phlex-reactive 0.13.4 → 0.14.0

data/CHANGELOG.md

@@ -6,9 +6,155 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.14.0] - 2026-10-07
+
+This section also covers 0.10.0 through 0.13.4, which were released without
+changelog sections of their own.
 
 ### Added
 
+- **Bulk-selection lists without a per-list controller (#319).**
+  `reactive_select_all("ids[]")` makes a header box that ticks or unticks every
+  owned box of the group (dispatching `input` and `change` on each one it flips) and shows
+  checked / indeterminate / unchecked from the group. `reactive_count("ids[]")`
+  writes the ticked count. `reactive_enable(if:/if_any:/unless:)` is
+  `reactive_show`'s sibling that flips the element's own `disabled` (a button,
+  a fieldset), with the same server first paint. The conditions language gains
+  `{ checked: n }` / `{ checked: 1.. }` — the ticked count of a checkbox group,
+  in every binding that takes conditions, evaluated for first paint from
+  `reactive_values` (an Array of checked values, or a count). Rows appended or
+  removed by a stream re-sync the header, the count, the show/enable bindings
+  and show targets, and re-arm `reactive_on_complete` without firing it; a
+  header sets every box before dispatching, so a count condition sees the
+  final count; a nested root's boxes are never counted or flipped. `js.submit(to,
+  submitter: "#delete-submit")` submits through that submit control, so its
+  `name=value` posts; anything that is not a submit control of the form warns
+  and falls back to a plain submit. The client grows by about 0.8 KB gzip
+  (the default bundle 24,976 → 25,786 B).
+
+- **`phlex_reactive:doctor` flags Falcon under `:thread` isolation (#321).**
+  Falcon serves each request as a fiber on one thread, so under Rails' default
+  `config.active_support.isolation_level = :thread` every piece of thread-keyed
+  state (`CurrentAttributes`, `IsolatedExecutionState`, thread variables, the
+  transactional-test connection lock) is shared between requests. A new
+  `fiber_isolation` check fails when Falcon serves the app and the level is
+  `:thread`, with the fix (`config.active_support.isolation_level = :fiber` in
+  `config/application.rb`); it passes under `:fiber` and for Puma or any other
+  server. The server is read from the bundle and the server constants already
+  loaded, never by requiring one; when Falcon is bundled beside another server
+  and is not the only server loaded, the line is advisory. The installation docs gain a
+  "Running under Falcon" section.
+
+- **A hotkey pressed before the controller connects is no longer lost (#303).**
+  `phlex/reactive/early` now records `window:` triggers — how a hotkey is
+  usually bound (`on(:toggle, event: "keydown.k", window: true)`,
+  `on_client("keydown.k", …, window: true)`) — by a capture listener on
+  `window`, and the controller replays them on connect. Such a keypress also
+  wakes a dormant root. It is never prevented (a window binding is not prevented
+  once connected either), and it is replayed only if the controller connects
+  within 1.5 s of the keypress, or the early-event TTL if that is shorter.
+  `outside:` triggers and non-bubbling events from inside the page are not
+  recorded (Stimulus's window listener never hears the latter). Two roots
+  sharing a hotkey both hear it, as they do once connected. `early.min.js`
+  grows from 1,060 B to 1,296 B gzipped; its test budget moves from 1,100 to
+  1,300 B. The replay side adds about 210 B gzipped to both the default bundle
+  and the opt-in core.
+- **`phlex_reactive:doctor` finds the early import anywhere and checks every import map (#307).** The dormant-roots check now scans every app JS entry and inline module scripts in `app/views` and `app/components` (naming the file), and a new advisory line per import map lacking the `phlex/reactive/early` pin; set `Phlex::Reactive.importmaps = -> { { "landing" => map } }` for maps outside `Rails.application.importmap`.
+- **`reactive_lazy(cache:)` — privately cacheable lazy renders (#277).**
+  `reactive_lazy cache: { max_age: 10.minutes }` (combinable with `on:` and
+  `tag:`) renders a stable signed URL into the shell and the client GETs it; the
+  new `GET /reactive/fragment/:id` answers `Cache-Control: max-age=…, private`
+  with an ETag, so the browser reuses the fragment instead of asking again. With
+  `on:` that is "load on first open, reuse across page views", and a refresh
+  morph re-materializes from the browser cache. By default the reply says
+  `Vary: Cookie`; define `reactive_cache_viewer` to key the URL on the viewer
+  instead (needed for reuse across page views under Rails' cookie session store,
+  whose cookie changes on every response) and `reactive_cache_version` to bust
+  it. Every non-200 reply is `no-store`, a component without `cache:` is 404, the
+  id is purpose-scoped (not an identity or defer token), a blank
+  `reactive_cache_viewer` falls back to `Vary: Cookie` (never a shared anonymous
+  key) and `u` is a keyed digest, a cacheable reply carries no `Set-Cookie` (a
+  request during which any callback changed the session, set or consumed a
+  flash, minted a CSRF token, or wrote a cookie is `no-store` instead; a filter
+  can tighten the policy — `no_store`, `expires_now`, a shorter `max-age`,
+  `must-revalidate`, and `max-age=0` means `no-store` — never loosen it; the
+  ETag is the body only, so `etag { }` blocks do not apply to fragments), a redirected or non-turbo-stream reply is a failed load,
+  and
+  a render that embeds a form authenticity token is served `no-store`. New
+  settings: `Phlex::Reactive.fragment_path` (if you change it, also render
+  `<meta name="phlex-reactive-fragment-path">`), and
+  `Phlex::Reactive.fragment_cache_max_age_limit` (1 hour). `phlex_reactive:doctor`
+  checks the GET route. Not breaking: opt-in.
+
+- **`reactive_lazy(on:)` — load on an event or on visibility (#276).**
+  `reactive_lazy on: "panel:opened"` keeps the placeholder shell until that
+  event reaches it (bubbling from inside counts), then fetches the real render
+  once; `on: :visible` (or `on: { visible: "200px" }`) does the same when the
+  shell first enters the observer region (the viewport, grown by any
+  rootMargin). No request on page load, no re-arm after the
+  replace, and no TTL: the shell carries the identity token and a
+  framework-owned `__materialize` trigger, which the action endpoint answers
+  with the real render (403 for components that aren't `reactive_lazy(on:)`).
+  `action :__materialize` is now refused at declaration. A Turbo morph that
+  turns the loaded root back into the shell re-materializes it at once, and a
+  shell that is still unloaded after a morph is re-armed (a failed load's retry
+  path). Plain `reactive_lazy` is unchanged.
+
+- **`phlex/reactive/early`: triggers that fire before the controller connects
+  are replayed, not lost (#273).** Import it eagerly
+  (`import "phlex/reactive/early"`; the engine pins it with `preload: true`) and
+  the `reactive` controller may load lazily: a click, submit, key or custom
+  event that reaches an element-bound `on`/`on_client` trigger (not a `window:`
+  or `outside:` one) before its root connects is
+  queued — its native default stopped where the controller would stop it — and
+  replayed once on connect. `:once` triggers replay once. Entries older than
+  `Phlex::Reactive.early_event_ttl_ms` (10 s, read from
+  `<meta name="phlex-reactive-early-ttl">`) or whose element left the page are
+  dropped, with a warning under `data-reactive-verbose`. The module is under
+  1.1 KB gzipped, asserted by a test. Every root now also sets
+  `data-reactive-connected` and emits a bubbling `reactive:connect` event when
+  its controller connects. Apps that never import `early` see no change beyond
+  that event and attribute. If you add the import, remove any hand-written
+  "wait for the controller, then dispatch" loop, or the trigger fires twice.
+
+- **Dormant roots: mount the controller on first use (#274).**
+  `reactive_dormant` (class-level, inherited) or `reactive_root(dormant: true)`
+  / `reactive_attrs(dormant: true)` renders `data-reactive-dormant="reactive"`
+  in place of `data-controller="reactive"`, so a root that only matters after a
+  gesture neither mounts the controller nor, when it loads lazily, fetches it
+  (68 KB minified, 20 KB gzipped). The first element-bound `on`/`on_client`
+  trigger (not a `window:` or `outside:` one) wakes the
+  root: `phlex/reactive/early` moves the identifier into `data-controller`
+  (other controllers on the root stay connected) and the trigger is replayed
+  once on connect. Requires `import "phlex/reactive/early"`;
+  `phlex_reactive:doctor` lists the dormant components and whether it found
+  the import. The actor's reply, a `reactive_lazy(on:)` materialize and the
+  defer endpoint render the root awake; the page and broadcasts render it
+  dormant, and a dormant render landing on an awake root is re-woken by the
+  next trigger. A `reactive_lazy(on: "event")` shell can be dormant (the event
+  wakes and loads it in one request); `on: :visible` cannot, and declaring both
+  raises. Non-dormant roots render the same
+  bytes as before. `early.min.js` grows 53 B (1,007 → 1,060 B gzipped; the test
+  budget moves from 1,024 to 1,100 B).
+
+- **`phlex_reactive:actions` tells a deliberate skip from a forgotten check
+  (#278).** The `auth` column now has three states: `authorized*` (a call was
+  detected), `skipped` / `skipped (class)` (declared `skip_verify_authorized`,
+  per action or component-wide, inherited too) and `unverified` (neither).
+  `UNVERIFIED=1` lists only the unverified rows. The JSON and the MCP
+  `phlex_reactive_actions` / `phlex_reactive_find` tools add `authorization`
+  (`detected`/`skipped`/`none`) and `authorization_skip` (`class`/`action`/`null`);
+  `authorization_call_detected` stays for compatibility.
+
+- **System-test helpers that count reactive requests (#279).**
+  `reset_reactive_requests!`, `have_reactive_requests(n, kind: nil)` and
+  `reactive_request_count` in `TestHelpers::System` answer "one request on
+  first open, none after" without a fetch spy. The matcher waits until the
+  layer is idle, then asserts the exact count (`kind: :action` or `:defer`),
+  failing at once if the count overshoots. The client keeps per-kind totals on
+  `<html data-reactive-requests>` only under the verbose gate (dev/test by
+  default); production writes nothing.
+
 - **Several `on_client` bindings on one element (#271).** Two `on_client`
   calls merged with `mix` now both work — e.g. a root that closes a menu on an
   outside click AND on Escape. Each call carries its own descriptor, flags and
@@ -474,324 +620,352 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
     `StaleReferenceError` or read a transient blank — the matcher waits for the value
     to settle.
 
-### Fixed
-
-- **`reactive_compute` never saw a checkbox's checked state (#262).**
-  `#recompute` resolved each declared name first-wins and read `.value`, which
-  for a checkbox is a constant. Measured: a Rails `check_box` pair read `0`
-  ticked or not (the hidden companion comes first), a lone `value="1"` box read
-  `1` either way, and a box with no value attribute read `0` (`Number("on")` is
-  NaN). A radio group read its FIRST radio's value, whichever was checked. The
-  reducer ran on the toggle, from values that could not have changed.
-
-  A checkbox now contributes its checked state, coerced by the declared type:
-  `1`/`0` as a `:number` (and in the array form), `"true"`/`"false"` as a
-  `:string`, and `true`/`false` under the new **`:boolean`** type. It wins over
-  its same-named hidden companion, as it already did for `reactive_show`. A radio
-  group contributes its checked radio's value. The identity mirror and the
-  `mirror:` fallback paint the same reading.
+- **Conditional confirm — warn only when the values look suspect (#179).**
+  `confirm:` now takes a Hash for soft-validation-before-submit, so the dialog fires
+  ONLY when the field values are wrong — instead of a hand-written submit handler that
+  inspects fields and calls `confirm()` itself. Two forms, both evaluated client-side
+  over the same collected fields `reactive_compute` reads:
+  - **Declarative** — `confirm: { when: { total: 0 }, message: "Total is 0 — continue?" }`.
+    `when:` reuses `reactive_show`'s conditions language verbatim: a scalar is equals,
+    a `Range` is a threshold (`qty: 100..`), an `Array` is membership. Zero JS. The
+    dialog fires when the condition MATCHES; a clean value submits silently.
+  - **Named predicate** — `confirm: { predicate: "end_before_start", message: "…" }` for
+    multi-field logic the single-field form can't express. Register a pure function at
+    boot (`setConfirmPredicate("end_before_start", ({ starts_at, ends_at }) => ends_at < starts_at)`),
+    the twin of `setComputeReducer`. An unregistered name warns and proceeds without a
+    dialog. Works on `on(...)` AND `on_client(...)`. The predicate is soft-validation UX,
+    **not authorization** — a user can bypass it and the action still hits the endpoint's
+    real authorize/default-deny; never let it stand in for a server-side check.
 
-  Outputs were wrong the same way: a result whose name resolved to a checkbox
-  pair wrote `.value` on the hidden companion, changing what the UNCHECKED state
-  submits and leaving the box alone. An output now sets a checkbox's `checked`
-  from the result's truthiness (`""`, `"0"`, `"false"`, `0` and `false` untick)
-  and checks the radio of a group that carries the result.
+- **`confirm:` on `on_client(...)` — themed confirmation for zero-round-trip client ops (#178).**
+  The client-op path gains the SAME overridable `confirmResolver` gate `on(:action, confirm:)`
+  has (#52/#55). A destructive-feeling client op (clear a draft, reset a form) gets the
+  app's themed dialog with one line and no round trip:
+  `button(**on_client(:click, js.text("#draft", ""), confirm: "Discard this draft?"))`.
+  The gate lives in the user-gesture path (`runOps`), never in the shared op applier — a
+  server-pushed `reactive:js` op stream must not prompt. `setConfirmResolver` now themes
+  both paths at once.
 
-  **If a reducer relied on the old reading**, it changes: a lone checkbox with a
-  numeric `value` used to read that number regardless of state and now reads
-  `1`/`0` — write the amount in the reducer (`gift ? 25 : 0`). Apps that worked
-  around the defect by reading the box from `document` inside the reducer keep
-  working and can drop the workaround.
+- **CI transport verification matrix — the browser suite runs on Action Cable AND pgbus (#187).**
+  The system job is now `server × transport` (Puma/Falcon × cable/pgbus). The pgbus
+  cells add a plain `postgres:18` (pgbus vendors the PGMQ schema via its own
+  migrations — no extension image) and set `TRANSPORT=pgbus`, so the existing browser
+  suite proves the reactive round trip is transport-agnostic, and new `:pgbus`-tagged
+  specs prove real cross-tab broadcast delivery + actor-echo exclusion over live
+  Postgres SSE. `rake spec:system_matrix` runs the 2×2 locally (pgbus cells skip with
+  a note when Postgres isn't reachable); `rake pgbus:prepare_test_db` sets up the DB.
+  pgbus remains an optional, non-gemspec dependency — it is now a first-class *tested*
+  transport, not a required one.
 
