» убран).
• Новая §5.1 — PIN-protected detailed spec (anchor fd-visibility-pin) — 4 styled boxes:
  • Anonymous visitor flow — URL → CSS blur(12-16px) on content wrapper → fixed PIN entry overlay (project name + input + Open project + Email us / Call us CTAs) → submit → 30-day cookie → After-PIN preset; rate-limit 5 attempts → 30s cooldown.
  • PIN bypass cases — valid 30d cookie, buyer-token (?b=...), logged-in team member owning/guest org, Owner-changed-PIN invalidates cookies.
  • PIN config UI — 4 conditional fields: PIN (required, free-format min 4 char, hashed at rest), After-PIN view (Discovery | Full sales), Contact email (required, default = Owner email), Contact phone (optional). Permission: Owner / Admin (matching §4.2 row).
  • Audit log — PIN set/changed (without value), failed attempts >3/hr flagged в operator panel, successful entries aggregate counter only. Schema → Phase 1.3 implementation.
• Viewer states table — substate note: state #1 anonymous может иметь valid pin_<project_id> cookie → renders как After-PIN preset без blur.

• §4.2 Permissions matrix row label — «Public Visibility settings (Private / Discovery / Full sales)» → «(Private / Discovery / Full sales / PIN-protected)». Permissions без изменений (Owner / Admin only).

• Phase 1.2 (Object Builder) — v4.5 callout получил bullet про 4 conditional поля для PIN-protected preset (PIN / After-PIN view / contact email / contact phone), которые разворачиваются в Object Builder + Project Settings.
• Phase 1.10 (Sales App) — v4.7 callout получил bullet про PIN gate routing: middleware sequence (buyer-token → cookie → auth → blur+overlay), CSS blur effect, 30-day cookie, Owner-PIN-change cookie invalidation.
• Phase 1.4 (Operator Dashboard) — v4.7 callout получил bullet про operator visibility (видит «PIN-protected» флаг для support, не видит PIN value; anti-brute-force flag для failed attempts >3/hr).

• Org-default Visibility — Stage 2 if multi-project studios попросят.
• Granular per-field overrides («ex-Custom toggles») — Stage 2.
• «Request access» CTAs в Private + Discovery preset'ах — куда ведут (по аналогии с PIN per-project contact?). Open Question; mini-patch после Chunk 4 если нужно.
• PIN-protected UI mockup в docs/mockups/admin-panel-atelier.html — отдельный track.
• PIN backend (hashed storage, rate-limit middleware, audit log table) — Phase 1.3 + 1.10 implementation.
• Phase 1.10 sales-app routing detailed pseudocode — Phase 1.10 build / sub-plan.
• Wave 2 Chunks 5-8 (§6 Journeys, §7 Edges, deep Phase callouts, ADRs).

Источники: закрытый /plan-interview по §4 Access (3 решения по Actions column / Internal vs External SA / View-as-Agent). Strategic insight: Internal vs External Sales Agent — это не разные роли, а одна роль с разным operational context; базовые permissions идентичны, различия — в orbital осях (stock pool default, cross-team visibility, invitation source, removal authority, reports/analytics scope). План: plans/stage1-chunk-3-access.md.

• §4.2 Permissions matrix — 2 новые action rows: «Invite/remove internal Sales Agents (own team)» (Owner ✅, Admin ✅, Sales Manager ✅, Content Editor —, Sales Agent —) + «Invite/remove External Sales Agents (via guest organisation)» (Owner ✅, Admin ✅, остальные —). Resolves CONV-22 What's Next item «Actions column» — оказалось это новые matrix rows, не отдельная колонка. Header note добавлен: Sales Agent column применяется к обоим Internal и External — базовые permissions identical.
• Новая §4.5 — Internal vs External Sales Agent (anchor fd-access shared) — comparison table с 5 осями: stock pool default (Closed mode), cross-team visibility, invitation source, removal authority, reports/analytics scope. Cross-link на §1 SA definition + §4.4 Closed pool table.
• Новая §4.6 — View-as-Agent — admin debug + training tool. Доступно: Owner / Admin / Sales Manager. Read-only mode (Save / Edit / Delete / Send / Assign disabled с тултипом) — explicit decision: НЕ impersonation. Persistent banner «Viewing as Иван (Sales Agent) · Exit view-as-mode →». Audit log entry «User X viewed as User Y at TIMESTAMP, duration N min». Schema-level дизайн → Phase 1.3 implementation. Cross-link на Preview-as-Buyer (отдельная фича в presentation builder, Phase 1.11).

