[Tasks Validation]
      ↓
[AC Lock Checkpoint]  ← THIS SKILL
      ↓
Per-Task: implementation

✋ AC Lock Checkpoint — Confirm Before Implementation

This feature will be considered DONE when all of the following are true:

**Functional**
1. [ ] Personal trainer can see all linked students in /cms/students
2. [ ] Student appears in trainer's list after successful Firestore connection
3. [ ] trainerId is persisted on student document in Firestore

**Technical**
4. [ ] POST /api/students saves trainerId field from auth context
5. [ ] GET /api/students filters by authenticated trainer's uid
6. [ ] Firestore security rules allow trainer to read their students only

**Quality**
7. [ ] All new use cases have unit tests
8. [ ] No breaking changes to existing /api/students consumers

---

Does this accurately capture what you want?

  yes           → Lock these ACs and start implementation
  adjust N      → Edit AC number N (e.g., "adjust 3")
  add           → Add a missing AC
  remove N      → Remove AC number N
  show-sources  → Show which document each AC came from

Current AC-3: "trainerId is persisted on student document in Firestore"
New AC-3: [user input]

Enter new AC (describe what must be true when the feature is done):
[user input]

Category: functional / technical / quality?

Removing AC-5: "GET /api/students filters by authenticated trainer's uid"
Are you sure? This requirement won't be tracked. (yes/no)

AC-1 → prd.md: Goals section
AC-4 → techspec.md: Validation & Testing Plan
AC-7 → tasks.md: Task 6 - "Done When" criteria

## Accepted Criteria — Locked

Feature: {slug}
Locked: {timestamp}
Locked by: user confirmation

> ⚠️ This file is immutable during implementation.
> Do not edit after locking.

### Functional
- [ ] AC-1: Personal trainer can see all linked students in /cms/students
- [ ] AC-2: Student appears in trainer's list after successful Firestore connection
- [ ] AC-3: trainerId is persisted on student document in Firestore

### Technical
- [ ] AC-4: POST /api/students saves trainerId field from auth context
- [ ] AC-5: GET /api/students filters by authenticated trainer's uid
- [ ] AC-6: Firestore security rules allow trainer to read their students only

### Quality
- [ ] AC-7: All new use cases have unit tests
- [ ] AC-8: No breaking changes to existing /api/students consumers

### Sources
| AC | Source |
|----|--------|
| AC-1 | prd.md: Goals |
| AC-4 | techspec.md: Validation & Testing Plan |
| AC-7 | tasks.md: Task 6 |

## Definition of Done

**Covered by this PR:**
- [x] AC-1: Personal trainer can see all linked students in /cms/students
- [x] AC-2: Student appears in trainer's list after Firestore connection
- [x] AC-4: POST /api/students saves trainerId field

**Known gaps (not covered):**
- [ ] AC-7: Unit tests — partial (3 of 5 use cases tested)

> Full AC list: .claude/feature-state/{slug}/accepted-criteria.md

⚠️ AC Lock bypassed — implementation will proceed without locked ACs.
   PR will not include a "Definition of Done" section.
   Type "skip-ac-lock" to confirm.