@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.5

package/dist/esm/core/resources/useResourceOperationActions.js

@@ -8,11 +8,14 @@
  */
 import React, { useMemo, useState, useCallback, useContext, useRef } from 'react';
 import { useResourceRegistry } from './useResourceRegistry.js';
+import { readBackgroundAcceptance, describeCaughtError } from '@wildo-ai/saas-models';
 import { useUserOrgs } from '../../core/security/useUserOrgs.js';
 import { useAppScopeSafe } from '../../core/scope/useAppScope.js';
 import { useNavigationController } from '../../core/navigation/useNavigationController.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
+import { useUserFacingErrorMessage } from '../../core/errors/useUserFacingErrorMessage.js';
 import { resolveComponentLabel } from '../../core/i18n/component-label-resolution.utils.js';
+import { resolveOperationDisplayTitle } from '../../core/i18n/operation-title-resolution.utils.js';
 import { useIconRegistry } from '../../core/icons/useIconRegistry.js';
 import { useEventBus } from '../../core/events/useEventBus.js';
 import { NotificationContext } from '../../core/events/NotificationContext.js';
@@ -23,18 +26,19 @@ import { useOperationsEnabled, buildOperationEnabledKey, } from './hooks/useOper
 import { NavigationUtils } from '../../core/navigation/navigation.utils.js';
 import { frontendResourceUtils, FrontendResourceUtils } from './frontend-resource.utils.js';
 import { FrontendEvents } from '../../core/events/events.frontend.schemas.js';
-import { FrontendComponentType } from '@wildo-ai/presets-components-models';
+import { FrontendComponentType, ResourceOperationTextSlot } from '@wildo-ai/presets-components-models';
 import { IconCategory, IconSize, StandardIconReference } from '../../core/icons/icon-registry.frontend.schemas.js';
 import { WebSocketContext } from '../../core/requests/websockets/WebSocketContext.js';
 import { extractEphemeralFields } from './ephemeral-fields.utils.js';
-import { ActionVisibility, ActionPlacement, DisabledActionHandling, ResourceOperationActionPresentation, resolveActionDisclosure, isOperationHeadless, isCollectionScopedOperation } from '../../core/resources/resources.frontend.schemas.js';
+import { ActionVisibility, ActionPlacement, DisabledActionHandling, ResourceOperationActionPresentation, resolveActionDisclosure, isOperationHeadless } from '../../core/resources/resources.frontend.schemas.js';
 import { ResourceOperationActionPopoverBody } from '../../components/resources/ResourceOperationActionPopover.js';
 import { InPlaceOperationTargetKind, useInPlaceOperation } from '../../core/resources/in-place/InPlaceOperationContext.js';
 import { ButtonVariants_Variant } from '../../components/actions/button.js';
-import { actionPresentationNavigates, BULK_OPERATION_SELECTION_IDS_CONTEXT_KEY, buildBulkOperationSelectorPayload, resolveResourceOperationActionPresentation, getOperationsForCoreSemantic, RESOURCE_OPERATION_EXECUTED_DISCRIMINATOR_CONTEXT_KEY, isGeneratedFileRegenerateOperation, isGeneratedCollectionExportOperation, readResourceOperationExecutedDiscriminator, resolveEffectiveCoreOperationFromOperation, shouldEmitResourceRefreshAfterDirectOperation, shouldTreatAsNonItemResourceOperation, } from './operation-semantics.frontend.utils.js';
+import { actionPresentationNavigates, BULK_OPERATION_SELECTION_IDS_CONTEXT_KEY, buildBulkOperationMatchPayload, buildBulkOperationSelectorPayload, resolveResourceOperationActionPresentation, getOperationsForCoreSemantic, RESOURCE_OPERATION_EXECUTED_DISCRIMINATOR_CONTEXT_KEY, isGeneratedFileRegenerateOperation, isCollectionScopedResourceOperation, isGeneratedCollectionExportOperation, readResourceOperationExecutedDiscriminator, resolveEffectiveCoreOperationFromOperation, shouldEmitResourceRefreshAfterDirectOperation, shouldTreatAsNonItemResourceOperation, toOperationResultSummary, } from './operation-semantics.frontend.utils.js';
 import { isFrontendOperationAddressableForCurrentContext, pickPreferredOperationForCoreSemanticAddressability, shouldRequireCurrentContextAddressabilityForOperation, } from './resource-addressability.frontend.utils.js';
 import { normalizeContextResourceIdentifiersForOutcome, normalizeContextResourceIdentifiersForTransport, } from './context-resource-identifiers.frontend.utils.js';
-import { CoreResourceOperation, ResourceOperationRiskLevel, ResourceOperationDisplayMode, ResourcesConfig_OperationPathUtils, Resources_SharedUtils, ResourceGeneratedOperationKind, ResourceCollectionExportRowScope, listCollectionExportSelections, ResourceOperationVariantType, FeatureUnavailabilityBehavior, userRolesSatisfyRequiredRoles, selectHighestRightsVariants, } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, ResourceOperationRiskLevel, isIrreversibleOperation, ResourceOperationDisplayMode, ResourcesConfig_OperationPathUtils, Resources_SharedUtils, ResourceGeneratedOperationKind, ResourceCollectionExportRowScope, listCollectionExportSelections, ResourceOperationVariantType, FeatureUnavailabilityBehavior, userRolesSatisfyRequiredRoles, selectHighestRightsVariants, resolveBulkOperationMaxSelection, } from '@wildo-ai/saas-models';
+import { describeResourceErrorForNotification } from '../../components/form/validation-errors/resource-error-notification-context.utils.js';
 function toActionBarFeatureAvailability(featureAvailability) {
     return featureAvailability;
 }
@@ -119,7 +123,16 @@ function describeCollectionExportSelection(selection) {
         : 'this page';
     return `${selection.format.toUpperCase()} — ${scopeLabel}`;
 }
-function humanizeGeneratedFileFieldName(operation) {
+/**
+ * The field a generated-file regenerate operation re-produces, as its PATH — never as words.
