Add governed tabular and LDAP address sources

docs/ADDRESS_MODULE_ARCHITECTURE.md

@@ -176,6 +176,37 @@ module retirement audits all remaining owned credential material before table
 removal. An unowned legacy reference is detached rather than passed to an
 external secret provider.
 
+LDAP and Active Directory use the same source, plan, diagnostic, tombstone, and
+provider-health records. Endpoints must use LDAPS or StartTLS and may reference
+only a visible reusable credential envelope; bind secrets are never copied into
+source metadata. Root-DSE discovery returns candidate base DNs. A configured
+source performs bounded paged searches and maps explicit attributes to contact
+fields. Stable source keys plus `modifyTimestamp`, `uSNChanged`, `entryCSN`, or
+a deterministic attribute digest make refreshes idempotent. Only a complete
+successful search can infer deletion. A timeout, bind failure, malformed entry,
+duplicate key, or configured entry limit retains existing contacts and reports
+the source as failed/stale instead of creating tombstones.
+
+## Static Tabular Imports
+
+CSV and XLSX use versioned, scoped mapping profiles rather than live sync
+sources. Profiles retain delimiter, encoding, header or worksheet selection,
+stable source-key mapping, field mappings, locale and tags, row limits, and
+explicit duplicate, blank-value, and existing-contact policies. Updating a
+profile creates an immutable next version; prior import runs continue to point
+at the reviewed version.
+
+Preview decodes at most 10 MB and 10,000 rows, validates every referenced
+column and source key, and returns an effect or diagnostic for every data row.
+XLSX parsing is read-only; formulas are rejected and macros/legacy workbook
+formats are not accepted. The input SHA-256 and deterministic plan hash are
+stored with full effects. Apply uses exactly that plan, rejects changed target
+contacts, and is idempotent. Created IDs and pre-update snapshots provide a
+guarded rollback: rollback proceeds only while each imported contact still
+matches its recorded post-apply hash. Arbitrary transforms remain Dataflow's
+responsibility; Files and Datasources are optional origins, not prerequisites
+for direct upload.
+
 ## Quality, Deduplication, And Recovery
 
 Quality is evidence about a concrete contact point, separate from communication
@@ -208,15 +239,15 @@ Implement connectors in this order:
 
 1. vCard import/export and batch import.
 2. CardDAV address books.
-3. [LDAP/Active Directory read-only directories](https://git.add-ideas.de/GovOPlaN/govoplan-addresses/issues/15)
-   and [reusable CSV/XLSX mapping profiles](https://git.add-ideas.de/GovOPlaN/govoplan-addresses/issues/19).
+3. LDAP/Active Directory read-only directories and reusable CSV/XLSX mapping
+   profiles (implemented).
 4. [Microsoft Graph for Microsoft 365](https://git.add-ideas.de/GovOPlaN/govoplan-addresses/issues/16),
    [explicit on-premises Exchange profiles](https://git.add-ideas.de/GovOPlaN/govoplan-addresses/issues/17),
    and [Google People](https://git.add-ideas.de/GovOPlaN/govoplan-addresses/issues/18).
 5. [LDIF import](https://git.add-ideas.de/GovOPlaN/govoplan-addresses/issues/20)
    and [selective/large-batch vCard workflows](https://git.add-ideas.de/GovOPlaN/govoplan-addresses/issues/21).
 
-The live connectors use the existing sync-source model. LDAP starts read-only;
+The live connectors use the existing sync-source model. LDAP is read-only;
 Microsoft Graph and Google start with read-only/import and gate two-way mode on
 conditional-write and outcome-reconciliation tests. On-premises Exchange first
 probes and records an explicit supported server/API profile. CSV/XLSX, LDIF,