@mhome/app-facade-protocol 1.93.0 → 1.109.2

package/README.md

@@ -121,6 +121,16 @@ Room uses one `/app/room/list` read. Every Room has `roomId`, `roomName`,
 `index`, `deviceCount`, and `deviceIds`; full and essential keep all five fields.
 Membership IDs include Device groups without expanding their members or state.
 
+Room writes use `/app/room/create`, `/rename`, `/delete`, `/reorder`,
+`/devices/move`, and `/devices/remove` under the same `/app/room` prefix.
+Reorder accepts every current Room ID exactly once in the desired order.
+Moves require a destination for each unique member ID; removal explicitly unassigns
+members. Repeating a move or removal is a successful no-op. Deleting a Room
+unassigns its members without deleting Devices or Device groups. Only deletion
+supports the prepared confirmation flow; other writes execute directly.
+Room write inputs use their declared fields and JSON string IDs/names; legacy fields
+and numeric or boolean IDs/names are rejected rather than silently converted.
+
 Targets without a dedicated projection retain their business fields in YAML;
 essential does not promise a smaller field set for every domain. Targets own that selection.
 
@@ -249,7 +259,7 @@ Space-bound `nodeId`, `version`, and Plugin-owned `payload`. The former
 contains only the generic transport contract. Binding/offline observations come from
 `/app/plugin/enabled/list`, independently of the runtime's status.
 
-UI Integration metadata uses `/app/integration/presentation/get`; see
+UI Integration metadata uses `/app/presentation/integration/get`; see
 [the presentation contract](contract/integration-presentation-v1.md).
 
 ## Artifact delivery
@@ -268,3 +278,5 @@ still applies. Local file download remains a client workflow over ordinary resol
 
 Agent Profile Markdown image ownership and canonical read-back are specified in
 [Agent Profile media](contract/agent-profile-media-v1.md).
+
+NFC management: [contract](contract/nfc-v1.md), [schema](schema/nfc.v1.schema.json).

