Migrate Tenancy interface patterns

docs/INTERFACE_PATTERN_MIGRATION.md

@@ -0,0 +1,43 @@
+# Tenancy Interface Pattern Migration
+
+This document records the bounded migration of Tenancy-owned WebUI surfaces to
+the GovOPlaN interface pattern language. Core owns the shared components and the
+Admin host; Tenancy owns the behavior and documentation described here.
+
+## Surface Inventory
+
+| Surface | Archetype | Consequence class | Contract |
+| --- | --- | --- | --- |
+| `tenancy.admin.system-tenants` | Administration directory and list-detail | Create, configure, suspend | Shared admin layout, DataGrid, stable row actions, adaptive create/edit dialog, lifecycle confirmation, contextual help |
+| Tenant details dialog | Read-only evidence/detail | None | Stable labels, effective governance provenance, retained object counts |
+| `tenancy.admin.tenant-settings` | Effective configuration | Configure | Shared admin layout, language selection, dirty-state guard, permission blocker, contextual help |
+
+## Consequence And Availability Rules
+
+- Creating a tenant establishes a new data and administration boundary and
+  provisions a protected initial owner.
+- Tenant slugs are immutable after creation.
+- System policy caps tenant governance overrides. A tenant can narrow an
+  allowance but cannot loosen a system denial.
+- Suspension retains tenant-owned records and audit evidence. The active
+  tenant cannot be suspended until the operator changes context.
+- Unavailable actions remain visible when they belong to the surface and state
+  the missing permission, inapplicable state, responsible actor, and
+  destination where applicable.
+- Dirty dialogs and settings use the shared unsaved-change guard. Consequential
+  suspension continues to use the shared destructive confirmation dialog.
+
+## State And Accessibility Evidence
+
+The panels use Core loading, error, success, empty, disabled-action, blocker,
+dialog, and status components. Row actions reserve a stable three-action area,
+retain translated accessible labels, and do not disappear for row-specific
+permission or lifecycle states. Dialog order follows identity, ownership,
+locale/status, description, and governed capabilities. Shared dialogs own focus
+containment and restoration, and the existing Admin shell provides responsive
+composition.
+
+Stable help references are contributed through the module manifest for the
+tenant registry, tenant settings, lifecycle actions, and individual fields.
+The WebUI structural test and backend documentation-contract test prevent those
+references and state explanations from silently regressing.