plutonium 0.60.0 → 0.60.1

data/docs/reference/configuration.md

@@ -35,7 +35,7 @@ Loads the baseline defaults for a given framework version. Call this first; late
 | `development` | `ENV["PLUTONIUM_DEV"]` | Development mode for the framework itself (local assets, hot reload, verbose errors). Query with `config.development?`. You rarely set this in an app — see [Development mode](#development-mode). |
 | `cache_discovery` | `true` outside `development` env | Cache resource/route discovery. Disable to pick up new resources without a reboot. |
 | `enable_hotreload` | `true` in `development` env | Hot-reload Plutonium components on change. |
-| `shell` | `:modern` | Chrome style: `:modern` (topbar + icon rail) or `:classic` (legacy header + sidebar, only for upgrades). See [Layouts](./ui/layouts). |
+| `shell` | `:modern` | Chrome style: `:modern` (topbar + icon rail), `:plain` (topbar, no icon rail), or `:classic` (legacy header + sidebar, only for upgrades). See [Layouts](./ui/layouts). |
 | `navii_host_url` | `"https://api.navii.dev"` | Host of the [Navii](https://navii.dev) avatar service used by [`Avatar`](./ui/components#avatar). The component appends `/avatar/:seed`. Repoint to self-host or proxy. |
 | `assets.logo` | `"plutonium.png"` | Brand logo asset. See [Assets](./ui/assets). |
 | `assets.favicon` | `"plutonium.ico"` | Favicon asset. |

data/docs/reference/resource/definition.md

@@ -562,9 +562,9 @@ class ArticleDefinition < ResourceDefinition
 end
 ```
 
-### Referencing an unknown field raises
+### Fields not in the permitted set are skipped
 
-A `section` that lists a field key that is not a known attribute of the model raises `ArgumentError` at render time — this catches typos early.
+A `section` only renders the fields that are actually in the form's permitted set for the current request. A key it lists that isn't there — a typo, or a field excluded by policy, per-action `permitted_attributes`, entity scoping, or nesting — is **silently dropped**, never an error. This lets a single `form_layout` reference conditionally-permitted fields without crashing the form in the contexts where they're filtered out.
 
 ### On interactions
 

data/docs/reference/ui/layouts.md

@@ -1,12 +1,13 @@
 # Layouts
 
-The overall page chrome — topbar, sidebar, footer, body wrapping. Plutonium ships two shells; you can eject the templates or write a custom `ResourceLayout` for total control.
+The overall page chrome — topbar, sidebar, footer, body wrapping. Plutonium ships three shells; you can eject the templates or write a custom `ResourceLayout` for total control.
 
 ## Shell
 
 ```ruby
 Plutonium.configure do |config|
   config.shell = :modern     # default — topbar + icon rail
+  # config.shell = :plain    # topbar, no icon rail (rail-less app)
   # config.shell = :classic  # legacy header + sidebar (only when upgrading)
 end
 ```
@@ -15,6 +16,41 @@ end
 If you're starting fresh, use `:modern`. `:classic` exists so apps upgrading from pre-`:modern` versions can preserve their chrome while migrating.
 :::
 
+## Shell variants & the icon rail
+
+`config.shell` selects the chrome for the whole app:
+
+- `:modern` (default) — Topbar plus the desktop icon rail.
+- `:plain` — Topbar but **no** icon rail. The Topbar is kept; only the rail is removed, so the whole app is rail-less.
+- `:classic` — legacy Header/Sidebar (upgrade paths only).
+
+### Per-controller / per-portal override
+
+Any Plutonium resource controller exposes a class-level `rail` DSL that overrides the shell default. It's a `class_attribute`, so it's inherited: a portal opts its entire surface in or out by calling `rail false` (or `rail true`) once in its controller concern.
+
+```ruby
+module CustomerPortal
+  module Concerns
+    module Controller
+      extend ActiveSupport::Concern
+      included { rail false }  # entire portal rail-less
+    end
+  end
+end
+```
+
+`rail nil` (the default) inherits the shell default — the rail shows when `config.shell == :modern`. Read the resolved value with the `rail?` predicate.
+
+### Stable CSS hooks
+
+Rail-less rendering exposes a few stable hooks for custom overrides:
+
+- `pu-topbar` — class on the Topbar nav.
+- `pu-sticky-footer` — class on the form sticky-footer div.
+- `html.pu-no-rail` — root class present whenever the current page is rail-less.
+
+A built-in rule cancels the desktop rail inset on `.pu-topbar` and `.pu-sticky-footer` under `html.pu-no-rail`; target these hooks to layer your own CSS.
+
 ## Eject the chrome for per-portal customization
 
