User journeys, end-to-end.

TRUNK · day-of-operations

Day-of Operations

Kiosk + check-in console + live attendee handling across two surfaces (kiosk.* + staff.*). Offline-mode contract, idempotent two-staff-same-guest pattern, anti-probing for invalid QRs. Roots in admin-shell-access.

Event-day staff Day-of

TRUNK · public-event-page

Public Event Page

The booking-pages app surface. Public guests, no auth shell. 6 failure modes including not-found, archived, draft-treated-as-not-found anti-probing, capacity-full, invite-only-no-token, and og-tags-present for share previews.

iOS/Android event-day shell. Different physics: offline by default, intermittent network, hardware (camera, bluetooth printer, NFC), background app states, OS permission lifecycles. 7 failure modes (network drop, force-quit-preserves-queue, app-update mid-event, two-staff idempotent, camera permission revoked, sign-out with pending, encrypted-at-rest). Runner: Detox/XCUITest, not yet wired.

TRUNK · native-app-shell

Native App Shell

TRUNK · efx-station-shell

EFx Station Shell

Live event station + organizer control + WebSocket runtime. Built on Durable Objects + the F80/F88-proven 5k-concurrent substrate. 8 failure modes (socket reconnect, out-of-order delta, results-visibility gate, 5k load stable, cross-station isolation, late-join state, idempotent vote, passcode rotation).

Station operator + attendee Live

Component stories

Design-system primitives. Tested once with all interaction edge cases. Branches that use a component inherit its contract via usesComponents and don't re-test the fiddly UX bits.

COMPONENT · ui-modal

Modal dialog

Focus trap, esc-closes, backdrop, scroll lock, layered z-index, mobile sheet behavior. The richest interaction primitive in the admin.

Component Inherited by ~50 branches

COMPONENT · ui-text-input

Text input

Validation rendering, autofill detection (no-validation-on-autofill), paste truncation, character counter, focus-ring-visible contract, label always above the field.

Label-click toggles, Space toggles + Enter doesn't, indeterminate aria-checked=mixed, disabled blocks both box and label, focus ring always visible.

COMPONENT · ui-checkbox

Checkbox

COMPONENT · ui-autocomplete

Autocomplete select

Debounce-and-clamp, race-stale-response discard, cursor stability by id not index, no-auto-highlight, three-state Esc, no-results-not-alert. 8 failure modes — the most failure-prone tier-1 primitive.

Submit lifecycle, idempotency-key wiring, busy-state lockout, error rendering (inline + summary), focus-first-error, Enter-vs-Cmd-Enter keyboard semantics.

COMPONENT · ui-form

Form

Content-length-aware auto-dismiss timing, hover-pause / focus-pause, max 3 stacked + queue, dedup by id, no-auto-focus-steal, mobile placement that doesn't overlap workspace chrome.

COMPONENT · ui-toast

Toast

COMPONENT · ui-data-table

Data table

The most-used surface in the admin. Sort round-trips through parent, sticky header doesn't bleed, row-click vs inner-button delegation, page-only vs cross-page select, distinct empty/loading/error states, long-cell truncation, keyboard nav.

Component Inherited by ~30 list-view branches

COMPONENT · ui-pagination

Pagination

Page numbers + prev/next + first/last + page-size, "Showing X–Y of Z" status. Page-size change resets to page 1, current page not clickable, ellipsis non-interactive, empty list hides controls. Total is required — never "?".

COMPONENT · ui-status-pill

Status pill

Closed registry of 24 statuses (draft, registered, ready, failed, bounced, …). Color is never the only differentiator, custom labels override defaults, unknown status falls back to "Unknown" with a warning, prefers-reduced-motion respected.

COMPONENT · ui-search-with-filters

Search with filters

Header above every list. 300ms debounce, Enter flushes, Esc clears. Active filters always visible (no "+2 more" collapse). Clear-all wipes both search and filters. Result count goes skeleton during in-flight, never stale.

COMPONENT · ui-bulk-action-bar

Bulk action bar

Appears when selection > 0. Page-scope vs all-matching scope distinction enforced. Destructive actions always confirm. Pluralization correct. Always shows absolute count, never "many". Bar persists during in-flight action.

