phlex-reactive 0.15.5 → 0.16.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb2e7841a38e3400b1777833cde2f16a73794b54c29f9e0ceb1a2b02c358263d
-  data.tar.gz: 8023c8ab7f9bb88833282c33c99a7797f565fb491795cf9b0c7566d0040653ef
+  metadata.gz: 860b397593c4d0a2d05d2485345bfc78564e784942c8413db1b67fbbacea6b41
+  data.tar.gz: '059b1148284859d6a69afdd4f62693f4dbedb0eab41370af843e30a4f3d27e4f'
 SHA512:
-  metadata.gz: 5257d059749e070f6b7e369e89c06fbca8b5c6b0cb9d6663b7983081a9af5a7831ba7f4d46b01da97d04a49f5fe727b6d760351f449d140e4ccffb2881cfd7c3
-  data.tar.gz: 0e29f1ca596e632855b89c9dacf2b1e0e4b6fc0db3f836f662d61c8349c0fbda0f11ebb706fe165acfcfb4ed9fbcd4d630154db8f25c023b8d7ce547dbaf9cab
+  metadata.gz: 0500ccbf1d82ea1039cf078dbe62e67efd6da9c9a2ecbeaace46d7d316f4a6c62ef479ea8b1a81e263ad1f738c25d9aa64f0dc53fc7af7a1bbadd6dab49e5021
+  data.tar.gz: eae4009ae39fba74bc6219c4b90df31589bed31ed70a457c7f240075ffd50b84662a39af475d878bc339d2e538611e248a287e11a5bbdacd52cb47d1bf73d45e