+ *
+ * The button names the field through the field's own authored label (`tResourceFieldDisplay`), so
+ * the words come from the label tree like every other field name the person reads. This used to
+ * humanize the path instead (`generatedSummaryPdf` → "generated Summary"), stripping a guessed
+ * `pdf` token: English produced by code, untranslatable, and wrong for any acronym it could not see
+ * (`.claude/rules/display-text-comes-from-i18n.md`, #1283).
+ */
+function resolveGeneratedFileFieldPath(operation) {
     // NARROW on `kind` before reading `fieldName`. `generatedOperation` is a DISCRIMINATED UNION —
     // the file-regenerate member carries `fieldName`, the collection-export member does not — so an
     // unnarrowed read is both a type error and, if it ever compiled, a field lookup on the wrong
@@ -133,16 +146,7 @@ function humanizeGeneratedFileFieldName(operation) {
         : typeof operation.operationIdentifier === 'string'
             ? Resources_SharedUtils.parseGeneratedFileRegenerateOperationIdentifier(operation.operationIdentifier)?.fieldName
             : undefined;
-    if (!fieldName)
-        return undefined;
-    const pathSegments = fieldName.split('.').filter(Boolean);
-    const lastSegment = pathSegments[pathSegments.length - 1] ?? fieldName;
-    const words = lastSegment
-        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
-        .replace(/[-_]+/g, ' ')
-        .replace(/\bpdf\b/gi, '')
-        .trim();
-    return words.length > 0 ? words : undefined;
+    return fieldName && fieldName.length > 0 ? fieldName : undefined;
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // Operations that are NOT per-item actions (excluded by default for item mode)
@@ -159,6 +163,10 @@ function riskLevelToVariant(riskLevel) {
             return ButtonVariants_Variant.GHOST;
     }
 }
+/** Spread helper: attach an `unavailability` only when there is one to attach. */
+function withUnavailability(unavailability) {
+    return unavailability ? { unavailability } : {};
+}
 function isRiskyOperation(riskLevel) {
     return riskLevel === ResourceOperationRiskLevel.HIGH || riskLevel === ResourceOperationRiskLevel.CRITICAL;
 }
@@ -176,12 +184,13 @@ const EMPTY_ROLES = [];
 // Hook
 // ─────────────────────────────────────────────────────────────────────────────
 export function useResourceOperationActions(params) {
-    const { resourceType, displayMode, currentObject, contextResourceIdentifiers, parentResourcesRequirements, navigationZone, operationId = 'operations', excludeOperations, bulkOnly = false, collectionOnly = false, placementFilter, selectedItemIds, additionalContext, successDiscriminator, suppressViewDetails = false, onOperationExecuted, collectionExportQuery, } = params;
+    const { resourceType, displayMode, currentObject, contextResourceIdentifiers, parentResourcesRequirements, navigationZone, operationId = 'operations', excludeOperations, bulkOnly = false, selectionObjects, onSelectionNarrow, collectionOnly = false, placementFilter, selectedItemIds, matchAllSelection, additionalContext, successDiscriminator, suppressViewDetails = false, onOperationExecuted, collectionExportQuery, } = params;
     const { registry, doOperation } = useResourceRegistry();
     const { permissions } = useUserOrgs();
     const appScope = useAppScopeSafe();
     const { navigateToResource } = useNavigationController();
-    const { tComponent, tResourceOperation, isReady } = useI18n({ component: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, resource: resourceType });
+    const { tComponent, tResourceOperation, tResourceFieldDisplay, isReady } = useI18n({ component: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, resource: resourceType });
+    const toUserFacingErrorMessage = useUserFacingErrorMessage();
     const { renderIcon } = useIconRegistry();
     // The element-level host, when this action bar is rendered inside a collection that provides one.
     // Absent everywhere else, where `isAvailable` is false — see `InPlaceOperationContext`.
@@ -227,8 +236,24 @@ export function useResourceOperationActions(params) {
     emitRef.current = emit;
     isWebSocketConnectedRef.current = isWebSocketConnected;
     // Confirmation dialog state
-    const [confirmState, setConfirmState] = useState({ open: false, label: '', requiresTypedConfirmation: false, confirmationPhrase: '', callback: null });
+    const [confirmState, setConfirmState] = useState({ open: false, label: '', requiresTypedConfirmation: false, confirmationPhrase: '', description: null, confirmLabel: '', callback: null });
     const [isExecuting, setIsExecuting] = useState(false);
+    /**
+     * Which operations are RUNNING, by operation path key. An action in flight is shown busy and
+     * cannot be started again until it ends; the others stay usable. The ref is the guard (two
+     * presses can land in the same tick, before state updates); the state drives the rendering.
+     * Before this there was no guard at all — a double press sent the request twice.
+     */
+    const runningOperationKeysRef = useRef(new Set());
+    /**
+     * The background run this bar started, if any — the job a surface follows to draw progress.
+     *
+     * Held rather than only announced: the acceptance arrives once, in a response, while the progress
+     * that follows arrives on the event bus keyed by `jobId`. A surface that missed the response has
+     * nothing to match those events against (#1461).
+     */
+    const [acceptedBackgroundRun, setAcceptedBackgroundRun] = useState(null);
+    const [runningOperationKeys, setRunningOperationKeys] = useState(() => new Set());
     /**
      * Which action currently has its anchored panel open, by operation PATH KEY.
      *
@@ -366,6 +391,30 @@ export function useResourceOperationActions(params) {
     // inputs above. ESLint exhaustive-deps is not wired in this repo.
     [userAppRolesKey]);
     const stableUserOrgRoles = useMemo(() => userOrgRoles, [userOrgRolesKey]);
+    /**
+     * Is the listing the user is looking at driven by a text SEARCH right now?
+     *
+     * `undefined` means the surface did not say — every caller that is not a listing — and the export
+     * gate below then stays inert rather than guessing. Read from the prop rather than the ref that
+     * the download handler uses, because this one must RE-RUN the operation filter when the mode
+     * flips; the ref exists precisely so the handler does NOT.
+     */
+    const listingSearchActive = collectionExportQuery?.isSearchActive;
+    /**
+     * Does this resource declare exports on BOTH a search-sourced and a non-search-sourced operation?