COMPONENT · ui-file-uploader

File uploader

File picker + drop zone + per-file progress. Validates size and MIME before upload starts, abort actually aborts (AbortController), retry uses idempotency-key, watchdog timeout marks stuck uploads as failed, partial-failure semantics surfaced, 0-byte and folder drops rejected.

COMPONENT · ui-async-job-tracker

Async job tracker

Polls a background job's lifecycle. Progress clamps at 99% until ready, stuck-in-queued banner after 60s, polling stops on terminal state, race between cancel-and-complete handled, expired countdown never goes negative, request-id always shown on failure for support.

Component Inherited by EF-086, EF-088, EF-089, EF-093

COMPONENT · ui-destructive-confirmation

Destructive confirmation

The "are you sure?" dialog. Friction-by-design: initial focus on Cancel, Enter doesn't confirm, type-to-confirm for high-stakes ops (case-sensitive), async confirm gates the modal, dialog stays open on rejection with inline error.

COMPONENT · ui-date-range-picker

Date range picker

Timezone-honest date selection. ISO strings as source of truth, never silent end-before-start swap (always prompts), DST-safe day enumeration, locale-aware text parsing (en-US vs en-GB), min/max enforced in calendar, presets show their dates before clicking.

Multi-step navigation. URL-state mandatory (linkBuilder), back-navigation skips validation (going back is always free), Next validates first, direct-URL-out-of-order redirects to first incomplete step, optional steps with allowSkip, async onStepChange with busy state.

COMPONENT · ui-stepper

Stepper / wizard

COMPONENT · ui-rich-text-editor

Rich text editor

Schema-bounded editor (output is JSON, never HTML). Paste-from-Word strips inline styles, merge tokens are atomic chips (cursor skips interior), undo/redo groups by operation, link URLs allow-listed (no javascript:), maxLength counts plain-text not markup.

WAI-ARIA-compliant tabs. Arrow keys auto-activate, disabled tabs skipped during nav, inactive panels unmounted (no display:none state leak), badge=0 hidden, overflow scrolls or wraps but never hides behind a "More" menu, URL-sync via linkBuilder.

COMPONENT · ui-tabs

Tabs

COMPONENT · ui-permissions-matrix

Permissions matrix

Subject × ability grid. Implied abilities cascade (granting "edit" implies "read"), revocation cascades when no other source, role presets apply with explicit diff preview, save shows the diff before committing (uses labels, not dot-IDs).

COMPONENT · ui-progress-bar

Progress bar

Determinate / indeterminate. Value clamps to 0..100, NaN renders indeterminate, value never regresses (panic prevention), prefers-reduced-motion drops animation, tone reinforced by icon (not color alone).

COMPONENT · ui-csv-import-preview

CSV import preview

Header→field mapping + per-row validation. Auto-match marked as "auto" so user can verify, commit sends only valid rows, large file commits all rows (not just preview), retry uses idempotency-key, post-commit per-row error report download.

COMPONENT (Tier 3) · ui-async-job-admin-page

Tier-3 compound components

Higher-order compositions harvested from the 94-story corpus. Each appears in 5+ branch stories — extracted once, ratchets all consumers automatically. Full analysis in TIER3-HARVEST.md; tier model in TIERS.md.

Async job admin page

Recurrence: 12+ stories (reports EF-086..EF-091, mailings EF-053/054, imports EF-093/094/005/044). One component renders the entire job-admin surface — list, filters, per-row tracker, drill-in modal, create/cancel/retry. Permission-gated, URL-state-synced, idempotent retries.

Tier 3 (compound) 12+ branch consumers

COMPONENT (Tier 3) · ui-oauth-connection-card

OAuth connection card

Recurrence: 5 stories (Salesforce EF-092/096, Zoom EF-095, Zapier EF-097, Dropbox+Drive EF-038). Pairs with usesIntegration envelope. 5 connection states (disconnected/connecting/connected/revoked/error), reconnect-preserves-account, sandbox vs prod isolation, popup-blocked redirect fallback, schema-drift graceful.

