janela 0.2.0 → 0.3.0

data/docs/decisions/016-the-styling-vocabulary.md

@@ -0,0 +1,100 @@
+---
+Date: 2026-09-16
+Status: Accepted
+Related: ADR 001, ADR 012, ADR 014
+Triggers:
+  - adding or renaming a CSS class the engine renders
+  - adding a layout value a person can edit
+  - changing the spacing scale or the grid
+  - a host asking how to restyle Janela
+Topics: css, layout, styling, public-api, security
+---
+
+# ADR 016: The Styling Vocabulary
+
+## Context
+
+ADR 012 made a frame's layout data: how many columns, what gap, how
+many columns a pane spans. ADR 014 confirmed the vocabulary is CSS
+Grid's rather than a new glossary. Two things still had to be decided
+before any of it is rendered.
+
+The first is safety. These values are edited by an analyst, and a
+length like `1rem` interpolated into a style attribute is injectable:
+`1rem; position: fixed; top: 0` is valid CSS and escaping does not
+help inside an attribute. The field is harmless today only because
+nobody can type into it yet, which changes in build 4.
+
+The second is that Janela ships no CSS at all, so a table pane renders
+with no padding and a label runs into its number, reading as `false55`
+(issue #15). A grid means nothing without CSS, so the stylesheet stops
+being optional the moment frames exist.
+
+Tailwind is the obvious model, and the part worth taking is not
+utility classes but the reason they work: the scale is **finite and
+indexed rather than measured**, so an inconsistent design is not
+expressible.
+
+## Decision
+
+**Layout values are small integers, and the gem supplies the units.**
+`columns` 1 to 12, `gap` 0 to 8, `span` 1 to 12. An integer cannot
+inject anything, so the field is safe by construction rather than by a
+regular expression somebody has to keep trusting.
+
+**An integer selects a class; it is never interpolated into a style
+attribute.** The engine renders class names and the shipped stylesheet
+defines them:
+
+```css
+.janela-frame     { display: grid; }
+.janela-cols-3    { grid-template-columns: repeat(3, minmax(0, 1fr)); }
+.janela-gap-4     { gap: calc(var(--janela-space) * 4); }
+.janela-span-2    { grid-column: span 2; }
+```
+
+Around thirty rules, enumerated for every value the validations
+permit. Nothing an analyst supplies reaches CSS: the integer only
+chooses a rule that was already written.
+
+**One naming rule: `janela-{property}-{scale}`.** `janela-cols-3`,
+`janela-gap-4`, `janela-span-2`. Learn it once and the rest is
+predictable, which is doing more work in Tailwind's success than any
+individual class.
+
+**One base unit is the whole spacing theme.** `--janela-space`,
+defaulting to `0.25rem`. A host sets it once and the entire scale
+moves, without touching data or overriding rules.
+
+**Responsive behaviour is in the stylesheet, not in the data.** The
+grid collapses to a single column below a narrow breakpoint. An
+analyst chooses a column count, not a set of breakpoints, and a
+dashboard that is unreadable on a phone is not a choice worth
+offering. Per breakpoint control, if ever needed, is a separate
+decision.
+
+**No arbitrary value escape hatch.** Tailwind offers `gap-[17px]`
+because a developer occasionally has to defy the design system. Here
+the editor is an analyst, the constraint is the point, and an escape
+hatch reintroduces exactly the injection surface these integers close.
+
+**The class names are public API.** A host restyles Janela by
+overriding `.janela-pane`, `.janela-gap-4` and the rest, or by setting
+`--janela-space`, so renaming one is a breaking change and belongs in
+`UPGRADING.md` like any other (ADR 015). The stylesheet ships as
+`app/assets/stylesheets/janela.css` and a host includes it, rather
+than the engine injecting it into a layout it does not own.
+
+## Consequences
+
+- Issue #15 is answered: the gem ships CSS, so a pane is legible on
+  install, and a host overrides rather than writes from scratch.
+- An analyst cannot express `1.375rem` of gap. Intended: the realistic
+  choices are none, small, medium and large, and a finite scale is why
+  a dashboard built by several people still looks like one thing.
+- The enumerated rules must stay in step with the validation ranges.
+  A value that validates but has no class renders unstyled and
+  silently, so the test suite asserts the two agree.
+- Janela now owns a stylesheet, which is a surface it has to maintain
+  and a thing hosts will want to argue with. Custom properties are
+  the pressure valve: retheme without forking.