+     *
+     * Only then is there a choice to disambiguate. Computed over the resource's own operations rather
+     * than over `filteredOps`, because it is an input to that filter.
+     */
+    const exportSourceIsAmbiguous = useMemo(() => {
+        const exports = (resourceConfig?.operations ?? [])
+            .filter((op) => isGeneratedCollectionExportOperation(op));
+        const searchSourced = exports.some((op) => op.generatedOperation?.kind === ResourceGeneratedOperationKind.GENERATED_COLLECTION_EXPORT
+            && op.generatedOperation.sourceCoreOperation === CoreResourceOperation.SEARCH);
+        const otherSourced = exports.some((op) => op.generatedOperation?.kind === ResourceGeneratedOperationKind.GENERATED_COLLECTION_EXPORT
+            && op.generatedOperation.sourceCoreOperation !== CoreResourceOperation.SEARCH);
+        return searchSourced && otherSourced;
+    }, [resourceConfig]);
     // ─── Step 1: Filter operations (stable reference for enabledCondition evaluation) ───
     const filteredOps = useMemo(() => {
         if (!resourceConfig)
@@ -417,8 +466,10 @@ export function useResourceOperationActions(params) {
             // already knows. Recognised HERE because this filter is the single site that decides which bar
             // an operation belongs to — the comment above says so, and adding a second site is what the
             // design avoids.
-            const isCollectionScoped = isCollectionScopedOperation(op.operationFrontendConfig)
-                || isGeneratedCollectionExportOperation(op);
+            // ONE predicate, shared with the list's mount check — see
+            // `isCollectionScopedResourceOperation`, which carries all three ways to be collection-scoped
+            // and the reason they may not be enumerated separately at each asker.
+            const isCollectionScoped = isCollectionScopedResourceOperation(op);
             if (collectionOnly) {
                 if (!isCollectionScoped || isBulk)
                     return false;
@@ -426,6 +477,33 @@ export function useResourceOperationActions(params) {
             else if (isCollectionScoped) {
                 return false;
             }
+            // ── ONE export affordance at a time, when the resource offers a CHOICE of source ──
+            //
+            // A resource may declare `collectionExport` on both its LIST and its SEARCH operation, and
+            // Wonder Todos does: the LIST export is the machine-readable surface (CSV + JSON) and the
+            // SEARCH export is the "give me what I just searched for" one (CSV). Both are correct
+            // declarations, and both companions are collection-scoped, so the toolbar rendered TWO export
+            // buttons that a reader cannot tell apart — identical icon, identical "Export" label — while
+            // exactly one of them can answer at any moment: the download handler REFUSES a LIST export
+            // while the search box has content, because returning the unsearched set would be a wrong
+            // answer delivered as a successful download.
+            //
+            // So the choice is already determined by the listing's state; showing both asks the user to
+            // make a decision the framework has already made, and to make it with no information. The
+            // source is read from `generatedOperation.sourceCoreOperation` — the DECLARED provenance —
+            // rather than from `resourceOperationLike`, which the synthesis happens to copy from it.
+            //
+            // Narrowed to the AMBIGUOUS case deliberately. A resource with a single export keeps it in
+            // every listing state, including an active search: there the handler's refusal explains
+            // itself, and hiding the only export while somebody types would remove a capability rather
+            // than disambiguate one. The gate needs the listing to have TOLD us its mode, so a surface
+            // that supplies no `collectionExportQuery` sees no change at all.
+            if (listingSearchActive !== undefined && exportSourceIsAmbiguous && isGeneratedCollectionExportOperation(op)) {
+                const exportsSearchResults = op.generatedOperation?.kind === ResourceGeneratedOperationKind.GENERATED_COLLECTION_EXPORT
+                    && op.generatedOperation.sourceCoreOperation === CoreResourceOperation.SEARCH;
+                if (exportsSearchResults !== listingSearchActive)
+                    return false;
+            }
             // Bulk mode: only bulk operations
             if (bulkOnly && !isBulk)
                 return false;
@@ -452,16 +530,13 @@ export function useResourceOperationActions(params) {
             }
             return true;
         });
-    }, [resourceConfig, stableExcludeOperations, bulkOnly, collectionOnly, stableUserAppRoles, stableUserOrgRoles]);
+    }, [resourceConfig, stableExcludeOperations, bulkOnly, collectionOnly, stableUserAppRoles, stableUserOrgRoles, listingSearchActive, exportSourceIsAmbiguous]);
     // ─── Step 2: Evaluate enabledCondition for all filtered operations ───
     // Async — starts as empty Map, then populates after evaluation completes.
     //
-    // EC — bulk contract: in bulk mode (`bulkOnly`) the caller passes NO
-    // `currentObject` (there is no single record for N selected items), so a bulk
-    // variant whose `enabledCondition` reads `currentObject.<field>` evaluates
-    // against an empty object. This is intentional: bulk availability is scoped to
-    // ROLES + SELECTION only — author bulk conditions accordingly. Per-item state
-    // gating belongs on the per-row action, which DOES receive `currentObject`.
+    // EC — bulk contract: in bulk mode there is no single `currentObject`, so a bulk
+    // operation's `enabledCondition` is judged against EACH of `selectionObjects` and
+    // passes only when every selected row does — the backend's multi-row rule.
     //
     // (Also note: on async-loaded surfaces like the read view, `currentObject` is
     // briefly `undefined` on first mount and this batch evaluates against `{}`
@@ -469,6 +544,7 @@ export function useResourceOperationActions(params) {
     const enabledMap = useOperationsEnabled(filteredOps, {
         currentObject,
         resourceType,
+        selectionObjects,
     });
     // Build contextual parameters for API calls (canonical implementation)
     const contextualParameters = useMemo(() => {
@@ -517,31 +593,36 @@ export function useResourceOperationActions(params) {
             // author's declaration order, which no reader of the UI can see.
             const exportConfig = resolveCollectionExportConfig(operation);
             const selections = exportConfig ? listCollectionExportSelections(exportConfig) : [];
-            const label = resolveComponentLabel({
+            // No English stand-in: until `collectionExport` is generated the KEY shows (#1414).