package/contract/automation-presentation-v1.md

@@ -0,0 +1,76 @@
+# Automation UI presentation
+
+All targets use the normal App Facade envelope. Reads require Space read authority; editor and mutation targets require Space write authority.
+They are UI entrypoints, not Agent/CLI/MCP tools. Inputs reject unknown fields.
+Full and Essential use the same business read scope; UI requests Full.
+
+| Target | Input | Output and read boundary |
+| --- | --- | --- |
+| `/app/presentation/automation/names/get` | `{ids}`: 1–100 selected, trimmed/deduplicated IDs | `{automations: {id: label}}`. Missing IDs omitted. Selected definition metadata only; no source downloads, parsing, state, history or graph reads. |
+| `/app/presentation/automation/list` | `{type: "RECURRING" \| "TASK_FLOW"}` | `{automations}`: current-type regular user programs, with labels, runnable/health/expiry metadata, enabled/running/blocked, last-run `timestamp`, status timestamps and tags. No temporary-program, Group, Widget, snapshot, graph or authored-source expansion. |
+| `/app/presentation/automation/overview/get` | `{automationId}`: nonblank, trimmed | `{id,name,type,enabled,runnable,corrupted,blocked,widgets}`. Selected metadata, status, cloud quota display state and owned Widget configuration/current values. No source, graph traversal, running history or snapshots. Missing definition is not-found. |
+| `/app/presentation/automation/placements/get` | `{automationId}`: nonblank, trimmed | `{canvases:[{id,name,containsAutomation}]}`. Reads owned Widgets, Widget-to-Card relations and canvas metadata/card IDs; never loads Card bodies. Retains existing default-canvas initialization when the Space has none. |
+
+Labels use saved preferredName, then the script-derived saved name, then the
+existing unknown-label fallback. Metadata reads never require source storage to
+be available. Names and overview permit generated-program inspection within the
+authorized Space; this does not widen user-program mutation Facades. Group
+management remains in the Group domain.
+
+Core filters the regular definition table by type in SQL and uses selected state
+reads. Cloud definition storage is partitioned by Space, so list reads that
+partition's stored metadata and filters by type before loading state. It does not
+hydrate source bodies or read the temporary/Group stores. This is not a promise
+of a type-specific physical index. Billing display and lifecycle state retain
+their existing authorities; enabled, runnable and running are independent.
+
+List Full timestamps are milliseconds. Essential renders explicit timestamp
+fields in the Space's Home timezone. Widget values retain their existing Widget
+DTO semantics; their numbers are not interpreted as timestamps.
+
+The frontend loads only the active list type, caches visited types within the
+active Space, applies realtime events to loaded rows, and invalidates inactive
+caches on incomplete updates or reconnect. Unloaded tab counts are unknown,
+not zero. Overview and placements are separate on-demand reads. Snapshot panels
+continue using `/app/automation/snapshot/list` only when opened.
+
+Automation detail includes `runnable` from its already-loaded definition; Group
+entries omit it. Automation status includes `corrupted` from the existing status
+and temporary `expireAt` from creation/last-run timestamps. Ordinary configuration
+editor initialization supplies the metadata it already loaded, so subsequent
+runtime hydration only needs status.
+
+## Selected summaries and configuration editing
+
+`/app/presentation/automation/summaries/get` accepts the same bounded selected
+`{ids}` as names. It returns `{items:[{requestedId,found,resource}]}` in normalized input
+order. A found resource contains ListItem fields plus `automationId`, `temp`,
+nullable `lastRunAt` and `expireAt`. Missing items omit resource. It supports
+stored Standard, Temporary and generated programs; it does not load script
+bodies, parse source, expand Widgets, snapshots or graphs. Public program status
+also uses metadata rather than downloading authored source.
+
+| Target | Input | Result / retained behavior |
+| --- | --- | --- |
+| `/app/presentation/automation/overview/init` | `{automationId?,inspireId?,inspireVersion?,snapshotId?,args?}` | Existing editor session, required installs, AutomationOverview and already-loaded metadata. Snapshot takes precedence over existing program, then Inspire. Uses the authenticated Client and existing staged-Inspire developer session. |
+| `/app/presentation/automation/overview/config/provide` | `{sessionId,var,input}` | Existing option query and editor revision. |
+| `/app/presentation/automation/overview/config/update` | `{sessionId,var,inputs?,widgetize?}` | Existing config evaluation, diagnostics and revision. |
+| `/app/presentation/automation/overview/save` | `{sessionId,automationId?,inspireId?,inspireVersion?,snapshotId?,preferredName?,debug?,addCard?,canvasIds?}` | `{automationId,runnable,enabled}`. Existing single-save guard, Client ownership, prepare/save/complete revision checks and internal normalized-source persistence. Legacy snapshotId/addCard/canvasIds are accepted but do not perform placement; frontend creates placements separately. |
+| `/app/presentation/automation/overview/cancel` | `{sessionId}` | Canonical acknowledgement without data. Existing Client ownership check and session cleanup. |
+| `/app/presentation/automation/copy` | `{automationId,name?}` | `{automationId,runnable,enabled}`. Copies the existing script/template metadata using the internal save operation. |
+| `/app/presentation/automation/enroll` | `{automationId,name?}` | `{automationId,runnable,enabled}`. Existing enrollment behavior. |
+| `/app/presentation/automation/share` | `{automationId}` | Existing `{sharedId}` from the share service, using trusted caller identity. |
+| `/app/presentation/automation/generated/enable` | `{automationId}` | Existing AutomationStatus for the selected generated program. Enables listening; does not force execution. |
+| `/app/presentation/automation/generated/disable` | `{automationId}` | Existing AutomationStatus after disabling. |
+| `/app/presentation/automation/generated/run` | `{automationId,timezone?,locationSymbol?}` | Canonical acknowledgement without data. Forces the existing stored generated program's threads, including Recurring programs. Runtime execution remains asynchronous. |
+
+Generated control accepts only stored `P-`, `S-`, `G-` program IDs. It does not
+rename generated programs, control Group entities, or widen public user-program
+start/stop. Actor and Client come from trusted ingress, never arbitrary sideData.
+Activity logging is best effort and cannot turn a successful control into a
+failure. These UI targets are not automatically exposed to Agent/CLI/MCP.
+
+The script-source editor and all legacy `/automation/*` Controller routes are
+retired. Configuration editing retains the existing internal save behavior;
+public `/app/automation/save` retains its independent validated-source contract
+for Agent/CLI/MCP. Internal compiler/format capabilities remain available.