data/docs/decisions/017-janela-owns-no-data-store.md

@@ -0,0 +1,113 @@
+---
+Date: 2026-09-16
+Status: Accepted
+Related: ADR 001, ADR 002, ADR 004, ADR 007, ADR 009
+Triggers:
+  - proposing a data store, warehouse, cache or copy of a host's data
+  - a pane or a frame being measurably slow on a real host
+  - adding a database adapter or a second connection
+  - anything that would query outside ActiveRecord and therefore outside the host's scope
+Topics: performance, columnar, storage, authorisation, scope, dependencies
+---
+
+# ADR 017: Janela Owns No Data Store
+
+## Context
+
+Commercial BI tools mostly answer performance by taking a copy: extract
+the host's data into a columnar store the vendor owns, and query that.
+Columnar storage is genuinely the right shape for what Janela does, a
+`SUM` or a `COUNT` grouped by one dimension over many rows, and the
+motivation for keeping that store local rather than in someone else's
+cloud is the same instinct that made this project worth starting.
+
+The Postgres ecosystem has caught up in a way that matters here.
+[`pg_duckdb` reached 1.0](https://motherduck.com/blog/pg-duckdb-release/)
+with over a million downloads by its own account,
+[`pg_ducklake` became production ready in January 2026](https://github.com/duckdb/pg_duckdb),
+and Citus has had a columnar access method for years. Each of these
+puts a vectorised columnar engine **inside** Postgres rather than
+beside it, which is the distinction this ADR turns on. Read those
+before reopening the question: they are the reason it is worth
+reopening at all, and they are also the reason it does not need to be
+reopened yet.
+
+ADR 001 already declined a separate data warehouse and ETL. This ADR
+records why that holds even now that a local columnar store is
+practical, and what Janela does instead.
+
+## Decision
+
+**Janela never holds a copy of a host's data.** No warehouse, no
+extract, no second connection, no adapter of its own.
+
+The reason is not performance, it is authorisation. Everything safe
+about this gem rests on `on: policy_scope(Order)`, an ActiveRecord
+relation carrying the host's Pundit scope and whatever tenancy it
+uses (ADR 002, ADR 004). A copy has no relation, no policy and no
+tenant filter, so a copy means reimplementing row level security
+against it. That is the subsystem ADR 001 refused, and getting it
+subtly wrong shows one tenant's numbers to another, which is a far
+worse failure than a slow pane.
+
+**Janela stays fast by generating SQL a columnar engine can
+accelerate, and by getting out of the way.** A host that needs
+analytical speed converts the table it reports on, with
+[`pg_duckdb`](https://github.com/duckdb/pg_duckdb), `pg_ducklake`,
+Citus columnar or whatever its own database offers. The
+table stays addressable by ActiveRecord, so Pundit, tenancy and every
+part of Janela's query path keep working, and **Janela gets faster
+with no change to the gem at all**. That is a page of documentation
+rather than an architecture, and it is the right division: the host
+owns its storage, the gem owns the question.
+
+It follows that the gem's obligation is to emit plain, grouped,
+aggregate SQL and not to outsmart the planner. ADR 007's ordering and
+limit are the whole of the performance surface Janela owns.
+
+**Snapshots are already the useful part of a warehouse.** ADR 009
+persists frozen results with no extract, no staleness question and no
+authorisation problem, because a snapshot was taken *under* a scope
+and stores only what that scope returned. Anything that wants
+precomputed aggregates should reach for a snapshot before it reaches
+for a store.
+
+**No measured problem exists.** The demo runs on 600 rows, the
+commercial host's largest reported table on about 1,100, the personal
+host's on four. Nothing is slow, and ADR 001 is explicit about not
+building for hypothetical futures.
+
+**What would change this.** A pane, measured on a real host, that is
+too slow to use after its table has been made columnar and after
+ADR 007's limit has been applied. At that point the question is
+whether Janela should read a host-owned materialised view or
+continuous aggregate, which is still the host's data under the host's
+scope, and not whether Janela should own a store. That distinction is
+the thing this ADR is really protecting.
+
+## Consequences
+
+- A host with genuinely large tables must do something about its own
+  storage, and the gem can only document the options rather than solve
+  it. That is a real limitation and it is the correct one: the
+  alternative is a copy whose access control Janela cannot honestly
+  guarantee.
+- The README gains a short performance section naming the columnar
+  extensions and pointing at snapshots. It must be honest that the
+  gem has not been tested against a large columnar table, because it
+  has not.
+- Refusing a second connection also refuses a whole category of
+  feature: querying anything that is not an ActiveRecord model in the
+  host. Reporting across two applications, or over a CSV, or over a
+  warehouse the business already has, is out of scope for the same
+  reason.
+- [`activerecord-duckdb`](https://rubygems.org/gems/activerecord-duckdb)
+  is at 0.1.0 and describes itself as incomplete, so even the tempting
+  version of this would be built on something immature today. That is
+  a timing observation rather than a reason, and it will stop being
+  true, which is why it is recorded as an observation.
+- This is the third time a scope question has been settled by asking
+  where authorisation lives (ADR 002's `on:`, ADR 012's persisted
+  panes, now this). It is worth naming as the project's actual test:
+  **if a feature cannot be expressed as a scoped ActiveRecord
+  relation, it is probably not Janela's to build.**

