spec(§7): delivery plan — SLICE-1..4 (skeleton, identity, storefront, deployed envs), rollout, risks

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

specs/SD-0001-mvp-sign-up-and-single-storefront.md

@@ -904,19 +904,84 @@ The prototype's discipline, inherited:
 
 ### 7.1 Approach / strategy
 
-<!-- §7.1 pending -->
+Walking skeleton first, then the two domains in dependency order, then the
+deployed environments — riskiest-last is wrong here: the *deploy* story is the
+novel risk (the prototype never deployed), so it gets its own slice with
+everything else already green, and PPE rehearses Prod (BUC-5a) rather than
+both being attempted at once.
+
+Execution convention (per the handbook): each slice is its own
+planning-and-executing session — implementation plan written just-in-time at
+session start → execute → verify → merge + version bump. The design pass is
+this document, once; if a slice proves it wrong, amend the spec, then replan.
+Slice tasks live in each slice's plan, not here.
 
 ### 7.2 Slicing plan
 
-<!-- §7.2 pending -->
+#### SLICE-1 — Walking skeleton → completes PUC-10 (localhost half of BUC-5)
+
+- **Depends on:** —
+- **Ships:** repo scaffold (backend 4-layer skeleton + import-linter
+  contract, frontend Vite/React shell, `scripts/check.sh`, CI); `platform/db`
+  with the migration runner (INV-7) and migration `0001` (the §6.3 schema);
+  `/healthz`; `scripts/dev.sh`; first cut of `docs/BOOTSTRAP.md` (localhost
+  section).
+- **Definition of done:** clean checkout → `scripts/dev.sh` → app up on an
+  empty, self-migrated DB; `/healthz` green; check gate green in CI; the
+  bootstrap test skeleton runs migrate-from-empty + idempotent re-migrate
+  (INV-1 partial — full flow lands with SLICE-2/3).
+
+#### SLICE-2 — Identity → completes PUC-1, PUC-2 (+a/b/c), PUC-3, PUC-9
+
+- **Depends on:** SLICE-1
+- **Ships:** `accounts` domain (request-code / verify / sessions / me /
+  logout per §6.4–6.5), `platform/mailer` port with `LogMailer`, Landing +
+  Sign-in screens, entry routing with storefront hard-wired `null`.
+- **Definition of done:** BUC-1/BUC-2 acceptance criteria met end to end on
+  localhost; scenario tests for 14.01.0001–0004, 0009–0011 and PUC-2a/b/c
+  green; INV-2/INV-3 invariant tests green; no enumeration (uniform 204)
+  asserted.
+
+#### SLICE-3 — Storefront → completes PUC-4, PUC-5, PUC-6, PUC-7, PUC-8
+
+- **Depends on:** SLICE-2
+- **Ships:** `storefronts` domain (create + guard + membership per §6.5),
+  Create-storefront + Admin-shell screens, full entry routing, the complete
+  bootstrap test (INV-1 whole-flow).
+- **Definition of done:** BUC-3/BUC-4 acceptance criteria met; scenario tests
+  for 14.01.0013/0015/0016/0025/0026/0027 and PUC-5/7/8 green; INV-4
+  concurrent-create test green; localhost bootstrap (PUC-10) walkable start
+  to finish — BUC-5's dev third done.
+
+#### SLICE-4 — Deployed environments → completes PUC-11 (BUC-5, BUC-5a)
+
+- **Depends on:** SLICE-3; **operator gestures:** PPE + Prod provisioning via
+  launch-app/flotilla (handbook §8.5 — the session hands the operator the
+  commands and waits), SMTP relay choice + credentials into Secret Manager
+  (§9 Q-1).
+- **Ships:** `SmtpMailer` + config wiring (INV-8), `deployment.toml`,
+  deployed-environment hardening from §6.6 (Secure cookies, log hygiene),
+  `docs/BOOTSTRAP.md` completed for PPE/Prod.
+- **Definition of done:** bootstrap rehearsal executed on PPE — a real
+  sign-up → storefront → admin with a real emailed code — then the identical
+  gesture on Prod; both recorded in the runbook; Feature #1 acceptance fully
+  met; Feature #1 closed.
 
 ### 7.3 Rollout / launch plan
 
-<!-- §7.3 pending -->
+Pre-v1, single Prod: PPE rehearsal is the canary (SLICE-4); Prod day-one *is*
+the bootstrap state; rollback is flotilla redeploy of the prior version
+(§6.9). No staged exposure — there is no traffic to stage.
 
 ### 7.4 Risks & mitigations
 
-<!-- §7.4 pending -->
+| Risk | Likelihood / impact | Mitigation |
+| --- | --- | --- |
+| R-1: First-ever ecomm deploy — flotilla provisioning/deploy path unexercised for this app | M / H | Isolate in SLICE-4 with all product code already green; PPE before Prod; operator runs provisioning (handbook §8.5); wiggle-snip's deployment.toml as template |
+| R-2: OTC email deliverability (spam-foldering, relay limits) kills real sign-ups | M / H | Relay is deployment config (swap without code, INV-8); rehearsal on PPE with real mailboxes before Prod; honest `delivery_failed` surfacing (INV-9) makes failures visible, not silent |
+| R-3: SQLite write concurrency at real scale | L (MVP) / M | WAL + short transactions now; INV-5/INV-6 keep the storage seam clean for a Postgres move; revisit at the first scale-bearing Feature |
+| R-4: Scope creep into admin features ("just one settings field…") | M / M | PUC-8's honestly-empty rule + §1.7 scope; anything beyond the shell is a new Feature |
+| R-5: The 1-1 storefront rule calcifies into hidden assumptions | L / M | INV-4 names the single deletable guard; membership schema + tests assert the many-capable shape stays intact |
 
 ## 8. Traceability matrix