docs: reconcile roadmap with shipped v1.2 Workflows track

The blueprint, CLAUDE.md, and the groups design doc still described the
Workflows track as "not-yet-started" and listed a per-app `materialized`
column as deferred — both stale. Workflows shipped M1–M6 (DAG execution +
conditional `when`, nested sub-workflows, durable orchestrator,
`workflow::start` SDK + admin API + `pic workflows`, dashboard DAG +
run-history; migrations 0071/0072), and D1's `materialized` column shipped.

Update the status lines to mark Workflows shipped (leaving §9.4 service
interceptors as the one remaining Workflows-track item and cluster mode as
next), bump the "migrations through 0070" note to 0072, and drop the stale
`materialized`-deferred line. Docs-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/design/groups-and-project-tool.md

@@ -8,7 +8,8 @@
 > scripts/modules + extension points, nested tree apply, §4.5 trigger/route templates, §11.6 shared
 > collections, §7 multi-repo ownership, §3 M3 (now server-authoritative) approval gate, §6 group
 > create/reparent — plus the Track A closeout and the 2026-07-11 audit remediation. **v1.2 Hierarchies
-> is complete;** only multi-node cluster propagation and the separate Workflows track remain. NB: §11's
+> is complete;** the separate Workflows track has since **shipped** (M1–M6), leaving only multi-node
+> cluster propagation and §9.4 service interceptors. NB: §11's
 > own Phase 1–6 numbering is local to this initiative and is **distinct from the
 > blueprint product-phase numbering** — "Phase 3" here = group-inherited config, not the blueprint's
 > admin-auth phase.
@@ -416,9 +417,9 @@ Two distinct constraints:
 > reseal, no new schema column). All descendant email webhooks validate against the one group HMAC secret;
 > each copy has its own `trigger_id` / inbound URL. A group email template whose group secret is unset
 > fails apply hard (same as the app path). Pinned by `tests/stateful_templates.rs` + the
-> `stateful_templates` journey. **Deferred:** a per-app `materialized` column in `pic triggers ls --app`;
-> cross-owner dedup (a descendant re-declaring an identical trigger double-fires — "overlapping triggers
-> coexist"); the per-app (non-shared) email secret model.
+> `stateful_templates` journey. (The per-app `materialized` column in `pic triggers ls --app` shipped as
+> D1.) **Deferred:** cross-owner dedup (a descendant re-declaring an identical trigger double-fires —
+> "overlapping triggers coexist"); the per-app (non-shared) email secret model.
 >
 > **Shipped — group ROUTE templates (live, inherited).** The same live model, adapted to routes. A
 > `[group]` declares a `[[routes]]` template binding a group-owned endpoint; `routes` gained a

serverless_cloud_blueprint.md

@@ -1,6 +1,6 @@
 # Project Blueprint: Lightweight Event-Based Serverless Cloud
 
-**Status**: v1.1 shipped (SDK + services) · v1.2 *Hierarchies* track **complete**; v1.2 *Workflows* track + v1.3 cluster mode are next  
+**Status**: v1.1 shipped (SDK + services) · v1.2 *Hierarchies* track **complete** · v1.2 *Workflows* track **shipped** (M1–M6: DAG execution, conditional branching, nested sub-workflows, `workflow::start` SDK, dashboard DAG + run-history); §9.4 service interceptors + v1.3 cluster mode are next  
 **Last Updated**: 2026-07-12 (reconciled to shipped code — CLAUDE.md is the live source of truth)  
 **Audience**: Solo developer (DIY self-hosted)
 
@@ -171,7 +171,8 @@ rhai_executor --script $SCRIPT_PATH --request "$REQUEST_JSON"
 
 ### 3.4 PostgreSQL Database
 **Schema (MVP sketch — NOT authoritative):** the block below is the original MVP shape. The **authoritative
-schema is the migration set** in `crates/manager-core/migrations/` (through `0070` as of v1.2), which has
+schema is the migration set** in `crates/manager-core/migrations/` (through `0072` as of v1.2, incl. the
+Workflows tables), which has
 since added apps/domains, RBAC (`admin_users`/`app_members`/`api_keys`), the v1.1 data-plane services
 (KV/docs/files/queues/…), and the v1.2 groups/collections/templates/projects tables. Treat this as
 illustration only.
@@ -1271,9 +1272,9 @@ Released in patch steps (v1.1.0 → v1.1.8), each landing one focused capability
 ### Phase 5: v1.2 (Advanced Workflows & Hierarchies)
 
 Two tracks under the same minor line. The **Hierarchies** track is **complete** (all §11 Phases 1–6
-shipped, plus the Track A closeout + the 2026-07-11 audit remediation); the **Workflows** track is the
-remaining, not-yet-started half (sequencing was an open call — see the design doc's §11 re-sequencing
-note).
+shipped, plus the Track A closeout + the 2026-07-11 audit remediation); the **Workflows** track is now
+**shipped** too (M1–M6 — see the list below), leaving only §9.4 service interceptors as the remaining
+Workflows-adjacent work.
 
 **Hierarchies — groups + the declarative project tool** (the detailed design and 6-phase breakdown
 live in [docs/design/groups-and-project-tool.md](../docs/design/groups-and-project-tool.md) §11; this
@@ -1299,12 +1300,12 @@ absorbs the original one-line "Hierarchies" bullet into a full initiative):
 - **Only remaining in this track:** multi-node cluster propagation (route-table + broadcast snapshot),
   which lives in the Phase 6 / v1.3+ scaling work below.
 
-**Workflows:**
-- Function workflows (DAG execution, conditional branching, error handling)
-- Nested workflows
-- Call graph visualization + execution tracing
-- Advanced query support for document store (`docs.query()` with filters: `$gt`, `$or`, etc.)
-- Service interceptors (see section 9.4)
+**Workflows** (shipped M1–M6 unless noted; migrations `0071_workflows.sql`, `0072_execution_source_workflow.sql`):
+- Function workflows (DAG execution, conditional `when` branching, error handling) — **shipped**
+- Nested workflows (`start_child`, parent-park, depth ceiling) — **shipped**
+- Call graph visualization + execution tracing — dashboard DAG view + run-history **shipped**
+- Advanced query support for document store (`docs.query()` with filters: `$gt`, `$or`, etc.) — **shipped** (`docs_filter` DSL)
+- Service interceptors (see section 9.4) — **remaining** (the only unshipped Workflows-track item)
 
 ---