@@ -0,0 +1,10 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+feat(platform-objects): Setup's user page gains an "AI Assistants" tab, for platform administrators
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@objectstack/platform-objects`**: the `sys_user` record page (`sys_user_detail`) has a new "AI Assistants" tab, beside API Keys, labelled in en, zh-CN, ja-JP, es-ES and zh-Hant. Its body is the console widget `mcp:authorized-assistants`: the AI assistants (OAuth clients such as Claude Desktop) this person authorized, each with a confirm-first Revoke. An administrator can now see and end what acts as a person who cannot sign in to withdraw it themselves (a lost laptop, a departure). The tab is shown only to a platform administrator (`current_user.isPlatformAdmin == true` on the tab item): the widget's list and Revoke go through the platform-admin-gated `/api/v1/auth/admin/authorized-clients` doors, so any other viewer could only see a refusal. The server's gate is unchanged.
@@ -38,7 +38,7 @@
 import { readFileSync, readdirSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { describe, expect, it } from 'vitest';
-import type { Page } from '@objectstack/spec/ui';
+import { ComponentPropsMap, type Page } from '@objectstack/spec/ui';
 import { auditPageExpressionEnvelopes, renderBareExpressionFindings } from '@objectstack/lint';
 // The one answer this tree has to "comment, literal, or code". It is a plain
 // `.mjs`, but `scripts/js-comment-mask.d.mts` beside it is a hand-written
@@ -159,6 +159,30 @@ function declaredPageExports(): { name: string; file: string }[] {
   return out.sort((a, b) => a.name.localeCompare(b.name));
 }
 
+/**
+ * Console-registered widget types with no `ComponentPropsMap` row, each with
+ * the reason door 3 loses nothing on it (the detector's header: a consumer
+ * records such an exemption in its own assert, never by ignoring the
+ * channel). The reason is held, not only stated: every node of an exempted
+ * type must author an EMPTY `properties` bag, so there is no props-level
+ * expression key for door 3 to miss. A node that starts authoring props reds
+ * the test below, and then the type needs its props schema.
+ */
+const UNMAPPED_TYPE_EXEMPTIONS: Readonly<Record<string, string>> = {
+  'mcp:authorized-assistants':
+    'the user page\'s AI Assistants tab body (@object-ui/app-shell): the widget takes no props and reads '
+    + 'the bound sys_user record, so its authored `properties` is `{}` and holds no expression key',
+};
+
+/** The authored node at an audit path such as `regions[0].components[2].properties.items[10].children[0]`. */
+function nodeAt(page: Page, path: string): unknown {
+  let cur: unknown = page;
+  for (const seg of path.match(/[^.[\]]+/g) ?? []) {
+    cur = isRec(cur) || Array.isArray(cur) ? (cur as AnyRec)[seg] : undefined;
+  }
+  return cur;
+}
+
 const AUDITS = EXPORTED_PAGES.map(([exportName, page]) => ({
   exportName,
   page,
@@ -205,15 +229,28 @@ describe('platform Page exports serve canonical expression envelopes', () => {
     expect(audit.componentCount).toBeGreaterThan(0);
   });
 
-  it.each(AUDITS)('$exportName: every component type is declared in ComponentPropsMap (door 3 precondition)', ({ audit }) => {
+  it.each(AUDITS)('$exportName: every component type is declared in ComponentPropsMap (door 3 precondition)', ({ page, audit }) => {
+    const exempted = audit.unmappedTypes.filter(e => Object.hasOwn(UNMAPPED_TYPE_EXEMPTIONS, e.type));
+    for (const e of exempted) {
+      const node = nodeAt(page, e.path);
+      expect(isRec(node) && node.type === e.type, `${e.path} does not resolve to its ${e.type} node`).toBe(true);
+      expect((node as AnyRec).properties ?? {}, `${e.path} [${e.type}] authors props, so its exemption no longer holds`).toEqual({});
+    }
     expect(
-      audit.unmappedTypes.map(e => `${e.path} [${e.type}]`).join('\n'),
+      audit.unmappedTypes.filter(e => !exempted.includes(e)).map(e => `${e.path} [${e.type}]`).join('\n'),
       'door 3 has no props schema for these component types, so any expression key inside '
         + 'their `properties` is unread by this gate. Either declare the props schema, or '
         + 'record the exemption here with the reason.',
     ).toBe('');
   });
 
+  it('every unmapped-type exemption is live: the type is still unmapped, and a shipped page still mounts it', () => {
+    for (const type of Object.keys(UNMAPPED_TYPE_EXEMPTIONS)) {
+      expect(Object.hasOwn(ComponentPropsMap, type), `${type} now has a ComponentPropsMap row: drop its exemption`).toBe(false);
+      expect(AUDITS.some(({ audit }) => audit.unmappedTypes.some(e => e.type === type)), `no shipped page mounts ${type}`).toBe(true);
+    }
+  });
+
   it.each(AUDITS)('$exportName: every authored `properties` bag parses against its props schema (door 3 precondition)', ({ audit }) => {
     expect(
       audit.unreadableProps.map(e => `${e.path} [${e.type}]: ${e.issues}`).join('\n'),
 
