lcp 0.1.0 → 0.2.0

data/app/views/layouts/lcp_ruby/application.html.erb

@@ -25,7 +25,18 @@
       h.setAttribute("data-lcp-radius", pick("lcp-radius", "<%= radius_def %>"));
     })();
   </script>
-  <% if Rails.application.config.respond_to?(:assets) %>
+  <%# Engine asset tags. `lcp_emit_engine_assets?` is false when the host
+      opted out via `config.skip_asset_pipeline_check = true` — that host runs
+      its own JS bundler (esbuild / importmap / jsbundling) and owns including
+      the LCP bundle, so the engine must NOT emit these pipeline-dependent tags
+      (Propshaft would raise MissingAssetError → 500 on every render). When NOT
+      opted out, the `lcp_ruby.asset_pipeline_check` boot initializer has
+      already guaranteed Sprockets is wired (audit #16), so the tags are safe.
+      The i18n payload is an inline <script> with no pipeline dependency and is
+      always emitted so a host-bundled LCP app.js can still consume it. The
+      dev-toolbar and vendored-mermaid blocks below use the same gate. %>
+  <%= lcp_i18n_payload_tag %>
+  <% if lcp_emit_engine_assets? %>
     <%= stylesheet_link_tag "lcp_ruby/tom-select", media: "all" %>
     <%= stylesheet_link_tag "lcp_ruby/application", media: "all" %>
     <script type="module" src="<%= asset_path('turbo.min.js') %>" data-turbo-track="reload"></script>
@@ -33,25 +44,32 @@
     <%= javascript_include_tag "lcp_ruby/activestorage.min", defer: true, "data-turbo-track": "reload" %>
     <%= javascript_include_tag "lcp_ruby/lucide.min", defer: true, "data-turbo-track": "reload" %>
     <%= javascript_include_tag "lcp_ruby/lucide_init", defer: true, "data-turbo-track": "reload" %>
-    <%= lcp_i18n_payload_tag %>
     <%= javascript_include_tag "lcp_ruby/application", defer: true, "data-turbo-track": "reload" %>
-    <%# FOUC mask for responsive top nav (Phase 1). The `data-measuring`
-        attribute hides the nav while JS runs initial overflow measurement;
-        the noscript override ensures the nav remains visible when JS is
-        disabled or fails to load. %>
-    <noscript><style>nav[data-measuring]{visibility:visible !important;}</style></noscript>
-    <% if defined?(Chartkick) && Rails.application.assets&.find_asset("Chart.bundle") %>
-      <%= javascript_include_tag "Chart.bundle", defer: true, "data-turbo-track": "reload" %>
-      <%= javascript_include_tag "chartkick", defer: true, "data-turbo-track": "reload" %>
-    <% end %>
-    <% if LcpRuby::Workflow::Registry.available? %>
-      <% mermaid_src = case LcpRuby.configuration.mermaid_source
-         when :cdn then "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.min.js"
-         when :vendored then asset_path("lcp_ruby/mermaid.min.js")
-         else LcpRuby.configuration.mermaid_source.to_s
-         end %>
-      <script src="<%= mermaid_src %>" defer data-turbo-track="reload"></script>
-    <% end %>
+  <% end %>
+  <%# FOUC mask for responsive top nav (Phase 1). The `data-measuring`
+      attribute hides the nav while JS runs initial overflow measurement;
+      the noscript override ensures the nav remains visible when JS is
+      disabled or fails to load. %>
+  <noscript><style>nav[data-measuring]{visibility:visible !important;}</style></noscript>
+  <%# Gated on lcp_emit_engine_assets? first: on a Propshaft opt-out host
+      `Rails.application.assets` is a non-nil Propshaft::Assembly with no
+      `find_asset`, so the `&.` would NOT short-circuit and would raise
+      NoMethodError → 500. The opt-out host owns its own Chartkick anyway. %>
+  <% if lcp_emit_engine_assets? && defined?(Chartkick) && Rails.application.assets&.find_asset("Chart.bundle") %>
+    <%= javascript_include_tag "Chart.bundle", defer: true, "data-turbo-track": "reload" %>
+    <%= javascript_include_tag "chartkick", defer: true, "data-turbo-track": "reload" %>
+  <% end %>
+  <%# Mermaid (workflow graphs). Gated on lcp_emit_engine_assets? too: the
+      :vendored branch resolves asset_path("lcp_ruby/mermaid.min.js"), which
+      would 500 on a Propshaft opt-out host — and an opt-out host owns its own
+      mermaid anyway. %>
+  <% if LcpRuby::Workflow::Registry.available? && lcp_emit_engine_assets? %>
+    <% mermaid_src = case LcpRuby.configuration.mermaid_source
+       when :cdn then "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.min.js"
+       when :vendored then asset_path("lcp_ruby/mermaid.min.js")
+       else LcpRuby.configuration.mermaid_source.to_s
+       end %>
+    <script src="<%= mermaid_src %>" defer data-turbo-track="reload"></script>
   <% end %>
 </head>
 <body class="lcp-layout-<%= menu_layout %>"
@@ -157,7 +175,11 @@
     </div>
   </dialog>
 
-<% if LcpRuby::DevToolbar.enabled? %>
+<%# Dev toolbar. Whole block (incl. the metadata <meta>) gated on
+    lcp_emit_engine_assets? — the meta URL is consumed by the pipeline-loaded
+    dev_toolbar.js, so emitting it without the JS on an opt-out Propshaft host
+    would 500 on the asset tags and otherwise advertise a dead endpoint. %>
+<% if LcpRuby::DevToolbar.enabled? && lcp_emit_engine_assets? %>
   <meta name="lcp-dev-metadata-url" content="<%= lcp_ruby.dev_toolbar_metadata_path %>">
   <%= stylesheet_link_tag "lcp_ruby/highlight-github.min", media: "all" %>
   <%= stylesheet_link_tag "lcp_ruby/dev_toolbar", media: "all" %>

data/app/views/layouts/lcp_ruby/auth.html.erb

@@ -15,7 +15,12 @@
       h.setAttribute("data-lcp-radius", localStorage.getItem("lcp-radius") || "rounded");
     })();
   </script>
-  <% if Rails.application.config.respond_to?(:assets) %>
+  <%# Same opt-out gate as the main layout (lcp_emit_engine_assets?): a host
+      that set skip_asset_pipeline_check bundles LCP itself, so emitting the
+      pipeline-dependent engine stylesheet here would 500 the login pages on
+      Propshaft. The old `respond_to?(:assets)` gate was true on Propshaft too,
+      so it never actually suppressed the tag. %>
+  <% if lcp_emit_engine_assets? %>
     <%= stylesheet_link_tag "lcp_ruby/application", media: "all" %>
   <% end %>
   <style>

data/app/views/lcp_ruby/resources/_show_sections.html.erb

@@ -65,17 +65,12 @@
                id="field-<%= field_name.to_s.tr('.', '-') %>"
                <%= "style=\"grid-column: span #{field_config['col_span']}\"" if field_config["col_span"] %>>
             <% field_def = field_config["field_definition"]
-               if field_name.include?(".")
-                 _parts = field_name.split(".", 2)
-                 _assoc = current_model_definition&.associations&.find { |a| a.name == _parts[0] }
-                 _label_model = _assoc&.target_model || current_model_name
-                 if field_def.nil? && _assoc
-                   _target_def = LcpRuby.loader.model_definitions[_assoc.target_model]
-                   field_def = _target_def&.field(_parts[1])
-                 end
-               else
-                 _label_model = current_model_name
-               end %>
+               # Walk the dot-path through metadata to find the terminal field
+               # def + owning model name. FieldPath handles any depth; falls
+               # back to current_model_name for non-LCP / unresolvable paths.
+               _resolved_fd, _resolved_model = LcpRuby::Metadata::FieldPath.terminal(current_model_definition, field_name, through_collections: true)
+               field_def ||= _resolved_fd
+               _label_model = _resolved_model || current_model_name %>
             <label><%= field_label_for(field_config.merge("field" => field_name), field_def: field_def, model_name: _label_model) %></label>
             <div class="lcp-field-value">
               <%
@@ -88,31 +83,43 @@
                 # Spec § Phase 4: "Show and card pick up the fix automatically
                 # through the runtime registry fallback."
                 effective_renderer_key = field_config["renderer"].presence
-                if effective_renderer_key.blank? && field_def && LcpRuby.configuration.runtime_type_renderers
+                # Skip the type-name fallback for Array values (has_many enum
+                # dot-paths): a scalar type renderer (e.g. enum → badge) can't
+                # render an Array, and it would shadow the collection branch
+                # below, emitting the Ruby array literal (issue #18 / finding E).
+                if effective_renderer_key.blank? && field_def && LcpRuby.configuration.runtime_type_renderers && !value.is_a?(Array)
                   effective_renderer_key = field_def.type.to_s
                 end
 
                 rendered_value = if field_config["partial"]
                   render partial: field_config["partial"], locals: { value: value, record: record, options: field_config["options"] || {} }
                 elsif effective_renderer_key && LcpRuby::Display::RendererRegistry.renderer_for(effective_renderer_key)
-                  render_display_value(value, effective_renderer_key, field_config["options"], field_def, record: record)
+                  render_display_value(value, effective_renderer_key, field_config["options"], field_def, record: record, model_name: _label_model)
                 elsif value.is_a?(Array)
-                  render_display_value(value, "collection", {})
+                  # Pass field_def + model so enum elements humanize (issue #18) —
+                  # the collection renderer itself only does item.to_s.
+                  render_display_value(value, "collection", {}, field_def, record: record, model_name: _label_model)
                 elsif value.is_a?(ActiveRecord::Base)
                   empty_value_placeholder(display_association_value(value), current_presenter)
                 else
-                  display_val = format_enum_display(value, field_def, current_model_name)
+                  display_val = format_enum_display(value, field_def, _label_model)
                   empty_value_placeholder(display_val, current_presenter)
                 end
               %>
               <%= wrap_link_through(value, rendered_value, record, field_config) %>
               <% if field_config["copyable"] && value.present? %>
                 <% copy_value = if value.is_a?(Array)
-                                  value.join(", ")
+                                  # Humanize enum elements for copy (issue #18) so the
+                                  # clipboard gets "Active, Done" instead of "active, done".
+                                  format_enum_display(value, field_def, _label_model).join(", ")
                                 elsif value.is_a?(ActiveRecord::Base)
                                   strip_tags(display_association_value(value).to_s)
                                 else
-                                  strip_tags(value.to_s)
+                                  # Enum scalars resolve to raw keys (issue #18); humanize for copy
+                                  # so the clipboard gets "Active" instead of "active".
+                                  # (Scalar only — has_many enum dot-paths are validator-blocked
+                                  # in show sections, so the Array branch above is non-enum.)
+                                  strip_tags(format_enum_display(value, field_def, _label_model).to_s)
                                 end %>
                 <% copy_label = I18n.t('lcp_ruby.toolbar.copy_value', default: 'Copy value') %>
                 <button type="button" class="lcp-copy-field" data-lcp-copy-value="<%= copy_value %>" title="<%= copy_label %>" aria-label="<%= copy_label %>">

data/app/views/lcp_ruby/resources/_table_index.html.erb

@@ -9,20 +9,12 @@
      columns.each do |col|
        field_path = col["field"]
        next unless field_path
-       if field_path.include?(".")
-         parts = field_path.split(".", 2)
-         assoc = current_model_definition&.associations&.find { |a| a.name == parts[0] }
-         if assoc
-           target_def = LcpRuby.loader.model_definitions[assoc.target_model]
-           if target_def
-             col_field_defs[field_path] = target_def.field(parts[1])
-             col_model_names[field_path] = assoc.target_model
-           end
-         end
-       else
-         col_field_defs[field_path] = current_model_definition&.field(field_path)
-         col_model_names[field_path] = current_model_name
-       end
+       # Metadata::FieldPath walks any-depth dot-paths; nil/nil for non-LCP
+       # or unresolvable segments. Pre-A2 humanization in the resolver masked
+       # 3+ part path failures here — now this is the single lookup point.
+       fd, model_name = LcpRuby::Metadata::FieldPath.terminal(current_model_definition, field_path, through_collections: true)
+       col_field_defs[field_path] = fd
+       col_model_names[field_path] = model_name || current_model_name
      end %>
   <% reorderable = current_presenter.reorderable? &&
                    current_model_definition.positioned? &&
@@ -105,17 +97,20 @@
             <td class="<%= hidden_on_classes(col) %> <%= 'lcp-pinned-left' if col['pinned'] == 'left' %>">
               <% value = @field_resolver.resolve(record, col["field"], fk_map: @fk_map) %>
               <% fd = col_field_defs[col["field"]] %>
+              <% fd_model = col_model_names[col["field"]] || current_model_name %>
               <%
                 rendered_value = if col["partial"]
                   render partial: col["partial"], locals: { value: value, record: record, options: col["options"] || {} }
                 elsif col["renderer"]
-                  render_display_value(value, col["renderer"], col["options"], fd, record: record)
+                  render_display_value(value, col["renderer"], col["options"], fd, record: record, model_name: fd_model)
                 elsif value.is_a?(Array)
-                  render_display_value(value, "collection", {})
+                  # Pass fd + model so enum elements humanize (issue #18) — the
+                  # collection renderer itself only does item.to_s.
+                  render_display_value(value, "collection", {}, fd, record: record, model_name: fd_model)
                 elsif value.is_a?(ActiveRecord::Base)
                   empty_value_placeholder(display_association_value(value), current_presenter)
                 else
-                  display_val = format_enum_display(value, fd, col_model_names[col["field"]] || current_model_name)
+                  display_val = format_enum_display(value, fd, fd_model)
                   empty_value_placeholder(display_val, current_presenter)
                 end
               %>

