PR #8972 · the staff door — disconnect a named company's mailbox or PMS
The other half of the staff-only ruling: a route staff can actually reach, and a confirmation that says what stops and what is kept.
16 Sept 2026 · branch lane-d/staff-disconnect · captured against propflow-stage · at 70d8fcfdc9+local
Data note. Every name and balance below comes from propflow-stage, which is anonymized by construction (ADR-0097/0110 — phones in the impossible +1000 NPA, emails @example.test). The identical capture against prod would carry real tenants' names and balances and is not safe to attach anywhere, which is why the generator refuses to run against one.
1 · The control, on a company that has something to disconnect
#8951 made the sending mailbox and the PMS connection staff-only and left no route staff could reach — every customer-facing disconnect resolves the company from the caller's own spine, and platform staff have none. The control goes here because this card is already the one place staff read these two connections.
This company has a connected mailbox and no PMS, which puts both halves of the rule in one frame. The mailbox row carries a Disconnect; the PMS row, reading Not connected, carries nothing at all. A Disconnect beside "Not connected" is a button that can only fail, so it is not offered — and the pair on screen is what makes that a rule rather than a coincidence.
The other thing to look at is what is absent: there is no Connect button anywhere on this card and there never will be. Staff cannot connect a customer's mailbox for them, so that would be an offer we cannot keep. Ending one is different, and as of the ruling it is staff's job alone. Teammate calendar rows carry nothing either — those stay the customer's to end.
Asserted in the captured DOM — Connections · Company mailbox · Disconnect · Not connected · TEAM CALENDARS. The card, both policy-bearing rows, and the Disconnect control itself — which is on screen here because this fixture's mailbox is genuinely connected. ⚠️ TEAM CALENDARS is asserted in CAPITALS on purpose: the markup says "Team calendars" and the label carries Tailwind's `uppercase`, so the captured VISIBLE text is transformed and the sentence-case string misses. The capture reads what a person sees, not what the JSX says.
2 · The confirmation — what stops, and what is kept
Both sentences are load-bearing, and the second one is the one people forget.
What stops — "Clara stops sending from this inbox, and stops reading new mail that arrives at it." Without it, "Disconnect the mailbox?" tells a staff member nothing about the consequence they are actually weighing.
What is kept — "The record of what was connected is kept, and they can connect it again at any time." Without it a reasonable person assumes a disconnect deletes what it disconnects, and then either hesitates over a reversible action or avoids it entirely and leaves a customer connected to something that should be off. The route backs the sentence: the mailbox hook is ENDED and its vault row survives as the audit trail; on the PMS path the credential is DISABLED, never deleted, so its fingerprint still stops another company claiming that database.
Asserted in the captured DOM — Clara stops sending from this inbox · The record of what was connected is kept · connect it again at any time · Cancel. The confirmation's own words, captured with the dialog open rather than quoted from source — which is the point of a capture over a unit test here. The copy contract is ALSO asserted directly in ConnectionsCard.staffDisconnect.test.tsx, so a reword fails a test as well as changing this picture.
What these captures are for
The thing a unit test cannot reach: that a destructive control on a staff-facing card reads as deliberate rather than as a stray button — sitting beside the status it acts on, on the card staff already open to read that status, with no Connect counterpart implying a symmetry that does not exist, and absent entirely on the row with nothing to end.
An earlier version of this page captured a fixture where NOTHING was connected, so no control was on screen — and the closing described one anyway. The reviewer caught it. The fix was to capture a company that actually has the connection, rather than to keep prose the picture did not support.