Sync Repo-README from project files

Repo-README.-.md

@@ -1,4 +1,4 @@
-<!-- codex-wiki-sync:cc2e08eb786357d2379952ea -->
+<!-- codex-wiki-sync:46707c15909610b1fa7967c0 -->
 
 > Mirrored from `/mnt/DATA/git/govoplan-portal/README.md`.
 > Origin: `repository`.
@@ -11,7 +11,7 @@
 **Repository type:** module (domain).
 <!-- govoplan-repository-type:end -->
 
-Portal owns service discovery, presentation, and channel entry. Its headless
+Portal owns service discovery, presentation, and channel entry. Its
 `portal.service_directory` capability projects provider-owned, versioned
 service definitions into available, explainably unavailable, or undiscoverable
 entries. It does not persist the institutional service promise or import Cases,
@@ -23,4 +23,17 @@ filtering remains authoritative and Portal adds only presentation-oriented
 availability checks for publication, effective time, audience, module, and
 capability requirements.
 
+The tenant-scoped `/api/v1/portal/services` endpoint and `/portal` WebUI expose
+the projection. Audience visibility is derived from trusted principal and
+active function-assignment state on the server.
+
+`POST /api/v1/portal/services/{service_id}/launch` re-fetches and re-evaluates
+the exact Service revision before any effect. URL entries return a validated
+redirect. Case, form, and workflow bindings delegate through the optional
+`cases.service_launcher`, `forms_runtime.service_launcher`, and
+`workflow_engine.service_launcher` contracts; each is tenant-bound and
+replay-safe. A missing owner launcher makes the entry explainably unavailable.
+Form launch resolves an exact published `<form-id>/<revision>` and returns the
+owner's Form-instance route rather than persisting values in Portal.
+
 See [docs/SERVICE_DIRECTORY_CONCEPT.md](docs/SERVICE_DIRECTORY_CONCEPT.md).