Product progress

queue step validate · milestone M0.4

commit 18fd451

• OpenTelemetry and Sentry are wired through configuration
• A missing DSN or endpoint disables export and does not crash boot
• No DSN, token, or secret is committed

queue step validate · milestone M0.8

commit 67a3df0

• A module spec exists at docs/modules/platform/worker-outbox.md before the code
• apps/api and apps/worker import a shared package and do not import each other (D-0042)
• The worker claims an unpublished identity.person_linked v1 row, records one inbox row, and marks the outbox row published
• A second delivery of the same event does not create a second inbox row
• No provider call, no schema change beyond the existing ops_outbox_events and ops_event_inbox tables, and no deploy

queue step validate · milestone M0.9

commit 330a6a0

• packages/design-tokens exposes the approved token v1 values
• web shells use those tokens and do not hard-code brand hex
• White text and white icons are not used on Impact Orange #FF6A00 (D-0027)

queue step implement · milestone M0.10

Blocked: Restore drills stay manual. The autopilot must not dump or restore the live database.

• A backup and a restore are proven on an isolated ci-test database
• The live codeimpact_v2 database is not overwritten

Platform · queue step validate · milestone P1-01b

Pull request #16 · checks not passed yet · autopilot/ap-0048

• docs/modules/system/number-sequences.md exists before the code and names listNumberSequences plus the internal ensure and allocate services
• A new ADR and a system-owned migration create only sys_number_sequences and insert no sequence rows
• listNumberSequences requires system.config.read and does not change next_value
• allocateHumanNumber locks the row, returns the prefixed padded number, advances next_value by one, and does not insert a missing sequence
• OpenAPI lists listNumberSequences and the slice adds no HTTP create or increment

queue step implement · milestone P1-01c

• docs/modules/system/settings.md exists before the code and names listSettings, getSetting, and putSetting
• A new ADR and a system-owned migration create only sys_settings, with one global row per key and is_secret false
• putSetting accepts only platform.timezone Asia/Kolkata and platform.currency INR
• An update requires If-Match, a missing header is 428, a stale tag is 412, and a real change appends one audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the three setting operations

queue step implement · milestone P1-01d

• docs/modules/system/feature-flags.md exists before the code and names listFeatureFlags and createFeatureFlag
• No new migration is added; createFeatureFlag uses the existing sys_feature_flags table
• createFeatureFlag requires features.manage, stores status active, and rejects a client status
• A duplicate flag key returns 409 and a success appends one system.feature_flag_created audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the two feature-flag operations

queue step validate · milestone P1-01a

commit 9b301b0

• docs/modules/system/holidays.md exists before the code and names listHolidays and createHoliday
• A new ADR and a system-owned migration create only sys_holidays, with campus_id null, no campus foreign key, and a database unique on global date and name
• createHoliday requires system.calendar.manage, stores status active, and rejects campusId
• A duplicate global date and name returns 409 and a success appends one system.holiday_created audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the two holiday operations

queue step validate · milestone P1-02

commit c4c5644

• docs/modules/identity/self-profile.md exists and names updateCurrentPerson
• PATCH /me updates only the self-editable profile fields and increments version_no
• A missing If-Match returns 428 and a stale If-Match returns 412
• A successful update appends an audit event and does not change keycloak_subject or status
• The OpenAPI document lists updateCurrentPerson and unit tests cover the forbidden and concurrency cases

queue step validate · milestone P1-02b

commit ed875b4

• docs/modules/identity/person-emails.md exists before the code
• listCurrentEmails, addCurrentEmail, and removeCurrentEmail operate only on the signed-in person
• A new email is stored unverified and no email provider is called
• Exactly one primary email remains when the person has any email, and the last email cannot be removed
• OpenAPI lists the three operationIds and unit tests cover a second person's denial

queue step validate · milestone P1-02c

commit 41a3e90

• docs/modules/identity/consents.md exists before the code
• A new identity-owned migration creates idn_consents and the applied migrations are unchanged
• recordCurrentConsent appends a row, and a withdrawal is a new row rather than an update
• The same Idempotency-Key replays and a different body returns 409 idempotency_conflict
• OpenAPI lists listCurrentConsents and recordCurrentConsent, and unit tests cover replay and conflict