data/CHANGELOG.md

@@ -8,6 +8,183 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
+- **Draggable regions: move and resize a box, or move a point, inside a
+  frame, with the result in fields (#416).** `reactive_frame` marks the
+  coordinate space, `reactive_box(fields:, value:, aspect:, min:, action:,
+  busy:, messages:)` a box in it, `reactive_box_handle(edge)` an edge or corner
+  to resize from, and `reactive_point(fields:, value:, within:, …)` a point,
+  inside the frame or inside a box. The helpers render the position as
+  percentages from `value:`, so the first paint needs no JavaScript and a
+  re-render with new values moves the box. The box moves and resizes with a
+  mouse, a pen, a finger or the keyboard (arrows 1%, Shift 10%, Alt resizes,
+  Escape puts it back, each step announced in the words of `messages:`). It
+  stays inside the frame and never goes below `min:`. `aspect:` locks the
+  ratio (a Numeric, or a field such as a row of preset radios, which re-fits
+  the box when it changes). The fields hold fractions rounded to 4 decimals,
+  with `input` as the box moves (at most once per field a frame) and one
+  `change` on release. `action:` is sent once per release through the root's
+  pipeline, with `x`, `y`, `width`, `height`. Without it the binding is
+  client-only and works on a `ClientBindings` root. A morph that lands
+  mid-drag does not interrupt it. The helpers check their arguments' keys,
+  types and ranges at render (an undeclared action under `verbose_errors`).
+  Client: a new `drag` feature module (3,576 B gzipped): +2,789 B in the
+  default bundle, +51 B in the split core, which loads it only on a page with
+  a frame, a box or a point. Docs: a "Draggable regions" guide with a live demo.
+
+- **Fields that feed CSS custom properties: `reactive_css_vars` (#417).** A
+  preview that follows a control (a slider that brightens an image, a select
+  that rotates it) needed app JavaScript or a request per input event.
+  `reactive_css_vars(to: "#sample", vars: { "--light" => "light",
+  "--turn" => { field: "turn", unit: "deg" } })` reads each field as
+  `reactive_show` does (a checkbox gives `1` or `0`, a radio group its checked
+  value), parses it as a finite number and writes `number + unit` on every
+  `to:` element with `style.setProperty`, on connect, on `input`/`change` and
+  after a morph, with no request. Anything that is not a number removes the
+  property, so the `var()` fallback applies: no text from a field reaches CSS.
+  Units come from a fixed list (`""`, `px`, `%`, `deg`, `turn`, `ms`, `s`,
+  `em`, `rem`, `fr`) and names match `--[a-zA-Z0-9-]+`, checked at render and in
+  the browser. `to:` resolves like a client op's (`:root`, inside the root,
+  `global: true`, an Array). It goes on the root or on any element inside it,
+  and works on a `ClientBindings` view. Client: +460 B gzipped in the default
+  bundle; +462 B in `features/bindings` and +16 B in the split core.
+  Docs: "Live CSS properties" on the client-ops page, with a demo.
+
+### Fixed
+
+- **A reply that refuses the posted values keeps the held marks (#413).**
+  Every reply to a root's own request released the fields a morph held
+  (#370), so after an action refused a save the user's next keystroke posted
+  no held names and went through over the other change. Return
+  `reply.morph.refused` (every mark) or `reply.morph.refused("title")` (only
+  those fields) and the client keeps the marks: the root's next action names
+  them in `reactive_held_fields` again, until the action stores the field or
+  the user takes the other value. The endpoint sends it as the
+  `X-Reactive-Refused` response header; the reply stays a 200, with no error
+  marker and no `reactive:error`. `run_reactive(…).refused?` and
+  `response.refused?` / `response.refused_fields` assert it in a unit test.
+  Client: +65 B gzipped in the default bundle, +60 B in the split core.
+  Docs: "Knowing what was held" on the architecture page, the `reply` table
+  in the README.
+
+## [0.16.0] - 2026-10-16
+
+### Upgrading from 0.15.x
+
+- **The configuration is finalized automatically at boot (#364).** Nothing to
+  call: the engine runs `Phlex::Reactive.finalize!` once the app has booted,
+  after every initializer and every `after_initialize` block the app
+  registered. From then on every setting reads back as a frozen copy, and the
+  param-type and named-schema registries are closed (registering into either
+  after boot already raised). Booting the gem without the engine, call
+  `Phlex::Reactive.finalize!` at the end of your own boot.
+
+- **The configuration's lists are frozen once the app has booted (#364).**
+  Append to `authorization_errors` in an initializer or an `after_initialize`
+  block, as before; after boot, assign a new list (`<<` raises `FrozenError`).
+  `around_action`, `on_action_error` and `register_token_upgrader` now replace
+  a frozen list instead of appending to it; `around_actions`,
+  `on_action_error_hooks` and `token_upgraders` are frozen, and
+  `authorization_methods`' default is a frozen list. A setting reads back
+  frozen too: change it by assigning, never in place.
+
+- **Nothing an app configures makes boot raise (#364).** A value no Ractor can
+  share is kept as it is and works on the main Ractor only: a block written in
+  an initializer (`around_action`, `on_action_error`, `param_type`), a lambda
+  that closes over app state, a logger, an APM object, the verifier. An app
+  booting without a `secret_key_base` (a production rake task or build step)