• §1 Sales Agent role definition — добавлен cross-link к §4.5 после описания Internal/External split: «operational различия в §4.5».

• Phase 1.3 (Tenancy) — 1.3.2 Permission layers bullet расширен: «Internal/External SA operational split formalised в §4.5 — RBAC должен экспонировать обе variants через API + UI permissions filter (membership_type derived через organisation_id link)».
• Phase 1.4 (Operator Dashboard) — добавлен bullet про boundary: «View-as-Agent (§4.6) — team-level admin tool, ≠ Stage 4 operator impersonation». Operator impersonation (login as Client) остаётся deferred to Stage 4.
• Phase 1.10 (Sales App) — добавлен bullet про view-as mode rendering: sales-app authed views должны поддерживать view-as когда Sales Manager инспектирует team-member view. Top banner + mutating actions disabled.
• Phase 1.11 (Presentation Layer) — добавлен bullet про Preview-as-Buyer (related but separate from §4.6 View-as-Agent): кнопка в presentation builder перед Send, render с тестовым preview-token'ом, не consume реальный buyer token, не считается в audit log как buyer view.

• ADR 0009 (Tenancy & Permission Architecture) — placeholder remains.
• View-as-Agent backend (audit log table schema) — Phase 1.3 implementation level.
• View-as-Agent UI mockup в docs/mockups/admin-panel-atelier.html — отдельный track.
• Preview-as-Buyer detailed spec — Phase 1.11 build / sub-plan plans/buyer-profile-and-presentation.md.
• Reports/analytics row в §4.5 — гипотеза «Internal aggregate Organisation-level / External own + own guest org» может потребовать пересмотра при Roman ratification.
• Wave 2 Chunks 4-8 (§5 Visibility, §6 Journeys, §7 Edge cases, deep Phase callouts, ADR placeholders) — последующие сессии.

Источники: закрытый /plan-interview по §3 Billing (4 решения по trial scope / trial expiry / ownership transfer UI / tier nomenclature). Strategic insight: trial без карты + ownership transfer до first payment = единый sales motion студия→девелопер. План: plans/stage1-chunk-2-billing.md.

• Tier table — «Custom» row → «Tier 3 (Enterprise)» для согласования с §2 (где уже использовалось «Tier 3» для Custom SSO). Структура зафиксирована: 4 tier'а = Free Guest + T1 + T2 + T3. Цены / лимиты / возможные переименования линейки → ADR 0008.
• Новая subsection: Trial period (anchor fd-billing-trial, open by default) — 14 дней T1 без привязки карты для Path A signup. Не применяется к Path B/C. Доступен полный T1 функционал; T2/T3 фичи (custom domain, DKIM, SSO) не входят. UI: TRIAL — N days left badge. Email reminders день 7/12/14. По истечении без оплаты → auto-downgrade → Free Guest, projects read-only, публичный сайт работает 30 дней потом freeze.
• Новая subsection: Ownership transfer (anchor fd-billing-transfer) — self-serve в Organisation Settings пока не было ни одного payment. 4-шаговый flow: ввод email → email-инвайт (7d token) → acceptance screen → Owner choice (стать Admin или удалиться) + audit log. После first payment — UI скрыт, manual через support@offplan.online (Stage 2/3 self-serve).
• Update existing «Что происходит при просрочке» — добавлен qualifier «после first payment» с cross-link на §3 Trial period. Для разделения двух механик (trial expiry vs grace period).
• Update existing «Гость → платный» → переименована в «Гость / trial → платный». Добавлен Path A (trial → paid через TRIAL badge → pricing modal) bullet. 3 → 4 bullets.

