govoplan/docs/INTERFACE_SURFACE_INVENTORY.md

GovOPlaN Interface Surface Inventory And Rollout

This is the initial evidence inventory for the product-wide interface pattern language. It records code contributions, not an assertion that every listed surface is complete, enabled in a deployment, usable, or compliant.

The applicable design contract is INTERFACE_PATTERN_LANGUAGE.md.

Snapshot And Method

The source-derived inventory command is documented in PLATFORM_CONTROL_PLANE.md. It produces machine-readable field, label, translation, route, API-reference, and module manifest evidence. This hand-maintained document remains the reviewed product interpretation and rollout ledger; generated evidence does not replace it.

Snapshot refreshed: 2026-08-03.

The generated snapshot contains 65 module manifests, 35 WebUI-contributing repositories, 40 statically declared module routes, 1,156 UI fields, and 836 backend endpoints. All backend endpoints are classified and no stale endpoint declarations were found. The 234 endpoints without a static WebUI reference are kept visible as review evidence; they may intentionally serve workers, public clients, connectors, or external integrations.

Evidence was read from tracked Git HEAD in the local GovOPlaN checkouts:

• core routes and fallback behavior in govoplan-core/webui/src/App.tsx
• every present govoplan-*/webui/src/module.ts
• the matching backend src/*/backend/manifest.py
• named UI capabilities and contribution identifiers in each module.ts
• Campaign nested routes in its tracked CampaignWorkspace.tsx and SectionSidebar.tsx

Tracked commits are used as the integrated baseline. Dirty worktree changes are not treated as delivered behavior. The former Campaign recipient-editor and preview WIP is integrated in tracked commits; completed work is no longer described as a local exception.

Runtime visibility remains conditional on the module being packaged and enabled, server metadata, installed optional capabilities, the authenticated actor, tenant context, route permission guards, and inner-surface permission checks. A route in this inventory therefore means "the code contributes this route when its module is active", not "every user sees it".

Inventory states:

• Contributed: a route or named UI capability exists in tracked source.
• Metadata gap: frontend runtime source contributes a route but the backend manifest does not describe the same route/navigation surface.
• Unreviewed: the surface has not yet completed the pattern, state, accessibility, privacy, and consequence audit. This is the default unless an issue supplies verification evidence.
• Pilot: the surface is in the Campaign-first rollout.

Core Shell Surfaces

Surface	Owner and code evidence	Audience/access evidence	Primary task and target archetype	Audit / rollout
Public landing and login	govoplan-core PublicLandingPage; rendered while no authenticated principal exists	Unauthenticated; maintenance and backend-reachability context are shell inputs	Understand the service and authenticate; public entry	Unreviewed; later public-entry audit
Session/bootstrap state	govoplan-core App.tsx and AppShell	All browser sessions during bootstrap	Understand that session/platform state is loading; state contract	Unreviewed; core shell
/ authenticated redirect	govoplan-core chooses the first visible navigation destination	Authenticated; result depends on visible nav contributions	Enter the actor's first accessible service area; navigation behavior, not a content page	Unreviewed; focused-view/default-route work must preserve this fallback
/dashboard fallback	govoplan-core DashboardPage only when the Dashboard module is absent	Authenticated; no route-specific scope in core	Cross-module starting point; dashboard	Unreviewed; compare with module dashboard before shared changes
/settings	govoplan-core SettingsPage	Authenticated; contributed sections and integrations filter internally	Profile, UI/workspace preference, local connection, and user-scoped integration settings; configuration	Unreviewed; Core #225 program
Shell chrome	AppShell, Titlebar, IconRail, BreadcrumbBar, HelpMenu, language menu, unsaved-change provider	Public/authenticated variants; nav filtered later	Tenant/actor context, global navigation, help, language, session and maintenance state	Unreviewed; platform-owned prerequisite for focused views

Direct Module Route Contributions

The access column summarizes only the route-level declaration in module.ts. Inner APIs and controls may impose additional checks. Public and compatibility routes are called out explicitly because they do not have the same manifest semantics as authenticated navigation routes.