+  keeps the verifier lazy, as before: the first token raises, not boot.
+
+### Added
+
+- **`Phlex::Reactive.finalize!`, `finalized?` and a test-only
+  `reset_finalization!` (#364).** `finalize!` freezes the param-type and
+  named-schema registries and stores every setting as a deep-frozen,
+  Ractor-shareable copy (the objects an app handed in are never frozen), so a
+  non-main Ractor can read the configuration. The engine calls it at boot (see
+  Upgrading). Writers keep working afterwards, and what they write is shared
+  too.
+
+- **`Phlex::Reactive.renderer` takes a name (#364).** `renderer =
+  "ApplicationController"`, like `base_controller_name`, resolves on every read,
+  so a class Zeitwerk reloaded in development is picked up (and the per-thread
+  view contexts rebuild for it). A class keeps working, and keeps rendering the
+  class object it was given. The README and the install template show the name.
+
+- **`phlex_reactive:doctor` reports Ractor readiness (#364).** An advisory line
+  (never a failure): eager loading on, the configuration finalized, and each
+  setting `finalize!` shares that still holds a value a non-main Ractor cannot
+  read, with its class (the verifier, never shareable, is left out).
+
+- **RBS signatures (#364).** `sig/` covers the configuration and token surface
+  of `Phlex::Reactive`, a component's class-level DSL, Streamable (its instance
+  methods and its class methods), `Response`, `ParamSchema`, `Store` and
+  `Shareable`, and ships with the gem. Lint runs `rbs -I sig validate`; a spec
+  fails when a public method has no signature.
+
+- **Concurrency conformance (#364).** conformance-kit 0.4's gates run in CI:
+  every `rubocop-thread_safety` cop, with no directory excludes (`NewThread`
+  is excluded only from the five spec files that start threads on purpose),
+  thread and Async contention examples over rendering, tokens, params and
+  broadcasts, a
+  Ruby 4.0 Ractor canary (param coercion, Stream wrapping, `Streamable#dom_id`,
+  configuration reads and token upgrades run in a non-main Ractor; rendering and
+  signing are pending on Phlex and ActiveSupport), and `conformance-audit
+  --strict`. A report-only kino smoke serves the dummy app in Ractor mode and
+  records the first blocker. Docs: a new "Concurrency & Ractors" guide page.
+
+### Changed
+
+- **No reader writes on first use (#364).** Every setting starts at its default
+  when the gem loads (the param-type registry is seeded then too; the verifier,
+  which needs `Rails.application`, is built by `finalize!` at boot when it can
+  be). With eager loading the engine also prepends `verify_authorized`'s
+  interceptor to every component and resolves every component's registries and
+  render memos at boot (a `ClientBindings`-only view's too), so a request
+  writes no class.
+
+- **Per-Ractor state instead of `Concurrent::Map` and lock constants (#364).**
+  The fragment viewer warnings, the CSRF-name patterns, the once-per-process
+  config warnings, the APM adapter memo, the Streamable class registry, the
+  pending-markup variants and the registry's write lock live in
+  `Phlex::Reactive::Store` (`Ractor.store_if_absent`, with a Mutex-guarded
+  table on an engine without Ractors). `lib/` and `app/` no longer reference
+  `concurrent-ruby`, which was never a declared dependency.
+
+### Fixed
+
+- **Eager loading the gem raised `NoMethodError: undefined method 'to_json'`
+  in a process that had not loaded json yet (#364).** `Component::Sortable`
+  calls `Hash#to_json` while it loads; it now requires json itself.
+
+- **`verify_authorized` could prepend two interceptors to one class (#364).**
+  The lazy, request-path `Authorization.instrument!` checked and prepended
+  without a lock; two threads first-calling it for one class both prepended.
+  It now holds a lock across the check and the prepend.
+
+## [0.15.5] - 2026-10-15
+
+### Fixed
+
+- **A server trigger inside a client-only root reaches the component around it
+  (#410).** A `ClientBindings` component (a `reactive_filter` list, a
+  `reactive_show` wrapper, an `on_client` menu) renders a root with no token.
+  Rendered inside a server component, it swallowed that component's `on(...)`
+  triggers: Stimulus sends the action to the nearest root, which had no token,
+  and the outer root's field collection skipped every control under it (the
+  #15 rule). A tokenless client-only root is now transparent to server round
+  trips: `dispatch` forwards to the nearest token-bearing root above (skipping
+  further client-only roots, waking a dormant one), and that root's action
+  collects the controls under nested client-only roots. A nested server
+  component keeps its own fields and triggers, and client bindings stay on
+  their own root. With no token-bearing root above, nothing is sent, and
+  `verbose_errors`/debug logs one warning. Lazy and deferred shells are not
+  client-only. Client: +414 B gzipped in the default bundle, +415 B in the
+  split core.
+
+## [0.15.4] - 2026-10-14
+
+### Added
+
 - **A server deadline counted down on the client — `reactive_countdown(until:, format: :ms, waiting:, done:)` (#400).**
   `span(**reactive_countdown(until: deadline.iso8601, waiting: "#wait", done: "#done")) { "2:00" }`
   puts the deadline on the element; the client paints the time left from
@@ -176,6 +353,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   anything else raises at render. Client: +27 B gzipped in the default
   bundle, +20 B in the persist module; the split core unchanged.
 
