@lotics/cli 0.221.0 → 0.223.0

package/dist/src/cli.js

@@ -35282,7 +35282,7 @@ var tableDateFieldSchema = tableFieldBaseSchema.extend({
   format: dateFormatSchema.optional(),
   timezone: zod_default.string().optional().describe("IANA timezone"),
   derive_from: zod_default.enum(["created_at", "updated_at"]).optional().describe(
-    "Auto-populate from the row's system timestamp. `created_at` stamps once at insert time; `updated_at` re-stamps on every record edit. Derived fields are read-only \u2014 user-supplied values are silently ignored at write time, matching the formula/rollup/lookup pattern. Replaces the per-table after_create workflow pattern."
+    "Auto-populate from the row's system timestamp. `created_at` stamps once at insert time; `updated_at` re-stamps on every record edit. A derived field is read-only: a write naming it is refused, as for formula/rollup/lookup. Replaces the per-table after_create workflow pattern."
   ),
   // A derived date is read-only, so derive_from and default_value are mutually
   // exclusive — enforced in validateFieldDefaultValue.
@@ -35595,6 +35595,17 @@ var fieldVisibilitySchema = zod_default.enum(["visible", "hidden"]).describe(
   "Field visibility state: 'visible' = shown to everyone, 'hidden' = not shown by default but members can toggle"
 );
 
+// ../shared/src/schemas/database_types.ts
+function extractRecordLinkIds(value) {
+  if (!value || !Array.isArray(value)) return [];
+  return value.map((item) => typeof item === "string" ? item : item?.id).filter((id) => Boolean(id));
+}
+function isPlatformWrittenField(field) {
+  if (COMPUTED_FIELD_TYPES.has(field.type)) return true;
+  if (field.type === "autonumber") return true;
+  return field.type === "date" && field.derive_from !== void 0;
+}
+
 // ../shared/src/binding_keys.ts
 function fieldKeyName(entityAlias, fieldAlias) {
   return `${entityAlias}.${fieldAlias}`;
@@ -37878,6 +37889,23 @@ function fieldHoldsSeveral(field) {
   if (field.type === "select") return field.multi === true;
   return field.type === "select_record_link" && field.cardinality !== "one";
 }
+var STATED_FIELD_TYPES = [
+  "text",
+  "number",
+  "date",
+  "boolean",
+  "select",
+  "select_record_link",
+  "files"
+];
+function isEditable(field) {
+  if (isPlatformWrittenField(field)) return false;
+  if (field.type === "select_record_link") return field.cardinality === "one";
+  return STATED_FIELD_TYPES.includes(field.type);
+}
+function isAsked(field) {
+  return isEditable(field) || field.type === "select_member";
+}
 var contractViewSchema = zod_default.object({
   alias: contractAliasSchema.describe("Stable view alias, unique within the entity"),
   label: zod_default.string().min(1).describe("Display name of the view"),
@@ -40416,13 +40444,15 @@ var contractActWhenSchema = zod_default.strictObject({
   field: contractAliasSchema.describe("The lifecycle field of this entity the state is read off"),
   in: zod_default.array(contractAliasSchema).min(1).describe("The option aliases of that lifecycle the act is offered at")
 }).describe("Offer this act only while the row stands at one of these stages");
+var contractActConfirmSchema = zod_default.boolean().describe("Ask before this act runs, with its own label as the commit word \u2014 for a press that cannot be taken back");
 var contractTemplateActSchema = zod_default.strictObject({
   label: zod_default.string().min(1).describe("The act's own words, as the reader reads them in the menu"),
   template: contractAliasSchema.describe(
     "A template alias this model declares; a row's act generates that document from the row and opens it"
   ),
   place: contractActPlaceSchema.optional(),
-  when: contractActWhenSchema.optional()
+  when: contractActWhenSchema.optional(),
+  confirm: contractActConfirmSchema.optional()
 });
 var contractAgentActSchema = zod_default.strictObject({
   kind: zod_default.literal("agent"),
@@ -40430,7 +40460,8 @@ var contractAgentActSchema = zod_default.strictObject({
   agent: contractAliasSchema.describe("An agent alias the APP declares (package.json#lotics.agents)"),
   fills: zod_default.array(contractAliasSchema).min(1).describe("The fields of this entity the run may write \u2014 reviewed by the reader, then written as ONE update"),
   place: contractActPlaceSchema.optional(),
-  when: contractActWhenSchema.optional()
+  when: contractActWhenSchema.optional(),
+  confirm: contractActConfirmSchema.optional()
 });
 var RECORD_INPUT = "record";
 var contractWorkflowActSchema = zod_default.strictObject({
@@ -40442,7 +40473,8 @@ var contractWorkflowActSchema = zod_default.strictObject({
     contractAliasSchema.describe('A field of this entity, or "record" \u2014 which names the row itself before any field of that alias')
   ).describe("What the run is handed: the workflow's own input name \u2192 the value on the row it is pressed on"),
   place: contractActPlaceSchema.optional(),
-  when: contractActWhenSchema.optional()
+  when: contractActWhenSchema.optional(),
+  confirm: contractActConfirmSchema.optional()
 });
 var contractActSchema = zod_default.union([contractAgentActSchema, contractWorkflowActSchema, contractTemplateActSchema], {
   error: (issue2) => typeof issue2.input === "object" && issue2.input !== null && "screen" in issue2.input ? "a row act opens this app's record or another app" : void 0
@@ -40505,6 +40537,28 @@ var contractPredicateSchema = zod_default.strictObject({
     "An `and` group of plain conditions over the entity's OWN fields, each `field_key` a field alias \u2014 the rows this predicate keeps"
   )
 });
+var SOCIAL_NETWORKS = ["facebook", "instagram", "threads", "x", "linkedin"];
+var contractPublishDestinationSchema = zod_default.strictObject({
+  network: zod_default.strictObject({
+    field: contractAliasSchema.describe("A single select on the DESTINATION entity saying what kind of surface a row is"),
+    options: zod_default.record(contractAliasSchema, zod_default.enum(SOCIAL_NETWORKS)).describe("Option alias \u2192 the network the kit previews and publishes it as; an option this map leaves out is posted by hand")
+  }).describe("Which destinations the platform can reach through an API, and as what"),
+  connected: contractAliasSchema.optional().describe("A text on the destination holding the account the platform posts as \u2014 empty means not connected, so by hand for now"),
+  // A POST IS WRITTEN ONCE AND GOES EVERYWHERE. Where the destinations differ by
+  // language the record carries a body each, and the destination's own select
+  // says which of them it receives; one alias is the model with one body.
+  bodies: zod_default.union([
+    contractAliasSchema,
+    zod_default.strictObject({
+      field: contractAliasSchema.describe("A single select on the DESTINATION entity deciding which body it receives"),
+      options: zod_default.record(contractAliasSchema, contractAliasSchema).describe("Option alias \u2192 a text field of THIS entity")
+    })
+  ]).describe("The text each destination goes out with \u2014 one field of this entity, or the destination's own select choosing between several"),
+  offered: zod_default.strictObject({
+    field: contractAliasSchema.describe("A single select on the destination"),
+    in: zod_default.array(contractAliasSchema).min(1).describe("Its option aliases the strip offers a row at")
+  }).optional().describe("Which destination rows the strip offers; absent, every row")
+});
 var ITINERARY_RUNS = ["when", "kind", "provider", "stage", "duration", "caption", "reference"];
 var STOP_LINE_RUNS = 4;
 var contractSectionDrawSchema = zod_default.discriminatedUnion("draw", [
@@ -40543,8 +40597,35 @@ var contractSectionDrawSchema = zod_default.discriminatedUnion("draw", [
     line: zod_default.array(zod_default.enum(ITINERARY_RUNS)).min(1).max(STOP_LINE_RUNS).describe(
       `The runs of a stop's muted line, in this order \u2014 at most ${STOP_LINE_RUNS}, each one this run already carries; absent, a stop is read by ${ITINERARY_RUNS.slice(0, STOP_LINE_RUNS).join(", ")}`
     )
+  }),
+  // ONE PIECE, N DESTINATIONS. The rows are not a register anybody reads: each
+  // is this record standing on one destination, so what a reader wants is the
+  // strip of destinations with the state of each on it — and the one press
+  // that sends the ones that are ready. Every other clause here names a column
+  // the roles cannot reach: the four states the desk draws, the per-destination
+  // override, and what came back from the platform.
+  zod_default.strictObject({
+    draw: zod_default.literal("publish").describe("One row per destination this record stands on \u2014 the strip, the preview, and the press that sends them"),
+    states: zod_default.strictObject({
+      queued: contractAliasSchema.describe("Waiting to go out \u2014 the stage the child's flow OPENS at"),
+      published: contractAliasSchema.describe("Sent through the API"),
+      failed: contractAliasSchema.describe("The platform refused it"),
+      by_hand: contractAliasSchema.describe("Posted by a person, and marked so here")
+    }).describe("Option aliases of the child's own lifecycle \u2014 all four, because each is a different thing the chip says"),
+    text: contractAliasSchema.optional().describe("A plain text on the child \u2014 what this one destination goes out with instead of the body"),
+    permalink: contractAliasSchema.optional().describe("A link-formatted text on the child \u2014 where the post landed"),
+    error: contractAliasSchema.optional().describe("A text on the child holding the platform's own refusal"),
+    link: contractAliasSchema.optional().describe("A link-formatted text of THIS entity \u2014 the address the post carries as its card"),
+    destination: contractPublishDestinationSchema,
+    publish: contractAliasSchema.describe(
+      "The workflow alias the APP binds (package.json#lotics.workflows) \u2014 the generator writes no body, and `lotics app check` refuses an alias nothing bound"
+    )
   })
 ]).describe("How a section of this screen's record is drawn, where its rows are more than a register");
+function publishBodies(clause) {
+  const bodies = clause.destination.bodies;
+  return typeof bodies === "string" ? [bodies] : [...new Set(Object.values(bodies.options))];
+}
 var contractLensSchema = zod_default.strictObject({
   label: zod_default.string().min(1).describe("What the chip is called"),
   predicates: zod_default.array(contractPredicateSchema).min(1).describe("The sets it offers, in this order")
@@ -40567,6 +40648,30 @@ function writesChildren(writes) {
 function statedWrites(writes) {
   return JSON.stringify(writes);
 }
+var DRAFT_INPUTS = 12;
+function standsOnLink(field, entity, roles) {
+  if (field.type !== "select_record_link") return false;
+  const role = roleOf(roles, entity.alias, field.alias)?.role;
+  return role === "parent" || role === "party";
+}
+function draftSkips(field, entity, roles, rules) {
+  if (!isAsked(field) && !standsOnLink(field, entity, roles)) {
+    return "a computed value, a link holding many rows and a minted number are the platform's to write, and no editor states them";
+  }
+  const decl = roleOf(roles, entity.alias, field.alias);
+  if (decl?.role === "lifecycle") return "a lifecycle is WALKED \u2014 the row opens at the flow's first rung and the ladder on its record moves it";
+  if (field.type === "files" && decl?.role !== "mark") return "a pile is gathered onto a row that exists, one paper at a time; only the `mark` is asked at create";
+  const from = rules[entity.alias]?.fields?.[field.alias]?.default_from;
+  if (from !== void 0) return `its value is copied from \`${from}\` when the row is written`;
+  const stamp = entity.fields.find((one) => {
+    const owed = roleOf(roles, entity.alias, one.alias);
+    return owed?.role === "obligation" && owed.satisfied_by === field.alias;
+  });
+  if (stamp !== void 0) {
+    return `it is the stamp that CLOSES "${stamp.label}", and a create is what OPENS the thing owed`;
+  }
+  return void 0;
+}
 var contractScreenSchema = zod_default.object({
   alias: contractAliasSchema.describe("Stable screen alias, unique within the app"),
   label: zod_default.string().min(1).describe("What the screen is called in the app"),
@@ -40584,6 +40689,12 @@ var contractScreenSchema = zod_default.object({
   columns: zod_default.array(contractAliasSchema).min(1).max(CONTEXT_COLUMNS).optional().describe(
     `Extra fields drawn after the slots, in this order \u2014 at most ${CONTEXT_COLUMNS}, each holding ONE value; never a files field, and never a field a slot already draws`
   ),
+  // WHAT THE DRAFT ASKS, where the row is written over days rather than typed
+  // in one sitting. Absent, the draft asks for every field a person states,
+  // which is right for a row somebody has the answers to when they open it.
+  create: zod_default.array(contractAliasSchema).min(1).optional().describe(
+    `The fields a new row is asked for, in this order \u2014 at most ${DRAFT_INPUTS}, each a field of this entity a draft can ask for, and every field the row cannot be written without among them; absent, the draft asks for every field a person states`
+  ),
   // Absent IS true: a desk that can only be read is the exception, so the file
   // says that and says nothing in the ordinary case.
   writes: zod_default.union([zod_default.boolean(), zod_default.literal(CHILDREN_WRITES)]).optional().describe(
@@ -40886,6 +40997,7 @@ function resolveScreen(app, entityByAlias, roles, templates = [], rules = {}) {
     }
   }
   const columns = resolveColumns(path24, screen, entity, [...entityByAlias.values()], fieldByAlias, boundBy, roles, shapeLabel, findings);
+  const create = resolveCreate(path24, screen, entity, roles, rules, fieldByAlias, findings);
   const acts = resolveActs(path24, screen, entity, roles, entityByAlias, rules, fieldByAlias, templates, findings);
   const sectionActs2 = resolveSectionActs(path24, screen, entity, roles, fieldByAlias, templates, findings);
   const summary = resolveSummary(path24, screen, entity, [...entityByAlias.values()], roles, slots, findings);
@@ -40915,6 +41027,7 @@ function resolveScreen(app, entityByAlias, roles, templates = [], rules = {}) {
       slots,
       outcomes,
       columns,
+      create,
       acts,
       sectionActs: sectionActs2,
       summary,
@@ -40982,6 +41095,58 @@ function resolveColumns(path24, screen, entity, entities, fieldByAlias, boundBy,
   }
   return drawn;
 }
+function resolveCreate(path24, screen, entity, roles, rules, fieldByAlias, findings) {
+  const named3 = screen.create;
+  if (named3 === void 0) return [];
+  const at2 = `${path24}.create`;
+  if (named3.length > DRAFT_INPUTS) {
+    findings.push({
+      severity: "error",
+      path: at2,
+      message: `asks for ${named3.length} fields, above the ${DRAFT_INPUTS} a draft is read in one pass \u2014 a create past that is a form in front of a row whose record edits every one of them in place`
+    });
+    return [];
+  }
+  const asked = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const alias of named3) {
+    const field = fieldByAlias.get(alias);
+    if (field === void 0) {
+      findings.push({ severity: "error", path: at2, message: `names "${alias}", which is not a field of entity "${entity.alias}"` });
+      continue;
+    }
+    if (seen.has(alias)) {
+      findings.push({ severity: "error", path: at2, message: `names "${alias}" twice` });
+      continue;
+    }
+    const skipped = draftSkips(field, entity, roles, rules);
+    if (skipped !== void 0) {
+      findings.push({ severity: "error", path: at2, message: `names "${alias}", which a draft never asks for: ${skipped}` });
+      continue;
+    }
+    seen.add(alias);
+    asked.push(field);
+  }
+  for (const field of draftMustAsk(entity, roles, rules)) {
+    if (seen.has(field.alias)) continue;
+    findings.push({
+      severity: "error",
+      path: at2,
+      message: `leaves out "${field.alias}", which a row cannot be written without \u2014 a draft that cannot save is worse than a long one`
+    });
+  }
+  return asked;
+}
+function draftMustAsk(entity, roles, rules) {
+  return entity.fields.filter((field) => {
+    if (draftSkips(field, entity, roles, rules) !== void 0) return false;
+    if (field.required === true) return true;
+    const role = roleOf(roles, entity.alias, field.alias)?.role;
+    if (field.type !== "select_record_link") return false;
+    if (role === "parent") return field.target_entity !== entity.alias;
+    return role === "party" && (rules[field.target_entity]?.natural_key ?? []).length > 0;
+  });
+}
 function columnCountsRows(field) {
   return field.type === "rollup" && field.aggregate_option.operation === "count";
 }
@@ -41183,8 +41348,11 @@ function resolveActs(path24, screen, entity, roles, entityByAlias, rules, fieldB
     import: resolveImport(path24, declared.import, screen, entity, entityByAlias, rules, findings)
   };
 }
+function platformWrittenKind(field) {
+  return field.type === "date" && field.derive_from !== void 0 ? `date stamped from the row's ${field.derive_from}` : field.type;
+}
 function importableField(field) {
-  return !COMPUTED_TYPES.includes(field.type) && !["autonumber", "select_record_link", "select_member", "files"].includes(field.type);
+  return !isPlatformWrittenField(field) && !["select_record_link", "select_member", "files"].includes(field.type);
 }
 function resolveImport(path24, declared, screen, entity, entityByAlias, rules, findings) {
   if (declared === void 0) return null;
@@ -41239,8 +41407,8 @@ function resolveImport(path24, declared, screen, entity, entityByAlias, rules, f
       findings.push({ severity: "error", path: at2, message: `fills "${alias}", which is not a field of "${target.alias}"` });
       return [];
     }
-    if (COMPUTED_TYPES.includes(field.type) || field.type === "autonumber") {
-      findings.push({ severity: "error", path: at2, message: `fills "${alias}", a ${field.type} \u2014 the workspace writes that column, so a file cannot` });
+    if (isPlatformWrittenField(field)) {
+      findings.push({ severity: "error", path: at2, message: `fills "${alias}", a ${platformWrittenKind(field)} \u2014 the workspace writes that column, so a file cannot` });
       return [];
     }
     if (!importableField(field)) {
@@ -41295,9 +41463,10 @@ function resolveAct(act, at2, screen, entity, roles, fieldByAlias, templates, fi
   const place = act.place === void 0 ? {} : { place: act.place };
   const gate = resolveActWhen(act.when, at2, entity, roles, fieldByAlias, findings);
   const stands = gate === void 0 ? {} : { when: gate };
+  const asks = act.confirm === true ? { confirm: true } : {};
   if (!("kind" in act)) {
     const template = resolveTemplateAct(act.template, templates, at2, findings);
-    return template === void 0 ? [] : [{ kind: "template", label: act.label, ...place, ...stands, template }];
+    return template === void 0 ? [] : [{ kind: "template", label: act.label, ...place, ...stands, ...asks, template }];
   }
   if (!writesRecord(screen.writes)) {
     const [pressed, why] = act.kind === "agent" ? [`runs "${act.agent}"`, "an agent act fills the record's own fields"] : [`hands the row to "${act.workflow}"`, "a hand-off moves the row"];
@@ -41310,7 +41479,7 @@ function resolveAct(act, at2, screen, entity, roles, fieldByAlias, templates, fi
   }
   if (act.kind === "workflow") {
     const inputs = resolveActInputs(act.inputs, at2, entity, fieldByAlias, findings);
-    return inputs === void 0 ? [] : [{ kind: "workflow", label: act.label, ...place, ...stands, workflow: act.workflow, inputs }];
+    return inputs === void 0 ? [] : [{ kind: "workflow", label: act.label, ...place, ...stands, ...asks, workflow: act.workflow, inputs }];
   }
   for (const dup of findDuplicates(act.fills)) {
     findings.push({ severity: "error", path: at2, message: `fills "${dup}" twice \u2014 one field is written once` });
@@ -41321,13 +41490,13 @@ function resolveAct(act, at2, screen, entity, roles, fieldByAlias, templates, fi
       findings.push({ severity: "error", path: at2, message: `fills "${alias}", which is not a field of entity "${entity.alias}"` });
       return [];
     }
-    if (COMPUTED_TYPES.includes(field.type) || field.type === "autonumber") {
-      findings.push({ severity: "error", path: at2, message: `fills "${alias}", a ${field.type} \u2014 the workspace writes that column, so a run cannot propose one` });
+    if (isPlatformWrittenField(field)) {
+      findings.push({ severity: "error", path: at2, message: `fills "${alias}", a ${platformWrittenKind(field)} \u2014 the workspace writes that column, so a run cannot propose one` });
       return [];
     }
     return [field];
   });
-  return fills.length === 0 ? [] : [{ kind: "agent", label: act.label, ...place, ...stands, agent: act.agent, fills }];
+  return fills.length === 0 ? [] : [{ kind: "agent", label: act.label, ...place, ...stands, ...asks, agent: act.agent, fills }];
 }
 function resolveActWhen(declared, at2, entity, roles, fieldByAlias, findings) {
   if (declared === void 0) return void 0;
@@ -41959,7 +42128,8 @@ var SECTION_WHY = {
   journal: "the record's own rows, a day and a markdown body, written by a member \u2014 parties are who it was with",
   parent: "rows this record owns",
   named: "rows that name this record",
-  link: "reached through a link carrying no role"
+  link: "reached through a link carrying no role",
+  publish: "the screen draws these rows as a publish desk, and a clause naming the reading IS the reading"
 };
 function recordSections(entity, entities, roles, header, shape = CUSTOM_SHAPE, door = recordDoor(shape, entity, entities, roles), drawn = void 0) {
   const band = recordBand(shape, entity, entities, roles, door, header.levels);
@@ -41992,6 +42162,14 @@ function recordSections(entity, entities, roles, header, shape = CUSTOM_SHAPE, d
           listed.add(child.alias);
           drawnRelations.add(relationKey(child.alias, link.alias));
         }
+        const stated3 = drawn?.[child.alias];
+        if (stated3?.draw === "publish") {
+          const byName = CHILD_COLUMN_ROLES.flatMap((role) => fieldsWithRole(child, roles, role)).filter(
+            (field) => field.alias !== link.alias
+          );
+          children.push({ kind: "children", why: SECTION_WHY.publish, child, via, link, fields: byName });
+          continue;
+        }
         const setField = fieldsWithRole(child, roles, "expected_set").find(
           (field) => field.type === "select" && field.multi !== true
         );
@@ -42061,10 +42239,14 @@ function recordSections(entity, entities, roles, header, shape = CUSTOM_SHAPE, d
       // ladder's own rows reached from the other side — a fact listing them by
       // name would be the history drawn twice, once as a list of ids.
       ...history === void 0 ? [] : [history.back],
-      // …AND THE FIGURES A SECTION BELOW HEADS ITSELF WITH.
-      ...Object.values(drawn ?? {}).flatMap(
-        (clause) => clause.draw !== "ledger" ? [] : clause.summary.flatMap((entry) => entity.fields.filter((field) => field.alias === summaryFieldOf(entry)))
-      ),
+      // …AND THE FIGURES A SECTION BELOW HEADS ITSELF WITH, and the words a
+      // desk below SENDS: the bodies are drawn as prose above the strip, so a
+      // fact for one is the same column edited twice, and a band holding
+      // nothing else is an empty grid with an entry in the rail.
+      ...Object.values(drawn ?? {}).flatMap((clause) => {
+        const named3 = clause.draw === "ledger" ? clause.summary.map(summaryFieldOf) : clause.draw === "publish" ? publishBodies(clause) : [];
+        return named3.flatMap((alias) => entity.fields.filter((field) => field.alias === alias));
+      }),
       ...ownSets,
       ...files,
       ...judged === void 0 ? [] : [judged],
@@ -42526,6 +42708,10 @@ function restingScreen(args) {
     slots: [],
     outcomes: {},
     columns: [],
+    // A CHILD'S DRAFT IS THE SECTION'S. The `create` clause is the SCREEN's, and
+    // a screen is one register over one entity — these rows are opened from the
+    // record above them, where the composer asking for them is the section's own.
+    create: [],
     acts: { row: [], selection: [], record: [], export: null, import: null },
     summary: { columnTotals: [], bandTotals: [], above: null, ageing: null, trend: null },
     period: null,
@@ -42751,9 +42937,113 @@ function checkFactGroups(screen, entities, roles) {
     )
   );
 }
+var SECTION_READING = {
+  expected_set: "a set of the entries it owes",
+  timeline: "a run of stops",
+  thread: "a correspondence",
+  journal: "a log"
+};
 function childRegisters(screen, entities, roles) {
   const sections = recordSections(screen.entity, entities, roles, recordHeader(screen, entities, roles), screen.screen.shape, screen.record, screen.screen.sections);
-  return new Map(sections.flatMap((section) => section.kind === "children" ? [[section.child.alias, section]] : []));
+  return {
+    registers: new Map(sections.flatMap((section) => section.kind === "children" ? [[section.child.alias, section]] : [])),
+    readings: new Map(
+      sections.flatMap(
+        (section) => "child" in section && section.kind !== "children" ? [[section.child.alias, SECTION_READING[section.kind]]] : []
+      )
+    )
+  };
+}
+function checkPublishDraw(at2, alias, clause, section, screen, entities, roles) {
+  const findings = [];
+  const fail3 = (path24, message2) => {
+    findings.push({ severity: "error", path: path24, message: message2 });
+  };
+  const child = section.child;
+  const textOf = (owner, named3) => {
+    const field = owner.fields.find((one) => one.alias === named3);
+    return field !== void 0 && resolvedFieldType(field, owner, entities) === "text" ? field : void 0;
+  };
+  const selectOf = (owner, named3) => {
+    const field = owner.fields.find((one) => one.alias === named3);
+    return field?.type === "select" && field.multi !== true ? field : void 0;
+  };
+  const namedText = (owner, what, named3, path24) => {
+    if (named3 === void 0) return;
+    if (textOf(owner, named3) === void 0) {
+      fail3(path24, `${what} "${named3}", which is not a text field of entity "${owner.alias}"`);
+    }
+  };
+  const party = fieldsWithRole(child, roles, "party").find((field) => field.type === "select_record_link");
+  const destination = party?.type === "select_record_link" ? entities.find((one) => one.alias === party.target_entity) : void 0;
+  if (party === void 0 || destination === void 0) {
+    fail3(at2, `draws "${alias}" as a publish desk, and its rows name no destination \u2014 declare the link to the destination entity as a "party"`);
+  }
+  const lifecycle = fieldsWithRole(child, roles, "lifecycle").find((field) => field.type === "select");
+  if (lifecycle === void 0 || lifecycle.type !== "select") {
+    fail3(at2, `draws "${alias}" as a publish desk, and its rows have no lifecycle \u2014 the chip's state is a stage of the child's own flow`);
+  } else {
+    for (const [state, named3] of Object.entries(clause.states)) {
+      if (!lifecycle.options.some((option) => option.alias === named3)) {
+        fail3(`${at2}.states.${state}`, `names "${named3}", which is not an option of "${lifecycle.label}" on entity "${child.alias}"`);
+      }
+    }
+    const opens = lifecycle.options[0];
+    if (opens !== void 0 && lifecycle.options.some((option) => option.alias === clause.states.queued) && clause.states.queued !== opens.alias) {
+      fail3(
+        `${at2}.states.queued`,
+        `names "${clause.states.queued}", and "${lifecycle.label}" opens at "${opens.alias}" \u2014 a destination is queued by opening a row, so the queued stage is the flow's first`
+      );
+    }
+  }
+  if (destination !== void 0 && fieldsWithRole(destination, roles, "identity").length === 0) {
+    fail3(at2, `draws "${alias}" over "${destination.alias}", which names no row of itself \u2014 a chip is the destination's own name, so it declares an "identity"`);
+  }
+  namedText(child, "overrides with", clause.text, `${at2}.text`);
+  namedText(child, "reads its permalink from", clause.permalink, `${at2}.permalink`);
+  namedText(child, "reads the refusal from", clause.error, `${at2}.error`);
+  namedText(screen.entity, "carries the address", clause.link, `${at2}.link`);
+  if (destination === void 0) return findings;
+  const reach = clause.destination;
+  const kind = selectOf(destination, reach.network.field);
+  if (kind === void 0) {
+    fail3(`${at2}.destination.network.field`, `names "${reach.network.field}", which is not a single select of entity "${destination.alias}"`);
+  } else {
+    for (const option of Object.keys(reach.network.options)) {
+      if (!kind.options.some((one) => one.alias === option)) {
+        fail3(`${at2}.destination.network.options`, `names "${option}", which is not an option of "${kind.label}" on entity "${destination.alias}"`);
+      }
+    }
+  }
+  namedText(destination, "reads the connected account from", reach.connected, `${at2}.destination.connected`);
+  if (typeof reach.bodies === "string") {
+    namedText(screen.entity, "goes out with", reach.bodies, `${at2}.destination.bodies`);
+  } else {
+    const picks = selectOf(destination, reach.bodies.field);
+    if (picks === void 0) {
+      fail3(`${at2}.destination.bodies.field`, `names "${reach.bodies.field}", which is not a single select of entity "${destination.alias}"`);
+    }
+    for (const [option, body] of Object.entries(reach.bodies.options)) {
+      if (picks !== void 0 && !picks.options.some((one) => one.alias === option)) {
+        fail3(`${at2}.destination.bodies.options`, `names "${option}", which is not an option of "${picks.label}" on entity "${destination.alias}"`);
+      }
+      namedText(screen.entity, "goes out with", body, `${at2}.destination.bodies.options`);
+    }
+  }
+  const offered = reach.offered;
+  if (offered !== void 0) {
+    const gate = selectOf(destination, offered.field);
+    if (gate === void 0) {
+      fail3(`${at2}.destination.offered.field`, `names "${offered.field}", which is not a single select of entity "${destination.alias}"`);
+    } else {
+      for (const option of offered.in) {
+        if (!gate.options.some((one) => one.alias === option)) {
+          fail3(`${at2}.destination.offered.in`, `names "${option}", which is not an option of "${gate.label}" on entity "${destination.alias}"`);
+        }
+      }
+    }
+  }
+  return findings;
 }
 function childRuns(screen, entities, roles) {
   const archetype = recordArchetype(screen.screen.shape, screen.entity, entities, roles);
@@ -42769,19 +43059,30 @@ function childRuns(screen, entities, roles) {
 function checkSectionDraws(screen, entities, roles) {
   const drawn = Object.entries(screen.screen.sections ?? {});
   if (drawn.length === 0) return [];
-  const registers = childRegisters(screen, entities, roles);
+  const { registers, readings } = childRegisters(screen, entities, roles);
   const runs = childRuns(screen, entities, roles);
   const takes = SHAPE_REGISTRY.worksheet.slots.sell.roles;
+  const desks = drawn.flatMap(([alias, clause]) => clause.draw === "publish" ? [alias] : []);
+  if (desks.length > 1) {
+    return [
+      {
+        severity: "error",
+        path: `apps.${screen.app.alias}.screen.sections`,
+        message: `draws ${desks.join(" and ")} as publish desks \u2014 a record is sent from ONE strip of destinations, and a row of the register wears the marks of one`
+      }
+    ];
+  }
   return drawn.flatMap(([alias, clause]) => {
     const at2 = `apps.${screen.app.alias}.screen.sections.${alias}`;
     const section = registers.get(alias);
     if (section === void 0) {
+      const read2 = readings.get(alias);
       const offered = [...registers.keys()];
       return [
         {
           severity: "error",
           path: at2,
-          message: offered.length === 0 ? `names "${alias}", and this record draws no register of a child's rows to be drawn another way` : `names "${alias}", which this record draws no register of \u2014 its registers are addressed by ${offered.join(", ")}`
+          message: read2 !== void 0 ? `names "${alias}", whose rows this record already draws as ${read2} rather than as a register \u2014 and "publish" is the one draw that outranks a reading the roles decided` : offered.length === 0 ? `names "${alias}", and this record draws no register of a child's rows to be drawn another way` : `names "${alias}", which this record draws no register of \u2014 its registers are addressed by ${offered.join(", ")}`
         }
       ];
     }
@@ -42821,6 +43122,9 @@ function checkSectionDraws(screen, entities, roles) {
         ] : [];
       });
     }
+    if (clause.draw === "publish") {
+      return checkPublishDraw(at2, alias, clause, section, screen, entities, roles);
+    }
     if (clause.draw === "ledger") {
       return clause.summary.flatMap((entry) => {
         const field = summaryFieldOf(entry);
@@ -42887,7 +43191,9 @@ function checkSectionDraws(screen, entities, roles) {
 function unregisteredChildren(screen, entities, roles, registered) {
   const entries2 = recordRecipe(screen.screen.shape, screen.entity, entities, roles, recordHeader(screen, entities, roles), screen.record, screen.screen.sections);
   const priced = new Set(
-    Object.entries(screen.screen.sections ?? {}).flatMap(([alias, clause]) => clause.draw === "worksheet" ? [alias] : [])
+    Object.entries(screen.screen.sections ?? {}).flatMap(
+      ([alias, clause]) => clause.draw === "worksheet" || clause.draw === "publish" ? [alias] : []
+    )
   );
   const read2 = new Set(
     entries2.flatMap(({ draw, section }) => {
@@ -44101,7 +44407,7 @@ function resultSideEffects(result) {
 }
 
 // src/version.ts
-var VERSION = "0.221.0";
+var VERSION = "0.223.0";
 
 // src/timezone.ts
 function machineTimezone() {
@@ -45792,7 +46098,8 @@ publish each declaration on their own.
