chore: updated reference design to app changes and fixes

docs/design/screens/activity.md

@@ -105,8 +105,21 @@ Event names are present tense, as the backend emits them: role.create, role.edit
 | role.delete | Role Intern deleted | Failed to delete the role Intern |
 | role.reassign | Moved 3 members from Intern to Writer (one member: Moved 1 member from Intern to Writer) | Failed to move 3 members from Intern to Writer |
 | user.change_role | Ines Duarte's role changed from Writer to Content lead | Failed to change the role of Ines Duarte |
+| user.remove | Removed Ines Duarte | Failed to remove Ines Duarte |
 | user.transfer_ownership | Ownership transferred from Marta Alves to Jonas Weber | Failed to transfer ownership to Jonas Weber |
 
 Failed template: "Failed to {verb} {object}". A failed row shows the Failed badge after the sentence; the details panel shows "Why it failed" with the reason from the API.
 
 Category filter values: Articles, Media, Users and invites (was "Users & invites"), Roles (new), API keys, Authentication, System. French and the failed sentences for every event are in screens/roles.md, group 8 and the table "Activity events: failed sentences, EN and FR". Frames: Roles board, group "8 Activity".
+
+
+### Fallback wordings (app sync)
+| Event | Condition | Sentence |
+|---|---|---|
+| role.reassign | target role unknown | Moved 3 members from Intern to another role |
+| role.reassign | count unknown | Moved the members of the role Intern |
+| role.reassign | failed, count unknown | Failed to move the members of the role Intern |
+| role.reassign | failed, one member | Failed to move 1 member |
+| user.remove | name unknown | Removed a user (proposal, not in the app) |
+
+Event names match the backend: role.create, role.edit, role.delete, role.reassign, user.change_role, user.transfer_ownership, user.remove.

docs/design/screens/integration.md

@@ -164,6 +164,15 @@ Board: group "Integration", states 8a to 8h, desktop 1440×900 and mobile 390×8
 - The 1.5 s flash duration and the #ep-<id> hash are proposals.
 
 
+## App sync notes
+- Schema routes show the permission key as their access chip: schema.view (GET), schema.edit (POST, PUT), schema.delete (DELETE). Purge routes show "Needs permission" until the app names the key.
+- 403 body for these routes: "Your role doesn't include this action. Ask an owner or admin." (app string, messages.ts).
+- Entries intro: "Writing entries needs the entry permissions for that type." (proposal; the app has no string yet).
+- Remaining "owners and admins" wording (activity export, content-types notice) stays as the app ships it.
+- Article list body: {items, total, page, size, counts} (no X-Total-Count). counts keys: all, online, draft, suggestions.
+- Users group has 7 routes: list, PATCH me, invite, cancel invite, renew invite, DELETE /v1/user/{id}?expected_role_id=N (permission, 409 target_role_not_found), GET /v1/auth/me. Profile routes use /v1/auth/me.
+- 404 adds site_not_found (sitemap, unknown key). The 403 note sits under its row at full row width. Every 400 uses the generic body-mismatch text ("The request cannot be processed due to a mismatch in the format of the body."); "Invalid page or size." is gone.
+
 ## Custom content types round
 Board: group "Integration", states 9a to 9j. Source: `IntegrationPage.dc.html`, `IntegrationSearch.dc.html`. Every route an API key can call is now documented.
 

docs/design/screens/media.md

@@ -10,7 +10,7 @@ Visual reference: `RenewCMS Screens Back-office.dc.html`, groups "Media", "Media
 
 Every state below is drawn in light and dark (theme switch on the board), at 1440×900 and 390×844 (both frames sit side by side). Board: `RenewCMS Screens Back-office.dc.html`. Copy is exact; where a cell is empty the state reuses the fixed copy.
 
-### Media (group "Media", 52 states)
+### Media (group "Media", 56 states)
 
 Route: `/media`. API: GET /v1/media/ · POST /v1/media/ · PATCH /v1/media/{id} · DELETE /v1/media/{id} · POST /v1/media/merge · GET /v1/media/{id}/usage.
 