data/docs/decisions/018-a-table-is-the-universal-renderer.md

@@ -0,0 +1,75 @@
+---
+Date: 2026-09-16
+Status: Accepted
+Related: ADR 009, ADR 011, ADR 013, ADR 016
+Triggers:
+  - rendering a pane where the chart runtime may be absent
+  - adding a renderer, or changing what a renderer means
+  - a pane rendering as something other than its row says
+  - the engine serving a page of its own
+Topics: rendering, renderers, charts, progressive-enhancement, engines
+---
+
+# ADR 018: A Table Is the Universal Renderer
+
+## Context
+
+ADR 013 promised a host could install the gem and navigate its own
+dashboards the same day, which is why the engine serves an index and a
+frame page of its own. ADR 011 established that those pages render in
+the engine's minimal layout, which loads none of the host's assets
+because the engine cannot know their names or bundler. ADR 014 then
+had a frame render its panes inline so that the page is correct before
+any JavaScript.
+
+Correct, but not complete. A chart pane is a `canvas` the Stimulus
+chart controller fills in, and the engine's own pages deliberately
+load no Stimulus and no Chart.js. So a frame with two chart panes
+served by the engine shows two empty holes the height of a chart. The
+claim that those pages are a correct static dashboard was not true.
+
+The engine could not fix this by loading a chart runtime: emitting a
+working module graph needs the host's importmap or bundle, which is
+exactly what ADR 011 said the engine cannot assume.
+
+## Decision
+
+**Where no chart runtime exists, a chart pane renders as a table.**
+
+The engine's own frame page passes `charts: false` to `janela_frame`,
+and a pane whose renderer is `bar` or `line` renders its table instead.
+A host's own page renders charts normally, because a host that
+registered the Stimulus controllers has the runtime.
+
+This is not JavaScript detection and it is not a fallback that guesses.
+The engine's pages deterministically have no chart renderer, so they
+deterministically use the one that needs nothing.
+
+**A renderer is a viewing choice, not part of the pane.** ADR 009
+already decided this when it made a snapshot store results rather than
+markup, and this follows from it: the row records that a pane is best
+seen as a bar chart, and a surface that cannot draw one shows the same
+numbers another way. Nothing about the data changes.
+
+**A table is the renderer that always works**, needing no JavaScript,
+no canvas and no measurement, which is why it is the one to fall back
+to rather than an error or an empty space.
+
+## Consequences
+
+- The engine's own pages are now what ADR 013 promised: a host mounts
+  the engine and reads a real dashboard the same day, with no
+  JavaScript wiring at all.
+- The same frame can look different in two places: a bar chart on a
+  host's page and a table on the engine's. That is the cost, it will
+  surprise someone, and the README says so plainly rather than leaving
+  them to discover it.
+- Cross-filtering is still absent from the engine's pages, because
+  that genuinely needs Stimulus. They are for reading, and a host that
+  wants interaction renders the frame in its own page, which is one
+  helper call.
+- `charts:` is a rendering option rather than a stored column, so no
+  migration and nothing for an analyst to get wrong.
+- If the engine ever gains a way to know a host's asset setup, this
+  decision is worth revisiting, because the better answer is a chart
+  that draws everywhere.

