@ai-matrx/records-ui 0.9.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,275 @@
 # Changelog — @ai-matrx/records-ui
 
+## 0.16.0
+
+**The grid never draws a row before it knows what the person may do.** My own
+regression from 0.12.0's refresh fix, bisected rather than guessed: treating the
+whole first load as "the rows have arrived" let the grid render while the
+table's own read was still in flight, and `useTableRights` answers `NO_RIGHTS`
+(`known: false`) then — so every cell came out as plain text with no editor and
+a click on it did nothing and said nothing. The declaration, the columns and the
+person's own level are answered ONCE per table, so they are a FIRST LOAD; only
+the page re-read is a refresh, and it still never blanks rows somebody is
+already typing in.
+
+**A publish gate that can be believed.** This package had not published since
+0.10.3 while five versions piled up, because `pnpm test` ran the whole live
+component suite against a database several lanes' harnesses share behind one
+advisory lock — each run failed a different handful of timing clauses with no
+overlap. `pnpm test` is now a DETERMINISTIC component suite (the real components
+against recorded real-door answers at this package's own `RecordsDataSource`
+seam, no network, and a call the fixture never saw throws by name) plus a SHORT
+live smoke (declare a table, take a column, write, read back, page, delete).
+Typecheck and both suites run in 27 seconds. The full live suite is
+`pnpm test:live` and runs in its own workflow on the tag and on a schedule,
+reporting red loudly and blocking nothing. Nothing was deleted or loosened.
+
+**And the two suites that could not run on a lane's own port** —
+`system-table-shape` and `walk` pinned 127.0.0.1:3005 — now read
+`RECORDS_UI_DEMO_PORT`.
+
+### Consumer action
+
+None. No API changed. `pnpm test:record` re-records the door fixture.
+
+## 0.15.0
+
+**`ActionInbox` reads the STORE's queue, and the package-owned one is gone.**
+SCR-11 shipped with its own `records_ui_action` Table: agents wrote rows into it
+and it rendered them beautifully. It was a second source of truth. An approval a
+person filed through the store, and the wait the server's own `field_propose`
+produces under `ask`, appeared nowhere in it — which is exactly the thing
+PRODUCTS.md row 6 says the product must not be ("One inbox holds human approvals
+AND the agent's field and table proposals — the same queue, the same right to
+approve").
+
+It now reads `custom.work_inbox` and decides through `custom.work_approval_decide`,
+which APPLIES the change in the same transaction as the decision, as the person
+who approved, through the store's own doors.
+
+* **Keyboard-first**, because Linear's inbox is the bar: `j`/`k` or the arrows
+  move, `a` approves, `d` declines, `o` opens, `r` refreshes. The selected row
+  scrolls into view and the header states the keys.
+* **Level-aware, absent rather than dead.** The door answers `actionable` — which
+  is `custom.work_approval_may_decide` asked per row — so a row this person may
+  not decide renders with NO buttons and says what it is waiting for, instead of
+  a greyed-out Approve that fails when clicked. The person who ASKED for a change
+  is refused the answer to their own request, by the store, and the row says so.
+* The store's own outcome sentence is shown verbatim ("Rate card is now a column
+  on this table"); this component never rewrites it.
+
+**Consumer action — BREAKING for anybody who seeded the old queue.**
+`ACTION_TABLE`, `actionDocument`, `QueuedAction`, `QueuedActionSpec` and the
+`seed` prop are removed. Nothing seeds an inbox any more: a person or an agent
+files a real request through `custom.work_approval_request`
+(`client.workApprovalRequest(...)`) and it appears. `ActionInbox` keeps
+`tableId`, `includeSettled`, `onOpenRecord` and `className`. Requires
+`@ai-matrx/records` 0.10.0.
+
+## 0.12.0
+
+**Everything 0.11.0 carried — the level-aware screens and the one refusal
+formatter below — is in this release. 0.11.0 was tagged and never published: its
+gate failed, and two of the four failures were real defects rather than stale
+copy. They are what this version fixes.**
+
+**A read the person did not ask for no longer takes the cell they are typing in
+off the screen.** `Grid` handed `MatrxDataTable` an `isLoading` that went true on
+every `reload()`, and a cell write reloads the page — while `isLoading` the data
+table renders six SKELETON rows IN PLACE OF the real ones, so committing one cell
+unmounted every cell on the page, the open editor included. In a browser that
+costs the caret and any keystroke inside the window; in the live suite one column
+of a tabbed row saved as nothing, a different one each run, which is what made it
+look like the store rather than the screen. A refresh is now `isFetching` — the
+data table's own refresh line, with the rows kept — and `isLoading` means only
+what it says: there is nothing to show yet.
