Read-only operator dashboard for recent inbound records, execution lineage, and routing reflection (IADM-01/02/07).
Sibling of MailglassAdmin.OperatorLive (D-48-13 — clone, not a refactor). The
screen keeps filter and selection state in URL params so refresh, back/forward
navigation, and copied links preserve the current operator context.
All inbound data access crosses a RUNTIME apply/3 edge through
MailglassAdmin.OptionalDeps.MailglassInbound (D-48-02/03). This module never
references the optional inbound modules directly, so the --no-optional-deps
compile lane stays green: when mailglass_inbound is absent the gateway module is
elided, gateway_available?/0 returns false, and every data call degrades to the
empty surface.
Tenant-required-or-empty (D-48-04): a blank/missing tenant renders the empty state
and never leaks another tenant's record id or recipient. The read-model enforces
the tenant where-clause + Tenancy.scope/2; this LiveView adds the
load_inbound_records(%{"tenant_id" => ""}) short-circuit head as defense in depth.