queue step implement · milestone P1-02d

• docs/modules/identity/person-relationships.md exists before the code and names createPersonRelationship and listCurrentRelationships
• A new ADR and an identity-owned migration create only idn_person_relationships, with restrict foreign keys to idn_people
• createPersonRelationship requires relationships.manage, stores status active, and accepts only parent, guardian, spouse, and mentor
• A self-link returns 422, a duplicate active triple returns 409, and a success appends one identity.relationship_created audit event
• The self list returns only the caller's relationships, the same Idempotency-Key replays, and OpenAPI lists the two relationship operations

queue step validate · milestone P1-03

commit c6db77a

• docs/modules/authorization/role-administration.md exists before the code
• createRole, getRole, and createRoleAssignment enforce authorization.manage or authorization.read as specified
• super_admin succeeds and a learner, a campus-only grant, and a global deny are forbidden
• Idempotent replay returns the original result and a changed body returns 409
• Successful role creation and assignment append audit events, and OpenAPI lists the three operationIds

queue step validate · milestone P1-04

commit 98c0ecf

• docs/modules/crm/staff-leads.md exists before the code
• A new crm-owned migration creates crm_leads and no campus, legal-entity, or catalogue table is added
• createLead, listLeads, and getLead require crm.leads.create or crm.leads.read, and a learner receives 403
• A created lead has status new, nullable campus and program ids, an audit event, and idempotent replay
• OpenAPI lists the three operationIds and unit tests cover denial, replay, and idempotency conflict

queue step validate · milestone P1-05

commit 01262df

• docs/modules/crm/lead-assignment.md exists before the code and names updateLead
• A new crm-owned migration creates crm_lead_assignments and applied migrations are unchanged
• updateLead with crm.leads.update sets owner_person_id, closes the open assignment, and appends one history row
• A missing If-Match returns 428 and a stale If-Match returns 412
• A learner receives 403 without the lead being loaded, OpenAPI lists updateLead, and unit tests cover denial, hidden existence, and a repeat assignment of the same owner

queue step validate · milestone P1-06

commit ddc5fe1

• docs/modules/crm/lead-activities.md exists before the code
• A new crm-owned migration creates crm_activities and no other crm table
• createLeadActivity and listLeadActivities enforce crm.activities.create and crm.activities.read, and a learner receives 403
• activity_type is only call, message, meeting, note, or demo, and the lead last_activity_at is updated in the same transaction
• The same Idempotency-Key replays and a different body returns 409, and OpenAPI lists both operationIds

queue step validate · milestone P1-07

commit c436a6e

• docs/modules/crm/lead-tasks.md exists before the code and an ADR sets the created task status to open
• A new crm-owned migration creates crm_tasks and applied migrations are unchanged
• createLeadTask and listLeadTasks enforce crm.tasks.create and crm.tasks.read, and a learner receives 403
• A created task has status open, an existing assignee, an audit event, and idempotent replay
• OpenAPI lists both operationIds and unit tests cover denial, hidden existence, replay, and conflict

queue step validate · milestone P1-08

commit 68063fb

• docs/modules/crm/lead-task-reminder.md and an ADR name the internal event crm.task_due version 1
• A successful createLeadTask writes one ops_outbox_events row in the same transaction, and a replay does not write another
• The worker records one inbox row and marks the outbox row published
• A second delivery of the same event does not create a second inbox row
• No provider is called, no notification table is added, and no migration is added

queue step validate · milestone P1-09

commit 81ce899

• docs/modules/crm/lead-stage.md exists before the code and names transitionLeadStage
• Allowed lead edges follow Domain §42.1 and any other edge returns 422 invalid_state_transition
• transitionLeadStage requires crm.leads.update, and a learner receives 403 without the lead being loaded
• Entering lost stores lost_at and lost_reason_code, entering converted stores converted_at, and a success appends one audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists transitionLeadStage

queue step validate · milestone P1-10

commit 10043f0

• docs/modules/catalogue/categories.md and the next ADR exist before the code and name listCategories, createCategory, and updateCategory
• A catalogue-owned migration creates only cat_categories, with created_at, updated_at, and version_no, and status has no CHECK
• createCategory requires catalogue.manage, stores status active, and a duplicate code or slug returns 409 without finishing idempotency
• updateCategory requires If-Match, a learner receives 403 without the row being loaded, and a real change appends one audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the three category operations

