Counsel marks a document “Privileged” on the Record

What changed

• Legal-lexicon module — src/lib/legal-lexicon/: typed concept keys → jurisdiction-aware labels (concepts.ts), a pure legalTerm(key, { jurisdiction }) resolver (resolve.ts, default US), and the useLegalTerm(key) hook (use-legal-term.ts). A mirror of the canonical lexicon. Every legal word (“Privileged”, “Work product”, “Record”) now renders ONLY from here — never an inline string, never a next-intl locale key. V1 wires the US column; other jurisdictions are a data addition, not a refactor.
• Counsel-only privilege control — src/components/documents/detail/privilege-control.tsx, shown under the timeline in the document drawer. Visible only to firm_admin / firm_editor (matters:write); a read-only member or support session sees nothing. Marking and clearing each require an explicit confirm stating the document leaves / returns to the Record.
• Wiring to the existing endpoint — the drawer container calls the generated useAppSetMatterDocumentPrivilege mutation; a new BFF proxy (/api/internal/matters/[matterId]/documents/[docId]/privilege) + toBrowserRoute mapping keep the browser on /api/internal/*. The proxy and the server gateway (documentsGateway.setPrivilege) parse the request and response against the generated Zod contract at the trust boundary (HR-21). No contract was hand-written — the endpoint already shipped in the OpenAPI mirror, so codegen was untouched.
• List reflects the flip — on success the updated row is bubbled up to the register state (instant Privileged badge) and router.refresh() re-runs the RSC record bootstrap to reconcile with the server, which has already gated the doc out of the evidence search index and Mode-2 processing.
• Copy discipline — non-legal scaffolding is next-intl in both messages/en.json and messages/hi.json under DocumentsRegister.detail.privilege; the legal labels are interpolated in from the lexicon.

The two axes (why Privileged ≠ Confidential)

Privilege is Axis-1 (can it go out?). The W1 upload buckets are Axis-2 (whose is it?). The axes never merge. This story ships the Axis-1 keys the control needs; the rest of the lexicon is recorded for later waves.

Verification

• Storybook-first: PrivilegeControl stories cover idle · confirm · privileged · updating · read-only-hidden; the drawer stories add the integrated counsel view. Each verified in isolation, no backend.
• pnpm test — 933 green, incl. the legalTerm resolver test and the mark/clear confirm-flow test (confirm gates the call; read-only renders nothing).
• pnpm lint clean; pnpm build green with the new privilege proxy route registered.
• No color literals; no new dependencies; no hand-written contract.

Out of scope (named later, per the lexicon): Blake auto-suggestion, the Work Product workspace, redaction, and confidential / AEO.

Files changed

20 file(s), +824 / -1 lines