package/contract/automation-v1.md

@@ -0,0 +1,28 @@
+# Automation controls and display names
+
+These Space-scoped public operations accept user programs, including temporary Task Flows.
+Generated Twin and Group programs remain internal resources.
+
+- `/app/automation/start` accepts `automationId` and optional `timezone` and
+  `locationSymbol` for execution text. Authenticated actor information is server-owned.
+  Recurring programs are enabled; Task Flows are activated and triggered.
+- `/app/automation/stop` accepts `automationId`, disables the program and cancels
+  all its instances, including durable waits. Completed actions are not undone.
+- Both return Full `data: {automationId, enabled, running}` with observed state.
+  A short Task Flow may already be idle when start returns. Essential renders the
+  same fields as YAML. Failures use the canonical error envelope, never `success:false`
+  inside successful business data. State pushes may supersede a request result.
+- `/app/automation/rename` accepts only Standard Automations (`AutomationUtil.is_std`),
+  excluding Group entity IDs. Twin, Group, Temporary and other prefixed internal
+  programs cannot be renamed here. Rename a Group through its Group operation.
+  It accepts `automationId` and a nonblank `name`, and returns
+  `{automationId, name}`. It changes display metadata without parsing, compiling,
+  replacing script source, creating a snapshot or restarting a generation. Public
+  list/detail and UI labels use this display name. Ordinary source edits preserve it;
+  snapshot rollback restores the snapshot's configuration.
+- `/app/automation/description/update` accepts `automationId`, `expectedScriptHash`
+  and at least one of `description` or nonempty `varDescription`. It validates the
+  exact source hash and parses the rewritten description. `name` is rejected; use
+  rename. The script's authored root name remains available in the script itself.
+
+Inputs are closed objects. The schema is `schema/automation.v1.schema.json`.

package/contract/client-space-focus-v1.md

@@ -0,0 +1,26 @@
+# Client Space focus
+
+`/app/client/space/focus` is a Client-only, connection-owned App Facade. It replaces
+`/focus`; no legacy alias exists. It is not a user preference or an Agent/MCP tool.
+The receiving transport must prove the live authenticated Client connection and
+must never forward this call to a Space owner or accept a client ID in input.
+
+Request: `{"control":{"mode":"direct"},"input":{"targetSpaceId":"space-b"}}`.
+`targetSpaceId` is required: non-empty unpadded text selects a Space, explicit
+`null` clears focus. User membership is checked authoritatively by Cloud; a local
+Host accepts only its authenticated session's Space (or clear). A bound Space
+Client can only affect its enrolled Space. No read of the old Space is required.
+
+Both request-response (`arq`) and one-way state synchronization (`ad`) use this
+same envelope. Native switch orchestration retains its existing ACK and session
+fences. Background synchronization remains per physical connection and is not
+an additional user switch. It never replays an obsolete clear after reconnect.
+For Cloud clear, the existing envelope `scopeId`, when non-empty, is a condition:
+a delayed clear for A cannot erase a newer focus on B. Omitted/blank scope clears
+unconditionally. Local connections can only focus/clear their bound Space.
+
+Full success: `{"status":"success","data":{"focusedSpaceId":"space-b"}}`;
+clear returns `focusedSpaceId:null`. `essential` uses normal Facade projection.
+One-way synchronization emits no response. Persistence failure retires the
+connection; success never means that every other connection has synchronized.
+Internal Host/Core presence events and `/bridge/app/focus` retain their own roles.