   \`src/workflows/<alias>.ts\` with declared \`inputs\`, so a caller's bad value is a \`field_errors\`
   reply rather than a half-written row.
 - **Declare what it changes.** \`package.json#lotics.writes\` names the fields the workflows
-  write; \`lotics app check\` refuses a body that writes outside it.
+  write and \`lotics.deletes\` the tables whose ROWS they take \u2014 a delete names no column;
+  \`lotics app check\` refuses a body that reaches outside either.
 - **No concrete id in source.** \`rec_\`, \`fld_\` and \`opt_\` literals belong in \`.lotics/\`, which
   is generated. \`lotics app codegen\` writes the \`F\`/\`OPT\`/\`TBL\` maps to type against.
 - **An alias is a promise once the API is published.** Renaming one, or narrowing what it takes,
@@ -52220,7 +52527,7 @@ function readLeadingComments(stmt) {
 var TOOL_INPUT_SEMANTICS = {
   // ─── Bulk record mutations ─────────────────────────────────────────────
   update_records: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     record_ids: { kind: "record_refs" },
     filters: { kind: "filter_tree", table_from: "table_id" },
     set: { kind: "record_data", table_from: "table_id", writes: true },
@@ -52252,7 +52559,7 @@ var TOOL_INPUT_SEMANTICS = {
     field_edits: { kind: "dynamic" }
   },
   create_records: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     records: { kind: "record_data_array", table_from: "table_id", writes: true },
     field_keys: { kind: "field_key_refs", table_from: "table_id", writes: true },
     // Per-record cells — semantic depends on field_keys[i]; tool resolves.
@@ -52263,7 +52570,7 @@ var TOOL_INPUT_SEMANTICS = {
     // `rec_*` identifiers) which is all this kind asserts: normalization passes it
     // through raw and nothing resolves it against stored rows.
     ids: { kind: "record_refs" },
-    source_table_id: { kind: "table_ref" },
+    source_table_id: { kind: "table_ref", removes: false },
     record_ids: { kind: "record_refs" },
     filters: { kind: "filter_tree", table_from: "table_id" },
     // Cross-table mapping — {source_field_key: target_field_key}. Not
@@ -52276,28 +52583,34 @@ var TOOL_INPUT_SEMANTICS = {
     return_fields: { kind: "field_key_refs", table_from: "table_id", writes: false }
   },
   delete_records: {
-    table_id: { kind: "table_ref" },
+    // THE ONE CALL THAT TAKES ROWS. Every column of the row goes with it, so
+    // nothing field-keyed can carry the fact and it rides the table position —
+    // which is also the only table the source NAMES. `cascade: true` reaches the
+    // rows of whatever tables a single-valued link points here from, and those
+    // are the link graph's answer rather than the source's, so a scan can no
+    // more resolve them than it can a field key computed at runtime.
+    table_id: { kind: "table_ref", removes: true },
     record_ids: { kind: "record_refs" },
     filters: { kind: "filter_tree", table_from: "table_id" },
     cascade: { kind: "scalar" }
   },
   restore_records: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     record_ids: { kind: "record_refs" },
     filters: { kind: "filter_tree", table_from: "table_id" }
   },
   lock_records: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     record_ids: { kind: "record_refs" },
     filters: { kind: "filter_tree", table_from: "table_id" }
   },
   unlock_records: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     record_ids: { kind: "record_refs" },
     filters: { kind: "filter_tree", table_from: "table_id" }
   },
   request_locked_record_change: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     record_id: { kind: "record_ref" },
     // Map of field_key → new value; key validation and per-field value
     // resolution depend on the table schema, resolved at execute time.
@@ -52306,7 +52619,7 @@ var TOOL_INPUT_SEMANTICS = {
   },
   // ─── Query surfaces ────────────────────────────────────────────────────
   query_records: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     view_id: { kind: "scalar" },
     field_keys: { kind: "field_key_refs", table_from: "table_id", writes: false },
     filters: { kind: "filter_tree", table_from: "table_id" },
@@ -52347,7 +52660,7 @@ var TOOL_INPUT_SEMANTICS = {
     limit: { kind: "scalar" }
   },
   aggregate_records: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     filters: { kind: "filter_tree", table_from: "table_id" },
     // Nested {field_key, operation} shape — current vocabulary has no
     // nested-field-key kind, so the tool resolves at execute time.
@@ -52358,14 +52671,14 @@ var TOOL_INPUT_SEMANTICS = {
   get_record: {
     // Schema only takes `record_id`; table_id is optional/derived.
     record_id: { kind: "record_ref" },
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     // Keys on the record's own table, which `table_id` names when supplied and
     // the record resolves otherwise — the same position it holds on a query.
     field_keys: { kind: "field_key_refs", table_from: "table_id", writes: false }
   },
   // ─── View management ──────────────────────────────────────────────────
   create_view: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     name: { kind: "text" },
     frozen_columns: { kind: "scalar" },
     // summary keys are field_keys on `table_id`, values are view-summary
@@ -52402,13 +52715,13 @@ var TOOL_INPUT_SEMANTICS = {
   },
   // ─── Buttons (table-scoped field with action) ─────────────────────────
   press_button: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     record_id: { kind: "record_ref" },
     field_key: { kind: "field_key_ref", table_from: "table_id", writes: false }
   },
   // ─── Table management ─────────────────────────────────────────────────
   update_table: {
-    table_id: { kind: "table_ref" },
+    table_id: { kind: "table_ref", removes: false },
     name: { kind: "text" },
     description: { kind: "text" },
     // add_fields carries NEW field definitions (not refs to existing ones).
@@ -52818,8 +53131,9 @@ function fieldInputs(alias, type) {
 }
 function bodyWrites(source) {
   const parsed = parseWorkflowJs(source, { toolNames: void 0 });
-  if (!parsed.ok) return { writes: [], unknownTools: [], parsed: false };
+  if (!parsed.ok) return { writes: [], deletes: [], unknownTools: [], parsed: false };
   const writes = [];
+  const deletes = [];
   const unknownTools = /* @__PURE__ */ new Set();
   walkStepTree(parsed.steps, (step) => {
     if (step.type !== "tool_call") return;
@@ -52830,12 +53144,17 @@ function bodyWrites(source) {
     }
     for (const [kwarg, value] of Object.entries(step.input)) {
       const semantic = semantics[kwarg];
-      if (semantic === void 0 || !("writes" in semantic) || !semantic.writes) continue;
+      if (semantic === void 0) continue;
+      if (semantic.kind === "table_ref") {
+        if (semantic.removes) deletes.push(resolveTableFrom(semantics, step.input, kwarg));
+        continue;
+      }
+      if (!("writes" in semantic) || !semantic.writes) continue;
       const table = resolveTableFrom(semantics, step.input, semantic.table_from);
       for (const field of writtenKeys(semantic.kind, value)) writes.push({ table, field });
     }
   });
-  return { writes, unknownTools: [...unknownTools], parsed: true };
+  return { writes, deletes, unknownTools: [...unknownTools], parsed: true };
 }
 function stillWritten(declaration, tables, writers) {
   const aliased = aliasTables([...tables]);
@@ -52846,7 +53165,7 @@ function stillWritten(declaration, tables, writers) {
     if (write.table === null) anyTable.add(write.field);
     else written.add(on(write.table, write.field));
   }
-  for (const [key, entries2] of Object.entries(writers.generated)) {
+  for (const [key, entries2] of Object.entries(writers.generated.writes)) {
     const table = declaredTable(aliased, key);
     if (table === void 0) continue;
     for (const entry of entries2) {
@@ -52856,7 +53175,7 @@ function stillWritten(declaration, tables, writers) {
   }
   const writes = {};
   const dropped = [];
-  for (const [key, entries2] of Object.entries(declaration)) {
+  for (const [key, entries2] of Object.entries(declaration.writes)) {
     const table = declaredTable(aliased, key);
     if (table === void 0) {
       writes[key] = entries2;
@@ -52871,7 +53190,26 @@ function stillWritten(declaration, tables, writers) {
     });
     if (kept.length > 0) writes[key] = kept;
   }
-  return { writes, dropped: dropped.sort() };
+  const removed = /* @__PURE__ */ new Set();
+  let removesSomething = false;
+  for (const table of [...writers.removed, ...removedTableIds(aliased, writers.generated.deletes)]) {
+    if (table === null) removesSomething = true;
+    else removed.add(table);
+  }
+  const deletes = [];
+  const undeleted = [];
+  for (const key of declaration.deletes) {
+    const table = declaredTable(aliased, key);
+    if (table === void 0 || removesSomething || removed.has(table.table.id)) deletes.push(key);
+    else undeleted.push(key);
+  }
+  return { writes, deletes, dropped: dropped.sort(), undeleted: undeleted.sort() };
+}
+function removedTableIds(aliased, keys2) {
+  return keys2.flatMap((key) => {
+    const table = declaredTable(aliased, key);
+    return table === void 0 ? [] : [table.table.id];
+  });
 }
 function writtenKeys(kind, value) {
   if (kind === "record_data") return isToolInputExpression(value) ? [] : Object.keys(value);
@@ -52898,9 +53236,13 @@ function literalString(value) {
 function writtenTableIds(bodies) {
   return [
     ...new Set(
-      bodies.flatMap(
-        (body) => bodyWrites(body.source).writes.flatMap((write) => write.table === null ? [] : [write.table])
-      )
+      bodies.flatMap((body) => {
+        const scanned = bodyWrites(body.source);
+        return [
+          ...scanned.writes.flatMap((write) => write.table === null ? [] : [write.table]),
+          ...scanned.deletes.flatMap((table) => table === null ? [] : [table])
+        ];
+      })
     )
   ];
 }
@@ -52909,7 +53251,7 @@ function writeFindings(declaration, bodies, tables) {
   const byTable = /* @__PURE__ */ new Map();
   const findings = [];
   const unresolved = [];
-  for (const [key, entries2] of Object.entries(declaration)) {
+  for (const [key, entries2] of Object.entries(declaration.writes)) {
     const table = declaredTable(aliased, key);
     if (table === void 0) {
       unresolved.push(key);
@@ -52930,6 +53272,12 @@ function writeFindings(declaration, bodies, tables) {
     }
     byTable.set(table.table.id, fields);
   }
+  const removable = /* @__PURE__ */ new Set();
+  for (const key of declaration.deletes) {
+    const table = declaredTable(aliased, key);
+    if (table === void 0) unresolved.push(key);
+    else removable.add(table.table.id);
+  }
   const anyDeclared = new Set([...byTable.values()].flatMap((fields) => [...fields]));
   const labelById = new Map(aliased.map((table) => [table.table.id, table.table.name]));
   const unknownTools = /* @__PURE__ */ new Set();
@@ -52937,6 +53285,17 @@ function writeFindings(declaration, bodies, tables) {
     const named3 = /* @__PURE__ */ new Set();
     const scanned = bodyWrites(body.source);
     for (const tool of scanned.unknownTools) unknownTools.add(tool);
+    const taken = /* @__PURE__ */ new Set();
+    for (const removed of scanned.deletes) {
+      if (removed === null ? removable.size > 0 : removable.has(removed)) continue;
+      if (taken.has(removed)) continue;
+      taken.add(removed);
+      const table = removed === null ? null : labelById.get(removed) ?? removed;
+      findings.push({
+        where: body.alias,
+        message: `${body.alias} deletes rows${table === null ? "" : ` of ${table}`}, which package.json#lotics.deletes does not declare.`
+      });
+    }
     for (const write of scanned.writes) {
       const declared = write.table === null ? anyDeclared : byTable.get(write.table) ?? /* @__PURE__ */ new Set();
       if (declared.has(write.field)) continue;
@@ -53107,6 +53466,18 @@ function createAlias(entity) {
 function importAlias(entity) {
   return `import_${entity}`;
 }
+function removeAlias(entity) {
+  return `remove_${entity}`;
+}
+function destinationsQueryAlias(entity) {
+  return `${entity}_destinations`;
+}
+function placedQueryAlias(child) {
+  return `${child}_in_view`;
+}
+function destinationColumnAlias(party, column) {
+  return `${party}_${column}`;
+}
 
 // src/plan_bind.ts
 var CARDINAL_TYPES = /* @__PURE__ */ new Set(["select", "select_member"]);
@@ -53140,7 +53511,10 @@ var WORDS = {
       offered: (target) => `Not one of the ${target.toLowerCase()} this may point at.`,
       mint: (target, label) => `Nothing in ${target} matches: give a ${label.toLowerCase()} to open a new one.`,
       opened: (entity) => `Opened one row of ${entity}.`,
-      updated: (entity) => `Changed one row of ${entity}.`
+      updated: (entity) => `Changed one row of ${entity}.`,
+      withdrawn: (entity) => `Took one row of ${entity} back.`,
+      sent: "This one has already gone out, so it cannot be taken back.",
+      placed: (destination) => `This one is already on that ${destination.toLowerCase()}.`
     },
     verbs: {
       open: (entity) => `New ${entity}`,
@@ -53154,7 +53528,9 @@ var WORDS = {
       record: (entity, screen) => `One row of ${entity} by id \u2014 the record page the "${screen}" screen opens.`,
       picker: (table, column) => `The ${table} a "${column}" may point at, narrowed by what the reader typed.`,
       children: (child, parent, link) => `The ${child} that name one ${parent} through "${link}".`,
-      history: (child, parent) => `The ${child} of one row of ${parent}, latest first.`
+      history: (child, parent) => `The ${child} of one row of ${parent}, latest first.`,
+      destinations: (destination) => `Every row of ${destination} a post can be sent to, by name.`,
+      placed: (child, parent) => `The ${child} of the ${parent} rows named \u2014 where each of them has already been sent.`
     }
   },
   diacritics: {
@@ -53168,7 +53544,10 @@ var WORDS = {
       offered: (target) => `D\xF2ng ${target.toLowerCase()} n\xE0y kh\xF4ng n\u1EB1m trong danh s\xE1ch \u0111\u01B0\u1EE3c ch\u1ECDn.`,
       mint: (target, label) => `Kh\xF4ng c\xF3 ${target.toLowerCase()} n\xE0o kh\u1EDBp: nh\u1EADp ${label.toLowerCase()} \u0111\u1EC3 m\u1EDF m\u1EDBi.`,
       opened: (entity) => `\u0110\xE3 m\u1EDF m\u1ED9t d\xF2ng ${entity}.`,
-      updated: (entity) => `\u0110\xE3 s\u1EEDa m\u1ED9t d\xF2ng ${entity}.`
+      updated: (entity) => `\u0110\xE3 s\u1EEDa m\u1ED9t d\xF2ng ${entity}.`,
+      withdrawn: (entity) => `\u0110\xE3 r\xFAt l\u1EA1i m\u1ED9t d\xF2ng ${entity}.`,
+      sent: "M\u1EE5c n\xE0y \u0111\xE3 g\u1EEDi \u0111i r\u1ED3i n\xEAn kh\xF4ng r\xFAt l\u1EA1i \u0111\u01B0\u1EE3c.",
+      placed: (destination) => `M\u1EE5c n\xE0y \u0111\xE3 n\u1EB1m \u1EDF ${destination.toLowerCase()} \u0111\xF3 r\u1ED3i.`
     },
     verbs: {
       open: (entity) => `${entity} m\u1EDBi`,
@@ -53182,7 +53561,9 @@ var WORDS = {
       record: (entity, screen) => `M\u1ED9t d\xF2ng ${entity} theo id \u2014 trang b\u1EA3n ghi m\xE0 m\xE0n h\xECnh "${screen}" m\u1EDF.`,
       picker: (table, column) => `C\xE1c ${table} m\xE0 "${column}" c\xF3 th\u1EC3 tr\u1ECF t\u1EDBi, thu h\u1EB9p theo ch\u1EEF ng\u01B0\u1EDDi xem g\xF5.`,
       children: (child, parent, link) => `C\xE1c ${child} g\u1EAFn v\u1EDBi m\u1ED9t ${parent} qua "${link}".`,
-      history: (child, parent) => `${child} c\u1EE7a m\u1ED9t d\xF2ng ${parent}, m\u1EDBi nh\u1EA5t tr\u01B0\u1EDBc.`
+      history: (child, parent) => `${child} c\u1EE7a m\u1ED9t d\xF2ng ${parent}, m\u1EDBi nh\u1EA5t tr\u01B0\u1EDBc.`,
+      destinations: (destination) => `M\u1ECDi d\xF2ng ${destination} m\xE0 m\u1ED9t b\xE0i c\xF3 th\u1EC3 g\u1EEDi t\u1EDBi, theo t\xEAn.`,
+      placed: (child, parent) => `C\xE1c ${child} c\u1EE7a nh\u1EEFng d\xF2ng ${parent} \u0111\u01B0\u1EE3c n\xEAu \u2014 n\u01A1i m\u1ED7i d\xF2ng \u0111\xE3 \u0111\u01B0\u1EE3c g\u1EEDi t\u1EDBi.`
     }
   }
 };
@@ -53247,6 +53628,135 @@ function tableIndex(aliased) {
 function fieldIndex(table) {
   return liveIndex(table.fields, { id: (candidate) => candidate.field.id, label: (candidate) => candidate.field.name });
 }
+function publishDraw(screen, child) {
+  const clause = screen.screen.sections?.[child];
+  return clause?.draw === "publish" ? clause : void 0;
+}
+function publishReads(child, clause) {
+  const named3 = [clause.text, clause.permalink, clause.error].filter((alias) => alias !== void 0);
+  return child.fields.filter((field) => named3.includes(field.alias));
+}
+function bindPublish(args) {
+  const { at: at2, clause, screen, child, childFields, ownFields, entities, roles, aliased, live, binding, scopeOf, missing } = args;
+  const roleField = (owner, role) => owner.fields.find((field) => roleOf(roles, owner.alias, field.alias)?.role === role);
+  const party = child.fields.find(
+    (field) => field.type === "select_record_link" && roleOf(roles, child.alias, field.alias)?.role === "party"
+  );
+  const stageField = roleField(child, "lifecycle");
+  const target = party?.type === "select_record_link" ? entities.find((one) => one.alias === party.target_entity) : void 0;
+  const partyBound = party === void 0 ? void 0 : childFields.get(party.alias);
+  const stage = stageField === void 0 ? void 0 : childFields.get(stageField.alias);
+  if (party === void 0 || target === void 0 || partyBound === void 0 || stage === void 0) {
+    missing.push(`${at2}: "${child.label}" is drawn as a publish desk and states no destination \u2014 declare its link to the destination entity as a "party"`);
+    return void 0;
+  }
+  const states = Object.fromEntries(
+    Object.entries(clause.states).flatMap(([state, alias]) => {
+      const option = stage.options?.get(alias);
+      return option === void 0 ? [] : [[state, option.id]];
+    })
+  );
+  if (states.queued === void 0 || states.published === void 0 || states.failed === void 0 || states.by_hand === void 0) {
+    missing.push(`${at2}: "${stage.label}" carries no option for ${Object.keys(clause.states).filter((state) => states[state] === void 0).join(", ")}`);
+    return void 0;
+  }
+  const identity = roleField(target, "identity");
+  if (identity === void 0) {
+    missing.push(`${at2}: "${target.label}" names no row of itself \u2014 a destination's chip is its own name, so it declares an "identity"`);
+    return void 0;
+  }
+  const contacts = target.fields.filter((field) => roleOf(roles, target.alias, field.alias)?.role === "contact");
+  const contact = contacts.find((field) => field.type === "text" && field.format === "link") ?? contacts[0];
+  const mark = roleField(target, "mark");
+  const group = roleField(target, "category");
+  const named3 = (alias) => alias === void 0 ? void 0 : target.fields.find((field) => field.alias === alias);
+  const language = typeof clause.destination.bodies === "string" ? void 0 : named3(clause.destination.bodies.field);
+  const scoped = new Set((target.read_scope?.any ?? []).flatMap((one) => "field" in one ? [one.field] : []));
+  const wanted2 = [
+    identity,
+    mark,
+    contact,
+    group,
+    named3(clause.destination.network.field),
+    named3(clause.destination.connected),
+    named3(clause.destination.offered?.field),
+    language,
+    ...target.fields.filter((field) => scoped.has(field.alias))
+  ].filter((field) => field !== void 0);
+  const found = bindTable(`${at2}.${target.alias}`, target, entities, roles, wanted2, aliased, live, missing, binding);
+  if (found === void 0) return void 0;
+  const network = found.fields.get(clause.destination.network.field);
+  const identityBound = found.fields.get(identity.alias);
+  if (network === void 0 || identityBound === void 0) return void 0;
+  const bindOptions = (field, declared) => Object.fromEntries(
+    Object.entries(declared).flatMap(([alias, value]) => {
+      const option = field.options?.get(alias);
+      return option === void 0 ? [] : [[option.id, value]];
+    })
+  );
+  const offeredField = clause.destination.offered === void 0 ? void 0 : found.fields.get(clause.destination.offered.field);
+  const languageField = language === void 0 ? void 0 : found.fields.get(language.alias);
+  const bodyAliases = publishBodies(clause);
+  const bodies = bodyAliases.flatMap((alias) => {
+    const bound = ownFields.get(alias);
+    return bound === void 0 ? [] : [bound];
+  });
+  if (bodies.length === 0) {
+    missing.push(`${at2}: none of the bodies "${bodyAliases.join(", ")}" is a column of "${screen.entity.label}"`);
+    return void 0;
+  }
+  const media = roleField(screen.entity, "mark");
+  const mediaBound = media === void 0 || media.type !== "files" ? void 0 : ownFields.get(media.alias);
+  const link = clause.link === void 0 ? void 0 : ownFields.get(clause.link);
+  const optional2 = (alias) => alias === void 0 ? void 0 : childFields.get(alias);
+  const when = roleField(child, "when");
+  const whenBound = when === void 0 ? void 0 : childFields.get(when.alias);
+  const textBound = optional2(clause.text);
+  const permalinkBound = optional2(clause.permalink);
+  const errorBound = optional2(clause.error);
+  const markBound = mark === void 0 ? void 0 : found.fields.get(mark.alias);
+  const contactBound = contact === void 0 ? void 0 : found.fields.get(contact.alias);
+  const groupBound = group === void 0 ? void 0 : found.fields.get(group.alias);
+  const connectedBound = clause.destination.connected === void 0 ? void 0 : found.fields.get(clause.destination.connected);
+  const rule = scopeOf(target, found);
+  return {
+    party: partyBound,
+    stage,
+    states: { queued: states.queued, published: states.published, failed: states.failed, by_hand: states.by_hand },
+    ...whenBound === void 0 ? {} : { when: whenBound },
+    ...textBound === void 0 ? {} : { text: textBound },
+    ...permalinkBound === void 0 ? {} : { permalink: permalinkBound },
+    ...errorBound === void 0 ? {} : { error: errorBound },
+    destination: {
+      entity: target,
+      table: found.table,
+      tableAlias: found.tableAlias,
+      alias: destinationsQueryAlias(target.alias),
+      fields: found.fields,
+      identity: identityBound,
+      ...markBound === void 0 ? {} : { mark: markBound },
+      ...contactBound === void 0 ? {} : { contact: contactBound },
+      ...groupBound === void 0 ? {} : { group: groupBound },
+      network: { field: network, options: bindOptions(network, clause.destination.network.options) },
+      ...connectedBound === void 0 ? {} : { connected: connectedBound },
+      ...clause.destination.offered === void 0 || offeredField === void 0 ? {} : {
+        offered: {
+          field: offeredField,
+          in: clause.destination.offered.in.flatMap((alias) => {
+            const option = offeredField.options?.get(alias);
+            return option === void 0 ? [] : [option.id];
+          })
+        }
+      },
+      ...typeof clause.destination.bodies === "string" || languageField === void 0 ? {} : { language: { field: languageField, options: bindOptions(languageField, clause.destination.bodies.options) } },
+      ...rule === void 0 ? {} : { scope: rule }
+    },
+    bodies,
+    ...mediaBound === void 0 ? {} : { media: mediaBound },
+    ...link === void 0 ? {} : { link },
+    publish: clause.publish
+  };
+}
 function bindTable(at2, entity, entities, roles, wanted2, aliased, live, missing, binding) {
   const bound = binding?.entities[entity.alias];
   const named3 = bindAlias(bound?.table, entity.label, tableIndex(aliased));
@@ -53640,7 +54150,8 @@ function bindScreen(screen, live, roles, entities, rules, groups = /* @__PURE__
         );
         return;
       }
-      const itinerary = draw === "open" ? recordItinerary(archetype, step, child, roles, screen2.screen.sections) : void 0;
+      const desk = publishDraw(screen2, child.alias);
+      const itinerary = draw === "open" && desk === void 0 ? recordItinerary(archetype, step, child, roles, screen2.screen.sections) : void 0;
       const route = routeOf(child, roles);
       const goes = route !== void 0 && drawn.some((field) => field.alias === route.from.alias);
       const operandAliases = /* @__PURE__ */ new Set([
@@ -53709,6 +54220,7 @@ function bindScreen(screen, live, roles, entities, rules, groups = /* @__PURE__
         const boundField = found.fields.get(field.alias);
         if (boundField !== void 0 && !fields.has(field.alias)) operands.set(field.alias, boundField);
       }
+      const publish = desk === void 0 ? void 0 : bindPublish({ at: at2, clause: desk, screen: screen2, child, childFields: found.fields, ownFields: own.fields, entities, roles, aliased, live, binding, scopeOf, missing });
       const scope2 = scopeOf(child, found);
       const logged = entry2.section.kind === "journal" ? entry2.section.when : void 0;
       const when = logged ?? childWhen(child, roles);
@@ -53744,7 +54256,8 @@ function bindScreen(screen, live, roles, entities, rules, groups = /* @__PURE__
         ...itinerary === void 0 ? {} : { itinerary },
         ...scope2 === void 0 ? {} : { scope: scope2 },
         ...order === void 0 ? {} : { order },
-        ...surface === void 0 ? {} : { surface }
+        ...surface === void 0 ? {} : { surface },
+        ...publish === void 0 ? {} : { publish }
       });
     };
     for (const entry2 of sections) {
@@ -53777,6 +54290,11 @@ function bindScreen(screen, live, roles, entities, rules, groups = /* @__PURE__
       }
       if (section.kind === "children") {
         const drawn = drawnColumns2(section.child, section.fields, roles);
+        const desk = publishDraw(screen2, section.child.alias);
+        if (desk !== void 0) {
+          bindChild(entry2, drawn, void 0, void 0, void 0, publishReads(section.child, desk));
+          continue;
+        }
         if (drawn.length > 0) {
           bindChild(entry2, drawn);
           continue;
@@ -53868,23 +54386,6 @@ function bindScreen(screen, live, roles, entities, rules, groups = /* @__PURE__
   };
   return { bound: bindOne(screen, screen.app.alias, true), missing };
 }
-var STATED_FIELD_TYPES = [
-  "text",
-  "number",
-  "date",
-  "boolean",
-  "select",
-  "select_record_link",
-  "files"
-];
-function isEditable(field) {
-  if (isComputedFieldType(field.type)) return false;
-  if (field.type === "select_record_link") return field.cardinality === "one";
-  return STATED_FIELD_TYPES.includes(field.type);
-}
-function isAsked(field) {
-  return isEditable(field) || field.type === "select_member";
-}
 function stated(entry, field) {
   return field.type === "select_record_link" ? entry.links.has(field.alias) : isEditable(field);
 }
@@ -53892,8 +54393,8 @@ function factLinkTargets(screen, sections, entities, roles, owns) {
   if (!writesRecord(screen.screen.writes) || !owns) return [];
   return sections.flatMap((section) => section.kind === "facts" ? section.fields : []).flatMap((field) => linkTarget2(field, entities, roles));
 }
-function linkTarget2(field, entities, roles) {
-  if (field.type !== "select_record_link" || !isEditable(field)) return [];
+function linkTarget2(field, entities, roles, stands = false) {
+  if (field.type !== "select_record_link" || !(isEditable(field) || stands)) return [];
   const target = entities.find((candidate) => candidate.alias === field.target_entity);
   if (target === void 0) return [];
   const named3 = field.display_field_aliases?.[0];
@@ -53902,7 +54403,9 @@ function linkTarget2(field, entities, roles) {
 }
 function createLinkTargets(screen, entities, roles, owns, under) {
   if (!writesRecord(screen.screen.writes) || !owns) return [];
-  return screen.entity.fields.flatMap((field) => field.alias === under?.alias ? [] : linkTarget2(field, entities, roles));
+  return screen.entity.fields.flatMap(
+    (field) => field.alias === under?.alias ? [] : linkTarget2(field, entities, roles, standsOnLink(field, screen.entity, roles))
+  );
 }
 function mintedWith(target, display, keys2) {
   const keyed = new Set(keys2.map((field) => field.alias));
@@ -53953,6 +54456,16 @@ function appSurfaces(entry) {
   for (const surface of reached) if (!surfaces.has(surface.screen.entity.alias)) surfaces.set(surface.screen.entity.alias, surface);
   return [...surfaces.values()];
 }
+function publishDesks(entry) {
+  const drawn = (child) => child.publish !== void 0;
+  const desks = /* @__PURE__ */ new Map();
+  for (const surface of appSurfaces(entry)) {
+    for (const child of surface.children.values()) {
+      if (drawn(child) && !desks.has(child.entity.alias)) desks.set(child.entity.alias, child);
+    }
+  }
+  return [...desks.values()];
+}
 function appEditors(entry) {
   const editors = /* @__PURE__ */ new Map([[entry.screen.entity.alias, entry]]);
   const kept = [
@@ -53973,7 +54486,11 @@ function planWrites(entry) {
 function savedFields(entry) {
   if (!writesRecord(entry.screen.screen.writes)) return [];
   const banded = bandStated(entry).filter((field) => stated(entry, field));
-  return banded.concat(entry.sections.flatMap(({ section }) => {
+  const sent = new Set(
+    Object.values(entry.screen.screen.sections ?? {}).flatMap((clause) => clause.draw === "publish" ? publishBodies(clause) : [])
+  );
+  const bodies = entry.screen.entity.fields.filter((field) => sent.has(field.alias) && stated(entry, field));
+  return banded.concat(bodies).concat(entry.sections.flatMap(({ section }) => {
     if (section.kind === "facts") return section.fields.filter((field) => stated(entry, field));
     if (section.kind === "progress") return [section.field];
     if (section.kind === "prose") return stated(entry, section.field) ? [section.field] : [];
@@ -54046,6 +54563,16 @@ function projection(fields) {
 function unique2(fields) {
   return [...new Map(fields.map((field) => [field.alias, field])).values()];
 }
+function destinationReadings(desk) {
+  const across = (column, type) => column === void 0 ? [] : [
+    {
+      output: destinationColumnAlias(desk.party.alias, column.alias),
+      type,
+      source: { link: { source: desk.party.id, field: column.id } }
+    }
+  ];
+  return [...across(desk.destination.mark, "files"), ...across(desk.destination.network.field, "select")];
+}
 function planQueries(entry) {
   const queries = {};
   const inbound = registerFilters(entry);
@@ -54120,6 +54647,32 @@ function planQueries(entry) {
       description: entry.words.queries.picker(subject.table.name, subject.display.label)
     };
   }
+  const desk = [...entry.children.values()].find((child) => child.publish !== void 0);
+  if (desk?.publish !== void 0) {
+    const page = recordsParam(entry.screen.entity.alias);
+    queries[placedQueryAlias(desk.entity.alias)] = {
+      ast: {
+        kind: "project",
+        from: {
+          kind: "from_table",
+          table_id: desk.table.id,
+          filter: withScope(
+            {
+              node_type: "condition",
+              type: "select_record_link",
+              field_key: desk.link.id,
+              operator: "has_any_of",
+              value: `{{params.${page}}}`
+            },
+            desk.scope
+          )
+        },
+        columns: [...projection(unique2([...desk.fields.values(), ...desk.operands.values()])), ...destinationReadings(desk.publish)]
+      },
+      params: { [page]: { type: "record_link", table_id: entry.table.id, multi: true, required: true } },
+      description: entry.words.queries.placed(desk.entity.label, entry.screen.entity.label)
+    };
+  }
   recordRead(queries, entry, picked, subject);
   surfaceReads(queries, entry);
   for (const party of entry.parties.values()) {
@@ -54219,6 +54772,33 @@ function surfaceReads(queries, entry) {
       params: { [child.param]: { type: "record_link", table_id: entry.table.id } },
       description: child.section === "progress" ? entry.words.queries.history(child.entity.label, entry.screen.entity.label) : entry.words.queries.children(child.entity.label, entry.screen.entity.label, child.link.label)
     };
+    const desk = child.publish;
+    if (desk !== void 0 && queries[desk.destination.alias] === void 0) {
+      const offered = desk.destination.offered;
+      const filter2 = withScope(
+        offered === void 0 ? void 0 : {
+          node_type: "condition",
+          type: "select",
+          field_key: offered.field.id,
+          operator: "has_any_of",
+          value: [...offered.in]
+        },
+        desk.destination.scope
+      );
+      queries[desk.destination.alias] = {
+        ast: {
+          kind: "project",
+          from: {
+            kind: "from_table",
+            table_id: desk.destination.table.id,
+            sort: [{ field_key: desk.destination.identity.id, order: "asc" }],
+            ...filter2 === void 0 ? {} : { filter: filter2 }
+          },
+          columns: projection([...desk.destination.fields.values()])
+        },
+        description: entry.words.queries.destinations(desk.destination.entity.label)
+      };
+    }
     if (child.surface !== void 0) surfaceReads(queries, child.surface);
   }
 }
@@ -54291,6 +54871,14 @@ var specFieldSchema = zod_default.object({
   format: textFormatSchema.optional(),
   /** A select or a link that holds SEVERAL — read as a list, never re-pointed by a picker. */
   multi: zod_default.literal(true).optional(),
+  /**
+   * A DATE THE WORKSPACE STAMPS from the row's own time — the model's own key,
+   * carried so `isPlatformWrittenField` answers over a spec field exactly as
+   * the server's write path answers over the table's: the type alone reads as
+   * a date somebody states, and an editor offered on it commits a save the
+   * server refuses.