Routes	Owner	Route-level access	Primary archetype	Migration issue
/admin	Access	Any declared administration/read scope	Administration/configuration host	Access #19, Core #225
/address-book	Addresses	addresses:contact:read	Directory/list-detail	Addresses #23
/approvals	Approvals	approvals:workspace:read	Work queue/guided decision	Approvals #3
/calendar	Calendar	calendar:event:read	Calendar/list-detail	Calendar #22
/campaigns, /campaigns/:campaignId/*, /campaigns/queue, /campaigns/reports, /templates	Campaign	Campaign read/report/control scopes; template route has no route guard	List-detail, guided review, monitoring, reporting	Campaign #74
/operator	Campaign	Campaign read plus queue/control scope	Compatibility redirect to /campaigns/queue	Campaign #74; retire under the compatibility policy
/cases, /cases/:caseId	Cases	cases:case:read	List-detail/case workspace	Cases #4
/committee	Committee	committee:workspace:read	Governed workspace	Committee #2
/dashboard	Dashboard	No route-specific scope	Dashboard	Dashboard #3
/dataflow	Dataflow	Pipeline read/admin	Graph editor/execution evidence	Dataflow #20
/datasources	Datasources	Catalogue read/source admin	Directory/configuration	Datasources #7
/distribution-lists	Distribution Lists	List read/write/admin	Directory/list-detail	Distribution Lists #8
/docs	Docs	Documentation or settings read	Documentation/reference	Docs #15
/files	Files	files:file:read	Directory/explorer	Files pattern migration complete in Files #42, commit d8ae506
/forms	Forms	forms:definition:read	Definition library/editor	Forms #4
/forms-runtime, /forms-runtime/:instanceId	Forms Runtime	Participate or workspace read	Guided form execution	Forms Runtime #5
/idm	IDM	Assignment, function-change, relationship, or organization scopes	Directory/governed change	IDM #12
/mail, /mail/bounces	Mail	Mailbox or bounce read/manage	Inbox/list-detail/monitoring	Mail #20
/notifications	Notifications	notifications:notification:read	Inbox/list-detail	Notifications #4
/ops	Ops	Operations or settings read	Monitoring/evidence	Ops #4
/organizations	Organizations	Model/unit/function or settings read	Directory/hierarchy editor	Organizations #7
/portal	Portal	portal:service:read	Service portal	Portal #2
/postbox	Postbox	postbox:postbox:read	Inbox/list-detail	Postbox #26
/projects	Projects	projects:project:read	List-detail/project workspace	Projects #2
/reporting, /reports	Reporting	reporting:definition:read	Reporting/definition library	Reporting #8
/risk-compliance	Risk Compliance	Workspace or sanctions read	Governed work queue/evidence	Risk Compliance #8
/scheduling	Scheduling	scheduling:schedule:read	List-detail/guided decision	Scheduling #8
/scheduling/public/:requestId/:token	Scheduling	Public signed token	Public participation	Scheduling #8
/search	Search	search:result:read	Search overlay/results	Search #4
/templates	Templates	Template read/write/publish/render/admin	Definition library/editor	Templates #5
/voting	Voting	voting:ballot:read	Governed ballot workspace	Voting #1
/workflow	Workflow	Definition read or instance admin	Graph editor/execution evidence	Workflow #15

Manifest And Runtime Route Alignment

Backend route metadata lets operators, Docs, release tooling, and remote bundle loading reason about the configured interface without executing module UI code. module.ts remains the executable local route/render source. Missing metadata is recorded here as an evidence gap; this inventory does not infer whether each gap is intentional.

The generated comparison is aligned for all authenticated canonical routes. Two deliberate exceptions remain visible:

• Campaign contributes /operator as a compatibility redirect for saved View projections; its canonical and manifest-declared destination is /campaigns/queue.
• Scheduling contributes /scheduling/public/:requestId/:token through the separate publicRoutes contract. Authenticated manifest routes intentionally do not describe public signed-token entry points yet.

Admin, Audit, Policy, Tenancy, and Views contribute composed administration or settings surfaces rather than direct routes. Their migration issues are Admin #8, Audit #8, Policy #11, Tenancy #6, and Views #2.

Release evidence must continue to run the generated inventory and manifest shape checks so new executable routes, public routes, aliases, and composed surfaces cannot silently diverge from their declared metadata.

Composed Surfaces And Extension Points

These surfaces are active only when the host and contributing modules are enabled and the actor passes the declared filters.

