feat(settings): multi-version uninstall picker + default_scope editor

Two operator surfaces shipped together:

**Multi-version uninstall picker** — when more than one version
of a `(provider, name)` is installed side-by-side, both the
module-sheet "Uninstall" affordance and the store-detail
"Uninstall" affordance now ask the operator which version to
remove before calling the RPC. The hub's wire-level support for
this (UninstallModuleRequest.version) was already there; Studio
just wasn't using it. Picker pre-selects the highest version so
single-version flows still take one click.

  - `HubService.installedVersions(name)` enumerates the installed
    versions via the capabilities list.
  - `HubService.uninstallModule(name, version: ...)` forwards
    the version into the RPC.
  - `_UninstallVersionPickerDialog` (module sheet) and
    `_StoreUninstallVersionPickerDialog` (store) host the
    picker — separate widgets so each surface can evolve copy
    independently. Uses `RadioGroup<String>` for Flutter
    3.32+ deprecation compliance.

**Default scope editor** — new DEFAULT SCOPE panel in Settings
that calls the freshly-added HubAdmin RPCs
`GetDefaultScope` / `SetDefaultScope`. Operators can:

  - reorder publisher segments with up/down buttons
    (first match wins in the bare-form resolver),
  - delete entries (hub still rejects empty list — Studio
    surfaces the constraint inline),
  - add arbitrary entries via the text field,
  - add catalog-known publishers via suggestion chips
    (sorted alphabetically, populated from the catalog).

Every change persists to `~/.fai/config.yaml` via the hub
and hot-swaps the in-memory copy without a daemon restart.

Bumped pubspec to 0.48.0. dart analyze clean (No issues
found!); flutter test green (11 tests).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/hub.dart

@@ -391,13 +391,50 @@ class HubService {
 
   /// Remove an installed module by name. Returns the version
   /// that was removed so the caller can confirm.
+  ///
+  /// Pass [version] to target a specific version when multiple
+  /// versions of the same `(provider, name)` are installed
+  /// side-by-side. Empty / omitted lets the hub pick the
+  /// highest-version match.
   Future<({String name, String version})> uninstallModule(
-    String name,
-  ) async {
-    final r = await _client.uninstallModule(name);
+    String name, {
+    String version = '',
+  }) async {
+    final r = await _client.uninstallModule(name, version: version);
     return (name: r.name, version: r.version);
   }
 
+  /// Read the operator's `default_scope:` plus the catalog-known
+  /// publisher shortlist. Used by Settings → DEFAULT SCOPE panel.
+  Future<({List<String> scope, List<String> knownProviders})>
+      getDefaultScope() async {
+    return _client.getDefaultScope();
+  }
+
+  /// Replace the operator's `default_scope:` and hot-swap on the
+  /// running hub. Caller passes the new ordered list; hub rejects
+  /// an empty list with InvalidArgument.
+  Future<({List<String> scope, List<String> knownProviders})>
+      setDefaultScope(List<String> scope) async {
+    return _client.setDefaultScope(scope);
+  }
+
+  /// Every installed version of one module, sorted newest-last.
+  /// Returns an empty list when nothing matches. Used by the
+  /// uninstall flow to show a picker when more than one version
+  /// is installed side-by-side.
+  Future<List<String>> installedVersions(String moduleName) async {
+    final caps = await _client.listCapabilities();
+    final versions = caps
+        .where((c) => c.moduleName == moduleName)
+        .where((c) => c.kind.isEmpty || c.kind == 'wasm')
+        .map((c) => c.moduleVersion)
+        .toSet()
+        .toList()
+      ..sort();
+    return versions;
+  }
+
   /// Read the installed module's `MODULE.md` (or
   /// `MODULE.<locale>.md`) from disk under
   /// `~/.fai/modules/<module>/`. Air-gap friendly, no network.