+   */
+  derive_from: zod_default.enum(["created_at", "updated_at"]).optional(),
   /**
    * THE RECORD THIS COLUMN'S NAME IS A DOOR ONTO — a key of `records`, where
    * this app opens the record of the entity the link points at.
@@ -54361,6 +54949,7 @@ var specActWhenSchema = zod_default.strictObject({
   field: specColumnAliasSchema,
   in: zod_default.array(specOptionIdSchema)
 }).describe("The act stands down unless this column holds one of these options");
+var specActConfirmSchema = zod_default.literal(true);
 var specTemplateActSchema = zod_default.object({
   kind: zod_default.literal("template"),
   label: zod_default.string().min(1),
@@ -54371,6 +54960,7 @@ var specTemplateActSchema = zod_default.object({
   input: zod_default.string().min(1),
   place: specActPlaceSchema.optional(),
   when: specActWhenSchema.optional(),
+  confirm: specActConfirmSchema.optional(),
   /**
    * WHAT THE PRESS OPENS INSTEAD OF RUNNING — one of the app's own components,
    * drawn in a panel the runtime owns, handed the act and the rows it was
@@ -54398,7 +54988,8 @@ var specAgentActSchema = zod_default.object({
   /** The columns of this surface the run may write, in the order the act named them. */
   fills: zod_default.array(specColumnAliasSchema).min(1),
   place: specActPlaceSchema.optional(),
-  when: specActWhenSchema.optional()
+  when: specActWhenSchema.optional(),
+  confirm: specActConfirmSchema.optional()
 }).strict();
 var RECORD_ID_COLUMN = "__source_record_id";
 var specActInputSchema = zod_default.object({
@@ -54415,7 +55006,8 @@ var specWorkflowActSchema = zod_default.object({
   /** What the press hands the run, in the order the act named them. */
   inputs: zod_default.array(specActInputSchema).min(1),
   place: specActPlaceSchema.optional(),
-  when: specActWhenSchema.optional()
+  when: specActWhenSchema.optional(),
+  confirm: specActConfirmSchema.optional()
 }).strict();
 var specActSchema = zod_default.discriminatedUnion("kind", [specTemplateActSchema, specAgentActSchema, specWorkflowActSchema]);
 var specColumnsExportSchema = zod_default.object({
@@ -54589,6 +55181,30 @@ var specObligationSchema = zod_default.object({
    */
   satisfiedBy: specColumnAliasSchema.optional()
 }).strict();
+var specPublishStatesSchema = zod_default.strictObject({
+  queued: specOptionIdSchema,
+  published: specOptionIdSchema,
+  failed: specOptionIdSchema,
+  by_hand: specOptionIdSchema
+}).describe("The child's stages the desk reads, bound");
+var specDestinationsSchema = zod_default.object({
+  /** The read, and the param it takes the page's rows by. */
+  query: runtimeAliasSchema,
+  param: zod_default.string().min(1),
+  /** The child entity whose rows these are. */
+  child: contractAliasSchema,
+  /** The column on them that names the register's row — what groups the answer. */
+  link: specColumnAliasSchema,
+  /** The column that names the destination — what each mark is called. */
+  party: specColumnAliasSchema,
+  /** Where each stands, and the four stages its dot reads it as. */
+  stage: specColumnAliasSchema,
+  states: specPublishStatesSchema,
+  /** The destination's face, where the child's own row carries a reading of it. */
+  mark: specColumnAliasSchema.optional(),
+  /** Its network, where the child's own row carries a reading of that. */
+  network: zod_default.strictObject({ field: specColumnAliasSchema, options: zod_default.record(specOptionIdSchema, zod_default.enum(SOCIAL_NETWORKS)) }).optional()
+}).strict();
 var specScreenSchema = zod_default.object({
   alias: contractAliasSchema,
   label: zod_default.string().min(1),
@@ -54639,6 +55255,8 @@ var specScreenSchema = zod_default.object({
   period: specColumnAliasSchema.optional(),
   /** Where the register is read a day at a time — the day, and where in it a row sits. */
   runs: zod_default.object({ day: specColumnAliasSchema, slot: specColumnAliasSchema }).strict().optional(),
+  /** Where the rows in view have already gone, where the record they open carries a publish desk. */
+  destinations: specDestinationsSchema.optional(),
   /** The key a row is filed under, under the name a person calls it by. */
   caption: specColumnAliasSchema.optional(),
   /** What a clerk types to find a row — joined, in this order. */
@@ -54833,7 +55451,25 @@ var specChildSchema = zod_default.object({
    * DRAWN ON: a section that marks one of its own rows is writing the child,
    * and the surface's own save would have sent the field to the parent.
    */
-  write: zod_default.object({ alias: runtimeAliasSchema, param: zod_default.string().min(1) }).strict().optional()
+  write: zod_default.object({ alias: runtimeAliasSchema, param: zod_default.string().min(1) }).strict().optional(),
+  /**
+   * THE WORKFLOW ONE OF THESE ROWS IS OPENED THROUGH, where the section adds a
+   * row without a panel to collect it — the param names the record it hangs
+   * under, and everything else about the draft the section already knows.
+   *
+   * A section that ASKS carries its create in `creates` instead, mounted on
+   * this section's key: the panel is the statement there, and two of them
+   * would be two ways to open one row.
+   */
+  create: zod_default.object({ alias: runtimeAliasSchema, param: zod_default.string().min(1) }).strict().optional(),
+  /**
+   * THE WORKFLOW ONE OF THESE ROWS IS WITHDRAWN THROUGH, where the section can
+   * take one back — the param names the row.
+   *
+   * The BODY refuses the row it may not take: a delete offered on a surface
+   * and refused nowhere else is a press that removes what already happened.
+   */
+  remove: zod_default.object({ alias: runtimeAliasSchema, param: zod_default.string().min(1) }).strict().optional()
 }).strict();
 var specPricedChildSchema = specChildSchema.extend({ worksheet: specWorksheetSchema });
 var specProgressHistorySchema = zod_default.strictObject({
@@ -54861,6 +55497,28 @@ var specProgressHistorySchema = zod_default.strictObject({
 }).describe("The dated stage changes behind this ladder");
 var specProgressPhaseSchema = zod_default.strictObject({ label: zod_default.string().min(1), stages: zod_default.array(specOptionIdSchema).min(1) }).describe("One part of the flow and the stages under it");
 var sectionActs = { acts: zod_default.array(specActSchema).min(1).optional() };
+var specPublishDestinationSchema = zod_default.object({
+  entity: contractAliasSchema,
+  table: specTableIdSchema,
+  query: runtimeAliasSchema,
+  fields: specFieldsSchema,
+  /** What a chip is called. */
+  identity: specColumnAliasSchema,
+  /** Its face, where the destination keeps one. */
+  mark: specColumnAliasSchema.optional(),
+  /** Where a post put there by hand is pasted. */
+  contact: specColumnAliasSchema.optional(),
+  /** What the strip folds the chips under — the destination's own kind. */
+  group: specColumnAliasSchema.optional(),
+  /** Which destinations the platform can reach, and as which network's feed. */
+  network: zod_default.strictObject({ field: specColumnAliasSchema, options: zod_default.record(specOptionIdSchema, zod_default.enum(SOCIAL_NETWORKS)) }).describe("An option this map leaves out is posted by hand"),
+  /** The account the platform posts as — empty means not connected. */
+  connected: specColumnAliasSchema.optional(),
+  /** Which rows the strip offers at all. */
+  offered: zod_default.strictObject({ field: specColumnAliasSchema, in: zod_default.array(specOptionIdSchema).min(1) }).optional(),
+  /** Which of THIS record's bodies each destination receives. */
+  language: zod_default.strictObject({ field: specColumnAliasSchema, options: zod_default.record(specOptionIdSchema, specColumnAliasSchema) }).optional()
+}).strict();
 var specSectionSchema = zod_default.discriminatedUnion("kind", [
   zod_default.object({
     kind: zod_default.literal("facts"),
@@ -54966,6 +55624,50 @@ var specSectionSchema = zod_default.discriminatedUnion("kind", [
       ...sectionActs
     }).strict()
   ]),
+  /**
+   * WHERE THIS RECORD GOES — one child row per destination it stands on, drawn
+   * as the strip of destinations rather than as a register of those rows.
+   *
+   * A register of them would be the same record listed N times with a stage
+   * beside it. What a reader wants is the opposite reading: every destination
+   * they COULD go to, each wearing what has happened there — so the section is
+   * over the destination table, and the child's rows are the state on it.
+   */
+  zod_default.object({
+    kind: zod_default.literal("publish"),
+    key: zod_default.string().min(1),
+    heading: zod_default.string().min(1),
+    child: specChildSchema,
+    /** The column of those rows that names the destination — what ties one to its chip. */
+    party: specColumnAliasSchema,
+    /** Where each stands, and the four stages the chip reads it as. */
+    stage: specColumnAliasSchema,
+    states: specPublishStatesSchema,
+    /** When it went out. */
+    when: specColumnAliasSchema.optional(),
+    /** What this one destination goes out with instead of the body. */
+    text: specColumnAliasSchema.optional(),
+    /** Where it landed, and what the platform said when it would not take it. */
+    permalink: specColumnAliasSchema.optional(),
+    error: specColumnAliasSchema.optional(),
+    destination: specPublishDestinationSchema,
+    /** THIS record's own text columns, in the clause's order — what goes out, and the prose the record draws above the desk. */
+    bodies: zod_default.array(specColumnAliasSchema).min(1),
+    /** The pile the post carries. */
+    media: specColumnAliasSchema.optional(),
+    /** The address it carries as its card. */
+    link: specColumnAliasSchema.optional(),
+    /**
+     * THE ONE PRESS THAT SENDS THEM — the alias the APP binds, the input that
+     * names this record, and the input that names the destinations being sent.
+     *
+     * The body is the author's: what each platform accepts is the business's
+     * own arrangement with it, so the generator writes none and `lotics app
+     * check` refuses an alias nothing bound.
+     */
+    publish: zod_default.strictObject({ workflow: runtimeAliasSchema, param: zod_default.string().min(1), rows: zod_default.string().min(1) }),
+    ...sectionActs
+  }).strict(),
   /**
    * WHERE THE RECORD IS AGAINST WHERE IT SHOULD BE — a child whose rows are the
    * ordered stops, each carrying the day it was promised for and the day it
@@ -55059,6 +55761,7 @@ function sectionChild2(section) {
   switch (section.kind) {
     case "children":
     case "desk":
+    case "publish":
     case "timeline":
     case "thread":
     case "journal":
@@ -55204,11 +55907,18 @@ function referencedComponents(spec) {
 function specQueryAliases(spec) {
   const children = (record2) => record2.sections.flatMap((section) => {
     const child = sectionChild2(section);
-    return child === void 0 ? [] : [child.query];
+    return [
+      ...child === void 0 ? [] : [child.query],
+      // A PUBLISH DESK READS A SECOND TABLE: the destinations it OFFERS, which
+      // are not the rows the child answers with and have no other reader.
+      ...section.kind === "publish" ? [section.destination.query] : []
+    ];
   });
   return [
     .../* @__PURE__ */ new Set([
       spec.screen.query,
+      // …AND SO DOES THE REGISTER, for the marks each row wears.
+      ...spec.screen.destinations === void 0 ? [] : [spec.screen.destinations.query],
       ...spec.scope === void 0 ? [] : [spec.scope.query],
       ...Object.values(spec.records).flatMap((record2) => [
         record2.options,
@@ -55302,7 +56012,16 @@ function specWorkflowAliases(spec) {
         // marks its answer through.
         ...record2.sections.flatMap((section) => {
           const child = sectionChild2(section);
-          return child?.write === void 0 ? [] : [child.write.alias];
+          return [
+            ...child?.write === void 0 ? [] : [child.write.alias],
+            // …AND THE TWO A SECTION THAT OPENS AND WITHDRAWS ITS OWN ROWS calls
+            // with no panel in between — a publish desk's chip, pressed on and
+            // pressed off.
+            ...child?.create === void 0 ? [] : [child.create.alias],
+            ...child?.remove === void 0 ? [] : [child.remove.alias],
+            // AND THE ONE THE DESK'S OWN BUTTON RUNS, which is the author's body.
+            ...section.kind === "publish" ? [section.publish.workflow] : []
+          ];
         })
       ]),
       ...(spec.creates ?? []).map((create) => create.workflow)
@@ -55336,24 +56055,6 @@ function captionField(entry, roles) {
 }
 
 // src/plan_creates.ts
-function filledLater(entry, roles) {
-  const entity = entry.screen.entity;
-  return new Set(
-    entity.fields.flatMap((field) => {
-      const decl = roleOf(roles, entity.alias, field.alias);
-      return decl?.role === "obligation" && decl.satisfied_by !== void 0 ? [decl.satisfied_by] : [];
-    })
-  );
-}
-function filledByBody(entry, roles, mounted) {
-  const filled = /* @__PURE__ */ new Set();
-  for (const field of entry.screen.entity.fields) {
-    const role = roleOf(roles, entry.screen.entity.alias, field.alias)?.role;
-    if (role === "lifecycle" || role === "parent" && mounted) filled.add(field.alias);
-    if (writeRuleOf(entry.rules, entry.screen.entity.alias, field.alias)?.default_from !== void 0) filled.add(field.alias);
-  }
-  return filled;
-}
 function planCreates(entry, roles) {
   if (!writesChildren(entry.screen.screen.writes)) return [];
   const plan = planWrites(entry) === void 0 ? void 0 : planCreate(entry, roles);
@@ -55392,7 +56093,7 @@ function childCreates(entry, roles) {
       ];
     }
     if (child.surface === void 0 || planWrites(child.surface) === void 0) return [];
-    const plan = planCreate(child.surface, roles, entry);
+    const plan = planCreate(child.surface, roles, entry, child.publish);
     return plan === void 0 ? [] : [plan];
   });
 }
@@ -55404,15 +56105,13 @@ function composedEntry(section) {
     ...section.fields.filter((field) => field.type === "select" && field.multi !== true && !asked.has(field.alias) && isEditable(field))
   ];
 }
-function planCreate(entry, roles, on = entry) {
+function planCreate(entry, roles, on = entry, desk) {
   const entity = entry.screen.entity;
-  const later = filledLater(entry, roles);
   const roleOfField = (field) => roleOf(roles, entity.alias, field.alias)?.role;
   const parentField = parentLink(entity, roles);
   const mountedOn = parentField !== void 0 && on.children.has(childKey(entity.alias, parentField.alias)) ? on : void 0;
   const parentBound = parentField === void 0 ? void 0 : entry.fields.get(parentField.alias);
   const parent = parentBound === void 0 || mountedOn === void 0 ? void 0 : { bound: parentBound, screen: mountedOn, param: recordParam(mountedOn.screen.entity.alias) };
-  const filled = filledByBody(entry, roles, parent !== void 0);
   const lifecycleField = entity.fields.find((field) => roleOfField(field) === "lifecycle");
   const lifecycleBound = lifecycleField === void 0 ? void 0 : entry.fields.get(lifecycleField.alias);
   const firstOption = lifecycleBound?.options === void 0 ? void 0 : [...lifecycleBound.options.values()][0];
@@ -55421,13 +56120,13 @@ function planCreate(entry, roles, on = entry) {
   const reads = /* @__PURE__ */ new Map();
   const unique3 = [];
   let party;
+  let queued;
   for (const field of entity.fields) {
     const fieldBound = entry.fields.get(field.alias);
     if (fieldBound === void 0) continue;
     const rule = writeRuleOf(entry.rules, entity.alias, field.alias);
-    if (!isAsked(field) || field.type === "files" || later.has(field.alias)) continue;
-    if (field.type === "text" && field.unique === true) unique3.push(fieldBound);
-    if (filled.has(field.alias)) {
+    const skipped = draftSkips(field, entity, roles, entry.rules);
+    if (skipped !== void 0) {
       if (rule?.default_from === void 0) continue;
       const [linkAlias, sourceAlias] = rule.default_from.split(".");
       const link2 = entry.createLinks.get(linkAlias);
@@ -55438,6 +56137,8 @@ function planCreate(entry, roles, on = entry) {
       reads.set(linkAlias, read2);
       continue;
     }
+    if (parent !== void 0 && field.alias === parentField?.alias) continue;
+    if (field.type === "text" && field.unique === true) unique3.push(fieldBound);
     if (field.type !== "select_record_link") {
       inputs.push({
         name: fieldBound.alias,
@@ -55455,7 +56156,7 @@ function planCreate(entry, roles, on = entry) {
     if ((link.where !== void 0 || link.scope !== void 0) && !reads.has(field.alias)) {
       reads.set(field.alias, { input: fieldBound.alias, local: `${camel(field.alias)}Row`, link, copies: [], where: link.where ?? [] });
     }
-    if (party === void 0 && roleOfField(field) === "party" && link.keys.length > 0) {
+    if (desk === void 0 && party === void 0 && roleOfField(field) === "party" && link.keys.length > 0) {
       party = { alias: field.alias, link, bound: fieldBound, local: `${camel(field.alias)}Id` };
       for (const key of link.keys) {
         inputs.push({
@@ -55481,7 +56182,7 @@ function planCreate(entry, roles, on = entry) {
       }
       continue;
     }
-    inputs.push({
+    const chosen = {
       name: fieldBound.alias,
       field,
       bound: fieldBound,
@@ -55490,18 +56191,26 @@ function planCreate(entry, roles, on = entry) {
       // mounts this act writes the parent on every row it opens, so the door
       // that has to ask cannot let one through without it — the register the
       // record's own section draws would never list it.
-      required: field.required === true || roleOfField(field) === "parent",
+      //
+      // …AND A CHIP STANDS ON A DESTINATION. The press IS the destination, so a
+      // desk's create that could open a row without one would queue a placement
+      // on nothing, which no strip can ever draw again.
+      required: field.required === true || roleOfField(field) === "parent" || desk !== void 0 && roleOfField(field) === "party",
       into: "row",
       link,
       ...rule === void 0 ? {} : { rule }
-    });
+    };
+    inputs.push(chosen);
+    if (desk !== void 0 && roleOfField(field) === "party") queued = chosen;
   }
-  if (inputs.length === 0) return void 0;
+  const asked = entry.screen.create;
+  const drafted = queued !== void 0 ? [queued] : asked.length === 0 ? [...inputs.filter((input) => input.required), ...inputs.filter((input) => !input.required)] : asked.flatMap((field) => inputs.filter((input) => input.field.alias === field.alias));
+  if (drafted.length === 0) return void 0;
   const section = parent === void 0 || parentField === void 0 ? void 0 : parent.screen.children.get(childKey(entity.alias, parentField.alias));
   const mount = section !== void 0 ? { kind: "section", key: sectionKey(entity.alias, section.linkAlias) } : shapeListsRows(entry.screen.screen.shape) ? { kind: "register" } : void 0;
   if (mount === void 0) return void 0;
   const run = section?.itinerary;
-  const day = run === void 0 ? void 0 : inputs.find((input) => input.link === void 0 && input.field.alias === run.when.alias)?.name;
+  const day = run === void 0 ? void 0 : drafted.find((input) => input.link === void 0 && input.field.alias === run.when.alias)?.name;
   return {
     entry,
     entity,
@@ -55511,11 +56220,14 @@ function planCreate(entry, roles, on = entry) {
     ...parent === void 0 ? {} : { parent },
     ...opening === void 0 ? {} : { opening },
     ...party === void 0 ? {} : { party },
-    reads: [...reads.values()],
+    ...queued === void 0 ? {} : { queued },
+    // THE ROWS THE BODY READS ARE THE ONES THE DRAFT NAMES. A desk's create
+    // takes the destination and nothing else, so a picker's narrowing or a
+    // copied default over a link nobody states would read a row by an input the
+    // workflow never declared.
+    reads: [...reads.values()].filter((read2) => queued === void 0 || read2.input === queued.name),
     unique: unique3,
-    // REQUIRED FIRST. A form is read top to bottom and the fields it cannot go
-    // without are the ones a person came to fill — the rest is what they may add.
-    inputs: [...inputs.filter((input) => input.required), ...inputs.filter((input) => !input.required)],
+    inputs: drafted,
     mount
   };
 }
@@ -55633,6 +56345,7 @@ function childRole(child, role) {
   return void 0;
 }
 function runOf(archetype, slot2, child) {
+  if (child.publish !== void 0) return void 0;
   const byDay = archetype === "work_record" && slot2 === "children";
   const byYear = archetype === "profile" && slot2 === "named_by";
   if (!byDay && !byYear) return void 0;
@@ -55692,6 +56405,7 @@ function specField(bound, declared, extras = {}) {
     ...bound.description === void 0 ? {} : { description: bound.description },
     ...bound.format === void 0 ? {} : { format: bound.format },
     ...multi ? { multi: true } : {},
+    ...declared?.type === "date" && declared.derive_from !== void 0 ? { derive_from: declared.derive_from } : {},
     ...extras.opens === void 0 ? {} : { opens: extras.opens },
     ...extras.route === void 0 ? {} : { route: extras.route },
     ...money === void 0 ? {} : { money },
@@ -55770,6 +56484,7 @@ function childExtras(child, roles) {
 }
 function boundAct(entry, templates, act, input) {
   const place = act.place === void 0 ? {} : { place: act.place };
+  const asks = act.confirm === true ? { confirm: true } : {};
   const gateField = act.when === void 0 ? void 0 : entry.fields.get(act.when.field.alias);
   const stands = gateField === void 0 ? {} : { when: { field: gateField.alias, in: optionIds(gateField, act.when?.in ?? []) } };
   if (act.kind === "workflow") {
@@ -55778,14 +56493,14 @@ function boundAct(entry, templates, act, input) {
       const bound = entry.fields.get(taken.field.alias);
       return bound === void 0 ? [] : [{ name: taken.name, field: bound.alias }];
     });
-    return inputs.length < act.inputs.length ? void 0 : { kind: "workflow", label: act.label, key: act.workflow, workflow: act.workflow, inputs, ...place, ...stands };
+    return inputs.length < act.inputs.length ? void 0 : { kind: "workflow", label: act.label, key: act.workflow, workflow: act.workflow, inputs, ...place, ...stands, ...asks };
   }
   if (act.kind === "agent") {
     const fills = act.fills.flatMap((field) => {
       const bound = entry.fields.get(field.alias);
       return bound === void 0 ? [] : [bound.alias];
     });
-    return fills.length === 0 ? void 0 : { kind: "agent", label: act.label, key: act.agent, agent: act.agent, fills, ...place, ...stands };
+    return fills.length === 0 ? void 0 : { kind: "agent", label: act.label, key: act.agent, agent: act.agent, fills, ...place, ...stands, ...asks };
   }
   return templates.has(act.template.alias) ? {
     kind: "template",
@@ -55794,7 +56509,8 @@ function boundAct(entry, templates, act, input) {
     workflow: generateAlias(act.template.alias),
     input,
     ...place,
-    ...stands
+    ...stands,
+    ...asks
   } : void 0;
 }
 function specRecordActs(entry, templates) {
@@ -56043,6 +56759,8 @@ function specScreen(entry, roles, templates, inbound) {
   const summary = specSummary(entry, roles);
   const tabs = ref(screen.tabs);
   const period = ref(screen.period);
+  const desk = [...entry.children.values()].find((child) => child.publish !== void 0);
+  const destinations = specDestinations(entry, desk);
   return {
     alias,
     label: screen.screen.label,
@@ -56065,6 +56783,7 @@ function specScreen(entry, roles, templates, inbound) {
     ...lenses.length === 0 ? {} : { lenses },
     ...period === void 0 ? {} : { period },
     ...runs === void 0 ? {} : { runs },
+    ...destinations === void 0 ? {} : { destinations },
     ...caption === void 0 ? {} : { caption },
     ...search.length === 0 ? {} : { search },
     ...summary === void 0 ? {} : { summary },
@@ -56074,6 +56793,22 @@ function specScreen(entry, roles, templates, inbound) {
     ...specPresentation(entry)
   };
 }
+function specDestinations(entry, desk) {
+  const publish = desk?.publish;
+  if (desk === void 0 || publish === void 0) return void 0;
+  const across = (column) => destinationColumnAlias(publish.party.alias, column.alias);
+  return {
+    query: placedQueryAlias(desk.entity.alias),
+    param: recordsParam(entry.screen.entity.alias),
+    child: desk.entity.alias,
+    link: desk.link.alias,
+    party: publish.party.alias,
+    stage: publish.stage.alias,
+    states: publish.states,
+    ...publish.destination.mark === void 0 ? {} : { mark: across(publish.destination.mark) },
+    network: { field: across(publish.destination.network.field), options: publish.destination.network.options }
+  };
+}
 function specPresentation(entry) {
   const stated3 = entry.screen.screen.presentation;
   if (stated3 === void 0 || Object.values(stated3).every((clause) => clause === void 0)) return {};
@@ -56188,7 +56923,15 @@ function specChild(child, roles, archetype, slot2, entry, expected) {
     ...files === void 0 ? {} : { files },
     ...owed === void 0 ? {} : { expected: owed },
     ...opens === void 0 ? {} : { opens },
-    ...written === void 0 ? {} : { write: { alias: writeAlias(written), param: recordParam(written) } }
+    ...written === void 0 ? {} : { write: { alias: writeAlias(written), param: recordParam(written) } },
+    // A SECTION THAT OPENS AND WITHDRAWS ITS OWN ROWS WITH NO PANEL — a publish
+    // desk, whose chip IS the draft: the destination is the whole of what a new
+    // row says, and a dialog asking for it again would be a second way to queue
+    // one.
+    ...child.publish === void 0 ? {} : {
+      create: { alias: createAlias(child.entity.alias), param: recordParam(entry.screen.entity.alias) },
+      remove: { alias: removeAlias(child.entity.alias), param: recordParam(child.entity.alias) }
+    }
   };
 }
 function specWorksheet(sheet) {
@@ -56360,6 +57103,59 @@ function specRecord(entry, roles, templates, register) {
       case "children": {
         const child = entry.children.get(childKey(section.child.alias, section.link.alias));
         if (child === void 0) break;
+        const desk = child.publish;
+        if (desk !== void 0) {
+          sections.push({
+            kind: "publish",
+            key: sectionKey(child.entity.alias, child.linkAlias),
+            heading: child.heading,
+            child: specChild(child, roles, archetype, slot2, entry, void 0),
+            party: desk.party.alias,
+            stage: desk.stage.alias,
+            states: desk.states,
+            ...desk.when === void 0 ? {} : { when: desk.when.alias },
+            ...desk.text === void 0 ? {} : { text: desk.text.alias },
+            ...desk.permalink === void 0 ? {} : { permalink: desk.permalink.alias },
+            ...desk.error === void 0 ? {} : { error: desk.error.alias },
+            destination: {
+              entity: desk.destination.entity.alias,
+              table: desk.destination.table.id,
+              query: desk.destination.alias,
+              fields: specFields(desk.destination.fields, desk.destination.entity.fields),
+              identity: desk.destination.identity.alias,
+              ...desk.destination.mark === void 0 ? {} : { mark: desk.destination.mark.alias },
+              ...desk.destination.contact === void 0 ? {} : { contact: desk.destination.contact.alias },
+              ...desk.destination.group === void 0 ? {} : { group: desk.destination.group.alias },
+              network: { field: desk.destination.network.field.alias, options: desk.destination.network.options },
+              ...desk.destination.connected === void 0 ? {} : { connected: desk.destination.connected.alias },
+              ...desk.destination.offered === void 0 ? {} : { offered: { field: desk.destination.offered.field.alias, in: [...desk.destination.offered.in] } },
+              ...desk.destination.language === void 0 ? {} : {
+                language: {
+                  field: desk.destination.language.field.alias,
+                  // THE BODY IS A COLUMN OF THIS RECORD, so the map's values
+                  // are rewritten from the model's aliases into the ones the
+                  // record's own read projects.