+## [0.15.3] - 2026-10-13
+
+### Added
+
 - **An image fallback that recovers — `reactive_image_fallback(hide: true, show_alt: nil)` (#383).**
   `img(**reactive_image_fallback)` marks an `<img>` whose `src` fails with
   `data-reactive-image-state="error"` and hides it; `show_alt: "#bank-name"`
@@ -196,6 +377,91 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   +550 B in the split core. Docs: "An image that falls back, and recovers" on
   the client-ops example.
 
+### Fixed
+
+- **`reactive_media` waits for `take` characters before calling a key a miss
+  (#380).** A value shorter than `take:` sliced to a short key, missed the
+  pool and wrote `blank_label` while the user was still typing. It is now
+  *pending*: `blank_label` only names a full-length key that misses. New
+  options: `match:` (a Regexp, anchored to the whole key; a key it rejects is
+  pending too) and `pending: :clear` (default: clear the preview, empty the
+  label) or `:keep` (leave both alone). The preview carries
+  `data-reactive-media-state="pending|hit|miss"`, so a row can hide itself
+  with CSS. `match:` reaches the browser as a JS pattern: its `\A`/`\z`
+  anchors are dropped (a trailing `\Z` becomes `\n?`), and what JS reads
+  differently raises at render (options, escapes such as `\h`/`\p{…}`/`\s`/
+  `\u{…}`, POSIX and nested classes, `&&`, `(?i)`/`(?>…)`, characters above
+  U+FFFF). **Behaviour change:** with `take:`, a short value now leaves the
+  label empty instead of writing `blank_label`. Without `take:` or `match:`
+  nothing changes. Client: +160 B gzipped in the default bundle (+152 B on
+  top of #381/#382), +152 B in the bindings module, the split core unchanged. Docs: "Media
+  previews" on the client-ops example.
+
+- **A pool `<img>` with an `alt` and no `src` keeps its name (#381).**
+  `js.copy_media` and `reactive_media` treated a source `<img>` without `src`
+  as a clear: the preview's `alt` was emptied and `label:` got `blank_label`,
+  so a known entry with no logo file lost its name. Such a source is now a hit
+  without an image: the target's `src` and `srcset` are removed, its `alt` is
+  set, and `label:` gets that `alt`. Only a pool miss, a selector that matches
+  nothing, or a source that is not an `<img>` clears. Client: +1 B gzipped in
+  the default bundle, −2 B in the split core; the bindings module is
+  unchanged.
+
+- **`js.preview_file` follows an app's upload validation (#382).** A preview
+  ran once, on `change`, so a file the app then rejected (cleared with
+  `input.value = ""`, no new `change`) stayed on screen. Two pieces fix it.
+  `js.preview_file(…, valid: true)` treats an input whose `validity.valid` is
+  false (`setCustomValidity`, `required`) as empty: it never gets a preview,
+  and one it had is cleared and its URL revoked. And `reactive:file-changed`
+  is the documented event for "the app changed this input's files without a
+  `change` event": bind the op to it as well,
+  `mix(on_client(:change, op), on_client("reactive:file-changed", op))`, and
+  the app dispatches it after it clears or invalidates the field. That works
+  whichever `change` listener runs first. Without `valid:` the op behaves as
+  before. Client: +22 B gzipped in the default bundle, +34 B in the split
+  core (on top of #381). Docs: "Preview a chosen image" on the client-ops example.
+
+### Performance
+
+- **Guarded and persisted forms connect in linear time.** Each `warn_unsaved`
+  root added its own `beforeunload` / `turbo:before-visit` pair on `window`,
+  and each persisted root its own `turbo:submit-end` listener on `document`.
+  A browser scans a target's listeners on every add and remove, so connecting
+  and disconnecting N of them was quadratic. One shared listener per window or
+  document now serves them all, added with the first root and removed with
+  the last; behaviour is unchanged (live dirty count, one prompt per visit,
+  #298). Headless Chromium, insert + connect: 4,000 guarded roots ~306 ->
+  ~227 ms, 4,000 persisted roots ~280 -> ~230 ms. +194 B gzipped in the
+  default bundle (110 B for the guard, 84 B for persist).
+- **A record-backed token no longer builds a GlobalID URI.** For a record
+  whose `to_gid` is GlobalID's own and whose id is an Integer, the gid is
+  built directly as `gid://<app>/<Class>/<id>` (byte-identical, pinned by
+  `identity_gid_spec.rb`); anything else still calls `to_gid`. The token goes
+  from ~11.4 µs and 54 objects to ~5.2 µs and 20 (in-place A/B).
+- **`rake bench:browser`.** Connect, disconnect and a heap soak for the
+  shipped client in headless Chromium. The happy-dom connect bench is
+  engine-relative and missed the quadratic above; this is the one to trust.
+- **The doctor's authorization check is linear, not quadratic.** It rebuilt
+  the Inspector's whole component list (a Prism scan per action) once for
+  every component. It now reads it once: `doctor.checks` over the dummy app's
+  90 components drops from 1,337 ms to 55 ms, and an app with a few hundred
+  components no longer waits tens of seconds on `rake phlex_reactive:doctor`.
+- **`on()` checks for removed keywords without building arrays.** Every
+  trigger ran `params.keys & REMOVED_ON_KWARGS.keys`. It now returns at once
+  when there are no extra keywords. `on(:increment)` allocates 5 objects
+  instead of 8; a 7-trigger component's `render_component` 118 instead of 136
+  (~5% faster in an in-place A/B, a method-level win that shows on broadcast
+  fan-out, not request latency).
+- **The request bench measures production, not a file watcher.** The dummy
+  app's test env left code reloading on, so every request globbed `app/`:
+  `rake bench:request` read ~1.7-2.0 ms and 1,272 objects per state-backed
+  action, against ~0.30-0.35 ms and 824 objects with it off (same machine,
+  interleaved). Test-env only; the gem is unchanged.
+
+## [0.15.2] - 2026-10-13
+
+### Added
+
 - **Media previews — `js.copy_media` and `reactive_media` (#373).**
   `js.copy_media("#logo", from: "#logo-007")` copies `src`, `srcset` and `alt`
   from an `<img>` the server rendered onto a preview `<img>`; the URL is read
@@ -285,6 +551,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   Client: +251 B gzipped in the default bundle, +247 B in the split core.
   Docs: "Keeping client state through a morph" on the client-ops example.
 