lib/l10n/app_de.arb

@@ -777,6 +777,25 @@
     }
   },
   "storeAdvisoryVersionTooltip": "Föderierter Upstream-Dienst — Version ist Richtwert; der Upstream kann ohne Versionsanhebung Kompatibilität brechen.",
+  "uninstallVersionPickerTitle": "Version zum Entfernen wählen",
+  "uninstallVersionPickerBody": "Mehrere Versionen von `{module}` sind parallel installiert. Wähle genau die Version aus, die entfernt werden soll — die anderen bleiben bestehen.",
+  "@uninstallVersionPickerBody": {
+    "placeholders": {
+      "module": {
+        "type": "String"
+      }
+    }
+  },
+  "uninstallVersionPickerContinue": "Weiter",
+  "defaultScopeHeader": "STANDARD-SCOPE",
+  "defaultScopeBlurb": "Geordnete Liste von Publisher-Segmenten, die der Hub konsultiert, wenn ein Flow eine Capability ohne explizites `<provider>/`-Präfix benennt. Erster Treffer gewinnt — die Segmente, die euer Team am häufigsten nutzt, gehören nach oben. Katalog-bekannte Publisher erscheinen als Chips; private Segmente lassen sich frei eintragen.",
+  "defaultScopeAddLabel": "Publisher-Segment hinzufügen",
+  "defaultScopeAddHint": "z.B. acme.team",
+  "defaultScopeAddButton": "Hinzufügen",
+  "defaultScopeSuggestions": "Katalog-Vorschläge:",
+  "defaultScopeSavedToast": "Standard-Scope aktualisiert.",
+  "defaultScopeLoadFailed": "Standard-Scope konnte nicht geladen werden.",
+  "defaultScopeNonEmptyError": "Standard-Scope darf nicht leer sein — mindestens ein Segment muss erhalten bleiben.",
   "maintenanceHeader": "HUB-WARTUNG",
   "maintenanceResetBlurb": "Operator-Zustand zurücksetzen und mit einem sauberen Hub neu starten. Stoppt jeden laufenden Daemon, sichert ~/.fai/ atomar in ein Backup, legt es dann neu an — Binary, Channel-Pointer, MCP-/n8n-/System-AI-Konfiguration und Registry-Token bleiben erhalten. Wiederherstellen durch Zurückverschieben des Backup-Ordners.",
   "maintenanceKeepModulesTitle": "Installierte Module behalten",

lib/l10n/app_en.arb

@@ -780,6 +780,25 @@
     }
   },
   "storeAdvisoryVersionTooltip": "Federated upstream service — version is advisory; the upstream may break compatibility without bumping it.",
+  "uninstallVersionPickerTitle": "Pick a version to uninstall",
+  "uninstallVersionPickerBody": "Several versions of `{module}` are installed side-by-side. Select the exact version to remove — the others stay in place.",
+  "@uninstallVersionPickerBody": {
+    "placeholders": {
+      "module": {
+        "type": "String"
+      }
+    }
+  },
+  "uninstallVersionPickerContinue": "Continue",
+  "defaultScopeHeader": "DEFAULT SCOPE",
+  "defaultScopeBlurb": "Ordered list of publisher segments the hub consults when a flow names a capability without an explicit `<provider>/` prefix. First match wins — promote the segments your team uses most to the top. Catalog-known publishers appear as chips; arbitrary entries are accepted for private segments.",
+  "defaultScopeAddLabel": "Add publisher segment",
+  "defaultScopeAddHint": "e.g. acme.team",
+  "defaultScopeAddButton": "Add",
+  "defaultScopeSuggestions": "Catalog suggestions:",
+  "defaultScopeSavedToast": "Default scope updated.",
+  "defaultScopeLoadFailed": "Could not load default scope.",
+  "defaultScopeNonEmptyError": "Default scope cannot be empty — keep at least one segment.",
   "maintenanceHeader": "HUB MAINTENANCE",
   "maintenanceResetBlurb": "Wipe operator state and start over with a clean hub. Stops every running daemon, atomically backs ~/.fai/ up, then recreates it with the binary, channel state, MCP / n8n / system-AI config, and registry token preserved. Restore by moving the backup directory back.",
   "maintenanceKeepModulesTitle": "Keep installed modules",

lib/l10n/app_localizations.dart

@@ -2252,6 +2252,78 @@ abstract class AppLocalizations {
   /// **'Federated upstream service — version is advisory; the upstream may break compatibility without bumping it.'**
   String get storeAdvisoryVersionTooltip;
 