queue step validate · milestone P1-11

commit ee99c39

• docs/modules/catalogue/programs.md exists before the code and names listPrograms, createProgram, and getProgram
• A catalogue-owned migration creates only cat_programs, with a restrict foreign key to cat_categories and unique code and slug
• createProgram requires catalogue.manage, stores status active and public_visibility private, and rejects any other programType
• An unknown category is 404, a learner receives 403 without the program being loaded, and a success appends one audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the three program operations

queue step validate · milestone P1-12

commit 6e83365

• docs/modules/catalogue/program-update.md exists before the code and names updateProgram
• updateProgram requires catalogue.manage and If-Match, and a learner receives 403 without the program being loaded
• The body cannot change code, status, categoryId, or public_visibility
• A real change bumps version_no and appends one catalogue.program_updated audit event; an unchanged patch does neither
• A stale If-Match returns 412 and OpenAPI lists updateProgram

queue step validate · milestone P1-13

commit 35a5dd2

• docs/modules/catalogue/tracks.md exists before the code and names listProgramTracks, createProgramTrack, and updateTrack
• A catalogue-owned migration creates only cat_tracks, with a restrict foreign key to cat_programs and uniqueness of code and slug within the program
• createProgramTrack requires catalogue.manage, stores status active, and an unknown program returns 404
• updateTrack requires If-Match, a learner receives 403 without the track being loaded, and a real change appends one audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the three track operations

queue step validate · milestone P1-14

commit ae80d45

• docs/modules/catalogue/skills.md exists before the code and names listSkills, createSkill, and updateSkill
• A catalogue-owned migration creates only cat_skills, with created_at, updated_at, and version_no, and category is not a foreign key
• createSkill requires catalogue.manage, stores status active, and a duplicate skillKey or slug returns 409 without finishing idempotency
• updateSkill requires If-Match, a learner receives 403 without the skill being loaded, and a real change appends one audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the three skill operations

Commerce · queue step validate · milestone P1-25

Pull request #18 · checks not passed yet · autopilot/ap-0052

• docs/modules/commerce/promotion-update.md exists before the code and names updatePromotion
• updatePromotion requires commerce.promotions.manage and If-Match, and a learner receives 403 without the promotion being loaded
• The body cannot change code, status, or conditions, and a replaced discount still follows the ADR-0013 percentage or INR fixed rules
• A real change bumps version_no and appends one commerce.promotion_updated audit event; an unchanged patch does neither
• A stale If-Match returns 412 and OpenAPI lists updatePromotion

queue step implement · milestone P1-27

• docs/modules/commerce/scholarship-programs.md exists before the code and names listScholarshipPrograms and createScholarshipProgram
• A new ADR and a commerce-owned migration create only prd_scholarship_programs
• createScholarshipProgram requires scholarships.manage, stores status active, and stores no amount and no GST rate
• An authenticated learner can list active programs, and an anonymous caller receives 401 authentication_required
• A duplicate code returns 409, a success appends one commerce.scholarship_program_created audit event, and OpenAPI lists both operations

queue step implement · milestone P1-28

• docs/modules/commerce/scholarship-applications.md exists before the code and names listScholarshipApplications and createScholarshipApplication
• A new ADR and a commerce-owned migration create only prd_scholarship_applications, with restrict foreign keys to prd_scholarship_programs and idn_people
• A person can apply for themselves, another person's id without scholarships.manage is 403, and the stored status is submitted
• The owner list returns only that person's rows, and global scholarships.read returns the queue
• A success appends one commerce.scholarship_application_created audit event and OpenAPI lists both operations

queue step implement · milestone P1-29

• docs/modules/commerce/scholarship-decision.md exists before the code and names decideScholarshipApplication
• A new ADR and a commerce-owned migration create only prd_scholarship_awards
• decideScholarshipApplication requires scholarships.decide, and a learner receives 403 without the application being loaded
• Approval from submitted writes one award and sets the application approved; rejection writes no award; any other status is 422 invalid_state_transition
• The same Idempotency-Key replays one award at most, and OpenAPI lists decideScholarshipApplication

