Preconditions
Organizer admin is authenticated in the admin shell with tenant-level account settings access.
Happy path
Open My Account.
The account overview route renders a visible
EF-001 not implementedgap panel until the contract ships.Review usage, plan, support, features, and billing.
The implemented target shows event and guest usage against plan quotas, current plan tier, support tier, enabled features, billing snippet, and upgrade CTA.
Start an upgrade or feature request.
The CTA preserves tenant context and creates an auditable account-level intent.
Failure modes
Permission denied at the right boundary
Trigger: non-admin opens My Account.
Resolution: 403, no plan, billing, support, or usage details leak.
Cross-tenant isolation
Trigger: tenant A admin guesses tenant B account id.
Resolution: 404 masks account existence.
Soft-delete leaves audit trail
Trigger: account-level feature flag or entitlement is removed.
Resolution: entitlement is deactivated with actor, timestamp, and prior state in audit.
Archive vs delete distinction
Trigger: admin archives old billing contact or removes it.
Resolution: archive remains reversible; delete requires destructive confirmation and preserves audit.
Edit lock during concurrent operations
Trigger: billing or feature ledger refresh is running while admin saves account settings.
Resolution: stale save receives conflict UI and does not overwrite refreshed account state.
Audit log row on every state change
Trigger: plan request, support-tier note, feature toggle, billing-contact edit, or usage export changes.
Resolution: d1-row-exists confirms an account audit row.
Two organizers concurrent
Trigger: two admins edit account metadata simultaneously.
Resolution: final state is deterministic and both sessions refresh after conflict or warning.
Undo window for destructive actions
Trigger: admin removes billing contact or disables a feature.
Resolution: 10 second undo restores the exact prior state.
Usage quota stale or unavailable
Trigger: usage aggregation fails.
Resolution: page marks usage stale, disables quota-sensitive upgrade decisions, and keeps support/billing visible.
Upgrade CTA loses tenant context
Trigger: admin clicks upgrade from a multi-tenant session.
Resolution: request carries active tenant id and never submits against the previous team.
Feature ledger mismatch
Trigger: enabled-feature ledger disagrees with runtime feature flags.
Resolution: mismatch is visible and supportable; hidden flags are not silently presented as enabled.
Parity gap: account overview absent
Trigger: matrix marks EF-001 absent.
Resolution: visible EF-001 not implemented gap panel remains until usage, plan, support, features, billing, and upgrade contract ship.
Stable test attributes
Visibility teeth. Each attribute must be effectively visible when active.
account-overview-page | Page | Account overview root |
account-overview-gap-panel | Page | Absent matrix gap |
account-usage-panel | Page | Usage and quotas |
account-plan-pill | Header | Plan tier |
account-support-tier | Page | Support tier |
account-feature-ledger | Page | Enabled features |
account-billing-snippet | Page | Billing summary |
account-upgrade-cta | Page | Upgrade action |
account-settings-form | Form | Future configuration UI |
account-conflict-modal | Modal | Concurrent conflict |
account-undo-toast | Toast | Undo destructive action |
Agent test plan
- account-overview-gap-renders
- account-overview-contract-visible
- account-upgrade-intent
- permission-denied-boundary
- cross-tenant-404
- soft-delete-audit
- archive-delete-distinction
- concurrent-edit-lock
- audit-row-every-change
- concurrent-organizers-conflict
- destructive-undo-window
- usage-quota-stale
- upgrade-tenant-context
- feature-ledger-mismatch
- account-overview-gap-probe
- evaluate-account-overview