Host surface	Contributor and evidence	Contributed regions/actions	Pattern implication	Audit
/admin	Access host (AdminPage)	System tenants/users/roles, tenant users/groups/roles/API keys/settings, function-role mappings, user/group mail and file connector scopes	One stable admin information architecture must contain both host-owned and contributed sections	Unreviewed; P1 Core #225
/admin	govoplan-admin admin.sections	Overview; system settings; configuration changes; configuration packages; role/group templates; module management	Configuration, guided operations, review/preflight, consequence	In progress under Core #225; surface-level evidence still needed
/admin	govoplan-audit admin.sections	System audit; tenant audit	Evidence/provenance and reporting	Unreviewed
/admin	govoplan-files admin.sections and files.connectors	System and tenant file connections plus scoped connector managers used by Access	Adaptive configuration, discovery/test, policy and credentials	Pattern migration, contextual help, blocker explanations and focused evidence complete in Files #42 (d8ae506)
/admin	govoplan-organizations admin.sections	Tenant organization settings	Configuration/list-detail	Unreviewed
/admin	govoplan-policy admin.sections	System, tenant, group, and user retention	Effective value, source/provenance, consequential configuration	Unreviewed; Core #225 phase 4
/admin and /settings	govoplan-mail mail.profiles	System/tenant/group/user mail profile and policy managers	Same server/credential/policy grammar as file connectors	Unreviewed; Core #225 mail migration
/settings	Core host	Profile; interface; workspace; local connection	Personal configuration with adaptive forms and immediate feedback	Unreviewed
/settings	Files and Mail named capabilities	User-scoped file connections and mail profiles/policy	Optional integration regions disappear cleanly when capability absent	Unreviewed
/settings	govoplan-notifications settings.sections	Notification preferences	Personal configuration	Unreviewed
/dashboard	Dashboard host and dashboard.widgets	Installed-modules widget; Ops health widget when Ops contributes it	Widget ordering, staleness, permissions, destination behavior	Unreviewed
/organizations	IDM organizations.functionActions	Action leading to assignment view filtered by IDM scopes	Cross-module context action through explicit capability	Unreviewed
Campaign attachments/import	Files files.fileExplorer	Folder tree, managed chooser, file listing/pattern resolution/sharing	Optional domain composition without sibling-private imports	Pilot audit under Campaign #74
Campaign review/send	Mail runtime mail.devMailbox	Mock-mail verification when backend advertises runtime capability	Optional review stage with unavailable/optional states	Explicit intervention and review-progress vocabulary delivered in Campaign #63; send modes/progress delivered in #62/#79

Other named capability exports (files.connectors, organizations.functionPicker, and mail profile validation) are contracts consumed inside the composed surfaces above; they are not independent routes.

Files Surface Map

Files #42 classifies and verifies the complete Files-owned route and composition boundary. The durable module-level inventory is govoplan-files/docs/INTERFACE_PATTERN_MIGRATION.md.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Completion evidence
/files (FilesPage)	Browse spaces/folders and repeatedly act on current content	Full-height directory/explorer	Navigation is low consequence; upload, synchronize, move, copy and share are medium; delete is high	Stable two-pane composition, contextual help, selection/permission/state-specific disabled reasons, shared confirmation and responsive collapse
Upload/archive, transfer, rename and connector-import dialogs	Supply, validate and review one bounded change	Adaptive create/edit or guided import	Writes managed content and may resolve conflicts or import untrusted bytes	Shared dialogs/drop zone, bounded archive preflight, conflict review, explicit confirmation and no browser-native confirmation
Share/access explanation	Inspect or change who can use a resource	Review/decision	Grants can disclose content; delete/revoke changes access	Shared access explanation, action components and destructive confirmation; backend redaction remains authoritative
File connector tree and connection/credential dialogs	Compare and configure external endpoints and reusable credentials	Administration plus adaptive create/edit	Endpoint, secret and capability changes can enable remote access	Shared connection tree/forms/advanced panel, endpoint discovery and login test, unsaved-change guard, read-only deployment provenance and actionable disabled reasons
Connector policy card	Narrow effective connector use	Effective-policy editor	Inherited deny/allow rules affect lower scopes	Typed selectors, deny-precedence warning, effective sources, contextual admin help and permission blocker
files.widget.spaces	See available spaces and enter Files	Dashboard widget	Space/provider names remain permission-filtered	Shared loading, alert and status components; bounded configuration and refresh
files.fileExplorer capability	Select a governed managed snapshot for another module	Directory chooser	Exact file/version becomes another module's governed input	Capability-only composition, no sibling-private import, stable chooser/confirmation and exact snapshot evidence

Automated evidence for commit d8ae506 comprises 104 Files backend tests, three focused Files WebUI structure tests, the full-product TypeScript/Vite build, structural localization audit, theme contract and bundle budget. Shared Dialog and disabled-tooltip behavior provide focus entry/return and keyboard-reachable explanations; responsive source order is guarded at 1050 px and 760 px. Secrets are not returned to the WebUI, and JSON remains only an advanced provider-compatibility escape hatch rather than the primary editor.