Tier 3 (compound) 5 branch consumers

COMPONENT (Tier 3) · ui-public-form-flow

Public form flow

Recurrence: 6 stories (EF-014/016/017/019/025/031). Run-validated — the deployed booking-pages diverges from this contract; codifying it lets the Ratchet narrow that divergence. Identity + consent + submit + success + already-completed + anti-probing-uniform-response + browser-back-safe + idempotent retry + capacity-full conversion + bot-fill rate-limit. Page or modal mode.

Tier 3 (compound) 6 branch consumers

COMPONENT (Tier 3) · ui-conflict-resolution-modal

Conflict resolution modal

Recurrence: 11 stories (cluster-B two-organizers + edit-lock-during-publish standardization). 4 conflict kinds (version-mismatch / publish-in-progress / edit-lock-held / session-expired). Field-level diff (not document-blob). Default focus on Discard, overwrite uses destructive-confirmation, allowOverwrite=false available for high-stakes surfaces.

Tier 3 (compound) 11 branch consumers

COMPONENT (Tier 3) · ui-csv-import-flow

CSV import flow

Recurrence: 4 stories (EF-005, EF-044, EF-045, EF-093). 4-phase guided flow (upload → preview → importing → done) with URL-state per phase. Wraps ui-file-uploader + ui-csv-import-preview + ui-async-job-tracker. URL refresh mid-import recovers correctly, large files commit ALL rows (not just preview), idempotent retry, partial-failure surfaces error report download.

Tier 3 (compound) 4 branch consumers

COMPONENT (Tier 3) · ui-audit-log-viewer

Audit log viewer

Recurrence: 4 stories (EF-002, EF-088, EF-100, EF-026). Filterable + paginated audit display with per-row drill-in. Hot-tier (≤90 days) vs cold-tier transparent. Sensitive fields redacted without canViewSensitive permission. Drill-in renders before/after diff for UPDATE actions. Column headers NOT sortable (timestamp-only by contract).

Tier 3 (compound) 4 branch consumers

Branch stories

Each roots in a trunk and focuses on the specific feature's success + failure surface. Component-tier mechanics inherit from the component stories above. Cluster B (organizer admin) was the first codex-factory dispatch — 7 stories at 10-12 failure modes each, all lint clean.

EF-001

My Account overview

Matrix=Absent — ships entirely as gap probe. 12 failure modes describing the desired contract: usage panel (events + guests + plan-quota delta), plan/upgrade CTA, support tier, enabled-features ledger, billing snippet. Visible "EF-001 not implemented" panel.

Switch active account/team context. 12 failure modes including persisted active-team URL state, audit-row-per-switch (compliance), prevents accidental cross-tenant operations after switch, gap probe for missing multi-account switcher.

EF-002

Team selection

Reusable contact records + activity. 12 failure modes including contact merge (same email twice), contact-event-history, soft-delete with audit, gap probe for missing full Address Book UI.

EF-004

Address book contacts

Reusable groups + bulk contact upload. 12 failure modes including group-of-groups not supported by contract, bulk-add via ui-csv-import-preview, gap probes for downloadable duplicate/error reports.

EF-005

Address book groups

Organizer creates a fresh event or clones a past one. The seemingly-simple one — but the failure modes around copy-from-deleted-source and cross-tenant access have real teeth.

EF-008

Create or copy event

Organizer Planning

EF-011

Event info & settings

Metadata, URLs, language, social, revenue, waitlist, archive. 10 failure modes including audit-trail-on-soft-delete, archive-vs-delete distinction, edit-lock-during-publish, two-organizers concurrent.

Distribution, availability, price, capacity, transferability, FCFS, sort. 11 failure modes including payment-settlement parity gap, public-display gap, sort-collision normalization, conflict-modal pattern.

EF-015

Access Types

Public email-lookup form. Email-not-on-list returns generic "no invitation found" (anti-probing — same response shape as known-not-found vs invalid format), per-email rate-limit, invite link emailed not displayed inline.

EF-014

Invitation reveal

The simplest happy-path public flow. 11 failure modes including capacity-full mid-fill race, two-tab idempotency, browser-back doesn't double-register, og-tags present for share previews, bot-fill rate-limit, already-registered show-existing record.

EF-016

Public registration

Private free invitation. 12 failure modes including the dignified-rejection contract (no-leak, no-diagnostic-distinguisher, warm tone, request-invitation CTA), capacity-full waitlist, revoked-mid-flow with composed-message preserved.