package/contract/entity-presentation-v1.md

@@ -1,6 +1,29 @@
 # Entity UI presentation
 
-`/app/entity/presentation/get` is a read-only App Facade for the UI. Its direct
+## Selected reference metadata
+
+`/app/presentation/entity/meta/get` accepts `{entityType, ids}` under the normal
+Facade envelope. It is a Space-read UI operation, routed by Space mode, not an
+Agent/MCP catalog entry. IDs are nonblank, trimmed, deduplicated in request order
+and bounded to 100 input entries. Empty input and unknown fields are rejected.
+The response is `{items: [{requestedId, found, resource? , reason?}]}`. A found
+resource contains only `id`, `entityType`, `displayName`, and `group`. A missing,
+deleted or wrong-type reference returns `found: false, reason: "not_found"`.
+
+Automation uses definition metadata; Widget uses its own definition; other
+entities use their stored Twin identity. `g:` IDs read the Group definition and
+check its member type (an empty legacy member type accepts the requested type).
+No Group members are resolved. All reads use authenticated tenant and Space.
+No source refresh, room lookup, runtime status, history, card/relationship read or
+script expansion is performed. Missing display names remain empty; the UI owns
+its fallback label. Both response detail modes preserve these business fields.
+
+This is a selected-reference resolver, not a replacement for the domain catalogs
+of special entities such as AppClient or Location. It does not enumerate them.
+
+## Entity renderer aggregate
+
+`/app/presentation/entity/get` is a read-only App Facade for the UI. Its direct
 input is `{entityType, entityId}`; tenant, Space and caller come from authenticated
 context. It requires Space read access. It is not an Agent or MCP catalog entry.
 

package/contract/integration-presentation-v1.md

@@ -1,6 +1,6 @@
 # Integration UI presentation
 
-`/app/integration/presentation/get` is a read-only App Facade for UI consumers.
+`/app/presentation/integration/get` is a read-only App Facade for UI consumers.
 Input is `{integrationId}` for one root Integration. Tenant, Space and caller
 come from authenticated context; Space read membership is required. Empty IDs,
 unknown fields and Provider IDs are rejected; missing Integrations are not found.

package/contract/plugin-preview-v1.md

@@ -0,0 +1,16 @@
+# Native Plugin Preview preflight
+
+`/app/plugin/preview/check` is a read-only App Facade on the selected Local
+Space's Hub. It accepts the empty business input `{}` and requires Space Manage
+access. Its business result is `{ "spaceId": "<selected-space>" }`, inside the
+standard Facade response envelope. Unknown input fields are rejected.
+
+The desktop CLI must complete this check before asking its local Host to install
+or restart a native Preview. Cloud Spaces cannot route this Hub-only operation.
+The check creates no session, token, reservation or persistent data. It does not
+grant Host installation permission: the Host's existing local authorization still
+applies. Binding rechecks Space authority after installation; this preflight does
+not guarantee that permissions cannot change during the operation.
+
+Integration Preview status remains a Space Read operation. Native Preview must
+not use that status read as evidence of management permission.

package/contract/reference-presentation-v1.md

@@ -0,0 +1,35 @@
+# Reference picker presentation
+
+UI-only Space reads use the standard FacadeCall and success/data/error envelope.
+Both targets require spaceRead and follow scopeMode routing. They are not native
+Agent, CLI or MCP tools. Full and Essential preserve the same business fields;
+Essential represents them as YAML.
+
+| Target | Input | Business output |
+| --- | --- | --- |
+| `/app/presentation/reference/type/list` | `{}` | `{types:[{entityType,name,category}]}` |
+| `/app/presentation/reference/item/list` | `{entityType}` | `{items:[{id,name,entityType,category,capabilities,group}]}` |
+
+Inputs reject unknown fields. entityType is a nonblank string, trimmed at the
+boundary. category is device, widget, automation or entity, derived by the server.
+Candidate names do not replace IDs. Empty capabilities and false group values are
+preserved. No business input selects another Space.
+
+Types come from installed and auto-installed Integration standalone declarations,
+deduplicated and sorted by entityType. Empty types are not hidden by counting their
+instances. Item reads select one type only. Widget reads preserve the shared global
+catalog (including global Automation-owned Widgets), not the narrower Widget-page
+visibility rules. Device and Entity groups retain their existing capability
+resolution. Automation references include regular and temporary programs and
+Automation groups, with the existing internal-object exclusions and display names.
+Location and AppClient retain their dedicated discovery rules.
+
+Reference reads omit room/enablement enrichment, group runtime state, Automation
+status and script hydration. They do not load Widget values, histories, owner
+names or full configurations. Metadata reads may still require underlying stored
+rows and group capability resolution; this contract does not promise one DB query.
+
+The UI lazily caches types and items by Space/type and merges in-flight reads.
+Search remains client-side. Failed requests are retryable and are not successful
+empty catalogs. Space changes discard late results. Message reference identity and
+serialization remain unchanged. Legacy `/reference/*` request routes are retired.