data/docs/decisions/019-a-created-frame-asks-the-host-who-owns-it.md

@@ -0,0 +1,79 @@
+---
+Date: 2026-09-16
+Status: Accepted
+Related: ADR 002, ADR 004, ADR 012, ADR 014
+Triggers:
+  - creating a frame or any other record on a host's behalf
+  - adding a configuration setting to Janela
+  - a host needing to influence what the engine writes
+  - a record being invisible to the scope that was meant to find it
+Topics: authorisation, tenancy, persistence, host-integration, configuration
+---
+
+# ADR 019: A Created Frame Asks the Host Who Owns It
+
+## Context
+
+ADR 014 gave a frame a nullable polymorphic owner purely so a host's
+Pundit scope has a column to filter on, and said Janela never
+interprets it. That was right while frames were only created in a
+console or a seed, where whoever created one could set it.
+
+Build 4 lets an analyst create a frame through the engine's own form,
+and the gap becomes a fault: Janela writes the row, so Janela decides
+the owner, and it has nothing to decide with. A frame saved with no
+owner is hidden by the very scope meant to find it, so the analyst
+creates a dashboard and it disappears. That failure has already
+happened twice in this project by other routes, once in a test and
+once on the live demo, which is how confidently it can be predicted
+here.
+
+Three ways out. A configuration setting naming the owner. The engine
+not creating frames at all, leaving it to each host, which defeats the
+purpose of build 4 since the analyst is the person who cannot deploy.
+Or asking the host at the moment of writing.
+
+## Decision
+
+**If the host's controller responds to `janela_frame_owner`, the
+engine assigns its return value as the owner of a frame it creates.**
+
+```ruby
+class ApplicationController < ActionController::Base
+  private
+    def janela_frame_owner
+      Current.account
+    end
+end
+```
+
+A host that defines nothing gets a nil owner, which is correct for a
+single tenant application and is what the demo did before it had
+tenancy at all.
+
+This is the pattern `policy_scope` already established (ADR 004):
+Janela asks the host's controller a question by duck typing, and takes
+silence as an answer rather than requiring configuration. It keeps
+Janela's settings at one, `parent_controller`, and it puts the
+decision in the only place that can make it, inside a request where
+the current user and tenant exist.
+
+**Janela still never interprets the owner.** It assigns what it is
+handed and reads nothing from it. Scoping remains entirely the host's
+policy, exactly as ADR 014 said.
+
+## Consequences
+
+- An analyst can create a dashboard and see it, which is the whole
+  point of build 4 and was impossible without this.
+- A multi tenant host that forgets to define the method gets frames
+  nobody can see. That is a quiet failure, so it is what the doctor
+  task should notice: a host with a `policy_scope` that filters frames
+  by owner, but no `janela_frame_owner`, is misconfigured. Worth
+  adding to ADR 015's checks.
+- Duck typing means a typo in the method name fails silently, which is
+  the cost of not having configuration. The doctor check above is the
+  mitigation.
+- The same question will arrive for any other record Janela writes on
+  a host's behalf. The answer is this pattern rather than a second
+  setting, and this ADR is the precedent to cite.

