docs: update .ai docs for session fix and owner dashboard

https://claude.ai/code/session_01JmHn8AGZVkKPAvHDgR67Hu

Author: claude

.ai/status.md

@@ -8,8 +8,16 @@
 <!-- ====================================================================== -->
 
 ## Last Updated
-2026-03-11 -- **Sprint V-5: Journal fixes, session edit, @mentions, audio attachments.**
+2026-03-11 -- **Session fix + Owner Dashboard (two-dashboard architecture).**
 
+30. **Session completion fix + two-dashboard architecture.** Two changes:
+    - **Session "Mark Complete" bug fix**: `hx-vals` always sends form-encoded data regardless of `hx-headers` Content-Type. `UpdateSessionAPI` expects JSON, so the decode failed → 400 error → red notification bar. Replaced with `Chronicle.apiFetch()` onclick handler using `data-url` and `data-name` attributes. Also fixes XSS risk from session name interpolation into JSON template string.
+    - **Two-dashboard architecture**: Split campaign dashboard into two independently customizable dashboards:
+      - **Campaign Page** (`GET /campaigns/:id`) — visible to all members and public visitors. The "front page" of the campaign.
+      - **Owner Dashboard** (`GET /campaigns/:id/dashboard`) — visible only to campaign owner. Campaign management with quick links (Settings, Customize, Members, Plugins), category grid, and recent entities.
+      New migration (000006) adds `owner_dashboard_layout` JSON column. Full CRUD: model field + parser, repository query updates, service methods with shared `validateDashboardLayout()` helper, handler + routes, `OwnerDashboardPage` templ component, sidebar "Dashboard" link for owners, and second dashboard editor section in Customization Hub.
+
+### Previous Update
 29. **Journal + Sessions + Audio Attachments sprint.** Four changes:
     - **Journal save bug fix**: `journal.js` referenced `window.Chronicle._tiptapBundle` which doesn't exist — the TipTap bundle is `window.TipTap`. Fixed the reference so TipTap editor loads correctly and notes save.
     - **Session edit UI**: Added edit button + modal on session detail page. Pre-populates all fields (name, date, summary, status, recurrence). Submits JSON PUT to existing `UpdateSessionAPI` endpoint. Visible to Scribe+ users.

.ai/todo.md

@@ -58,6 +58,7 @@ Known broken or missing things, ordered by severity.
 - [x] **Timeline event creation from timeline page** — Already implemented: "Create Event" button in header opens modal with full form (name, date, description, category, visibility, color, multi-day, recurrence). POST to standalone-events API.
 - [x] **Calendar shows as pending plugin in admin** — Fixed: set calendar and API to PluginActive, added 5 missing active plugins to registry.
 - [x] **False "confirm before leaving" dialog** — Fixed: added htmx:beforeRedirect listener to clear dirty form state before HTMX redirects.
+- [x] **Session "Mark Complete" button fails with red error bar** — `hx-vals` sends form-encoded data but `UpdateSessionAPI` expects JSON. Replaced with `Chronicle.apiFetch()` onclick. Also fixed XSS risk from session name interpolation into JSON string.
 - [x] **Image upload 500 error (ClamAV)** — Removed ClamAV entirely, added structured error logging to upload pipeline.
 - [x] **Nav panel not showing new entities** — Fixed: sidebar drill panel refreshes content on navigation instead of closing.
 - [x] **Shop inventory "entity type not found" in template editor** — Fixed: added missing data-campaign-id to layout editor fragment widget mount.
@@ -188,7 +189,7 @@ _Fix orphaned data, cascade gaps, and admin DB visibility. See `.ai/phases.md`._
 