EF-018

Invite to RSVP

Organizer + guest Setup → Public

EF-021

Ticket quantities & windows

Capacity adjustment + availability start/end windows. 11 failure modes including downstream-attendee-messaging gap probe, capacity-shrink-below-current-registrations conflict, window edits during in-flight registrations.

Invitation transfer (public)

EF-022

Recipient pastes transfer link, lands on acceptance page, can accept or decline. Idempotent (accept-twice doesn't double-register), transfer-from-deleted-source returns generic 4xx, transfer link expiry handled.

Waitlist signup + status check. Position display ("you're #4") OR generic "we'll reach out". Promotion-from-waitlist via email channel (gap probe). Anti-probing on email-lookup.

EF-025

Waitlist (public)

Compose, preview, publish event pages. 10 failure modes covering undo/redo correctness across block ops, paste-from-other-page reference resolution, asset-upload failure isolated, scheduled publish atomicity, autosave recovery on refresh, two-editor conflict resolution.

EF-027

Canvas page builder

Catalog + start-from-template + team templates. 10 failure modes including team-template permission scope (uses ui-permissions-matrix), template-modified-after-use does NOT propagate to existing pages, template paginates via ui-data-table.

EF-028

Canvas templates

Guest navigation across /p/:slug pages of one event. Deep-link refresh-safe per SPA-state mandate, 404 on unknown sub-slug, canonical URL resolves consistently, og-tags differ per page.

EF-029

Multi-page event sites

Event + guest merge tokens for Canvas pages. 10 failure modes including token-rendering-fallback (missing data → fallback, never empty merge), per-token validation, resolution-at-preview vs at-render, token catalog pagination.

EF-030

Canvas dynamic elements

Registration button modal

EF-031

The public guest's first interaction. 8 failure modes including validation-required-field, email-format-invalid, back-button-closes-modal, network-failure-retry, capacity-full-mid-fill, two-tab-race-idempotent, server-500-with-request-id, already-registered.

Matrix=Absent — entire feature ships as gap probe. 11 failure modes describing the desired contract: form block, anti-abuse rate-limit + CAPTCHA, email routing to event organizer, audit log per submission. Visible "EF-032 not implemented" panel.

EF-032

Canvas contact form

Public guest Canvas

EF-033

Canvas video embeds

MP4, YouTube, Vimeo. 11 failure modes including embed-parsing strips arbitrary HTML, lazy-load below-fold, autoplay disabled by default for accessibility, video-parity-gap probe for missing provider parity.

Countdown to event start. 11 failure modes including timezone-honest counting, "Event in progress" mid-state, configurable post-event message, countdown-parity-gap for organizer controls.

EF-034

Canvas countdown

Nav-bar block, anchor links, mobile hamburger. 11 failure modes including nav reorder via block ops (not separate config), anchor link targeting, fixed-position option, nav-parity-gap for builder + mobile parity.

EF-035

Canvas navigation bar

Canvas custom code & fonts

EF-036

Custom CSS allow-list, font upload + subset, JSON page-tree import/export. 11 failure modes including arbitrary JS forbidden, @import URL allow-list, custom-fonts-parity-gap.

Matrix=Absent — entire feature ships as gap probe. 11 failure modes describing the desired contract: shared style class registry, edits propagate across blocks using a class, inspector shows class-membership, conflict UI when local override exists.

EF-037

Canvas style sync

Dropbox + Google Drive connector OAuth, asset picker, R2 mirroring (not hot-link). 11 failure modes including revoked-OAuth recovery + re-connect flow, no-hot-link rendering, external-assets-parity-gap.

EF-038

Canvas external assets

Title, company, address, phone, country. 11 failure modes including admin-field-required configuration gap probe, attendee-form rendering parity gap, audit-on-required-flag-toggle.

EF-039

Built-in guest fields

Custom registration questions

EF-040

Custom answer types + access-type-scoped questions. 13 failure modes including answer-type validation per registered type, preview-vs-published divergence, question-reorder concurrent edit, two-organizers conflict.