+  /// No description provided for @uninstallVersionPickerTitle.
+  ///
+  /// In en, this message translates to:
+  /// **'Pick a version to uninstall'**
+  String get uninstallVersionPickerTitle;
+
+  /// No description provided for @uninstallVersionPickerBody.
+  ///
+  /// In en, this message translates to:
+  /// **'Several versions of `{module}` are installed side-by-side. Select the exact version to remove — the others stay in place.'**
+  String uninstallVersionPickerBody(String module);
+
+  /// No description provided for @uninstallVersionPickerContinue.
+  ///
+  /// In en, this message translates to:
+  /// **'Continue'**
+  String get uninstallVersionPickerContinue;
+
+  /// No description provided for @defaultScopeHeader.
+  ///
+  /// In en, this message translates to:
+  /// **'DEFAULT SCOPE'**
+  String get defaultScopeHeader;
+
+  /// No description provided for @defaultScopeBlurb.
+  ///
+  /// In en, this message translates to:
+  /// **'Ordered list of publisher segments the hub consults when a flow names a capability without an explicit `<provider>/` prefix. First match wins — promote the segments your team uses most to the top. Catalog-known publishers appear as chips; arbitrary entries are accepted for private segments.'**
+  String get defaultScopeBlurb;
+
+  /// No description provided for @defaultScopeAddLabel.
+  ///
+  /// In en, this message translates to:
+  /// **'Add publisher segment'**
+  String get defaultScopeAddLabel;
+
+  /// No description provided for @defaultScopeAddHint.
+  ///
+  /// In en, this message translates to:
+  /// **'e.g. acme.team'**
+  String get defaultScopeAddHint;
+
+  /// No description provided for @defaultScopeAddButton.
+  ///
+  /// In en, this message translates to:
+  /// **'Add'**
+  String get defaultScopeAddButton;
+
+  /// No description provided for @defaultScopeSuggestions.
+  ///
+  /// In en, this message translates to:
+  /// **'Catalog suggestions:'**
+  String get defaultScopeSuggestions;
+
+  /// No description provided for @defaultScopeSavedToast.
+  ///
+  /// In en, this message translates to:
+  /// **'Default scope updated.'**
+  String get defaultScopeSavedToast;
+
+  /// No description provided for @defaultScopeLoadFailed.
+  ///
+  /// In en, this message translates to:
+  /// **'Could not load default scope.'**
+  String get defaultScopeLoadFailed;
+
+  /// No description provided for @defaultScopeNonEmptyError.
+  ///
+  /// In en, this message translates to:
+  /// **'Default scope cannot be empty — keep at least one segment.'**
+  String get defaultScopeNonEmptyError;
+
   /// No description provided for @maintenanceHeader.
   ///
   /// In en, this message translates to:

lib/l10n/app_localizations_de.dart

@@ -1288,6 +1288,47 @@ class AppLocalizationsDe extends AppLocalizations {
   String get storeAdvisoryVersionTooltip =>
       'Föderierter Upstream-Dienst — Version ist Richtwert; der Upstream kann ohne Versionsanhebung Kompatibilität brechen.';
 
