portal-mojo 0.2.21 → 0.2.23

package/docs/ModelTable.md

@@ -174,6 +174,17 @@ The table retains native row/cell semantics.
 (`__gte`), `daterange` (the `dr_*` triple). Applied filters render as
 editable pills; presets are param bundles with DERIVED active state.
 
+**The selected preset owns its keys.** While a preset matches, its params
+render no pill and don't count on the Filter button, and every Clear (the
+pill row's Clear all, the Filter menu's, the empty state's) keeps them —
+the segment is the one control for them. So a `defaultParams` default that
+matches a preset (`{ status: 'submitted' }` beside a "Submitted" preset)
+shows as the highlighted segment, never as a removable pill. Filters added
+on top still pill. The Filter menu keeps its check on an owned key's
+definition; editing it there changes the value, the preset stops matching,
+and the pill returns. A default with NO matching preset is still a plain
+removable pill; scope that must never be removable is `fixedParams`.
+
 ## Selection + batch
 
 `selectable` renders checkboxes independently of `batchActions` (decoupled

package/docs/admin-assistant.md

@@ -15,24 +15,44 @@ Assistant permissions and member/group grants cannot satisfy it. The server
 also rejects confined ApiKey/GroupScopedToken sessions and enforces person
 ownership; the client does not invent a broader per-user-key ban.
 
-The basic section shows deployment readiness, exact provider/model/key
-selection, Automatic — latest Sonnet or an explicit manual pin, credential source and optional server hint, blank replacement input,
-Check and save key, Check current key and enable/disable. A configured key and
-an enabled switch do not prove readiness. `route.ready` describes configuration,
-not current provider health. Unknown routes remain unknown: a missing
-credential can cause the backend to omit the entire route. Only an explicit
-`handler` route points to the Platform credential section. Bedrock uses AWS
-identity from deployment. Assistant, Platform and AWS credentials never
-substitute for one another. Missing Assistant/realtime applications are also
-reported. Runtime model identifiers preserve provider punctuation, including
-Bedrock colons; only a manual pin uses the backend's restricted pin syntax.
-
-Advanced native details separate Platform credentials, deployed policy/safety,
-remote access/connections and incident triage. Policy activation acknowledges
-the deployed policy on this node, does not edit it and never establishes
-fleet-wide agreement. Static, database and effective emergency stops are
-separate; only the database switch is writable. Activation and breaker reset
-cannot release a stop.
+The page separates **AI Assistant** from **MCP connections** with two task
+tabs. AI Assistant is the built-in provider-backed chat and incident processing;
+MCP serves tools to external agents that bring their own AI. MCP does not
+require an Assistant provider key, model selection, policy acknowledgement or
+enabled chat switch. The MCP tab shows its address, independent access switch,
+public discovery check and connections directly; AI readiness warnings remain
+in the AI tab. Ordinary reads probe neither provider nor public discovery.
+
+The AI tab starts with a compact status overview: the enabled switch, current
+provider/model and selected connection, followed by Safety & usage and Incident
+triage. Configure model and Manage keys open focused native dialogs. The API
+keys dialog separates Assistant and Platform keys with two task tabs; Safety &
+usage separates Policy & stops from Usage & recovery. Incident triage is a
+direct dialog. Keyboard-accessible info icons hold catalogue metadata,
+credential explanations, policy/admission diagnostics, connection dates and
+the triage watermark. Errors, failed checks, emergency stops and operation
+consequences stay visible beside their actions. No expandable sections or
+single-item side navigation are used.
+
+A configured key and enabled switch do not prove readiness. `route.ready`
+describes configuration, not current provider health. Unknown routes remain
+unknown: a missing credential can cause the backend to omit the entire route.
+A handler route opens Manage keys on Platform key. Bedrock uses deployment AWS
+identity; the key dialog explains that browser keys cannot configure it.
+Assistant, Platform and AWS credentials never substitute for one another.
+Missing Assistant/realtime applications are reported. Runtime model identifiers
+preserve provider punctuation, including Bedrock colons; only a manual pin uses
+the backend's restricted pin syntax.
+
+Policy activation acknowledges the deployed policy on this node, does not edit
+it and never establishes fleet-wide agreement. Static, database and effective
+emergency stops are separate; only the database switch is writable. Activation
+and breaker reset cannot release a stop. Destructive and consequential actions
+use a nested confirmation, initially focused on Cancel. During an operation,
+repeat submission, task tabs and native Escape/backdrop/close are locked. Cancel
+returns to the task without making a request. Closing a task or changing key
+types clears unsaved secret drafts; reopening model selection restores the
+saved value. All dialogs unmount with the owner/session boundary.
 
 Model selection controls the protected runtime selection only when the backend
 returns a valid capability for the explicit Anthropic `auto:sonnet` policy.
@@ -42,8 +62,7 @@ unavailable until deployment removes that pin. Mode is authoritative even when
 a fixed route retains an inert legacy `selected` value.
 
 The exact resolved runtime identifier (`model.effective`) and source are
-separate from the selection draft and `route.ready`. Advanced → Deployed policy
-and safety contains the raw policy model and admission diagnostic. The additive
+separate from the selection draft and `route.ready`. Safety & usage → Policy & stops → the Deployed policy info icon contains the raw policy model and admission diagnostic. The additive
 `route.can_invoke` reports admission to the guarded request path: a cold
 automatic catalogue can admit a request while configuration readiness remains
 false. It does not prove that a usable model or healthy provider is ready.
@@ -78,7 +97,7 @@ changes conservatively discard it: the shared auth API cannot distinguish
 renewal from same-person replacement across tabs. A 440 uses the existing
 fresh-auth UI after clearing credential drafts; even successful reauthentication
 requires explicit re-entry/retry. No secret is silently replayed. Confirmation
-is page-local, focuses Cancel, and ends with the page/session scope.
+is a page-owned native dialog, focuses Cancel, and ends with the page/session scope.
 
 Protocol helpers are exported from `portal-mojo/admin/assistant`:
 `getAssistantSetup(options, probe?)`, `mutateAssistantSetup(action, options)`,
@@ -153,7 +172,7 @@ fake password `mojo`. No real credentials or deployment changes belong in demos.
 `verify:admin-assistant-setup` covers wire contracts, owner navigation/admission,
 projections and mounted auth/draft/confirmation/fresh-auth/transport/cache
 lifecycle; it is wired into `verify:release`. Browser checks separately establish
-both-theme layout, native details, keyboard controls and console behavior.
+both-theme layout, native dialogs, help popovers, keyboard controls and console behavior.
 
 ## Conversation transport
 
@@ -218,9 +237,42 @@ per-type schemas/caps; unknown/malformed blocks drop. Context references are
 inert and allowlisted. Action choices require confirmation, then their bounded
 value is sent attachment-free through the ordinary REST POST.
 
+## Management pages
+
+Conversations and Skills use a clean searchable list with URL-backed pagination
+and Refresh. Searches target conversation titles or skill names. Record details
+open in compact native dialogs without tabs or a side rail. Conversations label
+messages with their actual owner and compare the viewer separately; foreign
+history shows an explicit viewing-only notice and no composer. Owned history
+retains realtime/REST transport selection, completed attachments and no automatic
+resend after an unknown outcome. New conversations start from the app's Assistant
+button.
+
+Skill details show trigger phrases and readable ordered steps. Tool identifiers,
+dates and secondary explanations use info popovers. Automatic execution remains
+visibly called out: read-only steps can run automatically; changes still require approval. The sole lifecycle action deactivates/reactivates through the
+existing endpoint, then reloads authoritative state; no create/delete UI is added.
+
+The page lifetime is keyed to person, auth-session revision and global permissions.
+Late reads cannot replace newer results. Writes check live authority after auth
+preflight, use synchronous single-flight guards and lock native dismissal while
+pending. Private history/memory stays component-local. The Dashboard is unchanged.
+
 ## Memory
 
-Global and user tiers require the global Assistant grant. Group memory first chooses from a bounded normal `/api/group` request and supplies that id as normal request context (`?group=<id>`). A group id is never put in the memory body and ambient group state is never consulted. Keys are limited to 64 lowercase alphanumeric/colon/underscore/hyphen characters; values are limited to 500 characters.
+Global and user tiers require the global Assistant grant. Group memory first chooses from a searchable normal `/api/group` picker and supplies that id as normal request context (`?group=<id>`). A group id is never put in the memory body and ambient group state is never consulted. Keys start with a lowercase letter or number and are limited to 64 lowercase alphanumeric/colon/underscore/hyphen characters; values are limited to 500 characters.
+
+Memory uses Personal, Global and Group tabs because they select different
+Assistant audiences. Lists show saved values with Edit and Remove actions; Add
+opens a focused Key/Value dialog. Existing keys are immutable, duplicate new keys
+cannot overwrite a saved value, and changing audience/group discards unsaved
+drafts. The searchable group picker replaces the previous first-50 limit. Group
+membership checks remain explicit and inherited; missing/refused checks are
+visible. Members with the global Assistant grant can inspect group memory;
+editing additionally requires inherited member Assistant authority or superuser. Shared edits name their audience, removal names its key and audience and
+initially focuses Cancel. Writes keep errors in the dialog, retain drafts on
+refusal and never replay automatically. Refresh failures are distinct from empty
+memory. Saved entries are not silently truncated to the first 100.
 