Compliance-sensitive. 13 failure modes — waiver checkbox NOT pre-checked, evidence stored with policy version (later edits don't rewrite past consents), signature-required validation, minor/guardian copy captured, parity-gap probe (matrix=Absent).

EF-041

Waiver / signature

Organizer + guest Compliance

EF-042

Guest list views

Status views, sorting, searching, export. 11 failure modes including URL-sync for filter state, pagination preserved across status-tab switches, export-during-pagination scoping (full match-set vs current page).

Add or invite one guest. 12 failure modes including contact reuse vs new contact, idempotent invite-resend within 60s, ticket-block scope enforcement, audit row per state change.

EF-043

Individual invite

Bulk invite via group or upload. 14 failure modes including ui-csv-import-preview integration, partial-success commit, large-file commits ALL rows (not just preview), bulk-resend progress via ui-async-job-tracker.

EF-044

Group invite + upload

Generated CSV/XLSX template. 13 failure modes including all-required-fields-present, deprecated columns flagged "ignored" (not rejected), format auto-detect xlsx vs csv, commit retry with idempotency key.

EF-045

Upload template

Modify access type, ticket block, status, custom fields, notes. 10 failure modes including closed-event edit parity gap, cancel-with-pending warning, two-organizers concurrent on same guest, audit-on-status-change.

EF-046

Edit guest

Staff-only notes shown at check-in. 12 failure modes including visible-to-staff-not-guest, edit history preserved, character limit enforced server- AND client-side, native check-in display gap probe (deferred to native trunk).

EF-047

Check-in notes

Organizer + staff Guest list → Day-of

EF-048

Arrival alerts

Email/SMS on specific guest check-in. 12 failure modes including per-guest config preserved across edits, multi-recipient alert, opt-out per guest, dispatch-on-checkin gap probe (matrix flags it not implemented end-to-end).

Organizer Notification

EF-049

Resend invitations

Single + bulk resend, confirmation resend, timeframe exclusions, ticket-block resend. 12 failure modes including bulk-resend gap, confirmation-resend gap, timeframe-exclusion gap, async-job-tracker for bulk runs.

Last-Contacted + Last-Email-Interaction columns + filtering. 11 failure modes including delivery/open/click/bounce ingestion gap, guest-list UI parity gap, time-range filter, async-job-tracker for export.

EF-050

Last contacted

Reusable designs + 6 message types (invitation, confirmation, decline, save-the-date, manual, ops). 11 failure modes including deployed-runtime-gap (template API 404), design-list pagination, preview-vs-published divergence.

EF-051

Email designs & types

Access-type → message-type-design mapping. 11 failure modes including deployed-runtime-gap (PUT 404 on association endpoint), test-send via association preview.

EF-052

Email association

One-time send with audience picker. 11 failure modes including deployed-runtime-gap (mailing create 409 NO_RECIPIENTS), recipient-resolution empty-audience handling, ui-async-job-tracker for fan-out progress.

EF-053

Guest messaging

Future send_at, edit/cancel before send-due. 11 failure modes including deployed-runtime-gap (scheduled mailing 409 NO_RECIPIENTS), past-edit-window enforcement, ui-date-range-picker for schedule input.

EF-054

Scheduled messages

Mobile-responsive templates

EF-055

Multi-viewport preview (mobile-portrait/landscape, tablet, desktop). 11 failure modes including deployed-runtime-gap (template list 404), max-width ~600px constraint, sample-data preview.

Token catalog + insert + per-recipient resolution. 11 failure modes including deployed-runtime-gap (token catalog 404), token-rendering-fallback, never-empty-merge contract.

EF-056

Email dynamic elements

QR design block + signed URL → check-in round-trip. 11 failure modes including deployed-runtime-gap (mailing send 409 NO_RECIPIENTS), inline alt text, plain-text fallback for QR-incompatible clients.

EF-057

QR codes in emails

Google/Outlook/Yahoo/ICS preview + signed ICS link. 11 failure modes including deployed-runtime-gap (mailing send 409 NO_RECIPIENTS), HMAC-signed ICS, calendar-app round-trip.

EF-058

Calendar links

R2 asset upload, sizing knobs, missing-alt warning. 11 failure modes including deployed-runtime-gap (sizing PATCH 404), oversized-image warning, ui-file-uploader integration.

