Complete governed campaign lifecycle actions

docs/CAMPAIGN_HANDBOOK.md

@@ -96,6 +96,18 @@ Important distinctions:
 - **Archive** preserves evidence. Draft-only campaigns without built, locked,
   or delivery evidence may be deleted where policy allows; evidence-bearing
   campaigns are archived instead.
+- **Copy campaign** creates a new campaign and one fresh editable version from
+  the selected source version. It copies configuration, but never delivery
+  jobs, outcomes, shares, locks, or audit evidence.
+- **Archive historical version** hides only a non-current version from the
+  default history. It does not change the version's workflow state or remove
+  configuration, reports, delivery results, or audit evidence.
+
+Campaign lifecycle confirmations are bound to the state shown in the UI. If a
+job, version, share, or campaign state changes before confirmation, the server
+rejects the stale action and requires a reload. The lifecycle-policy response
+states the applicable built-in rule and the reason for every unavailable
+action.
 
 ## User tasks
 
@@ -221,6 +233,8 @@ At a minimum:
    Only the latter becomes explicitly retryable, and neither decision resends
    the already SMTP-accepted message.
 8. Archive only after active and uncertain effects are resolved.
+9. Use **Delete draft** only for an untouched draft. If retained evidence or an
+   active share exists, revoke the share where appropriate or archive instead.
 
 Pause stops new eligible work but cannot undo a provider effect already in
 progress. Cancel marks work that has not yet produced a protected SMTP outcome;
@@ -283,6 +297,8 @@ as an executable Mail configuration:
 
 - public responses remove legacy transport fields and secrets;
 - validation, build, queue, retry, and delivery fail closed;
+- computed previews that require a current Campaign configuration return an
+  actionable validation problem instead of a server error;
 - an editable version changes to profile-only form only through an explicit
   Mail-settings save; and
 - a locked version is preserved and must be forked to an editable successor.
@@ -538,6 +554,18 @@ lock exists. Evidence-bearing campaigns are archived. Destructive module
 retirement remains a separately confirmed installer operation with backup and
 retirement evidence.
 
+The Campaign **Audit** page is currently an explained handoff, not a second
+audit store: Campaign emits bounded platform audit records and authorized
+readers inspect them in Administration > Tenant audit. A future object-scoped
+projection may improve that navigation without duplicating Audit ownership.
+Evidence-bundle export and offline verification remain owned by Audit #3.
+
+The advanced **JSON** page displays and downloads the complete campaign
+configuration available to the current campaign reader. It contains no inline
+transport secrets, but recipient, message, and attachment fields may contain
+personal data. The UI therefore identifies it as sensitive expert output;
+campaign access and export purpose remain the governing controls.
+
 ## Reference-composition acceptance
 
 Campaign is ready to serve as the demonstration module only when all of the