-  Cost, same machine, happy-dom (engine-relative): the 30-input calculator
-  bench goes from 16.3 to 18.4 µs/iter, allocations flat. That is one `el.type`
-  read per declared name, which is what telling a checkbox from a text field
-  takes.
+- **Compound & numeric `reactive_show` predicates — `all:`/`any:` and
+  `gte:`/`gt:`/`lte:`/`lt:` (#176).** Value-conditional visibility now spans
+  **more than one field** and **numeric thresholds**, staying inside the
+  eval-free "declared literal predicate" contract. `all:` / `any:` fold a list of
+  per-field terms (`{ field:, equals:/not:/in:/gte:/… }`) with one fixed
+  connective — AND vs OR over the same literal vocabulary, no expression surface;
+  one flat binding replaces wrapper-div nesting and is the only way to express OR.
+  `gte:`/`gt:`/`lte:`/`lt:` compare `Number(value)` against a literal number baked
+  into the binding (the RHS must be a real `Numeric` — a typo fails at render); a
+  non-numeric field value is `NaN` → hidden, the safe reveal-on-threshold default.
+  Numeric predicates work standalone, as a compound term, and inside a
+  `reactive_show_targets` map. Malformed terms fold **false** (fail-closed:
+  default-deny). The single-field `reactive_show(:field, equals:)` form is
+  unchanged; the additions are backwards compatible.
 
-- **The dropped-param hints said nothing for a schema with string keys.**
-  `ParamSchema.compile` keeps keys as the author wrote them, so
-  `params: { "date" => :string }` is valid, but the #16/#21 hints only looked
-  up symbol keys. The param was still dropped and logged, just without the hint
-  that says where the schema declares it.
+- **Installable Claude debugging skill + `rails g phlex:reactive:claude` (#168).**
+  The gem ships a `phlex-reactive-debugging` skill (the doctor → inventory → find
+  → browser `report()` → MCP workflow + a failure table) under `lib/`, and the
+  new generator copies it into a host app's `.claude/skills/` and writes the MCP
+  server entry to `.mcp.json` — only when absent (it never rewrites an existing
+  `.mcp.json`; it prints the snippet instead). A new **Debugging & tooling** docs
+  page ties the four surfaces together; the security page documents
+  `verify_authorized`; the instrumentation table gains the `:unverified` outcome;
+  the README gains a Debugging & tooling section + the config rows.
 
-- **A checkbox group collapsed to one boolean, and the chosen values never left
-  the browser (#258).** `#collectFields` wrote `fields[name] = field.checked` for
-  every checkbox, so several boxes sharing a `features[]` name overwrote each
-  other and the action received the LAST box's checked state — `{}` under a
-  `[:string]` schema, `"false"` under a flat `:string` one, silent either way,
-  while a native submission of the same boxes sends
-  `features[]=news&features[]=events`. A name ending in `[]` is now collected as
-  an array of the chosen values: a ticked box contributes its `value`, an
-  unticked one nothing, a `<select multiple>` its selected options. The suffix is
-  the only trigger — a group says so rather than being inferred from two controls
-  sharing a name.
+- **On-demand client inspector — `phlex/reactive/inspect` (#168).** A standalone
+  JS module (the `confirm.js`/`compute.js` precedent — **zero hot-path cost**, no
+  edit to `reactive_controller.js`, loaded only when imported) that scans the live
+  DOM and maps every reactive root + bound trigger back to the server
+  `Component#action` names. From the browser console:
+  `(await import("phlex/reactive/inspect")).report()` prints a `console.table` of
+  every reactive root — its `id`, decoded token payload (component class, gid,
+  state keys, token version — try/catch base64+JSON decode, degrading to
+  `{ opaque: true }` on a Marshal-serialized payload), status attrs, triggers
+  (action + event + params + debounce/throttle/confirm), client-only ops,
+  computes, the `name`d fields the dispatch would collect, and the
+  show/filter/text binding families. Triggers are scoped to the **nearest** root,
+  so nested roots aren't double-attributed. The server↔client mapping is
+  by-name: `scan()`'s `component` + trigger `action` strings are exactly the
+  identifiers `phlex_reactive:actions` and the MCP tools list. Pinned by the
+  engine (not preloaded); pure read, never mutates the page.
 
-  **That makes the suffix a migration point.** ANY `[]`-named control now
-  contributes to an array, including a single one and including a named rich
-  editor or bare contenteditable, which the collector reads in a second pass: a
-  lone `<input type="text" name="tags[]">` used to post `"abc"` and now posts
-  `["abc"]`. An editor sharing its `[]` name with another control adds its
-  value to the group instead of standing down behind it, so the entry count
-  changes there too. Beside a radio it still stands down, because a radio keeps
-  its single value with or without the suffix. A ready but empty editor
-  contributes an empty string, the way an empty text field in the same group
-  does. An unticked box still contributes nothing. A hidden input under the
-  same name keeps contributing: nothing in the DOM tells a hidden that mirrors
-  an editor from one that is a list JS maintains, and a value posted twice is
-  visible where a swallowed one is not. Against a flat `params: { tags: :string
-  }` the array coerces to the literal `"[\"abc\"]"` — silently, with a 200. A
-  control whose name ends in `[]` has to be declared as an array type (`tags:
-  [:string]`), or renamed without the suffix if it was never meant as a list.
+- **Read-only diagnostic MCP server (#168).** `bin/rails phlex_reactive:mcp`
+  starts a stdio [MCP](https://modelcontextprotocol.io) server exposing five
+  read-only tools — `phlex_reactive_doctor`, `phlex_reactive_components`,
+  `phlex_reactive_actions` (optional `component:` filter), `phlex_reactive_find`
+  (fuzzy search + Prism method source), `phlex_reactive_config` (redacted) — so
+  Claude Code inside a host app can introspect the live reactive registry when
+  debugging. The `mcp` gem is **optional and lazy**: it is NOT a gemspec runtime
+  dependency; `Phlex::Reactive::MCP.load!` requires it on demand with a helpful
+  message when missing (the pgbus pattern), and the gem-dependent tool tree stays
+  out of the Zeitwerk autoloader — a host app without `mcp` boots and eager-loads
+  unaffected. Every tool is read-only and non-destructive (no arbitrary-query or
+  mutation tool) and reports names/paths/schemas only — never a token, secret, or
+  runtime state; `phlex_reactive_config` never emits the verifier or
+  `secret_key_base`. Consumer `.mcp.json`:
+  `{ "mcpServers": { "phlex-reactive": { "command": "bin/rails", "args": ["phlex_reactive:mcp"] } } }`.
+  Known constraint: stdio MCP needs a clean stdout — an initializer that `puts`
+  breaks the transport (same caveat as pgbus).
 
-  Three shapes keep their meaning on purpose: a lone checkbox without `[]` stays
-  the documented yes/no boolean, a radio group keeps its single checked value
-  with or without the suffix, and a hidden input sharing a name with a checkbox
-  is that box's companion. The companion is identified by the shared name, not
-  by its value, because Rails renders three of them: `check_box` emits
-  `value="0"`, `check_box(..., multiple: true)` the same under a `[]` name, and
-  `collection_check_boxes` a blank one — or none at all with
-  `unchecked_value: nil`. Reading the second shape by value collected
-  `["0","0","0","3"]` for three boxes with the third ticked.
+- **verify_authorized runtime guard (#168).** New
+  `Phlex::Reactive::Authorization` (fiber-local tracking window, method
+  interception, the enforcement decision), `mark_authorized!` instance helper,
+  the `skip_verify_authorized` DSL (registry #6, inherits like the other five),
+  and `Phlex::Reactive.verify_authorized` / `authorization_methods` config
+  (`defined?`-guarded so an explicit override sticks). See the breaking note
+  above for the behavior and remedies.
 
-  A form body can't carry an empty array, so a cleared group used to go missing
-  whenever the client sent a form body (as soon as a file input holds a file),
-  and the action got its keyword default instead of `[]`. Now the client names
-  the cleared group in `empty_groups[]`, a field next to `token`, `act` and
-  `params`, and the endpoint sets it to `[]`. A request without that field
-  behaves as before, and a group that carries values keeps them.
+- **Action inventory — `Phlex::Reactive::Inspector` + rake tasks (#168).** A new
+  read-only introspection layer that answers "what reactive actions exist in this
+  app, where are they defined, and is each authorized?" without grepping.
+  `Phlex::Reactive::Inspector.components` discovers every constant-backed reactive
+  component from the loaded `Streamable` registry; `.find(query)` fuzzy-matches
+  one (exact > prefix > substring > subsequence, on both the demodulized and the
+  full name). Each action reports its declared param schema, `file:line`, the full
+  `def … end` source (extracted with **Prism**, degrading to `nil` on an
+  unreadable/unparseable file — never raising), and a **heuristic** authorization
+  status (a Prism scan for a configured authorization method or
+  `mark_authorized!` in the body — advisory only, since a helper may authorize
+  indirectly). Two shipped rake tasks surface it: `bin/rails
+  phlex_reactive:actions` (plain-text table, `FORMAT=json` for tooling) and
+  `bin/rails "phlex_reactive:find[query]"` (ranked matches; top match in detail
+  with each action's method source). Output is names/paths/schemas only — never
+  tokens, secrets, or runtime state (the instrumentation privacy contract
+  extended to tooling). `Doctor` now delegates its `constant_backed_component?`
+  filter to the Inspector so the endpoint-rebuild predicate lives in one place.
 
-  It applies to params the action declares as an array, by plain name or with
-  the component's `reactive_scope` in front, and only at the top level. A group
-  declared one level down or inside nested attributes is ignored and keeps its
-  keyword default; `verbose_errors` logs it. The endpoint never takes the key it
-  writes from the request. It looks the name up in the declaration and writes
-  the declared key, so a request can't create a param the action didn't ask for.
+- **Deferred reply segments — `reply.defer` (#165).** An expensive part of a
+  reply (a cross-aggregate rollup, a report) no longer stalls the actor's
+  interaction: `reply.streams(cheap).defer(SessionTotals.new(workout:))`
+  returns the cheap streams immediately and streams the real render to the
+  SAME actor when it finishes. Keep-content default (the stale value stays
+  visible, marked `data-reactive-defer-pending` + `aria-busy` for CSS
+  shimmer); `placeholder: true` / a component swaps a skeleton in;
+  `morph: true` morphs the arrival (the mode rides INSIDE the signed token).
+  Transactional (the directive rides the post-commit reply — a rollback or a
+  denied action leaks nothing), actor-scoped (peers keep `broadcast_*_to`),
+  superseding (a newer action for the same target aborts the in-flight
+  deferred render — no stale paint), and interactive on arrival (fresh action
+  token). Delivery is transport-adaptive (`Phlex::Reactive.defer_transport`,
+  default `:auto`): a parallel fetch to the new `POST /reactive/defer`
+  endpoint everywhere (purpose-scoped, short-TTL defer token —
+  `defer_token_ttl`, default 120s; `reply.defer` tokens are **actor-bound**
+  to the requesting session so a leaked one can't be redeemed elsewhere,
+  `reactive_lazy` shell tokens are unbound by necessity — they render
+  before a session exists — with the TTL + `authorize!` as their bound;
+  never interchangeable with action tokens),
+  or a **durable pgbus one-shot stream + `DeferredRenderJob`** when pgbus's
+  reactive Streams and ActiveJob are present (`defer_job_queue` config; the
+  durable since-id replay closes the broadcast-before-subscribe race, and the
+  broadcast tears down its own subscription). The push lane's one-shot queue is
+  reclaimed by pgbus's age-based orphan-stream sweep (**pgbus ≥ 0.9.10**; run
+  the Dispatcher with `streams_orphan_threshold` set); we never eager-drop it
+  (that would reopen the delivery race). The one-shot key is sized to the live
+  pgbus `queue_prefix` budget, so a non-default prefix can't overflow it; the
+  render job broadcasts a cleanup on ANY failure so the actor's pending state
+  always resolves. Every capability gap degrades to the fetch lane — the
+  Action-Cable-or-pgbus invariant holds. **Profile first:** an app-side N+1
+  looks exactly like framework lag; defer is for segments that are genuinely
+  expensive after the synchronous path is cheap.
 
-  A blank entry (`params[name][]=""`) would have been the other way, but the
-  schema reads `[""]` per element type, and for a `[:file]` param behind
-  `has_many_attached` that is the difference between "not sent" and "remove the
-  attachments".
+- **Lazy initial mount — `reactive_lazy` (#165).** The same machinery for the
+  FIRST render (Livewire `#[Lazy]`): the page ships the component's
+  placeholder shell (`deferred_placeholder`, or a built-in pending shell) with
+  the defer token on the root; the client fetches the real content on connect
+  AND after a Turbo page-refresh morph (so a lazy component survives a
+  `turbo:reload`). `reactive_lazy tag: :tr` (etc.) ships a shell element that
+  matches a `<tr>`/`<li>` root instead of an invalid `<div>`.
+  Reactive-machinery renders (an action's self-replace, broadcasts, the defer
+  endpoint/job) stay REAL, so actions never pay two round trips.
 
-  `post_reactive_multipart` takes `empty_groups:` so a request spec can send a
-  cleared group the way the client does. `ParamSchema#array_param(name)`
-  returns the declared key for an array param, or `nil`.
+- **pgbus capability gates.** `Phlex::Reactive.pgbus?` and `.pgbus_streams?`
+  (the documented broadcast-accepts-`:exclude` probe, now actually
+  implemented) plus `.defer_push_capable?` for the defer push lane.
 