EF-059

Email images & GIFs

Matrix=Absent — entire feature ships as gap probe. 11 failure modes describing the desired contract: domain verification UI, DNS TXT records to copy, verification status pill, sender enforcement at send time, suspended-domain handling.

EF-060

Email masking (SPF/DKIM)

9 failure modes including idempotent two-staff-same-guest, expired-window with permission-gated force, tampered-QR anti-probing, waitlisted-three-options decision UI, network-drop offline queue.

EF-066

QR reader check-in

Event-day staff Day-of

EF-086

Generated reports

Async-job lifecycle. 11 failure modes including job-stuck-queued, job-failed-with-reason, signed-URL-expired, swept-artifact, two-organizers, large-dataset, bounce-indicator, race-window-404, permission-revoked, cancel-mid-run, permission-gated-catalog.

Guest list summary report

EF-087

Identity, title, company, position dataset fields; CSV + PDF outputs. 12 failure modes including deployed-runtime-gap (D1 bootstrap 400), signed-URL expiry, permission-gated catalog. Inherits ui-async-job-tracker contract.

Unioned guest, scan, notification, email activity. 12 failure modes including deployed-runtime-gap (D1 bootstrap 400), paginated preview before download, time-range filter via ui-date-range-picker.

EF-088

Activity log report

Email deliverability report

EF-089

Email-event counts (delivered/opened/clicked/bounced/suppressed). 12 failure modes including deployed-runtime-gap (D1 bootstrap 400), per-mailing or per-event aggregation, ui-status-pill registry for status display.

Graphical check-in report

EF-090

Check-in-over-time chart, PDF with chart embedded. 12 failure modes including deployed-runtime-gap (D1 bootstrap 400), dedupe + timeline rows, time-range filter.

Specialized ticketing reports

EF-091

Transfer states, waitlist promotions, purchase reconciliation, ticket-block allocations. 12 failure modes including deployed-runtime-gap (D1 bootstrap 400), per-sub-report tabs, large-dataset streaming.

GDPR — privacy, consent, DSR

EF-006

Hand-written. Public consent (never pre-checked, evidence with policy version), tenant privacy policy URL display, DSR fulfillment workflow (export 30-day SLA, delete with cascade + tombstone). 12 failure modes covering verification token forgery, two-eyes delete, audit-tombstone-preserves-traceability.

Public + admin + DPO Compliance

EF-007

White labeling

Hand-written. Brand profile (logo + color + font + footer + sender domain), feature gated by SKU, SVG sanitization, color-contrast warning, brand-version pinning per event, asset URL HMAC-signed, trial-expiry falls back to default. 12 failure modes.

Tenant admin Compliance

EF-013

Event collaborators & roles

Hand-written. Per-event roles (organizer, read-only, support, check-in-staff, assistant). 12 failure modes — invitation token forgery, role-escalation-via-payload-rejected, revocation cascades active sessions, plan-downgrade preserves existing + blocks new, matrix display matches server enforcement.

Organizer Compliance

EF-017

Public purchase

Hand-written. Stripe Elements (PCI scope off our origin), 3DS challenge, idempotent retry no double-charge, capacity-full mid-checkout, partial refund balances, dispute lifecycle, receipt failure doesn't roll back, currency in event-currency not converted, webhook source-of-truth. 12 failure modes.

Public guest Payments

EF-019

Invite to purchase

Hand-written. Inherits EF-017 payments + invitation token mechanics. 10 failure modes including token-revoked-mid-checkout, token-already-used, token-consumed-released-after-fail, transferable vs non-transferable enforcement (revealed-email anti-probing first-3-chars), access-type-specific price.

Invited guest Payments

EF-024

Promo codes

Hand-written. Matrix=Absent — ships as gap probe. Discount/free-ticket/reveal-hidden, anti-probing on unknown/expired/exhausted codes (same UI message), free-ticket skips Stripe, refund decrements redemption count, brute-force rate-limit. 12 failure modes describing the contract.

Organizer + guest Payments

EF-026

Refunds & ACH withdrawal

Hand-written. Refund (full + partial + idempotent), ACH withdrawal lifecycle (pending → in_transit → paid via ui-async-job-tracker), withdraw-during-dispute excludes disputed amount, payout failed/reversed handling, ACH timing disclosure honesty, finance-role-only enforcement. 12 failure modes.