@@ -116,3 +116,9 @@ A secondary "Purge duplicates" button (icon merge) in the toolbar next to the so
 
 ## Media field (pass 5)
 Spec, states, exact copy, measurements, backend needs and accessibility: `media-field-changes.md`, section 3.8. Board groups: 11 Media library usage.
+
+## App sync (batch A)
+- Detail panel, "Used elsewhere" below the articles and entries lists: rows "Author avatar" (/authors) and "Site default social image" (/settings/sites). States: avatar only, site only, both, none (section absent). The "Used in N" badge includes these, N = articles + entries + elsewhere. "Not used in any article" appears only when N is 0; otherwise the line reads "No article shows it."
+- Selected card (grid, mobile list): outline badges ("Used in N", "Draft") keep opaque bg-default over the sand tint, text colour unchanged. --ui-text-toned on --ui-bg: 9.7:1 light (#444 on #fff), 11.7:1 dark (#cfccc7 on #111).
+- Media library board (variants): adds tabs (All, Unused, Duplicates), Select all, grid/list toggle, Duplicate badges, the variants filter row and the Details | Variants tab row. Variant URL: /static/uploadedImages/photo.png?v=thumb.
+- Not yet done: mobile picker sheet height and tile count, desktop frame of the mobile-only state, stray miniatures.

docs/design/screens/profile.md

@@ -64,3 +64,7 @@ The "Author profile" card sits between Account and Password in every Profile fra
 | 3 | Created | 201: the card shows the author. The author is named from the display name and linked to the user. | Author profile created · Marta Alves is now your byline. · Edit author · Linked to your account. New articles start with this author. |
 | 4 | Created, slug adjusted | The slug was taken, so the server added a number. No error is shown. | Your slug is marta-alves-2 · marta-alves was already used by another author. You can change it in Edit author. |
 | 5 | Edit own author | Edit author on the card, by a role without author rights. The form opens with the linked user locked and no Unlink. There is no delete action in the form or on this screen. | Edit Marta Alves · Linked user · marta@renew.example · This is your author profile. Only an owner or admin can change the link. · Save changes |
+| 6 | No author profile, no display name | The user has no linked author and has not set a display name. | Uses your username, marta. You can change it afterwards. |
+| 7 | Edit own author: owner or admin | Edit author on the card, by an owner or admin. The form opens with the linked user and Unlink is allowed. | Edit Marta Alves · Linked user · marta@renew.example · Unlink · Save changes |
+
+Order on the page: Display name, Account, Your role (role card), Author profile, Password.

docs/design/screens/roles.md

@@ -42,7 +42,7 @@ Copy: Edit · Duplicate · Delete (disabled) · Built-in roles can't be deleted.
 
 Trigger: User has Roles: view but not Roles: manage. New role is disabled with a tooltip.
 
-Copy: You can see roles but not change them · Ask an owner or admin if a role needs to change. · You can see roles, but only people who manage roles can create or change them.
+Copy: ReadOnlyBanner: You can see roles, but only people who manage roles can create or change them.
 
 ### Error (Available now)
 
@@ -268,7 +268,7 @@ Copy: Ownership transferred · Jonas Weber is now the owner. You are an Admin.
 
 ## 6 Role-aware shell
 
-Route: Every page · API: GET /v1/me returns role and permission keys · Auth: Any
+Route: Every page · API: GET /v1/auth/me returns role and permission keys · Auth: Any
 
 Rule: hide whole areas the person can never use; disable, with a reason, an action that is blocked on something they can see; show read-only pages with a banner. Writer in these frames is the built-in Writer; Contributor shows "own" scope.
 
@@ -382,7 +382,7 @@ Copy: All categories · Articles · Media · Users and invites · Roles · API k
 
 ## 9 Profile: your role
 
-Route: /profile · API: GET /v1/me · Auth: Any
+Route: /profile · API: GET /v1/auth/me · Auth: Any
 
 The person sees their own role and a read-only summary.
 
@@ -845,3 +845,42 @@ The board lists, and this file repeats, the tables below.
 | 8 | A user with Roles: manage cannot edit their own role, even in a custom role. | Allow narrowing only. |
 