 ```bash

data/docs/superpowers/plans/2026-06-14-form-sectioning.md

@@ -290,7 +290,7 @@ git commit -m "feat(forms): add form_layout/section/ungrouped DSL registry"
 
 ### Task 2: Resolve a field list into ordered sections
 
-**Goal:** Add `resolve_form_sections(resource_fields)` to `FormLayout` — assign permitted fields to sections (in declared order), collect leftovers into `ungrouped` (default **last**, else at its declared position), raise on unknown field keys, and keep empty sections (no hiding). _(Amended: default was "first" — see Amendments at the end.)_
+**Goal:** Add `resolve_form_sections(resource_fields)` to `FormLayout` — assign permitted fields to sections (in declared order), collect leftovers into `ungrouped` (default **last**, else at its declared position), skip section keys not in the permitted set, and keep empty sections (no hiding). _(Amended: default was "first", and unknown keys originally raised — see Amendments at the end.)_
 
 **Files:**
 - Modify: `lib/plutonium/definition/form_layout.rb` (add instance method `resolve_form_sections`)
@@ -302,7 +302,7 @@ git commit -m "feat(forms): add form_layout/section/ungrouped DSL registry"
 - [ ] `ungrouped` collects all unclaimed permitted fields, in `resource_fields` order.
 - [ ] Without an `ungrouped` macro, leftovers render in a heading-less section placed **last** (appended after all declared sections). _(Amended — was "first".)_
 - [ ] With an `ungrouped` macro, leftovers render at the macro's declared position with its options.
-- [ ] A section referencing a field absent from `resource_fields` *and* not a known attribute raises `ArgumentError`; a field merely filtered by policy is silently dropped (it's still "known" — see note).
+- [ ] A section referencing a field not in `resource_fields` (a typo, or a field filtered by policy/scoping/per-action) is **silently skipped**, not raised. _(Amended — originally raised `ArgumentError`.)_
 - [ ] Empty sections are returned (not hidden).
 
 > **Known-vs-permitted note:** `resolve_form_sections` only sees the policy-filtered `resource_fields`. To distinguish "typo" from "filtered out", it raises only when the field is not present in `resource_fields` AND the caller passes it as not-an-attribute. For unit purposes we treat any field not in `resource_fields` as unknown → raises. The form passes the *full* attribute set check at render via existing machinery; here we validate against `resource_fields`. Keep it strict: unknown key → raise.
@@ -898,6 +898,15 @@ steps/snippets are left as-built; these supersede them where they conflict.
   render — visibility + option evaluation in one pass — and `render_form_section`
   is pure presentation. Example: `collapsed: -> { object.persisted? }`.
 
+- **Unknown / filtered section keys skipped, not raised** (`form_layout.rb`,
+  `resolve_form_sections`). A key not in the form's permitted set
+  (`submittable_attributes_for(action)`) is dropped silently. The original raise
+  crashed forms whenever a layout referenced a field excluded by per-action
+  `permitted_attributes`, entity scoping, nesting, or per-user policy — the
+  resolver only ever saw the filtered list, so it couldn't tell a typo from a
+  legitimately-filtered field. Test renamed
+  `test_unknown_field_raises` → `test_field_not_in_permitted_set_is_skipped_not_raised`.
+
 - **Interactions exercised** — `ReconfigureKitchenSink` (record action on
   `KitchenSink`) + `test/integration/admin_portal/form_layout_interaction_test.rb`
   cover form_layout (incl. a dynamic `collapsed:`) in an interaction form, where