data/app/views/lcp_ruby/widgets/_markdown.html.erb

@@ -0,0 +1,13 @@
+<%#
+  Markdown widget — i18n-resolved source is converted to HTML in the
+  resolver (Commonmarker without `unsafe:` so raw HTML in the source
+  is stripped at parse time), then sanitized here against the shared
+  allow-list in `LcpRuby::Display::MarkdownSanitize` — same list the
+  model-level :markdown renderer uses, so on-page and in-table
+  markdown render identically.
+%>
+<div class="lcp-text-content lcp-markdown">
+  <%= sanitize(data[:html],
+        tags: LcpRuby::Display::MarkdownSanitize::TAGS,
+        attributes: LcpRuby::Display::MarkdownSanitize::ATTRIBUTES) %>
+</div>

data/app/views/lcp_ruby/widgets/_presenter_zone.html.erb

@@ -11,16 +11,26 @@
     <%
       zone_model_def = data[:model_definition]
       zone_model_name = zone_model_def&.name
-      # Index field_definitions by name to avoid O(cols × fields) linear scans
-      # in the header loop.
-      zone_field_defs = (zone_model_def&.fields || []).index_by(&:name)
+      # Resolve every column's terminal field def + owning model name via
+      # Metadata::FieldPath so dot-path enum columns (e.g. "contact.status")
+      # humanize against the correct i18n namespace. Direct fields resolve
+      # via the same walker (single-segment path).
+      zone_field_defs = {}
+      zone_field_models = {}
+      data[:column_set].visible_table_columns.each do |col|
+        path = col["field"]
+        next unless path
+        fd, mn = LcpRuby::Metadata::FieldPath.terminal(zone_model_def, path, through_collections: true)
+        zone_field_defs[path] = fd
+        zone_field_models[path] = mn || zone_model_name
+      end
     %>
     <table class="lcp-table lcp-table-compact">
       <thead>
         <tr>
           <% data[:column_set].visible_table_columns.each do |col| %>
             <th>
-              <% label = field_label_for(col, field_def: zone_field_defs[col["field"]], model_name: zone_model_name) %>
+              <% label = field_label_for(col, field_def: zone_field_defs[col["field"]], model_name: zone_field_models[col["field"]] || zone_model_name) %>
               <% if col["sortable"] %>
                 <%
                   field = col["field"]
@@ -60,15 +70,21 @@
             <% data[:column_set].visible_table_columns.each do |col| %>
               <td>
                 <% value = data[:field_value_resolver].resolve(record, col["field"]) %>
+                <% fd = zone_field_defs[col["field"]] %>
+                <% fd_model = zone_field_models[col["field"]] %>
                 <%
                   rendered_value = if col["renderer"]
-                    render_display_value(value, col["renderer"], col["options"], nil, record: record)
+                    render_display_value(value, col["renderer"], col["options"], fd, record: record, model_name: fd_model)
                   elsif value.is_a?(Array)
-                    render_display_value(value, "collection", {})
+                    # Pass fd + model so enum elements humanize (issue #18) — the
+                    # collection renderer itself only does item.to_s.
+                    render_display_value(value, "collection", {}, fd, record: record, model_name: fd_model)
                   elsif value.is_a?(ActiveRecord::Base)
                     empty_value_placeholder(display_association_value(value))
                   else
-                    empty_value_placeholder(value)
+                    # Resolver returns raw enum keys (issue #18); humanize via
+                    # the field's owning model i18n namespace.
+                    empty_value_placeholder(format_enum_display(value, fd, fd_model))
                   end
                 %>
                 <%= wrap_link_through(value, rendered_value, record, col) %>

data/app/views/lcp_ruby/widgets/_rich_text.html.erb

@@ -0,0 +1,25 @@
+<%#
+  Rich text widget — renders the i18n-resolved content as HTML.
+
+  Trust model (defense-in-depth):
+  * Trusted page (YAML/auto-defined, code-reviewed locale source) →
+    raw pass-through, same posture as any engine view that uses `raw`.
+  * Untrusted page (database-defined, end-user-editable through the
+    platform UI) → sanitized against the shared MarkdownSanitize allow-list.
+    `data[:trusted]` is set by Widgets::DataResolver from the page origin;
+    this branch is fail-closed (absent/false → sanitize), so even a
+    rich_text widget that slipped past the save-time Pages::DefinitionValidator
+    (seeds, update_column, pre-existing records) can't emit unsanitized HTML.
+
+  When the source is author-written markdown, prefer the :markdown widget —
+  friendlier authoring and the same sanitize guarantee.
+%>
+<div class="lcp-text-content lcp-text-content--rich">
+  <% if data[:trusted] %>
+    <%= raw(data[:content]) %>
+  <% else %>
+    <%= sanitize(data[:content],
+          tags: LcpRuby::Display::MarkdownSanitize::TAGS,
+          attributes: LcpRuby::Display::MarkdownSanitize::ATTRIBUTES) %>
+  <% end %>
+</div>

