feat(campaign): explain governed child access

docs/ACCESS_EXPLANATION_COVERAGE.md

@@ -16,6 +16,11 @@ and they must identify that inheritance explicitly.
 - Persisted validation issue, version-bound review decision, and attachment-policy override
 - SMTP, IMAP append, Postbox, and printable-output attempts
 - Message action, message-action attempt, and job reconciliation decision
+- Campaign share and Core-owned Campaign ownership-transfer record
+- Independently user-owned recipient import mapping profile
+- Saved recipient import execution, identified by `<version UUID>:<import UUID>`
+- Persisted validation, build, execution-snapshot, and review evidence, identified
+  by `<version UUID>:<artifact kind>`
 
 All persisted child IDs are random UUIDs. Embedded build/review children use a
 version UUID plus a random job UUID, so callers cannot enumerate a recipient
@@ -35,6 +40,10 @@ snapshots, diagnostic text, or reconciliation notes.
 | Transport or worker diagnostics | Campaign read/owner/share | `campaigns:diagnostic:read` |
 | Exported delivery evidence | Campaign read/owner/share | `campaigns:report:export` |
 | Reconciliation decision | Campaign read/owner/share | Campaign reconcile and diagnostic read |
+| Share or ownership transfer | Campaign governance | Campaign share, transfer-participant, group-acceptance, or recovery authority; content access remains a separate decision |
+| Import mapping profile | Independent user owner | `campaigns:recipient:import`; no Campaign share is inherited |
+| Import execution | Campaign read/owner/share | Recipient read and import authority |
+| Persisted protocol artifact | Campaign read/owner/share | Recipient, review, report, diagnostic, or export authority appropriate to the artifact |
 
 Postbox, Mail/IMAP, and printable attempts keep bounded Campaign-owned evidence
 after provider acceptance. Their explanation therefore remains available when
@@ -42,13 +51,19 @@ an optional provider module is later disabled. A missing attempt reports only
 the optional owner and `unavailable_or_hidden`; it does not distinguish absence
 from hidden data.
 
-## Remaining owner boundaries
+## Optional and unsupported owner boundaries
 
-1. Campaign shares and ownership-transfer records
-2. Import mapping profiles and import executions
-3. Reusable Campaign templates and template revisions when the template
-   library becomes persistent
-4. Export packages and protocol/report artifacts
+Reusable templates and template revisions are independently governed by the
+optional Templates module; Campaign never treats a Campaign share as a template
+grant. Durable export packages are independently governed by the optional
+Reporting module. Asking the Campaign provider to explain either class therefore
+fails closed with `independently_governed_by_optional_module` and
+`unavailable_or_hidden`. The response does not reveal whether the optional
+module is absent, the object does not exist, or the caller cannot see it.
+
+Campaign reports generated on demand remain non-persisted, version-bound
+resources. Their explanation names the report kind and its Campaign/version
+parent, and keeps report read, export, and diagnostic permissions distinct.
 
 Each child explanation must include:
 
@@ -64,3 +79,9 @@ Delivery attempts, review decisions, reports, and exports can contain more
 sensitive evidence than the Campaign summary. Their read and diagnostic/export
 permissions therefore remain independently enforceable even when the parent
 Campaign is readable.
+
+Import explanations include only the stable import identity, source type,
+opaque source identity, source revision, and whether additional provenance was
+recorded. They never return imported rows, filenames, column mappings, or source
+metadata. Mapping-profile explanations expose only non-reversible header
+fingerprints and shape information; headers and mappings remain hidden.