queue step validate · milestone P1-15

commit a47c1f6

• docs/modules/commerce/products.md and the next ADR exist before the code and name listProducts, createProduct, and getProduct
• A commerce-owned migration creates only prd_products and prd_product_programs, with restrict foreign keys to cat_programs and cat_tracks
• createProduct requires commerce.catalogue.manage, stores status active and product_type program, and an unknown program returns 404
• A learner receives 403 without the product being loaded, and a success appends one commerce.product_created audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the three product operations

queue step validate · milestone P1-16

commit 5635508

• docs/modules/commerce/product-update.md exists before the code and names updateProduct
• updateProduct requires commerce.catalogue.manage and If-Match, and a learner receives 403 without the product being loaded
• The body cannot change productCode, productType, status, programId, or trackId
• A real change bumps version_no and appends one commerce.product_updated audit event; an unchanged patch does neither
• A stale If-Match returns 412 and OpenAPI lists updateProduct

queue step validate · milestone P1-17

commit 21e6b31

• docs/modules/commerce/offers.md exists before the code and names listOffers, createOffer, and getOffer
• A commerce-owned migration creates only prd_offers, with a restrict foreign key to prd_products and entitlement_bundle_id nullable
• createOffer requires commerce.offers.manage, stores status active, and rejects campusId, salesChannel, and entitlementBundleId
• An unknown product is 404, a learner receives 403 without the offer being loaded, and a success appends one commerce.offer_created audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the three offer operations

queue step validate · milestone P1-18

commit 983f717

• docs/modules/commerce/offer-update.md exists before the code and names updateOffer
• updateOffer requires commerce.offers.manage and If-Match, and a learner receives 403 without the offer being loaded
• The body cannot change code, productId, status, campusId, salesChannel, or entitlementBundleId
• A real change bumps version_no and appends one commerce.offer_updated audit event; an unchanged patch does neither
• A stale If-Match returns 412 and OpenAPI lists updateOffer

queue step validate · milestone P1-19

commit c23f288

• docs/modules/commerce/offer-prices.md exists before the code and names listOfferPrices and createOfferPrice
• A commerce-owned migration creates only prd_prices, with a restrict foreign key to prd_offers, DECIMAL(19,4) amount, and CHAR(3) currency_code
• createOfferPrice requires commerce.pricing.manage, stores status active, and accepts only currency INR
• An overlapping active price for the same offer and currency returns 409, and a success appends one commerce.price_created audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the two price operations

queue step validate · milestone P1-20

commit 9f5ca54

• docs/modules/commerce/price-update.md exists before the code and names updatePrice
• updatePrice requires commerce.pricing.manage and If-Match, and a learner receives 403 without the price being loaded
• The body cannot change offerId, status, or countryCode, and currency stays INR
• A real change bumps version_no and appends one commerce.price_updated audit event; an overlapping active window returns 409
• A stale If-Match returns 412 and OpenAPI lists updatePrice

queue step validate · milestone P1-21

commit e2ae7cc

• docs/modules/commerce/payment-plans.md exists before the code and names listPaymentPlans and createPaymentPlan
• A new ADR and a commerce-owned migration create only prd_payment_plans and prd_payment_plan_parts
• createPaymentPlan requires commerce.pricing.manage, stores status active, and each part uses exactly one of percent or fixed amount
• A duplicate code returns 409 and a success appends one commerce.payment_plan_created audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the two payment-plan operations

queue step validate · milestone P1-22

commit f831c6d

• docs/modules/commerce/payment-plan-update.md exists before the code and names updatePaymentPlan
• updatePaymentPlan requires commerce.pricing.manage and If-Match, and a learner receives 403 without the plan being loaded
• The body cannot change code or status, and a replaced part still uses exactly one of percent or fixed amount
• A real change bumps version_no and appends one commerce.payment_plan_updated audit event; an unchanged patch does neither
• A stale If-Match returns 412 and OpenAPI lists updatePaymentPlan