Organizer (finance) Payments

EF-026b

Receipt lifecycle

Hand-written (split from EF-026). HTML email + PDF receipt, online receipt URL HMAC-signed forever, refund-receipt only on charge.refunded webhook, dispute banner, customer + organizer resend (rate-limited), no PII in receipt URL or document title. 10 failure modes.

Customer + organizer Payments

EF-070

EFx enablement & passcode

Account-level EFx enablement + per-event station passcode. Passcode rotation locks new connections without killing live sessions; audit row per rotation. 11 failure modes.

Organizer + station op EFx

EF-071

EFx SMS messaging

Matrix=Absent — ships as gap probe. SMS provider, audience filter (checked-in only), dynamic personalization, delivery telemetry, opt-out. 12 failure modes describing the contract.

Organizer EFx

EF-072

SMS arrival greeting

Matrix=Absent — ships as gap probe. Check-in event triggers SMS, template with merge tokens, per-event opt-out, delivery telemetry. 10 failure modes. Roots in day-of-operations (trigger is at check-in).

Event-day staff EFx

EF-073

EFx poll (live)

Live poll using F80/F88 substrate. Question types (single, multi, free-text), real-time tally, results-visibility gate per question. Inherits efx-station-shell trunk's idempotent-vote + cross-station-isolation. 11 failure modes.

Organizer + attendee EFx

EF-074

Polling results visualizer

AppleTV/large-display surface for poll tally, raffle, leaderboard. Display-only (no input), large-text contrast for distance viewing, prefers-reduced-motion respected. 11 failure modes.

Display operator EFx

EF-075

EFx teams & leaderboard

Team membership, scoring, leaderboard. Inherits cross-station-isolation. SMS teammate-finding (relies on EF-071 substrate — gap probe), score arithmetic server-side authoritative. 11 failure modes.

Organizer + attendee EFx

EF-076

Roaming photographer

Matrix=Not Ready. Capture app, guest matching by face/QR, SMS delivery (gap on EF-071), consent + storage policy, retention. Substantial substrate for photo wall visualizer. 12 failure modes describing the contract.

Photographer EFx

EF-077

EFx access control (NFC)

Session/breakout scan at door checkpoints. Native NFC + QR component (gap probe for native runner), per-session capacity enforcement, late-arrival policy per session config, audit row per scan. 12 failure modes.

Door staff EFx

EF-078

Lead retrieval (sponsors)

Sponsor scans attendee QR/NFC; lead captured with custom fields; per-sponsor scoped export. Sponsor-facing mobile app gap probe. 10 failure modes.

Sponsor + organizer EFx

EF-079

Fast pass scheduling

Attendee at NFC station receives a timed-return assignment ("come back at 3:15 PM"). SMS notification (relies on EF-071 — gap probe), idempotent within slot, capacity per slot. 10 failure modes.

Attendee + station op EFx

EF-080

Reservation queueing

Public-facing queue with SMS callback (gap on EF-071), position display, abandon-and-rejoin-keeping-position, FIFO server-side authoritative. 10 failure modes.

Public guest EFx

EF-081

Product pickup

Scan attendee → check eligibility → mark fulfilled in inventory. Idempotent (don't double-fulfill), inventory audit row per pickup, sponsor/buyer reporting. 10 failure modes.

Pickup staff EFx

EF-082

Digital memory bank

Post-event personalized microsite generated from station interactions (scans, photos, polls, raffle wins). Auth via guest token, content retention policy. Microsite generation gap probe. 11 failure modes.

Public guest (post-event) EFx

EF-083

Raffle

Entry per checked-in attendee (idempotent), deterministic draw (server-side seeded), winner notification via SMS (gap on EF-071), multi-prize tiers, runner-up if winner unreachable. 11 failure modes.

Organizer + attendee EFx

EF-084

Concierge

Matrix=Absent — ships as gap probe. Scan-triggered content station, content model (text/image/video), attendee display surface, per-content analytics. 10 failure modes.

