Migrate Postbox interface patterns

docs/INTERFACE_PATTERN_MIGRATION.md

@@ -0,0 +1,54 @@
+# Postbox Interface Pattern Migration
+
+This document records the bounded migration of Postbox-owned WebUI surfaces to
+the GovOPlaN interface pattern language. Core owns shared controls and host
+shells. Postbox owns function-bound addresses, messages, receipts, delivery
+evidence, personal inbox projections, and reusable address templates.
+
+## Surface Inventory
+
+| Surface | Archetype | Consequence class | Contract |
+| --- | --- | --- | --- |
+| `/postbox` directory | Directory and hierarchy-context selector | Change query projection | Shared selection list, explicit assignment blocker, contextual help, guarded reload |
+| `/postbox` messages | Searchable work queue | Read, acknowledge, reply, or author | Shared filters/pagination/status/alerts, explained unavailable actions, privacy-safe retained states |
+| Message detail and composer | Record detail and consequential editor | Deliver institutional message | Source/function provenance, classification boundary, guarded draft, stable field help |
+| Unified-view dialog | Personal configuration editor | Change or delete query projection | Shared dialog/toggle/confirmation; deletion never changes source messages or evidence |
+| `postbox.admin.templates` | Versioned definition library | Publish or retire immutable template revision | Shared admin layout, durable consequence explanations, guarded editor, contextual help |
+| Materialized Postbox administration | Repeated administration | Create or archive durable address | Organization/function selector, prerequisite blocker, destructive confirmation, retained-evidence explanation |
+| `postbox.widget.inbox` | Dashboard summary | Navigate to unread work | Shared widget loading/error/list contract and localized accessible attachment metadata |
+
+## Consequence And Availability Rules
+
+- A Postbox address belongs to an organization function, not to an account.
+  Current effective IDM assignments determine access without changing the
+  durable message or address record.
+- Publishing freezes an immutable template revision. Retiring a template stops
+  future revision and materialization work but leaves existing addresses
+  intact.
+- Archiving an address stops new delivery while preserving messages, receipts,
+  access events, and delivery evidence.
+- Unified inbox views are personal projections. Deleting one does not move or
+  delete source Postboxes, messages, acknowledgements, or evidence.
+- Hierarchy copies are separate, bounded deliveries. Vacancy escalation is a
+  separately scheduled and auditable route, not an implicit personal grant.
+- Withdrawal and expiry prevent future content access while retaining only the
+  metadata the current actor may inspect. Already exported or printed plaintext
+  cannot be retracted.
+- Disabled actions state whether the blocker is loading, another operation, a
+  missing permission, a missing assignment, an unavailable message, or a
+  lifecycle constraint.
+
+## State And Accessibility Evidence
+
+The module uses Core admin/page shells, selection lists, pagination, dialogs,
+confirmations, alerts, status badges, action blockers, contextual field help,
+disabled reasons, and unsaved-change guards. Shared dialogs retain keyboard
+focus and return behavior. Existing responsive workspace CSS keeps directory,
+message list, and detail regions bounded and independently scrollable.
+
+English and German catalogues cover module metadata, accessible attributes,
+workspaces, dialogs, fields, lifecycle states, and dashboard output. Dates use
+the selected platform locale. Manifest topics publish stable route, surface,
+field, blocker, privacy, and consequence references. Focused backend and WebUI
+tests pin these contracts without importing optional sibling modules.
+