docs(setup): the AI Copilot checklist says what Setup actually ships

.changeset/setup-checklist-ai-copilot-says-what-ships.md

@@ -0,0 +1,58 @@
+---
+'hotcrm': patch
+---
+
+The admin setup checklist's **14. AI Copilot** section stops citing a `Setup → AI`
+group that does not exist, and stops asking for two screens that do not ship.
+
+`administration/setup` line 136 read "Confirm the AI Copilot is enabled (Setup →
+AI)" in all three faces — bare parenthesised prose, which is why it survived
+every pass that cleared the navigation quarantine ledger: rule 2 of
+`test/docs-setup-navigation-names.test.ts` matches a **bold** `**App → …**`
+citation, and rule 1 cannot ban `AI`, a real *Studio* group label. The two
+adjacent items were filed as suspected-but-unmeasured, and all three are
+resolved here against the installed platform (`@objectstack/* 17.3.0`).
+
+**Setup ships no `AI` group.** Its nine are *Overview*, *Apps*, *People &
+Organization*, *Access Control*, *Approvals*, *Configuration*, *Diagnostics*,
+*Integrations*, *Advanced*; `AI` is a **Studio** group holding *Agents*,
+*Tools* and *Skills*. Re-resolved the way the guard builds its roster —
+`SETUP_APP.navigation` + `SETUP_NAV_CONTRIBUTIONS` + `SetupAppTranslations`
+across the four shipped locales.
+
+**Nothing enables the Copilot.** The `ai` settings namespace behind
+*Configuration → AI & Embedder* carries no master switch: its only toggles are
+*Auto-summarize conversation titles*, *Record traces* and *Log full prompts*,
+and its only gestures are *Test connection*, *Test embedder* and *Reset to
+environment defaults*. The one control that looks like the switch — the beta
+*AI Assistant* toggle in the `feature_flags` namespace (*Configuration →
+Feature Flags*) — ships **off**, and the key `ai_enabled` occurs nowhere in the
+installed platform except its own manifest and its four locale labels. What
+does decide whether the Copilot can answer is the **provider**, which defaults
+to *Memory (echo — testing only)*: an environment that never sets one has an
+assistant that replays the question. So the item became that check plus a
+denial, not a redirect to a plausible screen.
+
+**There is no per-skill enable surface in Setup.** No Setup entry names skills,
+and none of the eleven settings namespaces carries a skill key. Skills are
+metadata: `SkillSchema` carries `active` (default `true`), the six HotCRM
+skills declare it nowhere and therefore all ship active, and the roster comes
+from `allSkills` in `src/skills/index.ts` — an app change, documented under
+Customization › AI Skills. The item now points at **Studio → AI → Skills** for
+the roster and says the set is decided in the app.
+
+**There are no AI sensitivity or redaction rules to configure.** The only
+`redactFields` the platform defines belongs to an object's `publicSharing`
+block — "field names removed from records served via a share token", which
+`crm_knowledge_article` uses for share links and which has nothing to do with
+the Copilot. What limits what the Copilot may read is field-level security, as
+`administration/sharing-and-security` already states in its own words: FLS is
+enforced in list views, reports, the API and the AI Copilot alike, and the
+Copilot reads as the signed-in user. The item now sends the reader there.
+
+Every surviving path is written in **bold**, the shape rule 2 of the guard
+resolves live, rather than the parenthesised prose no rule could see. The
+localized faces keep their conventions: zh-Hans uses the zh-CN language-pack
+labels (**设置 → 配置 → AI 与 Embedder**, **Studio → AI → 技能**), zh-Hant
+spells platform navigation in English because the console falls back to
+Simplified.

content/docs/administration/setup.mdx

@@ -133,10 +133,12 @@ There is nothing to seed called *Sales Knowledge*, *Product Information* or *Com
 
 ### 14. AI Copilot
 
-- [ ] Confirm the AI Copilot is enabled (Setup → AI)
-- [ ] Choose which skills to enable
-- [ ] Run a sample query (*"Give me Customer 360 on [test account]"*) to verify
-- [ ] Configure data sensitivity rules — which fields the Copilot must redact
+There is no *AI* group in Setup, and no screen turns the Copilot on. Setup carries exactly two AI surfaces: **Setup → Configuration → AI & Embedder**, which configures the provider, model and embedder, and a beta *AI Assistant* toggle under **Setup → Configuration → Feature Flags** that ships off and that nothing in the platform reads. What makes the Copilot answer is a configured provider; which skills it can run belongs to the app, not to setup. *AI* as a navigation group is **Studio → AI** (Agents / Tools / Skills).
+
+- [ ] Confirm the provider at **Setup → Configuration → AI & Embedder** is a real one — it defaults to *Memory (echo — testing only)*, which replays your input instead of answering — then press *Test connection*
+- [ ] Run a sample query (*"Give me Customer 360 on [test account]"*) to verify — an answer that cites real records means the provider is live
+- [ ] Review the skills the Copilot ships with at **Studio → AI → Skills** — they all ship active, and which ones exist is decided in the app rather than picked here (see [Skills](/docs/ai-copilot/skills))
+- [ ] Look at field-level security rather than for AI redaction rules: the Copilot reads as the signed-in user, so a field masked on their profile never reaches it (see [Sharing & security](/docs/administration/sharing-and-security))
 
