Synchronize public module directory publication

docs/PACKAGE_REGISTRY_RELEASES.md

@@ -186,6 +186,15 @@ the current workspace. Each entry binds its Python wheel and optional WebUI
 tarball to the registry URL, filename, size, SHA-256, package identity, source
 tag, and source commit before the complete catalog is signed.
 
+The same publication transaction regenerates and prunes the browsable static
+directory under `public/catalogs/v1/modules/`. It writes a global
+`modules/index.json`, one `<module>/index.json`, and one
+`<module>/<version>/manifest.json` for every entry in the signed channel.
+These files are derived from that exact signed payload and keyring; stale JSON
+from an older partial catalog is removed while unrelated static assets are left
+untouched. The signed channel remains the trust anchor, while the module
+directory provides stable discovery URLs for browsers and external tooling.
+
 Official GovOPlaN modules are open-source directory entries and do not require
 license entitlements. The generic `license_features` contract remains available
 for third-party package directories, support/configuration packages, or future
@@ -201,6 +210,13 @@ cache. A saved plan is rejected if any package ref, artifact identity, catalog
 channel, sequence, or signing-key identity differs from the currently validated
 catalog.
 
+The Admin directory can be searched by module, package, repository, or tag and
+filtered by available, installed, update, and blocked/withdrawn states. It
+shows the source revision, artifact digest, release notes, and configuration
+requirements. Missing dependency/interface providers and unsupported update
+windows are surfaced before an operator adds the entry to a plan; installer
+preflight remains authoritative.
+
 Package lifecycle and availability are intentionally separate:
 
 - install, update, and uninstall change the instance-wide package composition;