+            const base = resolveComponentLabel({
                 tComponent,
                 componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
                 key: 'collectionExport',
             });
-            const base = label && label !== 'collectionExport' ? label : 'Export';
             // Only ONE thing on offer ⇒ name it, so the button is not a mystery about which file arrives.
             // Several ⇒ stay generic: the choice is in the menu, and repeating one of them in the trigger
             // would imply that one is what clicking does.
             return selections.length === 1 ? `${base} ${selections[0].format.toUpperCase()}` : base;
         }
         if (isGeneratedFileRegenerateOperation(operation)) {
-            const fieldLabel = humanizeGeneratedFileFieldName(operation);
-            if (fieldLabel) {
-                return `Regenerate ${fieldLabel} file`;
+            const fieldPath = resolveGeneratedFileFieldPath(operation);
+            if (fieldPath) {
+                // No English stand-in on either half: an ungenerated key, or an unlabelled field, shows as
+                // its key — which is what names the gap somebody has to fill (#1414).
+                return resolveComponentLabel({
+                    tComponent,
+                    componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                    key: 'generatedFileRegenerateNamed',
+                    params: { field: tResourceFieldDisplay(resourceType, fieldPath, 'label') },
+                });
             }
             const label = resolveComponentLabel({
                 tComponent,
                 componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
                 key: 'generatedFileRegenerate',
             });
-            if (label && label !== 'generatedFileRegenerate') {
-                return label;
-            }
-            return 'Regenerate file';
+            // No English stand-in: until the label is generated the KEY shows (#1414).
+            return label;
         }
         // Core operations (READ, UPDATE, DELETE) own a registered i18n key —
         // try the framework's component-level i18n bundle first.
@@ -552,28 +633,16 @@ export function useResourceOperationActions(params) {
                 componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
                 key: labelKey,
             });
-            if (label)
-                return label;
-        }
-        // Custom operations (anything outside `CORE_OPERATION_LABEL_KEYS`) come
-        // from the application developer. Prefer the resource's generated
-        // per-operation TITLE (`resources.{res}.operations.{op}.title`) — the SAME
-        // label the form host, header, and launcher resolve via `tResourceOperation`
-        // — so a scope-level "Retry all" / "Purge all" reads correctly (and the
-        // CRITICAL type-to-confirm phrase is a real word, not a camelCase-mangled
-        // id). `tResourceOperation` returns '' (or the raw `resources.` key path)
-        // when the title is not generated yet, in which case we fall back to a
-        // humanized identifier so unregistered custom op ids remain visible and
-        // addressable instead of vanishing.
-        //
-        // Examples: `switch_mode` → "Switch mode", `regenerate_secret` →
-        // "Regenerate secret", `retry_all` → "Retry all" (or generated title).
-        const generatedTitle = tResourceOperation(resourceType, opId, 'title');
-        if (generatedTitle && !generatedTitle.startsWith('resources.')) {
-            return generatedTitle;
+            // A core operation's label is framework-declared, so a miss here is a GAP and renders as
+            // its key (#1414) — it never falls through to the custom-operation chain below.
+            return label;
         }
-        return opId.charAt(0).toUpperCase() + opId.slice(1).replace(/_/g, ' ').toLowerCase();
-    }, [tComponent, tResourceOperation, resourceType]);
+        // Custom operations (anything outside `CORE_OPERATION_LABEL_KEYS`) come from the application
+        // developer: their generated title, else their identifier. Shared with the CRITICAL
+        // type-to-confirm phrase on the form and zero-input paths, so the phrase a person is asked to
+        // type is the name the button showed them.
+        return resolveOperationDisplayTitle(tResourceOperation, resourceType, opId);
+    }, [tComponent, tResourceOperation, tResourceFieldDisplay, resourceType]);
     // Resolve icon for an operation
     const getOperationIcon = useCallback((operation) => {
         return renderIcon({
@@ -593,6 +662,92 @@ export function useResourceOperationActions(params) {
         const opId = resolveEffectiveCoreOperationFromOperation(operation) ?? String(operation.operationIdentifier);
         return DEFAULT_DISPLAY_PRIORITIES[opId] ?? DEFAULT_CUSTOM_OPERATION_PRIORITY;
     }, []);
+    /**
+     * WHY an action whose condition is not met cannot run — the explanation an unavailable action owes.
+     *
+     * The reason comes from the application when it wrote one (`operations.<op>.unavailableReason`,
+     * generated from the operation specification's `unavailableWhen`), and otherwise from the
+     * framework's own generic line, so the bar never falls silent. For a bulk action judged per row it
+     * leads with the count ("2 of 5 selected…") and, when some rows DO qualify, offers to keep only
+     * those: a bulk action is all-or-nothing, and narrowing is the one-click way through it.
+     *
+     * Feature-gated unavailability is not handled here — it has its own upgrade/contact affordance.
+     */
+    const isOperationRunning = useCallback((operation) => runningOperationKeys.has(ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(operation)), [runningOperationKeys]);
+    /**
+     * Does the current selection exceed what one request of this BULK operation may name? The limit is
+     * enforced by the bulk request schema (`resolveBulkOperationMaxSelection`); asking here too means the
+     * bar says so before anyone clicks, instead of a refused request after.
+     */
+    /**
+     * How many rows a bulk action would touch.
+     *
+     * Read by the batch-limit check, the unavailability wording and the confirmation's consequence
+     * line — three sites, so it is one function rather than three spellings. Under a cross-page
+     * selection the number is what the LISTING reported, because the client has no rows to count.