package/contract/resource-read-v1.md

@@ -14,7 +14,7 @@ follow the Space execution authority on both local Core and cloud.
 | `/app/widget/list` | `{}` | Summaries: id, displayName, description, type, tag; Data adds dataType/repeated. No list mode or full-definition catalog |
 | `/app/widget/detail/get` | `{ids}` | Existing ordered `items` with `widget` configuration; no value, next or nextTimestamp |
 | `/app/widget/value/get` | `{ids}` | Ordered `items` with `resource: {widgetId, revision, value, next?, nextTimestamp?}` |
-| `/app/automation/status` | `{ids}` | Ordered `items` with `resource: {automationId, enabled, runnable, running, blocked, lastRunAt}` |
+| `/app/automation/status` | `{ids}` | Ordered `items` with `resource: {automationId, enabled, runnable, corrupted, running, blocked, lastRunAt}`; temporary programs also include `expireAt` |
 | `/app/graph/relations/get` | `{resource: {kind, id}}` | `{resource, relations: [{from, relation, to, capabilityIds?}]}` |
 
 Device list and detail discriminate status using `group`: physical Devices (`false`)
@@ -101,7 +101,7 @@ open detail renderer; relationships by the view that displays them. Pushes recei
 during a snapshot request are applied after it lands. Switching scopes or disposing
 controllers prevents late responses from landing in another Space.
 
-House continues to use `/app/entity/presentation/get` and legacy Twin reads as its
+House continues to use `/app/presentation/entity/get` and legacy Twin reads as its
 separate development boundary. Pod Deck retains its existing complete Card content
 reader. These consumers are not silently migrated to static Canvas responses.
 

package/contract/space-presentation-v1.md

@@ -0,0 +1,45 @@
+# Space presentation and focused business readers
+
+All calls use the standard App Facade envelope. These presentation targets are
+UI reads, not Agent tools. They execute in the cloud and require user identity.
+
+- `/app/presentation/space/list` accepts `{}` and returns `{spaces}`. Each item
+  has `spaceId`, `name`, `mode`, `llmMode`, `betaMode`, `defaultActive`,
+  `lifecycleState`, `connectionMode`, and `currentUserRole`. Nullable metadata
+  remains nullable. It reads enrolled memberships and Space metadata, then live
+  connection state; it never expands members, Locations, preferences or profiles.
+- `/app/presentation/space/get` accepts `{includeMembers?: boolean}` (default
+  false) and returns `{space, members?}`. `space` has the same summary shape.
+  Only `includeMembers:true` reads the Space membership list and member profiles.
+  Each member has `userId`, `email`, `name`, `pending` and `role`. Active members
+  may read this presentation; management mutations still require their own grants.
+- `/app/space/location/list` accepts `{}` and returns `{locations}`. Each Location
+  has `spaceId`, `locationId`, `name`, `address`, `timezone`, `countryCode`,
+  `latitude`, `longitude`, and `altitude`. It executes according to Space mode,
+  reading only the authoritative backend's Locations; it does not read Space
+  details, members or preferences and has no cloud fallback in local mode.
+- `/app/space/delete/status` accepts `{operationId}` and returns `accepted`,
+  `operationId`, `spaceId`, `state`, `message`, and `deleted`. It queries the
+  existing durable operation and never starts or restarts deletion. Authorization
+  uses the operation initiator and authenticated user, so polling survives removal
+  of membership and Space data. The request retains the operation's Space ID.
+- `/app/space/beta/update` accepts `{betaMode: boolean}` and returns
+  `{betaMode, poll}`. It saves through the existing Space Beta service. A true
+  `poll` means the Client must wait for the Hub to apply the selected mode.
+
+Invitation accept/reject remain membership operations and never select a Client's
+Space. The UI explicitly uses the connection focus protocol after joining when
+its flow intends to enter the joined Space. Current-Space switches must not be
+discarded by the previous Space's request guard.
+
+Client handling of presentation replies unwraps successful Full Facade responses
+before updating cloud-authoritative membership/connection caches. Presentation
+wire DTOs (`spaceId`, `llmMode`) are explicitly projected into native state;
+login and Hub authorization retain their independently owned wire DTOs.
+
+Legacy `/scope/list`, `/scope/get`, `/scope/preference/get`, `/scope/agent/get`,
+and `/scope/location/list` readers are retired, without fallback aliases. Native
+UI membership refresh uses `/app/presentation/space/list`; the CLI uses
+`/app/space/list` for identity-only listing and selection checks, and presentation
+listing for its full management view. Neither lightweight flow expands per-Space
+context. `/focus` remains connection control, not a business Facade.

package/contract/storage-v1.md

@@ -180,7 +180,9 @@ and removal-only cleanup authority.
 