+  @override
+  String get uninstallVersionPickerTitle => 'Version zum Entfernen wählen';
+
+  @override
+  String uninstallVersionPickerBody(String module) {
+    return 'Mehrere Versionen von `$module` sind parallel installiert. Wähle genau die Version aus, die entfernt werden soll — die anderen bleiben bestehen.';
+  }
+
+  @override
+  String get uninstallVersionPickerContinue => 'Weiter';
+
+  @override
+  String get defaultScopeHeader => 'STANDARD-SCOPE';
+
+  @override
+  String get defaultScopeBlurb =>
+      'Geordnete Liste von Publisher-Segmenten, die der Hub konsultiert, wenn ein Flow eine Capability ohne explizites `<provider>/`-Präfix benennt. Erster Treffer gewinnt — die Segmente, die euer Team am häufigsten nutzt, gehören nach oben. Katalog-bekannte Publisher erscheinen als Chips; private Segmente lassen sich frei eintragen.';
+
+  @override
+  String get defaultScopeAddLabel => 'Publisher-Segment hinzufügen';
+
+  @override
+  String get defaultScopeAddHint => 'z.B. acme.team';
+
+  @override
+  String get defaultScopeAddButton => 'Hinzufügen';
+
+  @override
+  String get defaultScopeSuggestions => 'Katalog-Vorschläge:';
+
+  @override
+  String get defaultScopeSavedToast => 'Standard-Scope aktualisiert.';
+
+  @override
+  String get defaultScopeLoadFailed =>
+      'Standard-Scope konnte nicht geladen werden.';
+
+  @override
+  String get defaultScopeNonEmptyError =>
+      'Standard-Scope darf nicht leer sein — mindestens ein Segment muss erhalten bleiben.';
+
   @override
   String get maintenanceHeader => 'HUB-WARTUNG';
 

lib/l10n/app_localizations_en.dart

@@ -1303,6 +1303,46 @@ class AppLocalizationsEn extends AppLocalizations {
   String get storeAdvisoryVersionTooltip =>
       'Federated upstream service — version is advisory; the upstream may break compatibility without bumping it.';
 
+  @override
+  String get uninstallVersionPickerTitle => 'Pick a version to uninstall';
+
+  @override
+  String uninstallVersionPickerBody(String module) {
+    return 'Several versions of `$module` are installed side-by-side. Select the exact version to remove — the others stay in place.';
+  }
+
+  @override
+  String get uninstallVersionPickerContinue => 'Continue';
+
+  @override
+  String get defaultScopeHeader => 'DEFAULT SCOPE';
+
+  @override
+  String get defaultScopeBlurb =>
+      'Ordered list of publisher segments the hub consults when a flow names a capability without an explicit `<provider>/` prefix. First match wins — promote the segments your team uses most to the top. Catalog-known publishers appear as chips; arbitrary entries are accepted for private segments.';
+
+  @override
+  String get defaultScopeAddLabel => 'Add publisher segment';
+
+  @override
+  String get defaultScopeAddHint => 'e.g. acme.team';
+
+  @override
+  String get defaultScopeAddButton => 'Add';
+
+  @override
+  String get defaultScopeSuggestions => 'Catalog suggestions:';
+
+  @override
+  String get defaultScopeSavedToast => 'Default scope updated.';
+
+  @override
+  String get defaultScopeLoadFailed => 'Could not load default scope.';
+
+  @override
+  String get defaultScopeNonEmptyError =>
+      'Default scope cannot be empty — keep at least one segment.';
+
   @override
   String get maintenanceHeader => 'HUB MAINTENANCE';
 

lib/pages/store.dart

@@ -2029,6 +2029,24 @@ class _StoreDetailSheetState extends State<_StoreDetailSheet> {
 