+## [0.15.1] - 2026-10-12
+
+### Added
+
 - **Modal dialogs — `js.show_modal` / `js.close_dialog` and
   `data-reactive-modal` (#365).** `js.show_modal("#picker")` calls
   `HTMLDialogElement#showModal()`, so an `on_client` dialog gets the browser's
@@ -310,6 +580,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   every other key alone (+134 B gzipped). `once:` raises on these keys. Existing
   chords render unchanged.
 
+## [0.15.0] - 2026-10-12
+
+### Added
+
 - **Presence — `reactive_presence`, `presence`, `js.presence` (#358).** A
   roster component declares the presence stream it shows
   (`reactive_presence :viewers, state: { selected: :integer }, ttl: 45`) and
@@ -353,6 +627,40 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   true` without `shortcut:` behaves exactly as before (never prevented, no
   editable guard).
 
+### Fixed
+
+- **A stream that renders into a connected root wires what its content needs
+  (#356).** A root read its feature markers only at connect and after a morph
+  of itself, so a `reactive_show` target, select-all/count group, filter,
+  nested list, dirty field or paste trigger that an `append`, `prepend`,
+  `update`, `before`, `after` or child `replace` brought into it stayed dead
+  until the root reconnected. Now, once such a stream has rendered, the root
+  re-runs the seeds of the features it has (a new show target takes the
+  field's current value) and connects any feature its new content needs, in
+  both clients; bindings and form also wire a binding whose gate reads true
+  only then. As after a morph, this covers a root with an action token or a
+  lazy shell; a tokenless, client-only root does not re-read. On the split
+  client the stream's render waits for the module the content needs, as it
+  already did for an incoming root, so the content lands wired; the wait is
+  capped at 1 s, after which Turbo renders and the root connects the module
+  when it arrives. A draft
+  restore no longer marks fields `data-reactive-dirty` on a root that never
+  opted into dirty tracking (one that only gates a paste trigger).
+
+- **An editable is editable in an engine without `contenteditable="plaintext-only"`,
+  however it reaches the page (#355).** Such an engine reads the server's
+  `plaintext-only` as invalid, so the element cannot even be focused. The
+  bindings feature switched it to `"true"` only when it connected, or after a
+  morph of the root, which left an editable that a stream appended, a frame
+  loaded or an unfocused morph rewrote uneditable. The runtime now does the
+  switch with one observer, installed only in such an engine (elsewhere the
+  probe is all that runs). Bundle: default +157 B gzip, split core +241 B,
+  `features/bindings` -138 B.
+
+## [0.14.4] - 2026-10-11
+
+### Added
+
 - **Sortable lists — `reactive_sortable`, `reactive_sortable_source`,
   `reactive_sortable_item` (#350).** Rows drag to reorder a list with a mouse,
   a finger (a 200 ms press) or the keyboard (Space picks up, arrows move,
@@ -390,104 +698,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   client the stream that brings it starts the import). Bundle: default
   +977 B gzip, split core +412 B, `features/bindings` +524 B.
 
-- **`on_client(…, detail: { success: true })` — run ops only when the event's
-  payload qualifies (#346).** A binding can require top-level `event.detail`
-  keys to strictly equal JSON scalars, so `on_client("turbo:submit-end",
-  js.check_group("ids[]", false), detail: { success: true })` clears a bulk
-  selection after a successful submit and keeps it after a failed one. A
-  missing detail or key never matches; a miss runs no confirm and no
-  `preventDefault`. Each binding record carries its own filter, so two bindings
-  on one element can split success and failure. A non-scalar value, an empty
-  Hash, or `detail:` with `once:` raises at render. Records without `detail`
-  are byte-identical.
+## [0.14.3] - 2026-10-07
 