+
+**Enter finishes a long-text cell, and Shift+Enter makes the newline.** It used
+to be the other way round, with Ctrl/Cmd+Enter to save, printed in 10px under the
+box: the key every grid in the world binds did nothing in the columns whose
+values are longest. Airtable is the bar. A json cell takes its newline the same
+way — it was not counted as multi-line at all, so Enter could not save it either.
+
+**One version read per record, and a version only ever goes up.** Opening a cell
+asked the store for the record's version, and tabbing on asked again before
+either answer was back; the write between them stored the store's new version,
+and whichever read landed last put the old one back. The next cell of that row
+then carried a version the store had already moved past, and a person tabbing
+through their own row was shown a conflict with themselves.
+
+**A borrowed value and a total can be built over a Person or a File again.**
+`ValueOnTheOtherSide` offers the columns the relation's target Table DECLARES —
+and a Person column points at the person kernel, which has 441 records and zero
+Field rows, so it offered nothing and said the table had no columns. The store
+reads the far side as `custom.record_values(…) -> pick`, so a pick names a key
+those records CARRY: when the target declares no Fields, the panel reads one of
+its records through the ordinary read door and offers the keys it has.
+
+### Consumer action
+
+None beyond 0.11.0's (below): no API changed. Requires `@ai-matrx/records`
+>= 0.7.0 for `custom.my_levels`.
+
+## 0.11.0 — tagged, never published
+
+**The screens never invite an action the ladder will refuse.** The 19–20
+September verdict (sixth pass), measured against Airtable, Notion and Linear:
+"None of these three products lets you start an action it already knows it will
+reject."
+
+**Every control follows the level the STORE answers.** The rights question was a
+port with two honest answers and no third — nothing offered, or
+`storeDecidesRights`: yes to everything for every non-kernel table, for
+everybody, and let the door refuse afterwards. That second one is what every
+person in the product met, and it is the defect written down. `useTableRights`
+now asks `custom.my_levels` (a table is a record), `useRecordRights` asks for one
+record, and `useRowRights` asks for a whole page in ONE call — and only when the
+table's own level does not already admit editing, because a record shared at
+Editor inside a table held at Viewer is exactly what the verdict found and the
+grid labelled that row "viewer" while the store let its holder write to it.
+
+`src/rights.ts` is the ONE place a level becomes a screen: six capabilities —
+read, comment, write, remove, share, structure — each keyed to the rung the DOOR
+itself asks for. Every `false` carries the sentence that says why, naming the
+level it would take and who can give it: *"You are Viewer here, and it takes
+Editor to change anything here. Ask somebody who is Admin on it to move you up."*
+Absent AND explained. A cell a person may not write is plain text that says so
+on hover; Tab walks PAST a row they may not write rather than opening an editor
+in it; Delete is absent on those rows; Share is absent below Admin; the field
+panel and the table settings say what changing the shape of a table takes.
+
+**One formatter, and every refusal goes through it.** `src/plainWords.ts`;
+`Refusal.tsx` renders what it returns and NOTHING else — no `error.message`, no
+`error.hint`, no SQLSTATE where a person reads. Filtering the hint was not
+enough, structurally: the store builds its access refusals with `format()` from
+THE DOOR'S OWN NAME, so the machine identity is inside the sentence written for
+the person ("You do not have access to this record, so `custom.record_update`
+may not write to it"). The formatter drops the machine clause by SHAPE, keeps
+the store's own words where they are a person's words, and ADDS A REMEDY keyed
+off the refusal code — a refusal with nothing to do about it is a dead end with
+an explanation. What it drops is kept for an engineer on the notice and in a
+screen-reader-only line. Nine screens that had captured `error.message` into
+their own state now go through it too.
+
+**A borrowed value and a total no longer ask for an internal key.** "The value
+to read" was a free-text box with the placeholder `name`; the relation already
+says which Table it points at, so both now offer that Table's columns BY NAME.
+
+**All sixteen column types open their own editor.** Four editor states that drew
+a paragraph rather than a box — a choice list loading, a choice list whose Table
+is empty, a multi-choice row, a worked-out column — carried no cell id, so the
+cell could not identify itself. Verified keyboard-only against the live store:
+sixteen open, nine typed kinds land, the date included.
+
+**Internal names, swept, by a guard that reads rendered text node by node.** Gone
+from where a person reads: the derived key under the field panel's name box; the
+machine key as a history label and raw JSON for unknown history values; the
+conflict line's key and two JSON blobs; the record panel's provenance rows as
+JSON; a truncated uuid standing in for an unnamed subject's name; JSON dumps in
+cells and in the grid's conflict line.
