feat(security): explain Campaign child evidence

docs/ACCESS_EXPLANATION_COVERAGE.md

@@ -10,19 +10,45 @@ and they must identify that inheritance explicitly.
 - Campaign version
 - Campaign delivery job / built message
 - Computed Campaign report, identified by Campaign, version, and report kind
+- Recipient row, identified by `<version UUID>:<job UUID>`
+- Frozen recipient source snapshot, identified by its Campaign-version UUID
+- Campaign attachment binding and version-bound frozen attachment resolution
+- Persisted validation issue, version-bound review decision, and attachment-policy override
+- SMTP, IMAP append, Postbox, and printable-output attempts
+- Message action, message-action attempt, and job reconciliation decision
 
-## Planned Slices
+All persisted child IDs are random UUIDs. Embedded build/review children use a
+version UUID plus a random job UUID, so callers cannot enumerate a recipient
+index or infer an address. A version mismatch is reported as a stale reference.
+Missing and cross-tenant children use the same non-disclosing not-found
+provenance. Explanations never include recipient addresses, source rows,
+filenames, object locators, transport responses, worker claims, target
+snapshots, diagnostic text, or reconciliation notes.
 
-1. Recipient rows and imported recipient-source snapshots
-2. Attachment bindings and frozen attachment resolutions
-3. Validation issues, review decisions, and attachment-policy overrides
-4. Delivery attempts, IMAP append attempts, Postbox attempts, and
-   reconciliation decisions
-5. Campaign shares and ownership-transfer records
-6. Import mapping profiles and import executions
-7. Reusable Campaign templates and template revisions when the template
+## Permission matrix
+
+| Evidence | Parent boundary | Further restriction |
+| --- | --- | --- |
+| Recipient row or source snapshot | Campaign read/owner/share | `campaigns:recipient:read` |
+| Attachment binding/resolution, validation, review, override | Campaign read/owner/share | Campaign review and `campaigns:diagnostic:read` |
+| Delivery status | Campaign read/owner/share | `campaigns:report:read` |
+| Transport or worker diagnostics | Campaign read/owner/share | `campaigns:diagnostic:read` |
+| Exported delivery evidence | Campaign read/owner/share | `campaigns:report:export` |
+| Reconciliation decision | Campaign read/owner/share | Campaign reconcile and diagnostic read |
+
+Postbox, Mail/IMAP, and printable attempts keep bounded Campaign-owned evidence
+after provider acceptance. Their explanation therefore remains available when
+an optional provider module is later disabled. A missing attempt reports only
+the optional owner and `unavailable_or_hidden`; it does not distinguish absence
+from hidden data.
+
+## Remaining owner boundaries
+
+1. Campaign shares and ownership-transfer records
+2. Import mapping profiles and import executions
+3. Reusable Campaign templates and template revisions when the template
    library becomes persistent
-8. Export packages and protocol/report artifacts
+4. Export packages and protocol/report artifacts
 
 Each child explanation must include: