Channel administration app (PWA)

Source and purpose

DefaultPreferences/Container and CreatorDeniedRoute admit owner/delegate, excluding creators, without an additional named channel permission. ChAdminApp fetches the PWA record. ChAdminAppSection renders NOT_RELEASED, INITIALIZING and RELEASED. Its only writer is initial release, with an optional custom icon. The released name is read-only and derived by the original UI; there is no rename, re-release, unpublish or independent icon-update control.

The release check first requires the channel loginKey/address, then the source isBusinessPlanOrHigher table. Known disallowed plans are FREE_TRIAL, NORMAL_STARTER, NORMAL_STARTER_2023_04, NORMAL_BASIC and NORMAL_ESSENTIAL. Known remaining source plans are allowed; an unknown future plan is unknown, not silently entitled by the source helper's default branch. Missing address links to publish/settings; plan changes link to plan/home. No plan purchase is sent.

Source repository requests: GET /seller/api/v1/channel-management/pwa and POST /seller/api/v1/channel-management/pwa/release with {iconImageSrc}. The source saga optionally uploads the original icon first, then refreshes PWA info. API origin, selected channel bearer and x-publ-channel-id apply. The active reducer consumes data.pwaReleaseInformation, despite the repository's stale undefined return type. The optional record being absent is not proof of NOT_RELEASED.

The original modal accepts PNG/JPEG/WebP/SVG up to 1,000,000 bytes. Omit iconFile to use the observed PWA icon or channel icon, with the UI's ?ver= suffix removed. Do not accept arbitrary image URLs, local paths, mutable names or private keys. Raw loginKey and installationUri stay out of MCP responses/journals; actual installation and copying its link belong to the original console. Preserve only address/link presence, a private address-change digest and source presentation fields. Repeated source observations are not an atomic snapshot.

Interface and recovery plan

channel_admin_app_get returns stored status, presentation fields, prerequisites, revision and one exact preferences/ch-admin-app destination. channel_admin_app_release requires channelCode, expectedRevision, stable requestId and confirmation RELEASE_ADMIN_APP; optional iconFile carries original base64 bytes. dryRun plans without upload, POST or journal. Supported preconditions never imply a completed release or functioning installed app.

A durable taskType channel-admin-app-release records phases before grant, upload and release effects. Never repeat an uncertain effect. Keep temporary upload credentials in memory only. A prepared/acknowledged-upload task may continue only through the identical release call; task_status and task_resume are observation only. INITIALIZING remains pending. RELEASED with the expected icon and unchanged channel/address/actor can reconcile stored completion without proving causality. Completed replay is historical and unconfirmed; use get for current status. No rollback, image deletion, reinstall or automatic plan/domain change.

Implementation reconciliation

HTTP release acknowledgements 200/201/202/204 are dispatch acknowledgements only; source code gives no usable release data DTO. Non-204 responses must retain the source data envelope without a contradictory error, bounded to 2 MiB. A malformed envelope stays an unknown dispatched outcome, never an acknowledgement or replay opportunity. No response data is used as completion evidence: repeated stored RELEASED/channel/icon observations are required, with causalityVerified:false. Actual backend acknowledgement compatibility is pending.

This branch appends only the PWA section and does not overwrite that owner's transport/login guidance reconciliation. The current provider-view confirmation wording already distinguishes activation versus provider observations; the separate Docs candidate is not treated as integrated or approved.

Root static-check record

Accounting is 108 tools / 44 partial workflows / 209 partial API associations / 42 human financial handoffs / 738 pending audits. Ten changed Markdown files, six JSON example blocks and 241 relative file links were checked; the three PWA documents are in both package entries and the public allowlist. This validates file inclusion, not built-package or rendered-public-response behavior. No product test was executed by root. Existing public-guide/actual/hosted/model holds are not closed.

The release dry-run checks an existing journal under the task lock and rejects changed original input with REQUEST_ID_CONFLICT. A valid saved record does not turn the dry-run into historical success: it still checks fresh prerequisites. No durable task is created or updated by planning.

Saved record identity

A missing file differs from a present malformed record. JSON null, false, zero or an empty string is rejected with TASK_CONTEXT_CHANGED; apply/dry-run/status/ resume do not overwrite it or start replacement work. Preserve the file for inspection. Do not delete/edit it or substitute a new request ID to bypass the error. Valid original-task recovery and genuinely missing-record behavior remain.