+                  options: Object.fromEntries(
+                    Object.entries(desk.destination.language.options).flatMap(([option, body]) => {
+                      const bound2 = entry.fields.get(body);
+                      return bound2 === void 0 ? [] : [[option, bound2.alias]];
+                    })
+                  )
+                }
+              }
+            },
+            bodies: desk.bodies.map((body) => body.alias),
+            ...desk.media === void 0 ? {} : { media: desk.media.alias },
+            ...desk.link === void 0 ? {} : { link: desk.link.alias },
+            publish: {
+              workflow: desk.publish,
+              param: recordParam(entity),
+              rows: recordsParam(child.entity.alias)
+            },
+            ...stands
+          });
+          break;
+        }
         const door = entry.mounts && child.entity.alias === register;
         if (draw === "related") {
           related.push({
@@ -56598,7 +57394,14 @@ function specCreate(plan) {
   };
 }
 function bindAppSpec(app, entry, roles, templates = /* @__PURE__ */ new Map()) {
-  const creates = planCreates(entry, roles);
+  const desks = new Set(
+    appSurfaces(entry).flatMap(
+      (surface) => [...surface.children.values()].flatMap(
+        (child) => child.publish === void 0 ? [] : [sectionKey(child.entity.alias, child.linkAlias)]
+      )
+    )
+  );
+  const creates = planCreates(entry, roles).filter((plan) => plan.mount.kind !== "section" || !desks.has(plan.mount.key));
   const screen = specScreen(entry, roles, templates, [...registerFilters(entry).keys()]);
   const records = appSurfaces(entry).map(
     (surface) => [surface.screen.entity.alias, specRecord(surface, roles, templates, entry.screen.entity.alias)]
@@ -56639,14 +57442,20 @@ var COMPONENTS_DIR = "src/components";
 var projectionSchema = zod_default.object({
   kind: zod_default.literal("project"),
   from: zod_default.object({ kind: zod_default.literal("from_table"), table_id: zod_default.string() }),
-  columns: zod_default.array(zod_default.union([zod_default.string(), zod_default.object({ source: zod_default.string(), output: zod_default.string().optional() })]))
+  columns: zod_default.array(zod_default.union([zod_default.string(), zod_default.object({ source: zod_default.unknown(), output: zod_default.string().optional() })]))
 });
 function projectionOf(declaration) {
   const parsed = projectionSchema.safeParse(declaration?.ast);
   if (!parsed.success) return void 0;
   return {
     table: parsed.data.from.table_id,
-    outputs: new Set(parsed.data.columns.map((column) => typeof column === "string" ? column : column.output ?? column.source))
+    outputs: new Set(
+      parsed.data.columns.flatMap((column) => {
+        if (typeof column === "string") return [column];
+        if (column.output !== void 0) return [column.output];
+        return typeof column.source === "string" ? [column.source] : [];
+      })
+    )
   };
 }
 function checkSurface(at2, alias, table, fields, manifest) {
@@ -56704,6 +57513,17 @@ function itineraryRunAliases(plan) {
     reference: plan.reference
   };
 }
+function checkDeskIsSoleEditor(at2, desk, record2) {
+  const filed = new Map(
+    record2.sections.flatMap(
+      (section) => section.kind === "facts" ? section.groups.flatMap((group) => group.facts.map((fact) => [fact.field, section.key])) : []
+    )
+  );
+  return [...desk.bodies, ...desk.media === void 0 ? [] : [desk.media]].flatMap((alias) => {
+    const band = filed.get(alias);
+    return band === void 0 ? [] : [{ at: at2, message: `sends "${alias}", which "${band}" also draws as a fact \u2014 the desk is that column's editor, so it stands in one of the two` }];
+  });
+}
 function checkRecord(spec, key, record2, manifest) {
   const at2 = `records.${key}`;
   const findings = [];
@@ -56772,6 +57592,45 @@ function checkRecord(spec, key, record2, manifest) {
         }
       }
     }
+    if (section.kind === "publish") {
+      const reach = section.destination;
+      findings.push(...checkSurface(childAt, reach.query, reach.table, reach.fields, manifest));
+      for (const alias of [
+        reach.identity,
+        ...reach.mark === void 0 ? [] : [reach.mark],
+        ...reach.contact === void 0 ? [] : [reach.contact],
+        ...reach.group === void 0 ? [] : [reach.group],
+        reach.network.field,
+        ...reach.connected === void 0 ? [] : [reach.connected],
+        ...reach.offered === void 0 ? [] : [reach.offered.field],
+        ...reach.language === void 0 ? [] : [reach.language.field]
+      ]) {
+        if (!Object.hasOwn(reach.fields, alias)) {
+          findings.push({ at: childAt, message: `reads "${alias}" off its destinations, which "${reach.query}" does not project` });
+        }
+      }
+      for (const alias of [
+        ...section.bodies,
+        ...section.media === void 0 ? [] : [section.media],
+        ...section.link === void 0 ? [] : [section.link],
+        ...Object.values(reach.language?.options ?? {})
+      ]) {
+        if (!Object.hasOwn(record2.fields, alias)) {
+          findings.push({ at: childAt, message: `sends "${alias}", which this record does not project` });
+        }
+      }
+      findings.push(...checkDeskIsSoleEditor(childAt, section, record2));
+      const sends = manifest.workflows?.[section.publish.workflow];
+      if (sends === void 0) {
+        findings.push({ at: childAt, message: `sends through "${section.publish.workflow}", which package.json#lotics.workflows does not declare` });
+      } else {
+        for (const name of [section.publish.param, section.publish.rows]) {
+          if (!Object.hasOwn(sends.inputs ?? {}, name)) {
+            findings.push({ at: childAt, message: `sends "${name}" to "${section.publish.workflow}", which declares no such input` });
+          }
+        }
+      }
+    }
     const child = sectionChild2(section);
     if (child === void 0) continue;
     findings.push(...checkSurface(childAt, child.query, child.table, child.fields, manifest));
@@ -56779,6 +57638,17 @@ function checkRecord(spec, key, record2, manifest) {
       findings.push({ at: childAt, message: `filters on "${child.param}", which "${child.query}" declares no param for` });
     }
     const reads = [
+      // A DESK'S OWN COLUMNS are read off the CHILD's rows like every other
+      // section's: the destination each stands on, where it stands, the override
+      // it goes out with, where it landed and what the platform said.
+      ...section.kind === "publish" ? [
+        section.party,
+        section.stage,
+        ...section.when === void 0 ? [] : [section.when],
+        ...section.text === void 0 ? [] : [section.text],
+        ...section.permalink === void 0 ? [] : [section.permalink],
+        ...section.error === void 0 ? [] : [section.error]
+      ] : [],
       ...section.kind === "timeline" ? [section.planned, section.actual] : [],
       ...section.kind === "thread" ? [
         section.body,
@@ -56826,6 +57696,27 @@ function checkRecord(spec, key, record2, manifest) {
     if (child.write !== void 0 && manifest.workflows?.[child.write.alias] === void 0) {
       findings.push({ at: childAt, message: `changes its rows through "${child.write.alias}", which package.json#lotics.workflows does not declare` });
     }
+    if (child.create !== void 0) {
+      const opens = manifest.workflows?.[child.create.alias];
+      if (opens === void 0) {
+        findings.push({ at: childAt, message: `opens its rows through "${child.create.alias}", which package.json#lotics.workflows does not declare` });
+      } else {
+        const named3 = [child.create.param, ...section.kind === "publish" ? [section.party] : []];
+        for (const input of named3) {
+          if (!Object.hasOwn(opens.inputs ?? {}, input)) {
+            findings.push({ at: childAt, message: `opens its rows with "${input}", which "${child.create.alias}" declares no such input` });
+          }
+        }
+      }
+    }
+    if (child.remove !== void 0) {
+      const takes = manifest.workflows?.[child.remove.alias];
+      if (takes === void 0) {
+        findings.push({ at: childAt, message: `withdraws its rows through "${child.remove.alias}", which package.json#lotics.workflows does not declare` });
+      } else if (!Object.hasOwn(takes.inputs ?? {}, child.remove.param)) {
+        findings.push({ at: childAt, message: `withdraws its rows with "${child.remove.param}", which "${child.remove.alias}" declares no such input` });
+      }
+    }
     if (child.write !== void 0 && !writesChildren(spec.screen.writes)) {
       findings.push({
         at: childAt,
@@ -56974,6 +57865,29 @@ function checkAppSpec(spec, manifest, components) {
       findings.push({ at: at2, message: `lands a file through "${taken.workflow}", which package.json#lotics.workflows does not declare` });
     }
   }
+  const marks = screen.destinations;
+  if (marks !== void 0) {
+    if (manifest.queries?.[marks.query] === void 0) {
+      findings.push({ at: at2, message: `reads its destinations from "${marks.query}", which package.json#lotics.queries does not declare` });
+    } else {
+      if (!paramsOf(manifest, marks.query).has(marks.param)) {
+        findings.push({ at: at2, message: `reads its destinations by "${marks.param}", which "${marks.query}" declares no param for` });
+      }
+      const projection2 = projectionOf(manifest.queries[marks.query]);
+      const read2 = [
+        marks.link,
+        marks.party,
+        marks.stage,
+        ...marks.mark === void 0 ? [] : [marks.mark],
+        ...marks.network === void 0 ? [] : [marks.network.field]
+      ];
+      for (const alias of read2) {
+        if (projection2 !== void 0 && !projection2.outputs.has(alias)) {
+          findings.push({ at: at2, message: `reads its destinations' "${alias}", which "${marks.query}" does not project` });
+        }
+      }
+    }
+  }
   for (const slot2 of screen.slots) {
     if (slot2.quick !== true) continue;
     const refused = quickRefusal(slot2.role, slot2.order);
@@ -57272,6 +58186,14 @@ function planWorkflows(entry, roles, templates = /* @__PURE__ */ new Map()) {
       ...importColumns(entry, taken).map((column) => column.bound.alias)
     ]);
   }
+  const removes = /* @__PURE__ */ new Set();
+  for (const desk of publishDesks(entry)) {
+    declared[removeAlias(desk.entity.alias)] = {
+      inputs: { [recordParam(desk.entity.alias)]: { type: "record_link", table_id: desk.table.id, required: true } },
+      description: `Take one row of ${desk.entity.label} back off the desk it was queued on \u2014 refused once it has gone out.`
+    };
+    removes.add(desk.tableAlias);
+  }
   for (const act of templateActs(entry)) {
     if (!templates.has(act.template.alias)) continue;
     const entity = act.entry.screen.entity;
@@ -57285,7 +58207,8 @@ function planWorkflows(entry, roles, templates = /* @__PURE__ */ new Map()) {
   }
   return {
     workflows: declared,
-    writes: Object.fromEntries([...written].map(([table, fields]) => [table, [...fields].sort()]))
+    writes: Object.fromEntries([...written].map(([table, fields]) => [table, [...fields].sort()])),
+    deletes: [...removes].sort()
   };
 }
 function writtenColumns(entry) {
@@ -57398,18 +58321,18 @@ function scopePasses(rule, local) {
     return `(!isNull(${caller}) && ${names})`;
   }).join(" || ");
 }
-function scopeGuard(entry, param, over = `i.${param}`, pad = "") {
-  const rule = entry.scope;
+function scopeGuard(on, param, over = `i.${param}`, pad = "") {
+  const rule = on.scope;
   if (rule === void 0) return "";
   const reads = rule.clauses.some((clause) => clause.kind !== "member_of");
-  const fetched = reads ? `${pad}const target = await get_record({ table_id: ${str(entry.table.id)}, record_id: ${over} });
+  const fetched = reads ? `${pad}const target = await get_record({ table_id: ${str(on.table.id)}, record_id: ${over} });
 ` : "";
   const passes = scopePasses(rule, "target");
   return `${pad}// THE ROW RULE, ON THE WRITE PATH. The record's id arrives from whoever called
 ${pad}// this workflow and is proven against the TABLE, never against the rows that
 ${pad}// caller may read.
 ${fetched}${pad}validate({
-${pad}  checks: [{ fail_when: !(${passes}), message: ${str(entry.words.refusals.outOfScope)} }],
+${pad}  checks: [{ fail_when: !(${passes}), message: ${str(on.words.refusals.outOfScope)} }],
 ${pad}});
 `;
 }
@@ -57459,6 +58382,22 @@ validate({
 ${scopeGuard(entry, param)}${blocks.join("\n")}
 `;
 }
+function removeSource(entry, desk) {
+  const param = recordParam(desk.entity.alias);
+  return `// ${removeAlias(desk.entity.alias)} \u2014 take one row of ${desk.entity.label} back.
+// ONLY WHILE IT IS STILL WAITING. A row that has gone out is the record of
+// something that exists elsewhere, and removing it here would leave that standing
+// with nothing in the workspace saying so \u2014 so the stage is read first and
+// anything past the queue is refused.
+const i = trigger.app_workflow.inputs;
+${scopeGuard({ scope: desk.scope, table: desk.table, words: entry.words }, param)}const standing = await get_record({ table_id: ${str(desk.table.id)}, record_id: i.${param} });
+validate({
+  checks: [{ fail_when: standing.data[${str(desk.publish.stage.id)}] != ${str(desk.publish.states.queued)}, message: ${str(entry.words.refusals.sent)} }],
+});
+await delete_records({ table_id: ${str(desk.table.id)}, record_ids: [i.${param}] });
+return({ status: "success", message: ${str(entry.words.refusals.withdrawn(desk.entity.label))} });
+`;
+}
 function historyAppend(entry) {
   for (const { section } of entry.sections) {
     if (section.kind !== "progress" || section.history === void 0) continue;
@@ -57521,6 +58460,7 @@ ${pad}  ],
 ${pad}});`;
 }
 function createValue(input) {
+  if (input.field.type === "files") return `i.${input.name} ?? []`;
   const list3 = input.link !== void 0 || input.field.type === "select_member" && input.field.multi === true;
   return list3 ? `isNull(i.${input.name}) ? null : [i.${input.name}]` : `i.${input.name}`;
 }
@@ -57566,7 +58506,7 @@ function createSource(plan) {
   for (const input of plan.inputs) {
     if (input.into === "party" && input.through?.matched !== true) continue;
     if (input.required) {
-      const empty = input.field.type === "text" || input.into === "party" ? `isEmpty(trim(coalesce(i.${input.name}, "")))` : `isNull(i.${input.name})`;
+      const empty = input.field.type === "files" ? `isEmpty(i.${input.name})` : input.field.type === "text" || input.into === "party" ? `isEmpty(trim(coalesce(i.${input.name}, "")))` : `isNull(i.${input.name})`;
       checks.push(checkLine(empty, input.name, words.refusals.required(input.label)));
     }
     if (input.rule?.min !== void 0) {
@@ -57596,6 +58536,20 @@ function createSource(plan) {
       ]).trimEnd()
     );
   }
+  const queued = plan.queued;
+  if (queued !== void 0 && plan.parent !== void 0) {
+    const standing = [
+      `{ node_type: "condition", field_key: ${str(plan.parent.bound.id)}, operator: "has_any_of", value: [i.${plan.parent.param}] }`,
+      `{ node_type: "condition", field_key: ${str(queued.bound.id)}, operator: "has_any_of", value: [i.${queued.name}] }`
+    ];
+    lines.push(
+      `const placed = await query_records({
+  table_id: ${str(plan.table.id)},
+  filters: { node_type: "group", logic: "and", children: [${standing.join(", ")}] },
+});`,
+      validateBlock([checkLine(`!isNull(first(placed.records))`, queued.name, words.refusals.placed(queued.label))]).trimEnd()
+    );
+  }
   for (const read2 of plan.reads) {
     lines.push(`const ${read2.local} = await get_record({ table_id: ${str(read2.link.table.id)}, record_id: i.${read2.input} });`);
     const narrowed = [
@@ -57690,6 +58644,10 @@ function createInputs(plan) {
       inputs[input.name] = { type: "record_link", table_id: input.link.table.id, required: input.required };
       continue;
     }
+    if (input.field.type === "files") {
+      inputs[input.name] = { type: "file", multi: true, required: input.required };
+      continue;
+    }
     if (input.field.type === "select") {
       inputs[input.name] = { type: "select", field: input.bound.id, ...input.field.multi === true ? { multi: true } : {}, required: input.required };
       continue;
@@ -57824,6 +58782,8 @@ function buildPlanFiles(app, entry, roles, templates = /* @__PURE__ */ new Map()
     { path: COMPONENTS_INDEX, content: COMPONENTS },
     ...editors,
     ...creates.map((plan) => ({ path: `src/workflows/${createAlias(plan.entity.alias)}.ts`, content: createSource(plan) })),
+    // THE OTHER HALF OF A CHIP — the press that takes a queued destination back.
+    ...publishDesks(entry).map((desk) => ({ path: `src/workflows/${removeAlias(desk.entity.alias)}.ts`, content: removeSource(entry, desk) })),
     ...entry.screen.acts.import === null ? [] : [{ path: `src/workflows/${importAlias(entry.screen.acts.import.entity.alias)}.ts`, content: importSource(entry) }],
     ...templateActs(entry).flatMap((act) => {
       const id = templates.get(act.template.alias);
@@ -57833,7 +58793,16 @@ function buildPlanFiles(app, entry, roles, templates = /* @__PURE__ */ new Map()
   ];
 }
 function readmeSource(app, entry) {
-  const tables = [entry.screen.entity.label, ...[...entry.children.values()].map((child) => child.entity.label)];
+  const tables = [
+    entry.screen.entity.label,
+    ...[...entry.children.values()].flatMap((child) => [
+      child.entity.label,
+      // …AND THE TABLE A PUBLISH DESK OFFERS ITS DESTINATIONS FROM, which no
+      // section lists and no relation reaches: a reader opening the project a
+      // month later would meet a read over a table this page never named.
+      ...child.publish === void 0 ? [] : [child.publish.destination.entity.label]
+    ])
+  ];
   return `# ${app.name}
 
 ${app.description ?? `Generated from its plan \u2014 one register, and the record its rows open.`}
@@ -61484,6 +62453,7 @@ function readAppMeta(projectDir) {
     // Same rule as `bundle_calls` below: absent is no declaration, which is a
     // different claim from an empty one.
     writes: pkg.lotics.writes,
+    deletes: pkg.lotics.deletes,
     // Deliberately NOT defaulted: absent must stay absent, because absent is
     // what tells the orphan report it has no baseline to compare against and
     // must say nothing. An `?? {queries:[],…}` here would read as "the last
@@ -62319,6 +63289,7 @@ async function resolvePlanForCreate(client, from) {
     templates,
     live,
     writes: bindings.writes,
+    deletes: bindings.deletes,
     ...Object.keys(bindings.workflows).length === 0 ? {} : { workflows: bindings.workflows }
   };
 }
@@ -62442,6 +63413,7 @@ function withPlanFiles(targetPath, starter, plan) {
   const generated = buildPlanFiles(plan.app, plan.bound, plan.roles, plan.templates);
   const replaced = /* @__PURE__ */ new Set([...generated.map((file2) => file2.path), "src/App.tsx"]);
   const writes = Object.keys(plan.writes).length === 0 ? void 0 : plan.writes;
+  const deletes = plan.deletes.length === 0 ? void 0 : plan.deletes;
   return {
     files: [
       ...starter.map((file2) => {
@@ -62458,7 +63430,8 @@ function withPlanFiles(targetPath, starter, plan) {
           // Absent leaves the scaffold's own empty map; overwriting it with one
           // would say the plan declared no writes, which is a different claim.
           ...plan.workflows === void 0 ? {} : { workflows: plan.workflows },
-          ...writes === void 0 ? {} : { writes }
+          ...writes === void 0 ? {} : { writes },
+          ...deletes === void 0 ? {} : { deletes }
         };
         return { path: file2.path, content: `${JSON.stringify(manifest, null, 2)}
 ` };
@@ -63113,15 +64086,16 @@ function reportUndescribedQueries(queries) {
 }
 async function reportUndeclaredWrites(client, projectDir, meta3, tables) {
   const aliases = Object.keys(meta3.workflows ?? {});
-  if (meta3.writes === void 0) {
+  if (meta3.writes === void 0 && meta3.deletes === void 0) {
     if (aliases.length > 0) {
       warn(
         `\u26A0 This app declares no writes, so nothing checks what its ${aliases.length} workflow bod${aliases.length === 1 ? "y" : "ies"} change.
-  Declare them in package.json#lotics.writes as {"<F.TABLE alias>": ["<field alias>", \u2026]} \u2014 'lotics app create --from' seeds it, and 'lotics app check' then refuses a body that writes outside it.`
+  Declare them in package.json#lotics.writes as {"<F.TABLE alias>": ["<field alias>", \u2026]}, and the tables whose rows they DELETE in package.json#lotics.deletes as ["<F.TABLE alias>", \u2026] \u2014 'lotics app create --from' seeds both, and 'lotics app check' then refuses a body that writes outside them.`
       );
     }
     return 0;
   }
+  const declaration = { writes: meta3.writes ?? {}, deletes: meta3.deletes ?? [] };
   const bodies = aliases.flatMap((alias) => {
     const file2 = workflowFilePath(projectDir, alias);
     if (!fs11.existsSync(file2)) return [];
@@ -63129,7 +64103,7 @@ async function reportUndeclaredWrites(client, projectDir, meta3, tables) {
   });
   if (tables === null) {
     warn(
-      `\u26A0 Did not check the ${bodies.length} workflow bod${bodies.length === 1 ? "y" : "ies"} against package.json#lotics.writes \u2014 the workspace schema could not be read, and the declaration names fields by alias. The warning above says why.`
+      `\u26A0 Did not check the ${bodies.length} workflow bod${bodies.length === 1 ? "y" : "ies"} against package.json#lotics.writes/deletes \u2014 the workspace schema could not be read, and the declaration names fields and tables by alias. The warning above says why.`
     );
     return 0;
   }
@@ -63145,10 +64119,10 @@ async function reportUndeclaredWrites(client, projectDir, meta3, tables) {
       return 0;
     }
   }
-  const { findings, unresolved, unknownTools } = writeFindings(meta3.writes, bodies, resolved);
+  const { findings, unresolved, unknownTools } = writeFindings(declaration, bodies, resolved);
   if (unresolved.length > 0) {
     warn(
-      `\u26A0 package.json#lotics.writes names ${unresolved.length} table this app neither reads nor writes (${unresolved.join(", ")}) \u2014 ${unresolved.length === 1 ? "it covers" : "they cover"} nothing. Name it by the F.<TABLE> alias the field map carries, or drop the entry.`
+      `\u26A0 package.json#lotics.writes/deletes names ${unresolved.length} table this app neither reads nor writes (${unresolved.join(", ")}) \u2014 ${unresolved.length === 1 ? "it covers" : "they cover"} nothing. Name it by the F.<TABLE> alias the field map carries, or drop the entry.`
     );
   }
   if (unknownTools.length > 0) {
@@ -63163,7 +64137,8 @@ async function reportUndeclaredWrites(client, projectDir, meta3, tables) {
 ` + findings.map((finding) => `  \u2022 ${finding.message}`).join("\n") + `
 
   What an app writes is a contract its catalogue publishes and other desks are built against. Either the body is writing a column that belongs to another desk, or the declaration is missing it \u2014 add the field to package.json#lotics.writes, and name the other apps in a
-  {"field": "<field>", "shared_with": ["<app alias>"]} entry when the split is deliberate.`
+  {"field": "<field>", "shared_with": ["<app alias>"]} entry when the split is deliberate.
+  A body that DELETES names no column: add its table to package.json#lotics.deletes.`
   );
   return findings.length;
 }
@@ -65401,7 +66376,7 @@ Captured ${totalRows} row${totalRows === 1 ? "" : "s"} across ${result.captured.
 }
 
 // src/model_reference.md
-var model_reference_default = '# The Lotics workspace model (`model.json`)\n\nOne JSON file describing the tables, fields, options, views, roles and first rows\na workspace starts with. `lotics scaffold check model.json` proves it offline \u2014\nno account, no network. `lotics setup model.json --email you@company.com` creates\nthe account and applies it. `lotics scaffold apply model.json` applies it again,\ninto the workspace the credential names.\n\n**There are two forms of this file.** The full one, below, spells the model out.\nThe `from` one names a published preset and carries only what this business\ndiffers by \u2014 see \xA7 Starting from a preset, and prefer it whenever a preset fits\nthe trade.\n\nApps are PLANNED here and built afterwards: `apps` names each app\'s screens as a\nshape over an entity, checked against the roles `field_roles` gives its fields,\nso the plan is refused before anyone builds a screen (\xA7 Apps and screens). The\nbuilt app lives in the workspace; publishing that workspace as a package is how\nit ships.\n\n## The rules\n\n- **At least one entity, at most 50.** More tables than that is a data model\n  being designed, not scaffolded \u2014 scaffold the rest in a second call.\n- **Adoption is explicit.** `lotics setup` REFUSES an entity whose `label`\n  already names a table in the workspace, naming every colliding label at once.\n  `lotics scaffold apply` adopts those tables and adds the fields, options and\n  views they are missing. Nothing is ever modified or deleted, so applying the\n  same model twice creates nothing the second time.\n- **Adoption is by LABEL, not alias.** Change an entity\'s `label` and the next\n  run asks for a NEW table beside the old one. Renaming a FIELD is\n  `lotics field rename <table> <field> "<new label>" --model <this file>`, which\n  moves the platform, this file and every app bound to it together; deleting is\n  `lotics run delete_table`. Neither goes through the file.\n- **The file\'s own majority is the language.** A model names no locale \u2014 which\n  language it is in is what it mostly says, and `scaffold check` notes the label\n  written the other way. The generated screens read the kit\'s pack, and a\n  generated WRITE cannot: its refusals run on the server, so they are worded in\n  that same majority. Mix the two and the workspace answers in two languages.\n- **`lotics scaffold diff model.json` says where the file and the workspace have\n  come apart**, joined on label, entity then field \u2014 the join adoption itself\n  makes. It exits 1 on any difference, so a model that is about to be published\n  as a preset carries the labels in use rather than the ones it was written with.\n- **Rows land only where every bound table is empty.** One table already holding\n  records and no rows are written anywhere, and the result says\n  `rows_skipped: true`: sample rows landing among a customer\'s real ones cannot\n  be told apart from them.\n- **After the first run the WORKSPACE is the source of truth.** The file is an\n  authoring input, not a mirror \u2014 scaffold never deletes what the file stopped\n  naming.\n- **`lotics scaffold check` decides all of it offline**, and reports every\n  problem in one run rather than the first: an alias that resolves to nothing, a\n  link whose pair is not symmetric, and the rows themselves \u2014 a field the entity\n  does not declare, an option alias the field does not declare, a link naming no\n  row in the file, a `ref` used twice, a date that is not one, a value on a\n  platform-computed field, and a files cell that is neither a relative path\n  beside this file nor a `fil_` id.\n\n## Top level\n\n```jsonc\n{\n  "entities": [ /* the tables */ ],\n  "roles":    [ /* workspace groups to create */ ],    // optional\n  "templates":[ /* inline html / email templates */ ], // optional\n  "rows":     { /* first records, keyed by entity alias */ },  // optional\n  "field_roles": { /* the reporting role each field plays, keyed by entity then field */ }, // optional\n  "write_rules": { /* what a CREATE finds, defaults and refuses, keyed by entity */ }, // optional\n  "apps":     [ /* the screens each app will have, as shapes over entities */ ], // optional\n  "apply":    [ /* published packages to copy in afterwards */ ], // optional\n  "preset":   { /* a trade\'s branches, for a PUBLISHED model */ } // optional\n}\n```\n\nThe other form names a preset instead of restating one:\n\n```jsonc\n{\n  "from":     "field_service",             // the preset this model starts from, by slug\n  "variants": ["crews"],                   // optional \u2014 its branches to merge in, in order\n  "rename":   {                            // optional \u2014 what THIS business calls each table\n    "job": { "label": "\u0110\u01A1n h\xE0ng", "fields": { "code": "M\xE3 \u0111\u01A1n" } }\n  },\n  "entities": [ /* tables the preset does not declare */ ],    // optional\n  "rows":     { /* first records, keyed by entity alias */ },  // optional\n  "field_roles": { /* roles on the preset\'s fields and this business\'s own */ }, // optional\n  "write_rules": { /* create-time clauses on the preset\'s entities and its own */ }, // optional\n  "apps":     [ /* the screens each app will have */ ],        // optional\n  "apply":    [ /* published packages to copy in afterwards */ ] // optional\n}\n```\n\n**A model may not carry** `fixtures`, `knowledge` or `knowledge_expects`, and no\n`excel` / `word` / `pdf-form` template: each of those is content that lives in a\npublished bundle, which a model has none of. `apps` here is a plan of screens,\nnever built code. An unknown top-level key is an error, never ignored.\n\n### Aliases\n\nEvery `alias` is a lowercase slug \u2014 a letter, then letters, digits and\nunderscores (`unit_price`, `so_1001`). Aliases are how the file cross-references\nitself; they are never shown to anyone. `label` is what a person sees.\n\nLabels must be unique within their namespace \u2014 two entities, two fields on one\nentity, two options on one field, two views on one entity, two roles or two\ntemplates cannot share a label, because scaffold matches by label.\n\n## Entity\n\n```jsonc\n{\n  "alias": "order",\n  "label": "Orders",            // the table\'s name, which names the SET it holds\n  "singular": "Order",          // optional \u2014 ONE of them, for the act that opens one\n  "description": "\u2026",           // optional\n  "fields": [ /* at least one */ ],\n  "views":  [ /* optional; an entity with none still gets the default grid */ ],\n  "read_scope": { /* optional; absent, everyone with access to the table reads every row */\n    "any": [\n      { "member_of": "sales" },                       // a role alias this model declares\n      { "field": "scope", "is": ["shared"] },         // a single select on this entity, by option alias\n      { "field": "assignee", "is": "self" }           // a select_member on this entity \u2014 the members it names\n    ]\n  }\n}\n```\n\n**`singular` is what a create says.** A register\'s own act and the panel it\nopens name the row being made \u2014 `New Order`, `H\u1ED3 s\u01A1 m\u1EDBi` \u2014 while `label` names\nthe table, so without it the button reads `New Orders`. Nothing derives it\n(English plurals are irregular), and most models need none: a Vietnamese noun is\nthe same word either way. `scaffold check` prints it beside the table under *Who\nwrites what* and NOTES a table that will name the set. An act on a child section\nkeeps the label: it adds a line to the register under the record the reader is\nalready standing in.\n\n**`read_scope` is a ROW rule, enforced by the platform.** A row is readable when\nANY clause holds: the reader is in that role\'s group, the named select carries\none of those options, or the named `select_member` column names the reader\n(`"is": "self"`, on a column of one member or several). It is resolved at\nscaffold into the table\'s own row filters, so an app, a workflow reading for a\nviewer, and the API all answer the same rows \u2014 a per-record visibility field the\napp merely honours is a convention, not a gate. `any` may not be empty (a rule\nnobody satisfies hides the table), and every role alias and option alias in it\nmust be one this model declares. Scaffold writes the rule onto a table it\nCREATES; a table it adopted that ALREADY CARRIES a rule keeps that one, because\nthe rule is the workspace\'s own statement about its rows \u2014 and a run whose model\nstates a different rule reports the entity rather than leaving the claim silent.\n\n**The rows under a private record INHERIT its rule.** An entity that states no\n`read_scope` and hangs under one that does \u2014 through its `parent` link, over one\nhop or several \u2014 is read by the ancestor\'s rule, answered through that link, on\nits table\'s own filters and in every query and guard alike; nothing is restated,\nso a child needs none of the ancestor\'s columns. Stating a rule on the child\nkeeps that one instead, an ancestor with no rule passes nothing down, and a row\nhanging further under the scoped one than a row filter reaches is refused by\nname \u2014 state a rule on it. So is a hop over a link that names more than one row:\nthe rule would admit a reader any one of them admits while the editor\'s guard\nreads the first, so give the link `"cardinality": "one"` or state a rule on the\nchild.\n\n**ONLY the `parent` role is walked.** A register a scoped record reaches by any\nother link \u2014 the rows that NAME it \u2014 is read by that record\'s id with no rule\ntravelling to it, so it is refused until it states one of its own.\n\n## Field\n\nEvery field carries `alias`, `label`, an optional `description`, and an optional\n`required` \u2014 advisory only, read by app forms and workflows; the table itself has\nno required constraint. `label` may not contain `{` or `}` (formulas reference\nfields by label at the platform level).\n\n`default` is the value pre-filled into a NEW record. It applies on create only;\nexisting records are never backfilled. Only the types listed below accept one.\n\n### `text`\n\n```jsonc\n{ "alias": "name", "label": "Name", "type": "text",\n  "unique": false,              // optional \u2014 require distinct values\n  "format": "text",             // optional \u2014 "text" | "link" | "markdown"\n  "default": "" }               // optional\n```\n\n### `number`\n\n```jsonc\n{ "alias": "amount", "label": "Amount", "type": "number",\n  "format": "currency",         // optional \u2014 "number" | "currency" | "percentage"\n  "currency": "VND",            // optional \u2014 ISO 4217\n  "default": 0 }                // optional\n```\n\n`format` is what the number IS, and every surface reads it: `currency` prints as\nmoney in the code the row or the field states, `percentage` as a whole percent\nwith its sign. An ABSENT number is drawn absent \u2014 the one exception is a\n`sum` or count rollup the plan reads as a **`measure`**: that is the thing\naccumulated toward a bound, so nothing accumulated yet is zero and the meter\ndraws it. The same rollup read as an `amount` keeps its blank, and so does every\nother role: nothing added to what a row is WORTH means unpriced, not free. A\n`min`, an `avg`, a percentage of nothing and every FORMULA stay blank in any\nrole, because none of them has an answer to give. This is why the pair on one\nscreen reads two ways \u2014 what has come in against what is owed \u2014 and why a\nmeasure\'s own LIMIT, an amount, leaves an unquoted row out of the count rather\nthan reporting it as nothing collected. **AND WHERE THAT LIMIT IS ABSENT THERE IS\nNO LEVEL AT ALL**: a level is a reading AGAINST a bound, so a row that states no\nbound draws nothing \u2014 cell, fact and all \u2014 rather than a numerator whose whole\nmeaning was the comparison. "Collected 0" beside a blank total reads as money\nagainst a job worth nothing. A measure the model gives no limit is a plain figure\nand is unaffected. A share is stored in percent units \u2014 68.1 is 68.1 % \u2014 and the\ncolumn, the fact behind it, the meter it is judged by and the figure over the\nregister all say so.