 ### Fixed
 
-- **A server trigger inside a client-only root reaches the component around it
-  (#410).** A `ClientBindings` component (a `reactive_filter` list, a
-  `reactive_show` wrapper, an `on_client` menu) renders a root with no token.
-  Rendered inside a server component, it swallowed that component's `on(...)`
-  triggers: Stimulus sends the action to the nearest root, which had no token,
-  and the outer root's field collection skipped every control under it (the
-  #15 rule). A tokenless client-only root is now transparent to server round
-  trips: `dispatch` forwards to the nearest token-bearing root above (skipping
-  further client-only roots, waking a dormant one), and that root's action
-  collects the controls under nested client-only roots. A nested server
-  component keeps its own fields and triggers, and client bindings stay on
-  their own root. With no token-bearing root above, nothing is sent, and
-  `verbose_errors`/debug logs one warning. Lazy and deferred shells are not
-  client-only. Client: +414 B gzipped in the default bundle, +415 B in the
-  split core.
-
-- **`reactive_media` waits for `take` characters before calling a key a miss
-  (#380).** A value shorter than `take:` sliced to a short key, missed the
-  pool and wrote `blank_label` while the user was still typing. It is now
-  *pending*: `blank_label` only names a full-length key that misses. New
-  options: `match:` (a Regexp, anchored to the whole key; a key it rejects is
-  pending too) and `pending: :clear` (default: clear the preview, empty the
-  label) or `:keep` (leave both alone). The preview carries
-  `data-reactive-media-state="pending|hit|miss"`, so a row can hide itself
-  with CSS. `match:` reaches the browser as a JS pattern: its `\A`/`\z`
-  anchors are dropped (a trailing `\Z` becomes `\n?`), and what JS reads
-  differently raises at render (options, escapes such as `\h`/`\p{…}`/`\s`/
-  `\u{…}`, POSIX and nested classes, `&&`, `(?i)`/`(?>…)`, characters above
-  U+FFFF). **Behaviour change:** with `take:`, a short value now leaves the
-  label empty instead of writing `blank_label`. Without `take:` or `match:`
-  nothing changes. Client: +160 B gzipped in the default bundle (+152 B on
-  top of #381/#382), +152 B in the bindings module, the split core unchanged. Docs: "Media
-  previews" on the client-ops example.
-
-- **A pool `<img>` with an `alt` and no `src` keeps its name (#381).**
-  `js.copy_media` and `reactive_media` treated a source `<img>` without `src`
-  as a clear: the preview's `alt` was emptied and `label:` got `blank_label`,
-  so a known entry with no logo file lost its name. Such a source is now a hit
-  without an image: the target's `src` and `srcset` are removed, its `alt` is
-  set, and `label:` gets that `alt`. Only a pool miss, a selector that matches
-  nothing, or a source that is not an `<img>` clears. Client: +1 B gzipped in
-  the default bundle, −2 B in the split core; the bindings module is
-  unchanged.
-
-- **`js.preview_file` follows an app's upload validation (#382).** A preview
-  ran once, on `change`, so a file the app then rejected (cleared with
-  `input.value = ""`, no new `change`) stayed on screen. Two pieces fix it.
-  `js.preview_file(…, valid: true)` treats an input whose `validity.valid` is
-  false (`setCustomValidity`, `required`) as empty: it never gets a preview,
-  and one it had is cleared and its URL revoked. And `reactive:file-changed`
-  is the documented event for "the app changed this input's files without a
-  `change` event": bind the op to it as well,
-  `mix(on_client(:change, op), on_client("reactive:file-changed", op))`, and
-  the app dispatches it after it clears or invalidates the field. That works
-  whichever `change` listener runs first. Without `valid:` the op behaves as
-  before. Client: +22 B gzipped in the default bundle, +34 B in the split
-  core (on top of #381). Docs: "Preview a chosen image" on the client-ops example.
-
-- **A stream that renders into a connected root wires what its content needs
-  (#356).** A root read its feature markers only at connect and after a morph
-  of itself, so a `reactive_show` target, select-all/count group, filter,
-  nested list, dirty field or paste trigger that an `append`, `prepend`,
-  `update`, `before`, `after` or child `replace` brought into it stayed dead
-  until the root reconnected. Now, once such a stream has rendered, the root
-  re-runs the seeds of the features it has (a new show target takes the
-  field's current value) and connects any feature its new content needs, in
-  both clients; bindings and form also wire a binding whose gate reads true
-  only then. As after a morph, this covers a root with an action token or a
-  lazy shell; a tokenless, client-only root does not re-read. On the split
-  client the stream's render waits for the module the content needs, as it
-  already did for an incoming root, so the content lands wired; the wait is
-  capped at 1 s, after which Turbo renders and the root connects the module
-  when it arrives. A draft
-  restore no longer marks fields `data-reactive-dirty` on a root that never
-  opted into dirty tracking (one that only gates a paste trigger).
-- **An editable is editable in an engine without `contenteditable="plaintext-only"`,
-  however it reaches the page (#355).** Such an engine reads the server's
-  `plaintext-only` as invalid, so the element cannot even be focused. The
-  bindings feature switched it to `"true"` only when it connected, or after a
-  morph of the root, which left an editable that a stream appended, a frame
-  loaded or an unfocused morph rewrote uneditable. The runtime now does the
-  switch with one observer, installed only in such an engine (elsewhere the
-  probe is all that runs). Bundle: default +157 B gzip, split core +241 B,
-  `features/bindings` -138 B.
-
 - **A `checked:`-only `reactive_show_targets` entry hides at zero boxes
   (#348).** `"#bulk-bar" => { if: { "ids[]" => { checked: 1.. } } }` was left
   visible once the owning root held no box of the group (the last ticked row
@@ -497,42 +711,20 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   first paint already were. A target with any value term keeps the skip when
   none of its fields is owned.
 