 ## Physical backend and reads
 
-`storage.backend.v2` remains separate from the public `storage.v1` capability.
+`storage.backend.v1` remains separate from the public `storage.v1` capability.
+Storage is in development: both protocols evolve in place as v1, with no legacy
+readers, version negotiation or compatibility branches.
 Describe reports capacity; grant authorizes stat/read/delete; prepare-write reserves
 space for an immutable Blob before issuing a write grant. A lost reply can have
 reserved bytes. Receipts are resolved before changing repositories. Issued grants survive temporary Core control disconnection until normal expiry;

package/contract/widget-presentation-v1.md

@@ -0,0 +1,36 @@
+# Widget UI presentation reads
+
+These are UI App Facades with the standard Full/Essential response and Space read
+policy. They are not Agent/CLI/MCP tools. Inputs reject unknown fields.
+
+| Target | Input | Business output and read boundary |
+| --- | --- | --- |
+| `/app/presentation/widget/list` | Required `{type: "data" \| "button" \| "circadian"}` | `{items, automationNames}`. Reads only that type's Widget table. Global standalone Widgets, defaults and Automation-owned parameters are included; card interiors, Twin and weather internals are excluded. Owner labels use one selected metadata batch, only for returned Automation owners. No script, relation, history or all-type reads. |
+| `/app/presentation/widget/names/get` | `{ids}`: 1–100 selected, trimmed, deduplicated IDs | `{names: {id: displayName}}`. Missing/blank names omitted. Only selected Widget rows; no legacy `name` fallback. |
+| `/app/presentation/widget/defaults/get` | `{}` | `{items, automationNames:{}}`. Preserves the existing default Widget lookup and lazy initialization, then reads the selected Data Widgets. |
+
+Rows carry ID, revision, displayName, description, source/baseId, global, tag,
+current value, and type-specific control configuration. Circadian rows contain
+only `curve`, `curvePreview` (active curve's UI points), current/next values and
+`nextTimestamp`; they omit complete schedules, location and internal state.
+Complete configuration uses `/app/widget/detail/get`; runtime uses
+`/app/widget/value/get`, both selected-ID reads. Full timestamps are milliseconds;
+Essential renders explicit timestamps and typed Timestamp values in Home timezone.
+
+`/app/widget/list` remains the shared summary catalog. Optional `type` limits the
+physical Widget-table read; optional `excludeSources` filters known sources
+(`widget`, `automation`, `special`, `twin`, `weather`). Omitted filters preserve
+the existing global supported-type catalog. It never returns control values or
+full definitions. Dashboard selection excludes Automation-owned parameters and
+adds selected IDs directly without definition/value reads.
+
+The UI loads only the active type, caches visited tabs within the Space and never
+fetches inactive counts. Automation parameters are grouped by owning Automation;
+users can operate them and open the owner but cannot edit/delete their definition.
+Realtime changes update loaded rows, deletes remove them, and reconnect or
+incomplete presentation changes refresh only the relevant active tab. Space
+switches clear caches and reject late responses. All public Widget request
+Controllers, including reads and writes, are removed. Writes use the shared
+`/app/widget/*` Facades described in `widget-writes-v1.md`.
+`/widget/reportUpdate` remains a push protocol; internal Automation dispatch
+remains separate from public request routing.

