Channel administration app (PWA)

# Channel administration app (PWA)

## Source and purpose

DefaultPreferences/Container and CreatorDeniedRoute admit owner/delegate, excluding creators, without an additional named channel permission. ChAdminApp fetches the PWA record. ChAdminAppSection renders NOT_RELEASED, INITIALIZING and RELEASED. Its only writer is initial release, with an optional custom icon. The released name is read-only and derived by the original UI; there is no rename, re-release, unpublish or independent icon-update control.

The release check first requires the channel loginKey/address, then the source
isBusinessPlanOrHigher table. Known disallowed plans are FREE_TRIAL,
NORMAL_STARTER, NORMAL_STARTER_2023_04, NORMAL_BASIC and NORMAL_ESSENTIAL. Known
remaining source plans are allowed; an unknown future plan is unknown, not
silently entitled by the source helper's default branch. Missing address links
to publish/settings; plan changes link to plan/home. No plan purchase is sent.

Source repository requests: GET /seller/api/v1/channel-management/pwa and POST
/seller/api/v1/channel-management/pwa/release with {iconImageSrc}. The source saga
optionally uploads the original icon first, then refreshes PWA info. API origin,
selected channel bearer and x-publ-channel-id apply. The active reducer consumes
data.pwaReleaseInformation, despite the repository's stale undefined return type.
The optional record being absent is not proof of NOT_RELEASED.

The original modal accepts PNG/JPEG/WebP/SVG up to 1,000,000 bytes. Omit iconFile
to use the observed PWA icon or channel icon, with the UI's ?ver= suffix removed.
Do not accept arbitrary image URLs, local paths, mutable names or private keys.
Raw loginKey and installationUri stay out of MCP responses/journals; actual
installation and copying its link belong to the original console. Preserve only
address/link presence, a private address-change digest and source presentation
fields. Repeated source observations are not an atomic snapshot.

## Interface and recovery plan

channel_admin_app_get returns stored status, presentation fields, prerequisites,
revision and one exact preferences/ch-admin-app destination. channel_admin_app_release
requires channelCode, expectedRevision, stable requestId and confirmation
RELEASE_ADMIN_APP; optional iconFile carries original base64 bytes. dryRun plans
without upload, POST or journal. Supported preconditions never imply a completed
release or functioning installed app.

A durable taskType channel-admin-app-release records phases before grant, upload
and release effects. Never repeat an uncertain effect. Keep temporary upload
credentials in memory only. A prepared/acknowledged-upload task may continue only
through the identical release call; task_status and task_resume are observation
only. INITIALIZING remains pending. RELEASED with the expected icon and unchanged
channel/address/actor can reconcile stored completion without proving causality.
Completed replay is historical and unconfirmed; use get for current status.
No rollback, image deletion, reinstall or automatic plan/domain change.

## Implementation reconciliation

HTTP release acknowledgements 200/201/202/204 are dispatch acknowledgements only;
source code gives no usable release data DTO. Non-204 responses must retain
the source data envelope without a contradictory error, bounded to 2 MiB. A
malformed envelope stays an unknown dispatched outcome, never an acknowledgement
or replay opportunity. No response data is used as completion evidence: repeated
stored RELEASED/channel/icon observations are required, with
causalityVerified:false. Actual backend acknowledgement compatibility is pending.

This branch appends only the PWA section and does not overwrite that owner's transport/login guidance reconciliation. The current provider-view confirmation wording already distinguishes activation versus provider observations; the separate Docs candidate is not treated as integrated or approved.

## Root static-check record

Accounting is 108 tools / 44 partial workflows / 209 partial API associations / 42 human financial handoffs / 738 pending audits. Ten changed Markdown files, six JSON example blocks and 241 relative file links were checked; the three PWA documents are in both package entries and the public allowlist. This validates file inclusion, not built-package or rendered-public-response behavior. No product test was executed by root. Existing public-guide/actual/hosted/model holds are not closed.

The release dry-run checks an existing journal under the task lock and rejects
changed original input with `REQUEST_ID_CONFLICT`. A valid saved record does not
turn the dry-run into historical success: it still checks fresh prerequisites.
No durable task is created or updated by planning.

## Saved record identity

A missing file differs from a present malformed record. JSON null, false, zero
or an empty string is rejected with `TASK_CONTEXT_CHANGED`; apply/dry-run/status/
resume do not overwrite it or start replacement work. Preserve the file for
inspection. Do not delete/edit it or substitute a new request ID to bypass the
error. Valid original-task recovery and genuinely missing-record behavior remain.