# Template Module Boundary

`govoplan-templates` owns reusable render definitions and immutable render
evidence. Callers own data selection, approval, delivery, and lifecycle state.

## Owned Concepts

- scoped template definitions and immutable revisions;
- template type, usage, locale, required-field contracts, output profiles, and
  page/media hints;
- safe HTML/text bodies and deterministic token substitution;
- draft preview and published final rendering;
- template, input, renderer, and output hashes plus item/page counts and
  diagnostics; and
- bounded fallback payloads when no artifact store is available.

The implemented printable types are `label`, `label_sheet`, `envelope`,
`serial_letter`, `form_letter`, and `list_layout`. `email` and `generic` use the
same contract while preserving their explicit usage.

## Consumer Boundary

Templates never imports Addresses, Distribution Lists, Campaign, Files, Mail,
Reporting, Forms, or Workflow internals. Consumers discover
`templates.catalog` and `templates.renderer` through Core and submit plain
provider-neutral DTOs. The supplied `input_snapshot` records a stable source
reference; Templates does not fetch or silently refresh that source.

Files optionally implements `files.artifact_store`. A final render can request
managed persistence through that contract. If Files is absent, incompatible,
or unauthorized, the result carries a warning and remains available through a
5 MiB actor-scoped Templates download. Managed output is not duplicated in the
Templates payload column.

## Safety And Determinism

- backend sanitization removes scripts, styles, active embeds, unsafe links,
  event handlers, and undeclared attributes;
- substituted values are HTML escaped;
- output is limited to 5,000 items and 5 MiB;
- final output requires a published revision and idempotency key;
- reusing an idempotency key with changed input is rejected;
- every render pins the immutable definition hash and canonical input hash;
- final artifacts contain hashes and references, not credentials or plaintext
  secrets in provenance; and
- browser/OS printing from deterministic HTML is the baseline. PDF conversion
  and managed printer delivery belong to future connector adapters.

## Recovery

Template definitions, revisions, render evidence, and bounded output are in the
shared database and therefore follow platform backup and restore. Managed Files
artifacts follow Files recovery. Bounded render payloads and history are visible
only to their creator or a Templates administrator; consumers provide a
resource-governed proxy when collaborators need access. Retiring the module is
destructive only after the installer captures a database snapshot; consumers
retain pinned hashes and must diagnose the now-unavailable provider.