   Future<void> _uninstall() async {
     final l = AppLocalizations.of(context)!;
+    // Multi-version aware: ask which version to remove when
+    // more than one is installed side-by-side. Otherwise the
+    // hub picks "highest version" and the operator can be
+    // surprised by what disappeared.
+    final versions =
+        await HubService.instance.installedVersions(widget.item.name);
+    if (!mounted) return;
+    String? targetVersion;
+    if (versions.length > 1) {
+      targetVersion = await showDialog<String>(
+        context: context,
+        builder: (ctx) => _StoreUninstallVersionPickerDialog(
+          moduleName: widget.item.name,
+          versions: versions,
+        ),
+      );
+      if (targetVersion == null || !mounted) return;
+    }
     final ok = await showDialog<bool>(
       context: context,
       builder: (ctx) => AlertDialog(
@@ -2056,7 +2074,10 @@ class _StoreDetailSheetState extends State<_StoreDetailSheet> {
       _toast = null;
     });
     try {
-      final r = await HubService.instance.uninstallModule(widget.item.name);
+      final r = await HubService.instance.uninstallModule(
+        widget.item.name,
+        version: targetVersion ?? '',
+      );
       if (!mounted) return;
       final l2 = AppLocalizations.of(context)!;
       setState(() {
@@ -3398,3 +3419,80 @@ class _ProvenancePill extends StatelessWidget {
     }
   }
 }
+
+/// Store-side version picker. Same shape as the module-sheet
+/// version picker but lives here so the Store page doesn't take
+/// a dependency on the module-sheet's private widgets. The
+/// duplication is small (one dialog), and keeping them
+/// separate lets each surface evolve its copy independently.
+class _StoreUninstallVersionPickerDialog extends StatefulWidget {
+  final String moduleName;
+  final List<String> versions;
+
+  const _StoreUninstallVersionPickerDialog({
+    required this.moduleName,
+    required this.versions,
+  });
+
+  @override
+  State<_StoreUninstallVersionPickerDialog> createState() =>
+      _StoreUninstallVersionPickerDialogState();
+}
+
+class _StoreUninstallVersionPickerDialogState
+    extends State<_StoreUninstallVersionPickerDialog> {
+  late String _picked;
+
+  @override
+  void initState() {
+    super.initState();
+    _picked = widget.versions.last;
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final l = AppLocalizations.of(context)!;
+    return AlertDialog(
+      title: Text(l.uninstallVersionPickerTitle),
+      content: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          Text(l.uninstallVersionPickerBody(widget.moduleName)),
+          const SizedBox(height: FaiSpace.md),
+          RadioGroup<String>(
+            groupValue: _picked,
+            onChanged: (val) {
+              if (val != null) setState(() => _picked = val);
+            },
+            child: Column(
+              mainAxisSize: MainAxisSize.min,
+              children: [
+                for (final v in widget.versions)
+                  RadioListTile<String>(
+                    value: v,
+                    title: Text(
+                      'v$v',
+                      style: const TextStyle(fontFamily: 'monospace'),
+                    ),
+                    dense: true,
+                    contentPadding: EdgeInsets.zero,
+                  ),
+              ],
+            ),
+          ),
+        ],
+      ),
+      actions: [
+        TextButton(
+          onPressed: () => Navigator.pop(context),
+          child: Text(l.buttonCancel),
+        ),
+        FilledButton(
+          onPressed: () => Navigator.pop(context, _picked),
+          child: Text(l.uninstallVersionPickerContinue),
+        ),
+      ],
+    );
+  }
+}

lib/widgets/fai_module_sheet.dart

@@ -50,11 +50,32 @@ class _FaiModuleSheetState extends State<FaiModuleSheet> {
 
   Future<void> _confirmAndUninstall(ModuleDetail detail) async {
     final l = AppLocalizations.of(context)!;
+    // When more than one version of the same module is
+    // installed side-by-side, ask the operator which one to
+    // remove. The hub's uninstall RPC otherwise falls back to
+    // "remove the highest version", which is rarely what an
+    // operator means when they've explicitly kept multiple
+    // versions around.
+    final versions =
+        await HubService.instance.installedVersions(detail.name);
+    if (!mounted) return;
+    String? targetVersion;
+    if (versions.length > 1) {
+      targetVersion = await showDialog<String>(
+        context: context,
+        builder: (ctx) => _UninstallVersionPickerDialog(
+          moduleName: detail.name,
+          versions: versions,
+        ),
+      );
+      if (targetVersion == null || !mounted) return;
+    }
+    final displayVersion = targetVersion ?? detail.version;
     final ok = await showDialog<bool>(
       context: context,
       builder: (ctx) => AlertDialog(
         title: Text(l.modulesUninstallTitle),
-        content: Text(l.modulesUninstallBody(detail.name, detail.version)),
+        content: Text(l.modulesUninstallBody(detail.name, displayVersion)),
         actions: [
           TextButton(
             onPressed: () => Navigator.pop(ctx, false),
@@ -74,7 +95,10 @@ class _FaiModuleSheetState extends State<FaiModuleSheet> {
     if (ok != true || !mounted) return;
     setState(() => _uninstalling = true);
     try {
-      final r = await HubService.instance.uninstallModule(detail.name);
+      final r = await HubService.instance.uninstallModule(
+        detail.name,
+        version: targetVersion ?? '',
+      );
       if (!mounted) return;
       ScaffoldMessenger.of(context).showSnackBar(
         SnackBar(
@@ -299,6 +323,85 @@ class _Body extends StatelessWidget {
   }
 }
 
