@ai-matrx/records-ui 0.70.0 → 0.75.0

package/CHANGELOG.md

@@ -1,5 +1,119 @@
 # Changelog — @ai-matrx/records-ui
 
+## 0.75.0
+
+**0.74.0 was tagged and never reached npm** — its release gate failed on
+`view-deep-link.test.tsx`, which still asserted the switcher offered five views on the
+day the archive made it six. The contract test was corrected on main; these are the
+same contents, released under the next number because a version number that reached
+the registry can never be reused and one that did not should not be argued about.
+
+**An archived record has a way back, on every table.** (lane FIX-10A-ARCHIVE, from VERIFIER-10 finding F4.)
+
+* Archiving was a **one-way door**. The grid's row action soft-deleted correctly — `deleted_at`
+  stamped, `version` bumped, nothing removed — and then, in the verifier's words, *"it is gone for
+  good as far as any screen is concerned… The door is there; nothing reaches it."* The store's
+  `custom.record_restore` had existed the whole time.
+* **`ArchivedView` is the sixth way of looking at one table**, a `PageView` like the board and the
+  dashboards: pressed from the same row of buttons, named by the same `?view=` parameter, and
+  therefore inherited by **every** Table in every organization the moment this file exists. It is
+  one primitive over the whole store, never a per-table screen.
+* It obeys the archived-items law in full: the default still hides archived rows, revealing them is
+  one click **on the surface itself**, the two lanes (**mine** and the organization's) are a control
+  rather than a guess, and each row says **who archived it and when** — read from
+  `history.row_versions`' own SOFT_DELETE actor, so nothing was backfilled and nothing is invented.
+* Absent or honest, never dead: Restore is not drawn at all for somebody who may not write, with
+  the store's own sentence in its place; a read the store refuses is a sentence rather than an empty
+  list; and an empty list **names its lane**, so "nothing here" can never be read as "nothing was
+  ever archived" while the other lane holds twenty records.
+* **Consumer action:** none, but it needs `custom.read_records_archived` on the database — applied
+  and granted to `authenticated` on 2026-09-22.
+
+**A signature's verdict is read through the door that can answer it.** (lane FIX-10B, from VERIFIER-10 finding F6.)
+
+* `SignBlock` asked `doc_signature_intact` once per signature to find out whether each seal still
+  held. That function is the internal half of the pair — SECURITY INVOKER over a doors-only table —
+  so from a browser every one of those calls answered `permission denied for table doc_signature`,
+  and the screen printed a refusal exactly where the verdict belongs. Measured live on 2026-09-22
+  against a signature that had just been written successfully: the e-sign half of Documents could
+  write a seal it could never verify out loud.
+* It now asks `client.docSignatureRead`, the definer door, which answers the seal and the verdict
+  together. Proven live: *"intact: the record still says exactly what Ama Osei signed on 22
+  September 2026."*
+* **Consumer action:** none. Needs `@ai-matrx/records` ≥ 0.51.0.
+
+## 0.73.0
+
+**"Signature" is on the Add-field menu, so the e-sign half of Documents can be reached.** (lane FIX-10B-F6, from VERIFIER-10 finding F6.)
+
+* The Documents section told a person, under a rendered document, that their table needed
+  "a signature column — a text column whose format is signature", and section 1 — this
+  package's `FieldEditor` — offered Name, what it holds, required, multi, dated,
+  sensitivity, context policy and a validation check. **No format control and no signature
+  choice.** The precondition the product stated could not be met from any screen.
+* **The menu is the store's list now.** `PickableFieldType` was a union assembled here — the
+  parity floor plus two words this file knew about — and that union WAS the defect: a kind
+  the store took and the menu omitted was invisible, with no error and no red test.
+  `FIELD_TYPE_CHOICES` is now checked against `DECLARABLE_FIELD_KINDS` (generated from
+  `custom.field_kinds()`), and `kindsWithNoChoice()` is the guard: the suite fails the day
+  the store learns a kind nobody put on the menu. Proven failing-then-passing on 2026-09-22
+  — it named `signature` before the choice was written.
+* **`save()` gained the arm every future kind arrives through.** It had exactly two branches,
+  relation and plain, and everything else was sent as `parity_type` — so a menu entry that is
+  not one of the fourteen would have been refused "There is no field type called signature".
+  A kind that is neither parity nor plain nor a relation now goes as its WORD, which is what
+  `custom._field_document_for` resolves.
+* **And an existing signature column opens as one.** `editorKindFor` answers which EDITOR to
+  draw and correctly says "text" for it; the panel asks which KIND somebody picked, so it
+  reads the format the store wrote. Without that, opening the column would have said "Text"
+  and saving it would have quietly retyped the column out from under the seal it holds.
+* Known gap, stated rather than hidden: the grid and the record form still draw a signature
+  column as an ordinary text box, because `fieldKindFor` classifies it as text. Typing there
+  is not how a signature is made — `custom.doc_sign` is — and nothing is sealed by it, but
+  the box is not yet honest about that.
+* Consumer action: none required.
+
+## 0.72.0
+
+**The board stopped saying it held the whole table over four rows of forty-two.** (lane DRILL.)
+
+* Seen on Rincon Plumbing Co's own board the moment 0.70.0 let a dashboard number narrow
+  it: the column read "Scheduled 4", every card under it was real, and the line above them
+  read *"This view has no Rule, so it holds the whole table."* That sentence was written
+  when a view had exactly two possible answers — a Rule, or everything. A question from
+  the address is a third, and it now has its own words: *"These are only the records
+  behind the number you clicked — the store narrowed them, not this screen."*
+* Found by looking at the screenshot of the thing that had just been proved working, which
+  is the only way this class is ever found: every assertion in the drill proof passed.
+
+## 0.71.0
+
+**A public form no longer takes the page down when it asks for a choice, a linked record or a
+person.** (lane FIX-10A, from VERIFIER-10 finding F1.)
+
+An agent built and published a job-request form for a plumbing company in forty seconds and
+handed over its link. Opened by a signed-out stranger — the only person that link is for — it
+answered **HTTP 500**, on production, with `useRecordsClient was called outside
+<RecordsProvider>` in the console.
+
+The public arm of `FormRunner` is deliberately the arm that mounts **no store client**: the
+server resolved the Fields through `custom.form_public`, and the browser on that page holds no
+key, knows no organization and may not read a row. `useOptionalRecordsClient` exists in
+`@ai-matrx/records` for exactly that screen. But three of the editors `FieldControl` can draw
+asked for the client with `useRecordsClient`, which throws by design — so **any** public form
+carrying a drop-down, a relation or a person question died, whatever it was about.
+
+* **`OptionControl`, `RelationPicker` and `PersonPicker` now take the optional client** and,
+  with none mounted, are **absent and honest** instead of fatal. A choice question takes the
+  answer as text and says why the list cannot be read on a page answered without an account; a
+  relation question says it cannot be answered here and to leave it blank; a person question
+  already had that sentence and now reaches it instead of throwing above it.
+* **The guard** — `src/a-public-form-needs-no-store-client.test.tsx` — walks `FIELD_KINDS`, the
+  store's own closed list of the nineteen kinds a Field can be, and renders the public arm with
+  a question of every one of them and no provider of any sort above it. Red on the bytes before
+  this release (4 of 19), green on these. A twentieth kind whose editor reaches for the store
+  turns it red the day it is added, not the day a stranger opens a link.
+
 ## 0.70.0
 
 **The bar that said four now opens four.** (lane DRILL.)