Changeset 0.28.3.2 (#189)

docs/ROADMAP.md

@@ -25,7 +25,7 @@ v0.9.x–v0.27.5  Foundation → Extensions → Surfaces → Auth     ✅
                 v0.28.0 Platform Polish
                   ├─ v0.28.1  Surfaces ICD audit        ✅
                   ├─ v0.28.2  ICD audit — all domains   ✅
-                  ├─ v0.28.3  ICD close-out + FE decomp prep
+                  ├─ v0.28.3  ICD close-out + FE decomp   ✅
                   ├─ v0.28.4  Security tier (red team)
                   ├─ v0.28.5  Infrastructure
                   │   (virtual scroll, KB auto-inject,
@@ -179,8 +179,14 @@ decomposition groundwork.
 - [x] Phase 3: Action registry (`sb.js`) — 248 `window.*` exports replaced with
       `sb.register()`/`sb.ns()`. `sb.resolve()` centralized dispatch.
       `sb.call()` template bridge ready for Go template migration.
-- [ ] Phase 3b: Go template onclick → `sb.call()` migration (~50 handlers)
-- [ ] Phase 4: ES module conversion (remove IIFE wrappers, add import/export)
+- [x] Phase 3b: Go template onclick → `sb.call()` migration (72 handlers
+      across 10 templates, 4 unconvertible inline DOM ops, 3 standalone
+      pages excluded)
+- [x] Phase 4: ES module conversion — IIFE wrappers removed from all 47
+      files, `<script type="module">` across all templates. `sb.js` +
+      vendor stay classic. CI test harness fixed (sb.js in VM context).
+- [ ] Phase 5 (future): `import`/`export` statements, remove `window[name]`
+      dual-write from `sb.register()`/`sb.ns()`
 
 ### v0.28.4 — Security Tier (ICD Runner Red Team)
 New `security` tier in ICD test runner. Multi-user fixtures already exist.