@@ -0,0 +1,130 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #31085 — the user page's "AI Assistants" tab: the place an administrator
+ * sees, and revokes, the AI assistants a person authorized.
+ *
+ * The tab's body is the console widget `mcp:authorized-assistants`, which
+ * reads the page's bound `sys_user` record and calls
+ * `/api/v1/auth/admin/authorized-clients`, a door that refuses every caller
+ * below platform admin. So the tab item carries the ADR-0095 D3 PLATFORM_ADMIN
+ * rung, in the CEL envelope, the same item-level mechanism the Security tab
+ * uses: a viewer the door refuses is not shown a tab that can only draw a 403.
+ *
+ * Read from the shipped page metadata, so the pin fails if the tab leaves the
+ * strip or moves, if its body changes, and if its gate is dropped, loses its
+ * envelope, or starts reading standing from `positions`. The gate is evaluated
+ * with `@objectstack/formula`'s `celEngine` under the console's binding — the
+ * whole scope as `extra`, one subject under `current_user` / `user` /
+ * `ctx.user` / `os.user` — and ⛔ not through `user:`, under which the engine
+ * re-derives `isPlatformAdmin` from `positions`.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { celEngine } from '@objectstack/formula';
+import { PageSchema } from '@objectstack/spec/ui';
+import { SysUserDetailPage } from './sys-user.page.js';
+
+type Rec = Record<string, unknown>;
+
+/** The standing, spelled as the object's platform-admin actions spell it. */
+const STANDING = 'current_user.isPlatformAdmin == true';
+
+/** The strip, in order: the new tab sits beside API Keys. */
+const STRIP = [
+  'Details',
+  'Positions',
+  'Permission Sets',
+  'Business Units',
+  'Sessions',
+  'Linked Accounts',
+  'Organizations',
+  'OAuth Apps',
+  'Security',
+  'API Keys',
+  'AI Assistants',
+  'Preferences',
+];
+
+type Subject = { id: string | null; email: string; isPlatformAdmin: boolean; positions: string[] };
+
+const PLATFORM_ADMIN: Subject = { id: 'u_pa', email: 'pa@example.com', isPlatformAdmin: true, positions: [] };
+
+/** Every viewer the door refuses, the grades first, then the position the rung must never be read from. */
+const REFUSED: ReadonlyArray<[string, Subject]> = [
+  ['org owner', { id: 'u_owner', email: 'owner@example.com', isPlatformAdmin: false, positions: ['org_owner'] }],
+  ['org admin', { id: 'u_admin', email: 'admin@example.com', isPlatformAdmin: false, positions: ['org_admin'] }],
+  ['plain member', { id: 'u_member', email: 'member@example.com', isPlatformAdmin: false, positions: ['member'] }],
+  [
+    "a tenant-written 'platform_admin' position without the rung",
+    { id: 'u_pos', email: 'pos@example.com', isPlatformAdmin: false, positions: ['platform_admin', 'org_owner'] },
+  ],
+  // The console's signed-out identity (`buildExpressionUser(null)`).
+  ['signed out', { id: null, email: '', isPlatformAdmin: false, positions: [] }],
+];
+
+/** The record the tab is drawn on: someone else's, and the viewer's own. */
+const records = (subject: Subject): Array<Record<string, unknown>> => [
+  { id: 'u_someone_else', email: 'else@example.com' },
+  { id: subject.id, email: subject.email },
+];
+
+function shown(source: string, subject: Subject, record: Record<string, unknown>): boolean {
+  const r = celEngine.evaluate(
+    { dialect: 'cel', source },
+    { record, extra: { current_user: subject, user: subject, ctx: { user: subject }, os: { user: subject } } },
+  );
+  return r.ok && r.value === true;
+}
+
+describe('sys_user_detail — the AI Assistants tab', () => {
+  const tabs = (SysUserDetailPage.regions![0]!.components as Rec[]).find((c) => c.type === 'page:tabs') as Rec;
+  const items = (tabs.properties as Rec).items as Rec[];
+  const tab = items.find((it) => (it.label as Rec).en === 'AI Assistants')!;
+
+  it('parses through PageSchema', () => {
+    const parsed = PageSchema.safeParse(SysUserDetailPage);
+    expect(parsed.success, JSON.stringify(parsed.error?.issues ?? [])).toBe(true);
+  });
+
+  it('sits in the strip beside API Keys', () => {
+    expect(items.map((it) => (it.label as Rec).en)).toEqual(STRIP);
+  });
+
+  it('carries the label in every locale the sibling tabs spell', () => {
+    expect(tab.label).toEqual({
+      en: 'AI Assistants',
+      'zh-CN': 'AI 助手',
+      'ja-JP': 'AI アシスタント',
+      'es-ES': 'Asistentes de IA',
+      'zh-Hant': 'AI 助理',
+    });
+    for (const sibling of items) {
+      expect(Object.keys(sibling.label as Rec).sort(), String((sibling.label as Rec).en)).toEqual(
+        Object.keys(tab.label as Rec).sort(),
+      );
+    }
+  });
+
+  it('mounts the `mcp:authorized-assistants` widget, with no props, as its only child', () => {
+    expect(tab.children).toEqual([{ type: 'mcp:authorized-assistants', properties: {} }]);
+  });
+
+  it('carries the platform-admin gate on the tab item, in the CEL envelope', () => {
+    expect(tab.visibleWhen).toEqual({ dialect: 'cel', source: STANDING });
+  });
+
+  it('is shown to a platform administrator, on any user record', () => {
+    const source = (tab.visibleWhen as { source: string }).source;
+    for (const record of records(PLATFORM_ADMIN)) {
+      expect(shown(source, PLATFORM_ADMIN, record), JSON.stringify(record)).toBe(true);
+    }
+  });
+
+  it.each(REFUSED)('is not shown to %s, on any user record — own record included', (_name, subject) => {
+    const source = (tab.visibleWhen as { source: string }).source;
+    for (const record of records(subject)) {
+      expect(shown(source, subject, record), JSON.stringify(record)).toBe(false);
+    }
+  });
+});
@@ -41,9 +41,11 @@ describe('sys_user_detail — the Security tab is gated to the viewer\'s own rec
     expect(security.visibleWhen).toEqual({ dialect: 'cel', source: OWN_RECORD });
   });
 
