Manage apps and the app-settings lane — what landed

The admin half of phase 3 of Apps live on the instance (§6, §7). It builds on the plan in Settings extensions. Everything here is a framework control (DataGrid + PropertyColumnControl, Stack, Title, Markdown, Button, MeshNodePickerControl); nothing writes a grant, creates a Space or copies a package.

Every page is a template (Doc/GUI/DataBinding, "Templates first, data later"): the grids are BindGrid and the lines BindMarkdown, fed by ManageAppsFeeds / InstanceMapsFeeds, which read the mesh and build no control; row buttons act on the clicked row (ctx.RowAs<TRow>()). The admin verdict and the page switch (grid / one app / capabilities) are structure, decided before any read.

The lane: UiContribution context AppSettings

A content module cannot reach another hub's configuration, so it could not add a tab to the Admin app or to another app's settings. Core gained one context for it (MeshWeaver#6445):

The tab joins the host's settings page (/{host}/Settings/{node id}) and no other. Seed validation reports a hostless tab and a foreign address; scripts/check-menu-contexts.py knows the context.

Administration (host Admin)

The existing compiled Admin tabs (Registration from HostingInstanceModuleAttribute, Fleet from InstancesAdminLayoutArea) are unchanged.

Manage apps

• The grid lists exactly the app roots: nodeType:Store/Plugin content.app:true, read through the synced query so the content is typed (ManageApps.AppRows). Columns: icon, name, tier, Who sees it (the audience, or "everyone on or above"; "…" while the policy is read, "unknown" when it cannot be), status, and Manage.
• Add lists the package catalog (StorePackage feed) minus the ids already on the instance (AddableRows). Add to this instance files a governed proposal — a Governance/Proposal at {admin}/_Proposals/{id} under the package.provision standard with input package. Once two signers who are not the proposer sign, the governance executor writes the Store/Provision request as System and the control plane runs SystemInstall.RunResolved. A person-written Store/Provision request is refused when Access:BroadGrantGuard:Mode enforces, so the page never writes one (Governance/Catalogue).
• Remove proposes package.remove the same way (→ SystemRemoval, which refuses a package another one requires and a pre-installed one).
• The management page shows what the app declares it needs (PluginContent.Configuration: key, kind, secret or value, why) and its requires.
• Audience. The picker offers users and groups through the platform's AccessSubjectQueries.ForScope(null). Adding or removing a subject edits {app}/_Policy field audience (ManageApps.AudienceField, the one spelling on this side; core PartitionAccessPolicy.Audience, MeshWeaver#6442). The content object is edited, never replaced (WithAudience), and the write runs as System after SystemAuthorization confirms the clicking admin, because a global admin holds no Update on a system-synced space. What the audience does (plan coverage AND audience → Read) is the Licensing change's PlanAccess (MeshWeaver.Plugins#3308); this page only writes the field.
• 🚧 Blocked under an enforcing guard: a PartitionAccessPolicy write must run under a governed access.policy-change activity (Governance/Catalogue), and that standard's executor creates policies only — an UPDATE executor is the follow-up. Until it exists, the audience write (System, after the admin check) passes only while Access:BroadGrantGuard:Mode is log-only; under Enforce it is refused and the status line says why. The audience then belongs on a governed proposal like Add/Remove.
• Show capabilities lists the roots that are neither apps nor hosted in one.

Maps

• Keys: GoogleMaps:ApiKey and AppleMaps:Token (the renderers), plus the Apple Maps Server API trio AppleMaps:TeamId / KeyId / PrivateKey that place search and routes run on (AmapsConnect.InstanceKey; all three needed). The action names only the configuration key; the deployment record resolves its vault object and synced Secret. The page lists the renderer packages present and which are ready (OpenStreetMap needs no key); which one DRAWS is the deployment's module choice (Modules:Assemblies), which the page does not claim.
• Plaintext never reaches content. The value is encrypted with the platform key protector (refused when it does not come back enc:-tagged), then a Hosting/InstanceAction with requestedAction: SetSecrets is filed in the operational space for this instance's Hosting:Deployment — the path the record page's Set Key Vault secrets dialog uses. The page shows a mask, and "set on …" ("…" while the history is read, "unknown" when it cannot be) from the newest COMPLETED action naming that key (state: Done, lastAction: SetSecrets), in the viewer's time zone (pinned across both DST changes and the date line).
• An instance that does not know its deployment id (Hosting:Deployment unset) refuses the save and says to set the key on its record page on the control instance.
• The user-facing key entry is gone: the Apple Maps page of a viewer's copy no longer renders the credentials form. Keys already stored there keep working; moving them to the instance is the migration phase, and nothing here deletes them.

App settings (other hosts)

Tests

• core AppSettingsContributionTest — host match, other pages, hostless, AdminOnly, foreign address, seed validation.
• Store/Catalog/Test/ManageAppsTests — the grid lists exactly app roots; Add and Remove propose the governed package.provision / package.remove activity; the audience lands on _Policy with every other field kept; the Maps save files SetSecrets and never puts the secret in content; "set on" and the renderer.
• AppleMaps/Maps/Test/MapsTests — no personal key entry.
• src/MeshWeaver.AI.Test/AiThreadsApplicationTest — the Settings tabs render the same for a pro and a free viewer; Models lists own providers, never a shelf; the web-search default.

Not executed by these suites (follow-up): the Maps Save chain (encrypt → create the Hosting/InstanceAction in the operational space → control-plane target) and the audience WriteAudience chain (admin check → System → owning _Policy hub) need a mesh rig with a layout host, an operational space and a real admin grant; the pure suites pin their shapes, and the live write is the deploy check below.

Deploy

Recycle after the merge and the core seal: Store (the catalog type), AI/AiThreads, Admin. The tabs appear only once the running platform carries MeshWeaver#6445; before that the contributions are inert (no consumer renders the context).