 ## Shell ownership
 

package/docs/admin-dns-domains.md

@@ -1,92 +1,98 @@
 # Domains
 
-`DomainsPage` is the everyday global DNS inventory at `/dns/domains`, under the
-host Admin mount. Import it from `portal-mojo/admin/infrastructure`. It keeps
-`DomainModel`, the `admin:dns:domains` table persistence key and server search,
-provider/status filters, sorting and paging. Scope comes from each row's group
-or Platform; the active product group is never used.
-
-The header exposes **Register existing**, **Adopt**, and **Buy domain**. Register
-and Buy need global `sys.manage_dns | sys.security`. Adopt also needs literal
-`me.is_superuser === true`; the backend independently refuses noninteractive
-and key-backed authority. Viewer sessions can inspect domains, DNS records and
-certificates without mutation controls.
-
-## Explicit onboarding
-
-`showDomainOnboarding()` preserves its original menu. An optional
-`{ initialMode: 'menu' | 'register' | 'adopt' | 'purchase' }` opens a workflow
-directly. The page imports the dialog only after a button click.
-
-Register existing selects one authorized group from bounded
-`/api/dnsman/credential/group-choice`, then an active verified GoDaddy
-credential queried through `DnsCredentialModel` with exact group/provider and
-verification filters. No credential selector mounts before an explicit group.
-The selector remounts by group, clears its selection on group change and rejects
-resolved credentials from another group or unsupported/unusable credentials.
-There is no `/api/group` read, free-form group id, provider-secret input or
-provider-account enumeration. The exact normalized name is probed for ownership
-without spending money. The only body is `{ group, domain, credential }`.
-
-Adopt takes one normalized existing public zone name, then explicitly reviews
-that name and Platform scope before posting `{ domain }`. It never supplies
-`group` or `create_zone`, discovers inventory or assigns a tenant. Review and
-mutation guard native dialog dismissal; Cancel review performs no mutation.
-Registration/adoption use an immediate single-flight ref. An unknown outcome
-invalidates inventory and requires operator review before starting another flow.
-
-Buy preserves the bounded typed-TLD, prerequisite, tri-state search and durable
-ledger flow documented in [the registrar reference](admin-dns-registrar.md).
-The purchase body is exactly `{ group, purchase, confirm_token, confirm_domain,
-confirm_price }`. Name and decimal price come from the immutable validated quote,
-not editable confirmation inputs. The quote token is removed from its mounted
-ref before the operation and kept transient through `withFreshAuth`; only a 440
-may resume the identical body once. Cancelled step-up and other failures never
-replay. An attempted purchase is terminal in that mounted wizard and reconciles
-against the durable ledger, including ambiguous provider outcomes.
-
-## Inspection and registrar settings
-
-A row opens the standard `modal.detail` overview. Server-owned name, provider,
-status, scope, registration/expiry dates and redacted failure remain read-only.
-DNS Records is a direct shortcut for Route 53 and GoDaddy; Mojo explains its
-certificate-only limitation. Shortcuts derive their mount from the observed DNS
-route, so root, `/admin` and embedded prefixes work. Serving links explicitly
-navigate to the mount's sibling `/edge/vhosts`; they are outside the registry
-whose routes are relative to `/dns`.
-
-Only Route 53 managers receive **Registrar settings**. Its focused guarded native
-modal sends only changed boolean `auto_renew`/`privacy` fields to the existing
-generic domain save endpoint. It never edits group, credentials, raw metadata,
-protected fields or registrar contacts. Every attempted save authoritatively
-refetches and invalidates DomainModel, including rejection. HTTP success alone
-is not registrar success: a nonempty `last_error` stays visible with a historical
-warning and instructions to inspect the registrar. Uncertain writes keep the
-modal open, disable additional writes and require review. There is no automatic
-retry. GoDaddy registrar/privacy/WHOIS management remains in GoDaddy; Mojo is
-certificate-only. Unknown providers remain labeled and read-only.
-
-## Advanced validation
-
-**Domains → Advanced → Shared validation setup** opens without an existing
-domain, preserving external-domain consumer setup and controller review.
-Domain detail retains Advanced validation, DNS Records and Certificates sections,
-existing registered related links and the permission/readiness-gated setup action.
-Descriptor import/export, TLS paths and shared-validation protocol are unchanged.
-
-## Verification and showcase
-
-`verify-admin-domains.mjs` exercises the independent strict purchase peer,
-fresh-auth continuation/cancellation and ambiguous no-replay. Its central mock
-contract leg requires missing/mismatched name and decimal-price tuples to leave
-the quote unspent. `verify-admin-domains-mounted.mjs` mounts real wizard, picker,
-page and editor components to prove scope isolation, action authority, deliberate
-adoption, registrar reconciliation and mount-aware navigation. The closing browser
-pass supplies native focus, responsive layout and light/dark evidence.
-
-The focused **Admin → Domains** showcase uses mock manager, platform and viewer
-identities and preserves every earlier DNS showcase.
-
-### KISS presentation
-
-Domain/provider share one table cell. The page header owns registration/adoption/purchase; technical registrar facts are in Registration details. Provider warnings remain visible. See [visual QA](admin-presentation.md).
+Import `DomainsPage` from `portal-mojo/admin/infrastructure`. The global DNS
+inventory lives at the host's `/dns/domains` mount. Server search, filters,
+sort and paging stay on `DomainModel` with `admin:dns:domains` persistence.
+Scope comes from each row, never the active product group. An absent expiry
+means **Unknown**, not Never. Narrow layouts combine provider, scope and status
+under the name so the Records action stays visible.
+
+## Everyday tasks
+
+**Add domain** opens three explicit choices: **Connect GoDaddy domain**,
+**Buy domain**, and literal-superuser **Adopt Route 53 zone**. Purchasing has its
+own read-only ledger shortcut. **More domain actions → Shared validation setup**
+keeps external-domain/controller setup available without an existing domain.
+Viewers get inspection and Purchases; writes require global
+`sys.manage_dns | sys.security`. Platform adoption/assignment additionally require
+literal interactive `is_superuser`; backend gates remain authoritative.
+
+A row opens a compact native dialog with Overview, provider-applicable DNS
+records, Certificates, and manager Registration. It has no side rail or nested
+registration disclosure. Only the selected task mounts. The same record panel
+serves the standalone Records page; its type filter is controlled by that page's
+URL or locally when embedded. Serving is an explicit sibling route under the
+observed Admin mount. Extra registered domain links retain their own gates.
+
+## Connect, repair and adopt
+
+Connect selects one explicit authorized group through bounded
+`/api/dnsman/credential/group-choice`, then an active, verified GoDaddy
+credential in that exact group. Changing group clears credential state and
+fences late replies. **Link credential** opens the existing write-only credential
+editor locked to that group; a verified return resumes the same domain draft.
+There is no generic group list, free-form group id or provider-account discovery.
+The ownership probe sends exactly `{ group, domain, credential }` and spends no
+money. Domain names are normalized before submission.
+
+An existing GoDaddy domain with an unusable linked credential offers **Repair
+linked credential**. Rotation verifies the same credential/group, clears raw
+password refs, then refreshes safe credential and domain projections. This does
+not expose an arbitrary credential-FK reassignment: the backend has no same-group
+validation for that generic save. A domain with no linked credential cannot be
+silently attached to a newly linked one.
+
+Adoption reviews one exact existing public zone name and Platform scope before
+posting `{ domain }`. It never supplies `group`/`create_zone` or discovers the AWS
+account. Native dismissal is guarded during review and mutation. Cancel review
+writes nothing. Unknown onboarding outcomes require inventory/provider review;
+submitted forms never repeat their request.
+
+A Platform domain offers **Assign to group** to literal superusers. Choose the
+destination, review domain/from/to, and type the exact destination name. The UI
+checks current authority, current domain ownership and the exact authorized group
+again before `{ domain, group }`. Already-grouped rows never offer reassignment.
+A lost receipt retains **Refresh owner** and refuses replay, even if the fresh
+read still says Platform; a read cannot prove an older write has finished.
+
+All onboarding writes check their owner at the transport's `beforeSend` boundary,
+after any asynchronous auth refresh. Credential/purchase step-up continuations
+perform that same check. A replacement session never inherits old consent.
+
+## Registration
+
+Registration starts with an explicit manager-only **Read registration**. WHOIS
+contacts stay in the mounted dialog, outside Query, URLs, storage and logs.
+Route 53 DNS hosting alone never admits registrar edits: the returned registrar
+must identify Amazon Registrar/Route 53. Hosted-zone-only, unavailable or unknown
+registrations remain read-only. GoDaddy registration tasks hand off to its account;
+Mojo remains certificate-only. No manual Renew action is invented.
+
+Confirmed Route 53 registration offers focused settings and contacts dialogs.
+Auto-renew uses the existing best-effort boolean save; privacy uses its dedicated
+all-contact action. Fresh owner/registrar/value preflight precedes writes. Only
+live WHOIS readback can establish observed values; an accepted DB save is not
+provider proof. Unknown outcomes lock the submitted editor and never replay.
+An unchanged desired DB value may not re-run a failed model hook; the registrar
+account handoff remains available.
+
+Contact inspection groups identity, email/phone and postal address. Identical
+Registrant/Admin/Technical contacts share one view; differing contacts get useful
+role tabs. Editing keeps one draft across Contact/Address tabs. **Replace all
+contacts** explicitly replaces all three roles, matching the backend contract.
+Entering edit mode never submits. Registry extension fields are preserved locally.
+Pending operations guard tab switches, native dismissal and repeated writes.
+
+## Purchase and QA
+
+Buying is restricted to one quoted year until the backend binds multi-year
+payable totals. Privacy limits and acknowledged downgrades stay visible.
+See [registrar flows](admin-dns-registrar.md) for exact confirmation and recovery.
+
+`verify:admin-domains` includes delayed-auth transport fences.
+`verify:admin-domains-mounted` runs onboarding, assignment/filter/credential,
+registration and purchase/contact journey contracts, including StrictMode and
+stale-session/scope cases. JSDOM establishes behavior only. Closing acceptance
+uses actual Portal and built Showcase screenshots and interactions in light/dark,
+desktop and 390px; see [visual QA](admin-presentation.md). No live registrar
+purchase or infrastructure mutation is required for this mock acceptance.

package/docs/admin-dns-records.md

@@ -14,7 +14,7 @@ import {
 
 The one canonical DNS section is `id: "dns"`, `basePath: "dns"`, in Infrastructure. Its routes are ordered `domains`, `records`, `certificates`, `purchases`, `registrant`, `credentials`. The read surfaces accept the global, system-pinned any-of view clause `sys.view_dns | sys.manage_dns | sys.security`; registrant and record mutation controls use `sys.manage_dns | sys.security`. Group/member grants never open Admin.
 
-Domains uses the server-backed `DomainModel` list and `modal.detail`. Detail composes Overview, DNS Records, and the bounded Certificates section; Records is the same `DnsRecordsPanel` used by the standalone page. That page owns only `domain` and `record_type` in the URL. It may select the first active domain only when `domain` is absent. Invalid, denied, missing, and inactive deep links are preserved and shown as errors.
+Domains uses the server-backed `DomainModel` list and compact native task dialog. Detail composes Overview, applicable DNS records, bounded Certificates and manager Registration; Records is the same `DnsRecordsPanel` used by the standalone page. That page owns only `domain` and `record_type` in the URL. An embedded panel owns a local type filter when no controlled value is supplied. It may select the first active domain only when `domain` is absent. Invalid, denied, missing, and inactive deep links are preserved and shown as errors.
 
 ## Wire contract
 

package/docs/admin-dns-registrar.md

@@ -10,13 +10,28 @@ The wizard asks for one explicit group through bounded `/api/dnsman/credential/g
 
 `POST /registrar/quote` returns `{purchase,name,price,currency,years,token,expires,privacy_supported}`. The raw token lives only in an immutable ref in the mounted wizard. It is never state, URL data, Query/Mutation cache data, mock request history, or durable mock data. The exact tuple binds purchase id, token, group, normalized domain, years, decimal price, currency, and expiry. Any upstream change or expiry clears it.
 
-The operator types the exact normalized domain before the single-flight, nonretry `POST /registrar/purchase`. The token is removed from the ref before the request. Success and every exception reconcile through an imperative `GET /purchase/<id>?graph=default`; one non-overlapping bounded-backoff loop follows `submitted` to a durable terminal row. Timeout hands the operator to the ledger.
-
-After purchase is attempted, the wizard cannot retry or requote. A failed, ambiguous, or timed-out result always says that money may have moved and directs the operator to the AWS Route 53 Domains operation console and durable ledger first.
+The portal purchases **one year** only. The backend currently keeps raw TLD
+registration price separately from years, so the UI does not multiply it into an
+allegedly authoritative multi-year payable total. `privacy_supported` is part of
+the retained quote identity; an unsupported registry is explained before consent,
+and an acknowledged `privacy_downgraded` result stays visible.
+
+The operator types the exact normalized domain before the single-flight, nonretry `POST /registrar/purchase`. The token is removed from the ref before the request. Success and every exception reconcile through an imperative `GET /purchase/<id>?graph=default`; one non-overlapping bounded-backoff loop follows `submitted` to a durable terminal row. Timeout keeps exact **View purchase** and **Refresh** actions available. Each
+refresh reads the retained purchase ID and never submits another purchase. A
+completed receipt opens the acknowledged domain ID when available; the ledger
+graph has no domain FK, so other completed receipts use a mount-relative
+name-filtered inventory handoff.
+
+After purchase is attempted, the wizard cannot retry or requote. A final
+transport owner check runs after the asynchronous auth gate and before every
+permitted 440 continuation. Session replacement stops that continuation. Only
+the purchase ID/owner survives a same-user revision change, giving an exact-ID
+recovery view; a different user receives none of the previous recovery state. A failed, ambiguous, or timed-out result always says that money may have moved and directs the operator to the AWS Route 53 Domains operation console and durable ledger first.
 