\n\n### `date`\n\n```jsonc\n{ "alias": "placed_on", "label": "Placed on", "type": "date",\n  "format": "date",             // optional \u2014 "date" | "datetime" | "date_range" | "datetime_range"\n  "timezone": "Asia/Ho_Chi_Minh",  // optional \u2014 IANA name\n  "derive_from": "created_at",  // optional \u2014 "created_at" | "updated_at"; makes the field read-only\n  "default": "2026-01-01" }     // optional; refused together with derive_from\n```\n\n### `boolean`\n\n```jsonc\n{ "alias": "paid", "label": "Paid", "type": "boolean", "default": false }\n```\n\n### `select`\n\n```jsonc\n{ "alias": "tier", "label": "Tier", "type": "select",\n  "options": [                                     // at least one\n    { "alias": "standard", "label": "Standard", "color": "slate" },\n    { "alias": "gold",     "label": "Gold",     "color": "amber" }\n  ],\n  "multi": false,               // optional\n  "default": ["standard"] }     // optional \u2014 option ALIASES; one unless multi\n```\n\n`color` is one of: `red`, `orange`, `amber`, `yellow`, `lime`, `green`,\n`emerald`, `teal`, `cyan`, `sky`, `blue`, `indigo`, `violet`, `purple`,\n`fuchsia`, `pink`, `rose`, `slate`, `gray`, `zinc`, `neutral`, `stone`.\n\n### `select_member`\n\nA person picker over the workspace\'s members. No default: a model cannot name\nmembers of a workspace that does not exist yet.\n\n```jsonc\n{ "alias": "owner", "label": "Owner", "type": "select_member", "multi": false }\n```\n\n### `select_record_link`\n\n```jsonc\n{ "alias": "customer", "label": "Customer", "type": "select_record_link",\n  "target_entity": "customer",        // an entity alias this model declares\n  "cardinality": "one",               // optional \u2014 "one" | "many" (default "many")\n  "sync_both_ways": true,             // optional \u2014 keep a paired field on the target\n  "paired_field_alias": "orders",     // the partner field ON THE TARGET entity\n  "display_field_aliases": ["name"] } // optional \u2014 what the link shows / the picker\'s columns\n```\n\nA two-way link is declared on BOTH sides, each naming the other as its\n`paired_field_alias`; the pair must be symmetric or the model is refused.\n\n**A single-valued link needs no partner.** `"cardinality": "one"` on its own is a\nlink that holds one row \u2014 one customer on an invoice, one project on a device \u2014\nand nothing is created on the target. The mirror invariant belongs to a PAIRED\nlink: pair a link when the target\'s own record should list what points at it, and\nleave it unpaired when it should not. Either way the record plan draws the\nrelation as a section on the side it points at, so an unpaired link costs the\ntarget nothing.\n\n### `files`\n\n```jsonc\n{ "alias": "attachments", "label": "Attachments", "type": "files" }\n```\n\n### `formula`\n\n```jsonc\n{ "alias": "total", "label": "Total", "type": "formula",\n  "formula": {\n    "expression": "{amount} * 1.1",  // fields on THIS entity, by alias, in braces\n    "output_type": "number",         // optional \u2014 what it YIELDS: "number" | "text" | "date" | "datetime" | "boolean"\n    "format": "currency",            // optional \u2014 how that result is DRAWN: "number" | "currency" | "percentage" | "link"\n    "currency": "VND"                // optional\n  } }\n```\n\n`output_type` is what the expression answers WITH; `format` is how it is printed.\nThe platform infers the result at write time and ignores what you declare, so\nthis is a statement the offline checks read \u2014 which is what lets a role or a\nscreen clause accept a computed value: a caption over a derived name\n(`output_type: "text"`), a period over a settled date (`"date"`). A formula\ndeclaring neither says nothing about its result, and every rule that needs one\nrefuses it by name. `lotics scaffold export` writes the result a live workspace\ncomputed, so exporting a workspace fills these in.\n\n### `rollup`\n\nAggregates the records reached through a link on this entity.\n\n```jsonc\n{ "alias": "total_ordered", "label": "Total ordered", "type": "rollup",\n  "source_field_alias": "orders",    // a select_record_link field on THIS entity\n  "aggregate_option": {\n    "operation": "sum",              // count | sum | avg | median | min | max | range |\n                                     // empty | filled | percent_empty | percent_filled |\n                                     // unique | percent_unique |\n                                     // earliest | latest | date_range |\n                                     // checked | unchecked | percent_checked |\n                                     // percent_unchecked\n    "field_key": "amount"            // a field ALIAS on the linked entity ("count" may omit it)\n  },\n  "filter": { /* optional \u2014 see Views; every field_key is an alias on the LINKED entity */ } }\n```\n\nThe operation must be one the aggregated field\'s type allows \u2014 `sum` over a\nnumber, `earliest` over a date, `filled` over anything.\n\n### `lookup`\n\nDisplays a field from the linked records.\n\n```jsonc\n{ "alias": "customer_tier", "label": "Customer tier", "type": "lookup",\n  "source_field_alias": "customer",  // a select_record_link field on THIS entity\n  "lookup_field_alias": "tier",      // a field alias on the linked entity\n  "order_by": { "field_key": "placed_on", "direction": "desc" } }  // optional \u2014 pick the single extreme row\n```\n\n### `autonumber`\n\n```jsonc\n{ "alias": "seq", "label": "No.", "type": "autonumber",\n  "prefix": "SO-",     // optional \u2014 ignored when template is set\n  "padding": 4,        // optional \u2014 1..20, zero-pads the integer\n  "template": "SO-{YEAR}-{N:4}" }  // optional \u2014 {N}, {N:W}, {YEAR}, {YEAR:2}, {MONTH}, {DAY}\n```\n\n## Views\n\nSaved views live under the entity they belong to. Every field reference is a\nfield ALIAS on that entity.\n\n```jsonc\n{\n  "alias": "gold",\n  "label": "Gold customers",\n  "description": "\u2026",                       // optional\n  "columns": [                              // optional \u2014 omit to show every field\n    { "field_alias": "name", "visibility": "visible", "width": 240 },\n    { "field_alias": "tier", "visibility": "hidden" }\n  ],\n  "filters": {                              // optional\n    "node_type": "group",\n    "logic": "and",                         // "and" | "or"\n    "children": [\n      { "node_type": "condition", "type": "select", "field_key": "tier",\n        "operator": "has_any_of", "value": ["gold"] }\n    ]\n  },\n  "sort": [ { "field_key": "name", "order": "asc" } ],  // optional; order is "asc" | "desc" | null\n  "summary": { "amount": "sum" },           // optional \u2014 field alias \u2192 footer operation\n  "frozen_columns": 1                       // optional\n}\n```\n\nA condition\'s `type` is the field\'s type and its `operator` is one that type\nadmits \u2014 `has_any_of` / `has_none_of` / `has_all_of` / `is_empty` /\n`is_not_empty` for a select, `equals` / `greater_than` / `less_than` for a\nnumber, `on` / `before` / `after` / `between` for a date, `contains` /\n`is_any_of` for text. A select condition\'s `value` names option ALIASES.\n\n`columns`, when present, is exhaustive and must not be empty: a view renders\nexactly the entries it holds. Omit the key to show every field.\n\n## Roles\n\nA role becomes a workspace group. Members are added afterwards, in the app.\n\n```jsonc\n{ "alias": "sales", "label": "Sales" }\n```\n\n## Templates\n\nOnly inline `html` and `email` templates \u2014 the rest are file-backed and a model\nhas no bytes. An `html` template renders to a PDF when a workflow generates\nfrom it; `{{name}}` is filled from the workflow\'s data.\n\n```jsonc\n{ "alias": "order_ack", "label": "Order acknowledgement", "type": "email",\n  "content": "<p>Hello {{customer}}\u2026</p>" }\n```\n\nA paper that has to look like a counterparty produced it \u2014 an official letter,\nan acceptance minute, a supplier\'s bill \u2014 is the same `html` template with a\nshell around the body: a letterhead, a reference line, a seal and a signature\nblock, and paper grain over everything. One shell, many bodies; the data is the\nonly thing that changes, so a workflow can re-issue it over any record.\n\n```jsonc\n{ "alias": "cong_van", "label": "C\xF4ng v\u0103n", "type": "html",\n  "content": "\u2026the page below, as one JSON string\u2026" }\n```\n\n```html\n<style>\n    .sheet{position:relative;width:718px;padding:44px 58px 30px;background:#fbfaf6;color:#111;font:14.2px/1.5 \'Liberation Serif\',serif}\n    .grain{position:absolute;inset:0;opacity:.34;mix-blend-mode:multiply;background:url("data:image/svg+xml;utf8,<svg xmlns=\'http://www.w3.org/2000/svg\' width=\'140\' height=\'140\'><filter id=\'f\'><feTurbulence baseFrequency=\'.9\' numOctaves=\'2\'/><feColorMatrix values=\'0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .35 0\'/></filter><rect width=\'140\' height=\'140\' filter=\'url(%23f)\'/></svg>")}\n    .top{display:flex;text-align:center;font-size:13.4px} .top>div{flex:1} .u{display:inline-block;border-bottom:1px solid #111;font-weight:700}\n    .ref{display:flex;text-align:center;font-size:13.4px;margin-top:6px} .ref>div{flex:1} .ref .r{font-style:italic}\n    h1{text-align:center;font-size:15.6px;margin:26px 0 18px} p{text-align:justify;text-indent:26px;margin:0 0 9px}\n    .sig{display:flex;margin-top:20px} .sig .l{flex:1} .sig .r{width:290px;text-align:center;position:relative}\n    .sig .nm{font-weight:700;margin-top:96px} .seal{position:absolute;left:4px;top:8px;width:166px;height:166px;opacity:.66;mix-blend-mode:multiply;transform:rotate(-17deg)}\n  </style>\n  <div class=\'sheet\'><div class=\'grain\'></div>\n    <div class=\'top\'><div><b>{{issuer_parent}}</b><br><span class=\'u\'>{{issuer}}</span></div>\n      <div><b>C\u1ED8NG H\xD2A X\xC3 H\u1ED8I CH\u1EE6 NGH\u0128A VI\u1EC6T NAM</b><br><span class=\'u\'>\u0110\u1ED9c l\u1EADp - T\u1EF1 do - H\u1EA1nh ph\xFAc</span></div></div>\n    <div class=\'ref\'><div>S\u1ED1: {{number}}</div><div class=\'r\'>{{place}}, ng\xE0y {{day}} th\xE1ng {{month}} n\u0103m {{year}}</div></div>\n    <h1>{{title}}</h1>\n    <p>K\xEDnh g\u1EEDi: {{recipient}}.</p>\n    {{{body}}}\n    <div class=\'sig\'><div class=\'l\'><b>N\u01A1i nh\u1EADn:</b><br>- Nh\u01B0 tr\xEAn;<br>- L\u01B0u VT.</div>\n      <div class=\'r\'><img class=\'seal\' src=\'{{seal_url}}\'><b>{{signer_title}}</b><div class=\'nm\'>{{signer}}</div></div></div>\n  </div>\n```\n\n`lotics preview <file.html>` renders any such page to a PNG the way a demo\'s\nprops are made, sized to its content, so a paper can be looked at before it is\nput in a template.\n\n## Rows\n\nFirst records, keyed by entity alias. Up to 200 rows per entity and 2000 across\nthe model, attaching at most 2000 documents between them \u2014 a real data set\nbelongs in an import, not a model.\n\n```jsonc\n"rows": {\n  "customer": [\n    { "ref": "acme", "fields": { "name": "Acme Trading", "tier": "gold" } }\n  ]\n}\n```\n\n`ref` is a local handle (lowercase letters, digits, underscores) that other rows\'\nlink fields address. It is never persisted.\n\nA `files` cell attaches documents: paths relative to this file (no `..`, never\nabsolute), which `check` proves exist and `apply` uploads into the workspace\nbefore any row is written \u2014 a paperwork business seeds its papers with its\nrows. The server accepts only `fil_` ids of files this workspace owns, which is\nwhat the upload leaves behind. After a run that wrote rows, the WORKSPACE holds\nwhich record each row became, under the row\'s own `<entity>:<ref>`:\n`delete_records` over them is how a seeded set is reset, and applying again\nre-dates it.\n\n`fields` is keyed by field alias, and every value is read against the field\'s\nDECLARED type:\n\n| Field type | Value |\n|---|---|\n| `text` / `number` / `boolean` | the value itself |\n| `date` | `"2026-03-14"`, or a relative expression (below) |\n| `select` | the option ALIAS \u2014 `"gold"`, or `["gold","vip"]` for a multi-select |\n| `select_record_link` | `"<entity-alias>:<ref>"` naming another row in this file \u2014 `"customer:acme"`, or an array for several |\n| `select_member` | `"self"` only \u2014 the person applying the model |\n| `files` | paths beside this file \u2014 `["scans/pccc_letter.png"]` \u2014 uploaded by `apply`/`setup` before the rows are posted; or `fil_` ids of files already in this workspace |\n| `formula`, `rollup`, `lookup`, `autonumber` | not allowed \u2014 the platform writes these |\n\n**Documents can be attached on their own, afterwards.** Rows land only into empty\ntables, so a model whose binaries were added after the first apply has no second\napply to carry them: `lotics scaffold apply model.json --documents` writes ONLY\nthe `files` cells, onto the records the first run created, found by each row\'s\nown `ref` in the binding the workspace holds \u2014 so a row added to or removed from\nthe file since changes nothing about the rest. Running it twice attaches nothing\nthe second time: the same path keeps the same file, and a cell is a set.\n\n### Relative dates\n\nA date cell holds a literal `YYYY-MM-DD`, or an expression relative to the day\nthe model is applied, so a screen that opens on "this month" is not empty a month\nlater:\n\n- `@today` \u2014 the day of the run, in the workspace\'s timezone\n- `@month-start` \u2014 the 1st of that month\n- either with a whole-day offset: `@today-14`, `@month-start+9`\n\n`@month-start` exists because `@today-N` cannot promise a month: applied on the\n2nd, `@today-3` lands in the previous one.\n\n## Field roles\n\n`field_roles` names the reporting role a field plays on its entity \u2014 keyed by\nentity alias, then field alias \u2014 so every screen over the entity agrees on\nwhich column names the row and which select is the stage. A shape\'s slot binds\nto it (\xA7 Apps and screens). Like `rows` and `apps`, it is this file\'s: `check`\nproves it and the workspace never sees it. Each role sits on the types that can\nanswer it:\n\n| Role | On | Meaning |\n|---|---|---|\n| `identity` | `text`, `select_record_link`, `formula` | what a PERSON calls the row \u2014 the register\'s first column; a link where the row is "the product, at this branch"; a formula where the name is computed, and then it may not be `format`ted as a figure. NEVER an autonumber: a minted code is a `reference`. One per entity |\n| `reference` | `text`, `autonumber`, `formula` | the key the SYSTEM files the row under \u2014 an order number, a container code \u2014 drawn as the supporting line under the name rather than as a column of its own, and leading where the entity has no `identity` at all. One per entity |\n| `mark` | `files`, or a `lookup`/`rollup` that resolves to one | the row\'s picture \u2014 its own, or the linked record\'s. NEVER A COLUMN: a register draws words, so a mark is projected only where a surface leads with one \u2014 the subject rung of a picture-led grid, and a record\'s itinerary. A child entity\'s mark reaches a record\'s run and nothing else. One per entity |\n| `lifecycle` | single `select` | the ordered stages a row walks; option order is the order. Which of them END the flow is `outcomes`, which parts of the flow they group into is `phases`, and `history` keeps the day each one was reached. One per entity |\n| `category` | single `select`, or a `lookup` that resolves to one | what the row IS \u2014 a kind, a service, a book. One badge in the field\'s own colour, with no ladder behind it and no flow to advance. Often a fact about the thing the row books rather than about the row, and then it is the lookup that reads it. Repeats: a row can be of two kinds of thing |\n| `measure` | `number`, `formula`, `rollup` | a level read against a limit \u2014 see `against` and `alert`. Money where the model says so, and then it prints as money |\n| `expected_set` | `select` | its OPTIONS are the required set (documents, checks, services); an option no row has is a gap to show, not nothing. A multi-select draws as a ring and a fraction wherever it is drawn \u2014 absence is the information, and a list of what IS there says nothing about what is missing |\n| `amount` | `number`, `formula`, `rollup` | THE money of a ledger row; `signed_by` says which way it moved, `against` names the reference it is quoted off. One per entity |\n| `when` | `date`, or a `formula`/`rollup`/`lookup` that yields one | the ledger or timeline date \u2014 stated, or derived: the day money MOVED is a formula over the two columns that could hold it. `due` makes it a DEADLINE; without it the date is the plain day it is. `until` names the stage of this entity\'s own `lifecycle` at which the countdown is spent, and says `due` by saying so. One per entity |\n| `slot` | single `select`, or a `datetime` `date` | where in the DAY a row sits \u2014 the run it is read in under its day\'s heading on an itinerary. A select\'s option order IS the run\'s order; a time is ordered by the clock. A plain `date` is refused: that is the day itself. One per entity |\n| `party` | `select_record_link`, `select_member` | WHO THE ROW IS FOR \u2014 the counterparty it was transacted with, or the workspace MEMBER whose work it is (a shift, an assignment, a timesheet period). A member is drawn as the person and opens nothing: they have no record in the app. One per entity \u2014 and left off where the `identity` IS the link to them: the row is then NAMED by that record, and a strip under the title would state them twice |\n| `parent` | `select_record_link` | the record this row belongs to \u2014 a line\'s order, a paper\'s case. The parent\'s record shows these rows; the row shows the parent as a fact. One per entity, and it links to an entity this model declares |\n| `contact` | `text` | a way to reach a party \u2014 an address, a number, the town it is in. The record draws them as ONE row of links under the name, so the role sits on every field that is one of them. Repeats |\n| `currency` | single `select` whose option LABELS are ISO 4217 codes | the money THIS ROW\'s figures are in. Every amount and every money measure on the entity is then printed per row rather than in one code for the whole column, and the select is not drawn as a fact of its own. One per entity |\n| `verdict` | `boolean`, `formula` | a settled pass/fail \u2014 ticked, or computed. TRUE is the PASSING side wherever it is drawn, a register\'s risk flag included, so a field whose true means trouble is the same fact asked the other way round. One per entity |\n| `obligation` | `date` | a day something is OWED by \u2014 a cut-off, a permit expiry, a payment due. It counts down by definition. `satisfied_by` names what CLOSES it (or `until`, the stage the record stops owing it at), `label` what is owed. Repeats: a row owes several things, and a shape that fans them draws one row each |\n| `origin` | `text`, single `select`, or a one-row `select_record_link` | where the row STARTS. Declared with a `destination` \u2014 a route has two ends, and one alone is refused \u2014 and then every surface over the entity draws the two as ONE reading, `Warehouse 4 \u2192 Site B`: on the register\'s supporting line after the key, and as one column on the child registers and party histories that list these rows. The two fields are then not facts of their own, and a `columns` clause naming either end is refused. One per entity, holding ONE place |\n| `destination` | `text`, single `select`, or a one-row `select_record_link` | where the row ENDS \u2014 the other half of the `origin`\'s route, and read only with it. One per entity, holding ONE place |\n\n**`due` is what makes a `when` a deadline.** A date a row is merely filed by \u2014 the\nday a lead arrived, the day a movement happened \u2014 is neither early nor late,\nhowever long ago it was. Without the clause every desk drew every `when` as a\ncountdown and a two-month-old lead read "40 days overdue" on a record nobody was\nlate on. So a bare `when` is a plain date, and `{ "role": "when", "due": true }`\nis the one that counts down. An `obligation` needs no clause: a day something is\nowed by is a deadline already.\n\n**`until` stops a countdown where the work is DONE.** A deadline counts down so\nsomebody acts on it, and a row that has arrived needs nothing: without the clause\na delivered order is tinted for a date it met, and every settled row past its day\njoins the urgent ones in the reader\'s glance. It names one option of the entity\'s\n`lifecycle`; at that stage, at every stage past it and at every `outcome`, the\ndate is drawn as the plain day it is. On a `when` it also says the date is `due`.\n\n"One per entity" is one COLUMN, never one value on screen. A second counterparty\nor a second parent stays a ROLELESS `select_record_link`: which field fills a\nslot is the screen\'s answer (\xA7 Apps and screens), and the extra link is a fact on\nthe row with its own section on the record, headed by that link\'s own label. A\nrole naming two fields would move the ambiguity into every shape that reads it.\n\nA COMPUTED field is admitted where its RESULT is what the role needs, and\nrefused where it is not: `identity` and `reference` need `text`, `when` a `date`,\n`mark` `files`. A formula\'s result is its `output_type`; a rollup\'s and a\nlookup\'s is read through the walk. So a formula yielding a number is refused in a\nname\'s place, a lookup landing on anything but `files` is refused as a `mark`, and\na formula declaring NO result is refused by all four \u2014 naming `output_type` as\nthe remedy, because a value drawn as a type nobody stated is the wrong cell with\nnothing saying so. The result also decides the DEVICE every screen draws the value\nwith: a rollup taking the `latest` of a set of dates is drawn as a date, a lookup\nof a select as the words it holds.\n\nA bare role name is the common form. A role that is read against a SECOND field\ntakes the object form:\n\n- **`measure`** names its limit: `against` \u2014 a constant, or a field on the same\n  entity the row states as a number (a `number`, or a formula or rollup whose\n  result is one) \u2014 and `alert`, which side of it needs attention, `over` a\n  capacity or `under` a minimum. The two come together.\n- **`measure`** names what its number COUNTS, where the unit changes how the row\n  is DRAWN rather than how the figure reads: `counts: "days"` spans a stop across\n  that many days of a run, so a three-night stay fills three of its days instead\n  of only the one it starts on, and `counts: "hours"` is how long a stop takes\n  INSIDE its day, stated beside it. Stated, never inferred \u2014 nothing about a `3`\n  says whether it is nights, pallets or hours, and a quantity drawn across a week\n  is a run nobody can read.\n- **`lifecycle`** names the stages that END the flow: `outcomes`, option aliases\n  of that select. A row in one has ARRIVED \u2014 delivered, cancelled, written off \u2014\n  so a desk draws them apart from the ladder instead of chaining them after each\n  other. Not every option may be an outcome, and terminal-ness belongs here, never\n  written into a stage\'s label.\n- **`lifecycle`** groups its stages into the parts of the flow they belong to:\n  `phases`, each a `label` and the `stages` under it. Nine rungs down one column\n  is a list nobody reads as a flow; the same rungs under three headings are three\n  pieces of work, and which belong together is the business\'s answer. Every stage\n  but an `outcome` falls in exactly one \u2014 a stage in two is drawn twice, a stage\n  in none vanishes off the ladder \u2014 and the outcomes may be placed in a phase or\n  left out, and are then read as a last part of their own.\n- **`lifecycle`** keeps every stage the row reached: `history: true`, or\n  `history: "<alias>"` to name the table. A ladder with no history reports where\n  a row IS and nothing about how it got there, which is the whole of what a\n  reader asks a pipeline. It is declared BESIDE `phases`, and refused without\n  them: the rungs a ladder draws are the live select\'s options, which nothing\n  reading a file or an app\'s spec can see, so `phases` is the one statement of\n  what the dates have to cover \u2014 and without it a rung the history cannot reach\n  draws undated on every record with nothing anywhere saying so. The flag is the\n  ONE statement: the model DERIVES a\n  child table from it \u2014 the link back to this record, the stage, the moment it\n  was reached and who moved it \u2014 and `check`, `apply`, `diff` and the app\n  generator all see that table exactly as they see a written one. Nothing else\n  declares it, and a file that also writes it by hand is refused. The generated\n  create stamps the rung the flow opens at and the generated editor stamps every\n  move after it; a stage changed anywhere ELSE is a rung with no date\n  (`docs/platform_gaps.md`). **A first apply backfills nothing** \u2014 `apply` writes\n  rows only into empty tables, and rows that existed before the flag walked their\n  stages before that table existed. The honest backfill is ONE opening row per\n  existing parent, at its FIRST stage, dated when that parent was created (true\n  by construction); the stage it stands on NOW is not dated unless that is also\n  the first. It is a create per parent \u2014 `lotics run create_records` \u2014 and\n  `scaffold apply` prints it as the work it did not do.\n- **`amount`** names the REFERENCE it is read against: `against`, a field on the\n  same entity the row states as a number. A price against the list it is quoted\n  off, a rate against the going one \u2014 and the catalogue item\'s record draws the\n  pair on one axis with the gap said in words. Never a constant (a price typed\n  into the model ages with nothing to update it) and never an `alert`: a limit is\n  a ceiling a row can pass, and beating a reference is the point.\n- **`amount`** names the select that SIGNS it: `signed_by`, a select on the same\n  entity, and `outflow`, the options of that select under which the amount is\n  money going out. Without it every shape over the ledger adds both directions\n  together: a month whose net was small reads as the total of everything that\n  moved, and the trend plots one rising line. The two come together, and\n  `outflow` is some of that select\'s options, never all.\n- **`expected_set`** names what CONDITIONS the set: `required_by`, a field on the\n  same entity, and `options`, which of that field\'s values require which entries.\n  A row whose value is not named requires nothing. Without it the denominator is\n  every option, so a set whose entries are mutually exclusive by kind reads\n  `1 of 4` on every complete row \u2014 a denominator no row can reach is worse than\n  no role. The field is a single `select`, keyed by its option aliases \u2014 or a\n  YES/NO the row answers itself (a `boolean`, or a formula resolving to one),\n  keyed by `"true"` and `"false"`: a check that FAILED owes its consequence \u2014 the\n  photograph, the owner, the day it is due \u2014 and there is no select of the record\n  that says so. `from: "parent"` reads that field off the record these rows hang\n  under instead, through this entity\'s own `parent` link: which documents an order\n  owes is the ORDER\'s type, and the papers carry no column that says it. Which of\n  the two a set takes is the set\'s own shape and not a choice \u2014 a multi-select\n  holds the whole set on one row and is narrowed by that row (`from` omitted), a\n  single select is one entry per row and takes `from: "parent"` \u2014 and the other\n  way round is refused rather than left conditioning nothing.\n- **`obligation`** names what ENDS it: `satisfied_by`, a `date` or a `files` field\n  on the same entity \u2014 the day it was done, or the paper that proves it \u2014 or,\n  where the business stamps nothing, `until`, the stage of this entity\'s\n  `lifecycle` at which the record stops owing it: a deposit is owed until the\n  order is paid, and nobody records the act of paying twice. One or the other,\n  never neither \u2014 without one every obligation the business ever met stays on the\n  desk. Optionally `label`, what is OWED as the reader says it ("G\u1EEDi SI"), which\n  is not what the column holding the date is called ("SI cut-off").\n\n```jsonc\n"field_roles": {\n  "product": { "name": "identity", "photo": "mark" },\n  "stock":   { "on_hand": { "role": "measure", "against": "minimum", "alert": "under" },\n               "uptime":  { "role": "measure", "against": 80, "alert": "under" } },\n  "order":   { "stage": { "role": "lifecycle", "outcomes": ["delivered", "cancelled"],\n                          // Two pieces of work, and every step dated.\n                          "phases": [{ "label": "Taking it on", "stages": ["placed", "confirmed"] },\n                                     { "label": "Getting it out", "stages": ["picked", "shipped"] }],\n                          "history": true },\n               // A DEADLINE COUNTS DOWN \u2014 `payment.paid_on` below is a plain day.\n               "ship_by": { "role": "when", "due": true },\n               // The day the papers are owed by, and the day they went.\n               "papers_due": { "role": "obligation", "label": "File the papers", "satisfied_by": "papers_sent" },\n               // Nothing stamps a deposit paid \u2014 the order\'s own stage ends it.\n               "deposit_due": { "role": "obligation", "label": "Take the deposit", "until": "delivered" } },\n  // WHICH PAPERS THIS ONE OWES IS THE ORDER\'S OWN TYPE, and no document says it.\n  "document": { "order": "parent",\n                "kind": { "role": "expected_set",\n                          "required_by": { "from": "parent", "field": "kind",\n                                           "options": { "export": ["invoice", "customs"] } } } },\n  // `kind` is the direction select \u2014 options `received` and `paid_out`, no role of its own.\n  // Every figure on a quotation is in the currency that row names.\n  "quote":   { "unit": "currency", "total": "amount" },\n  // What the price is quoted off, so the item\'s page reads one against the other.\n  "service": { "price": { "role": "amount", "against": "list_price" },\n               "kind": "category" },\n  // The day the money moved is neither early nor late, so it stays a bare `when`.\n  "payment": { "paid_on": "when",\n               "value": { "role": "amount", "signed_by": "kind", "outflow": ["paid_out"] },\n               // A receipt owes a receipt voucher; a payment owes an invoice and a payment voucher.\n               "papers": { "role": "expected_set",\n                           "required_by": { "field": "kind",\n                                            "options": { "received": ["receipt_voucher"],\n                                                         "paid_out": ["invoice", "payment_voucher"] } } } },\n  // A CHECK THAT FAILED OWES ITS CONSEQUENCE \u2014 keyed by the row\'s own answer,\n  // and the answer that owes nothing is omitted rather than named with an empty list.\n  "check":   { "passed": "verdict",\n               "evidence": { "role": "expected_set",\n                             "required_by": { "field": "passed",\n                                              "options": { "false": ["photo", "owner", "due"] } } } }\n}\n```\n\nIn a file that starts from a preset (\xA7 Starting from a preset), `field_roles`\nmay name the preset\'s fields as well as this business\'s own; a role the preset\ndeclares itself is kept unless this file names the same field, and `null`\nclears it.\n\n## Write rules\n\n`write_rules` is what only a CREATE meets \u2014 keyed by entity alias, like\n`field_roles`, and this file\'s in the same way: `check` proves it and the\nworkspace never sees it. An update names one field that moved; a create takes a\ndraft whole, so it has to know which row a name already belongs to, where a\nvalue comes from when nobody types it, and what a figure or a picker may hold.\nThe generator writes one `create_<entity>` workflow and one `New<Entity>Dialog`\nper entity an app can operate, from these clauses and the fields\' own\n`required`.\n\n```jsonc\n"write_rules": {\n  // A customer is RECOGNISED by their address. Where an entity names a customer\n  // as its `party`, the create takes the email instead of a picker, reuses the\n  // row it matches and mints one only where nothing does \u2014 so the book never\n  // grows a second Acme because somebody typed the name differently.\n  "customer": { "natural_key": ["email"] },\n  "order_line": {\n    "fields": {\n      // A line of nothing is not a line. Refused on create and on update, at\n      // the control the figure was typed into.\n      "quantity": { "min": 1, "max": 9999 },\n      // The price is fixed at the moment of ordering \u2014 COPIED off the product,\n      // not looked up for ever after, so the price list moving next week does\n      // not silently reprice an order already placed.\n      "unit_price": { "default_from": "product.price" },\n      // And nothing is sold off an empty shelf. The picker reads only the rows\n      // that answer this, and the write refuses the same rows again \u2014 a caller\n      // who never opened the picker is bound by it too.\n      "product": {\n        "options_where": {\n          "node_type": "group", "logic": "and",\n          "children": [{ "node_type": "condition", "type": "number",\n                         "field_key": "in_stock", "operator": "greater_than", "value": 0 }]\n        }\n      }\n    }\n  }\n}\n```\n\n| Clause | On | Meaning |\n|---|---|---|\n| `natural_key` | the entity | the field aliases a row is recognised by. A `text` key declares `unique: true` on the field itself \u2014 two rows sharing it would make find-or-create pick whichever the read answered first \u2014 and a key is `text` or `number`, because a person types it back |\n| `default_from` | a field | `"<link alias>.<field alias>"` \u2014 the value is copied from the linked row when the row is created, never asked. The link is a one-row link on this entity and `required`, because there has to be a row to read, and the two field types must match |\n| `min` / `max` | a `number` | the figure is refused outside them, on create and on update |\n| `options_where` | a `select_record_link` | an `and` group of plain conditions over the TARGET\'s own fields, each `field_key` a field alias. It narrows the picker\'s read and is refused again where the write lands, so the link is `required` |\n\nA field\'s own `required` is not here: the contract carries it, every write path\nrefuses the row by field name from it, and the generated panel stands its commit\ndown until the same set is filled. `unique` is the text field\'s own clause\n(\xA7 `text`) \u2014 the create says so at the control before the column does.\n\nWhat a create asks is what a person STATES. A `default_from` field is not drawn,\na `lifecycle` opens at its first rung, the stamp an obligation\'s `satisfied_by`\nnames is not asked (the row is only now taking that on), and files are attached\nto the row afterwards \u2014 one fact, one place. `scaffold check` prints every clause\nunder its entity in **Who writes what**.\n\n**The `parent` is prefilled only in the door that mounts the act.** A row opened\nfrom the record it hangs under takes that record from the door it was pressed\nin, so the link is neither asked for nor drawn. The same entity\'s act on its own\nregister has no such row, so there the parent is an ordinary picker the draft\ncannot be committed without \u2014 a payment opened from a money app belongs to a\ncase either way.\n\n## Apps and screens\n\n`apps` is the plan: each app the reader will build, as ONE REGISTER \u2014 a SHAPE\nover an ENTITY \u2014 under `screen`. Nothing here is built by the scaffold: the plan\nis what `lotics scaffold check` prints back, register by register with the field\nin every slot, so it is read and corrected before a screen exists.