-  `reactive_persist` drafts such a group as the list of ticked values and
-  restores exactly those boxes; before, the draft held one boolean and the
-  restore ticked every box of the group. Whether the server already rendered a
-  box ticked — in which case it keeps its say and the draft yields — is decided
-  once before the restore walks the controls, because the walk writes `checked`
-  as it goes and asking from inside it would read the restore's own work: the
-  first box it ticks would make every later box of the group look
-  server-rendered, and a draft of two values would come back as one. A
-  non-checkbox control sharing the group's name additionally threw inside the
-  draft write, which is swallowed — the root then persisted nothing at all,
-  silently. On restore, such a control keeps what the server rendered whenever
-  the group has two or more contributors: the list records the values, not
-  which control each one came from, so replaying it would paste `freeform,news`
-  into a text field, an editor, or a contenteditable. A group of ONE
-  contributor has no such ambiguity — its single entry can only have come from
-  that control — so a plain field whose name merely ends in `[]`, the usual
-  shape for a list JS maintains, keeps its draft exactly as it did before
-  groups existed. A `<select multiple>` reads a list by matching option values,
-  which is only sound when the list is its own: sharing a group with another
-  contributor, it too keeps what the server rendered, since a text value that
-  happens to equal an option would otherwise select it.
-
-  Drafts written before this release are not discarded, but their group key is
-  no longer applied to the controls that read a list: it holds one boolean (or,
-  in a mixed group, whichever control wrote last), and applying that kept
-  causing damage for as long as the draft lived — by default seven days after
-  the upgrade. The damage differed by control. A checkbox group came back fully
-  ticked. A `<select multiple>` sharing the group's name lost its rendered
-  selection instead, because under `restore: "always"` the select branch skips
-  the "the server had a say" check and matches `Set{"true"}` against its
-  options, where nothing matches. The next snapshot replaces the key with the
-  list. Only that one key changed meaning, which is why `PERSIST_VERSION` stays
-  where it is: bumping it would also throw away the drafted prose of every form
-  that has no checkbox group at all.
-
-- **`reply.pending` kept its settle handle under
-  `enqueue_after_transaction_commit = true` (#254).** The handle was captured in
-  `Phlex::Reactive::Settles#serialize`, which reads a thread-local that lives
-  only for the duration of `reply.pending`'s enqueue block. Under Rails'
-  `ActiveJob::Base.enqueue_after_transaction_commit = true` (the 7.2+
-  recommended setting) `job.enqueue` is deferred to
-  `ActiveRecord.after_all_transactions_commit`, and the endpoint runs every
-  action inside a transaction — so `serialize` always ran AFTER the block had
-  exited. The job serialized with no `phlex_reactive_settle` key,
-  `reactive_settle` was a no-op, and the row sat shimmering until someone
-  reloaded. The handle is now captured when the job INSTANCE is created
-  (`perform_later` → `job_or_instantiate` → `new`), which is synchronous inside
-  the block whether or not the enqueue itself is deferred; `serialize` prefers
-  the captured handle and still falls back to the thread-local. Both the
-  `job:`/`args:` sugar (narrowing per record, so failures stay attributable) and
-  the block form are covered, and a retry re-enqueue keeps its handle. Jobs
-  enqueued outside any `reply.pending` still carry nothing.
-
-- **`rake release` bumps the pin in every tracked lockfile (#247, #253).** Since
-  #246 the gem root's `Gemfile.lock` is committed alongside `docs/Gemfile.lock`,
-  and both pin `phlex-reactive` by local path — so a version bump that left them
-  alone shipped a stale lockfile, and the Release workflow's frozen
-  `bundle install` refused it (v0.13.0's first attempt).
-
-  The task now bumps that pin **with a text edit**, not `bundle lock`. #247's
-  first cut used `bundle lock --local`, which is a full re-resolve — and a
-  re-resolve trips over constraints that have nothing to do with this gem:
-  `docs/Gemfile.lock` declares Linux platforms for the Kamal deploy, and
-  resolving `thruster` for those against a Mac's installed gems fails ("Could
-  not find gems matching 'thruster' valid for all resolution platforms"), which
-  aborted v0.13.1's first attempt mid-release with `version.rb` already bumped.
-  A re-resolve also silently folds unrelated dependency drift into the release
-  commit the moment a Gemfile is out of sync with its lock. The only line a
-  version bump changes is the path-gem pin, so the task edits exactly that (the
-  `PATH` spec + the `CHECKSUMS` entry) in place — deterministic on any machine,
-  no network, no installed gems, the same 2-line diff bundler produced. A
-  lockfile that names no pin at all now **aborts** the release rather than
-  reporting itself already current — and that check runs in a PREFLIGHT, before
-  the task does anything destructive or irreversible: before the `force`
-  cleanup that deletes the GitHub release and its tag, and before `version.rb`
-  or any lockfile is written. So an abort leaves the release intact and the tree
-  clean, rather than a deleted release or a half-bumped tree the clean-tree
-  guard would then block on retry.
-  pgbus's release task made the same call after the same failure.
-
-- **`Component::Action` renamed `ActionDefinition` — it shadowed a host kit
-  component named `Action` under dev autoloading (#233).** The mixin sits in
-  every reactive component's ancestry, so its bare `Action` constant satisfied
-  Phlex::Kit's LazyLoader `const_get` check with the wrong class: the kit's
-  real `Action` component never autoloaded and the call fell through to
-  `NoMethodError` — intermittently (any unrelated load of the kit class masks
-  it until the next reload) and only under lazy autoloading, so an
-  eager-loaded test suite stays green. The rename matches its siblings
-  (`ComputeDefinition`, `OnCompleteDefinition`, `CollectionDefinition`) and
-  removes the constant entirely — **deliberately no alias**, since any
-  `Action` constant in the ancestry re-creates the shadowing. Breaking only
-  for code referencing the internal
-  `Phlex::Reactive::Component::Action` Data class directly; the `action :name`
-  DSL and `reactive_actions` registry are unchanged. A regression spec guards
-  the whole component ancestry against `:Action` coming back.
-
-- **Multipart path corrupted/dropped fields with Rails-bracketed names (#231).**
-  `#buildFormData` wrapped every collected field/file name verbatim as
-  `params[<name>]`, so `blog_post[summary]` went out as the Rack-unparseable
-  `params[blog_post[summary]]` — the scalar arrived as `{"]" => value}` (and a
-  writer stringified that hash into the record, with a 200), and a `:file` under
-  a bracketed name (`blog_post[image]`) never reached its schema key (silent
-  drop). It only fired when a file input was populated — the JSON path expands
-  the same names server-side — which is why flat-named forms never caught it.
-  The client now bracket-expands the field **name** into wire segments
-  (`params[blog_post][summary]`, `params[blog_post][image]`, and
-  `params[photos][]` for a `multiple` picker named `photos[]`), mirroring the
-  server's `bracket_path` exactly, so a multipart body and a JSON body coerce
-  identically for the same fields. Flat names are byte-identical to before.
-
-- **Reply-rendered components now generate absolute URLs with the REQUESTING
-  host, not the process default (#232).** Actor replies (`reply.replace`,
-  `reply.streams(...)`, the implicit replace) render through the memoized
-  off-request view context, whose `url_options` were process defaults — so any
-  absolute URL helper (`image_tag` on an Active Storage attachment being the
-  everyday case) rendered the wrong host on a multi-host app: a broken image
-  after every save, healed by the next full page load. The action endpoint now
-  threads the request's protocol/host/port into the reply render (the
-  `ActiveStorage::SetCurrent` move) via a thread-local the memoized context
-  merges per call — the context is never rebuilt, so the render memoization
-  win is untouched (allocations byte-identical, throughput flat within noise).
-  The defer **pull** endpoint gets the same treatment (it is an actor request).
-  **Broadcasts are unchanged by design** — there is no request and subscribers
-  can be on different hosts, so a broadcast fired *inside* an action explicitly
-  clears the actor's url_options around its render; "URLs in broadcast-rendered
-  components must be host-relative" is now documented in the Broadcasting guide.
-
-- **`rake bench` ran the removed `broadcast_replace_to` API and exited 1.**
-  `benchmark/micro/broadcast.rb` migrated to the #185 spellings
-  (`broadcast_to(*key, replace:)` / `broadcast_to(each:, replace:)`); the
-  transport double is unchanged.
-
-- **`reactive_nested_remove(confirm:)` now interpolates `%{field}` on client-added
-  rows (#222).** A row added in the browser via `reactive_nested_add` is a
-  `cloneNode` of the `<template>`, and the clone path (`#renumberNestedRow` /
-  `#seedNestedRow`) never rewrote the confirm attribute — so a per-row confirm
-  froze to the template's value-less string on every added row (the exact rows
-  the primitive exists for). The client now resolves `%{field}` placeholders in
-  the confirm message from **that row's live field values** at click time (keyed
-  by the same trailing-bracket inference `as: :json` uses), so
-  `confirm: "Delete '%{name}'?"` on the template shows `Delete 'Widget'?` on the
-  added row — reflecting a later edit too (resolved on remove, not on clone). An
-  unresolved `%{key}` is left as its literal text (debuggable, never a silent
-  blank); the placeholder works in the conditional Hash's `message:` as well.
-  Server-rendered rows already interpolate server-side, so their finished strings
-  are unaffected. **Also (superset of the issue's proposal 3):** `confirmResolver`
-  now receives an optional second argument — a context object, always `{ el }`
-  (the trigger), plus `{ row, fields }` on a `reactive_nested_remove` — so a
-  themed-dialog override can build row-specific messages programmatically. The
-  arg is additive: a one-parameter resolver (and `window.confirm`) is unchanged.
-
-- **A draft (unsaved-parent) token can now round-trip real server actions (#208).**
-  `Component::Identity` already signed a gid-less `{c, state}` token for an
-  unpersisted (or nil) record, but `from_identity` still `fetch`ed the absent
-  `gid` — the FIRST action against a draft crashed with an uncaught `KeyError`
-  (500). It now rebuilds through the record kwarg's **initialize default**
-  (e.g. `def initialize(order: Order.new, …)`), with the declared
-  `reactive_state` riding the token as before; a component whose initialize
-  REQUIRES the record kwarg raises a guided `Phlex::Reactive::Error` naming the
-  fix instead of a bare missing-keyword `ArgumentError`.
-
-- **`have_reactive_value` now reads the field's `.value` property, so it can verify a
-  reducer-set disabled/computed field (#204).** The matcher (added in #201) delegated to
-  Capybara's `have_field(with:)`, which matches the value **attribute** — but a
-  `reactive_compute` reducer paints a computed output by setting its JS `.value`
-  **property** (`el.value = …`), and for a **disabled / read-only** output the attribute
-  never reflects that. So the matcher read `""` and failed on exactly the fields it was
-  built for. It now re-resolves the field by id **or name** each poll and asserts the live
-  `.value` property (via `evaluate_script`), covering enabled AND disabled/computed fields
-  while keeping the morph-immunity. `have_reactive_text` (textContent) was unaffected.
-
-- **A freshly-rendered `reactive_compute` root now self-seeds its derived fields on connect (#199).**
-  Before, a compute root computed nothing until the first user `input` — a fresh render
-  (or a server validation-error re-render that replaced the body) left every derived
-  output and cross-root `mirror:` node blank until you typed. Apps worked around it by
-  dispatching a synthetic seed `input` on connect, but the compute root is a distinct
-  Stimulus controller that may connect a frame later, so the seed raced its own wiring —
-  the reported symptom being a PARTIAL apply (an early output painted; a later output
-  and the mirror stayed blank). Now `connect()` runs ONE full `recompute()` after the
-  controller is fully connected, so the whole single-pass write set (batch outputs →
-  paint text sinks + cross-root mirrors → dispatch) runs synchronously and every
-  declared output, text sink, and mirror paints from a single reducer result — no user
-  interaction, no round trip. It re-seeds on `turbo:morph-element` (the show/filter/dirty
-  precedent) and is idempotent (change-guarded writes make a re-seed a no-op, so an app
-  still dispatching a synthetic input is harmless). The seed is gated on a new
-  `data-reactive-compute-seed` marker emitted by `reactive_root(compute:)`; a non-compute
-  root pays one attribute read and never seeds. The seed passes no event, so
-  `meta.changed` is `null` — the correct "no field edited yet" semantics, so a convergent
-  reducer's default branch computes the full settled set.
-
-- **Scoped form fields no longer silently drop their params — the #67 footgun is fixed (#184).**
-  Under `reactive_scope`, `reactive_field(:date)` now emits the scoped wire name
-  (`name="invoice[date]"`), so the POST arrives bracketed — and the endpoint unwraps
-  exactly ONE scope level before schema matching, so a FLAT schema
-  (`params: { date: :string }`) matches. Previously a scoped field either POSTed a bare
-  name (misaligned with the `reactive_show`/`reactive_compute` resolvers, which already
-  query `[name="scope[x]"]`) or forced a hand-written bracketed name + a hand-nested
-  schema that Rails' bracket-expansion silently dropped. The client's `meta.changed`
-  resolver (`#changedComputeField`) is now scope-aware too, so a scoped compute
-  component's reducer still sees the bare declared name.
+- **Client-side option filtering — `reactive_filter` (#163).** The other half
+  of #72's combobox: **preload the options, type to narrow — zero round
+  trips.** Spread `reactive_filter(input:, option:, group:, empty:)` onto the
+  root and the generic controller shows/hides each option on every keystroke by
+  a case-folded substring match against its `data-reactive-filter-text`
+  haystack (falling back to the option's own text) — no POST, no token, no
+  bespoke per-feature Stimulus controller. Optional `group:` collapses a header
+  whose every contained option is hidden; optional `empty:` reveals a
+  no-matches node at 0 visible. Selectors resolve within the root only (nested
+  reactive roots untouched), state seeds at connect and re-applies after a
+  morph, and blank selectors raise at render (a dead binding must fail loudly).
+  Composes with keyboard nav and per-row selection: a filtered-out option also
+  drops out of the Arrow-key path and loses its highlight, so Enter can never
+  pick an invisible row — selection itself stays a signed `on(:select)` action.
+- **Standalone combobox keyboard nav — `reactive_listnav` (#163).** The same
+  Arrow/Enter/Escape wiring `on(…, listnav:)` appends, without the dispatch
+  descriptor — for the preload-and-filter input that fires **no** action (an
+  `on()` trigger would POST per keystroke). Spread
+  `reactive_listnav("[role=option]")` onto the input; Enter still picks by
+  clicking the highlighted option's own signed trigger.
+- **Cross-root `reactive_show` targets — `reactive_show_targets` (#164).** A
+  field can now drive the visibility of declared elements **outside** its
+  reactive root — the nav tab, the panel in another tab pane, the sidebar note
+  a mode selector governs — the visibility parallel to the #159 cross-root
+  text mirror. The component that **owns** the field declares which outside
+  ids it governs, spread on the root:
+  `mix(reactive_root, reactive_show_targets(:mode, "#advanced-tab" =>
+  { equals: "advanced" }, "#basic-note" => { not: "advanced" }))`. Same
+  posture as `mirror:`: opt-in and declared, never implicit (a plain
+  `reactive_show` stays root-isolated, #15 untouched); targets are **single id
+  selectors only** — a class/compound selector raises at declare time AND is
+  warn-and-skipped by the client (two-sided default-deny); the predicate is
+  the same literal-only `reactive_show` vocabulary; the toggle is `hidden`
+  only. The field read stays **owned** — you can only drive outside visibility
+  from a field the declaring root owns. A target id not on the page is
+  silently skipped (an unrendered tab pane is normal); the cross-root pass
+  shares the owned-binding pass's field-read memo (one read per field per
+  sync). No map declared → one `getAttribute` and out. **One call per root**:
+  Phlex `mix` space-joins duplicate string data values, so a second call's
+  JSON would corrupt the attr (the client warns and ignores it) — several
+  fields go in one call via the hash form
+  (`reactive_show_targets(mode: { … }, kind: { … })`).
+- **Value-conditional visibility — `reactive_show` (#161).** The `x-show` /
+  `data-show` / `wire:show` case — show/hide an element from a form field's
+  **current value** — no longer needs a hand-written `change`-listener Stimulus
+  controller. Spread `reactive_show(:mode, not: "off")` onto the element to
+  show/hide (also `equals:` and `in: [...]`; `equals: true` reads a checkbox's
+  checked state, a radio group reads the checked radio's value) and the generic
+  controller toggles the `hidden` attribute on every `input`/`change` —
+  client-only, zero round trip, no token. The predicate is a **declared literal
+  match**, never an expression (no eval surface); exactly one predicate is
+  enforced loudly at render; a missing field or malformed wire attr is
+  warn-and-skipped (client-side default-deny). Visibility seeds at connect and
+  re-syncs after a `turbo:morph-element`; a `reactive_compute` output write
+  dispatches a real `input` event, so derived values drive visibility too.
+  Ownership follows the nested-root rules (#15). Roots without a binding pay
+  one connect-time probe — no new listeners, byte-identical wire.
 