 ## Purchase ledger
 
-`DomainPurchaseModel` lists only `graph=basic`: id, domain, status, price, and currency. Export/download and alternate graphs are rejected. Clicking a row performs an imperative default-graph read into a KISS modal; the detail response and redacted error are modal-local and never Query-cached.
+`DomainPurchaseModel` lists only `graph=basic`: id, domain, status, price, and currency. Export/download and alternate graphs are rejected. Clicking a row performs an imperative default-graph read into a focused modal
+with an exact-ID Refresh action; the detail response and redacted error are modal-local and never Query-cached.
 
 ## Registrant PII
 
@@ -24,6 +39,16 @@ The contact page starts with no scope and no contact. Operators explicitly choos
 
 An inherited group response renders a blank form and only the backend-authored boolean status; inherited values are never disclosed. Normal editable values may seed from that scope's database row or the House settings-file response. `Fax` and opaque `ExtraParams` are preserved only when the original response is a direct database row for the exact same scope. They are never carried across scope, inheritance, or deployment-file override boundaries.
 
+## Scoped purchase contact setup
+
+A missing-contact search offers **Set up contact** without discarding the explicit
+purchasing group or intended name. `RegistrantContactPage` accepts optional
+`initialGroup`, `lockScope`, `onSaved`, `onClose`, and `onBusyChange` for that
+focused native dialog. Reads are explicit manager-only, fenced by scope/session,
+and never Query-cached. Contact/Address tabs keep one draft; save returns to the
+same purchase search and rechecks scoped capabilities. There is no active-group
+fallback. The standalone page retains its explicit scope chooser.
+
 ## House adoption
 
 House adoption is a separate, literal-superuser-only menu option. The operator types one exact existing name and submits `/registrar/adopt` without `group`. The UI never calls `/registrar/discover`, auto-discovers account domains, or silently assigns the adopted asset to a tenant.

package/docs/admin-dns.md

@@ -89,9 +89,8 @@ rotation remains write-only and imperative. Built-in credential Delete is absent
 
 ## Shared wildcard validation
 
-Domains offers **Advanced → Shared validation setup** to global DNS
-managers even when server setup needs an operator. Domain detail includes
-read-only **Advanced validation**; its context action and Certificate Delegation compose
+Domains offers **More domain actions → Shared validation setup** to global DNS
+managers even when server setup needs an operator. Domain Overview offers the focused **Shared validation** action; Certificate Delegation composes
 the same focused flow. See [the human walkthrough and exact
 contracts](admin-dns-certificates.md#shared-validation-setup).
 

package/docs/admin-modals.md

@@ -25,6 +25,27 @@ omit deployment controls, and attempt viewers get a direct overview when there
 is no admitted node evidence. Workflow, integration, setup identity and profile
 editing use focused child dialogs. No shared DetailView default is changed.
 
+Domains uses a compact native task dialog with Overview, applicable DNS records,
+Certificates and manager Registration. Focused assignment, credential, registrar,
+contact and purchase-recovery dialogs guard their own pending operations. Read-only
+contact roles use tabs only when the returned contacts differ. This is scoped to
+Domains; the shared DetailView and Admin Dashboard remain unchanged.
+
+Assistant Setup separates AI Assistant and MCP connections as page tabs. Model,
+API keys, Safety & usage and Incident triage use focused page-owned native
+dialogs, with a nested confirmation for consequential actions. The page's live
+owner/session scope owns both layers, the single-flight operation lock guards
+native dismissal, and closing a task clears its unsaved secret drafts. MCP
+connection controls remain directly on their own page tab and do not depend on
+AI readiness. This changes neither shared DetailView nor Admin Dashboard.
+
+Assistant Conversations, Skills and Memory use focused page-owned native dialogs.
+History and skill details have no rail or gratuitous tabs. Memory's audience tabs
+remain on its page, with Add/Edit and named removal confirmation dialogs. The live
+person/session/permission and selected memory audience own their lifetime; pending
+writes block native dismissal. Foreign history has no composer and names the
+actual owner. This changes neither shared DetailView nor Admin Dashboard.
+
 Use `modal-pad`, `modal-title`, `modal-message`, grouped fields and `modal-actions`.
 Cancel precedes the primary button. Pending operations disable repeat submission;
 `canDismiss` also protects native Escape/backdrop dismissal during a write.

package/docs/menus-and-access.md

@@ -62,6 +62,30 @@ share one `/system` landing instead of emitting duplicate index routes.
 Generated Admin destinations are exact matched, so an embedded mount’s root
 Dashboard cannot remain selected on every nested page.
 