Station op + attendee EFx

EF-085

Smart bar

Matrix=Absent — ships as gap probe. Ordering UI, bartender queue, eligibility (age, prepaid drinks), inventory limits, scan-and-pickup pattern. 11 failure modes.

Bartender + attendee EFx

EF-092

Salesforce connection

First story to use usesIntegration envelope. OAuth2 flow, persisted connection state, reconnect on token revoke. Capability gap probe for sandbox creds + customer round-trip proof. 12 failure modes.

Salesforce campaign import/export

EF-093

Matrix=Absent — ships as gap probe. Campaign member import (SF → Voyage), campaign export (Voyage → SF), member-status mapping, dedup by email, partial-rollback on errors. 12 failure modes.

Matrix=Absent — ships as gap probe. Active-campaign limit, import size cap, email-uniqueness behavior, Lead vs Contact selection, field mapping UI. 13 failure modes.

EF-094

Salesforce sync limits

The matrix's only Shippable integration. Meeting/webinar create, registrant sync, signed webhook for check-in. fixture: "live". All 8 integration rubric categories asserted against real Zoom contract. 12 failure modes.

EF-095

Zoom integration (live)

Organizer Integrations

EF-096

Zoom settings repair

Detect unsupported Zoom settings (e.g., webinar with public registration when org disabled), surface repair UI. Inherits Zoom contract from EF-095. 12 failure modes.

Organizer Integrations

EF-097

Zapier app

Matrix=Absent — ships as gap probe. Public Zapier app publication, OAuth via Zapier's auth scheme, version management, Zapier review/publish lifecycle. 12 failure modes.

Matrix=Absent — ships as gap probe. Trigger feeds for check-in, invitation, registration, purchase, ticket-block-assignment, ticket-block-removal. 12 failure modes describing per-trigger contract.

EF-098

Zapier triggers

Matrix=Absent — ships as gap probe. Zapier recipe subscribing to EventFarm registration trigger and creating Zoom webinar registrant. Combines EF-095 + EF-098 contract surfaces. 12 failure modes.

EF-099

Zoom webinar via Zapier

Hand-written. Tenant-level public-API enablement. Anti-probing 404 when disabled, token displayed once, scope enforcement, rate-limit with Retry-After, IP allow-list, revoke cascades within 60s, bulk-revoke type-to-confirm. 12 failure modes.

EF-100

API access flag & tokens

Tenant admin + dev Compliance

EF-061

Native check-in app

Hand-written. iOS + Android signed-build check-in. Synthesis story — when a signed build passes the trunk's failure-mode catalog AND the check-in-flow modes here on physical hardware, EF-061 ships green. 11 failure modes. Runner: Detox/XCUITest (not yet wired) → Gate 7 manual evidence.

Offline roster & sync monitor

EF-062

Hand-written. Resumable initial roster download, delta-fetch with tombstones for cancelled rows, chronological replay on reconnect, encrypted-at-rest, sync monitor in admin (yellow/red stale pills at 10/30 min). 10 failure modes.

Staff + organizer monitor Native

EF-063

On-site walk-in add

Hand-written. Quick-add native form creating registration + check-in atomically. Walk-ins-tab visible only when access types allow, capacity-full mid-form converts to waitlist offer, duplicate-email already-registered link, empty-email allowed, two-staff race resolved server-side. 9 failure modes.

Hand-written. Matrix=Absent — ships as gap probe. Split-party check-in (1 of 4 arrives, 3 invitations remain active). 10 failure modes describing the contract — overscan blocking, two-staff race, audit per partial check-in, group-revoked-mid-event, anonymous-attendee handling.

EF-064

Leave-behind invitations

Staff + remaining-guest Native

EF-065

Kiosk mode (iPad)

Hand-written. iOS Guided Access self-check-in. 6-digit kiosk passcode, no-app-navigation, orientation lock, anti-probing email-not-found, no-autofill-leak between attendees, exit-passcode lockout (60/300/600s), battery-low banners. 8 failure modes.

Attendee + organizer Native

EF-067

Wireless badge printing

Hand-written. Matrix=Absent — ships as gap probe. Bluetooth-paired thermal printer, badge template editor, auto-print on confirm, manual reprint with permission gate, BT-loss queues + retries, out-of-paper banner with retry. 8 failure modes.