• §1 Owner role definition — добавлен cross-link к fd-billing-transfer (transfer mechanic).
• §1 footer disclaimer («Что вне Stage 1») — anchor сменён с #fd-billing на #fd-billing-transfer для precision.
• §2 Path A row — добавлено явное «Карта не привязывается на этом шаге — даётся 14-дневный trial T1» + cross-link.
• Phase 1.2 v4.5 callout (Atelier model) — Trial badge wording обновлён: «TRIAL — N days left», 14 дней T1 без карты, ссылка на §3 Trial period.
• Phase 1.2 Object Builder spec (Trial-gate bullet) — то же обновление + детали expiry behaviour.

• Hero CTA «Start free trial — 3 months free» → «Start your 14-day trial — no card required» + cross-link.
• Billing structure trial line «3 месяца free» → «14 дней T1 без карты (Path A)».
• Open question «Trial без карты vs с картой» → resolved (CONV-24, без карты).
• Task 1.7.5 (Trial mechanics) — описание пересмотрено: «mechanics locked в §3 Trial period (CONV-24); эта таска = implementation против фиксированного спека». Глубокий rewrite остального 1.7 spec deferred в Wave 2 Chunk 7 (Phase callouts).

• ADR 0008 (Tier model + admin mode coupling) — placeholder remains, написание = другая сессия.
• Sub-plan plans/onboarding-trial-mode.md deep design — отдельная /plan-сессия (нужна обновить с учётом Atelier model + locked decisions из CONV-24).
• Wave 2 Chunks 3-8 (§4 Access onwards + Phase callouts + ADR placeholders) — последующие сессии.
• Stripe integration / billing implementation код — Phase 1.7 build-уровень, не plan-уровень.

v4.5 entry (CONV-21 Atelier rework + CONV-22 Wave 1/1.5 entity rename + Wave 2 Chunk 1) пропущен в этом changelog'е — backlog item для будущей сессии retroactive cleanup. Все изменения в плане commit'нуты (a56033a + 9409f1c).

Источники: закрытый /plan permission-and-tenancy-model interview (Blocks A-G по 36 sub-вопросам). Ratification Phase 1.3 + cross-cutting decisions integration в 7 phase'ов Stage 1.

• Вставлена прямо после priority order callout, перед Phase 1.1. Обязательное чтение перед phase'ами — объясняет «кто есть кто», «как работает подписка», «как раздаются доступы», «что видят разные viewers».
• 7 deep-dive subsections с anchor navigation: §1 Кто есть кто (entity glossary с real-world examples) · §2 Регистрация и онбординг (3 paths) · §3 Подписка Модель 4 + suspension flow · §4 Раздача доступов (invitations matrix + 5-role permissions table + S·1 stock allocation) · §5 Что кому видно (4 viewer states + Public Visibility 3 presets) · §6 Buyer flow (Variant E2 — tokenised unit links) · §7 Edge cases (suspension / GDPR / conflicts / referrals). Reservations & status flow удалена — Partner менеджит reservation процесс в своей CRM, в нашей админке только manual unit status flips.

• 1.2 — +Free Guest tier signup endpoint, +Hybrid login surfaces (per-Partner branded + central fallback), +Personal invite flow E.4, +Workspace switcher UI, +Auth methods (Google + email/password)
• 1.3 — RATIFIED: авторитативные decisions по всем 10 subtasks (1.3.1-1.3.10) с reference на foundational sections. ADR 0009 + ADR 0010 + ADR 0005 update будут созданы при ratification сессии.
• 1.4 — +Suspension management UI, +GDPR/ADGM erasure processing, +Stock allocation conflict reconciliation, +Owner lockout recovery, +Reserved subdomain (staff)
• 1.7 — +Public Visibility settings UI (Private / Discovery / Full sales presets + Advanced overrides), +Anonymous visitor flow, +Subdomain pattern (default + custom domain Tier 2+), +Project URL structure, +Stock allocation mode toggle (Closed pool default / Open pool opt-in per-project)
• 1.9 — +GDPR/ADGM right-to-erasure clause (jurisdiction-agnostic), +Reverse invite legal framework, +Buyer data export for KYC, +Hosting region disclosure, +Audit log retention notice
• 1.10 — +Buyer-aware unit pages (Variant E2 tokenised URLs), +Anonymous unit pages, +Status badge rendering, +Manual status change UI (no system-managed locks), +Buyer attribution preservation
• 1.11 — +Buyer entity = passwordless per-presentation, +Email content composition (auto-summary + agent free-text + N tokenised links), +Token expiry handling 90d, +Buyer self-service actions, +Forward email handling, +NO dedicated shortlist page (design-decision)