data/docs/README.md

@@ -9,6 +9,7 @@ LCP Ruby is a Rails mountable engine that generates full CRUD information system
   - **`rails generate lcp_ruby:install`** — add LCP to an existing Rails app
   - **`rails generate lcp_ruby:entity NAME field:type ...`** — scaffold a complete CRUD entity (model + presenter + permissions + view group). See [Getting Started → Scaffolding new entities](getting-started.md#scaffolding-new-entities) and the [design spec](design/entity_generator.md) for the field grammar and worked examples.
 - [Host Application Guide](guides/host-application.md) — Full app bootstrap, optional dependencies (XLSX, charts, metrics), feature generators
+- [Windows Setup](guides/windows-setup.md) — Native-compile toolchain on a clean Windows box (rbenv-for-windows, MSYS2/GCC gotchas, libyaml, the stale `libwinpthread` fix), the seven-step quick path
 
 ## YAML Reference
 
@@ -49,6 +50,7 @@ Complete attribute reference for every YAML configuration file:
 - [Import](reference/import.md) — Data import: CSV/XLSX upload, column mapping, strategies, nested has_one, profiles, background execution, generator
 - [Theme Variables](reference/theme-variables.md) — All `--lcp-*` CSS custom properties with light/dark values
 - [Engine Configuration](reference/engine-configuration.md) — `LcpRuby.configure` options
+- [Asset Pipeline](reference/asset-pipeline.md) — Sprockets compatibility shim on Rails 8 / Propshaft, boot-time `AssetPipelineError` check, `--skip-asset-pipeline` opt-out, Phase 2 ESM roadmap
 - [Boot / Reload Lifecycle](reference/boot_lifecycle.md) — Engine boot phases, extension hook timing (`on_model_ready`, `on_models_loaded`), dev-mode metadata watcher, `lcp_ruby:ensure_tables` rake + `db:prepare` / `db:setup` / `db:reset` integration, `boot.lcp_ruby` and `reload.lcp_ruby` AS::Notifications events
 - [`lcp_ruby:doctor`](reference/doctor.md) — Health check rake task: install manifest replay, feature state vs. prereqs, environment leaks (`BUNDLE_GEMFILE`, `.envrc`), seeds hygiene; `FORMAT=text|json|summary` and `EXIT_ON=error|warning`; install manifest format and JSON schema for CI consumption
 
@@ -136,6 +138,7 @@ Implemented:
 - [Auditing](design/auditing.md) — Native change tracking and audit trail
 - [Tree Structures](design/tree_structures.md) — Declarative parent-child hierarchies with traversal, cycle detection, and tree index view
 - [Saved Filters & Parameterized Scopes](design/saved_filters.md) — User-persistent named filters with visibility levels, parameterized scopes with typed parameters, generator, CRUD API
+- [Unify Scope Filters onto Presenters](design/grouped_predefined_filters.md) — Surface the shipped page `scope_filters` mechanism (grouped, multi-widget, AND across groups) on plain presenter indexes; reframe `predefined_filters` as sugar over it; fix the saved-filter dead-click; future: retire sugar, multi-select, parameterized options, DB/host sources
 - [Aggregate Columns](design/aggregate_columns.md) — Virtual computed columns (COUNT, SUM, MIN, MAX, AVG) from associated records, custom SQL, service-based aggregates
 - [Virtual Columns](design/virtual_columns.md) — Generalized query extensions: expressions, JOINs, GROUP BY, auto-include, backward-compatible with aggregates
 - [Tiles View](design/tiles_view.md) — Card grid layout for index pages with sort dropdown, per-page selector, and summary bar

data/docs/feature-catalog.md

@@ -3,7 +3,7 @@
 Auto-generated from `docs/feature-catalog.yml`. Do not edit manually.
 Regenerate: `cd examples/showcase && bundle exec rake lcp_ruby:feature_catalog`
 
-621 features across 45 categories.
+624 features across 45 categories.
 
