feat: refine ISAC media and notification workflows

docs/DEPLOYMENT.md

@@ -94,7 +94,9 @@ In `https://git.jb.codes/jb/shd.build/settings/actions`:
 
 `.gitea/workflows/deploy-staging.yml` runs for pushes to `main` and manual
 dispatches. The trusted staging runner builds each commit-tagged image locally,
-so the workflow needs no registry credentials.
+so the workflow needs no registry credentials. Gitea assigns
+`gitea.run_number` to `SHD_BUILD_NUMBER`; each new workflow run receives the
+next integer, while retries of the same run retain their number.
 
 ## Deployment lifecycle
 
@@ -217,7 +219,8 @@ Add these repository Action secrets:
 Optional repository variables are `PRODUCTION_DEPLOY_PATH` (default
 `/opt/shd-build-production`) and `PRODUCTION_PORT` (default `3102`). The
 `deploy-production.yml` workflow deploys production on pushes to `main` and
-manual dispatches using the trusted `stage-deploy` host runner.
+manual dispatches using the trusted `stage-deploy` host runner. Its Gitea
+workflow run number supplies the production `SHD_BUILD_NUMBER`.
 
 Prepare the host directory once from an interactive SSH session:
 

docs/DESIGN_SYSTEM.md

@@ -756,10 +756,10 @@ pagination controls to preserve the rail's shape.
 Registries with a meaningful name, title, or agent-identity column place the
 shared server-side search inside this pagination rail. Results update after a
 short typing debounce, so do not place a redundant Search button beside the
-field. Label the behavior as `LIVE SEARCH`, replace it with `SEARCHING…` while
-navigation is pending, and provide an explicit clear action whenever a query is
-active. Search resets the page number while preserving the selected KPI filter
-and row-count preset; page navigation preserves the query. Search applies to
+field or label the field as live search. Show `SEARCHING…` only while navigation
+is pending, and provide an explicit clear action whenever a query is active.
+Search resets the page number while preserving the selected KPI filter and
+row-count preset; page navigation preserves the query. Search applies to
 the complete filtered registry before pagination, including visible pending
 proposals, and never only to the current page. Specialized oversight and
 history searches may remain in their richer filter consoles when they search
@@ -826,19 +826,24 @@ changes to orange, explains that saves enter moderation, and offers a
 `RETURN TO READ-ONLY` toggle. Disabling is immediate and reversible and does not
 withdraw existing proposals. Use text for every mode state; color alone is
 insufficient. At narrow widths, stack the explanation and full-width toggle.
+Show contributor access banners only on Data Management modules. Show the
+`DATA MODE` status on those modules and the contributor-guidelines page. Omit
+data-mode controls and language from User Operations, System Oversight, and
+System Configuration because their permissions govern access independently.
 Read-only mode is an inspection surface: hide add controls, row edit actions,
 mutation forms, and editors opened through URL state. Do not merely dim or
 disable them. Registry navigation, KPI filters, pagination, search, evidence,
 and other non-mutating inspection controls remain visible and interactive.
 
-The ISAC command-status cluster includes an explicit `DATA MODE` cell alongside
-system, access, and environment. It reports the highest effective data authority
-in this order: `ADMIN`, `OVERSIGHT`, `DATA MANAGER`, `CONTRIBUTOR`, then
-`READ-ONLY`. Use a neutral treatment for read-only, orange for contributor,
-blue for Oversight authority, and green for direct-management authority. The
-label and value are mandatory because color is supplemental. At medium widths
-the four cells become a two-column grid; on narrow screens the cluster spans
-the command header width.
+The ISAC command-status cluster includes system state, access state, the themed
+ISAC node identifier, the CI build number, and an explicit `DATA MODE` cell.
+The data-mode cell reports the highest effective authority in this order:
+`ADMIN`, `OVERSIGHT`, `DATA MANAGER`, `CONTRIBUTOR`, then `READ-ONLY`. Use a
+neutral treatment for read-only, orange for contributor, blue for Oversight
+authority, and green for direct-management authority. Every cell requires a
+label and value because color provides supplemental information. At medium
+widths, arrange the cells in a two-column grid and let the data-mode cell span
+both columns. On narrow screens, the cluster spans the command header width.
 
 ### Oversight proposal corrections
 
@@ -1063,8 +1068,15 @@ must use their named component classes rather than the global application
 
 `VIEW DETAILS` opens the standard in-page modal rather than navigating
 immediately. The modal repeats sender, source, category, semantic tone, time,
-full message body, read control, and optional related-page destination. This
-keeps review context in the inbox and makes outbound navigation deliberate.
+full message body, read control, and related-page destinations. Keep the sender
+header and utility footer fixed while the message and action area scrolls.
+Group destination actions beneath an `AVAILABLE ACTIONS` label in a regular
+grid; reserve the footer for message state and closing the modal. Opening the
+modal moves focus to its close control. Trap keyboard focus inside it, support
+Escape and backdrop dismissal, and return focus to the originating `VIEW
+DETAILS` control after closing. Inbox cards show up to four lines of body copy
+at reading size before truncation. Place the per-message read control beside the
+timestamp so message state remains separate from workflow actions.
 
 ISAC message content uses the structured system-transmission body. A compact
 blue `ISAC TRANSMISSION` kicker precedes the summary, and recognized supporting
@@ -1074,20 +1086,20 @@ same hierarchy at reading size. Community messages remain conversational body
 copy; do not apply the system-transmission frame to agent comments.
 