• Parked product question: Cyprus vs Abu Dhabi (ADGM) — contemplating only, not blocking. Privacy schema jurisdiction-agnostic.
• 7 tech questions для Ильи: Wildcard SSL strategy, Multi-tenant DB strategy, Token storage/hashing, Email provider, Existing Super Admin Panel reuse, Real-time sync для unit status, VV API audit. Required before final tech-estimate.
• Pricing tier specifics — отдельный /plan onboarding-trial-mode + ADR 0008.

• Главный plan вырос с ~3070 строк до ~3400 строк (foundational section + 7 callouts + open questions)
• Phase 1.3 готов к ratification как полноценный engineering brief для Ильи
• Все cross-cutting decisions (Buyer flow, Public Visibility, Permissions matrix, Stock allocation S·1) видны в одном документе для review с Романом

Источники: 2-часовой звонок Сергея с Романом + 7 уточняющих заметок Сергея. Интеграция критичных пунктов из звонка в Stage 1.

• Phase 1.3 — Tenancy & Permission Model ⭐ NEW (10 subtasks, foundational). Entity model (Partner / Developer / Studio / Agency / Agent / Editor / Buyer), permission layers, per-unit stock allocation, scoped URLs, cross-entity invitation flows (forward + reverse), referral architecture. Блокирует 1.4, 1.7, 1.10, 1.11. ADR 0009 (Tenancy & Permission Architecture) — обязательно.
• Phase 1.11 — Sales Presentation Layer ⭐ NEW (8 subtasks). Buyer Profile (1.11.1-5: создание профиля во время презентации, лайки юнитов, summary email с deep-link) + Remote Presentation (1.11.6-8 с маркером [needs-tech-estimate] от Ильи). Если remote не лезет в Stage 1 timeline — переносим в Stage 2.

• Существующие фазы 1.3-1.9 сдвинуты на 1 → стали 1.4-1.10. Новая 1.3 вставлена между Onboarding (1.2) и Operator Dashboard (теперь 1.4).
• Phase 1.2 переименована: Self-Serve Onboarding → Self-Serve Onboarding + Quick Build — Quick Build mode (Object Builder) интегрирован как часть онбординга. Визуальный референс: admin-quick-build-v2.html.
• ~90+ cross-references обновлены автоматически (sub-task IDs, deps, Q-table refs).

• 1.2 — +Quick Build mode, +Slug picker, +Tier-aware layout, ❌1.2.4 demo project deprecated
• 1.4 — +Fullscreen client card (replace drawer)
• 1.5 — +AI file upload endpoint, +VV API audit
• 1.7 — +4 landing pages by audience, +iframe demo embed, +Free tier billing, +Custom domain DKIM
• 1.8 — +Two-domain email setup, +DKIM/SPF/DMARC, +Hosting cost projection
• 1.9 — +Permission delegation framework, +Multi-party access agreement, +Data ownership matrix, +Liability allocation (Phase 1.9 растёт с 11 до 15 documents)
• 1.10 — +3 access modes (Public/PIN/People), +Login button top-right, +360° на Exterior, +Simple hotspot navigation

• 5 ADRs в очереди: 0008 (Tier model + admin mode), 0009 (Tenancy architecture), 0010 (Stock allocation), 0011 (Email sender), 0012 (Real-time sync)
• 6 sub-plans в очереди: permission-and-tenancy-model (P0 — первым), onboarding-trial-mode, buyer-profile-and-presentation, remote-presentation (условный), landing-pages-by-audience, legal-multi-party-framework
• Делta callouts в существующих фазах разворачиваются в полноценные subtask divs через соответствующие sub-/plan-сессии (тогда же создаются workstream'ы).

