Changeset 0.28.3.1 (#188)

docs/ROADMAP.md

@@ -174,9 +174,13 @@ decomposition groundwork.
       `api.js` — uses `API.accessToken` instead
 - [ ] ICD runner gains test tiers: `crud`, `envelope`, `security`, `sdk`
 - [ ] Runner coverage target: 100% of ICD-documented endpoints have at least one test
-- [ ] Phase 2: onclick → addEventListener migration (143 dynamic + ~50 template handlers)
-- [ ] Phase 3: ES module conversion
-- [ ] Phase 4: Template handler shim
+- [x] Phase 2: onclick → addEventListener migration (143 dynamic → 5 unconvertible,
+      163 data-action delegated via `_uiDispatch` on document.body)
+- [x] Phase 3: Action registry (`sb.js`) — 248 `window.*` exports replaced with
+      `sb.register()`/`sb.ns()`. `sb.resolve()` centralized dispatch.
+      `sb.call()` template bridge ready for Go template migration.
+- [ ] Phase 3b: Go template onclick → `sb.call()` migration (~50 handlers)
+- [ ] Phase 4: ES module conversion (remove IIFE wrappers, add import/export)
 
 ### v0.28.4 — Security Tier (ICD Runner Red Team)
 New `security` tier in ICD test runner. Multi-user fixtures already exist.