Complete governed reporting execution and publication

docs/REPORTING_BOUNDARY.md

@@ -83,6 +83,10 @@ Reporting does not own:
   outcomes.
 - `reporting.chart_renderer` renders provider-neutral visual models with an
   accessible table fallback.
+- `reporting.publication.files` adapts immutable results to Core's
+  `files.artifact_store` boundary without importing Files internals.
+- `reporting.publication.mail` adapts report notices to Core's
+  `mail.notificationDelivery` boundary without importing Mail internals.
 - `reporting.read_model:*` capabilities can expose bounded source-owned rows.
 - `reporting.publication_target:*` capabilities can accept immutable result
   payloads without Reporting importing the target module.
@@ -125,14 +129,22 @@ row-policy provenance, blocking quality plans, definition hashes, executor
 version, output hash, diagnostics, and authorized rows are retained with the
 execution. Failed runs also retain evidence.
 
-The query engine deliberately implements a typed expression and semantic
+The query layer deliberately implements a typed expression and semantic
 query language rather than `eval`, arbitrary SQL, stored procedures, or
-runtime scripts. It supports detail, grouped summary, pivot, dimensions,
+runtime scripts. PostgreSQL installations receive parameterized semantic plans
+for filters, grouping, measures, calculated aggregates, sorting, and bounds;
+other engines and pivots use the equivalent bounded runtime evaluator. It
+supports detail, grouped summary, pivot, dimensions,
 hierarchies, common aggregates, calculated measures, filters, sorting,
 pagination, totals, and a provider-neutral visualization model. A saved chart
 that is incompatible with an ad-hoc query degrades to its mandatory table
 fallback instead of failing a valid report run.
 
+Aggregate drill-through uses an expiring actor-bound context hash. Resolution
+rechecks all definition and row-policy decisions, verifies the source
+fingerprints against the original execution, preserves the complete dimension
+path, and returns only authorized contributors.
+
 Direct export supports UTF-8 CSV and JSON. CSV cells that spreadsheet software
 could interpret as formulas are escaped. Additional formats and delivery
 destinations use an optional publication capability and preserve idempotent
@@ -142,7 +154,10 @@ unsupported executable behavior remains.
 
 The WebUI uses the platform module loader and common controls. It exposes a
 report catalogue, parameter and semantic-query controls, result visualization
-and table views, history/provenance, saved views, schedules, and downloads.
+and table views, accessible bar/column/line/area/pie/donut/metric charts,
+drill-through, access explanations, history/provenance, saved views, schedule
+management, Files/Mail publication management, downloads, and a Dashboard
+widget contribution.
 The global `/reports` route is owned only by Reporting. `/reporting` is a
 documented compatibility path. Campaign's module-local aggregate view remains
 at `/campaigns/reports`; when both modules are enabled, the same safe aggregate
@@ -151,7 +166,8 @@ contract.
 
 ## Remaining Product Depth
 
-The architecture boundary is implemented. Further work is additive product
-depth: richer visualization providers, drill-through navigation, packaged
-domain report catalogues, XLSX/PDF formatting through optional providers, and
-target-environment evidence for a maturity claim above `vertical_slice`.
+The architecture boundary and first operational vertical are implemented.
+Further work is additive product depth: packaged domain report catalogues,
+XLSX/PDF formatting through optional renderer providers, selector-backed Mail
+profile configuration, external publication connectors, and target-environment
+evidence for a maturity claim above `vertical_slice`.