-- **`reactive_compute` output order no longer silently corrupts values (#183).**
-  Each output write used to dispatch an `input` event **mid-loop**, re-entering the
-  reducer synchronously from a **half-written DOM** — so a wrong `outputs:` order
-  could commit wrong values (a real money-corruption class), settling only if the
-  reducer was convergent in exactly the declared order. The client now runs the
-  reducer **once** from one pre-write input snapshot, writes all changed outputs as
-  a **batch**, paints text/mirror sinks from the settled values, then dispatches the
-  `input` events — each self-marked so the root skips re-running its own reducer
-  while other listeners (chained repaint, dirty tracking, `reactive_show`, sibling
-  roots) still fire. Declared output order is no longer semantics. Covered by a JS
-  order-independence test (declare outputs in the historically-wrong order — values
-  stay correct) and a self-re-entry-suppression test.
+- **Cross-root text mirrors + the `text` client op (#159).** A derived value can
+  now be painted into a text node **outside** the computing component's reactive
+  root — the read-only recap in another tab pane that previously forced a
+  bespoke JS listener — with the library's default-deny posture intact:
+  - `reactive_compute ..., mirror: { sum_total: "#sum_total" }` declares
+    allowlisted cross-root text mirrors. Each compute pass paints every declared
+    name into its document-wide **id** target(s) via `textContent`
+    (change-guarded, never `innerHTML`, never blanks a name the pass produced no
+    value for). The value comes from the reducer result, a just-written output's
+    field, or a declared input's identity value — so it works with no reducer at
+    all. Non-id selectors raise at declare time AND are warn-and-skipped by the
+    client interpreter (two-sided default-deny). No `mirror:` → the wire is
+    byte-identical to before.
+  - `js.text(to, value, global: false)` — a new op that sets `textContent`
+    (stringified; `nil` clears), available to `on_client`, `reply.js`, and
+    `broadcast_js_to`. Strictly less powerful than `set_attr`; pair with
+    `global: true` for the cross-root paint.
+  - `global: true` is now honored on the `reactive:js` stream path: a single op
+    can opt out of the reply's target-root scope to document-wide resolution
+    (previously it was silently ignored when a `target` was set).
 
 ### Changed
 
+- **The client ships as two entries: the default, one file with everything,
+  and an opt-in core that imports feature modules on demand (#275). The
+  default is unchanged: nothing to do when upgrading.**
+  - **`phlex/reactive/reactive_controller` — the default — is still one file
+    with the whole client in it.** Same specifier, same imports (Stimulus and
+    the three override seams), nothing fetched on demand, every feature
+    connected inside `connect()` as before. Existing importmap pins, bundler
+    aliases and vendored copies keep working as they are. It contains no
+    `import()` at all. It is 24,675 B gzipped, 2,403 B more than the 22,272 B
+    it was before the split. The split first left it at 26,132 B; #305 builds
+    it with `__SPLIT__` false, so the runtime imports every feature statically
+    and calls it directly — no feature table, no loader, no `withFeature` —
+    and recovers 1,457 B of that. What remains is how the features are written
+    as modules (per-root state records where the controller had private
+    fields, exported wrappers, the `core` handle), not the boundary between
+    them. The budget test holds a 24,900 B ratchet; getting back to the
+    22,700 B target (the pre-split size plus a loader's worth) is #310.
+  - **`phlex/reactive/core` — new, opt-in — is the controller without its
+    feature modules** (12,467 B gzipped). It imports a feature the first time
+    something on the page needs it, by a literal bare-specifier `import()`:
+    `phlex/reactive/features/persist` (3,210 B: `reactive_persist` drafts and
+    rich-text editors), `…/defer` (2,846 B: `reply.defer`, `reactive_lazy`,
+    `reactive_lazy(on:/cache:)`), `…/form` (1,015 B: dirty tracking,
+    `warn_unsaved`, the paste-trigger gate), `…/bindings` (5,360 B:
+    `reactive_show` and show targets, `reactive_on_complete`,
+    `reactive_filter`, `reactive_tags`, nested rows and their JSON mode, the
+    conditional `confirm:`), `…/compute` (2,084 B: `reactive_compute`,
+    `reactive_text`, the connect-time seed), `…/effects` (1,693 B:
+    `reactive_effects` and `dismiss_after`), `…/hints` (1,024 B: `optimistic:`
+    and `busy:`) and `…/devtools` (1,589 B: the latency simulator, the
+    zero-target warnings, the debug trace). The engine pins the core and every
+    feature (`preload: false`) and precompiles them. An app imports it INSTEAD
+    of `reactive_controller`, never both; loading both logs `the client was
+    loaded twice`. The README's "The split client" section is the opt-in
+    guide: what loads when, the trade-off, how to preload a feature, and the
+    one prefix alias a bundler needs.
+  - **The budget.** The epic's "core under 8 KB" became 10,240 B during the
+    work. The honest moves — every feature out, the test seams out of the
+    shipped build, the diagnostics into devtools, the conditional confirm and
+    its DNF fold into bindings, the compute seam import into compute — leave
+    the core at 12,383 B, 2,143 B over. The budget test holds the real size
+    (rounded up to 12,500 B) as the ratchet and prints the target; the PR for
+    the last phase lists what else could move and what each is worth. The
+    epic's criterion is amended to the shipped number.
+  - **Only with the split client:** the first root of a page load that needs
+    a feature waits for its import (later roots and Turbo visits do not).
+    While a draft-keeping root waits, nothing is drafted from the server's
+    blanks, what the user changes is drafted when the module arrives (also if
+    they leave the page first), a successful submit still forgets the draft,
+    `persist_state` / `persist_clear` wait for the restore, and an action
+    waits for the restore and posts the restored values — except when the
+    module is slower than the feature timeout, fails to load, or the root
+    leaves the page first. An `on:` event during a lazy shell's wait loads it
+    exactly once afterwards; a `reactive:defer` stream is kept and applied. A
+    stream that brings a page's first effect or dismissing flash — or swaps
+    in a root that needs a module — waits up to a second for the imports, and
+    the streams behind it keep their order; after that they render as they
+    are, and the effects module sweeps up the flashes it missed when it
+    arrives. A dirty-tracked form counts an edit made before its module
+    arrived, but `warn_unsaved` does not prompt for a navigation in that
+    window (preload `phlex/reactive/features/form` where that matters). A
+    form's bindings and a compute root show the server's rendering until
+    their module arrives, then seed from the fields as the user left them;
+    both hold the root's requests until then. A trigger with a hint has its
+    request wait for the hints module, then the hint applies and the request
+    goes out once; a failure after a late apply still reverts it. A
+    conditional `confirm:` asks once the bindings module can evaluate it.
+    `enableLatencySim` / `disableLatencySim` are exported by
+    `phlex/reactive/features/devtools` (the default client still exports them
+    itself). `reactive:error` gains `kind: "feature"`, whose detail carries
+    `feature`, `error` and a `phase` (one of `"load"`, `"timeout"`,
+    `"connect"`, `"detect"`); a feature that failed to load stays failed until
+    the page is reloaded.
+  - **`controller.featuresReady`** is a promise that resolves once the
+    features a root needs have connected. With the default client it is
+    always already resolved. It never rejects.
+  - A morph that adds a feature's marker to a connected, token-bearing root
+    connects the feature (and, on the split client, loads it first).
+  - The shipped builds no longer export the controller's `__…ForTest` seams
+    (they remain in the source the JS suite imports).
+  - `spec/javascript/bundle_budget.test.js` holds a ratchet on the default
+    file, the core, each feature and the split total (31,204 B).
+  - `rake bench:client` gains a `connect()` bench (2,000 roots), the one
+    place a feature module adds work to every root.
+  - Verified on Chromium (the browser suite, Puma and Falcon). Not run:
+    Firefox or WebKit; a real importmap-rails app with Propshaft digests on
+    the default entry (the docs site is one and its suite passes, but its
+    network requests were not inspected); the per-root `connect()` bench on
+    a quiet machine. A preloaded feature module (`preload: true`,
+    `modulepreload`) removes the network wait, not the window: it connects
+    in the task after `connect()`, and the first root's request gate applies
+    for that moment.
+
 - **`on_client` emits a binding record (#271).** `data-reactive-ops-param` now
   holds `{"on":…,"ops":[…], "window"?, "outside"?, "confirm"?, "confirmWhen"?}`
   instead of the bare `[[op, args]]` list, with every space written as
@@ -973,68 +1147,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   contradicted the clean-break rule. Each old name now raises a guided `NoMethodError`
   naming the real method.
 
-### Fixed
-
-- **A pending-state text swap no longer destroys a composite trigger's icon (#181).**
-  The former `disable_with:`/`loading:` text swap wrote `trigger.textContent`, which
-  **flattens every child node** — a `<button><svg/> Save</button>` lost its icon the
-  instant the request enqueued, and it never came back on restore. `busy:`'s swap now
-  reads and restores `innerHTML`, so an icon-plus-label trigger round-trips intact.
-  Covered by a new composite-trigger browser assertion and a JS child-preservation
-  unit test.
-
-- **`exclude:`/`visible_to:` now actually reach pgbus — actor-echo suppression works over SSE (#187).**
-  `broadcast_*_to`/`broadcast_*_to_each` passed `exclude:`/`visible_to:` as keyword
-  arguments to `Turbo::StreamsChannel.broadcast_*_to`, but turbo-rails swallows
-  unknown kwargs into its render locals — so on the pgbus transport the options were
-  **silently dropped** and `exclude: reactive_connection_id` never suppressed the
-  actor's own broadcast echo. They are now threaded through the thread-locals pgbus
-  reads (`Thread.current[:pgbus_broadcast_exclude]`/`_visible_to`), capability-gated
-  on `pgbus_streams?` so the Action Cable path is unchanged. Found by the new
-  end-to-end pgbus transport suite (below) — the prior unit doubles only proved the
-  option was *forwarded to the method*, never that it *reached pgbus*.
-
-### Added
-
-- **Conditional confirm — warn only when the values look suspect (#179).**
-  `confirm:` now takes a Hash for soft-validation-before-submit, so the dialog fires
-  ONLY when the field values are wrong — instead of a hand-written submit handler that
-  inspects fields and calls `confirm()` itself. Two forms, both evaluated client-side
-  over the same collected fields `reactive_compute` reads:
-  - **Declarative** — `confirm: { when: { total: 0 }, message: "Total is 0 — continue?" }`.
-    `when:` reuses `reactive_show`'s conditions language verbatim: a scalar is equals,
-    a `Range` is a threshold (`qty: 100..`), an `Array` is membership. Zero JS. The
-    dialog fires when the condition MATCHES; a clean value submits silently.
-  - **Named predicate** — `confirm: { predicate: "end_before_start", message: "…" }` for
-    multi-field logic the single-field form can't express. Register a pure function at
-    boot (`setConfirmPredicate("end_before_start", ({ starts_at, ends_at }) => ends_at < starts_at)`),
-    the twin of `setComputeReducer`. An unregistered name warns and proceeds without a
-    dialog. Works on `on(...)` AND `on_client(...)`. The predicate is soft-validation UX,
-    **not authorization** — a user can bypass it and the action still hits the endpoint's
-    real authorize/default-deny; never let it stand in for a server-side check.
-
-- **`confirm:` on `on_client(...)` — themed confirmation for zero-round-trip client ops (#178).**
-  The client-op path gains the SAME overridable `confirmResolver` gate `on(:action, confirm:)`
-  has (#52/#55). A destructive-feeling client op (clear a draft, reset a form) gets the
-  app's themed dialog with one line and no round trip:
-  `button(**on_client(:click, js.text("#draft", ""), confirm: "Discard this draft?"))`.
-  The gate lives in the user-gesture path (`runOps`), never in the shared op applier — a
-  server-pushed `reactive:js` op stream must not prompt. `setConfirmResolver` now themes
-  both paths at once.
-
-- **CI transport verification matrix — the browser suite runs on Action Cable AND pgbus (#187).**
-  The system job is now `server × transport` (Puma/Falcon × cable/pgbus). The pgbus
-  cells add a plain `postgres:18` (pgbus vendors the PGMQ schema via its own
-  migrations — no extension image) and set `TRANSPORT=pgbus`, so the existing browser
-  suite proves the reactive round trip is transport-agnostic, and new `:pgbus`-tagged
-  specs prove real cross-tab broadcast delivery + actor-echo exclusion over live
-  Postgres SSE. `rake spec:system_matrix` runs the 2×2 locally (pgbus cells skip with
-  a note when Postgres isn't reachable); `rake pgbus:prepare_test_db` sets up the DB.
-  pgbus remains an optional, non-gemspec dependency — it is now a first-class *tested*
-  transport, not a required one.
-
-### Changed
-
 - **BREAKING: ONE pending-state vocabulary — `busy:` replaces `loading:` / `disable_with:` (#181).**
   A trigger's declarative pending affordance is now a single `on(…, busy:)` kwarg
   that shares `optimistic:`'s key vocabulary and normalizer — the only difference
@@ -1053,292 +1165,599 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   | `on(:save, loading: { disable: true, class: "opacity-50", text: "Saving…" })` | `on(:save, busy: { disable: true, add_class: "opacity-50", text: "Saving…" })` |
   | `on(:search, event: "input", listnav: "[role=option]")` | `mix(on(:search, event: "input"), reactive_listnav)` |
 