data/docs/decisions/020-formatting-belongs-to-the-measure.md

@@ -0,0 +1,93 @@
+---
+Date: 2026-09-16
+Status: Accepted
+Related: ADR 002, ADR 009, ADR 012, ADR 018
+Triggers:
+  - a number rendering with more precision than it means
+  - adding an option to a pane, a frame or a pane URL
+  - units, currency or percentages
+  - a chart and a table showing the same number differently
+Topics: dsl, rendering, charts, snapshots, configuration
+---
+
+# ADR 020: Formatting Belongs to the Measure
+
+## Context
+
+An averaged measure rendered as `928.8767833333333`. Tables ran
+values through `number_with_delimiter`, which handles thousands and
+nothing else, and a chart tooltip showed whatever the database
+returned. Nothing anywhere said how many decimal places a number
+means, or that it is money, or a percentage.
+
+There are four layers that could say, and each was a real candidate.
+
+The **pane** is where an analyst works, so it is the tempting answer:
+this chart in thousands, that one to the cent. But a pane is a
+database row and a form field, so every knob there is a migration, a
+validation and another decision put to someone who should not have to
+know that `amount` is a decimal with a scale of two. Worse, the same
+measure on two frames could disagree about itself.
+
+The **pane URL** would make it ad hoc, `?precision=0`. That widens the
+grammar ADR 005 fixed, and it lets anyone holding a link change what a
+number appears to say. Precision is not a question a reader asks.
+
+The **frame** is the wrong shape. One frame holds panes from different
+models, so a single setting would be right for the currency and wrong
+for the count sitting next to it.
+
+The **measure** is the only one of the four that knows what the number
+*is*. The other three know where it appears.
+
+## Decision
+
+**A measure declares its own format, and every renderer asks the
+measure.**
+
+```ruby
+janela do
+  measure :revenue, sum: :amount, prefix: "$"
+  measure :pass_rate, average: :score, precision: 1, suffix: "%"
+  measure :orders, count: true
+end
+```
+
+**Almost nothing needs declaring, because the schema already knows.**
+Precision is the measure's own if it declares one, otherwise the
+column's: counting rows has no decimal places, a `decimal(10, 2)`
+column has two, summing an integer column stays whole. Only where
+neither says anything, such as averaging an integer, does it fall back
+to two places. Thousands are delimited with the host's own locale.
+
+`prefix` and `suffix` carry the unit, which no amount of rounding can
+say. They are two plain strings rather than a currency vocabulary,
+because a string is the thing a forker can read and replace in a
+minute.
+
+**Formatting is rendering, never rounding.** The number itself reaches
+a snapshot, an order clause and a comparison at full precision. A
+stored pane is data (ADR 009), so a snapshot taken last month reads
+back under a format declared today.
+
+**One formatter serves every renderer.** A table cell, a single value
+and a chart tooltip all show the string the measure produced, and the
+chart is handed those strings rather than formatting a second time in
+JavaScript. The chart still plots raw numbers, because an axis is a
+scale and not a label.
+
+## Consequences
+
+- The common measures read correctly with nothing declared, which is
+  the test this had to pass: money as money, counts as counts.
+- A host changes how every one of its numbers reads by editing its
+  model, not by touching a dashboard, a URL or a template.
+- A measure that wants two formats is two measures. That is a real
+  limit, and it is the same answer ADR 002 gives to every other
+  variation: declare what you mean and name it.
+- The chart controller now takes a `formatted` value alongside
+  `values`. A host that renders its own chart from Janela's data has
+  the strings available and is not obliged to use them.
+- If per pane formatting ever proves necessary, the measure's format
+  is the default it would override, not something to be undone first.
+  This is the layer to add it to, and the reason to think twice.

data/docs/decisions/021-a-check-has-a-name-a-host-can-silence.md

@@ -0,0 +1,84 @@
+---
+Date: 2026-09-16
+Status: Accepted
+Related: ADR 010, ADR 015, ADR 019
+Triggers:
+  - adding a check to janela:doctor
+  - adding a setting to Janela
+  - a warning that is a false alarm for some applications
+  - running the doctor in CI
+Topics: configuration, tooling, upgrades, agent-guidance
+---
+
+# ADR 021: A Check Has a Name, and a Host Can Silence It
+
+## Context
+
+`janela:doctor` reports what a host still has to do, and one of its
+checks cannot be certain. Authentication is whatever the host does, so
+the check reads the controller's filters and says what it sees. For an
+application that authenticates another way, that warning is wrong
+every single run.
+
+A warning that is always wrong is worse than no warning. People learn
+to skip the output, and the next finding, the true one, goes unread
+with it. In CI it is worse again, because the only way to keep a green
+build is to stop running the task.
+
+The pattern here is settled elsewhere. Django's system check framework
+gives every check an identifier and lets a project list the ones to
+silence. Homebrew, Flutter, npm, Bundler and RubyGems all ship a
+doctor of some shape, and the mature ones can be told to be quiet
+about a thing the maintainer has already judged.
+
+Janela had neither half: findings were prose with no stable handle, so
+there was nothing to name in a conversation, a commit message or a
+setting.
+
+## Decision
+
+**Every finding carries the name of the check that produced it**, in
+the output and on the finding itself:
+
+```
+WARNING (unauthenticated-endpoints): no authentication filter found on ApplicationController
+```
+
+The name is the check's own method name, dasherised by the runner
+rather than written out per check, so a code and the thing it names
+cannot drift apart. Words rather than numbers: there are seven checks,
+not seven hundred, and `unmigrated-tables` needs no lookup table the
+way `janela.E004` would.
+
+**A host silences a check by that name**:
+
+```ruby
+# config/initializers/janela.rb
+Janela.silenced_checks = %w[unauthenticated-endpoints]
+```
+
+**A silenced check is named every run**, in one line at the end, even
+when there is nothing else to report. A silence nobody remembers is
+how a real finding goes unread, which is the problem this is meant to
+solve rather than reproduce.
+
+This is Janela's second setting, and deliberately so. ADR 019 turned
+down configuration for what owns a frame because ownership is
+per-request state that a setting cannot hold. Silencing is the
+opposite: a judgement made once, about the application as a whole,
+that does not change between requests. That is what configuration is
+for, and the distinction is the rule to apply next time rather than a
+preference about this one.
+
+## Consequences
+
+- The doctor can run in CI on an application it cannot fully
+  understand, which is the only way it gets run at all.
+- Silencing an error passes the task. That is the point and it is a
+  loaded gun, which is why the silence is printed every run.
+- A check's name is now public. Renaming a check method renames what a
+  host silences, so a rename is a breaking change and goes in
+  UPGRADING.md like any other (ADR 015).
+- Agents get a stable handle too. "Silence unmigrated-tables" is an
+  instruction that can be given and followed without quoting a
+  sentence of prose (ADR 010).