• Stage 1: 9 → 11 фаз, ~56 → ~85 подзадач
• Главный план: hero subtitle обновлён ("4 стадии, 25 фаз, ~170 подзадач")
• Phase Navigation (sidebar): добавлены 2 новые карточки в Stage 1 column

Источники: чистка topnav главного плана.

• 4 отдельные ссылки в topnav (B. 20 вопросов, C. 44 вопроса, D. 17 заметок, E. Открытые) объединены в одну: «Вопросы для проработки», ведущую на launch-plan-appendices.html. Внутри файла навигация по разделам сохранена.
• Зачем: 4 пункта меню для одного вынесенного файла визуально перегружали навигацию и дублировали структуру. Один пункт — чище, и сразу понятно что это research-сторона документа, а не активная часть плана.

Источники: продолжение разгрузки рабочего плана — 4 research-appendix'a (B, C, D, E) суммарно ~465 строк не нужны при работе над фазами Стадии 1, но читаются каждый раз.

• Создан launch-plan-appendices.html — содержит:
  • Appendix B — 20 новых вопросов (security / rate limiting / reliability)
  • Appendix C — 44 вопроса (наследие из launch-plan v2)
  • Appendix D — 17 заметок
  • Appendix E — Открытые вопросы (≈344 строки, активный реестр)
• В главном файле блоки B–E заменены на единый callout-секцию со списком всех 4-х подразделов и cross-file ссылками. Все anchor'ы (#app-b, #app-c, #app-d, #app-e) в topnav, sidebar и body перенаправлены на launch-plan-appendices.html#app-X.
• Appendix A (Admin Panel Concept) и Appendix F (Связанные файлы) остались в главном файле — A небольшой и conceptual reference используется из Phase 1.1; F = inventory of related files, тоже компактный.
• Эффект: главный файл сократился с 3297 → ~2840 строк (-13.9%). От оригинала: 4668 → ~2840 (-39.2%).
• Зачем: Appendix E особенно — это активный реестр открытых вопросов (35+ items), который растёт со временем. Его удобно читать в отдельном tab пока работаешь над фазой. Появилось чёткое разделение: рабочий план vs research artefacts.

Источники: продолжение разгрузки рабочего плана — feedback от использования: stub-блоки Стадий 3/4 со списком фаз всё ещё избыточны (фазы видно из Phase Navigation), а сам Changelog читался каждый раз при работе с планом.

• Stub теперь только: stage-header + callout-ссылка. Убран список из 5 phase-карточек под каждой Стадией (3.1–3.5 и 4.1–4.5). Оставлены: kicker / название стадии / цель / условие выхода — это conceptual уровень, который видно из главного плана. Roadmap фаз остаётся в Phase Navigation (sidebar).
• Phase Navigation (sidebar) — ссылки на Stages 3/4 теперь cross-file. Клик на "3.1 Performance & Scale Testing" в боковой навигации главного плана → переход в launch-plan-future.html#phase-3-1. То же для всех phases 3.x и 4.x. Topnav "Стадия 3" / "Стадия 4" — аналогично.
• Эффект: главный файл сократился ещё на ~50 строк (с stub-карточками было ~3660, без них ~3610). Главное — визуально чище: на месте Стадии 3/4 в главном плане теперь компактный 2-блок (header + callout), а не растянутый список.

• Создан launch-plan-changelog.html — содержит полную историю ревизий (v3.0 → v4.0). Тот же стилевой набор, единый формат entry-блоков.
• В главном файле Appendix G заменён на короткий callout с ссылкой на changelog-файл. Ссылки в topnav, hero-meta, footer обновлены — все указывают на launch-plan-changelog.html вместо in-page anchor #appendix-g.
• Зачем: Changelog — это история, а не активная часть плана. При работе над фазами он не нужен, но read-каждый-раз съедал контекст AI-инструмента (~340 строк). Вынос в отдельный файл = чтение только когда явно нужно посмотреть историю.
• Линки: старые in-page anchor-ссылки (#appendix-g) заменены на cross-file (launch-plan-changelog.html). Все стали валидными — нет broken links.