queue step validate · milestone P1-23

commit c1d1507

• docs/modules/commerce/offer-payment-plans.md exists before the code and names attachOfferPaymentPlan
• A new ADR and a commerce-owned migration create only prd_offer_payment_plans, with restrict foreign keys to prd_offers and prd_payment_plans
• attachOfferPaymentPlan requires commerce.pricing.manage, and a learner receives 403 without the offer or the plan being loaded
• The first attach appends one commerce.offer_payment_plan_attached audit event, and a second attach of the same pair inserts neither a row nor an audit event
• An unknown offer or an unknown plan returns 404 and OpenAPI lists attachOfferPaymentPlan

queue step validate · milestone P1-24

commit 3ab9b24

• docs/modules/commerce/promotions.md exists before the code and names listPromotions and createPromotion
• A new ADR and a commerce-owned migration create only prd_promotions
• createPromotion requires commerce.promotions.manage, stores status active, keeps a percentage as a normalized rate, and accepts only INR for a fixed discount
• A duplicate code returns 409 and a success appends one commerce.promotion_created audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the two promotion operations

Admin screens · queue step implement

builder is still writing the branch · autopilot/ap-0040

• docs/modules/crm/admin-lead-activities.md exists and names listLeadActivities and createLeadActivity
• The timeline calls those client methods through the BFF, with CSRF and Idempotency-Key on create
• activityType is only call, message, meeting, note, or demo, and occurredAt is UTC ending in Z
• Empty, validation, conflict, and forbidden states are text
• Vitest covers the empty timeline and the activity types, and apps/api is unchanged

queue step implement

• docs/modules/crm/admin-lead-tasks.md exists and names listLeadTasks and createLeadTask
• The screen calls those client methods through the BFF, with CSRF and Idempotency-Key on create
• The form does not send status and does not call updateCrmTask or a people directory
• Empty, validation, not-found, and forbidden states are text
• Vitest covers the empty list and the labels, and apps/api is unchanged

queue step validate

commit 111da60

• docs/modules/crm/admin-lead-list.md exists and the screens follow it
• /leads calls listLeads and /leads/{leadId} calls getLead through the BFF session and packages/api-client
• The access token is not rendered, and a signed-out visitor does not call the API
• Loading, empty, forbidden, and unavailable states are text, and each lead has an accessible link name
• Vitest markup tests cover those states, and apps/api, OpenAPI, and the generated client are unchanged

queue step validate

commit 516fe9b

• docs/modules/crm/admin-lead-create.md exists before the form
• The form calls createLead with Idempotency-Key through the BFF and a CSRF check
• The body omits status, personId, campusId, sourceId, and interestProgramId
• validation_error, idempotency_conflict, forbidden, and success are visible as text, and submit cannot double-send
• Vitest covers labels and those states, and apps/api is unchanged

queue step validate

commit 1a19cdf

• docs/modules/crm/admin-lead-assignment.md exists and names updateLead
• The form sends ownerPersonId, optional reason, and the lead versionNo through the BFF with CSRF
• 412 stale_version offers a reload, and 404 says the lead or person was not found
• The screen does not call listPeople or getPerson and does not send status or contact fields
• Vitest covers the labels and those states, and apps/api is unchanged

Integration tests · queue step implement

builder is still writing the branch · autopilot/ap-0036

• docs/modules/crm/lead-tasks.md Tests section names this Testcontainers file
• createLeadTaskFor commits one open task, one crm.task_created audit row, one finished idempotency row, and one crm.task_due version 1 outbox row
• The outbox payload is taskId, leadId, and dueAt, and the lead version_no is unchanged
• A replay returns the same task and does not insert a second task, audit row, or outbox row
• A different body returns idempotency_conflict
• An unknown assignee rolls back the task, the audit row, the outbox row, and the idempotency row
• No worker, inbox, or production behavior changes unless a failing test proves a bug

queue step validate

commit d5c694b

• docs/modules/identity/consents.md Tests section names this Testcontainers file
• A grant and a later withdrawal are two idn_consents rows, and the grant row stays granted
• The consent insert and its audit_events row commit together; a replay adds neither
• A reused header with a different body returns idempotency_conflict and inserts nothing
• A status outside granted and withdrawn is rejected by the CHECK constraint
• No outbox row is written and no production behavior changes unless a failing test proves a bug