 ### Phase U: Collaboration & Platform Maturity
 
-- [ ] **Sprint U-1: Role-Aware Dashboards** — Role-keyed dashboard layouts. Dashboard editor gains role selector. Players see role-specific dashboard or default fallback.
+- [~] **Sprint U-1: Role-Aware Dashboards** — Two-dashboard architecture implemented: Campaign Page (public, `/campaigns/:id`) and Owner Dashboard (owner-only, `/campaigns/:id/dashboard`). Both independently customizable via Customization Hub. Migration 000006 adds `owner_dashboard_layout` column. Remaining: role selector in dashboard editor so Players/Scribes can see role-specific campaign page layouts.
 - [ ] **Sprint U-2: Invite System** — Migration: `campaign_invites` table. Email invitations with one-click accept link. Non-public campaigns require invitation. Invite management UI.
 - [ ] **Sprint U-3: 2FA/TOTP Support** — TOTP enrollment with QR code (`pquerna/otp`). Login redirect to TOTP input. Recovery codes (8 hashed). Admin force-disable.
 - [ ] **Sprint U-4: Accessibility Audit (WCAG 2.1 AA)** — ARIA labels, focus traps, skip-to-content, color contrast 4.5:1, keyboard nav, screen reader announcements, axe-core scanning.

internal/plugins/campaigns/.ai.md

@@ -51,7 +51,8 @@ Plugin (Core -- always enabled)
 | GET | /campaigns | Index | Auth only | List user's campaigns |
 | GET | /campaigns/new | NewForm | Auth only | Create campaign form |
 | POST | /campaigns | Create | Auth only | Create campaign |
-| GET | /campaigns/:id | Show | Player | Campaign dashboard |
+| GET | /campaigns/:id | Show | Player | Campaign page (public dashboard) |
+| GET | /campaigns/:id/dashboard | OwnerDashboard | Owner | Owner-only management dashboard |
 | GET | /campaigns/:id/edit | EditForm | Owner | Edit form |
 | PUT | /campaigns/:id | Update | Owner | Update campaign |
 | DELETE | /campaigns/:id | Delete | Owner | Delete campaign |
@@ -65,6 +66,9 @@ Plugin (Core -- always enabled)
 | GET | /campaigns/:id/accept-transfer | AcceptTransfer | Auth only | Accept (token) |
 | POST | /campaigns/:id/cancel-transfer | CancelTransfer | Owner | Cancel transfer |
 | GET | /campaigns/:id/customize | Customize | Owner | Customization Hub |
+| GET | /campaigns/:id/owner-dashboard-layout | GetOwnerDashboardLayout | Owner | Get owner dashboard layout JSON |
+| PUT | /campaigns/:id/owner-dashboard-layout | UpdateOwnerDashboardLayout | Owner | Save owner dashboard layout |
+| DELETE | /campaigns/:id/owner-dashboard-layout | ResetOwnerDashboardLayout | Owner | Reset owner dashboard to defaults |
 | GET | /campaigns/:id/plugins | PluginHub | Player | Features page |
 | GET | /campaigns/:id/sidebar-config | GetSidebarConfig | Player | Get sidebar config |
 | PUT | /campaigns/:id/sidebar-config | UpdateSidebarConfig | Owner | Save sidebar order/visibility |
@@ -89,6 +93,15 @@ Plugin (Core -- always enabled)
 - **Accent color**: `accent_color` column — CSS `--color-accent` override injected via layout
 - Campaign settings page has image upload and color picker sections
 
+## Two-Dashboard Architecture
+
+Campaigns have two independently customizable dashboards:
+
+- **Campaign Page** (`GET /campaigns/:id`) — visible to all members and public visitors. The "front page" of the campaign. Layout stored in `dashboard_layout` column.
+- **Owner Dashboard** (`GET /campaigns/:id/dashboard`) — visible only to campaign owner. Management-focused dashboard with quick links (Settings, Customize, Members, Plugins), category grid, and recent entities. Layout stored in `owner_dashboard_layout` column (migration 000006).
+
+Both dashboards use the same `DashboardBlockSwitch` dispatcher and are editable via the Customization Hub (Dashboard tab shows both editors side-by-side). The dashboard editor widget mounts with different `data-endpoint` values pointing to the respective layout APIs.
+
 ## Dashboard Block Types
 
 The campaigns plugin defines the central `DashboardBlockSwitch` dispatcher. Supported block types: