# Voting Interface Pattern Migration

This migration applies the GovOPlaN interface pattern language to Voting's
catalogue, ballot editor, casting, result, and governance-transition surfaces.
It preserves the strict distinction between recorded and provider-backed
assurance profiles.

## Surface Inventory

| Surface | Archetype | Consequence class | Contract |
| --- | --- | --- | --- |
| `/voting` catalogue | Governed work queue | Select, create, or manage ballot | Shared loading/empty/error/help and explicit management permission state |
| Ballot editor | Consequential definition editor | Save mutable draft | Guarded draft, contextual assurance/electorate help, validation reasons |
| Recorded cast panel | Guided decision | Record or replace authorized vote | Frozen eligibility, explicit selection, confirmation, privacy-bounded receipt |
| Result and assurance | Evidence/provenance | Inspect tally and hashes | Result visibility follows assurance profile and backend authorization |
| Open/close/certify/challenge/annul | Governed lifecycle | Freeze, tally, certify, challenge, or annul | Permission/lifecycle reasons, confirmations, required reasons, retained evidence |

## Consequence And Availability Rules

- Opening freezes options, electorate, weights, threshold, replacement rule,
  assurance profile, and provider binding.
- Recorded ballots are reconstructable and are not secret. Provider-backed
  privacy claims never exceed the installed provider contract.
- Closing stops casting and records a tally; certification adds evidence.
  Challenge and annulment append reasoned events and erase nothing.
- Missing permission or electorate membership identifies the required action,
  responsible actor, and destination.
- Electorate matching and new-ballot defaults use the canonical authenticated
  principal account ID, falling back to the shell user's account ID when the
  richer principal context has not loaded yet.
- Optional Committee, Decision, Encryption, Forms, Trust, Policy, Reporting,
  and Workflow integrations remain behind declared contracts.

The module uses shared controls, dialogs, confirmations, blockers, field help,
statuses, alerts, loading/empty states, disabled reasons, and unsaved-draft
guards. English and German catalogues cover the owned interaction vocabulary;
history timestamps follow the selected platform locale.