 ## API Backed Models
 
@@ -218,13 +218,15 @@ Regenerate: `cd examples/showcase && bundle exec rake lcp_ruby:feature_catalog`
 - **KPI Trend Indicator** — KPI with delta arrow (compare_scope: on kpi_card). Shows percentage change vs comparison scope. Up/down/neutral. · `docs/reference/pages.md#kpi_card` `docs/guides/dashboards.md#kpi-trend-indicators` `docs/design/dashboards.md#widget-zone-types` `lib/lcp_ruby/widgets/data_resolver.rb`
 - **Landing Page Configuration** — Post-login redirect (config.landing_page = { role => slug }). Per-role landing pages with default fallback. · `docs/reference/pages.md#page-attributes` `docs/guides/dashboards.md#3-configure-landing-page-optional` `docs/design/dashboards.md#dashboard-as-landing-page` `app/helpers/lcp_ruby/dashboard_helper.rb` `app/views/lcp_ruby/resources/_grid_page.html.erb`
 - **List Widget** — Compact record list (widget type: list). model:, limit:, link_to:. Shows label_method values in a list. · `docs/reference/pages.md#list` `docs/guides/dashboards.md#list` `docs/design/dashboards.md#widget-zone-types` `lib/lcp_ruby/widgets/data_resolver.rb`
+- **Markdown Widget** — i18n source parsed by Commonmarker, output sanitized (widget type: markdown, content_key:). Raw HTML in source is stripped (`unsafe:` deliberately omitted). · `docs/reference/pages.md#markdown` `docs/guides/dashboards.md#markdown` `lib/lcp_ruby/widgets/data_resolver.rb` `app/views/lcp_ruby/widgets/_markdown.html.erb` `lib/lcp_ruby/display/renderers/markdown.rb`
 - **Multi-Select Filter** — input_options.multi: true on filter form fields. URL emits bracket-array (?page_filter[field][]=…). Defensive Type::ArrayOf coercion. · `docs/reference/page_filters.md#multi-select-multi-true` `docs/reference/virtual_forms.md#security-invariants` `docs/design/page_filters_as_virtual_forms.md` `lib/lcp_ruby/virtual_fields/types/array_of.rb` `lib/lcp_ruby/pages/filter_form.rb`
 - **Multi-Series Chart** — Multiple data series in one chart (series: array). Each series has its own name, color, scope, and may override group_by/aggregate. · `docs/reference/pages.md#chart` `docs/design/chart_widget_multi_series.md` `lib/lcp_ruby/widgets/data_resolver.rb`
 - **Page Filter Form** — Page-level filter bar (filter_form: array, form-syntax fields). Propagated to all zones via ScopeApplicator. Supports text, select, multi-select, association_select, date_range, boolean, … · `docs/reference/page_filters.md` `docs/reference/pages.md#page-filters` `docs/design/page_filters_as_virtual_forms.md` `lib/lcp_ruby/pages/filter_form.rb` `lib/lcp_ruby/pages/filter_form_validator.rb` `lib/lcp_ruby/widgets/scope_applicator.rb` `app/views/lcp_ruby/resources/_filter_form.html.erb`
 - **Presenter Zone on Dashboard** — Embedded index table in dashboard grid (presenter:, limit:). Reuses existing presenter columns. No widget config. · `docs/reference/pages.md#presenter-zones` `docs/guides/dashboards.md#presenter-zone` `docs/design/dashboards.md#widget-zone-types` `lib/lcp_ruby/widgets/presenter_zone_resolver.rb`
+- **Rich Text Widget** — i18n source emitted as raw HTML (widget type: rich_text, content_key:). Locale carries `<h2>`/`<a>`/`<strong>`; same trust posture as any engine view using `raw`. · `docs/reference/pages.md#rich_text` `docs/guides/dashboards.md#rich-text` `lib/lcp_ruby/widgets/data_resolver.rb` `app/views/lcp_ruby/widgets/_rich_text.html.erb`
 - **Scope Filters** — Page-level AR-scope toggle bar (scope_filters: array). Each entry maps UI options to named scopes on the page model. widget: select/radio/button_group. · `docs/reference/page_filters.md#scope_filters-syntax` `docs/design/page_filters_as_virtual_forms.md` `lib/lcp_ruby/pages/scope_filter_set.rb` `lib/lcp_ruby/widgets/scope_applicator.rb` `app/views/lcp_ruby/resources/_scope_filters.html.erb`
 - **Stacked Chart** — Stack series on the Y axis (stacked: true). Legal for column/bar/line/area; hard error for pie/donut. · `docs/reference/pages.md#chart` `docs/design/chart_widget_multi_series.md` `lib/lcp_ruby/widgets/data_resolver.rb`
-- **Text Widget** — Static i18n content (widget type: text, content_key:). For welcome messages, announcements on dashboard pages. · `docs/reference/pages.md#text` `docs/guides/dashboards.md#text` `docs/design/dashboards.md#widget-zone-types` `app/helpers/lcp_ruby/dashboard_helper.rb` `app/views/lcp_ruby/resources/_grid_page.html.erb`
+- **Text Widget** — Plain HTML-escaped i18n content (widget type: text, content_key:). For welcome messages and announcements. See rich_text / markdown variants for formatted content. · `docs/reference/pages.md#text` `docs/guides/dashboards.md#text` `docs/design/dashboards.md#widget-zone-types` `lib/lcp_ruby/widgets/data_resolver.rb` `app/views/lcp_ruby/widgets/_text.html.erb`
 
