diff --git a/docs/plans/inbound-quarantine.md b/docs/plans/inbound-quarantine.md
index 50d4177..d97315a 100644
--- a/docs/plans/inbound-quarantine.md
+++ b/docs/plans/inbound-quarantine.md
@@ -22,6 +22,15 @@ so we can compare approaches before committing.
reference to them) under `/data`, retention, release workflow, and a wider
attack/backup surface — closer to "mini-mailbox" than pure relay.
+## Mockup
+
+A target look is drawn — list and detail —
+[in-quarantine](../assets/panel-redesign/panel/in-quarantine.html),
+[in-quarantine-message](../assets/panel-redesign/panel/in-quarantine-message.html)
+— under the design contract of [panel-redesign.md](panel-redesign.md). It
+assumes answers to the questions below (SelfPost holds the mail, release goes
+to the upstream, 14 days, headers only in the panel); it does not settle them.
+
## Open questions (to decide before a checklist)
1. **Where mail lives**
diff --git a/docs/plans/panel-redesign.md b/docs/plans/panel-redesign.md
index a9be311..4322fa7 100644
--- a/docs/plans/panel-redesign.md
+++ b/docs/plans/panel-redesign.md
@@ -13,7 +13,7 @@ design itself is drawn and accepted:
| Artefact | Role |
|---|---|
-| [docs/assets/panel-redesign/panel/](../assets/panel-redesign/index.html) | 29 screens — **the** reference for what each page looks like |
+| [docs/assets/panel-redesign/panel/](../assets/panel-redesign/index.html) | 33 screens — **the** reference for what each page looks like |
| [panel/components.html](../assets/panel-redesign/panel/components.html) | every component in every state — the only parts a page may be built from |
| [panel/outlines.json](../assets/panel-redesign/panel/outlines.json) | the component skeleton of each screen, generated from the mockups |
| [panel/check.py](../assets/panel-redesign/panel/check.py) | the contract as a program; its rules are ported to Go tests below |
@@ -93,6 +93,8 @@ only.
| Inbound: domain (upstream, recipients), log | all domains | assigned inbound domains |
| Add / delete a domain, either direction | yes | no |
| Queues, either direction | yes | no, until the queue is a filterable table |
+| Inbound › Quarantine | all domains | assigned inbound domains |
+| Inbound › Filter lists, Server › Preflight | yes | no — the lists are instance-wide |
| Account, Help | yes | yes |
- New table `user_inbound_domains (user_id, inbound_domain_id)`, mirroring
@@ -115,6 +117,7 @@ list, an action under the thing it changes.
|---|---|---|
| overview | `GET /overview` | `/status` |
| health | `GET /server/health` · `POST …/recheck` · `POST …/reload` | tables of `/status` · `/status/recheck` · `/reload` |
+| preflight | `GET /server/preflight` · `POST …/preflight/run` · `POST …/preflight/test-email` | — (preflight; its plan says `/preflight`) |
| out-domains | `GET, POST /outbound/domains` | `/domains` |
| out-domain | `GET /outbound/domains/{id}` · `POST …/dns-recheck` | `/domains/{id}` |
| out-domain-settings | `GET /outbound/domains/{id}/settings` · `POST …/settings/reports` · `…/settings/ratelimit` · `…/settings/ratelimit/recalc` · `…/settings/export` | cards of `/domains/{id}` · `…/dmarc` · `…/ratelimit` · `…/ratelimit/recalc` · `…/export` |
@@ -127,6 +130,8 @@ list, an action under the thing it changes.
| in-domains · in-domain | `GET, POST /inbound/domains` · `GET /inbound/domains/{id}` · `POST …/dns-recheck`, `…/upstream`, `…/recipients` | `/inbound` · `/inbound/{id}/…` |
| in-domain-delete | `GET, POST /inbound/domains/{id}/delete` | `/inbound/{id}/delete` |
| in-log · in-queue | `GET /inbound/log` · `GET /inbound/queue` | — (new, see below) |
+| in-quarantine · in-quarantine-message | `GET /inbound/quarantine` · `GET …/quarantine/{id}` · `POST …/{id}/release` · `POST …/{id}/discard` | — (inbound-quarantine) |
+| in-filter-lists | `GET, POST /inbound/filter-lists` · `POST …/filter-lists/{id}/delete` | — (inbound-antispam-panel) |
| system-log | `GET /server/log` | `/system-log` |
| backup | `GET, POST /server/backup` · `POST /server/backup/import` | `/backup` · `POST /domains/import` |
| users · user · user-delete | `/server/users` · `…/new` · `…/{uid}` · `…/{uid}/delete` | `/users/…` |
@@ -174,17 +179,18 @@ shell, and its menu entry is hidden if the page does not exist.