-### Performance
+## [0.14.2] - 2026-10-07
 
-- **Guarded and persisted forms connect in linear time.** Each `warn_unsaved`
-  root added its own `beforeunload` / `turbo:before-visit` pair on `window`,
-  and each persisted root its own `turbo:submit-end` listener on `document`.
-  A browser scans a target's listeners on every add and remove, so connecting
-  and disconnecting N of them was quadratic. One shared listener per window or
-  document now serves them all, added with the first root and removed with
-  the last; behaviour is unchanged (live dirty count, one prompt per visit,
-  #298). Headless Chromium, insert + connect: 4,000 guarded roots ~306 ->
-  ~227 ms, 4,000 persisted roots ~280 -> ~230 ms. +194 B gzipped in the
-  default bundle (110 B for the guard, 84 B for persist).
-- **A record-backed token no longer builds a GlobalID URI.** For a record
-  whose `to_gid` is GlobalID's own and whose id is an Integer, the gid is
-  built directly as `gid://<app>/<Class>/<id>` (byte-identical, pinned by
-  `identity_gid_spec.rb`); anything else still calls `to_gid`. The token goes
-  from ~11.4 µs and 54 objects to ~5.2 µs and 20 (in-place A/B).
-- **`rake bench:browser`.** Connect, disconnect and a heap soak for the
-  shipped client in headless Chromium. The happy-dom connect bench is
-  engine-relative and missed the quadratic above; this is the one to trust.
-- **The doctor's authorization check is linear, not quadratic.** It rebuilt
-  the Inspector's whole component list (a Prism scan per action) once for
-  every component. It now reads it once: `doctor.checks` over the dummy app's
-  90 components drops from 1,337 ms to 55 ms, and an app with a few hundred
-  components no longer waits tens of seconds on `rake phlex_reactive:doctor`.
-- **`on()` checks for removed keywords without building arrays.** Every
-  trigger ran `params.keys & REMOVED_ON_KWARGS.keys`. It now returns at once
-  when there are no extra keywords. `on(:increment)` allocates 5 objects
-  instead of 8; a 7-trigger component's `render_component` 118 instead of 136
-  (~5% faster in an in-place A/B, a method-level win that shows on broadcast
-  fan-out, not request latency).
-- **The request bench measures production, not a file watcher.** The dummy
-  app's test env left code reloading on, so every request globbed `app/`:
-  `rake bench:request` read ~1.7-2.0 ms and 1,272 objects per state-backed
-  action, against ~0.30-0.35 ms and 824 objects with it off (same machine,
-  interleaved). Test-env only; the gem is unchanged.
+### Added
+
+- **`on_client(…, detail: { success: true })` — run ops only when the event's
+  payload qualifies (#346).** A binding can require top-level `event.detail`
+  keys to strictly equal JSON scalars, so `on_client("turbo:submit-end",
+  js.check_group("ids[]", false), detail: { success: true })` clears a bulk
+  selection after a successful submit and keeps it after a failed one. A
+  missing detail or key never matches; a miss runs no confirm and no
+  `preventDefault`. Each binding record carries its own filter, so two bindings
+  on one element can split success and failure. A non-scalar value, an empty
+  Hash, or `detail:` with `once:` raises at render. Records without `detail`
+  are byte-identical.
 
 ## [0.14.1] - 2026-10-07
 
@@ -564,7 +756,7 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [0.14.0] - 2026-10-07
 
-This section also covers 0.10.0 through 0.13.4, which were released without
+This section also covers 0.9.1 through 0.13.4, which were released without
 changelog sections of their own.
 