 ## Dialogs
 
@@ -498,6 +500,7 @@ recovery codes, generated credentials). dialog_behavior show_result + result.sty
 - **Health Check Endpoint** — Built-in /lcp_health JSON endpoint. DB + boot checks. 200/503. Unauthenticated for K8s probes. · `docs/reference/monitoring.md#health-check` `docs/guides/monitoring.md#health-check` `docs/design/monitoring.md#layer-3-health-check-endpoint` `docs/design/monitoring.md#health-check-response` `lib/lcp_ruby/metrics/`
 - **Monitoring Dashboard (Page)** — Dashboard page (/monitoring). KPI cards from Prometheus metrics + recent errors list widget. · `docs/reference/monitoring.md` `docs/guides/monitoring.md#monitoring-dashboard` `docs/design/monitoring.md#monitoring-dashboard` `docs/design/monitoring.md#layer-5-dashboard-visualization` `lib/lcp_ruby/metrics/` `lib/lcp_ruby/pages/`
 - **Monitoring Generator** — Single generator (lcp_ruby:monitoring). Creates error log model, presenter, permissions, dashboard page. · `docs/reference/monitoring.md#generator` `docs/design/monitoring.md#generator-output` `lib/lcp_ruby/metrics/`
+- **Page-Level Access Gate** — Runtime enforcement of `page.visible_when:` via PageAuthorization concern + PageGate pure function. Standalone pages with role/service gates return 403 for non-matching users. AUTH-002-runtime / AUTH-003 / AUTH-010 / AUTH-011 codes. Silent-bypass sentinel. · `docs/design/authorization_hardening.md` `docs/reference/invariant_check.md` `docs/design/authorization_hardening.md` `app/controllers/concerns/lcp_ruby/page_authorization.rb` `lib/lcp_ruby/authorization/page_gate.rb` `lib/lcp_ruby/authorization/misconfigured_page_error.rb`
 - **Prometheus Metrics Endpoint** — /metrics endpoint in Prometheus format. Requires prometheus-client gem. 9 built-in metrics. · `docs/reference/monitoring.md#prometheus-metrics` `docs/guides/monitoring.md#prometheus-grafana` `docs/design/monitoring.md#prometheus-metrics` `docs/design/monitoring.md#layer-2-prometheus-metrics-collection` `lib/lcp_ruby/metrics/`
 - **Verify Authorized Framework Guarantee** — after_action :verify_authorized on ResourcesController. Future contributor forgets authorize → 500 in dev/test (Pundit::AuthorizationNotPerformedError). Skips 4xx/5xx + Devise. · `docs/design/authorization_hardening.md` `docs/design/authorization_hardening.md` `lib/lcp_ruby/authorized_controller.rb` `lib/lcp_ruby/controller/authorization.rb`
 