-  The wire attribute is renamed `data-reactive-loading-param` → `data-reactive-busy-param`;
-  the client keeps a **read shim** for the old attribute for one minor so an
-  in-flight page rendered by the previous gem across a deploy keeps its affordance.
+  The wire attribute is renamed `data-reactive-loading-param` → `data-reactive-busy-param`;
+  the client keeps a **read shim** for the old attribute for one minor so an
+  in-flight page rendered by the previous gem across a deploy keeps its affordance.
+
+- **BREAKING: `reactive_show` speaks ONE conditions language — `if:`/`if_any:`/`unless:` (#180).**
+  The four accreted dialects (the positional-field predicate kwargs
+  `equals:`/`not:`/`in:`/`gte:`/`gt:`/`lte:`/`lt:`, the `all:`/`any:` term
+  arrays, and the `{ equals: … }` target predicate hashes) are **removed** and
+  replaced by a single Ruby-native language: a **Hash is an AND**, an **Array is
+  membership**, a **Range is a threshold**, `if_any:` is OR-of-AND (one level of
+  disjunction — the distributive-law killer), and `unless:` negates. Each removed
+  form raises a **guided `ArgumentError`** printing the exact rewrite. Migration:
+
+  | Before (removed) | After |
+  |---|---|
+  | `reactive_show(:mode, not: "off")` | `reactive_show(unless: { mode: "off" })` |
+  | `reactive_show(:gift, equals: true)` | `reactive_show(if: { gift: true })` |
+  | `reactive_show(:size, in: %w[l xl])` | `reactive_show(if: { size: %w[l xl] })` |
+  | `reactive_show(:qty, gte: 10)` | `reactive_show(if: { qty: 10.. })` |
+  | `reactive_show(:amt, gt: 5000)` | `reactive_show(unless: { amt: ..5000 })` |
+  | `reactive_show(all: [{ field: :a, equals: "x" }, …])` | `reactive_show(if: { a: "x", … })` |
+  | `reactive_show(any: [{ field: :a, equals: "x" }, …])` | `reactive_show(if_any: [{ a: "x" }, …])` |
+  | `reactive_show_targets(:m, "#id" => { equals: "x" })` | `reactive_show_targets(:m, "#id" => "x")` |
+
+  New alongside it: **`reactive_values`** computes each binding's first-paint
+  `hidden:` server-side (no per-section mirror method, no flash);
+  **`reactive_scope :form`** lets bindings use bare field symbols
+  (`[name="form[field]"]` on the client); **`disable: true`** disables a hidden
+  section's own controls so a switched-away value never submits. The wire is now
+  ONE DNF shape (`data-reactive-show='{"any":[[term,…],…]}'`); the client keeps
+  legacy read arms for one minor (deploy overlap), removed in 0.11.
+
+- **`Phlex::Reactive::ClientBindings` — a blessed client-only include (#180).** A
+  view that only shows/hides, filters, or computes client-side (no server
+  actions, no token) includes this instead of the full `Component`. It does NOT
+  pull in `Streamable` (so it never clobbers an app's own `replace`/`to_stream_*`
+  concern) or the token machinery — a token-less `reactive_root` with no `#id`
+  requirement, invisible to `phlex_reactive:doctor`. The full `Component`
+  includes it (one implementation), then layers Streamable + Identity on top.
+
+- **Automatic token refresh — `reply.with` and `reply.streams` converge (#180).**
+  The action endpoint now appends a `reactive:token` refresh stream automatically
+  whenever a reply does not re-render the component's root, instead of prepending
+  a full self-replace that could clobber a live input. Picking `.streams` vs
+  `.with` to keep the signed token fresh is no longer a correctness decision — a
+  companion-only reply refreshes the token either way.
+
+- **BREAKING: `verify_authorized` is ON by default (#168).** A reactive action
+  that completes **without any authorization call now raises**
+  `Phlex::Reactive::AuthorizationNotVerified` — **rolling back the transaction**
+  (fail-closed, stronger than Pundit's after-the-fact check). This is the
+  presence-side complement to `authorization_errors`: a forgotten `authorize!`
+  becomes a loud 500 your error tracker sees, not a silent hole. The guard
+  detects a call to any `Phlex::Reactive.authorization_methods` name
+  (default `%i[authorize! authorize allowed_to?]` — Pundit/CanCanCan/ActionPolicy)
+  **or** `mark_authorized!`, made anywhere during the action (a helper the action
+  calls counts too). **Three remedies** for each action:
+  1. call your authorization method (`authorize! @record, :update?`);
+  2. call `mark_authorized!` after a bespoke check the interceptor can't see;
+  3. declare `skip_verify_authorized` (whole component) or
+     `skip_verify_authorized :action_name` (specific actions) for an
+     intentionally public action.
+  Turn it off globally with `Phlex::Reactive.verify_authorized = false` (the
+  install-generator initializer documents the knob). The `action.phlex_reactive`
+  instrumentation event gains a new `:unverified` outcome. A new **advisory**
+  doctor check flags mutating actions with no detected authorization call
+  (heuristic — a helper may authorize indirectly; never a hard fail).
+
+### Fixed
+
+- **`reply.morph` no longer overwrites the field being typed in** (#338).
+  Turbo's stream morph runs Idiomorph without `ignoreActiveValue`, so when a
+  debounced save's render carried a different value — normalised by the
+  server (`"Hello "` saved as `"Hello"`) or stale because the user kept typing
+  during the round trip — the focused field took it, and the next keystrokes
+  landed after it (`"Helloworld"`). Present since `reply.morph` (#28), so in
+  0.13.4. The client now holds the value of a focused `<input>`/`<textarea>`
+  inside a reactive root through any morph (it cancels
+  `turbo:before-morph-attribute` for `value` on that field, which Idiomorph
+  honours for the attribute and the property) and writes the render's value as
+  the field's new default itself, so dirty tracking still re-scans against the
+  saved value. Unfocused fields, every other attribute (a root's token
+  included), and morphs outside a reactive root are untouched. A field that
+  must be rewritten while focused (a formatter) opts out with
+  `data-reactive-morph-value`.
+
+- **`reactive_scope` with a flat schema receives its fields from a real browser
+  (#337).** The client's default JSON body keeps each field's bracketed name as
+  one key (`"todo[title]"`), and the endpoint looked for the scope key (`todo`)
+  before expanding those names, so it peeled nothing and the flat schema
+  (`params: { title: :string }`) dropped every field. Only the multipart body,
+  which Rails expands itself, worked; a request spec posting a nested hash
+  passed. The endpoint now expands first and then peels, so both encodings
+  give the action the same params, and `verbose_errors` no longer reports
+  `todo[title]` as dropped. Bare params posted beside the scoped fields (a
+  trigger's `on(:save, note: "x")`, an unscoped file input) now stay next to
+  them on both encodings, where the multipart path used to drop them; an
+  explicit `on(...)` param wins over a scoped field of the same name, as it
+  does on the client. Only declared params still reach the
+  action. Present since `reactive_scope` landed in 0.11.0 (#184), through
+  0.13.4.
+
+- **A `transition:` on show/hide/toggle no longer ends when a child's
+  animation or transition does.** `runTransition` had the settle bugs #296
+  fixed in effects: a descendant's bubbling `animationend` consumed its
+  `{ once: true }` listener and stripped the `during`/`to` classes early, and
+  a CSS transition's own `transitionend` was never listened for. Only the
+  element's own end event (or the fallback) settles it now, and settling
+  removes both listeners. In a hidden tab the fallback already cleaned up (it
+  never waited on a frame), but the late frame then re-added `to` for good;
+  cleanup now cancels that frame and clears `from` too. Rapid show/hide on one
+  element no longer lets a superseded run's late cleanup strip the new run's
+  classes: a new run settles the live one first (its classes, timer,
+  listeners and frame). And the fallback is no longer a fixed 350 ms that cut
+  longer transitions short: it follows the element's computed
+  transition/animation durations (times an animation's iteration count) plus
+  delays (+50 ms), with 350 ms as the floor and a 5 s cap.
+
+- **A custom-legs exit effect no longer waits for a background tab to become
+  visible (#295).** The legs choreography awaited an animation frame before
+  any timeout was armed, so in a hidden tab (no `requestAnimationFrame`) the
+  removal, and every stream behind it, stalled. The frame wait now races the
+  1 s settle fallback.
+
+- **An effect no longer ends when a child's animation or transition does
+  (#296).** `animationend`/`transitionend` bubble, so a descendant finishing
+  first cleared the container's effect class (and released an exit's removal)
+  early; settling also left the other end listener attached. Only the
+  element's own end event settles it now, and settling removes both listeners.
+
+- **A JSON-mode nested row serializes what a real submit would carry
+  (#299).** The row object behind `reactive_nested_list(as: :json)` and the
+  per-row confirm `%{field}` interpolation now takes only the checked radio
+  of a group (it took the last in DOM order), skips a nested reactive root's
+  controls, and skips disabled controls (so `reactive_show(disable: true)`
+  keeps a hidden field out of the JSON). A radio group with nothing checked,
+  like a disabled control, now leaves its key out; a confirm `%{field}` for
+  such a key stays literal.
+
+- **A single `<select>` with no `selected` option no longer reads as dirty
+  (#297).** The browser selects its first enabled option while that option's
+  `defaultSelected` stays false; dirty tracking now compares a one-row single
+  select against its reset state (the last `selected` option, else the first
+  enabled one — an option inside a disabled `<optgroup>` is not enabled).
+- **Two dirty `warn_unsaved` roots prompt once per Turbo visit (#298).** The
+  first dirty root to see a `turbo:before-visit` asks; the others skip that
+  event, and any dirty root's decline still vetoes the visit.
+
+- **A token an outside morph brings wins over the cached one (#301).** After a
+  morph or update reply the controller kept the token it cached from that
+  reply, so a later broadcast, page refresh or dormant morph-back that morphed
+  the root in place with markup signed for another state was ignored, and the
+  next action ran against the old state. The controller now drops its cached
+  token whenever `data-reactive-token-value` changes (Stimulus'
+  `tokenValueChanged`, which also fires on a reconnect after such a change).
+
+- **A pushed deferred render stays pending until it arrives (#292).** The
+  client settled a `via="stream"` defer on any turbo-stream to its target, so
+  an unrelated update of that element before the job's broadcast released the
+  guard (and the activity count) early. Only the job's removal of
+  `reactive-defer-src-<target>` settles it now.
+
+- **A morph inside a loading lazy shell no longer restarts its load (#294).**
+  `turbo:morph-element` bubbles, so a morph of any descendant re-probed a
+  `reactive_lazy` shell and aborted its in-flight fetch for a new one. Only a
+  morph of the shell's root re-probes now.
+
+- **A `hide:`/`show:` hint no longer flips a target that was already in that
+  state (#300).** A `busy:` or `optimistic:` `hide:` aimed at an
+  already-hidden element revealed it when the request settled (or failed), and
+  a `show:` on a visible one hid it. hide/show now undo only what the hint
+  changed, like the class ops.
+
+- **Subclasses of a reactive component appear in the actions inventory
+  (#302).** A subclass inherits `Phlex::Reactive::Component` instead of
+  including it, so Streamable's `included` hook never registered it, and
+  `phlex_reactive:actions`, `phlex_reactive:find`, the MCP tools and the doctor
+  skipped it. Streamable now registers subclasses from an `inherited` hook. A
+  subclass with a constant name is listed with its inherited and own actions
+  and any inherited `skip_verify_authorized`; an anonymous subclass is still
+  left out. Subclasses also have their memoized view context reset on a Rails
+  code reload now.
+
+- **The browser suite no longer wedges under Falcon when two requests
+  overlap (#303).** Transactional system tests pin one connection that the
+  test and the server share, guarded by a lock keyed on
+  `ActiveSupport::IsolatedExecutionState` — a thread-keyed `ThreadMonitor`
+  under the default `:thread` isolation. Falcon serves each request as a fiber
+  on one thread, so the first page that made two action requests overlap (the
+  two-roots hotkey fixture) let both fibers into the pinned connection's
+  critical section: a `ThreadError` in `ConnectionPool#checkout`, after which
+  every later request blocked and CI sat on the step until the 6-hour kill.
+  The dummy app now sets `config.active_support.isolation_level = :fiber` when
+  it serves under Falcon, as Rails documents for fiber-per-request servers; a
+  spec reproduces the overlap without a browser. Apps that run Falcon need the
+  same setting (the testing page says so).
+
+- **A lazy shell connects the feature a morph asks for (#312).** A Turbo morph
+  that kept a `reactive_lazy` shell connected (a `cache:` one, or a plain one)
+  but turned it into a root needing persist, form, bindings or compute never
+  connected that feature, or imported it on the opt-in core: the root's own
+  morph listener was installed only on a root with an identity token, which a
+  shell does not carry.
+
+- **A refused fragment URL supersedes the in-flight lazy load (#293).** A morph
+  that re-showed a lazy shell with a URL the client refuses left the earlier
+  load running, and its late arrival painted over the refused shell.
+
+- **A loaded `reactive_lazy` root morphed back into its shell loads again.**
+  A plain `reactive_lazy` component only re-probed after a Turbo morph when its
+  controller had connected on the shell. Once the real content had replaced it
+  (a new element, a new controller), a page-refresh morph that re-showed the
+  shell left it pending forever. The morph handler every token-bearing root
+  already has now probes a fetch-on-connect shell too (found while wiring
+  `cache:` into the same path, #277).
+
+- **`reactive_compute` never saw a checkbox's checked state (#262).**
+  `#recompute` resolved each declared name first-wins and read `.value`, which
+  for a checkbox is a constant. Measured: a Rails `check_box` pair read `0`
+  ticked or not (the hidden companion comes first), a lone `value="1"` box read
+  `1` either way, and a box with no value attribute read `0` (`Number("on")` is
+  NaN). A radio group read its FIRST radio's value, whichever was checked. The
+  reducer ran on the toggle, from values that could not have changed.
+
+  A checkbox now contributes its checked state, coerced by the declared type:
+  `1`/`0` as a `:number` (and in the array form), `"true"`/`"false"` as a
+  `:string`, and `true`/`false` under the new **`:boolean`** type. It wins over
+  its same-named hidden companion, as it already did for `reactive_show`. A radio
+  group contributes its checked radio's value. The identity mirror and the
+  `mirror:` fallback paint the same reading.
+
+  Outputs were wrong the same way: a result whose name resolved to a checkbox
+  pair wrote `.value` on the hidden companion, changing what the UNCHECKED state
+  submits and leaving the box alone. An output now sets a checkbox's `checked`
+  from the result's truthiness (`""`, `"0"`, `"false"`, `0` and `false` untick)
+  and checks the radio of a group that carries the result.
+
+  **If a reducer relied on the old reading**, it changes: a lone checkbox with a
+  numeric `value` used to read that number regardless of state and now reads
+  `1`/`0` — write the amount in the reducer (`gift ? 25 : 0`). Apps that worked
+  around the defect by reading the box from `document` inside the reducer keep
+  working and can drop the workaround.
+
+  Cost, same machine, happy-dom (engine-relative): the 30-input calculator
+  bench goes from 16.3 to 18.4 µs/iter, allocations flat. That is one `el.type`
+  read per declared name, which is what telling a checkbox from a text field
+  takes.
+
+- **The dropped-param hints said nothing for a schema with string keys.**
+  `ParamSchema.compile` keeps keys as the author wrote them, so
+  `params: { "date" => :string }` is valid, but the #16/#21 hints only looked
+  up symbol keys. The param was still dropped and logged, just without the hint
+  that says where the schema declares it.
+
+- **A checkbox group collapsed to one boolean, and the chosen values never left
+  the browser (#258).** `#collectFields` wrote `fields[name] = field.checked` for
+  every checkbox, so several boxes sharing a `features[]` name overwrote each
+  other and the action received the LAST box's checked state — `{}` under a
+  `[:string]` schema, `"false"` under a flat `:string` one, silent either way,
+  while a native submission of the same boxes sends
+  `features[]=news&features[]=events`. A name ending in `[]` is now collected as
+  an array of the chosen values: a ticked box contributes its `value`, an
+  unticked one nothing, a `<select multiple>` its selected options. The suffix is
+  the only trigger — a group says so rather than being inferred from two controls
+  sharing a name.
+
+  **That makes the suffix a migration point.** ANY `[]`-named control now
+  contributes to an array, including a single one and including a named rich
+  editor or bare contenteditable, which the collector reads in a second pass: a
+  lone `<input type="text" name="tags[]">` used to post `"abc"` and now posts
+  `["abc"]`. An editor sharing its `[]` name with another control adds its
+  value to the group instead of standing down behind it, so the entry count
+  changes there too. Beside a radio it still stands down, because a radio keeps
+  its single value with or without the suffix. A ready but empty editor
+  contributes an empty string, the way an empty text field in the same group
+  does. An unticked box still contributes nothing. A hidden input under the
+  same name keeps contributing: nothing in the DOM tells a hidden that mirrors
+  an editor from one that is a list JS maintains, and a value posted twice is
+  visible where a swallowed one is not. Against a flat `params: { tags: :string
+  }` the array coerces to the literal `"[\"abc\"]"` — silently, with a 200. A
+  control whose name ends in `[]` has to be declared as an array type (`tags:
+  [:string]`), or renamed without the suffix if it was never meant as a list.
+
+  Three shapes keep their meaning on purpose: a lone checkbox without `[]` stays
+  the documented yes/no boolean, a radio group keeps its single checked value
+  with or without the suffix, and a hidden input sharing a name with a checkbox
+  is that box's companion. The companion is identified by the shared name, not
+  by its value, because Rails renders three of them: `check_box` emits
+  `value="0"`, `check_box(..., multiple: true)` the same under a `[]` name, and
+  `collection_check_boxes` a blank one — or none at all with
+  `unchecked_value: nil`. Reading the second shape by value collected
+  `["0","0","0","3"]` for three boxes with the third ticked.
+
+  A form body can't carry an empty array, so a cleared group used to go missing
+  whenever the client sent a form body (as soon as a file input holds a file),
+  and the action got its keyword default instead of `[]`. Now the client names
+  the cleared group in `empty_groups[]`, a field next to `token`, `act` and
+  `params`, and the endpoint sets it to `[]`. A request without that field
+  behaves as before, and a group that carries values keeps them.
 