package/contract/widget-writes-v1.md

@@ -0,0 +1,44 @@
+# Widget writes
+
+Widget create and configuration Facades are shared by UI, Agent, CLI and MCP.
+Creation requires displayName; description may be omitted. A supplied description
+must remain nonblank. Existing text value inputs remain supported.
+
+## Data runtime values
+
+`/app/widget/data/update` accepts widgetId and exactly one non-null input:
+
+- value: a text-encoded scalar, for example "false" or "25C".
+- values: an array of text-encoded values, including an empty array.
+- typedValue: typed JSON, for example false, 0, [], or
+  {"_type":"Temperature","value":25,"unit":"C"}.
+
+Explicit typedValue:null is rejected; clearing is a separate Automation capability.
+The stored definition determines type, scalar/array shape, options and bounds.
+Object selections are restricted to stored Automation candidates. Only their type
+and UID identify a candidate; stored business fields replace caller-supplied fields.
+Both text and typed inputs use the same manager, write constraints, history and events.
+The request never changes configuration, visibility or ownership.
+
+## Circadian runtime controls
+
+`/app/widget/circadian/runtime/update` accepts widgetId and at least one of curve,
+offset, multiplier. Unknown fields and explicit null controls are rejected.
+Curve must identify an existing schedule; offset must match the stored data type;
+multiplier must be finite. Updates retain existing manual adjustment timing and
+recompute the current and next values. Automation-owned parameters are operable.
+Visibility, owner, name, location and schedule definitions remain unchanged.
+This is a direct operation, independent of prepared definition edits.
+
+Data value updates, Button triggers, Circadian runtime controls and delete return
+an acknowledgement: {"status":"success"}, without business data.
+Create/configuration responses retain action, widgetId, type and displayName.
+
+## Deletion
+
+`/app/widget/delete` retains the required explicit safe flag. The UI passes false
+to preserve its previous deletion behavior. This migration does not change the
+shared safe=true protection for Widgets referenced by Automations.
+
+All legacy public /widget/* request Controllers are retired. /widget/reportUpdate
+is a push event and internal /dispatch/widget/* operations retain their own roles.

package/fixtures/authorization/decisions.json

@@ -826,5 +826,101 @@
     "scopeId": "space",
     "target": "/app/object-storage/folders/set-limit",
     "allowed": false
+  },
+  {
+    "name": "space-ui:unscoped:/app/presentation/space/list",
+    "principal": {
+      "kind": "user",
+      "userId": "user"
+    },
+    "memberRole": null,
+    "tenantId": "tenant",
+    "scopeId": "space",
+    "target": "/app/presentation/space/list",
+    "allowed": true
+  },
+  {
+    "name": "space-ui:MEMBER:/app/presentation/space/get",
+    "principal": {
+      "kind": "user",
+      "userId": "user"
+    },
+    "memberRole": "MEMBER",
+    "tenantId": "tenant",
+    "scopeId": "space",
+    "target": "/app/presentation/space/get",
+    "allowed": true
+  },
+  {
+    "name": "space-ui:unscoped:/app/presentation/space/get",
+    "principal": {
+      "kind": "user",
+      "userId": "user"
+    },
+    "memberRole": null,
+    "tenantId": "tenant",
+    "scopeId": "space",
+    "target": "/app/presentation/space/get",
+    "allowed": false
+  },
+  {
+    "name": "space-ui:MEMBER:/app/space/location/list",
+    "principal": {
+      "kind": "user",
+      "userId": "user"
+    },
+    "memberRole": "MEMBER",
+    "tenantId": "tenant",
+    "scopeId": "space",
+    "target": "/app/space/location/list",
+    "allowed": true
+  },
+  {
+    "name": "space-ui:unscoped:/app/space/location/list",
+    "principal": {
+      "kind": "user",
+      "userId": "user"
+    },
+    "memberRole": null,
+    "tenantId": "tenant",
+    "scopeId": "space",
+    "target": "/app/space/location/list",
+    "allowed": false
+  },
+  {
+    "name": "space-ui:unscoped:/app/space/delete/status",
+    "principal": {
+      "kind": "user",
+      "userId": "user"
+    },
+    "memberRole": null,
+    "tenantId": "tenant",
+    "scopeId": "space",
+    "target": "/app/space/delete/status",
+    "allowed": true
+  },
+  {
+    "name": "space-ui:MEMBER:/app/space/beta/update",
+    "principal": {
+      "kind": "user",
+      "userId": "user"
+    },
+    "memberRole": "MEMBER",
+    "tenantId": "tenant",
+    "scopeId": "space",
+    "target": "/app/space/beta/update",
+    "allowed": false
+  },
+  {
+    "name": "space-ui:OWNER:/app/space/beta/update",
+    "principal": {
+      "kind": "user",
+      "userId": "user"
+    },
+    "memberRole": "OWNER",
+    "tenantId": "tenant",
+    "scopeId": "space",
+    "target": "/app/space/beta/update",
+    "allowed": true
   }
 ]