Consume governed recipients and add operational checks

docs/ACCESSIBILITY_REVIEW.md

@@ -0,0 +1,39 @@
+# Campaign Accessibility Review
+
+The Campaign WebUI uses Core's semantic `Button`, `Dialog`, `DataGrid`, form,
+alert, and segmented-control components. Core owns focus trapping, focus return,
+Escape handling, labels, disabled state, and keyboard behavior for those shared
+primitives.
+
+## Repeatable review matrix
+
+Run this matrix for Campaign overview, wizard, sender and recipients,
+attachments, template editing, review and send, operator queue, and reports:
+
+1. Navigate all actions with Tab and Shift+Tab; focus must remain visible and
+   follow the visual reading order.
+2. Activate buttons and links with Enter, and native buttons with Space.
+3. Open every dialog, verify initial focus remains within it, close with Escape,
+   and verify focus returns to the opener.
+4. Use DataGrid sorting, filtering, pagination, row selection, and action menus
+   without a pointer.
+5. At 200 percent browser zoom and a 320 CSS-pixel viewport, verify that content
+   reflows or scrolls without hiding actions.
+6. With reduced motion enabled, verify that workflow state does not depend on
+   animation.
+7. With a screen reader, verify page headings, field labels, validation errors,
+   workflow states, message navigation, and attachment evidence.
+
+## Automated structural guard
+
+`npm run test:accessibility-contract` rejects non-semantic click handlers,
+unlabelled icon-only buttons in the message preview, and Campaign-local modal
+implementations that bypass Core's `Dialog`. It complements rather than replaces
+browser and assistive-technology testing.
+
+## Known boundary
+
+Translation keys may be visible in source because Core resolves them at runtime.
+The review must use a built application with current language packages. WCAG
+conformance is a release-level claim and still requires a bounded manual audit
+of the release candidate.

docs/CAMPAIGN_HANDBOOK.md

@@ -135,9 +135,15 @@ just the authoring form:
 5. Confirm attachment behavior when a rule matches no files, ZIP/password
    behavior, and any recipient-specific files.
 6. Record review completion and the inspected message keys through the review
-   surface. The current baseline does not persist a distinct approve/reject
-   decision or review reason. If content, recipients, attachment inputs, owner
-   context, or non-secret transport identity changes, revalidate and rebuild.
+   surface. Validation, build, review, and exception evidence records the actor,
+   timestamp, and immutable build token/message digest where applicable. If
+   content, recipients, attachment inputs, owner context, or non-secret
+   transport identity changes, revalidate and rebuild.
+
+This evidence is the Campaign input to separation-of-duties policy. Generic
+approve/reject chains, delegation, substitutions, escalation, and signatures
+belong to the optional Approvals capability. Campaign must not claim an
+approval merely because validation, building, or message review completed.
 
 Normal readers and reviewers see business state and safe evidence. Process-local
 paths, storage keys, worker claim tokens, and raw provider diagnostics require