+     */
+    const resolveSelectionCount = useCallback(() => (matchAllSelection?.matchedCount ?? selectionObjects?.length ?? selectedItemIds?.length ?? 0), [matchAllSelection, selectedItemIds, selectionObjects]);
+    const exceedsBulkLimit = useCallback((operation) => {
+        if (operation.isBulkOperation !== true)
+            return false;
+        return resolveSelectionCount() > resolveBulkOperationMaxSelection(operation);
+    }, [resolveSelectionCount]);
+    const buildUnavailability = useCallback((operation, entry) => {
+        if (exceedsBulkLimit(operation)) {
+            return {
+                reason: resolveComponentLabel({
+                    tComponent,
+                    componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                    key: 'bulkSelectionTooLarge',
+                    params: {
+                        maxSelection: resolveBulkOperationMaxSelection(operation),
+                        selectedCount: resolveSelectionCount(),
+                    },
+                }),
+            };
+        }
+        if (entry.isEnabled)
+            return undefined;
+        if (entry.featureAvailability && !entry.featureAvailability.isAvailable)
+            return undefined;
+        const opId = String(operation.operationIdentifier);
+        const authored = tResourceOperation(resourceType, opId, ResourceOperationTextSlot.UNAVAILABLE_REASON);
+        const specificReason = authored && !authored.startsWith('resources.') ? authored : undefined;
+        const ineligible = entry.ineligibleSelectionIndices;
+        if (operation.isBulkOperation === true && ineligible && ineligible.length > 0 && selectionObjects?.length) {
+            const countLine = resolveComponentLabel({
+                tComponent,
+                componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                key: 'unavailableForSelection',
+                params: { ineligibleCount: ineligible.length, selectedCount: selectionObjects.length },
+            });
+            const ineligibleSet = new Set(ineligible);
+            const eligibleRows = selectionObjects.filter((_, index) => !ineligibleSet.has(index));
+            return {
+                reason: specificReason ? `${countLine} ${specificReason}` : countLine,
+                ...(eligibleRows.length > 0 && onSelectionNarrow
+                    ? {
+                        resolve: {
+                            label: resolveComponentLabel({
+                                tComponent,
+                                componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                                key: 'keepEligibleOnly',
+                                params: { eligibleCount: eligibleRows.length },
+                            }),
+                            onSelect: () => onSelectionNarrow(eligibleRows),
+                        },
+                    }
+                    : {}),
+            };
+        }
+        return {
+            reason: specificReason ?? resolveComponentLabel({
+                tComponent,
+                componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                key: 'unavailableForItem',
+            }),
+        };
+    }, [exceedsBulkLimit, onSelectionNarrow, resourceType, selectedItemIds, selectionObjects, tComponent, tResourceOperation]);
     // Get full operation enabled entry (enabled status + feature availability)
     const getOperationEntry = useCallback((operation) => {
         const operationKey = buildOperationEnabledKey(operation);
@@ -661,7 +816,7 @@ export function useResourceOperationActions(params) {
         const exportConfig = resolveCollectionExportConfig(operation);
         const httpClient = applicationRef.current?.httpClient;
         if (!exportConfig || !httpClient) {
-            notificationRef.current?.notifyError?.('This export is not available here.');
+            notificationRef.current?.notifyError?.(tComponent(FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, 'collectionExportUnavailable'));
             return;
         }
         // REFUSE rather than export the wrong thing. When the listing is showing text-search results it
@@ -672,7 +827,7 @@ export function useResourceOperationActions(params) {
         const listingQueryNow = collectionExportQueryRef.current;
         const exportsSearchResults = operation.resourceOperationLike === CoreResourceOperation.SEARCH;
         if (listingQueryNow?.isSearchActive && !exportsSearchResults) {
-            notificationRef.current?.notifyError?.('Clear the search box before exporting — this export covers filters and sorting, not text search.');
+            notificationRef.current?.notifyError?.(tComponent(FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, 'collectionExportClearSearch'));
             return;
         }
         const { format, rowScope } = selection;
@@ -698,7 +853,7 @@ export function useResourceOperationActions(params) {
                 : listingQueryNow?.params,
         });
         if (!url) {
-            notificationRef.current?.notifyError?.('This export cannot be addressed from here.');
+            notificationRef.current?.notifyError?.(tComponent(FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, 'collectionExportUnaddressable'));
             return;
         }
         try {
@@ -713,8 +868,9 @@ export function useResourceOperationActions(params) {
         }
         catch (error) {
             // The backend REFUSES rather than truncating when an export exceeds its declared ceiling, so a
-            // failure here is a message worth showing — silently doing nothing would read as a dead button.
-            notificationRef.current?.notifyError?.(error instanceof Error && error.message ? error.message : 'The export could not be produced.');
+            // failure here is worth showing — silently doing nothing would read as a dead button. The refusal's
+            // reference resolves to its localized explanation; the error's own `message` is never shown.
+            notificationRef.current?.notifyError?.(toUserFacingErrorMessage(error, tComponent(FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS, 'collectionExportFailed')));
         }
     }, [
         registry,
@@ -723,12 +879,19 @@ export function useResourceOperationActions(params) {
         contextResourceIdentifiers,
         contextualParameters,
         stableParentResourcesRequirements,
+        tComponent,
+        toUserFacingErrorMessage,
         // `collectionExportQuery` is deliberately ABSENT: it is read through its ref above, so listing it
         // here would rebuild every export button on every keystroke in a filter for no behavioural gain.
     ]);
     const handleExecuteOperation = useCallback(async (operation) => {
         if (!resourceConfig)
             return;
+        const runningKey = ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(operation);
+        if (runningOperationKeysRef.current.has(runningKey))
+            return;
+        runningOperationKeysRef.current.add(runningKey);
+        setRunningOperationKeys(new Set(runningOperationKeysRef.current));
         setIsExecuting(true);
         try {
             const operationPathKey = ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(operation);
@@ -743,11 +906,15 @@ export function useResourceOperationActions(params) {
             const rowTargetId = rowTargetField
                 ? frontendResourceUtils.getResourceId(contextResourceIdentifiersWithIdEvidence[resourceType])
                 : '';
-            const requestData = isBulk && selectedItemIds?.length
-                ? buildBulkOperationSelectorPayload(selectedItemIds)
-                : rowTargetField && rowTargetId
-                    ? { [rowTargetField]: rowTargetId }
-                    : undefined;
+            const requestData = isBulk && matchAllSelection
+                // A cross-page selection names the LISTING, never an id list: the client never loaded the
+                // population. The server re-evaluates it under the same scope as that listing.
