Management destinations tracer: independent multi-target work-failure notifications #1492

Parent

#1019

Human-confirmed direction

Management notifications may target multiple genuine external conversations for one PersonaBot, including destinations on different IM platforms as each Provider/event path becomes qualified. This extends #1041's current single qualified Lark management DM. It does not make notification visibility a decision capability.

First runnable slice

Configure two independently authorized Lark management DMs in the existing Bot DM sidebar management-notifications surface. One committed work failure produces one independently inspectable delivery intent per selected destination. Preserve the previous single-DM configuration when upgrading. Get Human feedback on this actual two-recipient flow before extending group or additional-Provider targets.

Shared ownership and UI

• Reuse the Messaging owner, Operational Database and authenticated Typert/API Gateway; evolve the shared management destination collection rather than adding a failure-only registry or Profile page.
• Use the RBAC-style wide two-column modal. Select genuine destination names with Platform/App/conversation identity; show event qualification, test send and per-destination delivery states. The model cannot edit these subscriptions.
• Each destination has explicit event subscriptions. Only qualified event/destination combinations can be enabled; never display unimplemented Provider support as an actionable option.
• Group visibility and current actor authority remain separate. An approved notification destination does not grant Answer/Approve/Reject/save-rules, or ordinary chat access.

Acceptance criteria

• Select multiple genuine authorized destinations within one PersonaBot scope; preserve App/Binding/platform/conversation identity and prevent cross-Bot sender reuse.
• Migrate the existing shared single-DM route/settings without silently changing recipients or enabling events.
• Keep one canonical committed failure fact; derive separate bounded delivery intents keyed by event and target. Do not copy private failure content into additional authorities.
• Recheck each destination's current authorization, Binding/App/Provider identity, event subscription and conversation visibility before final send. Disabling one destination stops that destination without cancelling other valid destinations.
• Keep receipts, known-unsent budgets, cancellation and Unknown Outcome separate per destination. Do not resend successful/ambiguous targets when retrying another target; restart and new route selection do not backfill old events.
• Actual UI distinguishes all accepted, partially accepted, unavailable and unknown results, with per-target detail; platform acceptance does not claim Human reading.
• Run a real two-private-DM Lark failure notification, disable one recipient and verify the other remains valid, then restore healthy work without replay. Capture sanitized UI/platform evidence and first-slice Human feedback.
• For formal approvals/questions later using this collection, retain the same canonical request and first authorized accepted Web/IM decision; other views settle to that result rather than creating another decision authority.
• Retain focused public-boundary tests, bilingual guides/ledger, exact-version review path, migration/rollback notes and head-bound PR evidence.

Dependencies and follow-on qualifications

Native first-slice blocker: #1041. This ticket adds multi-target failure routing, not another ordinary roles/pairing implementation.

• Lark groups: Lark tracer: management conversation destinations with per-actor question and approval checks #1034 retains Lark tracer: native Human questions answered from the paired DM #1031's formal-question dependency and actor/visibility qualification.
• Slack: Slack tracer: verified pairing and native Allow once / Reject #1046/Slack tracer: formal questions answered through qualified native controls #1047/Slack group tracer: named management destinations with qualified decision actors #1051 retain their native management control, question and group qualifications. Slack tracer: ordinary roles and reviewed chat pairing with current-authority intake #1415 ordinary DM pairing alone is not this qualification.
• Discord: Discord tracer: verified DM pairing and native Allow once / Reject #1042/Discord tracer: native formal question answers and qualified clarification replies #1043/Discord group tracer: named management destinations with qualified decision actors #1050 retain current-product binding, native control, question and group qualifications.
• Formal waiting/continuation and Host/VPS-down monitoring retain their existing owners. No receiver window, App permission, package promotion, merge or deployment is authorized by this issue.

Blocked by

• Alert tracer: Bot work failures reuse the configured management route #1041