-- **BREAKING: `reactive_show` speaks ONE conditions language — `if:`/`if_any:`/`unless:` (#180).**
-  The four accreted dialects (the positional-field predicate kwargs
-  `equals:`/`not:`/`in:`/`gte:`/`gt:`/`lte:`/`lt:`, the `all:`/`any:` term
-  arrays, and the `{ equals: … }` target predicate hashes) are **removed** and
-  replaced by a single Ruby-native language: a **Hash is an AND**, an **Array is
-  membership**, a **Range is a threshold**, `if_any:` is OR-of-AND (one level of
-  disjunction — the distributive-law killer), and `unless:` negates. Each removed
-  form raises a **guided `ArgumentError`** printing the exact rewrite. Migration:
+  It applies to params the action declares as an array, by plain name or with
+  the component's `reactive_scope` in front, and only at the top level. A group
+  declared one level down or inside nested attributes is ignored and keeps its
+  keyword default; `verbose_errors` logs it. The endpoint never takes the key it
+  writes from the request. It looks the name up in the declaration and writes
+  the declared key, so a request can't create a param the action didn't ask for.
 
-  | Before (removed) | After |
-  |---|---|
-  | `reactive_show(:mode, not: "off")` | `reactive_show(unless: { mode: "off" })` |
-  | `reactive_show(:gift, equals: true)` | `reactive_show(if: { gift: true })` |
-  | `reactive_show(:size, in: %w[l xl])` | `reactive_show(if: { size: %w[l xl] })` |
-  | `reactive_show(:qty, gte: 10)` | `reactive_show(if: { qty: 10.. })` |
-  | `reactive_show(:amt, gt: 5000)` | `reactive_show(unless: { amt: ..5000 })` |
-  | `reactive_show(all: [{ field: :a, equals: "x" }, …])` | `reactive_show(if: { a: "x", … })` |
-  | `reactive_show(any: [{ field: :a, equals: "x" }, …])` | `reactive_show(if_any: [{ a: "x" }, …])` |
-  | `reactive_show_targets(:m, "#id" => { equals: "x" })` | `reactive_show_targets(:m, "#id" => "x")` |
+  A blank entry (`params[name][]=""`) would have been the other way, but the
+  schema reads `[""]` per element type, and for a `[:file]` param behind
+  `has_many_attached` that is the difference between "not sent" and "remove the
+  attachments".
 
-  New alongside it: **`reactive_values`** computes each binding's first-paint
-  `hidden:` server-side (no per-section mirror method, no flash);
-  **`reactive_scope :form`** lets bindings use bare field symbols
-  (`[name="form[field]"]` on the client); **`disable: true`** disables a hidden
-  section's own controls so a switched-away value never submits. The wire is now
-  ONE DNF shape (`data-reactive-show='{"any":[[term,…],…]}'`); the client keeps
-  legacy read arms for one minor (deploy overlap), removed in 0.11.
+  `post_reactive_multipart` takes `empty_groups:` so a request spec can send a
+  cleared group the way the client does. `ParamSchema#array_param(name)`
+  returns the declared key for an array param, or `nil`.
 
-- **`Phlex::Reactive::ClientBindings` — a blessed client-only include (#180).** A
-  view that only shows/hides, filters, or computes client-side (no server
-  actions, no token) includes this instead of the full `Component`. It does NOT
-  pull in `Streamable` (so it never clobbers an app's own `replace`/`to_stream_*`
-  concern) or the token machinery — a token-less `reactive_root` with no `#id`
-  requirement, invisible to `phlex_reactive:doctor`. The full `Component`
-  includes it (one implementation), then layers Streamable + Identity on top.
+  `reactive_persist` drafts such a group as the list of ticked values and
+  restores exactly those boxes; before, the draft held one boolean and the
+  restore ticked every box of the group. Whether the server already rendered a
+  box ticked — in which case it keeps its say and the draft yields — is decided
+  once before the restore walks the controls, because the walk writes `checked`
+  as it goes and asking from inside it would read the restore's own work: the
+  first box it ticks would make every later box of the group look
+  server-rendered, and a draft of two values would come back as one. A
+  non-checkbox control sharing the group's name additionally threw inside the
+  draft write, which is swallowed — the root then persisted nothing at all,
+  silently. On restore, such a control keeps what the server rendered whenever
+  the group has two or more contributors: the list records the values, not
+  which control each one came from, so replaying it would paste `freeform,news`
+  into a text field, an editor, or a contenteditable. A group of ONE
+  contributor has no such ambiguity — its single entry can only have come from
+  that control — so a plain field whose name merely ends in `[]`, the usual
+  shape for a list JS maintains, keeps its draft exactly as it did before
+  groups existed. A `<select multiple>` reads a list by matching option values,
+  which is only sound when the list is its own: sharing a group with another
+  contributor, it too keeps what the server rendered, since a text value that
+  happens to equal an option would otherwise select it.
 
-- **Automatic token refresh — `reply.with` and `reply.streams` converge (#180).**
-  The action endpoint now appends a `reactive:token` refresh stream automatically
-  whenever a reply does not re-render the component's root, instead of prepending
-  a full self-replace that could clobber a live input. Picking `.streams` vs
-  `.with` to keep the signed token fresh is no longer a correctness decision — a
-  companion-only reply refreshes the token either way.
+  Drafts written before this release are not discarded, but their group key is
+  no longer applied to the controls that read a list: it holds one boolean (or,
+  in a mixed group, whichever control wrote last), and applying that kept
+  causing damage for as long as the draft lived — by default seven days after
+  the upgrade. The damage differed by control. A checkbox group came back fully
+  ticked. A `<select multiple>` sharing the group's name lost its rendered
+  selection instead, because under `restore: "always"` the select branch skips
+  the "the server had a say" check and matches `Set{"true"}` against its
+  options, where nothing matches. The next snapshot replaces the key with the
+  list. Only that one key changed meaning, which is why `PERSIST_VERSION` stays
+  where it is: bumping it would also throw away the drafted prose of every form
+  that has no checkbox group at all.
 
-- **BREAKING: `verify_authorized` is ON by default (#168).** A reactive action
-  that completes **without any authorization call now raises**
-  `Phlex::Reactive::AuthorizationNotVerified` — **rolling back the transaction**
-  (fail-closed, stronger than Pundit's after-the-fact check). This is the
-  presence-side complement to `authorization_errors`: a forgotten `authorize!`
-  becomes a loud 500 your error tracker sees, not a silent hole. The guard
-  detects a call to any `Phlex::Reactive.authorization_methods` name
-  (default `%i[authorize! authorize allowed_to?]` — Pundit/CanCanCan/ActionPolicy)
-  **or** `mark_authorized!`, made anywhere during the action (a helper the action
-  calls counts too). **Three remedies** for each action:
-  1. call your authorization method (`authorize! @record, :update?`);
-  2. call `mark_authorized!` after a bespoke check the interceptor can't see;
-  3. declare `skip_verify_authorized` (whole component) or
-     `skip_verify_authorized :action_name` (specific actions) for an
-     intentionally public action.
-  Turn it off globally with `Phlex::Reactive.verify_authorized = false` (the
-  install-generator initializer documents the knob). The `action.phlex_reactive`
-  instrumentation event gains a new `:unverified` outcome. A new **advisory**
-  doctor check flags mutating actions with no detected authorization call
-  (heuristic — a helper may authorize indirectly; never a hard fail).
+- **`reply.pending` kept its settle handle under
+  `enqueue_after_transaction_commit = true` (#254).** The handle was captured in
+  `Phlex::Reactive::Settles#serialize`, which reads a thread-local that lives
+  only for the duration of `reply.pending`'s enqueue block. Under Rails'
+  `ActiveJob::Base.enqueue_after_transaction_commit = true` (the 7.2+
+  recommended setting) `job.enqueue` is deferred to
+  `ActiveRecord.after_all_transactions_commit`, and the endpoint runs every
+  action inside a transaction — so `serialize` always ran AFTER the block had
+  exited. The job serialized with no `phlex_reactive_settle` key,
+  `reactive_settle` was a no-op, and the row sat shimmering until someone
+  reloaded. The handle is now captured when the job INSTANCE is created
+  (`perform_later` → `job_or_instantiate` → `new`), which is synchronous inside
+  the block whether or not the enqueue itself is deferred; `serialize` prefers
+  the captured handle and still falls back to the thread-local. Both the
+  `job:`/`args:` sugar (narrowing per record, so failures stay attributable) and
+  the block form are covered, and a retry re-enqueue keeps its handle. Jobs
+  enqueued outside any `reply.pending` still carry nothing.
 
-### Added
+- **`rake release` bumps the pin in every tracked lockfile (#247, #253).** Since
+  #246 the gem root's `Gemfile.lock` is committed alongside `docs/Gemfile.lock`,
+  and both pin `phlex-reactive` by local path — so a version bump that left them
+  alone shipped a stale lockfile, and the Release workflow's frozen
+  `bundle install` refused it (v0.13.0's first attempt).
 