+### Everyday Admin navigation
+
+The built-in menu keeps the existing top-level Dashboard. Operations contains
+Fleet, Maintenance, Deployments, Jobs Dashboard and Scheduled Tasks. Scheduled
+Tasks stays primary because its audience can lack access to Jobs Dashboard. Domains & Hosting contains
+Domains, Certificates and Serving. Storage has its own group. Configuration
+contains GeoLocation and Settings. Purpose-specific dashboards are welcome;
+their labels identify the task and their content should not duplicate Admin
+Dashboard. These menu changes do not change Dashboard content.
+
+`AdminRoute.searchOnly` is presentation metadata, carried to `MenuItem.searchOnly`.
+Accordion menus show these secondary tools in navigation search and while that
+exact destination is active. Static menus keep all entries. Permission filtering
+happens before search; section/route clauses and literal-superuser gates still
+apply. All routes remain registered, including embedded mounts and direct links.
+
+Fleet exposes Configuration beside its capacity controls. Domains exposes
+Purchases and a More menu for DNS records, provider credentials and registrant
+contact; individual domain records retain their focused tasks. Serving links to
+Upstreams. Jobs Dashboard links to Jobs, Runners and Scheduled tasks, each with
+its own permission check. These contextual links are omitted when their target
+is absent from an embedded Admin mount. Secondary tools remain searchable by
+their full names without filling the ordinary sidebar.
+
 Import the route/menu machinery from `portal-mojo/admin/core`, then import only
 the registry domains the shell installs. The stable domains are `identity`,
 `security`, `observability`, `operations`, `infrastructure`, `communications`,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "portal-mojo",
-    "version": "0.2.21",
+    "version": "0.2.23",
     "description": "React portal toolkit for django-mojo — typed client + params store, mission-control UI, dependency-free SVG charts, admin section bundles.",
     "type": "module",
     "license": "Apache-2.0",

package/src/admin/assistant/AssistantFeed.tsx

@@ -1,6 +1,9 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import type { FileReference, RecordFeedItem } from '../../client/record-feed';
-import { AttachmentQueue, RecordFeed, fmt, modal, type AttachmentQueueState } from '../../ui';
+import { AttachmentQueue, type AttachmentQueueState } from '../../ui/AttachmentQueue';
+import { RecordFeed } from '../../ui/RecordFeed';
+import { filesize } from '../../ui/format';
+import { modal } from '../../ui/modal';
 import { isSafeCapabilityUrl, openCapabilityUrl } from '../storage/models';
 import type { AssistantBlock, AssistantMessage, AssistantUser } from './types';
 