Campaign Pilot Surface Map

Campaign is detailed first because it exercises almost every archetype. The recipient-data editor is now consolidated into the recipients section on remote main; Campaign #67 records the accepted and verified integration boundary.

Campaign already consumes core primitives including ModuleSubnav, Card, PageTitle, Button, LoadingFrame, DismissibleAlert, FormField, StatusBadge, MetricCard, DataGrid, TableActionGroup, Dialog, ConfirmDialog, FileDropZone, MessageDisplayPanel, policy components, access/module capabilities, and unsaved-navigation guards. Reuse alone does not prove that the composition or states satisfy the pattern.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Known issue / rollout
Campaign list (CampaignListPage)	Find, compare, create, open	List-detail entry	Campaign lifecycle/status and creation	Audit in #74; guided entry #35
Overview (CampaignOverviewPage)	Understand/edit campaign identity, version, access, lifecycle	Object overview plus adaptive edit	Lock/archive/delete/access changes need real consequence and reversibility wording	#74 remaining audit
Fields (CampaignFieldsPage)	Define recipient/template field schema	Structured editor	Schema changes can invalidate recipient/template data	#74 audit
Attachments/files (AttachmentsDataPage, AttachmentRulesOverlay)	Select sources and attachment/ZIP rules	Directory chooser plus adaptive rule editor	Missing or mismatched files affect built messages	#74; attachment-detail #59
Recipients (RecipientDataPage)	Select/import/map/edit recipients, address fields and per-recipient values/files	Import/mapping plus list-detail editor	Personal data, validation, bulk activation, file links	Consolidated editor delivered in #67; #74 remaining audit and guided entry #35
Template (TemplateDataPage, placeholder/expression dialogs)	Author subject/body and preview substitutions	Adaptive editor plus stable preview	Generated communication content and unresolved expressions	#74; stable overlay #73
Mail settings (MailSettingsPage settings view)	Select/configure campaign mail transport	Adaptive configuration	Credentials, SMTP/IMAP destinations, test outcomes	#74; align with Core #225 mail pattern
Campaign settings (GlobalSettingsPage settings view)	Configure campaign behavior	Adaptive configuration	Can alter validation/build/send behavior	#74 audit
Mail policy (MailSettingsPage policy view)	Inspect/override effective mail policy	Effective policy/provenance editor	Inheritance and locks affect allowed delivery	#74; Core #225 policy pattern
Campaign policy (GlobalSettingsPage policy view)	Inspect/override campaign policy	Effective policy/provenance editor	Inheritance, actor authority, and blocked edits	#74; Core #225 policy pattern
Review/send (ReviewSendPage)	Validate, build, mock-test, confirm/send, inspect results	Guided review/decision plus durable progress	External communication, bounded synchronous execution, persisted queue mode, partial effects, retries, evidence	Blocking/non-blocking interventions and reviewed/remaining evidence delivered in #63; bounded synchronous and explicit/persisted queued modes delivered in #62 and #79; #74 audit remains
Message and attachment detail overlays	Inspect one built/mock message and its attachment links	Stable detail/review dialog	Personal data, exact outbound content, reviewed state	Delivered and verified in #59 and #73
Campaign report (CampaignReportPage)	Filter and inspect delivery outcomes	Reporting/list-detail	Partial, failed, explicitly excluded/skipped, SMTP/IMAP outcomes and retries	Server-owned filtering and counts delivered in #65 with the full-result DataGrid contract from Core #263; excluded semantics in #66
Audit (CampaignAuditPage)	Inspect campaign evidence/history	Provenance timeline/report	Actor/action/effect trace	#74 audit
JSON (CampaignJsonView)	Inspect expert representation	Advanced diagnostics/reference	Raw data may contain personal/configuration values; not a primary editor	#74 privacy/redaction audit
Create wizard (CreateWizard)	Seed a campaign through basics, sender, fields, recipients, template, attachments, review, send	Guided setup	Current steps mix creation and later consequential delivery; completion semantics need audit	Guided first campaign #35
Review/send wizard routes	Alternate guided review/send shells	Guided review	Tracked routes exist; implementation relationship to ReviewSendPage must be established, not guessed	#74 inventory decision
Operator queue (OperatorQueuePage)	Monitor jobs and intervene	Monitoring/work queue	Campaign/version/job identity, historical active-version discovery, fixed action positions, authority-aware disabled states, exact non-overlapping queue counts, server-paged jobs, bounded refresh, retry/queue/reconcile per version, campaign-wide pause/resume/cancel, and leave/return progress	Durable operator controls delivered in #78; #74 wording/accessibility audit remains
Aggregate reports (AggregateReportsPage)	Compare cross-campaign delivery outcomes	Privacy-preserving aggregate reporting	Tenant/campaign ACL, deployment/tenant small-cell policy, complementary and overlapping-cell suppression, explicit denominator, and no recipient detail/diagnostics/export/drill-down	Separate aggregate-reader surface delivered in #80; not parity with the permission-gated per-campaign detail report
Templates route (TemplatesPage)	Browse template records	Directory/list-detail	Template availability and later generated outputs	#74 audit; verify missing route guard intent