\n\n**THE PRINTOUT EXPLAINS ITSELF.** Everything the shape and the roles answered by\nthemselves is marked `(default)` \u2014 the door, the tab strip, the band\'s figures,\nwhat the rows lead with, how much room they take, which end the register is read\nfrom, the set a member lens opens on, how many rows a capped history stands at \u2014\nso a clause nobody wrote is never read back as one somebody did. And\n`lotics scaffold check --why` prints the RULE behind every binding and every\nsection, indented under the line it explains: which field filled a slot and what\nit was chosen from, why the record opens where it does, why a child\'s rows are a\njournal rather than a register, why a history is capped and a relation counted.\nEvery sentence is the derivation\'s own, so what the printout explains is what\ngets built.\n\n**THREE THINGS DECIDE EVERY SCREEN AND EVERY RECORD**: the SHAPE, whose slots are\nthe table below; the ROLES the entities declare (\xA7 Field roles), which fill those\nslots and decide what each child\'s rows become; and the CLAUSES, which are where\nthe plan overrides what the two would answer. This index says which is which, so\na clause is reached for only where the first two have no answer.\n\n**What a child\'s rows become.** One section per LINK into the record, and what\nthe CHILD declares decides its kind \u2014 the first line it answers wins.\n\n| Printed as | The child declares | The reader gets |\n|---|---|---|\n| `documents:` | an `expected_set` select, one entry per row | the desk of what is owed, each row\'s files attached to it |\n| `timeline:` | an `obligation` closed by a DATE, on rows with no `lifecycle` of their own | the ordered stops, the promised day against the day it happened |\n| `thread:` | a `markdown` body, a `party` and a `when` | the correspondence, its answer, and whose move it is |\n| `journal:` | a `markdown` body and a day, on rows a record OWNS (`parent`) with no `lifecycle` | the log \u2014 each entry read in full under its day, its selects beside it, and a composer that writes the next one |\n| `itinerary:` | a `when` and a `lifecycle`, on rows a JOB\'s record OWNS | the day heads the run, one line per stop, the sum under it |\n| `lines:` | anything else the record owns (`parent`) | the register of the rows it is made of |\n| `history:` | anything else NAMED BY it \u2014 the link is their `party` or their `identity` | the same rows read as that record\'s own history \u2014 on a PROFILE, every one of them stands open at its latest 5, headed by how many there are in all, with the rest a press away |\n| `via <link>:` | a link carrying neither role | the register, headed by that link\'s own label |\n| `related:` | rows of an entity this app lists NOWHERE | one counted line, and a press that opens their register |\n\nA child carrying the BODY and the party who wrote it, and no day, is a plain\nregister, and `scaffold check` names the declaration it is one short of rather\nthan letting it fall through silently. A `party` beside a `when` and no body is\nnot a near miss \u2014 that is every ledger line there is.\n\n**A LOG\'S DAY is the child\'s `when`, unless that `when` counts down** (`due`,\n`until`): a deadline is the day an answer is OWED, so a log stacked on it would\nput the entries nobody has chased at the top. Then \u2014 and where the child declares\nno `when` at all \u2014 the day is the first `date` no role claims. A child carrying a\n`lifecycle` is never a log, on the same rule a run of stops reads: it is a thing\nbeing WORKED, and the prose on it is a note about the job.\n\n**A child\'s columns read, and are given up, in one order**: identity \xB7 when \xB7\nlifecycle \xB7 category \xB7 amount \xB7 measure \xB7 expected_set \xB7 party \xB7 contact \xB7\nverdict. The DAY outranks the counterparty because a list of rows belonging to\none record is scanned by when \u2014 the counterparty repeats on every row, and on a\nlog there is none. Ranked the other way, a narrow register shed the date and kept\na column that said the same thing on every line.\n\n**A section names its link where two of them would read alike.** One child can\nreach a record through several links and land under the same heading twice, which\nis the same sentence with nothing saying which rows either holds \u2014 so each of\nthose says the link it is read through (`timeline: Stops via Billed to`), and a\nchild reaching the record once is named by the rows it lists.\n\n**The clauses, by name.** On the APP: `scope`. On the `screen`: `record`, `tabs`,\n`slots` (`roles` on a `custom` one), `columns`, `writes` (`false`, or\n`"children"` for the rows a record owns and not the record), `period`, `filters`,\n`summary` (`above`, `totals`, `ageing`, `trend`), `facts`, `presentation`\n(`lead`, `density`, `layout`, `until`), `acts` (`row`, `record`, `selection`,\n`export`, `import`), `section_acts`, `sections`. Every one is optional, every one\nis printed back by `scaffold check`, and a screen that states none gets what its\nshape and its roles answer by themselves.\n\n**ONE APP IS ONE REGISTER AND THE RECORDS IT OPENS.** A second register beside\nit is a second job on one page: the reader arrives on whichever the nav listed\nfirst and decides, every time, which of the two they came for. So an app has one\ndestination and everything else about a row is DISCLOSED by opening it \u2014 the\nfacts by tier, the children as lists, the related as counts, one primary act, and\na filter or a group where a strip of destinations would have been. What used to\nbe a second screen is a section of the record, or another app; a model still\nsaying `screens` is refused by name.\n\n**The unit of an app is a JOB, not a person and not a table.** A job has its\nown outcome (something exists or is settled when it is done), its own subject\n(the record it advances), and an end that does not wait on the rest of the\nwork. Two tasks are ONE job when neither finishes without the other and both\nadvance the same record. One app per job, and that is what makes an app a\nwrite-ownership boundary: what the job settles is its app\'s alone to write,\nplus everything it must read to settle it well. A person holding several jobs\nopens several apps \u2014 one app for everything one person does is the dump. A step\nof the job is a section of the record, never a register beside it; a reference\nthe job needs at hand is read inside the record it is about.\n\n**Two people signing is two jobs**, because the outcome belongs to the signer:\nthe desk that prepares against the gate that releases. So is a different\ncadence \u2014 reference data edited monthly and read by the public site, beside a\ndaily desk \u2014 and a different reader, the owner\'s read-only questions. Device,\nplace and step never split a job. A super app holds more than one job; an\nover-split holds less than one, a job cut by device, place or step. The count\nper workspace falls out of the jobs, typically two to six, and is never the\ninput: review the plan app by app, naming who holds it, the job in one\nsentence, what it writes and what it reads.\n\n**A party is not a job.** The people and companies a job\'s rows name \u2014 the\ncustomers, the suppliers, the carriers \u2014 are not a job of their own, however\nmany rows name them: nobody\'s day is "the customer book". They live inside the\napp whose rows name them: a create takes the party by its natural key, the row\'s\nname opens the party\'s own record (a profile \u2014 how to reach them, what is live\nwith them, their history, their journal), and its facts are edited there. A\nparty earns an app of its own only where someone\'s job IS the relationship, with\nan outcome of its own \u2014 an account plan signed, a supplier qualified \u2014 never\n"keeping the book". Two apps for one seller, the deals and the customers, is the\ndump cut in two.\n\n*A two-van appliance repair shop.* The technician\'s job is the call-out: the\noutcome is a visit done, the subject is the call-out record, and quoting it and\nscheduling it are one job, because neither finishes without the other and both\nadvance that record. The owner holds two of his own \u2014 billing the month\n(outcome invoiced, subject the invoice, settled against visits already closed)\nand the price list the booking page quotes from, edited monthly. Three jobs,\nthree apps, and the owner opens two of them.\n\n**Inside a job the caps hold**: six flow stages on a desk, seven facts before a\nrecord\'s fold. Past them, look for the second job hiding inside. And a job\'s app\nis DENSE: every create the job needs lives in it, so its user never leaves it to\ncorrect a figure the screen in front of them is stating \u2014 three workflows is a\nscreen, not a desk.\n\n**A handoff is a stage change.** Where one job ends the record moves stage and\nthe next job\'s desk opens on it; a field two jobs must both write is declared\nshared at the split, naming the stage each may write it in.\n\n**Name an app for the JOB, in the trade\'s own words, never for who it is for.**\nA title on the door says nothing about what the person who opened it came to\ndo, and it is wrong the day the org chart moves.\n\n```jsonc\n"apps": [\n  {\n    "alias": "sales", "name": "Sales",\n    "description": "\u2026", "icon": "briefcase", "theme": { "color": "blue" }, // optional\n    "screen":\n      { "alias": "orders",    "label": "Orders",    "shape": "lifecycle_desk", "entity": "order",\n        "record": "drawer",                  // optional \u2014 "drawer" | "page"; absent, the shape decides\n        "tabs": "stage",                     // optional \u2014 the entity\'s lifecycle, or null; absent, the shape decides. Any other select is a filter\n        "writes": false,                     // optional \u2014 default TRUE; false is a reader, "children" operates only the rows the record owns\n\n        "period": "due_date",                // optional \u2014 any field whose value is a date, derived ones included\n        "filters": ["kind",                  // optional \u2014 a single-select, or a lens the model states itself\n                    { "label": "Qu\xE1 h\u1EA1n l\u01B0u", "predicates": [\n                      { "label": "\u0110\xE3 qu\xE1", "tone": "red",\n                        "where": { "node_type": "group", "logic": "and", "children": [\n                          { "node_type": "condition", "field_key": "owed", "operator": "greater_than", "value": 0 }] } }] }],\n        "summary": { "totals": ["total"], "above": ["total", { "field": "owed", "at": "end" }],\n                     "ageing": { "amount": "owed", "due": "due_date", "buckets": [30, 60, 90] },\n                     "trend": { "field": "total", "direction": "up" } },  // optional \u2014 see below\n        "facts": { "groups": [{ "caption": "Pricing", "fields": ["rate", "surcharge"] }] },  // optional \u2014 the record\'s named bands\n        "presentation": { "lead": "none", "density": "dense" },  // optional \u2014 how it is DRAWN; absent, what the rows are decides\n        "acts": { "row": [{ "label": "Issue the note", "template": "debit_note", "place": "cta" },\n                          { "kind": "agent", "label": "Read the papers", "agent": "reader", "fills": ["ref", "due_date"] },\n                          { "kind": "workflow", "label": "Hand it to dispatch", "workflow": "hand_to_dispatch",\n                            "inputs": { "order_id": "record", "owed_by": "due_date" } }],\n                  "record": [{ "label": "Print the file", "template": "dossier" }],  // optional \u2014 the record\'s own header menu\n                  "selection": [{ "label": "Statement", "template": "statement" }],  // optional \u2014 the work it hands on\n                  "export": true,                                                    // optional \u2014 the rows in view, saved\n                  "import": { "kind": "import", "label": "Upload the sheet",         // optional \u2014 a file turned into rows\n                              "entity": "order", "key": "code", "columns": ["rate"] } },\n        "section_acts": { "line": [{ "label": "Chase the lines", "template": "chaser" }] },  // optional \u2014 a verb on one section\n        "sections": { "line": { "draw": "worksheet", "cost": "buy_rate", "sell": "rate" },  // optional \u2014 priced lines, worked down in place\n                      "payment": { "draw": "ledger", "summary": ["total", "paid", "outstanding", "due_on"] } },  // optional \u2014 a book headed by what it is read against\n        "slots": { "identity": "code",       // optional \u2014 slot \u2192 field, where the roles cannot decide alone\n                   "subject": ["customer", "project"],              // \u2026or the TIERS a fold walks down, outermost first\n                   "stage": { "field": "state", "quick": true } },  // \u2026or the field AND the reader\'s own control for it\n        "columns": ["source", "owner"] }     // optional \u2014 extra facts after the slots, shed first at narrow width\n  }\n]\n```\n\nA shape is a proven screen with named SLOTS, each filled by a field carrying a\nrole (\xA7 Field roles). A slot with exactly one candidate on the entity binds by itself;\ntwo candidates need naming in `slots`; a field fills one slot; a required slot\nwith none is refused \u2014 a lifecycle desk over an entity with no `lifecycle`\nselect cannot be built.\n\n**A LIST IS A HIERARCHY, not a set of columns.** A group register\'s `subject`\ntakes one \u2014 `"subject": ["customer", "project", "order"]`, outermost first \u2014 and\nthe register becomes one the reader walks DOWN: it folds by the first tier, a\nnode narrows to the tier inside it, the last tier opens the set behind the\nfigure, and a trail says where they are. Every tier is a field of this entity\ncarrying a role that slot accepts, and none of them fills a second slot. It is\nthe slot\'s own answer that decides: a list on any other is refused, because two\ncolumns in one cell is not a fold. Without it the same business needs a register\nper depth, and the same money is folded twice with nothing saying it is the same\nmoney.\n\n**AND ON A SLOT READ AGAINST A LIMIT A LIST IS SEVERAL MEASURES** \u2014\n`"level": ["received", "invoiced"]`, at most four, each drawn as a named meter\nline inside the ONE column and each read against its OWN `against`/`alert`. A\nrow is regularly scored against more than one target at once, and the second\nreading put in `columns` instead draws a figure bare with the comparison handed\nback to the reader. Every entry states a limit \u2014 a bare measure in the list is\nrefused, naming the clause \u2014 and `quick` is refused beside one, because a typed\nfigure is one cell. The FIRST leads: it is what `summary.above: "counts"` counts\npast-limit rows on and what a live board ranks its exceptions by, both of which\nname one set.\n\n**A QUICK SLOT IS FOR A DECISION THE READER MAKES FROM THE ROW ALONE.** A slot\'s\nvalue in `slots` is normally the field\'s alias; `{"field": \u2026, "quick": true}`\nsays the column is not a reading of that value but the CONTROL for it \u2014 pressed,\nit writes that one field as a diff through the record\'s own update, so the\nregister and the page behind it land the same write. THREE roles are such a\ndecision, and `quick` on any other is refused: a `lifecycle`, which rests as the\nstage\'s own dot and label, takes a rule under it on hover and focus, and opens\nthe field\'s stages with the ones that END the flow last \u2014 ONE control, which IS\nthe reading;\na `verdict`, which is the switch; and a `measure`, which is the figure typed in\nits own cell \u2014 a reading taken per row IS the row, which is what a timesheet\'s\nhours and a count sheet\'s tally are. Everything else is decided against what the\nrecord holds, and the record has to be open. All three carry the record\'s own\nblockers \u2014 a move the ladder holds is a move the cell holds, and it names the\nentries the row still owes \u2014 and an outcome asks before it commits. Add `"order": "sequence"`\nwhere the stages are a WALK rather than a set of destinations: the picker is then\nordered as the walk and the step the row takes next is MARKED in it. It never\nadds a second control \u2014 a column that answered with a reading in some rows and a\nverb in others is two columns about one value. A screen stating `writes: false`\nrefuses `quick`: a reader who may operate nothing has no decision to take.\n\n**THE SLOTS ARE THE ROW\'S ANSWER; `columns` IS ITS CONTEXT.** `"columns":\n["nguon", "phu_trach", "nhu_cau"]` names extra fields of the entity, drawn AFTER\nevery slot and in this order, each by what its column IS \u2014 a chip for a select,\nthe person\'s name for a member, the day for a date, the figure for a number, a\ntick for a boolean, the words for everything else. They are ranked BENEATH every\nslot, so a phone sheds all of them before it sheds any of the shape\'s own\ncolumns. **A COUNT IS NOT A COLUMN**: an entry whose field is a `rollup` that\nCOUNTS rows is read as the thing it counts \u2014 `3 b\xE1o gi\xE1 \u0111ang m\u1EDF`, the number then\nthe column\'s own label \u2014 on the name\'s supporting line at every width, so it\ntakes no seat and a count of nothing draws no run at all. Where the record LISTS\nthose rows, the reading is the press that opens it. At most four, and refused\nwhere one would say what a slot already says,\nover a files field (files are read, so they are a section of the record), over a\ncell holding several (a column of comma lists compares nothing), on a shape whose\nrows are not the entity\'s records in a table, and beside a `presentation.layout`\nthat draws the rows with a device of its own. A fifth fact worth the width is a\nslot the shape is missing \u2014 say so rather than widening this clause.\n\n| Shape | Answers | Required | Also fills | Record | Tabs |\n|---|---|---|---|---|---|\n| `lifecycle_desk` | what is stuck, what do I move next | `lifecycle`, `identity` | `mark`, `party`, `amount`, `measure` (level, one or several), `when` | page, or drawer where the entity carries `parent` | the lifecycle\'s stages |\n| `party_register` | who is this, our history, is there a risk | `identity` | `mark`, `contact`, `measure` (worth), `verdict` (risk) | page | none |\n| `offering_register` | what do we offer, at what price, can I sell it | `identity` | `mark`, `amount` (price), `measure` (availability) | page | none |\n| `transaction_ledger` | does this period reconcile, what is unexplained | `when`, `amount` | `identity` (reference \u2014 the line\'s own number), `party`, `lifecycle` (classification), `expected_set` (document) | drawer | none |\n| `monitored_asset_set` | what needs attention, is that number normal | `identity`, `measure` (level, one or several) | `mark`, `lifecycle` | drawer | none |\n| `obligation_desk` | what is due next, and has it been done | `identity`, and at least one `obligation` on the entity | `when` (runway) | page | none |\n| `trend_deep_dive` | how did the period go, and why | `when` | `measure`, `amount` | drawer | the series, where the model names a select |\n| `reconciliation_desk` | what does not match, and by how much | `identity` (reference), and two figures \u2014 `ours` and `theirs`, each an `amount` or a `measure` | `category` (reason), `verdict`, `when` | drawer, on the PAIR | the dated runs, where the model names a select |\n| `entry_matrix` | one value per subject per period | `identity` (subject), `across` \u2014 a `when`, or a `category` for a fixed column set | `measure` (value), `lifecycle` (state), `category` (note) | drawer, on the cell\'s row | none |\n| `guided_run` | complete an ordered sequence, a step at a time | `identity` (step) | `slot` (sequence), `capture` \u2014 a `measure`, `verdict` or `expected_set` \u2014 `verdict` (gate), `mark` (media) | page: the run IS the record | none |\n| `live_board` | is everything OK, right now | `lifecycle` (state), `identity` | `verdict` (exception), `when` (since), `measure` (level, one or several), `category` (where) | drawer | none |\n| `group_register` | what does each group come to, and what is behind it | `subject` \u2014 a `category`, `party` or `when` | `amount`, `measure`, `identity` (member) | page: a row is an aggregate, and the door is the SET behind it | none |\n| `media_set` | scan a body of pictures by where they belong | `mark` (picture), `identity` | `category` or `party` (group), `when`, `verdict` (current against superseded) | drawer | none |\n| `day_sheet` | what happened on each day | `when` (the day) | `lifecycle` (state), `measure` (level, one or several), `amount`, `category` (note) | page: a day composes several child logs | none |\n| `resource_schedule` | what is on each resource, in what order, under what ceiling | `lane` \u2014 a `party` or a `parent` \u2014 `identity`, `when` (the start) | `measure` (duration), and `load` and `bulk`, each a `measure` read against a ceiling of the LANE\'s \u2014 a vehicle fills by weight and by room and stops at whichever runs out first; `lifecycle` (stage) | drawer, over the lanes | none |\n| `worksheet` | priced lines the reader edits, totalling to one figure | `identity` | `category` (group), `measure` (quantity), and `cost` and `sell`, each an `amount` or a `measure` | drawer, per line | the versions or the jobs, where the model names a select |\n\n**A record is one of five KINDS, and the shape plus the roles decide which.**\nEvery one of them is ONE READING COLUMN, and the ORDER of that column is the\nwhole of what the kind means.\n\n| Kind | The column, top to bottom |\n|---|---|\n| WORK RECORD \u2014 a `lifecycle_desk` over rows that belong to nothing and that nothing transacts with | the one act that moves it \xB7 what it IS \xB7 the papers it owes \xB7 the rows it is made of \xB7 the book of what it came to |\n| LINE \u2014 the same shape over rows carrying `parent` | its ladder \xB7 the arithmetic behind its amount \xB7 the rows and papers under it \xB7 its particulars, last (the key it is filed by is the line under its title) |\n| PROFILE \u2014 a `party_register`, and any shape over an entity whose rows other entities are NAMED by (their `party` or their `identity`) | where it stands \xB7 its history, OPEN, grouped by year \xB7 the rest of its registers \xB7 its facts (the ways to reach it are under its name, its settlement is the band, and a `when` it owes closes that band as a countdown) |\n| CATALOGUE ITEM \u2014 an `offering_register` | its own words (the picture leads the header at media scale, the price is read against its reference in the band) \xB7 what uses it \xB7 its facts |\n| EVIDENCE \u2014 a `transaction_ledger` | the PROOF \xB7 what the paper is, compactly \xB7 the rest \xB7 the links to the record it settles and the party it was with |\n\nNothing in the file states the kind: a clause that could say it could say the\nwrong one, and the model already says it \u2014 `parent` says whether a row stands\nalone, and a link NAMING this record (`party`, `identity`) says whether other\nrows are ABOUT it. So a desk over accounts\nwalking their own stages opens a PROFILE: the quotes and the invoices naming\neach account are what its record is read for, and a work record would have\ncounted them in one line at the foot. `record`\noverrides the DOOR where the shape\'s own answer is not the one wanted \u2014 and its\nthird value, `"expand"`, is not a door at all: the row REVEALS what it holds in\nplace, where there is nothing behind it worth navigating to. A row read that way\nreads as a LINE whatever the shape would have opened: its ladder, the arithmetic\nbehind its amount, then its particulars, because there is no header above it to\nhave stated the name first. It is REFUSED for two reasons, and they are not the\nsame refusal. On a shape whose record is a page by nature \u2014 a `guided_run`, a\n`group_register`, a `day_sheet`, an `obligation_desk` \u2014 because each of those\nstates the opposite where its door is declared: what its row leads to is read\nwhole, not as four more columns than the register had room for. And on a shape\nthat draws its rows with a device of its OWN \u2014 an `entry_matrix`, a `media_set` \u2014\nbecause a cell of a grid and a tile on a wall have no band under them for the row\nto reveal into. For the same reason a revealed register is drawn as a TABLE: a\n`presentation.layout` of anything else is refused, and the reader is not offered\nthe arrangement either, since it would take away the only door the register has.\n\n**`scope` \u2014 the one subject every read of the app narrows to.** Stated on the\nAPP rather than on its screen, because it is not a filter: a record opened under\nit stays under it, the pick survives closing the app, and every app declaring the\nsame `entity` shares one pick per viewer \u2014 which is the whole value, and what\nstops a construction workspace asking which project twelve times. `entity` is the\nmodel\'s entity whose one row the app is read inside, and `param` is what the\napp\'s reads take that row by.\n\n```jsonc\n{ "alias": "site_work", "name": "Site work",\n  "scope": { "entity": "project", "param": "project_id" },\n  "screen": { \u2026 } }\n```\n\nThe register\'s own entity has to REACH it \u2014 its own rows, or rows that name one\nthrough a link \u2014 or the switcher is a control that changes nothing. Until a\nsubject is picked the app reads NOTHING and says which one it is waiting for: an\nunscoped read over a scoped app is every row in the workspace drawn as one\nproject\'s work, which looks correct.\n\n**ONE RECORD SURFACE PER ENTITY, AND ITS KIND IS THE ENTITY\'S.** An app is one\nregister, so the record its rows open is the register\'s own and the kind comes\nfrom that register\'s shape. Another app over the same entity opens the same kind\nof record: a payment read from a cash book and one read from a trend are both\nmovements, and both read proof first. A shape with no kind of its own (a trend, a\nmonitored set, a `custom` screen) says only where the record opens.\n\n**A NAMED PARTY HAS A RECORD SURFACE IN THE APP.** One register, but the party\nits rows name \u2014 by `identity` or by `party` \u2014 opens a record of its own, a\nPROFILE, from the cell that names it and from the record\'s header: the ways to\nreach them, what is live with them, every register that names them at its latest\nfive, their journal, their facts. It is the app\'s to write as far as the job\nneeds \u2014 the party\'s facts and its journal \u2014 and the writers matrix says so; the\nregister\'s own record stays the register\'s. A party named through a link\ncarrying no role opens nothing, and neither does a party that is a MEMBER \u2014 a\nperson of this workspace has no row in any book the app carries, so the cell and\nthe header state them and stop.\n\n**Two things a register states about a row beyond which field fills which slot.**\nA `measure` is read AGAINST its limit (`against`/`alert`) where the shape\'s slot\ntakes one \u2014 `level`, on a lifecycle desk, a monitored set, a live board and a day\nsheet, a schedule\'s `load` and `bulk`, and every slot of a\n`custom` screen, which composes the frame\'s own column; `worth`, `availability`\nand a trend\'s headline are plain figures, and a limit there would read as a meter\nin the record over a number the row printed bare. And the name carries a\nSUPPORTING LINE where the entity states a key to file the row under: the `parent`\nit belongs to, its `reference`, an `autonumber`, a text formula \u2014 in that order,\nfirst hit wins, never a field a person types prose into. Every record heads with\nthat same key, so the register and the door it opens name one row one way.\n\n**The act that opens a row belongs to a register that LISTS the entity\'s rows**\n\u2014 a desk, a register, a ledger, a monitored set, or a `custom` screen. A shape\nwhose rows are not records has neither that act nor the door a counted line\nelsewhere leads to: an obligation desk\'s rows are deadlines and a trend\'s are\nperiods, so a create pressed there would open a row the screen cannot show. An\nentity whose only app is one of those has no create at all \u2014 give it an app whose\nregister its rows are read in.\n\n**An `obligation_desk`\'s rows are not its entity\'s rows.** The shape fans the\nentity\'s `obligation` fields out \u2014 one row per thing still owed, which is one\nwhose date is SET and whose `satisfied_by` is empty \u2014 so a l\xF4 with four cut-offs\nis four rows, and the three it has met are not there at all. The row\'s name is\nthe obligation\'s, its supporting line the record\'s `identity`, and the door is\nthat record. A `when` bound to `runway` is what the countdown\'s ring is measured\nfrom. Over an entity declaring no `obligation` the shape is refused: there is\nnothing to count down to.\n\n**What a register carries beyond its columns.** Six clauses, each emitted as\nthe prop the kit draws it with; every one is optional and a screen that states\nnone gets a register of columns and nothing else.\n\n- **`period`** \u2014 a field on the entity whose value is a DATE. The toolbar gains a\n  date-range control (this month to start), and the rows it keeps are what the\n  register AND every figure below are computed over, so a band can never be over a\n  different window than the rows under it. Any such field, not only the `when`\n  role, and however the date got there: one table is read two ways (a cost ledger\n  by the day a line arose, the cash book over the same table by the day it\n  settled), a role is one field\'s, and the day money MOVED is often a formula over\n  the two columns that could hold it \u2014 which then declares `output_type: "date"`.\n  A `trend_deep_dive` brings its own period and takes none here; a `live_board`\n  is PERIODLESS and takes none either, for the opposite reason \u2014 it answers what\n  is true NOW, and a date range over it draws what was true in the window in the\n  live state\'s own colours.\n- **`filters`** \u2014 the chips beside the search. A single-`select` field\'s alias\n  offers that field\'s own live options; it is the lens a register is read through\n  over and above the one band its strip gives, so the strip\'s own field is\n  refused here (one dimension, one control) and so is a multi-select (a row would\n  answer the chip several ways at once). The rows the register and every figure\n  below are computed over are what the chips AND the period kept.\n  A `select_member` field\'s alias is the third form and asks one question \u2014 whose\n  rows these are: two peers, MINE and ALL, read against the person looking rather\n  than a directory of everybody. `{"field": \u2026, "default": "mine"}` opens the\n  register on the reader\'s own; that form on any other type is refused. Alone of\n  the chips it narrows the READ (a `member` param on the register\'s query), so a\n  desk that opens on the reader\'s work opens on all of it rather than on\n  whichever of their rows the first page happened to hold.\n  A DERIVED LENS is the other form \u2014 `{"label": \u2026, "predicates": [{"label": \u2026,\n  "tone": \u2026, "where": \u2026}]}` \u2014 where the sets a reader narrows by are ones the\n  MODEL names and no column holds: rate validity, plan urgency, free-time\n  overrun. Each `where` is an `and` group of plain conditions over the entity\'s\n  own fields, each `field_key` a field alias, and it is read off the row, so the\n  operators are the comparisons a value answers \u2014 `number` and `text` equality,\n  `number` ordering, `boolean` equality, `select` `has_any_of`/`has_none_of`, and\n  `is_empty`/`is_not_empty` on any of them. Nothing DATED: a relative point needs\n  a clock, and a screen states one date control (`period`), so a second beside it\n  would be two windows with nothing saying which a figure was computed over \u2014 a\n  date question is asked as a column the model derives and read here as a number\n  or a yes/no. `tone` is the option palette\'s, because the chip draws these\n  exactly as it draws a select\'s options.\n- **`summary`** \u2014 what the rows in view come to. `above` is a band OVER the\n  register: `"counts"` for how many rows are in view and, for the FIRST\n  `measure` the model gives a limit, how many are past it (accented only when\n  one is) \u2014 one such set, because a band naming three is the dashboard a\n  register is not; a list of number-field aliases for what they add up to, and a\n  `percentage` named there is refused, since a share summed over the rows in\n  view is a figure of no kind (draw it as a column, whose own total reads the\n  mean). A figure written `{"field": \u2026, "at": "end"}` is a STOCK instead: the\n  reading standing at the END of the window rather than the sum of the readings\n  in it, which is the only way opening + in \u2212 out = closing reconciles \u2014 a month\n  of daily closing stocks added together is thirty warehouses. The band labels it\n  as the snapshot it is, and it is refused on a screen that states no `period`,\n  since there is then no window for it to stand at the end of.\n  `ageing` stands in that same\n  band: an `amount` split by how many days past its `due` date each row is,\n  drawn as a `Breakdown` of the edges in `buckets` (30, 60 and 90 days unless the\n  model states its own, ascending). The ladder is the kit\'s \u2014 its boundary, its\n  words and its ramp \u2014 and it opens with what is NOT YET DUE, because a bar of\n  overdue bands alone is full at every input: a book with one late invoice and a\n  book that has gone entirely bad would paint the same solid width. Against the\n  current money the bar\'s own shape is the reading. A row whose date is empty is\n  in no band. `totals` is what the whole\n  view adds up, and it is drawn in that SAME band above the rows: a register\n  states one aggregate, over the rows the reader can see, in one place, and a\n  closing line under them is a second place to look and a second question about\n  which rows it covers. A closing line belongs to the one device that IS a\n  statement \u2014 a record\'s `Ledger`, whose balance is what it is read for, labelled\n  by its amount\'s own word. Where a shape has no band above (a trend, whose own\n  band is the chart) the figure stands under the register instead. A\n  `transaction_ledger` sums its amount column itself and takes `above` alone. An\n  `obligation_desk`\'s rows are DEADLINES and not records, so its band states\n  `"counts"` \u2014 how many are open \u2014 and a figure list, an `ageing` or a `trend`\n  over it is\n  refused: a l\xF4 with three cut-offs is three rows, and its freight added over\n  them is three times the freight.\n  `trend` is `{"field": \u2026, "direction": "up"|"down"}` and states WHICH WAY that\n  figure moved across the window: the rows in view are cut into the window\'s own\n  buckets \u2014 days over a month, weeks over half a year, months beyond \u2014 and the\n  later half of the CLOSED ones is read against the earlier half, drawn beside\n  the figures as one line, so a window the reader is still inside states the\n  movement of the days that have run rather than a fall into the ones that have\n  not. `direction` is which way is GOOD, which nothing about the number\n  says: a book wants its takings rising and a backlog wants its days falling, and\n  the same arrow is a win on one and an alarm on the other. It needs a `period`\n  to be a window of, and it is refused on a shape that draws its own (a\n  `trend_deep_dive` already draws the series) or that reads none at all (a\n  `live_board` answers what is true now). A window whose earlier half took\n  nothing draws no line: there is no base for a percentage, and 0 % would claim a\n  steadiness nobody measured.