# Diagnostic Entrypoint Matrix

Status: implementation matrix complete.

| Diagnostic need | Official entrypoint | Secondary entrypoint | Surface type | Audience | Reason | In scope? | Follow-up if deferred |
|---|---|---|---|---|---|---|---|
| Support needs quick environment context | Support Diagnostics modal from Environment Dashboard | OperationRun support diagnostics when run context owns the question | support-only, official-entrypoint | operator/support | Existing modal and bundle are visible and repo-backed | yes | none |
| Environment has repairable membership issue | Environment Repair Diagnostics page | Secondary read-only Support Diagnostics modal from the repair page | repair-only, secondary-entrypoint | operator/support | Existing `EnvironmentDiagnostics` repair actions own repair truth; Support Diagnostics owns broader context | yes | none |
| Environment has no owner | Environment Repair Diagnostics page | Environment Dashboard secondary repair link only if repo-backed and not primary | repair-only | operator/support | Existing `bootstrapOwner` action is a repair path | yes | none |
| Current user has duplicate membership | Environment Repair Diagnostics page | Environment Dashboard secondary repair link only if repo-backed and not primary | repair-only | operator/support | Existing `mergeDuplicateMemberships` action is a repair path | yes | none |
| No repair issue is active | Environment Repair Diagnostics no-action state | Secondary read-only Support Diagnostics modal from the repair page | repair-only, no-action | operator/support | The page should not pretend to check all health, but it can hand off to support context | yes | none |
| Provider connection blocked | Provider Connections / provider readiness destination | Support Diagnostics modal can show related context | deferred / provider-owned | operator/support | Provider readiness is not membership repair diagnostics | no | Provider/Permission Diagnostic Productization if fresh gap exists |
| Required permissions missing | Required Permissions / provider readiness destination | Support Diagnostics modal can show related context | deferred / provider-owned | operator/support | Permission remediation belongs to provider/permissions surfaces | no | Provider/Permission Diagnostic Productization if fresh gap exists |
| Evidence snapshot not reachable | Evidence Snapshot / Stored Report / Review Pack surfaces | Support Diagnostics modal can show availability context if repo-backed | deferred / evidence-owned | operator/auditor/support | Evidence is proof, not repair diagnostics | no | Evidence browser fixture or evidence productization follow-up |
| System-level operation issue | `/system` platform surfaces | OperationRun detail where applicable | deferred / system-owned | platform_admin/support | System auth/reachability is not environment repair scope | no | System panel browser fixture/auth follow-up |
| Customer asks for review evidence | Customer Review Workspace / Review Pack | Evidence or Stored Report detail | customer/auditor-owned | customer/operator/auditor | Customer-safe review consumption is not support diagnostics | no | Customer review/evidence productization specs |
| OperationRun failed or blocked | OperationRun detail / Operations hub | Support Diagnostics modal from run detail when available | diagnostics-secondary | operator/support | OperationRun detail owns execution truth | no runtime change expected | OperationRun follow-up only if link/action regression appears |
| Billing or entitlement diagnostics | Commercial entitlement surfaces | Support diagnostics only as redacted support context when existing | deferred / commercial-owned | operator/support | Not an environment repair concern | no | Commercial lifecycle follow-up |

## Entrypoint Class Definitions

- `official-entrypoint`: the product-preferred starting path for the diagnostic need.
- `secondary-entrypoint`: allowed but not the main path.
- `deeplink-only`: route can be used from targeted context but is not broadly promoted.
- `repair-only`: surface handles concrete repairable membership/access problems only.
- `support-only`: surface provides redacted operator/support context, not customer-default content.
- `deferred`: explicitly outside Spec 374 implementation.

## Implementation Rule

If a need maps to `deferred`, the implementation may mention or link only when existing repo truth already provides a safe destination. It must not implement the deferred diagnostic domain inside Spec 374.

## Implementation Outcome

- Dashboard: `Open support diagnostics` remains the only dashboard diagnostic action in the More group.
- Repair page: `/admin/workspaces/{workspace}/environments/{environment}/diagnostics` now renders as `Repair diagnostics` and exposes one secondary read-only `Open support diagnostics` modal action.
- Helper: `ManagedEnvironmentLinks::diagnosticsUrl()` is documented as a retained deeplink utility; no dashboard runtime caller was added.
- Browser proof: no-action repair state and the repair-page Support Diagnostics modal were reachable; repair/blocker browser state was not created because the existing smoke fixture does not safely create duplicate membership or missing-owner states.