+                ? buildBulkOperationMatchPayload(matchAllSelection)
+                : isBulk && selectedItemIds?.length
+                    ? buildBulkOperationSelectorPayload(selectedItemIds)
+                    : rowTargetField && rowTargetId
+                        ? { [rowTargetField]: rowTargetId }
+                        : undefined;
             // A row-targeted action MUST resolve the clicked row's id (it is injected
             // into the request body). If it cannot, fail loudly through the catch below
             // rather than POST an empty body the backend rejects as not-found. In
@@ -765,15 +932,34 @@ export function useResourceOperationActions(params) {
             // single NOTIFY_RESOURCE_ERROR toast. Suppress the global error toast so
             // action-bar operations (delete, custom, bulk) match the form's model.
             { silent: true });
+            // An ACCEPTED action has not run yet, and must not be reported as though it had.
+            //
+            // A background or queued runtime answers before the write happens (#1461). The rows then
+            // change one at a time, each carrying its own resource-room sync event, so the listing
+            // updates itself while the job runs — what the person needs here is to be told that this is
+            // what is happening, in their own language, from the label tree. The engine used to answer
+            // with the English sentence "Job has been queued for background processing" and this surface
+            // showed it verbatim as a SUCCESS toast; both halves are gone.
+            const backgroundAcceptance = readBackgroundAcceptance(result);
+            if (backgroundAcceptance) {
+                setAcceptedBackgroundRun({ jobId: backgroundAcceptance.jobId, attemptedCount: resolveSelectionCount() });
+                notificationRef.current?.notifyInfo(resolveComponentLabel({
+                    tComponent,
+                    componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                    key: 'operationRunningInBackground',
+                }));
+            }
             // Surface any human summary the action returned ("Re-queued 3 of 5; skipped
             // 2", "Purged N entries") as a success toast. Best-effort: fires only when a
             // NotificationProvider is mounted (see `notificationRef`) and the result is a
             // plain object carrying a non-empty string `message`. This is the ONLY path
             // that surfaces a custom op's response message — the resource-notification
             // event path resolves the operation title, not the response body.
-            const resultMessage = result && typeof result === 'object' && !Array.isArray(result)
-                ? result.message
-                : undefined;
+            const resultMessage = backgroundAcceptance
+                ? undefined
+                : result && typeof result === 'object' && !Array.isArray(result)
+                    ? result.message
+                    : undefined;
             if (typeof resultMessage === 'string' && resultMessage.length > 0) {
                 notificationRef.current?.notifySuccess(resultMessage);
             }
@@ -785,11 +971,10 @@ export function useResourceOperationActions(params) {
                     contextResourceIdentifiers: contextResourceIdentifiersWithIdEvidence,
                     resourceType,
                     result,
+                    isBulkOperation: operation.isBulkOperation === true,
                 });
                 const outcomeContextualParameters = FrontendResourceUtils.buildContextualParameters(normalizedOutcomeContext, registry);
-                const resultSummary = typeof result === 'object' && result !== null
-                    ? result
-                    : undefined;
+                const resultSummary = toOperationResultSummary(result);
                 if (!isWebSocketConnectedRef.current && shouldEmitResourceRefreshAfterDirectOperation(operation)) {
                     const listOperations = getOperationsForCoreSemantic(resourceConfig.operations ?? [], CoreResourceOperation.LIST).filter((listOperation) => operationInitiatorParametersSatisfied(listOperation, contextResourceIdentifiersWithIdEvidence, contextualParameters));
                     const { [resourceType]: _self, ...parentScopeIdentifiers } = normalizedTransportContext;
@@ -903,14 +1088,18 @@ export function useResourceOperationActions(params) {
                 contextResourceIdentifiers: normalizeContextResourceIdentifiersForTransport(contextResourceIdentifiersWithIdEvidence),
                 parentResourcesRequirements: stableParentResourcesRequirements,
                 additionalContext: {
-                    error: failure.message ?? (err instanceof Error ? err.message : String(err)),
+                    error: failure.message ?? (describeCaughtError(err)),
                     errorCustomMessageReference: failure.customMessageReference,
                     errorHttpStatus: failure.httpStatus,
+                    // The declared refusal the server named in `details.code` (#1048).
+                    errorRefusalCode: describeResourceErrorForNotification(err).errorRefusalCode,
                 },
             });
         }
         finally {
             setIsExecuting(false);
+            runningOperationKeysRef.current.delete(runningKey);
+            setRunningOperationKeys(new Set(runningOperationKeysRef.current));
         }
     }, [
         resourceConfig,
@@ -1011,27 +1200,72 @@ export function useResourceOperationActions(params) {
             // double-validation on the form submit instead — see
             // settings-hub-framework-topics.md Topic 2.)
             const requiresTypedConfirmation = riskLevel === ResourceOperationRiskLevel.CRITICAL;
+            // The consequence, specifically (NN/g: say what will happen, never "are you sure?"): how many
+            // rows a bulk action touches, and — only when true — that it cannot be undone. A risky action
+            // that CAN be undone used to be told "This action cannot be undone" by the dialog's generic
+            // line; it now gets no line rather than a false one.
+            const selectedCount = operation.isBulkOperation === true ? resolveSelectionCount() : 0;
+            const consequenceLines = [
+                selectedCount > 0
+                    ? resolveComponentLabel({
+                        tComponent,
+                        componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                        key: 'confirmAppliesToSelection',
+                        params: { count: selectedCount },
+                    })
+                    : undefined,
+                isIrreversibleOperation(operation)
+                    ? resolveComponentLabel({
+                        tComponent,
+                        componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                        key: 'confirmCannotBeUndone',
+                    })
+                    : undefined,
+            ].filter((line) => Boolean(line));
             setConfirmState({
                 open: true,
                 label: confirmLabel,
                 requiresTypedConfirmation,
                 confirmationPhrase: requiresTypedConfirmation ? getOperationLabel(operation) : '',
+                description: consequenceLines.length > 0 ? consequenceLines.join(' ') : null,
+                confirmLabel: getOperationLabel(operation),
                 callback: () => handleExecuteOperation(operation),
             });
             return;
         }
         // Non-risky executable operations — execute directly
         handleExecuteOperation(operation);
-    }, [handleNavigateOperation, handleExecuteOperation, tComponent, getOperationLabel]);
+    }, [handleNavigateOperation, handleExecuteOperation, tComponent, getOperationLabel, selectionObjects, selectedItemIds]);
+    /**
+     * The click handler for an action the bar CANNOT anchor a panel to — a sub-item inside a
+     * subgroup's dropdown, which is portalled and has no trigger of its own to hang a popover from.