## Room for roadmap items
-The mockups draw today's features plus the four rows above. The other open
-roadmap items are **not drawn yet**; each has a place, and none needs a new
-component or layout. A feature's screens are drawn mockup-first in this system
-(`panel/src/`, `build.py`, `check.py --write`) as the first step of that
-feature's own plan — not invented during its implementation.
+The mockups draw today's features, the four rows above, and the screens of
+the open roadmap items — none of them needed a new component or layout. A
+mockup of a feature is its target look, not a decision to build it: each item
+keeps its own status and plan. From here on a feature's screens are drawn
+mockup-first in this system (`panel/src/`, `build.py`, `check.py --write`) as
+the first step of that feature's plan — not invented during implementation.
| Roadmap item | Where it lands | Built from | Drawn |
|---|---|---|---|
-| inbound-antispam-panel (agreed, `1.10.0`) | journal = **Inbound › Log** (add client IP and engine to the mockup's columns; `quarantine` joins the decisions); lists = new **Inbound › Filter lists**, global-only because the lists are instance-wide | list layout: add form + table, `status_tag`, filter form in `box_head` | log: yes, to be adjusted · lists: **no** |
-| inbound-quarantine (candidate) | new **Inbound › Quarantine**, list + detail with *Release* / *Discard* | list layout; detail like `out-message` with `facts`, `log_pane`, a `sp-danger-zone` box for Discard | **no** |
-| preflight (candidate) | new **Server › Preflight**, next to Health: Health is what runs now, Preflight is the deeper on-demand installation check with a test e-mail form | `postmark` verdict, a table of checks with `status_tag`, `facts`, one form box | **no** |
+| inbound-antispam-panel (agreed, `1.10.0`) | journal = **Inbound › Log** (add client IP and engine to the mockup's columns; `quarantine` joins the decisions); lists = new **Inbound › Filter lists**, global-only because the lists are instance-wide | list layout: add form + two tables, `status_tag`, filter form in `box_head`; the log links *Allow / Deny sender* to the lists | `in-log`, `in-filter-lists` |
+| inbound-quarantine (candidate) | new **Inbound › Quarantine**, list + detail with *Release* / *Discard* | list layout; detail like `out-message` with `facts`, `log_pane` for headers only, Release beside a `sp-danger-zone` Discard | `in-quarantine`, `in-quarantine-message` — the open questions of its plan (where mail lives, what release means, retention, RBAC) stay open; the mockup assumes SelfPost-held mail, release to upstream, 14 days, delegated like the rest of Inbound |
+| preflight (candidate) | new **Server › Preflight**, next to Health: Health is what runs now, Preflight is the deeper on-demand installation check with a test e-mail form | `postmark` verdict, a table of checks with `status_tag` and a *What to do* column, one form box for the test e-mail | `preflight` |
| csrf-tokens | no screen; every form gains a hidden field — forms are rendered through one helper so the token cannot be forgotten | — | n/a |
| template-data-typing | no screen; the component partials are the natural first users of typed data | — | n/a |
| structured-logging, contributing, review follow-ups | none | — | n/a |
diff --git a/docs/plans/preflight.md b/docs/plans/preflight.md
index 26f9230..df7fff0 100644
--- a/docs/plans/preflight.md
+++ b/docs/plans/preflight.md
@@ -13,6 +13,12 @@ checks and helps the administrator confirm the instance is fully configured and
ready to deliver mail. Each failed check shows an actionable recommendation
(what to do or where to look).
+## Mockup
+
+[preflight](../assets/panel-redesign/panel/preflight.html), under the design
+contract of [panel-redesign.md](panel-redesign.md): **Server › Preflight**,
+path `/server/preflight` once the routes are renamed.
+
## Scope
**In:**