queue step validate

commit 09d7554

• docs/modules/authorization/role-administration.md Tests section names this Testcontainers file
• A duplicate role_key is rejected by MySQL and the failed create leaves no finished idempotency row
• Replaying the same header and body returns the original role and does not insert a second role or audit row
• A different body with the same header returns idempotency_conflict
• An assignment to an unknown person rolls back; a global assignment commits one row and one audit row
• No production behavior changes unless a failing test proves a bug

queue step validate

commit 245ce71

• docs/modules/crm/staff-leads.md Tests section names this Testcontainers file
• createLeadFor commits one crm_leads row, one crm.lead_created audit row, and one finished idempotency row
• A replay returns the same lead id and does not insert a second lead or audit row
• A different body returns idempotency_conflict and leaves that one lead
• An unknown personId rolls the lead, the audit row, and the idempotency row back
• No outbox row is written and no production behavior changes unless a failing test proves a bug

queue step validate

commit 501dda9

• docs/modules/crm/lead-assignment.md Tests section names this Testcontainers file
• A real assignment bumps version_no and commits the lead, one open history row, and one crm.lead_assigned audit row
• The same owner again does not bump version_no and writes no history or audit row
• A stale If-Match returns stale_version and a missing If-Match returns precondition_required
• After reassignment exactly one assignment has ends_at null
• An unknown owner leaves the lead unchanged and no production behavior changes unless a failing test proves a bug

queue step validate · milestone CUR-01

commit 7055d81

• docs/modules/curriculum/program-versions.md and the next ADR exist before the code and name listProgramCurriculumVersions, createProgramCurriculumVersion, and getCurriculumVersion
• A curriculum-owned migration creates only cur_program_versions, with a restrict foreign key to cat_programs, unique (program_id, version_number), and a status CHECK of draft, review, published, and retired
• createProgramCurriculumVersion requires curriculum.manage, stores status draft, assigns the next version_number, and an unknown program returns 404
• A learner receives 403 without the version being loaded, and a success appends one curriculum.program_version_created audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the three version operations

queue step validate · milestone CUR-02

commit 9d66214

• docs/modules/curriculum/program-version-update.md exists before the code and names updateCurriculumVersion
• updateCurriculumVersion requires curriculum.manage and If-Match, and a learner receives 403 without the version being loaded
• The body cannot change versionNumber, status, programId, or the publication fields, and a version that is not draft returns 409
• A real change bumps version_no and appends one curriculum.program_version_updated audit event; an unchanged patch does neither
• A stale If-Match returns 412 and OpenAPI lists updateCurriculumVersion

queue step validate · milestone CUR-03

commit 4557171

• docs/modules/curriculum/track-versions.md exists before the code and adds no operationId
• A curriculum-owned migration creates only cur_track_versions, with restrict foreign keys and unique (track_id, program_version_id, version_number)
• createProgramCurriculumVersion writes one draft track version per catalogue track of the program in the same transaction
• A program with no tracks writes none, and an idempotent replay does not insert track rows again
• getCurriculumVersion includes those track versions, and OpenAPI still lists only the program-version operations

Curriculum · queue step implement · milestone CUR-04

builder is still writing the branch · autopilot/ap-0045

• docs/modules/curriculum/entry-routes.md exists before the code and names listEntryRoutes and createEntryRoute
• A curriculum-owned migration creates only cur_entry_routes, with the generated track_version_scope unique across program version, track version, and code
• createEntryRoute requires curriculum.manage, stores status active, and a parent version that is not draft returns 409
• An unknown version is 404, a learner receives 403 without the version being loaded, and a success appends one curriculum.entry_route_created audit event
• The same Idempotency-Key replays, a different body returns 409, and OpenAPI lists the two entry-route operations

queue step implement · milestone CUR-05

• docs/modules/curriculum/entry-route-update.md exists before the code and names updateEntryRoute
• updateEntryRoute requires curriculum.manage and If-Match, and a learner receives 403 without the route being loaded
• The body cannot change code or status, and a parent version that is not draft returns 409
• A real change bumps version_no and appends one curriculum.entry_route_updated audit event; an unchanged patch does neither
• A stale If-Match returns 412 and OpenAPI lists updateEntryRoute