+/// Modal that asks the operator to pick which installed
+/// version to uninstall when more than one version of the same
+/// `(provider, name)` is on disk side-by-side. Pops the picked
+/// version string, or `null` on cancel.
+class _UninstallVersionPickerDialog extends StatefulWidget {
+  final String moduleName;
+  final List<String> versions;
+
+  const _UninstallVersionPickerDialog({
+    required this.moduleName,
+    required this.versions,
+  });
+
+  @override
+  State<_UninstallVersionPickerDialog> createState() =>
+      _UninstallVersionPickerDialogState();
+}
+
+class _UninstallVersionPickerDialogState
+    extends State<_UninstallVersionPickerDialog> {
+  late String _picked;
+
+  @override
+  void initState() {
+    super.initState();
+    // Default to the highest version — same fallback the hub
+    // would pick without an explicit version, so the operator
+    // can confirm with one click in the common case.
+    _picked = widget.versions.last;
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final l = AppLocalizations.of(context)!;
+    return AlertDialog(
+      title: Text(l.uninstallVersionPickerTitle),
+      content: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          Text(l.uninstallVersionPickerBody(widget.moduleName)),
+          const SizedBox(height: FaiSpace.md),
+          RadioGroup<String>(
+            groupValue: _picked,
+            onChanged: (val) {
+              if (val != null) setState(() => _picked = val);
+            },
+            child: Column(
+              mainAxisSize: MainAxisSize.min,
+              children: [
+                for (final v in widget.versions)
+                  RadioListTile<String>(
+                    value: v,
+                    title: Text(
+                      'v$v',
+                      style: const TextStyle(fontFamily: 'monospace'),
+                    ),
+                    dense: true,
+                    contentPadding: EdgeInsets.zero,
+                  ),
+              ],
+            ),
+          ),
+        ],
+      ),
+      actions: [
+        TextButton(
+          onPressed: () => Navigator.pop(context),
+          child: Text(l.buttonCancel),
+        ),
+        FilledButton(
+          onPressed: () => Navigator.pop(context, _picked),
+          child: Text(l.uninstallVersionPickerContinue),
+        ),
+      ],
+    );
+  }
+}
+
 class _SectionHeader extends StatelessWidget {
   final String text;
 