 State count: 90.
+
+
+## Read = Own: singular noun
+The singular noun in Read = Own copy ("entries you created", "event") is derived from the type name. Irregular names ("People", "Series") need a per-type singular field. Drawn as a Later item.
+
+## 2b Role editor: app sync
+
+Presets: Read only sets Read: All and everything else None for every type. Write own sets Read: All, Create: On, Update: Own, Delete and Publish: None. Full content sets Read, Update, Delete and Publish: All and Create: On. A preset overwrites every type row, including custom rows, and every changed cell counts as an unsaved change.
+
+"N unsaved changes" counts cells in the content grid plus general toggles that differ from the loaded role. Name and description count as one each. Setting a cell back to its loaded value removes it from the count.
+
+The footer bar is pinned to the bottom. The content grid scrolls sideways inside its card below 720 px. There is no leave guard on the delete dialog: it holds no unsaved edits.
+
+| State | Trigger | Copy |
+|---|---|---|
+| No Schema: view | The editor's role lacks schema.view, so custom types can't be listed. | Custom content types aren't listed · Your role doesn't include Schema: view, so only Articles is shown. The permissions of custom types stay as they are. |
+| Reset to default: confirm | Built-in role, owner only. | Reset Writer to default? · Writer goes back to its built-in permissions. 5 members and the API keys they created are affected as soon as you save. This can't be undone. · Cancel · Reset to default (proposal) |
+| Reset to default: done | | Role reset · Writer is back to its defaults. Save to apply it to 5 members. (proposal) |
+| Review differences: name and description | Name and description appear as rows above the permission rows. | Name · Contributor · Event writer · Description · Writes posts · Writes events |
+| Duplicate | /settings/roles/new?from=<id>. Name prefilled "<role> copy"; nothing saved until Save changes. | Copied from Contributor · The permissions are the same. Give the copy a name that fits, then save. (proposal) |
+| role_not_found page | /settings/roles/:id for a deleted role. | That role no longer exists · It was deleted somewhere else, so we removed it from the list. · Back to Roles |
+| invalid_role_name (400) | Server refuses a blank name. | Give the role a name. |
+| Generic 400 | Any other 400 on save. | Couldn't save the role · Something in the form isn't valid. Check the highlighted fields. |
+| Role created | 201 on create. | Role created · Contributor is ready. Assign it from Users. |
+| Built-in role delete | Reached by link. | Delete Writer? · Built-in roles can't be deleted. |
+| Change role: choice is now current | After the re-read the chosen role equals the member's current role. | Change role is disabled. |
+
+### Preview sentence templates (beyond the three examples)
+| Setting | Sentence |
+|---|---|
+| Read: None | No access to entries. |
+| Read: Own | Can read only entries they created. |
+| Read: All | Can read any entry. |
+| Create: On | Can create entries. |
+| Update: Own / All | Can edit only their own / any entry. |
+| Delete: Own / All | Can delete only their own / any entry. |
+| Publish: Own / All | Can publish only their own / any entry. |
+| Mixed rows | Listed per type, after "All content types". |
+Sentences join with commas and "and"; types that differ from the wildcard get their own line.

docs/design/screens/schema-later.md

@@ -4,7 +4,8 @@ All states on this page are **Later**: relations, permissions and schema export
 
 Visual reference: `RenewCMS Screens Schema.dc.html`, groups "Relations", "Permissions", "Export and import". Frames: `SchemaFrame.dc.html` mounted in `AppFrame.dc.html` (shell, sidebar, topbar, drawer). Every state is drawn in light and dark (theme switch) at 1440×900 (shown at 50%) and 390×844 (shown at 75%). Copy is exact. Strings in a Copy cell are separated by " · " and listed in reading order. Nothing is clock-sensitive.
 
-### 7 Relation field and picker (group "7 Relations", 4 states)
+### 7 Relation field and picker (group "7 Relations", 5 states)
+The picker exists in the app, so this group is no longer under "Later" in the build order; the route and the permission row stay as written.
 
 Route: `/schema/:key, /content/:key/:id`. API: not built. Auth: Owner or admin (picker), any verified user (form).
 
@@ -30,7 +31,7 @@ All later. Rows are types, columns are actions, one role at a time. Built-in row
 
 ### 9 Schema export and import (group "9 Export and import", 3 states)
 
-Route: `/schema (dialogs)`. API: not built. Auth: Owner or admin.
+Route: `/schema (dialogs)`. API: not built. Auth: permissions schema.view (open and read), schema.edit (create and change), schema.delete (delete a type).
 
 All later. Dev-to-production flow: export a file, import it elsewhere, preview, same compatibility review as group 3, explicit confirm.
 