-  it('gates only the Security tab — every other tab item carries no item-level gate', () => {
+  it('gates only the Security and AI Assistants tabs — every other tab item carries no item-level gate', () => {
+    // AI Assistants carries the platform-admin gate, not an own-record one:
+    // pinned in `sys-user-ai-assistants-tab.test.ts`.
     const gated = items.filter((it) => it.visibleWhen !== undefined).map((it) => (it.label as Rec).en);
-    expect(gated).toEqual(['Security']);
+    expect(gated).toEqual(['Security', 'AI Assistants']);
   });
 
   it('names only actions that are themselves own-record on the object', () => {
 
@@ -60,7 +60,8 @@ const TWO_FACTOR_OFFERED = P`has(features.twoFactor) && features.twoFactor == tr
  *  - The other tabs are **explicitly curated** to the related lists
  *    that matter on a user profile (Positions / Permission Sets / Business
  *    Units / Sessions / Linked Accounts / Organizations / OAuth Apps / API
- *    Keys / Preferences) plus a Security tab. The synthesized strip would
+ *    Keys / Preferences) plus a Security tab and, for platform
+ *    administrators only, an AI Assistants tab. The synthesized strip would
  *    carry a tab per object that has a FK to sys_user
  *    (sys_position.created_by, sys_email.updated_by,
  *    sys_email_template.created_by, …), dozens of noisy "查看全部" cards
@@ -610,6 +611,37 @@ export const SysUserDetailPage: Page = {
                   },
                 ],
               },
+              // ── AI Assistants ─────────────────────────────────────────
+              // The AI assistants (OAuth clients such as Claude Desktop) this
+              // person authorized, each with a confirm-first Revoke: where an
+              // administrator ends what acts as someone who cannot sign in to
+              // withdraw it themselves (a lost laptop, a departure). Beside API
+              // Keys, the other credential that acts as this user.
+              //
+              // The body is the console widget `mcp:authorized-assistants`
+              // (`@object-ui/app-shell`). It takes no props and reads the page's
+              // bound `sys_user` record; its list and its Revoke call
+              // `/api/v1/auth/admin/authorized-clients`, which refuses every
+              // caller below platform admin (the ADR-0068 platform-admin gate).
+              //
+              // So the tab item carries the ADR-0095 D3 PLATFORM_ADMIN rung, the
+              // standing that door admits, spelled as the object's platform-admin
+              // actions spell it: shown to anyone else, the tab could only draw
+              // the server's 403. An item-level `visibleWhen` omits the tab
+              // header AND panel, the mechanism the Security tab uses. ⛔ Never
+              // `'platform_admin' in current_user.positions`: standing is read
+              // from the key, and a tenant can write a position by that name.
+              // The gate widens and narrows nothing on the server, which refuses
+              // anyone else either way. Same `P` envelope as the Security tab:
+              // this raw `Page` literal reaches the wire verbatim.
+              {
+                label: { en: 'AI Assistants', 'zh-CN': 'AI 助手', 'ja-JP': 'AI アシスタント', 'es-ES': 'Asistentes de IA', 'zh-Hant': 'AI 助理' },
+                icon: 'bot',
+                visibleWhen: P`current_user.isPlatformAdmin == true`,
+                children: [
+                  { type: 'mcp:authorized-assistants', properties: {} },
+                ],
+              },
               // ── Preferences ───────────────────────────────────────────
               // [#23803] This user's `sys_user_preference` rows — the console's
               // per-user UI state (`ui.recent`, `ui.favorites`, `ui.list.<object>`