The five review stages currently named in code are Validate and inspect, Build and review, Mock send and verify, Confirm and send, and Delivery results. Campaign #63 owns the intervention and status vocabulary; Workflow is not required to define or implement it.

Repositories Without A WebUI Package

The generated manifest snapshot reports no WebUI package for:

govoplan-assets, govoplan-booking, govoplan-certificates, govoplan-connectors, govoplan-consultation, govoplan-contracts, govoplan-decisions, govoplan-encryption, govoplan-evaluation, govoplan-facilities, govoplan-grants, govoplan-helpdesk, govoplan-identity, govoplan-identity-trust, govoplan-inspections, govoplan-learning, govoplan-mandates, govoplan-parties, govoplan-permits, govoplan-poll, govoplan-procurement, govoplan-records, govoplan-resources, govoplan-rest, govoplan-services, govoplan-soap, govoplan-tickets, govoplan-transparency, govoplan-wiki, and govoplan-workflow-engine.

Tenancy does provide composed administration surfaces despite having no direct route. This section is only negative package evidence; connector-only, capability-only, runtime-only, and backend-only modules may intentionally remain headless. A new WebUI should be created only for a concrete user task, not to make every module symmetrical.

Rollout Matrix

Order	Scope	Current evidence	Target	Owner / issue	Verification gate	Status
0	Product grammar and route inventory	Doctrine, ledger, layout rules, module contract, current route sources	One reconciled pattern language and evidence inventory	Meta #11	Docs links/diff checks; issue/wiki sync after integration	Initial slice in this document
1	Campaign baseline integration	Recipient-editor WIP and tracker state have been reconciled with remote main	Integrated, testable baseline before migration claims	Campaign #67 and tracker cleanup	Backend and focused WebUI suites; issue evidence	Complete 2026-07-22
2	Campaign previews/details	Stable shared dialog with bounded scrolling and fixed responsive preview workspace	Stable header/body/footer, accessible long-content detail	Campaign #59 and #73	Review-preview and overlay structure tests	Complete 2026-07-22
3	Campaign review/interventions	Five domain-owned stages use central blocker and guided-review primitives; validation/build warnings name action, actor, and destination; hard blockers, individual review, and group review remain distinct; reviewed/remaining counts survive reload through build-bound review evidence	Clear stages, outcomes, blockers, next actor/action, reviewed evidence	Campaign #63	reviewProgress state tests, shared-component structure contract, TypeScript build, configured-system help topic, and Campaign documentation tests	Complete 2026-08-03 (d635f3a; Core primitives and contextual help b823a22)
4	Campaign send/progress	A hard deployment ceiling bounds synchronous delivery; the selected synchronous, worker-queue, or database-queue mode is explicit and persisted; progress and recovery survive navigation; immediate-send response and audit evidence are allowlisted	Pre-send mode/consequence plus durable leave/return progress, retry and reconciliation without recipient/provider leakage	Campaign #62 and #79	Boundary/concurrency/preflight, async selection, persisted mode, sanitized response/audit, partial/failure/retry and reload/return tests	Complete 2026-07-22 (7e16603, 60efd1c, 62a6879, b0282eb, f095a3e)
5	Campaign report filtering	Core DataGrid distinguishes client/full-result from server-owned queries; Campaign applies filter/sort/count before pagination and synchronizes count shortcuts with the grid query	One shared server-owned status/list/filter/count model	Campaign #65 and Core #263	DataGrid contract/build tests plus exact shortcut/query/filter/count and large-result behavior	Complete 2026-07-22 (e6062fe, cece71d, aa4ec66, 4eb651c)
6	Campaign operator recovery	A durable campaign/version queue page exposes historical work, exact non-overlapping state counts, persisted mode, permission-safe controls, server-paged job evidence, bounded refresh and active-state recovery	Fixed-position actions, disabled explanations, leave/return state, version-scoped retry/queue/reconcile and explicit campaign-wide pause/resume/cancel	Campaign #78	Queue model/structure, historical-version, permission, paging, recovery-control, stale-response and delta tests	Complete 2026-07-22 (21f3014, 99d44ee, 735e874)