@@ -9,12 +12,12 @@ function BlockView({ block, onAction, disabled }: { block: AssistantBlock; onAct
     if (block.type === 'chart') return <section className="assistant-block"><h4>{block.title ?? 'Chart data'}</h4><div className="assistant-chart" role="img" aria-label={`${block.chart_type} chart: ${block.title ?? 'Assistant chart'}`}>{block.labels.map((label, index) => <div key={`${label}:${index}`}><strong>{label}</strong>{block.series.map((series) => <span key={series.name}>{series.name}: {series.values[index]}</span>)}</div>)}</div></section>;
     if (block.type === 'stat' || block.type === 'list') return <section className={`assistant-block assistant-${block.type}`}><h4>{block.title ?? (block.type === 'stat' ? 'Summary' : 'Details')}</h4><dl>{block.items.map((item) => <div key={item.label}><dt>{item.label}</dt><dd>{String(item.value ?? '—')}</dd></div>)}</dl></section>;
     if (block.type === 'alert') return <section className={`assistant-block assistant-alert assistant-alert-${block.level}`} role={block.level === 'error' ? 'alert' : undefined}><strong>{block.title ?? block.level}</strong><p>{block.message}</p></section>;
-    if (block.type === 'file') return <section className="assistant-block assistant-file"><i className="bi bi-file-earmark-arrow-down" aria-hidden="true" /><span><strong>{block.filename}</strong><small>{[block.format, block.size != null ? fmt.filesize(block.size) : null, block.row_count != null ? `${block.row_count} rows` : null, block.expires_in].filter(Boolean).join(' · ')}</small></span>{isSafeCapabilityUrl(block.url) ? <button type="button" className="btn btn-compact" onClick={() => openCapabilityUrl(block.url, true)}>Download</button> : <span className="storage-unsafe">Unsafe URL withheld</span>}</section>;
+    if (block.type === 'file') return <section className="assistant-block assistant-file"><i className="bi bi-file-earmark-arrow-down" aria-hidden="true" /><span><strong>{block.filename}</strong><small>{[block.format, block.size != null ? filesize(block.size) : null, block.row_count != null ? `${block.row_count} rows` : null, block.expires_in].filter(Boolean).join(' · ')}</small></span>{isSafeCapabilityUrl(block.url) ? <button type="button" className="btn btn-compact" onClick={() => openCapabilityUrl(block.url, true)}>Download</button> : <span className="storage-unsafe">Unsafe URL withheld</span>}</section>;
     if (block.type === 'attachment') return <section className="assistant-block assistant-attachments" aria-label="Message attachments">{block.files.map((file) => <span className="assistant-attachment-chip" key={file.id}><i className="bi bi-paperclip" aria-hidden="true" /> <strong>{file.filename}</strong><small>{file.content_type}</small></span>)}</section>;
     if (block.type === 'context') return <section className="assistant-block"><h4>References</h4><ul>{block.references.map((reference) => <li key={`${reference.model}:${reference.pk}`}><code>{reference.model} #{reference.pk}</code>{reference.label ? ` — ${reference.label}` : ''}</li>)}</ul></section>;
     return <section className="assistant-block assistant-action"><h4>{block.title ?? 'Confirm action'}</h4>{block.description && <p>{block.description}</p>}<div className="assistant-action-row">{block.actions.map((action) => <button key={`${block.action_id ?? block.title}:${action.value}`} type="button" className="btn btn-compact" disabled={disabled} onClick={async () => { const confirmed = await modal.confirm({ title: `${action.label}?`, message: `Send “${action.value}” to the Assistant as your response?`, confirmText: action.label }); if (confirmed) await onAction(action.value); }}>{action.label}</button>)}</div></section>;
 }
-export function AssistantFeed({ messages, user, onSend, responding, disabled = false, attachmentKey = 'new' }: { messages: AssistantMessage[]; user: AssistantUser; onSend(text: string, attachments?: readonly FileReference[]): Promise<void>; responding: boolean; disabled?: boolean; attachmentKey?: number | string }) {
+export function AssistantFeed({ messages, user, onSend, responding, disabled = false, attachmentKey = 'new', viewerId = user.id, readOnly = false }: { messages: AssistantMessage[]; user: AssistantUser; onSend(text: string, attachments?: readonly FileReference[]): Promise<void>; responding: boolean; disabled?: boolean; attachmentKey?: number | string; viewerId?: number; readOnly?: boolean }) {
     const actionFlight = useRef(false);
     const [actionError, setActionError] = useState('');
     const [attachmentState, setAttachmentState] = useState<AttachmentQueueState>({ files: [], busy: false });
@@ -25,5 +28,5 @@ export function AssistantFeed({ messages, user, onSend, responding, disabled = f
     const sendAction = async (value: string) => { if (actionFlight.current || responding || disabled) return; actionFlight.current = true; setActionError(''); try { await onSend(value, []); } catch (error) { setActionError(error instanceof Error ? error.message : 'Action response failed'); } finally { actionFlight.current = false; } };
     const send = async (text: string) => { await onSend(text, attachmentState.files); setAttachmentReset((value) => value + 1); };
     const composerAddon = disabled ? null : <AttachmentQueue key={`assistant:${user.id}:${attachmentKey}:personal`} consumerKey={`assistant:${user.id}:${attachmentKey}:personal`} capacity={5} destination={{}} expectedGroupId={null} disabled={responding} resetKey={attachmentReset} onChange={attachmentChange} />;
-    return <RecordFeed items={items} onSend={send} isSending={responding} disabled={disabled} submitBlocked={attachmentState.busy} composerAddon={composerAddon} currentUserId={user.id} variant="bubbles" placeholder={disabled ? 'Only the owner can continue this conversation' : 'Message Assistant…'} sendLabel="Send" emptyLabel="Ask the Assistant about this deployment." ariaLabel="Assistant conversation" pending={responding ? <>Responding…</> : null} error={actionError || undefined} renderAddon={(item) => { const blocks = Array.isArray(item.raw.blocks) ? item.raw.blocks as AssistantBlock[] : []; return blocks.length ? <div className="assistant-blocks">{blocks.map((entry, index) => <BlockView key={`${item.id}:${index}`} block={entry} onAction={sendAction} disabled={responding || disabled || actionFlight.current} />)}</div> : null; }} />;
+    return <RecordFeed items={items} onSend={send} isSending={responding} disabled={disabled} submitBlocked={attachmentState.busy} composerAddon={composerAddon} currentUserId={viewerId} showInput={!readOnly} variant="bubbles" placeholder={disabled ? 'Only the owner can continue this conversation' : 'Message Assistant…'} sendLabel="Send" emptyLabel="Ask the Assistant about this deployment." ariaLabel="Assistant conversation" pending={responding ? <>Responding…</> : null} error={actionError || undefined} renderAddon={(item) => { const blocks = Array.isArray(item.raw.blocks) ? item.raw.blocks as AssistantBlock[] : []; return blocks.length ? <div className="assistant-blocks">{blocks.map((entry, index) => <BlockView key={`${item.id}:${index}`} block={entry} onAction={sendAction} disabled={responding || disabled || actionFlight.current} />)}</div> : null; }} />;
 }