+
+### Consumer action
+
+**None for the three mount sites in matrx-frontend** — they already pass
+`letTheStoreDecideRights`, which now means what it says: bind no `rights` port
+and the package asks the store. `storeDecidesRights` is DEPRECATED and answers
+"not known": it is synchronous, the honest answer needs a door call, and a port
+bound there would OVERRIDE the store's answer. A host that binds `rights` of its
+own still wins, and `tableRightsAt(level)` is the one way to build that answer
+by hand — it takes the LEVEL, never six booleans, so nobody can hand a screen a
+combination the ladder cannot produce.
+
+Requires `@ai-matrx/records` >= 0.7.0 for `custom.my_levels`.
+
+## 0.10.3
+
+Reissues the unpublished 0.10.2 candidate. Its live-store release gate exposed
+a race in the field-add smoke harness: it unmounted each panel immediately
+after clicking Save, before the asynchronous declaration had landed. The
+helper now waits until the real store reports the exact new Field before
+proceeding. Package behavior is unchanged.
+
+### Consumer action
+
+None.
+
+## 0.10.2
+
+Reissues the unpublished 0.10.1 candidate after its live-store release gate
+revealed that the demo selector read `document.title` while the actual
+`custom.record` row exposes the record payload as `data.title`. The smoke test
+now selects Acme Industrial from the real row shape; package behavior is unchanged.
+
+### Consumer action
+
+None.
+
+## 0.10.1
+
+Reissues the unpublished 0.10.0 package after its live-store smoke test selected
+the oldest demo record while asserting the identity of Acme Industrial. The
+test now selects that record by title, so re-seeding cannot substitute another
+record. Package behavior is unchanged from the 0.10.0 candidate.
+
+### Consumer action
+
+None.
+
+## 0.10.0
+
+**The three things the 19 September verdict (fifth pass) said a person hits the
+moment they touch a table.**
+
+**A double-click opens the typed editor, on every cell.** The verdict: "only the
+Title column can be opened by double-clicking; double-clicking any other cell
+opens a developer inspector — a floating window showing the record's raw JSON,
+its machine keys, a truncated id, and the headings DOCUMENT, LEVEL and HIDDEN."
+Two things did that. The data table ships a side panel AND a floating window,
+both falling back to `DataRowInspector`; the grid now turns both OFF, because
+this package has a record panel of its own (`Peek`, through `onRowOpen`) and a
+second one beside it is the parallel layer the platform forbids. And a cell now
+FILLS its cell and answers `dblclick` itself — the second press used to land on
+bare table cell after the first had swapped the DOM under the pointer, and a
+bare cell is a row click, which is exactly why a wide column worked and every
+narrow one did not.
+
+**Tab commits the typed value before it moves.** The verdict: "when we tabbed
+along a row, the first five values saved and the last four were silently
+dropped." The draft used to live in the open CELL, and this screen re-renders
+that cell for reasons that have nothing to do with the person typing — every
+accepted write calls `reload()`, which rebuilds the rows, the columns and the
+cells. A cell that remounted mid-edit came back initialised from the stored
+value, so the commit wrote what was already there and the screen correctly
+treated it as "nothing changed". The draft now lives in the editing session,
+beside the address of the open cell and the value it started from; `commit(move)`
+takes no value at all, because there is only one place the typed value can be
+read from. The editor is focused once per opening rather than on every render.
+
+**"Total of linked records" can be added, and a refusal is a sentence.** The
+panel now offers EVERY relation column — including the ones that hold a single
+record, marked "holds one" — because hiding "Crew lead" from the list taught a
+person nothing. `whatIsMissing` asks, in the panel's own words, what has not been
+answered yet ("Crew lead points at one record at a time, so there is nothing to
+total. Tick 'Can hold more than one' on Crew lead, or use Borrowed value to read
+its one value."), the sentence sits under the button, and the panel never sends a
+declaration it already knows the store must refuse.
+
+**A hint written for an engineer never reaches a person.** A store refusal
+carries a message for the person and a hint for whoever has to fix the caller
+("FLD-11: … config.via names a relation Field of this same table, by its key").
+This package printed both. `hintForAPerson` now filters the hint BY SHAPE — a
+contract row id, a schema-qualified database object, a path inside a document,
+a snake_case identifier or a SQLSTATE — and what it filters joins the SQLSTATE on
+the notice's title, for an engineer. A hint in ordinary words is still shown
+verbatim.
+
+New exports: `whatIsMissing`, `hintForAPerson`, `hintIsMachineIdentity`.
+
+### Consumer action
+
+None. `GridEditing.commit` now takes `(move)` instead of `(value, move)` and
+carries `draft` / `type`; nothing outside this package calls it.
+
 ## 0.9.0
 
 **Sharing reaches the record and table screens (SCR-N-5).** `ShareControl` puts a