7	Campaign aggregate reports	A separate aggregate-reader projection and UI expose only policy-suppressed business totals with a stable status domain	Explicit denominator and exclusions, deployment floor plus tenant-strengthened small-cell threshold, complementary and overlapping-cell suppression, no detail/export/diagnostics	Campaign #80	Aggregate query, cross-metric suppression, route/role/ACL, stable filter and UI structure tests	Complete 2026-07-22 (06125cc, fc36aee, 8ee87b7, ac3329c, 1225802)
8	Campaign excluded outcomes	Excluded build rows become explicit skipped transport outcomes and remain protected from queue/cancel/retry ambiguity	One durable source-to-job-to-report meaning with guarded historical normalization	Campaign #66	Builder/persistence, migration, query/count, queue-control and report-explanation tests	Complete 2026-07-22 (7229fb8)
9	Guided first campaign	Existing wizard routes and ordinary workspace overlap	Task-oriented entry that hands off clearly to normal editing/review	Campaign #35	First-run flow, resume/back, validation, optional modules, no implicit send	P1 after core pilot patterns stabilize
10	Prove/extract generic primitives	Core already exports many primitives; Campaign composition still unreviewed	Extract only contracts with a second consumer or clear platform ownership	Core #225 plus bounded follow-ups	Core behavior/accessibility tests and module-permutation tests	After Campaign proof
11	Configured-system pattern help	Role/config-aware workflow, reference, pattern, and system topics are projected by Docs; shared route, field, blocker, and action links resolve to configured Docs or the hosted fallback	Stable configured-system guidance without feature-to-Docs imports	Docs #15	Docs suite, shared component tests, Campaign review tests, 46 module permutations, full-product bundle budget	Complete 2026-08-03 (Docs abe2f78; Core b823a22; Campaign d635f3a)
12	Admin/configuration family	Shared primitives and module-lifecycle workflow are integrated; Files route/connectors/policy are migrated with module-owned inventory and focused evidence	Apply the same layered server/credential/policy grammar to Mail, then policy, retention, packages, API keys and settings	Core #225, Files #42, Mail #20 and module children	Per-surface state/accessibility/consequence evidence	Files complete 2026-08-03 (d8ae506); Mail is next
13	Remaining module surfaces	33 bounded module-owned issues now cover every WebUI contributor not already tracked by Campaign #74 or completed Docs #15	Per-module audit and migration, ordered by user task and consequence rather than a bulk rewrite	Issues linked in the direct-route and composed-surface sections	Module-focused tests, manifest shapes, contextual Docs, and applicable definition-of-done gates	Ready; Scheduling and admin/configuration are the first implementation slices
14	Manifest/runtime alignment	Several executable routes are absent from manifest metadata	Declared alignment or explicit validated exception	Core contract issue to create	Automated manifest/module route check and configured Docs verification	Discovery follow-up

Workflow remains outside this rollout matrix because it has its own runtime and editor workstream, not because it is postponed. Focused views can be specified, manually selected, and tested through core composition contracts today. Workflow steps may activate those views through the same contract without changing the proven surface patterns.

Inventory Maintenance

When a route, nav item, named UI capability, host section, or Campaign workspace surface changes:

1. Update the owner, evidence, task, archetype, and consequence here.
2. Link the implementation issue and verification evidence.
3. Keep "unreviewed" until state, permission/privacy, consequence/provenance, accessibility, responsive, theme, i18n, and applicable async behavior have been checked.
4. Re-scan both module.ts and the backend manifest; do not infer one from the other.
5. Recreate the inventory from a clean release lockfile before using it as release evidence.