 ## ✅ Day 6 — Dashboards & reports
 

content/docs/administration/setup.zh-Hans.mdx

@@ -133,10 +133,12 @@ HotCRM 只附带**一个**知识对象，而不是一组知识库。下面每一
 
 ### 14. AI Copilot
 
-- [ ] 确认 AI Copilot 已启用（设置 → AI）
-- [ ] 选择要启用哪些技能
-- [ ] 运行一个示例查询（*“给我 [测试客户] 的 Customer 360”*）以验证
-- [ ] 配置数据敏感性规则 —— Copilot 必须脱敏哪些字段
+设置里没有 *AI* 分组，也没有任何界面能把 Copilot 打开。设置里与 AI 相关的只有两处：**设置 → 配置 → AI 与 Embedder**（配置提供商、模型与 Embedder），以及 **设置 → 配置 → 功能开关** 下那个默认关闭、平台里没有任何东西读取的测试版 *AI 助手* 开关。让 Copilot 能作答的是一个配置好的提供商；它能跑哪些技能由应用本身决定，不属于安装环节。作为导航分组的 *AI* 在 **Studio → AI**（智能体 / 工具 / 技能）。
+
+- [ ] 确认 **设置 → 配置 → AI 与 Embedder** 里选的是一个真实提供商 —— 它默认是 *Memory(回显 — 仅测试)*，只把你的输入原样回显而不作答 —— 然后点 *测试连接*
+- [ ] 运行一个示例查询（*“给我 [测试客户] 的 Customer 360”*）以验证 —— 能引用真实记录作答，就说明提供商已生效
+- [ ] 在 **Studio → AI → 技能** 里过一遍 Copilot 随附的技能 —— 它们都是启用的；有哪些技能由应用决定，而不是在这里挑选（参见 [技能](/zh-Hans/docs/ai-copilot/skills)）
+- [ ] 不要去找 AI 脱敏规则，去看字段级安全：Copilot 以当前登录用户的身份读取，某个字段在他的权限档案里被遮罩，就永远到不了 Copilot（参见 [共享与安全](/zh-Hans/docs/administration/sharing-and-security)）
 
 ## ✅ 第 6 天 —— 仪表板与报表
 

content/docs/administration/setup.zh-Hant.mdx

@@ -133,10 +133,12 @@ HotCRM 只附帶**一個**知識物件，而不是一組知識庫。下面每一
 
 ### 14. AI Copilot
 
-- [ ] 確認 AI Copilot 已啟用（Setup → AI）
-- [ ] 選擇要啟用哪些技能
-- [ ] 執行一個範例查詢（*「給我 [測試客戶] 的 Customer 360」*）以驗證
-- [ ] 設定資料敏感性規則 —— Copilot 必須脫敏哪些欄位
+Setup 裡沒有 *AI* 分組，也沒有任何畫面能把 Copilot 打開。Setup 裡與 AI 相關的只有兩處：**Setup → Configuration → AI & Embedder**（設定供應商、模型與 Embedder），以及 **Setup → Configuration → Feature Flags** 底下那個預設關閉、平台裡沒有任何東西讀取的測試版 *AI Assistant* 開關。讓 Copilot 能作答的是一個設定好的供應商；它能跑哪些技能由應用本身決定，不屬於安裝環節。作為導覽分組的 *AI* 在 **Studio → AI**（Agents / Tools / Skills）。
+
+- [ ] 確認 **Setup → Configuration → AI & Embedder** 裡選的是一個真實供應商 —— 它預設是 *Memory (echo — testing only)*，只把你的輸入原樣回顯而不作答 —— 然後按 *Test connection*
+- [ ] 執行一個範例查詢（*「給我 [測試客戶] 的 Customer 360」*）以驗證 —— 能引用真實記錄作答，就表示供應商已生效
+- [ ] 在 **Studio → AI → Skills** 裡過一遍 Copilot 隨附的技能 —— 它們都是啟用的；有哪些技能由應用決定，而不是在這裡挑選（參見 [技能](/zh-Hant/docs/ai-copilot/skills)）
+- [ ] 不要去找 AI 脫敏規則，去看欄位層級安全：Copilot 以目前登入使用者的身分讀取，某個欄位在他的權限設定檔裡被遮罩，就永遠到不了 Copilot（參見 [共用與安全](/zh-Hant/docs/administration/sharing-and-security)）
 
 ## ✅ 第 6 天 —— 儀表板與報表