@@ -39,3 +40,5 @@ All later. Dev-to-production flow: export a file, import it elsewhere, preview,
 | 1 | Export | Export on /schema. | Export schema · Download the fields of your content types as a file. Entries aren't included. · All content types · 3 content types · One content type · Choose which one · File name · renewcms-schema.json · Import this file on another RenewCMS site to create the same content types. · Cancel · Download file | Later |
 | 2 | Import preview | A file was chosen. | Import schema · renewcms-schema.json · 3 content types · Create 1, change 1, no change 1 · Recipes · New content type with 4 fields. · Events · Add 2 fields, remove Description. Events has 37 entries on this site. · Removes data · Press mentions · Same as on this site. · Existing entries are checked against the changes when you import. If any entry doesn't fit, nothing is imported. · Cancel · Import schema | Later |
 | 3 | Import refused | The server answers schema_incompatible. | Nothing was imported · Some entries on this site don't fit the imported fields. RenewCMS can't tell which entries. The flagged change can cause this. · Try again | Later |
+
+| 4 | Relation picker: load more failed | Load more failed. Loaded rows stay, an inline error replaces the count, the button reads Try again. Focus stays on the button, then moves to the first new row. | Couldn't load more results. The 25 shown are still here. · Try again | Available now |

docs/design/screens/schema.md

@@ -1,6 +1,6 @@
 # Schema
 
-Route: `/schema`, `/schema/new`, `/schema/:key`. API: GET/POST /v1/content-type · GET/PUT/DELETE /v1/content-type/{key}. Auth: owner or admin.
+Route: `/schema`, `/schema/new`, `/schema/:key`. API: GET/POST /v1/content-type · GET/PUT/DELETE /v1/content-type/{key}. Auth: permissions schema.view (open and read), schema.edit (create and change), schema.delete (delete a type).
 
 Custom content types: an owner or admin defines a type (for example Events) made of 1 to 50 ordered fields; any verified user then writes entries. Everything about a type happens on one screen. Primary words: content type, field, choice list, entry. "Key" is kept for the API identifier. The key of a type is chosen at creation and never changes; the key and type of a saved field never change. Built-in types (Articles, Authors, Sites, Media, Users) are listed with a lock and a "Built-in" badge and open a read-only view. Non-owner, non-admin users see no Schema entry; a direct link shows a 403 page.
 
@@ -8,7 +8,7 @@ Visual reference: `RenewCMS Screens Schema.dc.html`, groups "Schema list", "Sche
 
 ### 1 Schema: list of types (group "1 Schema list", 6 states)
 
-Route: `/schema, /schema/:key (built-in)`. API: GET /v1/content-type. Auth: Owner or admin.
+Route: `/schema, /schema/:key (built-in)`. API: GET /v1/content-type. Auth: permissions schema.view (open and read), schema.edit (create and change), schema.delete (delete a type).
 
 Sidebar entry "Schema" for owners and admins only. Built-in types are listed with a lock and a Built-in badge, always after the custom ones. They open a read-only view. Sample data: the field counts of built-ins are illustrative.
 
@@ -23,7 +23,7 @@ Sidebar entry "Schema" for owners and admins only. Built-in types are listed wit
 
 ### 2 Schema builder (group "2 Schema builder", 16 states)
 
-Route: `/schema/new, /schema/:key`. API: POST /v1/content-type, GET/PUT /v1/content-type/{key}. Auth: Owner or admin.
+Route: `/schema/new, /schema/:key`. API: POST /v1/content-type, GET/PUT /v1/content-type/{key}. Auth: permissions schema.view (open and read), schema.edit (create and change), schema.delete (delete a type).
 
 One screen, three regions: type name and key on top, ordered field list on the left, field inspector on the right, collapsible API preview at the bottom. Mobile: the list is the page, the inspector is a 92% sheet, the API preview is a sheet. Field keys and types of saved fields are locked; fields added since the last save can still choose both.
 
@@ -48,7 +48,7 @@ One screen, three regions: type name and key on top, ordered field list on the l
 
 ### 3 Schema change review and delete type (group "3 Review and delete", 7 states)
 
-Route: `/schema/:key (dialogs)`. API: PUT /v1/content-type/{key}, DELETE /v1/content-type/{key}. Auth: Owner or admin.
+Route: `/schema/:key (dialogs)`. API: PUT /v1/content-type/{key}, DELETE /v1/content-type/{key}. Auth: permissions schema.view (open and read), schema.edit (create and change), schema.delete (delete a type).
 
 The review opens on Save when the type already has entries (37 here). It is informational: the server decides compatibility. Destructive changes (removing a field or a choice, tightening a limit, making a field unique or required) carry a warning flag. Per-change entry counts and a full diff are later.
 
