docs(roadmap): refine postbox and university BI paths

docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md

@@ -870,11 +870,17 @@ can be tested.
    acting context through their owned contracts.
 3. Postbox accepts one durable message and attachment references and returns a
    delivery receipt; Campaign or another sender retains only typed references.
-4. An authorized function holder or delegate discovers and handles the message.
-5. Vacancy, ambiguity, expiry, or unavailable dependencies create visible safe
-   states rather than an implicit personal fallback.
-6. Reassignment changes future access without moving or rewriting the message;
-   delivery, access, and correction evidence remains connected.
+4. The Postbox remains addressable with zero, one, or several incumbents. During
+   vacancy it retains the delivery and visibly waits for a holder rather than
+   falling back to a personal account.
+5. An authorized function holder or time-bounded delegate receives a
+   device-bound grant for the policy-selected key epochs and handles the
+   message in an explicit represented-function context.
+6. Hand-over, revocation, or delegation expiry rotates/withdraws future key
+   access without claiming to erase plaintext already obtained. Content is
+   corrected or superseded by a linked version, never silently substituted.
+7. Delivery, vacancy, assignment, key access, delegation, action, and correction
+   evidence remains connected and distinguishes multiple incumbents.
 
 ### Story J: from specialist-system context to reproducible document
 
@@ -892,17 +898,25 @@ can be tested.
 
 ### Story K: from operational sources to trusted institutional indicator
 
-1. A governed catalog declares source owner, purpose, classification, schema,
-   extraction mode, reporting-date semantics, freshness, and credentials.
+1. A governed catalog declares read-only HIS and CampusOnline source owners,
+   purpose, classification, schema, extraction mode, freshness, and credentials
+   for the internal student-statistics subject area.
 2. An ingestion run stages a snapshot or watermark and records schema drift,
    validation findings, quarantine, and replay evidence.
-3. Versioned transformations map official keys, organizational hierarchies,
-   time dimensions, and measures into a documented analytical data product.
-4. Reporting serves policy-aware aggregates and permitted drill-down with the
-   calculation and lineage visible.
-5. Scheduled outputs, APIs, templates, or open-data handoffs use the same
+3. The product records reference date separately from extraction, acceptance,
+   and freeze dates: for example, a `1 September` state accepted on
+   `12 December` becomes the pinned semester snapshot. Corrections supersede it
+   visibly rather than rewriting it.
+4. In a graphical typed data-flow editor, versioned source, validation, mapping,
+   transformation, aggregation, and data-product nodes map official keys,
+   organizational hierarchies, time dimensions, and measures. The graph is
+   acyclic, previewable, testable, and carries lineage and pinned versions.
+5. Reporting serves the internal student-statistics product with policy-aware
+   aggregates and permitted drill-down. A list report can become a governed
+   source for a downstream template-backed publishable report.
+6. Scheduled outputs, APIs, templates, or open-data handoffs use the same
    product version rather than reimplementing the calculation.
-6. Package promotion reproduces the accepted report in development, test, and
+7. Package promotion reproduces the accepted reports in development, test, and
    production; corrections create new evidence rather than rewriting history.
 
 ### Story L: from generated artifact to approved collaborative record
@@ -1216,16 +1230,19 @@ user-story implementation remains paused.
    examples as the first pinned reference product.
 2. **Function-bound Postbox.** Implement Postbox and the
    Organizations–Identity–IDM–Access responsibility path; add Campaign delivery
-   to a function in an organizational unit and prove reassignment, delegation,
-   vacancy, retention, and audit behavior.
+   to a function in an organizational unit and prove vacancy, multiple
+   incumbents, reassignment, time-bounded delegation, key-epoch access,
+   retention, and audit behavior without personal ownership fallback.
 3. **Templates, Reports, and deep launch.** Build one data-backed document and
    one report through curated source contracts; open the task safely from a
    mock and then target HIS-style producer; preserve reproducible input,
    definition, output, and return-reference evidence.
-4. **Governed university BI path.** Starting from that concrete source, add one
-   scheduled staging, quality, transformation, semantic-product, lineage, and
-   policy-aware reporting path. Package it for repeatable promotion between
-   development, test, and production before generalizing dataflow.
+4. **Governed university BI path.** Start with read-only HIS/CampusOnline data
+   and an internal student-statistics product. Add scheduled staging, explicit
+   reference/freeze states, quality, a graphical typed transformation and
+   aggregation flow, semantic-product lineage, list-report chaining, and a
+   template-backed publishable report. Package it for repeatable promotion
+   before generalizing dataflow.
 5. **Collaborative document lifecycle.** Add DMS versions, review/approval,
    provider-neutral editing sessions, one collaborative editor, conflict and
    recovery behavior, and Records handoff over Files-backed content.
@@ -1252,15 +1269,16 @@ them; they do not block the product vision today.
   system, and which conflict/failure behavior is acceptable?
 - Which default participant privacy profiles should ship for scheduling,
   consultation, committee, and public participation?
-- What assurance, signature, federation, and E2EE levels are required for the
-   first trusted postbox deployment?
-- Which external IDM source and conflict, disable, delegation, and vacancy
-  policy should prove delivery to organizational responsibility?
+- Which history window, device assurance, organizational recovery/quorum,
+  rotation strength, signature, and federation profile is required for the
+  first trusted E2EE Postbox deployment?
+- Which external IDM source and conflict/disable policy should prove function
+  assignment and time-bounded delegation for organizational responsibility?
 - Which HIS or other specialist system should be the first deep-launch
   producer, and which callback/reference behavior can it support?
-- Which bounded university dataset, reporting date semantics, official keys,
-  accepted calculation, privacy profile, and drill-down level should define the
-  first analytical data product?
+- Which exact HIS/CampusOnline interfaces, student-statistics fields and
+  official keys, accepted calculation, freeze/correction policy, privacy
+  profile, and drill-down level should define the first analytical data product?
 - After the first source-to-report proof, do repeated source/dataflow contracts
   justify separate `govoplan-datasources` and `govoplan-dataflow` modules?
 - Which collaborative editor should be the first target, and should its first