lib/widgets/fai_settings_dialog.dart

@@ -570,6 +570,8 @@ class _FaiSettingsDialogState extends State<FaiSettingsDialog> {
               onClear: _clearHubAuthToken,
             ),
             const SizedBox(height: FaiSpace.lg),
+            const _DefaultScopePanel(),
+            const SizedBox(height: FaiSpace.lg),
             const _ThemePluginPanel(),
             const SizedBox(height: FaiSpace.lg),
             _MaintenancePanel(
@@ -2227,3 +2229,315 @@ const _kMcpSuggestions = <_McpSuggestion>[
     apiKeyEnv: '',
   ),
 ];
+
+/// Operator panel for `default_scope:` — the ordered list of
+/// publisher segments the bare-form capability resolver consults
+/// when a flow names a capability without an explicit
+/// `<provider>/` prefix (e.g. `text.extract@^1` resolves to
+/// `fai/text.extract@^1` when `default_scope: [fai]`).
+///
+/// The hub returns the live list plus a catalog-known shortlist
+/// (`knownProviders`) — the panel renders the shortlist as
+/// suggestion chips and lets operators paste arbitrary entries
+/// for private publisher segments.
+///
+/// The order matters: when more than one segment matches a bare
+/// capability name, the first match wins. The panel surfaces the
+/// order with simple up/down buttons so operators can reorder
+/// without dragging.
+class _DefaultScopePanel extends StatefulWidget {
+  const _DefaultScopePanel();
+
+  @override
+  State<_DefaultScopePanel> createState() => _DefaultScopePanelState();
+}
+
+class _DefaultScopePanelState extends State<_DefaultScopePanel> {
+  List<String>? _scope;
+  List<String> _knownProviders = const [];
+  bool _loading = true;
+  bool _saving = false;
+  String? _error;
+  final _addController = TextEditingController();
+
+  @override
+  void initState() {
+    super.initState();
+    _load();
+  }
+
+  @override
+  void dispose() {
+    _addController.dispose();
+    super.dispose();
+  }
+
+  Future<void> _load() async {
+    try {
+      final r = await HubService.instance.getDefaultScope();
+      if (!mounted) return;
+      setState(() {
+        _scope = r.scope;
+        _knownProviders = r.knownProviders;
+        _loading = false;
+        _error = null;
+      });
+    } catch (e) {
+      if (!mounted) return;
+      setState(() {
+        _loading = false;
+        _error = e.toString();
+      });
+    }
+  }
+
+  Future<void> _save(List<String> next) async {
+    setState(() {
+      _saving = true;
+      _error = null;
+    });
+    try {
+      final r = await HubService.instance.setDefaultScope(next);
+      if (!mounted) return;
+      setState(() {
+        _scope = r.scope;
+        _knownProviders = r.knownProviders;
+        _saving = false;
+      });
+      final l = AppLocalizations.of(context)!;
+      ScaffoldMessenger.of(context).showSnackBar(
+        SnackBar(content: Text(l.defaultScopeSavedToast)),
+      );
+    } catch (e) {
+      if (!mounted) return;
+      setState(() {
+        _saving = false;
+        _error = e.toString();
+      });
+    }
+  }
+
+  void _addEntry(String raw) {
+    final entry = raw.trim();
+    if (entry.isEmpty) return;
+    final current = List<String>.from(_scope ?? const []);
+    if (current.contains(entry)) return;
+    current.add(entry);
+    _addController.clear();
+    _save(current);
+  }
+
+  void _removeAt(int i) {
+    final current = List<String>.from(_scope ?? const []);
+    if (i < 0 || i >= current.length) return;
+    if (current.length == 1) {
+      // Hub rejects empty; surface the constraint inline rather
+      // than letting the RPC fail.
+      setState(() => _error = AppLocalizations.of(context)!
+          .defaultScopeNonEmptyError);
+      return;
+    }
+    current.removeAt(i);
+    _save(current);
+  }
+
+  void _moveUp(int i) {
+    if (i <= 0) return;
+    final current = List<String>.from(_scope ?? const []);
+    final item = current.removeAt(i);
+    current.insert(i - 1, item);
+    _save(current);
+  }
+
+  void _moveDown(int i) {
+    final current = List<String>.from(_scope ?? const []);
+    if (i >= current.length - 1) return;
+    final item = current.removeAt(i);
+    current.insert(i + 1, item);
+    _save(current);
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+    final l = AppLocalizations.of(context)!;
+    final scope = _scope;
+    final unusedSuggestions = _knownProviders
+        .where((p) => !(scope ?? const []).contains(p))
+        .toList();
+
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        Text(
+          l.defaultScopeHeader,
+          style: theme.textTheme.labelSmall?.copyWith(
+            color: theme.colorScheme.onSurfaceVariant,
+            letterSpacing: 0.6,
+            fontSize: 10,
+          ),
+        ),
+        const SizedBox(height: 2),
+        Text(
+          l.defaultScopeBlurb,
+          style: theme.textTheme.bodySmall?.copyWith(
+            color: theme.colorScheme.onSurfaceVariant,