data/docs/decisions/INDEX.md

@@ -20,16 +20,23 @@ them when in doubt: `grep -l "Triggers:.*fork" docs/decisions/*.md`.
 
 | Topic | ADRs |
 |-------|------|
-| **Vision, scope, forkability** | 001 |
+| **Vision, scope, forkability** | 001, 010, 012 |
 | **Open-source & host-decoupling** | 001 |
 | **DSL & query layer** | 002, 006, 007 |
-| **Dependencies** | 002, 003, 004, 006 |
-| **Authorisation** | 002, 003, 004, 009 |
+| **Dependencies** | 002, 003, 004, 006, 017 |
+| **Authorisation** | 002, 003, 004, 009, 017, 019 |
+| **Performance & storage** | 007, 017 |
 | **Cross-filtering & Hotwire** | 003, 004, 005, 008 |
+| **Layouts & views** | 011, 012, 016, 018 |
+| **CSS & styling** | 016, 018 |
+| **Frames, panes & persistence** | 012, 013, 014, 019 |
+| **Naming rule** | 014 |
 | **JavaScript delivery & charts** | 004, 006 |
 | **Time dimensions** | 006 |
-| **Routes, URLs & naming** | 005, 007, 008, 009 |
+| **Routes, URLs & naming** | 005, 007, 008, 009, 011, 013 |
 | **Snapshots & publishing** | 009 |
+| **AI agents & guidance** | 010, 015 |
+| **Releases & upgrades** | 015 |
 | **Security** | 003 |
 | **Testing** | 003 |
 
@@ -46,7 +53,19 @@ them when in doubt: `grep -l "Triggers:.*fork" docs/decisions/*.md`.
 | 007 | Ordering and Limits | 2026-09-15 | Accepted |
 | 008 | Dashboard Filters in the Page URL | 2026-09-15 | Accepted |
 | 009 | Snapshots | 2026-09-15 | Accepted |
+| 010 | Agent Guidance Ships, the Agent Waits | 2026-09-15 | Accepted |
+| 011 | Panes Do Not Render in the Host Layout | 2026-09-15 | Accepted |
+| 012 | Frames and Panes Are Data | 2026-09-15 | Accepted |
+| 013 | Naming and Addressing Frames | 2026-09-15 | Accepted |
+| 014 | Corrections Before Frames Are Built | 2026-09-15 | Accepted |
+| 015 | How Breaking Change Is Communicated | 2026-09-16 | Accepted |
+| 016 | The Styling Vocabulary | 2026-09-16 | Accepted |
+| 017 | Janela Owns No Data Store | 2026-09-16 | Accepted |
+| 018 | A Table Is the Universal Renderer | 2026-09-16 | Accepted |
+| 019 | A Created Frame Asks the Host Who Owns It | 2026-09-16 | Accepted |
+| 020 | Formatting Belongs to the Measure | 2026-09-16 | Accepted |
+| 021 | A Check Has a Name, and a Host Can Silence It | 2026-09-16 | Accepted |
 
 ## Next number
 
-Next ADR: 010
+Next ADR: 022