data/docs/feature-catalog.yml

@@ -10214,11 +10214,13 @@ features:
   status: stable
 - name: Text Widget
   category: dashboards
-  synopsis: 'Static i18n content (widget type: text, content_key:). For welcome messages,
-    announcements on dashboard pages.'
-  description: 'A widget zone with `type: text` that renders static i18n content.
-    Use `content_key` to reference a locale key. Ideal for welcome messages, announcements,
-    or instructions.'
+  synopsis: 'Plain HTML-escaped i18n content (widget type: text, content_key:). For
+    welcome messages and announcements. See rich_text / markdown variants for formatted
+    content.'
+  description: 'A widget zone with `type: text` that renders static i18n content as
+    plain text (Rails default escaping). Use `content_key` to reference a locale key.
+    Ideal for plain announcements; for formatted content use the parallel `rich_text`
+    or `markdown` widget types.'
   config_example: |-
     ```yaml
     - name: welcome_note
@@ -10229,16 +10231,94 @@ features:
       position: { row: 1, col: 10, width: 3 }
     ```
   demo_path: "/showcase/showcase-dashboard"
-  demo_hint: The welcome text in the top-right corner of the dashboard is a text widget.
-    Its content comes from the `lcp_ruby.dashboard.welcome` i18n key.
+  demo_hint: 'The dashboard demonstrates the formatted variants (markdown for welcome,
+    rich_text for the announcement). For plain text behaviour, use `type: text` instead
+    — the locale string would render escaped.'
   docs_refs:
   - docs/reference/pages.md#text
   - docs/guides/dashboards.md#text
   design_refs:
   - docs/design/dashboards.md#widget-zone-types
   code_refs:
-  - app/helpers/lcp_ruby/dashboard_helper.rb
-  - app/views/lcp_ruby/resources/_grid_page.html.erb
+  - lib/lcp_ruby/widgets/data_resolver.rb
+  - app/views/lcp_ruby/widgets/_text.html.erb
+  status: stable
+- name: Rich Text Widget
+  category: dashboards
+  synopsis: 'i18n source emitted as raw HTML (widget type: rich_text, content_key:).
+    Locale carries `<h2>`/`<a>`/`<strong>`; same trust posture as any engine view
+    using `raw`.'
+  description: |-
+    A widget zone with `type: rich_text` that renders the i18n-resolved content as raw HTML — so the translation can contain `<h2>`, `<a>`, `<strong>`, etc. and they render as tags.
+
+    Trust model: locale files are author-controlled, the same trust level as any engine view that uses `raw`. When the translation pipeline involves external translators outside code review, prefer the `markdown` widget instead — it sanitizes Commonmarker output against an explicit tag allow-list.
+  config_example: |-
+    ```yaml
+    - name: announcement
+      type: widget
+      widget:
+        type: rich_text
+        content_key: lcp_ruby.dashboard.announcement_html
+      position: { row: 4, col: 5, width: 8 }
+    ```
+
+    ```yaml
+    # en.yml
+    en:
+      lcp_ruby:
+        dashboard:
+          announcement_html: '<strong>Heads up:</strong> rich_text pipes locale source through raw.'
+    ```
+  demo_path: "/showcase/showcase-dashboard"
+  demo_hint: 'The announcement on row 4 (next to "Draft Articles") uses `type: rich_text`.
+    Inspect the `<strong>` / `<code>` tags — they come straight from the i18n source,
+    no markdown conversion.'
+  docs_refs:
+  - docs/reference/pages.md#rich_text
+  - docs/guides/dashboards.md#rich-text
+  code_refs:
+  - lib/lcp_ruby/widgets/data_resolver.rb
+  - app/views/lcp_ruby/widgets/_rich_text.html.erb
+  status: stable
+- name: Markdown Widget
+  category: dashboards
+  synopsis: 'i18n source parsed by Commonmarker, output sanitized (widget type: markdown,
+    content_key:). Raw HTML in source is stripped (`unsafe:` deliberately omitted).'
+  description: |-
+    A widget zone with `type: markdown` that runs the i18n source through Commonmarker (CommonMark + GFM tables / tasklists / strikethrough / autolinks) and sanitizes the rendered HTML against the same tag/attribute allow-list as the model-level `:markdown` renderer (`display/renderers/markdown.rb`).
+
+    `unsafe:` is deliberately omitted from the Commonmarker options — raw HTML embedded in the markdown source is stripped at parse time. Friendlier authoring than HTML for hand-written welcome blurbs, and the safer choice when translations come from an external pipeline.
+  config_example: |-
+    ```yaml
+    - name: welcome
+      type: widget
+      widget:
+        type: markdown
+        content_key: lcp_ruby.dashboard.welcome_md
+      position: { row: 1, col: 10, width: 3 }
+    ```
+
+    ```yaml
+    # en.yml
+    en:
+      lcp_ruby:
+        dashboard:
+          welcome_md: |
+            ## Welcome
+
+            Mix **KPIs**, lists, charts, and *text-style* widgets on one page.
+    ```
+  demo_path: "/showcase/showcase-dashboard"
+  demo_hint: The "Welcome" zone in the top-right (row 1, col 10) renders Markdown
+    from the `lcp_ruby.dashboard.welcome_md` key — `##` becomes `<h2>`, `**bold**`
+    becomes `<strong>`.
+  docs_refs:
+  - docs/reference/pages.md#markdown
+  - docs/guides/dashboards.md#markdown
+  code_refs:
+  - lib/lcp_ruby/widgets/data_resolver.rb
+  - app/views/lcp_ruby/widgets/_markdown.html.erb
+  - lib/lcp_ruby/display/renderers/markdown.rb
   status: stable
 - name: List Widget
   category: dashboards