\n- **`facts`** \u2014 how the RECORD\'s facts are banded. `groups` is a list of\n  `{caption, fields}`: what a set of facts has in common is a sentence about the\n  business and nothing derives it, so a plan that states one gets exactly those\n  bands, in its own order, captioned. EACH BAND IS A SECTION of the record \u2014 its\n  own heading, its own entry in the rail, its own place in the column: under one\n  heading the reader is handed every particular at once, in a caption weight that\n  cannot out-rank the heading above it, with nothing in the rail to reach any of\n  them by. Everything the plan leaves unnamed is the LAST section and carries no\n  heading, since there is no sentence to head "whatever no group claimed" with \u2014\n  ONE section, even where the record\'s own recipe bands what was left in two (an\n  evidence record reads its particulars before the record and the party it was\n  with): both are groups inside it, because the word the kit heads "the rest"\n  with cannot name two entries in the rail.\n  A band of more than eight facts is NOTED: a section that long is two. A field the header, the band, the ladder, a required\n  set, the files or a register below already draws is refused: it is not a fact,\n  so a band naming it would either state it twice or draw nothing. Naming any\n  band IS the answer to which facts fold \u2014 see the TIERS below.\n- **`presentation`** \u2014 how the screen and the record it opens are DRAWN, where\n  what the rows are is not the answer wanted. `lead` is what each row leads\n  with: `"mark"` the subject\'s own mark, always spent because a party\'s initials\n  stand in for a picture nobody uploaded; `"picture"` the photograph, spent only\n  on the rows that carry one and, on the record, at media scale above the name;\n  `"paper"` the row\'s own files, drawn as the cards a pile of documents is read\n  as; `"figure"` the amount, with no gutter at all; `"none"` neither. `density` is\n  how many lines a row\'s subject may take \u2014 `"roomy"` two, `"dense"` one.\n  Both default, and the DEFAULT is what the rows are: a party register leads\n  with the mark, an offering register with the picture, a ledger with its\n  figure, and a desk \u2014 rows that are work still to do, scanned \u2014 stands its rows\n  one line each while a record\'s own rows are read roomy. So state it only to\n  differ, and a plan that states nothing still gets screens that vary. A lead\n  the rows cannot carry is refused: a mark, a picture or a paper where no column\n  is drawn as the rows\' mark, a\n  figure where no column is the amount, and the other subject\'s mark (which of\n  the two a row wears is the shape\'s, so the register and the record it opens\n  cannot call one row two kinds of thing).\n  `layout` is how the rows are ARRANGED \u2014 `"table"`, `"list"`, `"cards"`,\n  `"gallery"`, `"board"`, `"calendar"`, `"timeline"`, `"gantt"` \u2014 and it is\n  AFFORDED by what the rows carry, not by the shape: every register affords a\n  table and a list, a `mark` affords the two picture-led grids, a `lifecycle`\n  affords a board, a `when` affords a calendar and a timeline, and a `when`\n  beside a `measure` that `counts` DAYS affords a gantt, because a bar with no\n  length is a calendar drawn sideways and a bar measured in money or litres is a\n  length of another kind. `until` names the date field a bar ENDS on, where the\n  rows state one, and the days measure is what the bar runs for without it. A\n  layout the bound roles do not afford is refused, naming the ones they do.\n- **`acts`** \u2014 where this screen hands work on: `row` is the \u22EF menu on every row,\n  `record` is the \u22EF on the RECORD\'s own page header \u2014 the same reach as a row\'s,\n  standing where the work is open instead of while a list is scanned, and refused\n  on a record that opens as a drawer, which has no header of its own and whose\n  row already carries the register\'s menu \u2014 and `selection` is the bar over the\n  TICKED rows. `export` is the third reach \u2014\n  the WHOLE VIEW, saved in one press: `true` writes the rows as the register drew\n  them, in the columns it drew, as an `.xlsx`, and\n  `{"template": "\u2026"}` says the layout is the trade\'s and makes the paper with a\n  workflow like any other. It is never a list of columns: which columns the\n  export carries is what the screen already draws, and a second statement of it\n  disagrees the moment a slot moves \u2014 the generator reads them off the drawn\n  slots and writes them into the app, so the sheet\'s headings are the labels the\n  register drew them under.\n  `import` is the reach OPPOSITE it \u2014 a file turned into rows:\n  `{"kind": "import", "label": \u2026, "entity": \u2026, "key": \u2026, "columns": [...]}`. The\n  file is mapped column by column, each row is validated, what would change is\n  previewed, and the commit UPSERTS by `key` \u2014 which is why a sheet sent twice\n  moves no counts. That key is one of the entity\'s own `natural_key` fields\n  (\xA7 Write rules), and an entity declaring none is refused: without a key the\n  second run is a second set of the same rows. `entity` is the register\'s own \u2014\n  an app is one register, and rows filed into another entity are a count nobody\n  on this screen can check. `columns` is what the sheet may fill, in that order;\n  absent, it is every column a person states IN WORDS. A computed one is refused\n  because the workspace writes it, and a link, a member or a files column is\n  refused because a cell of a sheet is words and those hold a row of another\n  table or bytes \u2014 a file reaches another table through the party pattern (a\n  `natural_key` on the target, named rather than picked), which is a create\'s.\n  The generator writes the whole verb, as it does for a paper: an\n  `import_<entity>` workflow that finds the row by `key` and then changes it or\n  opens it, answering which of the two, and the staged run over it \u2014 drop, map,\n  the per-row verdict, the commit. A line whose cell the column cannot hold is\n  refused with the reason and the rest of the sheet still lands. A file MINTS\n  rows of the register, which is the Add many times over, so a screen stating\n  `writes: false` or `"children"` \u2014 which opens no row of its own \u2014 refuses the\n  clause; the `export` beside it stays, because it only reads.\n  Both spreadsheet reaches are read and written IN THE BROWSER, so the generated\n  `src/main.tsx` imports `@lotics/app-runtime/sheets` wherever the plan states\n  one of them and not otherwise; an app that has neither carries no spreadsheet\n  engine at all. An act names ONE of three things, never two:\n  - **`template`** \u2014 an `html` template this model declares (\xA7 Templates). The\n    paper is filled from ONE row in `row`, and from the whole ticked set in\n    `selection`. The generator writes the whole verb \u2014 a `generate_<template>`\n    workflow that reads the row and hands the file back, and a menu item that\n    opens it \u2014 so there is nothing left to bind. An `email` template is sent\n    rather than opened and is refused here; a file-backed template (`excel`,\n    `word`, `pdf-form`) is bytes a model has none of, so those stay the author\'s\n    own `lotics app workflow set`. Two screens over DIFFERENT entities cannot\n    name one template: one paper is filled from one kind of row.\n  - **`{"kind": "agent", \u2026}`** \u2014 a run over ONE row. `agent` is an alias the APP\n    declares (`package.json#lotics.agents`), because an agent is prose and tools\n    rather than anything a workspace model can state \u2014 `lotics app check` refuses\n    one nothing declares, exactly as it refuses a workflow nothing bound. `fills`\n    is the fields the run may write: pressed, the reader watches the run, reviews\n    what it proposes field by field against what the row holds now, and applies\n    the ones they kept as ONE write through the record\'s own update. A run can\n    reach nothing outside `fills`, a computed column there is refused (the\n    workspace writes those), and a screen stating `writes: false` refuses an\n    agent act outright. It belongs in `row`; the selection bar makes ONE paper\n    from many rows, and a run per ticked row is the row\'s own act many times.\n  - **`{"kind": "workflow", "workflow": "\u2026", "inputs": {\u2026}}`** \u2014 the work HANDED\n    ON: a lead becomes an opportunity, an order is split into the orders placed\n    on its suppliers, a request is closed. `workflow` is an alias the APP binds\n    (`package.json#lotics.workflows`), because the rule behind it is the\n    business\'s and no model states one \u2014 so the generator writes NO body and\n    `lotics app check` refuses an alias nothing bound, exactly as it refuses an\n    agent nothing declares. `inputs` is what the press hands that body: the\n    workflow\'s own input name \u2192 `"record"` for the row it was pressed on, or a\n    field of this entity for a value off that row. The value is what the\n    workspace HOLDS \u2014 an option\'s key, a linked row\'s id, the figure \u2014 never the\n    rendering. A files column is refused (the body reads the row\'s files off the\n    row it is handed), a column that is not a field of the entity is refused by\n    name, and one input short of the declaration is refused at the press, so the\n    whole act is dropped rather than shipped half-bound. It runs ON the press:\n    there is nothing to review first, which is the agent arm\'s law, and the\n    body\'s own sentence is what the reader is told either way. It stands in\n    `row`, in `record` and on a `section_acts` band \u2014 each reaches ONE row \u2014 and\n    is refused over the ticked set, where one act makes one paper from many. The\n    row it reaches is the RECORD\'s, so a screen stating `writes: false` or\n    `"children"` refuses a hand-off on every one of those surfaces, exactly as it\n    refuses an agent act.\n\n  **`"when"` stands an act down until the work is ready.** `{ "field": "<the\n  entity\'s lifecycle>", "in": ["<stage>", \u2026] }` offers the verb only while the\n  row stands at one of those stages. A verb that cannot work yet is worse than\n  no verb: the reader presses it, the body refuses, and nothing on the screen\n  ever said the work was not ready. Readiness is what a lifecycle states, so the\n  field named is this entity\'s `lifecycle` and nothing else \u2014 a category says\n  what a row is and a verdict answers a question, and neither moves. Refused: a\n  field that is not the lifecycle, a stage it does not declare, and every stage\n  at once, which is the act with no condition.\n\n  **`"place": "cta"` draws an act ON the row** instead of in its \u22EF \u2014 the one verb\n  a reader presses without opening a menu first. At most one per screen and every\n  other act stays in the menu, because the trailing gutter is paid for by every\n  row: a second is refused with *one verb on the row, the rest in its menu*. The\n  ticked set has no row of its own, so `cta` is refused there.\n\n  A hand-off\'s BODY is still the author\'s: `lotics app workflow set <alias>`\n  binds it, and `scaffold check` prints the act as `"<label>" \u2192 <alias>(\u2026) [you\n  write the body]` so it is read as work owed rather than as a verb already\n  wired.\n\n  A `selection` act is a `template` and nothing else: an act over many rows makes\n  ONE paper from them. The generator turns the register\'s checkbox gutter\n  on, emits a `generate_<template>` workflow taking the ticked ids, and the body\n  reads each row and passes them as `rows` \u2014 which is what the template iterates\n  (`{{#each rows}}`). One template is one paper AND one reach: naming the same\n  one from a row\'s \u22EF and from the bar is refused, because those are two bodies.\n  A shape whose rows are DERIVED rather than records \u2014 an `obligation_desk` \u2014\n  has no set to tick and refuses the clause. The paper is handed BACK, never\n  filed: a ticked set can hold rows of three different parents, so there is no\n  record on which "this document belongs here" is true.\n\n**`section_acts` puts a verb WHERE ITS EFFECT LANDS.** "Chase the paperwork"\nbelongs on the papers, not in the register\'s \u22EF two surfaces away. It is keyed by\nthe alias each section is DERIVED from \u2014 a field\'s (its progress, its prose, its\nrequired set, its charge, one of its files) or a CHILD ENTITY\'s (its register,\nits desk, its run, its thread) \u2014 because the sections come off the roles and the\nkey the app addresses one by does not exist until it is built. An alias naming no\nsection is refused, listing the ones that do; the facts band is what every other\nsection left over, so nothing addresses it. Each act is a `template`, an `agent`\nor a `workflow`, exactly as a row\'s is \u2014 the reach is the same one row \u2014 and\n`place: "cta"` is refused: a section is a band with a heading and has no row to\ndraw a verb on. `scaffold check` prints\nwhich section each alias landed on, which is the half an author cannot see in\ntheir own file.\n\n**`sections` says HOW one of those sections is DRAWN**, keyed by the same\naliases. It carries three readings.\n\n`"draw": "ledger"` heads a book of movements with what the record it is against\nis read against: `summary`, number or DATE fields of THIS record, in the order\nthey read \u2014 what is owed, and by when. Each is drawn as the record\'s own band\ndraws it: a measure with a bound is a meter, a date is a countdown, every other\nfigure is an amount. A date the record works TO is the default; a date a right\nRUNS OUT at \u2014 a free cancellation, a quote\'s validity \u2014 is written\n`{ "field": "refund_until", "sense": "expires" }` and reads closed rather than\nlate once it has passed. A\nsection with nothing in it is otherwise a heading, a verb and a void \u2014 and the\nemptiness is exactly when the reader most needs to be told what the rows would\nbe for, so the statement is drawn at nought rows too. The figures are the\nRECORD\'s rather than the child\'s for the same reason: a sum of the rows under it\nis the one statement a book with no rows cannot make.\n\n`"draw": "worksheet"`: the child\'s rows\nare PRICED LINES the reader works down in place, each part of the job footed and\nthe sheet closing under them. `cost` and `sell` name the child\'s two figures,\nwhich is the one thing the roles cannot decide \u2014 an entity carries one `amount`,\nand a line that is costed and sold carries two. Everything else is read off the\nchild\'s own roles: what a line is FOR is its `identity`, how many it is for is\nthe `measure` the pair left, and the part it falls under is its `category`. The\nMARGIN is on none of them, because it is arithmetic over the pair.\n\n`"draw": "itinerary"` says WHICH FOUR STATEMENTS each stop of a run is read by:\n`line`, in the order they read, from `when`, `kind`, `provider`, `stage`,\n`duration`, `caption` and `reference`. A stop is one press and its supporting\nline holds to one row at every width, so four is the whole of it \u2014 a fifth is a\nfact the stop\'s own drawer answers. Absent, a stop is read by `when`, `kind`,\n`provider`, `stage`, which is how a travel row reads; a roster is read by its\nhours and a courier\'s run by who is at the door, and nothing derives which:\n\n```jsonc\n// A cleaning round: the hour it takes and the flat it is at say more than the kind.\n"sections": { "visit": { "draw": "itinerary", "line": ["when", "duration", "provider", "stage"] } }\n```\n\nEvery run named is one the stops already carry \u2014 `duration` is the child\'s\n`measure` that `counts` hours, `caption` the second `party` a row names, `kind`\nits `category` \u2014 so a word the child declares no role for is refused rather than\ndrawn as a gap in every line, and so is the same word twice.\n\nA sheet is the WRITE side of a price, so it is the one child section whose cells\nare editors: a figure typed into a cell is written as a diff through the child\'s\nown update, which is the same editor the line\'s own drawer saves through. Every\nother child section is read where it is drawn and edited in the row\'s drawer. A\nline is ADDED from the section\'s heading as every child\'s row is, with the record\nit hangs under as the act\'s own context.\n\nRefused: an alias naming no register of this record, rows the record does not\nOWN (a line added to a history belongs to the job it is about, not to what is\nreading it), a figure that is not a field of the child or whose role is neither\n`amount` nor `measure`, a sheet naming neither figure, one figure priced as both,\na book headed by anything but a number field of the record, and a line on a\nsection this record draws as a register rather than as a run.\n\n**A CHILD NOBODY REGISTERS IS A NOTE, not a refusal.** Where a record lists a\nchild entity no app is a register of, `scaffold check` says `"<entity>" has no\nregister \u2014 its rows are read here and created nowhere` and the plan printout\nmarks that entity `(no app)`. Rows can arrive from an import or a workflow, so\nit is a reading rather than a rule; what it catches is the register somebody\nmeant to plan and did not. A section the record ADDS to is exempt, because its\nheading is where those rows are typed: the rows a record owns on a PAGE, a\nthread on any door \u2014 a reply is written where it is read \u2014 and a sheet, which\nopens its own lines. A record opening in a DRAWER adds none of them, so its\nowned rows are noted like anybody else\'s.\n\n`scaffold check` prints every clause a screen states, on its own line under the\nslots, spelling the screen\'s `writes` clause `operable` \u2014 the app manifest\'s\n`lotics.writes` keeps that word, and the two are different facts: `app create`\nSEEDS the manifest from the fields the screens\' own editors write, and from then\non the app owns the declaration `lotics app check` holds its bodies to.\n\nEach shape is a `@lotics/ui` component of the same name (`LifecycleDesk`,\n`PartyRegister`, \u2026) whose props are these slots, so once the tables exist\n`lotics app create <name> --from <this file>#<app alias>` scaffolds the app with\none screen per entry, each slot reading the field the plan bound.\n\n`"shape": "custom"` is the screen no registry row covers: it declares its own\n`roles` (slot name \u2192 role), and it is emitted on `ShapeFrame` \u2014 the one anatomy\nthe six shapes above are each a configuration of \u2014 so its strip, search,\nordinal, fit budget, empty and waiting states and record door are the same ones\nthey have. It opens the record its `record` says, drawer or page, like any other.\nA bound `lifecycle` slot IS its strip, the stages in the field\'s order as on a\ndesk, so such a screen names no `tabs`. Only a lifecycle earns a strip \u2014 each\ntab a queue of work at one stage \u2014 and a screen naming any other select as\n`tabs` is refused: a kind, a book, a channel is a `filters` entry beside the\nsearch. The three shapes whose strip means something of their own take any\nselect: a reconciliation\'s dated runs, a trend\'s series, a worksheet\'s versions.\n\n**An app IS its `app.json`.** `create --from` writes the bound plan \u2014 every\nscreen with its shape and slots, the record each row opens with its sections in\nthe archetype\'s order, the create panels, the acts \u2014 as one JSON document, plus\na five-line `src/main.tsx` that mounts `@lotics/app-runtime` over it and one\n`src/workflows/<alias>.ts` per write. There is no screen source: the runtime\ndraws the spec, so a kit correction reaches every app with its next install.\nWhere the plan has no word for what a screen or a section IS \u2014 or for what a\npaper act should ASK before it is made \u2014 the spec names one of the app\'s own\ncomponents and `src/components/index.ts` registers it, the one file under `src/`\na regeneration never rewrites. `lotics app eject <screen|<section key>|<act\nlabel>>` writes each of those, starting from what the runtime already drew.\n\n**How a spec reads a row.** Each query projects its columns under the alias the\nworkspace mints from the field\'s LABEL \u2014 never the alias this file keys it\nunder, which is the model\'s own namespace and which the workspace never saw. So\na field this file calls `partner` and labels `\u0110\u1ED1i t\xE1c` is referenced as\n`doi_tac` throughout the spec. Every id in it is live: the `tbl_` a screen is\nover, the `fld_` of each column, and the `opt_` of every option a role names.\n\n**Every query is described, in the model\'s own language.** The line an agent\nchooses between aliases by is written from this file\'s nouns \u2014 the entity\'s\nlabel, the screen\'s, the link\'s \u2014 and the sentence around them is the language\nthe file is mostly written in, decided the same way a generated write\'s refusals\nare. Hand-editing one is erased by the next regeneration; `lotics app check`\nrefuses an alias that carries none.\n\nA screen is that list and the RECORD it opens, and the record comes off the same\nroles \u2014 nothing to declare for it. It opens with a **header**: the entity\'s\n`identity` as the record\'s name \u2014 whether or not the list has a column for it, so\na ledger\'s and a trend\'s records are named too \u2014 the `mark` beside it on a PAGE,\nwhich is what the subject is recognised by (so the pile below is the papers that\nare left, and a `presentation.lead` spending that gutter on something else leaves\nthe picture in the pile), the `when` this screen reads\nunder it, and ONE headline\nfigure (the `amount` the screen reads, else its `measure`). BOTH DOORS state the\nname: which door a screen uses is a layout answer, and what the record is ABOUT\nis not.\n\n**A JOB\'S HEADER ALSO STATES WHO IT IS FOR.** Where the record is the work itself\n\u2014 a desk\'s rows that belong to nothing, opened on a page \u2014 its `party` is a link\nunder the name, beside the ways to reach the subject, or, where that party is a\nworkspace MEMBER, the person themselves with no door behind them, and it is then\nnot a fact\nas well: a page headed by a code alone said nothing about whose work it is, and\nthe one thing a reader arriving from the desk already knows the row by sat in the\ngrid below as a row among forty. A record opening in a DRAWER has no row of links\nto hang it on, so its party stays a fact; so does a LINE\'s, whose register files\nit under the thing it belongs to and whose party is that parent\'s, restated per\nrow.\n\n**A record whose figures are a SENTENCE states them under the header, in a\nband**, and the header then states neither of them: a job reads what it comes to,\nhow far through it is (the `measure` against its limit), what is left of it (a\nformula that is exactly `{amount} - {measure}`) and how long there is (an\n`obligation`, else its `when`, counted down); a party reads its settlement, the\n`amount` and `measure` roles it carries in the order the model declares them; a\ncatalogue item reads its `amount` against the reference that amount names. Two\nfigures are the floor and four the ceiling \u2014 under two, the header keeps its one.\nA band is a PAGE\'s strip, so a screen whose `record` is a drawer keeps every\nfigure where a drawer reads them. Each figure is drawn exactly once: the limit a\nmeter states is not a fact beside it, and the day a countdown counts to is not\nthe provenance line above it. The band draws them, so the band is where they are\nCHANGED \u2014 a date a person states is edited on the countdown and a limit a person\nstates on the meter, while the level between them is read. The `lifecycle` is\nnot badged there, because the progress section is the rung it stands on. Then\nits sections, in the order its KIND reads them: the\n**facts** (every field neither the header, the band nor another section owns, the\nrow\'s own `parent` among them \u2014 led by the ones THIS screen\'s slots bound, then\nthe key it is filed under, then the order the model declares them in \u2014 a\n`markdown` field among them, drawn across the grid\'s whole row rather than\nwrapped to a third of it), the record\'s own **body** (that same markdown, taken\nas a section instead, ONLY where the kind leads with it: a catalogue item IS its\ndescription, and a job is not its notes), the **charge** (where the `amount` is a formula over exactly one\nquantity and one money field, the line states `quantity \xD7 unit price = amount`\nand neither figure is typed twice \u2014 the section is headed by the amount\'s own\nlabel and the closing row says what the figure IS, so the word is said once),\nthe **progress** (the `lifecycle`\'s stages as a ladder the reader ticks a rung of\nto move the record on, grouped into its `phases` where the model states them, and\neach rung carrying the day it was reached where the lifecycle keeps a\n`history`), a\n**required set** (a multi-select `expected_set`, or a child entity whose rows\ncarry one entry of it each \u2014 that child\'s `files` field is what a paper attaches\nto), the record\'s **own rows** (any other child, its role-bound fields as\ncolumns), and its **files** (every `files` field the header does not lead with,\nthe `mark` first where it keeps one \u2014 a section of\nthe column like any other, straight after the facts it is the evidence for,\nexcept on an EVIDENCE record, which OPENS on the paper it exists for; the\nheading carries the Add verb, and stands it down while the pile is empty, where\nthe drop well is already the door; and a `verdict` whose FORMULA reads one of\nthose files fields is the pile\'s OWN state rather than a fact row \u2014 the file it\nis short, drawn as a ghost, and the mark the rail sends a reader to). A child is\nan entity that LINKS here, ONE SECTION PER LINK: the rows it owns (`parent`), the\nrows NAMED by it (their `party` or their `identity` \u2014 so this record\'s history),\nand the rows reaching it through a link carrying neither role, headed by that\nlink\'s own label. A child hanging off two records therefore declares one `parent` and\nleaves the second relationship a plain link, which still gets its section.\n\n**THE ROWS A RECORD OWNS ARE ADDED AND OPENED FROM THEIR SECTION.** A `parent`\nsection\'s heading carries the Add for its rows, handing the record as the\nparent \u2014 filled, never asked. Every row opens its own record \u2014 a line of a book,\na paper on a desk, a stop on a timeline alike: where this app already routes a\npage for those rows (the register\'s own, under one of them) it is navigated to;\notherwise it is a DRAWER mounted on the record it belongs to, stepped \u25C0 \u25B6 over\nthe section\'s rows as they are drawn, with the row\'s framed editors, its ladder\nand its files, saving through `update_<child>` \u2014 the one editor those rows have,\nwhich any control the section draws over a row writes through too. Never the\n`parent` link itself: it is the key the row is FILED under, stated by the record\nthe drawer was opened from, so it is neither a fact of the drawer nor an input\nof that editor. ONE LEVEL, and only from a PAGE: a child\'s own children draw as\nthe kit\'s panel of the row, with no drawer and no Add, and a register whose own\nrecord is a DRAWER is the same for the children it owns \u2014 a drawer mounts no\ndrawer. **A ROW IS ADDED WHERE IT CAN BE OPENED AGAIN**, so those sections lose\ntheir Add with their drawer; a row of the register\'s OWN kind keeps it, because\nthe register\'s list opens it. A correspondence\'s entries are the one owned row\nthat opens nothing anywhere: the composer under them is the section\'s Add\nwhatever door the record has, and the answer mark is one field of the reply\'s\nown editor. The rows a record is merely NAMED by, and those reaching it\nthrough a roleless link, are read only \u2014 a history, never a place to open or\nadd.\n\n**TWO CHILDREN ARE READ AS A RUN RATHER THAN AS A REGISTER**, and the model says\nwhich by the roles it declares on them. A child carrying an `obligation` whose\n`satisfied_by` is a DATE \u2014 and no `lifecycle`, because an entity with stages of\nits own is a JOB being worked and its rows under another record are that record\'s\nlines or its history \u2014 is a **timeline**: its rows are the ordered stops, each\nstating the day it was promised for and the day it happened, with the delta named\nwhere the rung was late \u2014 drawn as a register those are two date columns and the\nreader subtracts them by eye, which is exactly what "three days late at\ndischarge" costs to learn. An obligation closed by a FILE says nothing about\nwhen, so those rows stay the register they were. A child carrying a `markdown`\ntext field beside a `party` and a `when` \u2014 and naming no member of this\nworkspace, which would make it a log \u2014 is a **thread**: the entry is the body,\nthe author and the day lead it, and a `verdict` on the child is the yes/no one\nreply is marked the ANSWER with \u2014 a register of messages is a table whose one\nuseful column is the one it cannot draw. A SECOND `party` on those rows is who\nthe entry was left WITH, and the latest one names the ball in court: while\nnothing answers, the record says whose move it is and counts its own deadline\n(an `obligation`, else its `when`) against them. Both are read only under the\nrecord that OWNS the messages \u2014 under the party who wrote them the same rows are\nthat party\'s history, several questions at once, and the last of them says\nnothing about any. That record also REPLIES: the section\'s Add is a composer \u2014\nthe message is all a reply asks \u2014 and the answer mark is one field of the\nreply\'s own editor.\n\n**A body and a day, under a record that OWNS the rows, is a LOG** \u2014 what was\ndone, when, and the entry in the words somebody wrote. WHO WRITES THE ENTRY\nDECIDES WHICH IT IS: a `select_member` on the child makes it a log whatever else\nit names, because a member of this workspace keeps a log and a party writes a\nmessage. So a `party` on a log entry is who it was WITH, drawn on that entry\'s\nown line beside the `contact` it reached them at and the files that came with\nit \u2014 never its author, and never a move outstanding. The other selects on the\nrow are facts ABOUT the entry. A NAMED row is a log entry, not a message: a\nvisit or an inspection is a thing in its own right, which is what keeps it out\nof the thread. Its Add is a composer too, taking the entry, the day (opening on\ntoday) and the entry\'s own selects; the record it hangs under is not asked.\n\n**A PROFILE LEADS WITH ITS LADDER.** An account walks stages like any other work,\nso a profile carrying a `lifecycle` reads `progress` first \u2014 right under the\nband, the same place a job leads with the act that moves it \u2014 and its histories\nfollow. Under them the ladder was seven bands down a page nobody scrolls that\nfar.\n\n**NOTHING SITS BESIDE THE RECORD.** A page is ONE reading column \u2014 its fields,\nits files, the rows it owns, its notes, all sections of it in the archetype\'s\norder \u2014 over a reserved left gutter holding a floating NAVIGATION RAIL: the way\nback, then one line per section with that section\'s category mark, and nothing\nelse. No files, no counts, no group headings. Too narrow to seat the rail, it is\none pinned bar of the same list across the top. A section HEADING never wears\nthe mark; the rail\'s line for it does.\n\n**A RELATION THE RECORD NEVER ACTS ON CLOSES THE COLUMN.** Every register that\nmerely NAMES the record is one counted line of a single last section: its label,\nhow many rows name this record (a COUNT, never a page of rows measured), and a\npress that opens the register owning them narrowed to this record. An entity\nthis app lists nowhere is a count with no door, and where every count is zero\nthe section is not drawn at all. The one exception is a PROFILE, whose history\nIS its body and stands open in the column.\n\n**Rows the record owns whose `amount` is `signed_by` a direction are a\nBOOK**, drawn as a statement \u2014 each line dated and signed, the balance under\nthem where there is more than one line to add up, labelled by the amount\'s own\nword \u2014 where the same rows on the party they\nwere transacted with stay that party\'s history, which is scanned for the line\nshort of its paperwork rather than struck to a balance. **Rows that carry a\n`when` read as RUNS**: a party\'s history under the year \u2014 and only where the rows\nin hand span more than one, since a subhead over every line of a book names the\nyear and separates nothing \u2014 and a job\'s own rows under the day they fall on,\nwhich, where those rows also carry a `lifecycle`, is an ITINERARY rather than a\ngrouped table: the day heads the run, each row is one line (its `slot`, its name,\nits party, its stage, its `category` and `reference`, its amount), the figures end\non one edge and the run closes with their sum \u2014 unless the record\'s own BAND is a\nsum rollup over exactly these rows, which states it once already. A `category`\npaints the node the run is read down, in the option\'s own colour; a `reference`\ncloses the line with the code somebody quotes on the phone. **A `mark` LEADS the\nline with the stop\'s own picture** \u2014 a venue, a vehicle, a machine \u2014 and it is the one\nplace on a record where a child entity\'s mark is drawn at all, since no register\ncolumn is ever a picture; a line whose subject holds none is marked with its\n`category`\'s glyph instead, so the run keeps one left edge. All three are\nPROJECTED for the run whether or not the register\'s column budget would have\ndrawn them, and a mark is projected NOWHERE ELSE.\nA line\'s mark is most often the SUBJECT\'s rather than the line\'s own \u2014 the\nservice, the product, the asset it is a line of \u2014 which is a `lookup` through\nthat link onto the subject\'s own `files`, given the role on the line.\n**EACH DAY\'S HEAD CARRIES THE SECTION\'S OWN ADD** as well, handing the panel that\nday, so a line made from Tuesday opens with Tuesday answered; the heading keeps\nthe verb too, for the first line and for a day nothing is planned on yet. **THE\nKEY LEAVES THE COLUMNS where the head states the whole of it** \u2014 a day head does,\na year head states four digits of the date and the day is what the column is\nstill there to carry.\n**A run is READ FROM THE END THE READER WANTS**: a job\'s own rows and an itinerary\nascending, a book, a history and a log descending.\n**A REGISTER WHOSE `when` IS A DEADLINE IS READ FROM THE NEAR END** whatever its\nshape does \u2014 `due` (or an `until` that says where the countdown stops) makes the\ndate a promise, so the rows in breach of it lead and a row nobody dated falls\nlast. A plain `when` keeps the shape\'s own end. `scaffold check` prints the\npromise (`order: Theo d\xF5i ti\u1EBFp, overdue first`).\n\n**A DESK OVER AN ENTITY THAT CARRIES A `slot` IS ITSELF A DAY\'S RUN.** Its own\nregister is drawn under one subhead per day, sorted by that day and then by the\npart of it, and the date column goes \u2014 the subhead states it once for the whole\nrun, and a column repeating it down every line is the same value twice. Without\nit an itinerary was one flat list in whatever order the rows arrived.\nA document desk keeps its head either way \u2014 the entries it owes are its\ncontent, filed or not. The name and whatever figure is left to it are the header\'s\nalone \u2014 it states them in full, so a fact for either would be the same sentence\ntwice.\n\n**A FACT IS PRIMARY OR IT IS PROVENANCE.