 ### Added
@@ -2324,7 +2516,7 @@ changelog sections of their own.
   (`spec/requests/deferred_latency_spec.rb`) pins that a 120 ms segment cost
   moves OFF the actor's reply and onto the deferred leg; it never disappears.
 
-## [0.9.0] - 2026-07-03
+## [0.9.0] - 2026-07-04
 
 Consolidates everything since 0.2.6; tags 0.2.7–0.4.8 shipped without changelog
 sections, so this section spans the whole run to 0.9.0. The jump from 0.4.8 to
@@ -3760,7 +3952,7 @@ room for dogfood fixes.
   Outer flat fields and per-row reactive editing compose cleanly, with no
   name-disjointness workarounds.
 
-## [0.2.6]
+## [0.2.6] - 2026-06-25
 
 ### Added
 
@@ -3787,7 +3979,7 @@ room for dogfood fixes.
   for non-remove/redirect responses, and never double-prepends when the action
   already included a self-targeted stream.
 
-## [0.2.5]
+## [0.2.5] - 2026-06-25
 
 ### Fixed
 
@@ -3803,7 +3995,7 @@ room for dogfood fixes.
   bun unit test (`spec/javascript/reactive_controller.test.js`) that asserts the
   synchronous call and fails on the pre-fix deferred code. Closes #11.
 
-## [0.2.4] - 2026-06-24
+## [0.2.4] - 2026-06-25
 
 ### Fixed
 
@@ -3821,6 +4013,12 @@ room for dogfood fixes.
   byte-identical to source by a guard spec, so the browser tests never validate
   stale client code again. Closes #8.
 
+### Documentation
+
+- Documented the combined record + state identity (the `{c, gid, s}` token
+  shape): the README, `docs/architecture.md`, and `docs/security.md` no longer
+  frame `reactive_record` and `reactive_state` as mutually exclusive. (#9)
+
 ## [0.2.3] - 2026-06-24
 
 ### Fixed
@@ -3840,12 +4038,6 @@ room for dogfood fixes.
   round trip (only a genuinely absent value falls back to the `initialize`
   default). No API changes. Closes #6.
 
-### Documentation
-
-- Documented the combined record + state identity (the `{c, gid, s}` token
-  shape): the README, `docs/architecture.md`, and `docs/security.md` no longer
-  frame `reactive_record` and `reactive_state` as mutually exclusive. (#9)
-
 ## [0.2.2] - 2026-06-24
 
 ### Fixed
@@ -3922,7 +4114,17 @@ room for dogfood fixes.
   scaffolds a reactive component (and an RSpec spec when the app uses RSpec),
   state-backed by default or record-backed with `--record`.
 
-[Unreleased]: https://github.com/mhenrixon/phlex-reactive/compare/v0.14.1...HEAD
+[Unreleased]: https://github.com/mhenrixon/phlex-reactive/compare/v0.16.0...HEAD
+[0.16.0]: https://github.com/mhenrixon/phlex-reactive/compare/v0.15.5...v0.16.0
+[0.15.5]: https://github.com/mhenrixon/phlex-reactive/compare/v0.15.4...v0.15.5
+[0.15.4]: https://github.com/mhenrixon/phlex-reactive/compare/v0.15.3...v0.15.4
+[0.15.3]: https://github.com/mhenrixon/phlex-reactive/compare/v0.15.2...v0.15.3
+[0.15.2]: https://github.com/mhenrixon/phlex-reactive/compare/v0.15.1...v0.15.2
+[0.15.1]: https://github.com/mhenrixon/phlex-reactive/compare/v0.15.0...v0.15.1
+[0.15.0]: https://github.com/mhenrixon/phlex-reactive/compare/v0.14.4...v0.15.0
+[0.14.4]: https://github.com/mhenrixon/phlex-reactive/compare/v0.14.3...v0.14.4
+[0.14.3]: https://github.com/mhenrixon/phlex-reactive/compare/v0.14.2...v0.14.3
+[0.14.2]: https://github.com/mhenrixon/phlex-reactive/compare/v0.14.1...v0.14.2
 [0.14.1]: https://github.com/mhenrixon/phlex-reactive/compare/v0.14.0...v0.14.1
 [0.14.0]: https://github.com/mhenrixon/phlex-reactive/compare/v0.9.0...v0.14.0
 [0.9.0]: https://github.com/mhenrixon/phlex-reactive/compare/v0.2.6...v0.9.0