-- **Compound & numeric `reactive_show` predicates — `all:`/`any:` and
-  `gte:`/`gt:`/`lte:`/`lt:` (#176).** Value-conditional visibility now spans
-  **more than one field** and **numeric thresholds**, staying inside the
-  eval-free "declared literal predicate" contract. `all:` / `any:` fold a list of
-  per-field terms (`{ field:, equals:/not:/in:/gte:/… }`) with one fixed
-  connective — AND vs OR over the same literal vocabulary, no expression surface;
-  one flat binding replaces wrapper-div nesting and is the only way to express OR.
-  `gte:`/`gt:`/`lte:`/`lt:` compare `Number(value)` against a literal number baked
-  into the binding (the RHS must be a real `Numeric` — a typo fails at render); a
-  non-numeric field value is `NaN` → hidden, the safe reveal-on-threshold default.
-  Numeric predicates work standalone, as a compound term, and inside a
-  `reactive_show_targets` map. Malformed terms fold **false** (fail-closed:
-  default-deny). The single-field `reactive_show(:field, equals:)` form is
-  unchanged; the additions are backwards compatible.
+  The task now bumps that pin **with a text edit**, not `bundle lock`. #247's
+  first cut used `bundle lock --local`, which is a full re-resolve — and a
+  re-resolve trips over constraints that have nothing to do with this gem:
+  `docs/Gemfile.lock` declares Linux platforms for the Kamal deploy, and
+  resolving `thruster` for those against a Mac's installed gems fails ("Could
+  not find gems matching 'thruster' valid for all resolution platforms"), which
+  aborted v0.13.1's first attempt mid-release with `version.rb` already bumped.
+  A re-resolve also silently folds unrelated dependency drift into the release
+  commit the moment a Gemfile is out of sync with its lock. The only line a
+  version bump changes is the path-gem pin, so the task edits exactly that (the
+  `PATH` spec + the `CHECKSUMS` entry) in place — deterministic on any machine,
+  no network, no installed gems, the same 2-line diff bundler produced. A
+  lockfile that names no pin at all now **aborts** the release rather than
+  reporting itself already current — and that check runs in a PREFLIGHT, before
+  the task does anything destructive or irreversible: before the `force`
+  cleanup that deletes the GitHub release and its tag, and before `version.rb`
+  or any lockfile is written. So an abort leaves the release intact and the tree
+  clean, rather than a deleted release or a half-bumped tree the clean-tree
+  guard would then block on retry.
+  pgbus's release task made the same call after the same failure.
 
-- **Installable Claude debugging skill + `rails g phlex:reactive:claude` (#168).**
-  The gem ships a `phlex-reactive-debugging` skill (the doctor → inventory → find
-  → browser `report()` → MCP workflow + a failure table) under `lib/`, and the
-  new generator copies it into a host app's `.claude/skills/` and writes the MCP
-  server entry to `.mcp.json` — only when absent (it never rewrites an existing
-  `.mcp.json`; it prints the snippet instead). A new **Debugging & tooling** docs
-  page ties the four surfaces together; the security page documents
-  `verify_authorized`; the instrumentation table gains the `:unverified` outcome;
-  the README gains a Debugging & tooling section + the config rows.
+- **`Component::Action` renamed `ActionDefinition` — it shadowed a host kit
+  component named `Action` under dev autoloading (#233).** The mixin sits in
+  every reactive component's ancestry, so its bare `Action` constant satisfied
+  Phlex::Kit's LazyLoader `const_get` check with the wrong class: the kit's
+  real `Action` component never autoloaded and the call fell through to
+  `NoMethodError` — intermittently (any unrelated load of the kit class masks
+  it until the next reload) and only under lazy autoloading, so an
+  eager-loaded test suite stays green. The rename matches its siblings
+  (`ComputeDefinition`, `OnCompleteDefinition`, `CollectionDefinition`) and
+  removes the constant entirely — **deliberately no alias**, since any
+  `Action` constant in the ancestry re-creates the shadowing. Breaking only
+  for code referencing the internal
+  `Phlex::Reactive::Component::Action` Data class directly; the `action :name`
+  DSL and `reactive_actions` registry are unchanged. A regression spec guards
+  the whole component ancestry against `:Action` coming back.
 
-- **On-demand client inspector — `phlex/reactive/inspect` (#168).** A standalone
-  JS module (the `confirm.js`/`compute.js` precedent — **zero hot-path cost**, no
-  edit to `reactive_controller.js`, loaded only when imported) that scans the live
-  DOM and maps every reactive root + bound trigger back to the server
-  `Component#action` names. From the browser console:
-  `(await import("phlex/reactive/inspect")).report()` prints a `console.table` of
-  every reactive root — its `id`, decoded token payload (component class, gid,
-  state keys, token version — try/catch base64+JSON decode, degrading to
-  `{ opaque: true }` on a Marshal-serialized payload), status attrs, triggers
-  (action + event + params + debounce/throttle/confirm), client-only ops,
-  computes, the `name`d fields the dispatch would collect, and the
-  show/filter/text binding families. Triggers are scoped to the **nearest** root,
-  so nested roots aren't double-attributed. The server↔client mapping is
-  by-name: `scan()`'s `component` + trigger `action` strings are exactly the
-  identifiers `phlex_reactive:actions` and the MCP tools list. Pinned by the
-  engine (not preloaded); pure read, never mutates the page.
+- **Multipart path corrupted/dropped fields with Rails-bracketed names (#231).**
+  `#buildFormData` wrapped every collected field/file name verbatim as
+  `params[<name>]`, so `blog_post[summary]` went out as the Rack-unparseable
+  `params[blog_post[summary]]` — the scalar arrived as `{"]" => value}` (and a
+  writer stringified that hash into the record, with a 200), and a `:file` under
+  a bracketed name (`blog_post[image]`) never reached its schema key (silent
+  drop). It only fired when a file input was populated — the JSON path expands
+  the same names server-side — which is why flat-named forms never caught it.
+  The client now bracket-expands the field **name** into wire segments
+  (`params[blog_post][summary]`, `params[blog_post][image]`, and
+  `params[photos][]` for a `multiple` picker named `photos[]`), mirroring the
+  server's `bracket_path` exactly, so a multipart body and a JSON body coerce
+  identically for the same fields. Flat names are byte-identical to before.
 
-- **Read-only diagnostic MCP server (#168).** `bin/rails phlex_reactive:mcp`
-  starts a stdio [MCP](https://modelcontextprotocol.io) server exposing five
-  read-only tools — `phlex_reactive_doctor`, `phlex_reactive_components`,
-  `phlex_reactive_actions` (optional `component:` filter), `phlex_reactive_find`
-  (fuzzy search + Prism method source), `phlex_reactive_config` (redacted) — so
-  Claude Code inside a host app can introspect the live reactive registry when
-  debugging. The `mcp` gem is **optional and lazy**: it is NOT a gemspec runtime
-  dependency; `Phlex::Reactive::MCP.load!` requires it on demand with a helpful
-  message when missing (the pgbus pattern), and the gem-dependent tool tree stays
-  out of the Zeitwerk autoloader — a host app without `mcp` boots and eager-loads
-  unaffected. Every tool is read-only and non-destructive (no arbitrary-query or
-  mutation tool) and reports names/paths/schemas only — never a token, secret, or
-  runtime state; `phlex_reactive_config` never emits the verifier or
-  `secret_key_base`. Consumer `.mcp.json`:
-  `{ "mcpServers": { "phlex-reactive": { "command": "bin/rails", "args": ["phlex_reactive:mcp"] } } }`.
-  Known constraint: stdio MCP needs a clean stdout — an initializer that `puts`
-  breaks the transport (same caveat as pgbus).
+- **Reply-rendered components now generate absolute URLs with the REQUESTING
+  host, not the process default (#232).** Actor replies (`reply.replace`,
+  `reply.streams(...)`, the implicit replace) render through the memoized
+  off-request view context, whose `url_options` were process defaults — so any
+  absolute URL helper (`image_tag` on an Active Storage attachment being the
+  everyday case) rendered the wrong host on a multi-host app: a broken image
+  after every save, healed by the next full page load. The action endpoint now
+  threads the request's protocol/host/port into the reply render (the
+  `ActiveStorage::SetCurrent` move) via a thread-local the memoized context
+  merges per call — the context is never rebuilt, so the render memoization
+  win is untouched (allocations byte-identical, throughput flat within noise).
+  The defer **pull** endpoint gets the same treatment (it is an actor request).
+  **Broadcasts are unchanged by design** — there is no request and subscribers
+  can be on different hosts, so a broadcast fired *inside* an action explicitly
+  clears the actor's url_options around its render; "URLs in broadcast-rendered
+  components must be host-relative" is now documented in the Broadcasting guide.
 
-- **verify_authorized runtime guard (#168).** New
-  `Phlex::Reactive::Authorization` (fiber-local tracking window, method
-  interception, the enforcement decision), `mark_authorized!` instance helper,
-  the `skip_verify_authorized` DSL (registry #6, inherits like the other five),
-  and `Phlex::Reactive.verify_authorized` / `authorization_methods` config
-  (`defined?`-guarded so an explicit override sticks). See the breaking note
-  above for the behavior and remedies.
+- **`rake bench` ran the removed `broadcast_replace_to` API and exited 1.**
+  `benchmark/micro/broadcast.rb` migrated to the #185 spellings
+  (`broadcast_to(*key, replace:)` / `broadcast_to(each:, replace:)`); the
+  transport double is unchanged.
 
-- **Action inventory — `Phlex::Reactive::Inspector` + rake tasks (#168).** A new
-  read-only introspection layer that answers "what reactive actions exist in this
-  app, where are they defined, and is each authorized?" without grepping.
-  `Phlex::Reactive::Inspector.components` discovers every constant-backed reactive
-  component from the loaded `Streamable` registry; `.find(query)` fuzzy-matches
-  one (exact > prefix > substring > subsequence, on both the demodulized and the
-  full name). Each action reports its declared param schema, `file:line`, the full
-  `def … end` source (extracted with **Prism**, degrading to `nil` on an
-  unreadable/unparseable file — never raising), and a **heuristic** authorization
-  status (a Prism scan for a configured authorization method or
-  `mark_authorized!` in the body — advisory only, since a helper may authorize
-  indirectly). Two shipped rake tasks surface it: `bin/rails
-  phlex_reactive:actions` (plain-text table, `FORMAT=json` for tooling) and
-  `bin/rails "phlex_reactive:find[query]"` (ranked matches; top match in detail
-  with each action's method source). Output is names/paths/schemas only — never
-  tokens, secrets, or runtime state (the instrumentation privacy contract
-  extended to tooling). `Doctor` now delegates its `constant_backed_component?`
-  filter to the Inspector so the endpoint-rebuild predicate lives in one place.
+- **`reactive_nested_remove(confirm:)` now interpolates `%{field}` on client-added
+  rows (#222).** A row added in the browser via `reactive_nested_add` is a
+  `cloneNode` of the `<template>`, and the clone path (`#renumberNestedRow` /
+  `#seedNestedRow`) never rewrote the confirm attribute — so a per-row confirm
+  froze to the template's value-less string on every added row (the exact rows
+  the primitive exists for). The client now resolves `%{field}` placeholders in
+  the confirm message from **that row's live field values** at click time (keyed
+  by the same trailing-bracket inference `as: :json` uses), so
+  `confirm: "Delete '%{name}'?"` on the template shows `Delete 'Widget'?` on the
+  added row — reflecting a later edit too (resolved on remove, not on clone). An
+  unresolved `%{key}` is left as its literal text (debuggable, never a silent
+  blank); the placeholder works in the conditional Hash's `message:` as well.
+  Server-rendered rows already interpolate server-side, so their finished strings
+  are unaffected. **Also (superset of the issue's proposal 3):** `confirmResolver`
+  now receives an optional second argument — a context object, always `{ el }`
+  (the trigger), plus `{ row, fields }` on a `reactive_nested_remove` — so a
+  themed-dialog override can build row-specific messages programmatically. The
+  arg is additive: a one-parameter resolver (and `window.confirm`) is unchanged.
 
-- **Deferred reply segments — `reply.defer` (#165).** An expensive part of a
-  reply (a cross-aggregate rollup, a report) no longer stalls the actor's
-  interaction: `reply.streams(cheap).defer(SessionTotals.new(workout:))`
-  returns the cheap streams immediately and streams the real render to the
-  SAME actor when it finishes. Keep-content default (the stale value stays
-  visible, marked `data-reactive-defer-pending` + `aria-busy` for CSS
-  shimmer); `placeholder: true` / a component swaps a skeleton in;
-  `morph: true` morphs the arrival (the mode rides INSIDE the signed token).
-  Transactional (the directive rides the post-commit reply — a rollback or a
-  denied action leaks nothing), actor-scoped (peers keep `broadcast_*_to`),
-  superseding (a newer action for the same target aborts the in-flight
-  deferred render — no stale paint), and interactive on arrival (fresh action
-  token). Delivery is transport-adaptive (`Phlex::Reactive.defer_transport`,
-  default `:auto`): a parallel fetch to the new `POST /reactive/defer`
-  endpoint everywhere (purpose-scoped, short-TTL defer token —
-  `defer_token_ttl`, default 120s; `reply.defer` tokens are **actor-bound**
-  to the requesting session so a leaked one can't be redeemed elsewhere,
-  `reactive_lazy` shell tokens are unbound by necessity — they render
-  before a session exists — with the TTL + `authorize!` as their bound;
-  never interchangeable with action tokens),
-  or a **durable pgbus one-shot stream + `DeferredRenderJob`** when pgbus's
-  reactive Streams and ActiveJob are present (`defer_job_queue` config; the
-  durable since-id replay closes the broadcast-before-subscribe race, and the
-  broadcast tears down its own subscription). The push lane's one-shot queue is
-  reclaimed by pgbus's age-based orphan-stream sweep (**pgbus ≥ 0.9.10**; run
-  the Dispatcher with `streams_orphan_threshold` set); we never eager-drop it
-  (that would reopen the delivery race). The one-shot key is sized to the live
-  pgbus `queue_prefix` budget, so a non-default prefix can't overflow it; the
-  render job broadcasts a cleanup on ANY failure so the actor's pending state
-  always resolves. Every capability gap degrades to the fetch lane — the
-  Action-Cable-or-pgbus invariant holds. **Profile first:** an app-side N+1
-  looks exactly like framework lag; defer is for segments that are genuinely
-  expensive after the synchronous path is cheap.
+- **A draft (unsaved-parent) token can now round-trip real server actions (#208).**
+  `Component::Identity` already signed a gid-less `{c, state}` token for an
+  unpersisted (or nil) record, but `from_identity` still `fetch`ed the absent
+  `gid` — the FIRST action against a draft crashed with an uncaught `KeyError`
+  (500). It now rebuilds through the record kwarg's **initialize default**
+  (e.g. `def initialize(order: Order.new, …)`), with the declared
+  `reactive_state` riding the token as before; a component whose initialize
+  REQUIRES the record kwarg raises a guided `Phlex::Reactive::Error` naming the
+  fix instead of a bare missing-keyword `ArgumentError`.
 