@@ -79,3 +79,12 @@ One frame per type: inspector options, the entry form control (default and open
 
 ## Media field (pass 5)
 Spec, states, exact copy, measurements, backend needs and accessibility: `media-field-changes.md`, section 3.1 to 3.4. Board groups: 1 Schema list, 2 Schema builder, 3 Review, 4 Field types.
+
+## Permissions (app sync)
+Three keys gate Schema: schema.view (list and read types, and the Schema sidebar entry), schema.edit (create and change types and fields), schema.delete (delete a content type). The built-in Owner and Admin roles hold all three. The app still words the 403 as "Only owners and admins can…"; the design keeps that copy until the app changes. A role with schema.view only sees the builder read-only: Save, Add field, Move and Remove are hidden.
+
+## Mobile field sheet
+The field sheet carries Move up, Move down and Remove (44 px, equal widths) above Done. Move up is disabled on the first field, Move down on the last.
+
+## Saving
+Save always opens the review first, with or without entries. During Apply the dialog reads Applying… and the entries info bar is hidden.

docs/design/screens/users.md

@@ -2,7 +2,7 @@
 
 Route: `/users`. API: GET /v1/user/ · POST /v1/user/invite · DELETE /v1/user/invite/:id (pending) · POST /v1/user/invite/:id/renew (pending).
 
-One shared workspace: every user sees the same articles and this same list. Columns: email, display name, role (owner or admin), invite status and created date. A pending invite can be cancelled and an expired one renewed; accepted accounts have no row actions. An invite is Pending until its link is used, Expired after 3 days, and Accepted once the account is created.
+One shared workspace: every user sees the same articles and this same list. Columns: email, display name, role badge, invite status and created date. A pending invite can be cancelled and an expired one renewed; accepted accounts have no row actions. An invite is Pending until its link is used, Expired after 3 days, and Accepted once the account is created.
 
 Visual reference: `RenewCMS Screens Back-office.dc.html`, groups "Users". Frames: `AppFrame.dc.html` (shell, sidebar, topbar, drawer) plus the screen frame where listed in components.md.
 
@@ -29,7 +29,7 @@ Every state below is drawn in light and dark (theme switch on the board), at 144
 
 Route: `/users`. API: GET /v1/user/ · POST /v1/user/invite · DELETE /v1/user/invite/:id (pending) · POST /v1/user/invite/:id/renew (pending).
 
-One shared workspace: every user sees the same articles and this same list. Columns: email, display name, role (owner or admin), invite status and created date. A pending invite can be cancelled and an expired one renewed; accepted accounts have no row actions. An invite is Pending until its link is used, Expired after 3 days, and Accepted once the account is created.
+One shared workspace: every user sees the same articles and this same list. Columns: email, display name, role badge, invite status and created date. A pending invite can be cancelled and an expired one renewed; accepted accounts have no row actions. An invite is Pending until its link is used, Expired after 3 days, and Accepted once the account is created.
 
 | # | State | Trigger | Copy |
 |---|---|---|---|
@@ -50,3 +50,9 @@ One shared workspace: every user sees the same articles and this same list. Colu
 | 15 | Renew invite: done | 200: the row becomes Pending with today's date, moves to the top, and the old link stops working. Clock-sensitive: shows a relative time or a countdown. | "Today" / "Invite renewed" / "p.huber@gmail.com has 3 days to accept the new link." |
 | 16 | Renew invite: failed | 500 or network failure. The row stays Expired and the button can be pressed again. | "Couldn't renew the invite" / "Try again in a moment." |
 | 17 | Invite sent | 201: the dialog closes, the new invite appears at the top as Pending, and a toast confirms. | "lea.martin@renew.example" / "Today" / "lea.martin@renew.example has 3 days to accept." |
+
+## Spec notes (app sync)
+- The Users table has no "Assigned by" column. Columns: email, display name, role, invite status, created.
+- A blocked role in the RolePicker shows the generic RolePicker reason, not a per-role sentence. The current role carries a "Current" mark; Owner is disabled with its reason.
+- Own row: Change role is disabled with "You can't change your own role". Remove user is disabled with "You can't remove yourself. Ask another owner or admin."
+- Remove user: dialog "Remove {0}?" / "They lose access straight away, and the API keys they created stop working. Their articles, entries and media stay." / Remove user (pending: "Removing…"). Success toast "User removed" / "{0} no longer has access." 500: "Couldn't remove the user" / "Nothing was changed. Try again in a moment." 409 target_role_not_found: toast "User not removed" / "{0}'s role changed in the meantime, so nothing was removed. Check it and try again." / Reload. {0} is the display name, falling back to the username.