+          ),
+        ),
+        const SizedBox(height: FaiSpace.sm),
+        if (_loading)
+          const Padding(
+            padding: EdgeInsets.symmetric(vertical: FaiSpace.sm),
+            child: SizedBox(
+              height: 16,
+              width: 16,
+              child: CircularProgressIndicator(strokeWidth: 2),
+            ),
+          )
+        else if (scope == null)
+          Text(
+            _error ?? l.defaultScopeLoadFailed,
+            style: theme.textTheme.bodySmall?.copyWith(
+              color: theme.colorScheme.error,
+            ),
+          )
+        else ...[
+          for (var i = 0; i < scope.length; i++)
+            _ScopeRow(
+              index: i,
+              total: scope.length,
+              entry: scope[i],
+              busy: _saving,
+              onUp: () => _moveUp(i),
+              onDown: () => _moveDown(i),
+              onRemove: () => _removeAt(i),
+            ),
+          const SizedBox(height: FaiSpace.sm),
+          Row(
+            children: [
+              Expanded(
+                child: TextField(
+                  controller: _addController,
+                  decoration: InputDecoration(
+                    labelText: l.defaultScopeAddLabel,
+                    hintText: l.defaultScopeAddHint,
+                    border: const OutlineInputBorder(),
+                    isDense: true,
+                  ),
+                  onSubmitted: _saving ? null : _addEntry,
+                ),
+              ),
+              const SizedBox(width: FaiSpace.sm),
+              FilledButton.icon(
+                icon: const Icon(Icons.add, size: 14),
+                label: Text(l.defaultScopeAddButton),
+                onPressed: _saving
+                    ? null
+                    : () => _addEntry(_addController.text),
+              ),
+            ],
+          ),
+          if (unusedSuggestions.isNotEmpty) ...[
+            const SizedBox(height: FaiSpace.sm),
+            Text(
+              l.defaultScopeSuggestions,
+              style: theme.textTheme.bodySmall?.copyWith(
+                color: theme.colorScheme.onSurfaceVariant,
+                fontSize: 11,
+              ),
+            ),
+            const SizedBox(height: 4),
+            Wrap(
+              spacing: FaiSpace.xs,
+              runSpacing: 4,
+              children: [
+                for (final s in unusedSuggestions)
+                  ActionChip(
+                    label: Text(
+                      s,
+                      style: const TextStyle(fontFamily: 'monospace'),
+                    ),
+                    onPressed: _saving ? null : () => _addEntry(s),
+                  ),
+              ],
+            ),
+          ],
+          if (_error != null) ...[
+            const SizedBox(height: FaiSpace.sm),
+            Text(
+              _error!,
+              style: theme.textTheme.bodySmall?.copyWith(
+                color: theme.colorScheme.error,
+              ),
+            ),
+          ],
+        ],
+      ],
+    );
+  }
+}
+
+class _ScopeRow extends StatelessWidget {
+  final int index;
+  final int total;
+  final String entry;
+  final bool busy;
+  final VoidCallback onUp;
+  final VoidCallback onDown;
+  final VoidCallback onRemove;
+
+  const _ScopeRow({
+    required this.index,
+    required this.total,
+    required this.entry,
+    required this.busy,
+    required this.onUp,
+    required this.onDown,
+    required this.onRemove,
+  });
+
+  @override
+  Widget build(BuildContext context) {
+    final theme = Theme.of(context);
+    return Padding(
+      padding: const EdgeInsets.symmetric(vertical: 2),
+      child: Row(
+        children: [
+          SizedBox(
+            width: 24,
+            child: Text(
+              '${index + 1}.',
+              style: theme.textTheme.bodySmall?.copyWith(
+                color: theme.colorScheme.onSurfaceVariant,
+              ),
+            ),
+          ),
+          Expanded(
+            child: Text(
+              entry,
+              style: const TextStyle(fontFamily: 'monospace'),
+            ),
+          ),
+          IconButton(
+            icon: const Icon(Icons.arrow_upward, size: 16),
+            tooltip: 'Move up',
+            onPressed: busy || index == 0 ? null : onUp,
+            visualDensity: VisualDensity.compact,
+          ),
+          IconButton(
+            icon: const Icon(Icons.arrow_downward, size: 16),
+            tooltip: 'Move down',
+            onPressed: busy || index == total - 1 ? null : onDown,
+            visualDensity: VisualDensity.compact,
+          ),
+          IconButton(
+            icon: const Icon(Icons.delete_outline, size: 16),
+            tooltip: 'Remove',
+            onPressed: busy ? null : onRemove,
+            visualDensity: VisualDensity.compact,
+          ),
+        ],
+      ),
+    );
+  }
+}