+     *
+     * `handleOperationClick` answers a POPOVER by naming which operation is open and returning; the
+     * panel itself is rendered by the BAR, against the item's own trigger. Where no such trigger
+     * exists that is a button that sets a flag nobody reads — a dead control. This routes the same
+     * presentation to its documented degrade instead (`resolveActionPresentationTransition` maps
+     * POPOVER to an OVERLAY, never to the page the ordinary chain would otherwise produce).
+     *
+     * The single-variant branch already did exactly this through its `anchoredPanel ? … : …` ternary.
+     * This exists so the subgroup branch stops being the one place the rule is not applied — it was
+     * latent while nothing DERIVED a popover, and became reachable the moment the derivation did.
+     */
+    const handleUnanchorableOperationClick = useCallback((operation) => {
+        if (resolveResourceOperationActionPresentation(operation) === ResourceOperationActionPresentation.POPOVER) {
+            handleNavigateOperation(operation);
+            return;
+        }
+        handleOperationClick(operation);
+    }, [handleNavigateOperation, handleOperationClick]);
     // Confirmation dialog handlers
     const onConfirm = useCallback(async () => {
         if (confirmState.callback) {
             await confirmState.callback();
         }
-        setConfirmState({ open: false, label: '', requiresTypedConfirmation: false, confirmationPhrase: '', callback: null });
+        setConfirmState({ open: false, label: '', requiresTypedConfirmation: false, confirmationPhrase: '', description: null, confirmLabel: '', callback: null });
     }, [confirmState.callback]);
     const onCancel = useCallback(() => {
-        setConfirmState({ open: false, label: '', requiresTypedConfirmation: false, confirmationPhrase: '', callback: null });
+        setConfirmState({ open: false, label: '', requiresTypedConfirmation: false, confirmationPhrase: '', description: null, confirmLabel: '', callback: null });
     }, []);
     const onEphemeralAcknowledge = useCallback(() => {
         setEphemeralFields(null);
@@ -1053,7 +1287,31 @@ export function useResourceOperationActions(params) {
      * panel where it cannot present it and falls back to the item's `onClick`.
      */
     const buildAnchoredPanel = useCallback((operation, label) => {
-        if (resolveResourceOperationActionPresentation(operation) !== ResourceOperationActionPresentation.POPOVER) {
+        const presentation = resolveResourceOperationActionPresentation(operation);
+        /*
+         * INLINE degrades to an ANCHORED PANEL here, not to an overlay — and this is where the two
+         * non-navigating presentations meet.
+         *
+         * `INLINE` asks the ELEMENT being acted on to become the form, which needs a row to transform.
+         * The same action also renders where there is none: a detail page, a danger zone, a picker, and
+         * — the case that made this visible — the BULK bar, where the action targets N rows and so has
+         * no single one to become a form. Its documented degrade was an overlay, which covers the very
+         * list the presentation exists to keep visible, and for a bulk "change status to…" that is a
+         * full dialog for one dropdown.
+         *
+         * A panel anchored to the button that was clicked keeps the promise INLINE was making — the
+         * collection stays visible, nothing is pushed, nothing to navigate back from — and it is
+         * strictly closer to the authored intent than an overlay. The overlay is still the degrade
+         * BELOW this one: a bar that cannot anchor at all (overflow menu, subgroup) takes the item's
+         * `onClick`, which navigates.
+         *
+         * Note the two predicates must agree, and do by construction: this decides whether an item
+         * CARRIES a panel, and the click handler's INLINE branch tries the element host first and
+         * falls through to `onClick` only where no panel was built.
+         */
+        const wantsAnchoredPanel = presentation === ResourceOperationActionPresentation.POPOVER
+            || (presentation === ResourceOperationActionPresentation.INLINE && !inPlaceHost.isAvailable);
+        if (!wantsAnchoredPanel) {
             return undefined;
         }
         if (!resourceConfig) {
@@ -1071,7 +1329,7 @@ export function useResourceOperationActions(params) {
                 onDismiss: dismiss,
             }),
         };
-    }, [resourceConfig, openPopoverOperationKey, buildOperationContext, navigationZone]);
+    }, [resourceConfig, openPopoverOperationKey, buildOperationContext, navigationZone, inPlaceHost.isAvailable]);
     // ─── Step 3: Build ActionBarItem[] from filtered & enabled operations ───
     const items = useMemo(() => {
         if (!resourceConfig)
@@ -1144,16 +1402,36 @@ export function useResourceOperationActions(params) {
             const icon = getOperationIcon(defaultVariant);
             const label = getOperationLabel(defaultVariant);
             const priority = getDisplayPriority(defaultVariant);
-            // Placement: explicit `actionPlacement` override wins; otherwise derive from
-            // risk (HIGH/CRITICAL trail in the danger zone). Tagged on every emitted item
-            // via `_group`, consumed by the group-then-priority sort below.
+            // Placement: explicit `actionPlacement` override wins; otherwise the danger zone takes what is
+            // both RISKY and IRREVERSIBLE. Tagged on every emitted item via `_group`, consumed by the
+            // group-then-priority sort below.
+            //
+            // ## The second conjunct is new, and the first alone was wrong
+            //
+            // This read `isRiskyOperation(riskLevel)` alone, which made risk the sole membership test for
+            // the one surface that exists to mark the point of no return. Measured 2026-09-19 over
+            // `engine/saas-models`: of 150 HIGH/CRITICAL variants the owning verbs are 48 DELETE — and
+            // then 29 UPDATE_MANY, 14 CREATE, 9 UPDATE, plus `RESTORE`, `APPROVE`, `GRANT_OWNERSHIP`,
+            // `VERIFY_DOMAIN` and `GENERATE_TOKEN`. So a CREATE sat under a red button in a section headed
+            // "Danger Zone", and so did RESTORE, whose entire purpose is to undo a deletion.
+            //
+            // The pane that made it visible was Administration → Entitlements, where the primary verb —
+            // **Edit** — rendered as a red destructive button under "This action may cause significant
+            // disruption and be difficult to reverse", a sentence two of the three buttons beside it also
+            // carried. A heading that admits everything promises nothing.
+            //
+            // Risk still does its own job here: it picks the destructive COLOUR two lines above, and it
+            // keeps a LOW-risk delete (a draft, a scratch row) out of a section reserved for consequential
+            // acts. What it no longer does alone is decide permanence, which was never its question.
             const placement = defaultVariant.operationFrontendConfig?.actionPlacement
-                ?? (isRiskyOperation(riskLevel) ? ActionPlacement.DANGER_ZONE : ActionPlacement.PRIMARY);
+                ?? ((isRiskyOperation(riskLevel) && isIrreversibleOperation(defaultVariant))
+                    ? ActionPlacement.DANGER_ZONE
+                    : ActionPlacement.PRIMARY);
             // Surface filter: the main bar requests PRIMARY, the danger-zone section
             // requests DANGER_ZONE; omitted returns both (separated).
             if (placementFilter && placement !== placementFilter)
                 continue;
-            const disabled = !entry.isEnabled;
+            const disabled = !entry.isEnabled || exceedsBulkLimit(defaultVariant);
             // ── Feature-aware behavior switch ──
             // When disabled due to feature unavailability, apply the appropriate behavior
             if (disabled && entry.featureAvailability && !entry.featureAvailability.isAvailable) {
@@ -1274,6 +1552,8 @@ export function useResourceOperationActions(params) {
                         : () => handleOperationClick(defaultVariant),
                     ...(anchoredPanel ? { popover: anchoredPanel } : {}),
                     disabled,
+                    ...(disabled ? withUnavailability(buildUnavailability(defaultVariant, entry)) : {}),
+                    ...(isOperationRunning(defaultVariant) ? { busy: true } : {}),
                     _priority: priority,
                     _group: placement,
                     riskLevel,
@@ -1302,8 +1582,9 @@ export function useResourceOperationActions(params) {
                             variant: riskLevelToVariant(vRisk),
                             riskLevel: vRisk,
                             operationIdentifier: String(v.operationIdentifier),
-                            onClick: () => handleOperationClick(v),
-                            disabled: !vEntry.isEnabled,
+                            onClick: () => handleUnanchorableOperationClick(v),
+                            disabled: !vEntry.isEnabled || exceedsBulkLimit(v),
+                            ...(!vEntry.isEnabled || exceedsBulkLimit(v) ? withUnavailability(buildUnavailability(v, vEntry)) : {}),
                             ...(vEntry.featureAvailability && !vEntry.featureAvailability.isAvailable
                                 ? {
                                     featureLocked: true,
@@ -1314,13 +1595,23 @@ export function useResourceOperationActions(params) {
                 });
                 const subgroupDisabled = !entry.isEnabled && subItems.every((item) => item.disabled === true);
                 if (subItems.length === 0) {
+                    // Every non-default variant was hidden, so this renders as a PLAIN button — which means
+                    // it can anchor, and must be built like the single-variant branch above. Wiring it
+                    // straight to `handleOperationClick` left a derived POPOVER setting a flag with no panel
+                    // to read it.
+                    const soleAnchoredPanel = buildAnchoredPanel(defaultVariant, label);
                     actionItems.push({
                         type: 'button',
                         icon,
                         label,
                         variant,
-                        onClick: () => handleOperationClick(defaultVariant),
+                        onClick: soleAnchoredPanel
+                            ? () => handleNavigateOperation(defaultVariant)
+                            : () => handleOperationClick(defaultVariant),
+                        ...(soleAnchoredPanel ? { popover: soleAnchoredPanel } : {}),
                         disabled,
+                        ...(disabled ? withUnavailability(buildUnavailability(defaultVariant, entry)) : {}),
+                        ...(isOperationRunning(defaultVariant) ? { busy: true } : {}),
                         _priority: priority,
                         _group: placement,
                         riskLevel,
@@ -1429,8 +1720,20 @@ export function useResourceOperationActions(params) {
         getDisplayPriority,
         isOperationEnabled,
         getOperationEntry,
+        buildUnavailability,
+        exceedsBulkLimit,
+        isOperationRunning,
         handleOperationClick,
+        handleUnanchorableOperationClick,
         handleNavigateOperation,
+        // `buildAnchoredPanel` is what carries a POPOVER item's `open` state into `items`: it is rebuilt
+        // whenever `openPopoverOperationKey` changes, and this memo reads it. It was missing (#1041), so
+        // `onOpenChange(true)` set the key, the callback was rebuilt, and this memo handed back the cached
+        // items whose `popover.open` was still the first render's `false` — the panel was frozen closed
+        // for as long as the other dependencies stayed stable, which on a detail page is indefinitely.
+        // The unit pin passed only because its fixture rebuilt every param per render, recomputing the
+        // memo for an unrelated reason; the stable-params pin beside it is what holds this line.
+        buildAnchoredPanel,
         // The export buttons close over this callback directly (each menu item carries its own
         // selection). It is stable now that the listing query is read through a ref, so this entry is
         // correctness-by-declaration rather than load-bearing — and it must stay: dropping it would make
@@ -1444,11 +1747,14 @@ export function useResourceOperationActions(params) {
         items,
         isConfirmDialogOpen: confirmState.open,
         confirmDialogLabel: confirmState.label,
+        confirmDialogDescription: confirmState.description,
+        confirmDialogConfirmLabel: confirmState.confirmLabel,
         confirmRequiresTypedConfirmation: confirmState.requiresTypedConfirmation,
         confirmConfirmationPhrase: confirmState.confirmationPhrase,
         onConfirm,
         onCancel,
         isExecuting,
+        acceptedBackgroundRun,
         ephemeralFields,
         onEphemeralAcknowledge,
     };