 Inbox entries expose two distinct actions. `VIEW DETAILS` opens the complete
-message when preview copy is truncated to two lines. A separate bordered orange
-response action opens the known workflow and uses specific
-language such as `UPLOAD NEW AVATAR`, `REVISE CONTRIBUTION`, or
-`VIEW BUILD & REPLY`; never substitute a generic destination label when the
-notification type is known. The same response label appears in the detail
-modal. On mobile, response actions become full-width 44-pixel targets.
+message when its four-line preview truncates longer copy. A separate bordered
+orange response action opens the known workflow and uses specific language such
+as `UPLOAD NEW AVATAR`, `REVISE CONTRIBUTION`, or `VIEW BUILD & REPLY`; never
+substitute a generic destination label when the notification type is known.
+Lay out these controls in an auto-fitting grid so each label remains intact.
+The detail modal uses the same response labels in a three-column grid where
+space permits. On mobile, response actions become full-width 44-pixel targets.
 
-Inbox filtering uses additive segmented selectors derived from the OS Protocol
-quality control. Channels and message states are independent checkbox-backed
-segments, all selected by default, and each selection change applies
-immediately without a submit button. Selected segments use the orange lower
-rail and filled square indicator; deselected segments remain readable and
-available. The channel rail collapses from six to three and then two columns as
-space narrows, with minimum 44-pixel mobile targets.
+Inbox query controls use two compact radio-backed segmented selectors. `SHOW`
+switches between all, unread, and read messages. `SORT` offers newest, oldest,
+and unread-first order. Give both selectors the same compact width. Each
+selection applies without a submit button. Live search matches message titles,
+bodies, and sources across the paginated result set. At narrow widths, the
+selectors stack and retain 44-pixel targets.
 
 Use the shared `SegmentedChoice` component for every static, scannable ISAC
 choice set containing two through six options. Radio mode represents one
@@ -1115,10 +1127,10 @@ unfocusable and unchanged.
 
 `SegmentedChoice` supports two restrained density variants. Icon-only segments
 may omit visible text when a canonical, unambiguous game icon exists; they must
-retain an accessible label and hover title. Text-only segments may omit the
-default square indicator when the selected background, orange text, and lower
-rail communicate state. Do not remove both visible text and an
-icon from the same option.
+retain an accessible label and hover title. Do not render generic dots, squares,
+checkbox facsimiles, or radio facsimiles inside segments. The selected
+background, orange text, and lower rail communicate state. Keep visible text or
+an icon in every option.
 
 ### Skill Chip data console
 
@@ -1174,8 +1186,8 @@ grid, both selectors use at least 44-pixel targets, and changing slot clears
 incompatible Talent relationships exactly as the former selector did. Gear
 slot segments use icon-only controls with accessible slot names; registry labels
 retain icon and text for rapid table scanning. Tier segments use the compact
-game notation `T0`, `T1`, and `T2`, omit the redundant square indicator, and
-rely on the selected rail and color; do not expand these to “Tier 0” inside
+game notation `T0`, `T1`, and `T2`, and rely on the selected rail and color; do
+not expand these to “Tier 0” inside
 dense segmented controls. On desktop, icon-only Gear slot segments are square
 32-pixel cells so their classification rail stays compact and the adjacent
 record-name input receives the dominant width. Increase those cells to square
@@ -1555,9 +1567,11 @@ choices are remembered locally for that browser. Searching the rail temporarily
 reveals matching modules across all authorized categories without changing the
 remembered category state.
 
-Use the compact command-status strip for persistent system, access, environment,
-and data-mode context. These values remain textual and must not rely on color
-alone. Registry search remains available for a single page of results, while
+Use the compact command-status strip for persistent system, access, ISAC node,
+and CI build number context. Add the data-mode cell only in the Data Management
+context defined above. Keep each label above its value so the visible cells
+share one alignment. Text must communicate every state without relying on
+color. Registry search remains available for a single page of results, while
 page navigation and row-count controls appear only when the result set spans
 multiple pages. This keeps expert lookup fast without presenting inactive
 controls to contributors and first-time Oversight operators.
@@ -1765,3 +1779,16 @@ Assisted suggestions create a draft revision for review and leave activation
 to an authorized operator. Use monospaced text for raw loadout and prediction
 snapshots; labels, findings, and errors stay in the standard operational
 typeface.
+
+### Image Library assignment state
+
+An ISAC game-data editor registers each uploaded icon in the Image Library. The
+library record and editor share one processed file. Its card uses `ASSIGNED
+ICON`, names the owning entity type beside the category, and carries searchable
+tags for `isac`, `game data`, the module, the entity name, and entity context
+such as quality, focus, ability, or Talent category.
+
+Operators may rename, recategorize, and add tags to the library record. Replacing
+the icon from its game-data editor keeps that metadata and refreshes the context
+tags and file facts. Removing the source icon removes its linked library record.
+General library uploads retain the `ICON` or `IMAGE` state.

docs/architecture.md

@@ -367,6 +367,19 @@ time by the static `/missing-item-icon.svg` asset through the shared
 `MISSING_ITEM_ICON_URL` constant and `ItemIcon` component. The placeholder does
 not enter `game_data_icons`. A later edit or proposal can attach the real icon
 without recreating the canonical item.
+
+`source_entity_type` and `source_entity_id` link each `game_data_icons` row to a
+`managed_images` record. Both records share one storage key and one WebP file.
+The managed record adds the searchable library name, category, tags, creator,
+dimensions, and assignment state. Game-data icon saves upsert this record, keep
+operator-edited metadata, and merge current entity-context tags. Removing a
+source icon removes the linked library record and shared file.
+
+The additive database migration registers older game-data icons and selects an
+administrator or the earliest active account as the migration actor. ISAC and
+managed-image exports accept linked storage keys. Environment synchronization
+keeps the library metadata and one copy of each file.
+
 # Oversight notification dispatch
 
 New Data Change and Avatar Oversight review items are routed only to agents who