eleven / messenger Public

Apps live in places — the unified placement model, space-wide installs, and the pullback (#853)

Squashed history of PR #853. The through-line: replace the app framework's
tangle of placement flags with ONE vocabulary — `places` — carry it through
routing, the UI, and the member-app pipeline, then deliberately pull the
member-facing surface back behind a flag while the machinery stays live.

The places model
- Every app declares `places`: any non-empty subset of ["you","chat","space"].
  Legacy flags (personal/groupCapable/spaceCapable) and the older `scope` enum
  are accepted as INPUT at one funnel (normalizePlaces) then deleted, so nothing
  downstream reads a capability flag and a stale one can't disagree with places.
- Space-wide apps: one shared instance in a hidden all-members space thread,
  its commands usable from every chat; a sidebar "space band" home; install via
  the Apps sheet or `/cmd @everyone`. The Vault is space-capable (a team
  credential shelf); /gif asks for one Giphy key per space, asked once.
- The place-flag family — @me / @here / @everyone — with the "/" typeahead
  teaching the flags as selectable rows, in flowing per-row sentences.
- The Apps sheet is focus-and-explain: one directory, each app naming its
  places, the verb on a footer action.

The pullback (member-facing UI hidden, machinery live)
- Shipped apps park at ["you","chat"]; the multi-place UI hides behind the
  PLACES_UI device flag (default off) so two same-named rows can't appear in
  the thread list. Space band, install sheets, and space routing stay live and
  tested via synthetic fixtures.

The hook split
- chatMessage now means only "companion Chat view"; groupFeedMessage is the
  feed-only projection into group chats (fallback: chatMessage(_, {group:true})).
  Replaces the mis-named groupChatOnly flag — the hook shape is the declaration.

Member apps
- May declare any non-empty places subset (space-only + listed:false, the /gif
  shape, included). A documented compat policy (docs/member-apps.md § Legacy
  formats) + App Studio "older format" flag with one-tap in-place Upgrade.

Security + review fixes
- Member commands that collide with an existing verb (built-in or another app)
  are rejected at the load-time gate — a crafted blob could otherwise shadow
  /todo or /help on every client and route typed args into a hijacker-readable
  log. Plus confirmed lows: @here stripped on chat-only apps, spaceAppInfo
  honours the admins-only policy, installs registry declares places:[].

Docs: apps/README, space-apps.md, building-apps.md, building-member-apps.md,
member-apps.md, app-credentials.md, CLAUDE.md all speak places; the bot's
served guide teaches it. Tests + event vectors move with the contract.

Co-authored-by: Claude <noreply@anthropic.com>