-- **Lazy initial mount — `reactive_lazy` (#165).** The same machinery for the
-  FIRST render (Livewire `#[Lazy]`): the page ships the component's
-  placeholder shell (`deferred_placeholder`, or a built-in pending shell) with
-  the defer token on the root; the client fetches the real content on connect
-  AND after a Turbo page-refresh morph (so a lazy component survives a
-  `turbo:reload`). `reactive_lazy tag: :tr` (etc.) ships a shell element that
-  matches a `<tr>`/`<li>` root instead of an invalid `<div>`.
-  Reactive-machinery renders (an action's self-replace, broadcasts, the defer
-  endpoint/job) stay REAL, so actions never pay two round trips.
+- **`have_reactive_value` now reads the field's `.value` property, so it can verify a
+  reducer-set disabled/computed field (#204).** The matcher (added in #201) delegated to
+  Capybara's `have_field(with:)`, which matches the value **attribute** — but a
+  `reactive_compute` reducer paints a computed output by setting its JS `.value`
+  **property** (`el.value = …`), and for a **disabled / read-only** output the attribute
+  never reflects that. So the matcher read `""` and failed on exactly the fields it was
+  built for. It now re-resolves the field by id **or name** each poll and asserts the live
+  `.value` property (via `evaluate_script`), covering enabled AND disabled/computed fields
+  while keeping the morph-immunity. `have_reactive_text` (textContent) was unaffected.
 
-- **pgbus capability gates.** `Phlex::Reactive.pgbus?` and `.pgbus_streams?`
-  (the documented broadcast-accepts-`:exclude` probe, now actually
-  implemented) plus `.defer_push_capable?` for the defer push lane.
+- **A freshly-rendered `reactive_compute` root now self-seeds its derived fields on connect (#199).**
+  Before, a compute root computed nothing until the first user `input` — a fresh render
+  (or a server validation-error re-render that replaced the body) left every derived
+  output and cross-root `mirror:` node blank until you typed. Apps worked around it by
+  dispatching a synthetic seed `input` on connect, but the compute root is a distinct
+  Stimulus controller that may connect a frame later, so the seed raced its own wiring —
+  the reported symptom being a PARTIAL apply (an early output painted; a later output
+  and the mirror stayed blank). Now `connect()` runs ONE full `recompute()` after the
+  controller is fully connected, so the whole single-pass write set (batch outputs →
+  paint text sinks + cross-root mirrors → dispatch) runs synchronously and every
+  declared output, text sink, and mirror paints from a single reducer result — no user
+  interaction, no round trip. It re-seeds on `turbo:morph-element` (the show/filter/dirty
+  precedent) and is idempotent (change-guarded writes make a re-seed a no-op, so an app
+  still dispatching a synthetic input is harmless). The seed is gated on a new
+  `data-reactive-compute-seed` marker emitted by `reactive_root(compute:)`; a non-compute
+  root pays one attribute read and never seeds. The seed passes no event, so
+  `meta.changed` is `null` — the correct "no field edited yet" semantics, so a convergent
+  reducer's default branch computes the full settled set.
 
-- **Client-side option filtering — `reactive_filter` (#163).** The other half
-  of #72's combobox: **preload the options, type to narrow — zero round
-  trips.** Spread `reactive_filter(input:, option:, group:, empty:)` onto the
-  root and the generic controller shows/hides each option on every keystroke by
-  a case-folded substring match against its `data-reactive-filter-text`
-  haystack (falling back to the option's own text) — no POST, no token, no
-  bespoke per-feature Stimulus controller. Optional `group:` collapses a header
-  whose every contained option is hidden; optional `empty:` reveals a
-  no-matches node at 0 visible. Selectors resolve within the root only (nested
-  reactive roots untouched), state seeds at connect and re-applies after a
-  morph, and blank selectors raise at render (a dead binding must fail loudly).
-  Composes with keyboard nav and per-row selection: a filtered-out option also
-  drops out of the Arrow-key path and loses its highlight, so Enter can never
-  pick an invisible row — selection itself stays a signed `on(:select)` action.
-- **Standalone combobox keyboard nav — `reactive_listnav` (#163).** The same
-  Arrow/Enter/Escape wiring `on(…, listnav:)` appends, without the dispatch
-  descriptor — for the preload-and-filter input that fires **no** action (an
-  `on()` trigger would POST per keystroke). Spread
-  `reactive_listnav("[role=option]")` onto the input; Enter still picks by
-  clicking the highlighted option's own signed trigger.
-- **Cross-root `reactive_show` targets — `reactive_show_targets` (#164).** A
-  field can now drive the visibility of declared elements **outside** its
-  reactive root — the nav tab, the panel in another tab pane, the sidebar note
-  a mode selector governs — the visibility parallel to the #159 cross-root
-  text mirror. The component that **owns** the field declares which outside
-  ids it governs, spread on the root:
-  `mix(reactive_root, reactive_show_targets(:mode, "#advanced-tab" =>
-  { equals: "advanced" }, "#basic-note" => { not: "advanced" }))`. Same
-  posture as `mirror:`: opt-in and declared, never implicit (a plain
-  `reactive_show` stays root-isolated, #15 untouched); targets are **single id
-  selectors only** — a class/compound selector raises at declare time AND is
-  warn-and-skipped by the client (two-sided default-deny); the predicate is
-  the same literal-only `reactive_show` vocabulary; the toggle is `hidden`
-  only. The field read stays **owned** — you can only drive outside visibility
-  from a field the declaring root owns. A target id not on the page is
-  silently skipped (an unrendered tab pane is normal); the cross-root pass
-  shares the owned-binding pass's field-read memo (one read per field per
-  sync). No map declared → one `getAttribute` and out. **One call per root**:
-  Phlex `mix` space-joins duplicate string data values, so a second call's
-  JSON would corrupt the attr (the client warns and ignores it) — several
-  fields go in one call via the hash form
-  (`reactive_show_targets(mode: { … }, kind: { … })`).
-- **Value-conditional visibility — `reactive_show` (#161).** The `x-show` /
-  `data-show` / `wire:show` case — show/hide an element from a form field's
-  **current value** — no longer needs a hand-written `change`-listener Stimulus
-  controller. Spread `reactive_show(:mode, not: "off")` onto the element to
-  show/hide (also `equals:` and `in: [...]`; `equals: true` reads a checkbox's
-  checked state, a radio group reads the checked radio's value) and the generic
-  controller toggles the `hidden` attribute on every `input`/`change` —
-  client-only, zero round trip, no token. The predicate is a **declared literal
-  match**, never an expression (no eval surface); exactly one predicate is
-  enforced loudly at render; a missing field or malformed wire attr is
-  warn-and-skipped (client-side default-deny). Visibility seeds at connect and
-  re-syncs after a `turbo:morph-element`; a `reactive_compute` output write
-  dispatches a real `input` event, so derived values drive visibility too.
-  Ownership follows the nested-root rules (#15). Roots without a binding pay
-  one connect-time probe — no new listeners, byte-identical wire.
+- **Scoped form fields no longer silently drop their params — the #67 footgun is fixed (#184).**
+  Under `reactive_scope`, `reactive_field(:date)` now emits the scoped wire name
+  (`name="invoice[date]"`), so the POST arrives bracketed — and the endpoint unwraps
+  exactly ONE scope level before schema matching, so a FLAT schema
+  (`params: { date: :string }`) matches. Previously a scoped field either POSTed a bare
+  name (misaligned with the `reactive_show`/`reactive_compute` resolvers, which already
+  query `[name="scope[x]"]`) or forced a hand-written bracketed name + a hand-nested
+  schema that Rails' bracket-expansion silently dropped. The client's `meta.changed`
+  resolver (`#changedComputeField`) is now scope-aware too, so a scoped compute
+  component's reducer still sees the bare declared name.
 
-- **Cross-root text mirrors + the `text` client op (#159).** A derived value can
-  now be painted into a text node **outside** the computing component's reactive
-  root — the read-only recap in another tab pane that previously forced a
-  bespoke JS listener — with the library's default-deny posture intact:
-  - `reactive_compute ..., mirror: { sum_total: "#sum_total" }` declares
-    allowlisted cross-root text mirrors. Each compute pass paints every declared
-    name into its document-wide **id** target(s) via `textContent`
-    (change-guarded, never `innerHTML`, never blanks a name the pass produced no
-    value for). The value comes from the reducer result, a just-written output's
-    field, or a declared input's identity value — so it works with no reducer at
-    all. Non-id selectors raise at declare time AND are warn-and-skipped by the
-    client interpreter (two-sided default-deny). No `mirror:` → the wire is
-    byte-identical to before.
-  - `js.text(to, value, global: false)` — a new op that sets `textContent`
-    (stringified; `nil` clears), available to `on_client`, `reply.js`, and
-    `broadcast_js_to`. Strictly less powerful than `set_attr`; pair with
-    `global: true` for the cross-root paint.
-  - `global: true` is now honored on the `reactive:js` stream path: a single op
-    can opt out of the reply's target-root scope to document-wide resolution
-    (previously it was silently ignored when a `target` was set).
+- **`reactive_compute` output order no longer silently corrupts values (#183).**
+  Each output write used to dispatch an `input` event **mid-loop**, re-entering the
+  reducer synchronously from a **half-written DOM** — so a wrong `outputs:` order
+  could commit wrong values (a real money-corruption class), settling only if the
+  reducer was convergent in exactly the declared order. The client now runs the
+  reducer **once** from one pre-write input snapshot, writes all changed outputs as
+  a **batch**, paints text/mirror sinks from the settled values, then dispatches the
+  `input` events — each self-marked so the root skips re-running its own reducer
+  while other listeners (chained repaint, dirty tracking, `reactive_show`, sibling
+  roots) still fire. Declared output order is no longer semantics. Covered by a JS
+  order-independence test (declare outputs in the historically-wrong order — values
+  stay correct) and a self-re-entry-suppression test.
+
+- **A pending-state text swap no longer destroys a composite trigger's icon (#181).**
+  The former `disable_with:`/`loading:` text swap wrote `trigger.textContent`, which
+  **flattens every child node** — a `<button><svg/> Save</button>` lost its icon the
+  instant the request enqueued, and it never came back on restore. `busy:`'s swap now
+  reads and restores `innerHTML`, so an icon-plus-label trigger round-trips intact.
+  Covered by a new composite-trigger browser assertion and a JS child-preservation
+  unit test.
+
+- **`exclude:`/`visible_to:` now actually reach pgbus — actor-echo suppression works over SSE (#187).**
+  `broadcast_*_to`/`broadcast_*_to_each` passed `exclude:`/`visible_to:` as keyword
+  arguments to `Turbo::StreamsChannel.broadcast_*_to`, but turbo-rails swallows
+  unknown kwargs into its render locals — so on the pgbus transport the options were
+  **silently dropped** and `exclude: reactive_connection_id` never suppressed the
+  actor's own broadcast echo. They are now threaded through the thread-locals pgbus
+  reads (`Thread.current[:pgbus_broadcast_exclude]`/`_visible_to`), capability-gated
+  on `pgbus_streams?` so the Action Cable path is unchanged. Found by the new
+  end-to-end pgbus transport suite (below) — the prior unit doubles only proved the
+  option was *forwarded to the method*, never that it *reached pgbus*.
 
 ### Performance
 
+- **A deferred fragment renders as soon as it is read (#336).** The defer lane
+  (a `reply.defer` fetch, a `reactive_lazy` load, a `cache:` fragment) handed
+  its reply to `Turbo.renderStreamMessage`, and Turbo applies each
+  `<turbo-stream>` one animation frame after its `turbo:before-stream-render`.
+  The lane now catches those events and, once every listener has run, calls
+  the final `event.detail.render` itself, in order, in the same task; Turbo's
+  frame-later call gets a no-op. The event is still Turbo's own, so
+  `preventDefault()` cancels a stream and a wrapped `detail.render` (effects,
+  dismissing flashes) still runs. A Turbo that dispatches later renders on its
+  own, as before. A warm `reactive_lazy(on:, cache:)` open in headless
+  Chromium: median time from the trigger to the rows in the DOM 5.9 → 0.8 ms
+  (stream event to rows 5.2 → 0.2 ms). Action replies and broadcasts keep
+  Turbo's timing. On the opt-in client, a stream held for a module on its way
+  wraps a copy of the event's render instead of writing it back, so Turbo's
+  later call stays the no-op. The default bundle grows 128 B gzip
+  (25,429 → 25,557 B), the defer module 129 B (2,845 → 2,974 B), the split
+  core 21 B (13,323 → 13,344 B).
+
+- **The default client is 1,008 B smaller gzipped (#310).**
+  `reactive_controller.min.js` goes from 25,933 B to 24,925 B. The feature
+  modules keep their per-root state in closures instead of records whose
+  property names the minifier cannot rename (form, bindings, persist, defer;
+  compute's record gets short names), and hints, devtools and bindings drop
+  their per-call context records and wrapper exports. The features are also
+  laid out in the bundle so gzip's 32 KB window reaches the runtime code they
+  repeat (about 450 B of the total). The split client total goes from
+  32,568 B to 32,027 B; the core is unchanged. Behaviour is unchanged. The
+  22,700 B target is not met: 2,225 B remain, about 800 B of them from bulk
+  selection (#319), which landed after the target was set.
+- **A cacheable lazy shell is less than half the size (#306).** A
+  `reactive_lazy(on:, cache:)` shell with `reactive_cache_viewer` and
+  `reactive_cache_version` gzips to about 290 B (was about 580–670 B). The
+  fragment id is the identity encoded once plus a 128-bit MAC (it was the
+  verifier's token wrapped in a second Base64); `u` is 22 base64url characters
+  and `v` 11. A `cache:` shell no longer carries the identity token: a fragment
+  URL the client refuses falls back to a GET of the same id under the fragment
+  path it knows (`cache: "no-store"`), not to the `__materialize` POST, and a
+  failed defer module is reported by its `reactive:error` (`kind: "feature"`)
+  without a POST. Ids minted before this change still verify; their old `u`
+  no longer matches, so such a URL renders but is `no-store`. The
+  deferred-rendering page now says when deferring pays off.
+
 - The defer machinery adds nothing measurable to the existing hot paths
   (same-machine, same-checkout before/after vs `main`): `to_stream_replace`
   14.4k → 14.2k i/s (within ±3.7% noise), identity token 199.9k → 196.7k i/s
@@ -2947,7 +3366,8 @@ room for dogfood fixes.
   scaffolds a reactive component (and an RSpec spec when the app uses RSpec),
   state-backed by default or record-backed with `--record`.
 
-[Unreleased]: https://github.com/mhenrixon/phlex-reactive/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/mhenrixon/phlex-reactive/compare/v0.14.0...HEAD
+[0.14.0]: https://github.com/mhenrixon/phlex-reactive/compare/v0.9.0...v0.14.0
 [0.9.0]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.6...v0.9.0
 [0.2.6]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.5...v0.2.6
 [0.2.5]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.4...v0.2.5