** An `autonumber`, a date the platform\nstamps (`derive_from`) and a date a formula works out that no role names are what\nthe SYSTEM wrote; they fold, with every optional field this record does not\nstate, behind the grid\'s ONE link. Everything a person types or picks is primary\nand is shown, empty or not, because absence is work somebody owes. **A screen\nthat named `facts.groups` has already said which:** a field in a group is\nprimary, and one in none folds \u2014 grouping says what the reader decides with, and\nby saying so says the rest are not. A `tier` on a `facts` entry exists only for\nthe case that derivation gets provably wrong.\n\n**A `contact` field whose kind the\nmodel decides** \u2014 an email, a number, a place, a `link`-formatted text, or a\nMESSAGING APP its label names (WhatsApp, Zalo, Telegram, Viber, WeChat, Line,\nMessenger) \u2014 leaves the facts too, for the row of links under the name on a\nrecord that opens as a page; one whose kind nothing decides stays a labelled\nfact, because a scheme nobody stated is a link that opens nothing. A handle is\ndrawn under its app\'s name \u2014 the app is what identifies the person there, and a\nbare number beside an envelope says the wrong thing \u2014 and it dials only where its\nvalue IS a number.\n`check` prints the record under each screen\'s slots:\n\n```\n  Orders \u2014 lifecycle desk over Orders (12 rows) \xB7 page \xB7 tabs: Stage (New \u2192 Quoted \u2192 Confirmed \u2192 Shipped \u2192 Done)\n    stage Stage \xB7 identity Order no. \xB7 mark Photo \xB7 party Customer \xB7 amount Total \xB7 level (none \u2014 no field declares "measure") \xB7 when Due\n    record: header (Order no. \xB7 Customer) \xB7 band (Total \xB7 Shipped against Lines \xB7 Due counting down) \xB7 progress: Stage (5 stages) \xB7 facts (Ship to \xB7 \u2026 2 filed) \xB7 files: Photos \xB7 documents: Papers (Kind: 4 required) \xB7 itinerary: Order lines by Ship by at Window, kind Handling, ref Waybill (Product \xB7 Quantity \xB7 Line total) \xB7 related: Visits (count via Order)\n```\n\nThe ORDER of that line is the record\'s own, top to bottom, and it is the KIND\'s,\nand every entry of it is a section of the one column. `related:` is the counted\nline that closes it \u2014 a register the record never acts on, named and counted \u2014\nand `\u2026 N filed` is how many facts fold behind the grid\'s one link.\nA child register whose `amount` is `signed_by` a direction is a BOOK of movements\n\u2014 what the record came to rather than what it is made of \u2014 so it closes the\ncolumn rather than standing among the rows the job is made of.\n\n**A section over a child is named by the CHILD\'s own label**, because the reader\nalready knows which record they are on: "\u0110\u01A1n h\xE0ng", not "\u0110\u01A1n h\xE0ng \u2014 Kh\xE1ch h\xE0ng".\nWhere two links from one entity reach this record, that label names two sections\nand each takes its own link\'s label as a qualifier \u2014 `H\u1ED3 s\u01A1 (\u0110\u01A1n h\xE0ng)` and\n`H\u1ED3 s\u01A1 (\u0110\u01A1n g\u1ED1c)`.\n\nIn that line `documents:` is a `RecordExpectedSet`, and `lines:` a `RecordChildren` over the rows\nthis record owns \u2014 `history:` where they NAME it instead, as their `party` or their `identity`, capped at its latest 5\nwhere the record is a profile (`latest 5 of N by <day>`, the whole of them behind the foot); a required set\nwhose entries are a CHILD entity carrying files takes `kind="files"`, and the entity\'s own\nmulti-select takes `kind="items"`, since nothing attaches to an option.\n\n**A section that knows its size says so.** Where a `measure` on the record is a\n`count` rollup over the very link a rows section hangs on, the limit it is read\n`against` is how many rows that section is OWED: the printout adds `\u2014 expects\n<limit>` and the screen draws that many ghost rows until the first one lands,\ninstead of "nothing here" two bands under a count saying three are outstanding.\n\nA figure printed as `Total (USD)` is MONEY in the currency named \u2014 a `formula`\nstates it in `formula.currency`, and a `rollup` or a `lookup` inherits it from the\nfield it reads, so read those brackets: a rate that should be in dollars and is\nprinted bare will be drawn in the workspace\'s own money. Where the entity carries\na `currency` role, the ROW\'s code outranks the field\'s on every line that states\none, and a line stating none falls back to the field\'s.\n\n**A record surface can be OPERATED, and that is the default.** Every screen with\na record gets a workflow that writes its editable facts \u2014 every field a person\nstates \u2014 so the record\'s values are edited in place and its stage is advanced\nfrom the progress section. `"writes": false` makes one screen a reader: use it\nfor a screen over rows another desk owns, never as the default. A desk nobody\ncan act on is a viewer of state somebody must go and set somewhere else. A\nreader keeps the acts that only READ the row \u2014 its papers and its `export` \u2014\nand refuses every one that writes it: the quick column, the agent act, the\nhand-off on any surface, and the file an `import` would mint rows from.\n\n**`"writes": "children"` splits the record from the rows under it.** The record\nis drawn exactly as `false` draws it \u2014 the same refusals, and the register opens\nno row of its own \u2014 while every section listing the rows that record OWNS keeps\nits Add, its drawer and its own editor. Use it where one desk states the plan\nand another logs against it: the hours typed under a period the office set, the\nitems ticked under a job somebody else opened.\n\n**Which facts those are is the FIELD\'s answer.** Text, number, date, yes/no and\nselect are typed or picked. A `"cardinality": "one"` link is RE-POINTED, through\na picker over the target entity named by its `display_field_aliases` \u2014 else the\ntarget\'s `identity` \u2014 narrowed by what the reader types and carrying that\nentity\'s own `read_scope`, so a link the plan gives neither column is read\ninstead of offering an empty list. A files field is ATTACHED TO and DETACHED\nFROM, as the delta rather than the pile, so two readers filing at once each keep\ntheir file. A many-link, an `autonumber` and every computed field are read: the\nfirst is a list a fact cannot state, and the rest are the platform\'s to write.\n\n**A one-link is that fact WHATEVER its sync.** `sync_both_ways` is one relation\nwith a field on each side, and the sides are not the same surface: the record\nthat names ONE row states it as a fact, and the MANY side is the register on the\nother entity\'s record. Declaring both directions does not give this record a\nregister of the single row its own fact already names.\n\n**The write is the record SURFACE\'s.** Its inputs are the fields that surface\noffers to save \u2014 the facts with an editor, the lifecycle its ladder advances, a\nfiles section over exactly one stated field, and what the BAND states rather than\nreads: its countdown\'s date, and the limit under a meter where that limit is a\ncolumn a person types \u2014 never every field a person could in principle type. What\nthe header states, a limit a level folds into a meter among the FACTS, a required\nset with a section of its own and the pile a page\'s mark draws are read there, so\nno input is declared for them. A second screen over the same entity draws no\nsurface of its own and adds nothing.\n\nWhere two operable screens of one plan reach the same entity, `scaffold check`\nnames them and the apps they belong to: two desks writing one record is a\ndecision, and the split is stated on the FIELD in each app\'s\n`package.json#lotics.writes` rather than left to whoever edits second.\n\nThat workflow lands in the app as source, like every other: its body in\n`src/workflows/update_<entity>.ts` and its declaration in\n`package.json#lotics.workflows`. The two together are the binding \u2014 `lotics app\ndeploy` pushes whatever differs from what it last saw live \u2014 so the write is\nversion-controlled and travels with the app rather than being bound by hand\nafterwards.\n\nA `custom` screen declares its slots under `roles` (slot \u2192 role) and they bind\nthe same way:\n\n```jsonc\n{ "alias": "readings", "label": "Readings", "shape": "custom", "entity": "reading",\n  "roles": { "subject": "identity", "reading": "measure" } }\n```\n\n## Applying packages\n\n`apply` copies published packages into the workspace AFTER the model\'s own\ntables exist \u2014 apps over the tables you just described, and any tables of their\nown they still need. Ordered, and run by `lotics setup` and `lotics scaffold\napply` alike.\n\n```jsonc\n"apply": [\n  {\n    "package": "apg_k3nf82ldpq",\n    "bind": {                              // optional \u2014 which of YOUR tables each entity is\n      "company": { "label": "Customers", "fields": { "name": "Company name" } }\n    },\n    "no_sample_data": true                 // optional\n  }\n]\n```\n\n`bind` is keyed by the package\'s entity alias and holds the LABELS this\nworkspace uses: scaffold adopts by label, so binding points the package at the\ntables the model created instead of a second set beside them. Only naming\nmoves \u2014 a bound field must be the TYPE the package declares, or the copy is\nrefused. `lotics library list` is the shelf, and `lotics library show <apg_id>`\nlists the aliases to bind.\n\nEntries run in the order they are written, because a later one may bind onto a\ntable an earlier one created. **A refused entry stops the run and the entries\nbefore it stay** \u2014 they are separate copies, committed as they land, so the\nrefusal names them rather than leaving a caller to re-run the file and copy them\ntwice.\n\n### What a run remembers\n\nThe WORKSPACE remembers what each entity, field, select option, role and\ntemplate alias became here, plus which record each first row landed on and the\nfile each document path was uploaded as. The model file itself holds no live id\n\u2014 it is the portable half, and the same file applies to a demo workspace and to\na customer\'s \u2014 so the join lives where the things it names live, and one model\napplied to two workspaces holds two bindings that know nothing of each other.\n\nIt is the workspace\'s and not the file\'s because a model file is never\ncommitted: memory kept beside it is one author\'s disk, absent for a teammate, on\na second machine or after a delete \u2014 and every one of those goes quietly back to\nbinding by label, which is what grows the second table.\n\nEvery later verb binds through it: `apply`, `diff`, `app create --from`,\n`app regenerate --from` and `workspace build` take the remembered id first and\nfall back to a label only for an alias nothing has bound \u2014 a field you have just\nadded, or a workspace nothing has applied this model to. That is what makes a\nrelabel on EITHER side a rename rather than one thing the workspace lacks and\none the model lacks: `diff` prints one line under the alias\n(`order.state: label: model "Stage" \xB7 workspace "Giai \u0111o\u1EA1n"`), and `apply` binds\nthe thing it has always meant, reports the move and names the command that makes\nthe two agree \u2014 which side is right is yours to decide, not a reason to refuse\nthe run.\n\nA bound target the workspace no longer holds IS a refusal, by name: re-binding\nto whatever carries that label today is how the model comes to point at\nsomebody else\'s table. `lotics run restore_table` puts a deleted table back, and\n`lotics scaffold unbind <kind> <alias>` forgets the binding \u2014 after which the\nnext apply creates a new one and nothing joins it to what was there.\n\n## Presets\n\nA preset is a trade\'s model, published to be READ. An assistant reads it, asks\nat most two questions, picks a variant and writes a `model.json` from it \u2014\nnothing is copied, and a preset is a file rather than anything a workspace\ninstalls.\n\n```jsonc\n"preset": {\n  "name": "Field service",\n  "description": "Jobs, the crew that runs them, and what each one billed.",\n  "questions": ["Do you dispatch crews, or one person per job?"],  // at most 2\n  "variants": {\n    "crews": {\n      "when": "work is dispatched to crews rather than to one person",\n      "entities": [ /* tables this branch ADDS */ ],\n      "fields": { "job": [ /* fields this branch ADDS to `job` */ ] }\n    }\n  }\n}\n```\n\nVariants are **additive only**: a branch adds entities and fields and never\nremoves them, so the base is a model in its own right rather than a draft.\n`lotics scaffold check` proves the base AND every variant merged onto it, so a\npreset ships with every branch already proven \u2014 the branch nobody took is the\none that fails in the workspace of whoever takes it.\n\n`preset` is not scaffolded. `lotics setup` and `lotics scaffold apply` ignore\nit and create the base model\'s tables.\n\n`lotics scaffold export` prints a workspace that already works as one of these\nfiles \u2014 the starting point for a preset or for another business\'s model, never a\nsource of truth: it carries one business\'s words and stops describing that\nworkspace the moment either changes.\n\n## Starting from a preset\n\n`lotics library list` is the shelf of them and `lotics library show <slug>`\nprints one whole: its questions, every table as `alias \xB7 label` with each field\nas `alias:type`, and each variant as `slug \xB7 when` followed by the tables and\nfields that branch adds. When one of them is the trade in front of you, do not\ntranscribe it \u2014 name it:\n\n```jsonc\n{\n  "from": "field_service",\n  "variants": ["crews"],\n  "rename": { "job": { "label": "\u0110\u01A1n h\xE0ng", "fields": { "code": "M\xE3 \u0111\u01A1n" } } },\n  "entities": [ /* a table this business has that the preset does not */ ],\n  "rows": { "job": [ { "ref": "j1", "fields": { "code": "J-1" } } ] },\n  "field_roles": { "job": { "code": "identity" } },\n  "write_rules": { "customer": { "natural_key": ["email"] } },\n  "apps": [ /* the screens this business\'s apps will have */ ]\n}\n```\n\n- **`from`** is the preset\'s SLUG \u2014 its own file name, a lowercase slug. Naming\n  it is what makes `entities` optional; every other rule on this page is\n  unchanged, because the file is resolved into the full form and then checked and\n  applied exactly as one. A slug nothing serves is refused with the ones there\n  are, never resolved against something else.\n- **`variants`** names the branches to merge onto the base, in order. Pick the\n  one whose `when` describes what the person said; a slug the preset does not\n  declare is refused rather than ignored.\n- **`rename`** is keyed by the preset\'s entity alias and holds the labels this\n  business uses \u2014 the same shape `apply[].bind` takes, and the same rule: only\n  naming moves. An alias the preset does not declare, and a label that is\n  already another table\'s, are both refused.\n- **`entities`** are added after the rename, already in this business\'s own\n  words.\n- **`rows`**, **`field_roles`**, **`write_rules`**, **`apps`** and **`apply`**\n  mean exactly what they mean in the full form \u2014 `"rows"` are this business\'s\n  real first records,\n  `"field_roles"` may name the preset\'s fields as well as its own (a role the\n  preset declares itself is kept unless this file names the same field, or\n  clears it with `null`), `"write_rules"` the create-time clauses on either\n  (an entity this file names replaces the preset\'s whole entry for it),\n  `"apps"` the screens it will have (a preset carries none), `"apply"` the\n  packages copied in once its tables exist.\n\nThis is the ONE thing on this page that needs the network: `check` reads the\npreset it names, once. Everything after that read is the same offline check.\n\nWrite the full form when no preset is the trade.\n\n## A complete model\n\n```json\n{\n  "entities": [\n    {\n      "alias": "customer",\n      "label": "Customers",\n      "singular": "Customer",\n      "fields": [\n        { "alias": "name", "label": "Name", "type": "text", "required": true },\n        {\n          "alias": "tier",\n          "label": "Tier",\n          "type": "select",\n          "options": [\n            { "alias": "standard", "label": "Standard", "color": "slate" },\n            { "alias": "gold", "label": "Gold", "color": "amber" }\n          ],\n          "default": ["standard"]\n        },\n        {\n          "alias": "orders",\n          "label": "Orders",\n          "type": "select_record_link",\n          "target_entity": "order",\n          "cardinality": "many",\n          "sync_both_ways": true,\n          "paired_field_alias": "customer",\n          "display_field_aliases": ["code"]\n        },\n        {\n          "alias": "total_ordered",\n          "label": "Total ordered",\n          "type": "rollup",\n          "source_field_alias": "orders",\n          "aggregate_option": { "operation": "sum", "field_key": "amount" }\n        }\n      ],\n      "views": [\n        {\n          "alias": "gold",\n          "label": "Gold customers",\n          "filters": {\n            "node_type": "condition",\n            "type": "select",\n            "field_key": "tier",\n            "operator": "has_any_of",\n            "value": ["gold"]\n          },\n          "sort": [{ "field_key": "name", "order": "asc" }]\n        }\n      ]\n    },\n    {\n      "alias": "order",\n      "label": "Orders",\n      "singular": "Order",\n      "fields": [\n        { "alias": "code", "label": "Order no.", "type": "text", "unique": true },\n        { "alias": "placed_on", "label": "Placed on", "type": "date", "format": "date" },\n        {\n          "alias": "amount",\n          "label": "Amount",\n          "type": "number",\n          "format": "currency",\n          "currency": "VND"\n        },\n        {\n          "alias": "total",\n          "label": "Total with VAT",\n          "type": "formula",\n          "formula": { "expression": "{amount} * 1.1", "format": "currency", "currency": "VND" }\n        },\n        {\n          "alias": "customer",\n          "label": "Customer",\n          "type": "select_record_link",\n          "target_entity": "customer",\n          "cardinality": "one",\n          "sync_both_ways": true,\n          "paired_field_alias": "orders",\n          "display_field_aliases": ["name"]\n        }\n      ]\n    }\n  ],\n  "roles": [{ "alias": "sales", "label": "Sales" }],\n  "field_roles": {\n    "customer": { "name": "identity" },\n    "order": { "code": "identity", "placed_on": "when", "amount": "amount", "customer": "party" }\n  },\n  "apps": [\n    {\n      "alias": "customers",\n      "name": "Customers",\n      "screen": { "alias": "customers", "label": "Customers", "shape": "party_register", "entity": "customer" }\n    },\n    {\n      "alias": "orders",\n      "name": "Orders",\n      "screen": { "alias": "orders", "label": "Orders", "shape": "transaction_ledger", "entity": "order" }\n    }\n  ],\n  "rows": {\n    "customer": [\n      { "ref": "acme", "fields": { "name": "Acme Trading", "tier": "gold" } },\n      { "ref": "bluebird", "fields": { "name": "Bluebird Foods", "tier": "standard" } }\n    ],\n    "order": [\n      {\n        "ref": "so_1001",\n        "fields": {\n          "code": "SO-1001",\n          "placed_on": "@month-start+2",\n          "amount": 4200000,\n          "customer": "customer:acme"\n        }\n      },\n      {\n        "ref": "so_1002",\n        "fields": {\n          "code": "SO-1002",\n          "placed_on": "@today-3",\n          "amount": 1150000,\n          "customer": "customer:bluebird"\n        }\n      }\n    ]\n  }\n}\n```\n\n`lotics scaffold check` on this file reports\n`2 tables, 9 fields, 2 links, 1 view, 1 role, 4 rows, 2 apps`, then\nthe plan:\n\n```\nCustomers\n  Customers \u2014 party register over Customers (2 rows) \xB7 page (default) \xB7 tabs: none (default)\n    identity Name \xB7 mark (none \u2014 no field declares "mark") \xB7 contact (none \u2014 no field declares "contact") \xB7 worth (none \u2014 no field declares "measure") \xB7 risk (none \u2014 no field declares "verdict")\n    presentation: leads with nothing (default), roomy (default) \xB7 above: rows (default)\n    record: header (Name) \xB7 history: Orders (latest 5 (default) of N by Placed on) (Order no. \xB7 Placed on \xB7 Amount (VND)) \xB7 facts (Tier \xB7 Total ordered (VND))\nOrders\n  Orders \u2014 transaction ledger over Orders (2 rows) \xB7 drawer (default) \xB7 tabs: none (default)\n    when Placed on \xB7 amount Amount (VND) \xB7 reference Order no. \xB7 party Customer \xB7 classification (none \u2014 no field declares "lifecycle") \xB7 document (none \u2014 no field declares "expected_set" or "verdict")\n    order: Placed on, newest first (default) \xB7 presentation: leads with the figure (default), roomy (default) \xB7 above: Amount (VND) (default)\n    record: header (Order no. \xB7 Placed on \xB7 Amount (VND)) \xB7 facts (Placed on \xB7 Total with VAT (VND) \xB7 Customer)\n    party: Customers \u2014 opens from Customer (profile: header (Name) \xB7 history: Orders (latest 5 (default) of N by Placed on) (Order no. \xB7 Placed on \xB7 Amount (VND)) \u2014 foot: the whole register, narrowed to this record \xB7 facts (Tier \xB7 Total ordered (VND)))\nWho writes what:\n  Customers (customer, one: Customer): Customers \xB7 written from the rows of Orders: facts\n  Orders (order, one: Order): Orders\n```\n\nA `party:` line is the record a NAME on a row opens. A party is not a job, so it\ngets no app of its own \u2014 but a clerk reading the orders book presses the\ncustomer and corrects the phone number there, so the app whose rows name a party\ncarries that party\'s own record beside its register\'s. It is printed in the same\ngrammar the `record:` line is, because it is the same kind of surface: a profile,\non a page, its histories capped. Which cells are the door is what `opens from`\nsays \u2014 `the name` where the register\'s subject IS the party.\n\nThe last block is the WRITERS matrix \u2014 one line per record surface the plan\nleaves operable, the word one of its rows is called, and the app whose register\nopens it. Part of the verdict rather than a diagnostic beside it: which desk\nchanges a table is answerable from the plan, and two apps on one line is the\nsplit to state in each of their `package.json#lotics.writes`. A\n`written from the rows of \u2026` clause is the other reach: the party that register\nnames, and what the app can change on it \u2014 counted apart, because several\nregisters naming one account is the model working as designed rather than a\nsplit to declare.\n\nEvery `(none)` is a slot no field fills, and it says WHY: no field declares the\nrole, or several could and the plan named none of them (`(none \u2014 a, b; name\none)`). Read it as the screen a person will see. `above: \u2026 (default)` is the band\nnobody stated \u2014 the shape sums the amount its slot draws, and a plan naming its\nown figures loses the word. Neither\nentity carries a stage, a required set or files, so the rest is facts \u2014 except\nthe sections neither entity declares: the customer\'s `history:` is the orders\nthat name it as their party, and the order\'s `via Orders:` is the customers whose\n`Orders` link names it. **A link is a section, not a fact**, on the side it\npoints AT and on the side that holds it: `Customers.Orders` therefore leaves the\ncustomer\'s facts, because the section below already lists the same relation and\na link fact can only ever show the first of them. Both records state their name\nin the header and nowhere else \u2014 a ledger\'s columns are the date and the figure,\nso `Order no.` is on no column of that list and is still what the drawer behind\na line is called. `Total ordered (VND)` is the rollup inheriting the currency of\nthe column it sums: money is read off the model, never off the field\'s own line.\n';
+var model_reference_default = '# The Lotics workspace model (`model.json`)\n\nOne JSON file describing the tables, fields, options, views, roles and first rows\na workspace starts with. `lotics scaffold check model.json` proves it offline \u2014\nno account, no network. `lotics setup model.json --email you@company.com` creates\nthe account and applies it. `lotics scaffold apply model.json` applies it again,\ninto the workspace the credential names.\n\n**There are two forms of this file.** The full one, below, spells the model out.\nThe `from` one names a published preset and carries only what this business\ndiffers by \u2014 see \xA7 Starting from a preset, and prefer it whenever a preset fits\nthe trade.\n\nApps are PLANNED here and built afterwards: `apps` names each app\'s screens as a\nshape over an entity, checked against the roles `field_roles` gives its fields,\nso the plan is refused before anyone builds a screen (\xA7 Apps and screens). The\nbuilt app lives in the workspace; publishing that workspace as a package is how\nit ships.\n\n## The rules\n\n- **At least one entity, at most 50.** More tables than that is a data model\n  being designed, not scaffolded \u2014 scaffold the rest in a second call.\n- **Adoption is explicit.** `lotics setup` REFUSES an entity whose `label`\n  already names a table in the workspace, naming every colliding label at once.\n  `lotics scaffold apply` adopts those tables and adds the fields, options and\n  views they are missing. Nothing is ever modified or deleted, so applying the\n  same model twice creates nothing the second time.\n- **Adoption is by LABEL, not alias.** Change an entity\'s `label` and the next\n  run asks for a NEW table beside the old one. Renaming a FIELD is\n  `lotics field rename <table> <field> "<new label>" --model <this file>`, which\n  moves the platform, this file and every app bound to it together; deleting is\n  `lotics run delete_table`. Neither goes through the file.\n- **The file\'s own majority is the language.** A model names no locale \u2014 which\n  language it is in is what it mostly says, and `scaffold check` notes the label\n  written the other way. The generated screens read the kit\'s pack, and a\n  generated WRITE cannot: its refusals run on the server, so they are worded in\n  that same majority. Mix the two and the workspace answers in two languages.\n- **`lotics scaffold diff model.json` says where the file and the workspace have\n  come apart**, joined on label, entity then field \u2014 the join adoption itself\n  makes. It exits 1 on any difference, so a model that is about to be published\n  as a preset carries the labels in use rather than the ones it was written with.\n- **Rows land only where every bound table is empty.** One table already holding\n  records and no rows are written anywhere, and the result says\n  `rows_skipped: true`: sample rows landing among a customer\'s real ones cannot\n  be told apart from them.\n- **After the first run the WORKSPACE is the source of truth.** The file is an\n  authoring input, not a mirror \u2014 scaffold never deletes what the file stopped\n  naming.\n- **`lotics scaffold check` decides all of it offline**, and reports every\n  problem in one run rather than the first: an alias that resolves to nothing, a\n  link whose pair is not symmetric, and the rows themselves \u2014 a field the entity\n  does not declare, an option alias the field does not declare, a link naming no\n  row in the file, a `ref` used twice, a date that is not one, a value on a\n  platform-computed field, and a files cell that is neither a relative path\n  beside this file nor a `fil_` id.\n\n## Top level\n\n```jsonc\n{\n  "entities": [ /* the tables */ ],\n  "roles":    [ /* workspace groups to create */ ],    // optional\n  "templates":[ /* inline html / email templates */ ], // optional\n  "rows":     { /* first records, keyed by entity alias */ },  // optional\n  "field_roles": { /* the reporting role each field plays, keyed by entity then field */ }, // optional\n  "write_rules": { /* what a CREATE finds, defaults and refuses, keyed by entity */ }, // optional\n  "apps":     [ /* the screens each app will have, as shapes over entities */ ], // optional\n  "apply":    [ /* published packages to copy in afterwards */ ], // optional\n  "preset":   { /* a trade\'s branches, for a PUBLISHED model */ } // optional\n}\n```\n\nThe other form names a preset instead of restating one:\n\n```jsonc\n{\n  "from":     "field_service",             // the preset this model starts from, by slug\n  "variants": ["crews"],                   // optional \u2014 its branches to merge in, in order\n  "rename":   {                            // optional \u2014 what THIS business calls each table\n    "job": { "label": "\u0110\u01A1n h\xE0ng", "fields": { "code": "M\xE3 \u0111\u01A1n" } }\n  },\n  "entities": [ /* tables the preset does not declare */ ],    // optional\n  "rows":     { /* first records, keyed by entity alias */ },  // optional\n  "field_roles": { /* roles on the preset\'s fields and this business\'s own */ }, // optional\n  "write_rules": { /* create-time clauses on the preset\'s entities and its own */ }, // optional\n  "apps":     [ /* the screens each app will have */ ],        // optional\n  "apply":    [ /* published packages to copy in afterwards */ ] // optional\n}\n```\n\n**A model may not carry** `fixtures`, `knowledge` or `knowledge_expects`, and no\n`excel` / `word` / `pdf-form` template: each of those is content that lives in a\npublished bundle, which a model has none of. `apps` here is a plan of screens,\nnever built code. An unknown top-level key is an error, never ignored.\n\n### Aliases\n\nEvery `alias` is a lowercase slug \u2014 a letter, then letters, digits and\nunderscores (`unit_price`, `so_1001`). Aliases are how the file cross-references\nitself; they are never shown to anyone. `label` is what a person sees.\n\nLabels must be unique within their namespace \u2014 two entities, two fields on one\nentity, two options on one field, two views on one entity, two roles or two\ntemplates cannot share a label, because scaffold matches by label.\n\n## Entity\n\n```jsonc\n{\n  "alias": "order",\n  "label": "Orders",            // the table\'s name, which names the SET it holds\n  "singular": "Order",          // optional \u2014 ONE of them, for the act that opens one\n  "description": "\u2026",           // optional\n  "fields": [ /* at least one */ ],\n  "views":  [ /* optional; an entity with none still gets the default grid */ ],\n  "read_scope": { /* optional; absent, everyone with access to the table reads every row */\n    "any": [\n      { "member_of": "sales" },                       // a role alias this model declares\n      { "field": "scope", "is": ["shared"] },         // a single select on this entity, by option alias\n      { "field": "assignee", "is": "self" }           // a select_member on this entity \u2014 the members it names\n    ]\n  }\n}\n```\n\n**`singular` is what a create says.** A register\'s own act and the panel it\nopens name the row being made \u2014 `New Order`, `H\u1ED3 s\u01A1 m\u1EDBi` \u2014 while `label` names\nthe table, so without it the button reads `New Orders`. Nothing derives it\n(English plurals are irregular), and most models need none: a Vietnamese noun is\nthe same word either way. `scaffold check` prints it beside the table under *Who\nwrites what* and NOTES a table that will name the set. An act on a child section\nkeeps the label: it adds a line to the register under the record the reader is\nalready standing in.\n\n**`read_scope` is a ROW rule, enforced by the platform.** A row is readable when\nANY clause holds: the reader is in that role\'s group, the named select carries\none of those options, or the named `select_member` column names the reader\n(`"is": "self"`, on a column of one member or several). It is resolved at\nscaffold into the table\'s own row filters, so an app, a workflow reading for a\nviewer, and the API all answer the same rows \u2014 a per-record visibility field the\napp merely honours is a convention, not a gate. `any` may not be empty (a rule\nnobody satisfies hides the table), and every role alias and option alias in it\nmust be one this model declares. Scaffold writes the rule onto a table it\nCREATES; a table it adopted that ALREADY CARRIES a rule keeps that one, because\nthe rule is the workspace\'s own statement about its rows \u2014 and a run whose model\nstates a different rule reports the entity rather than leaving the claim silent.\n\n**The rows under a private record INHERIT its rule.** An entity that states no\n`read_scope` and hangs under one that does \u2014 through its `parent` link, over one\nhop or several \u2014 is read by the ancestor\'s rule, answered through that link, on\nits table\'s own filters and in every query and guard alike; nothing is restated,\nso a child needs none of the ancestor\'s columns. Stating a rule on the child\nkeeps that one instead, an ancestor with no rule passes nothing down, and a row\nhanging further under the scoped one than a row filter reaches is refused by\nname \u2014 state a rule on it. So is a hop over a link that names more than one row:\nthe rule would admit a reader any one of them admits while the editor\'s guard\nreads the first, so give the link `"cardinality": "one"` or state a rule on the\nchild.\n\n**ONLY the `parent` role is walked.** A register a scoped record reaches by any\nother link \u2014 the rows that NAME it \u2014 is read by that record\'s id with no rule\ntravelling to it, so it is refused until it states one of its own.\n\n## Field\n\nEvery field carries `alias`, `label`, an optional `description`, and an optional\n`required` \u2014 advisory only, read by app forms and workflows; the table itself has\nno required constraint. `label` may not contain `{` or `}` (formulas reference\nfields by label at the platform level).\n\n`default` is the value pre-filled into a NEW record. It applies on create only;\nexisting records are never backfilled. Only the types listed below accept one.\n\n### `text`\n\n```jsonc\n{ "alias": "name", "label": "Name", "type": "text",\n  "unique": false,              // optional \u2014 require distinct values\n  "format": "text",             // optional \u2014 "text" | "link" | "markdown"\n  "default": "" }               // optional\n```\n\n### `number`\n\n```jsonc\n{ "alias": "amount", "label": "Amount", "type": "number",\n  "format": "currency",         // optional \u2014 "number" | "currency" | "percentage"\n  "currency": "VND",            // optional \u2014 ISO 4217\n  "default": 0 }                // optional\n```\n\n`format` is what the number IS, and every surface reads it: `currency` prints as\nmoney in the code the row or the field states, `percentage` as a whole percent\nwith its sign. An ABSENT number is drawn absent \u2014 the one exception is a\n`sum` or count rollup the plan reads as a **`measure`**: that is the thing\naccumulated toward a bound, so nothing accumulated yet is zero and the meter\ndraws it. The same rollup read as an `amount` keeps its blank, and so does every\nother role: nothing added to what a row is WORTH means unpriced, not free. A\n`min`, an `avg`, a percentage of nothing and every FORMULA stay blank in any\nrole, because none of them has an answer to give. This is why the pair on one\nscreen reads two ways \u2014 what has come in against what is owed \u2014 and why a\nmeasure\'s own LIMIT, an amount, leaves an unquoted row out of the count rather\nthan reporting it as nothing collected. **AND WHERE THAT LIMIT IS ABSENT THERE IS\nNO LEVEL AT ALL**: a level is a reading AGAINST a bound, so a row that states no\nbound draws nothing \u2014 cell, fact and all \u2014 rather than a numerator whose whole\nmeaning was the comparison. "Collected 0" beside a blank total reads as money\nagainst a job worth nothing. A measure the model gives no limit is a plain figure\nand is unaffected. A share is stored in percent units \u2014 68.1 is 68.1 % \u2014 and the\ncolumn, the fact behind it, the meter it is judged by and the figure over the\nregister all say so.\n\n### `date`\n\n```jsonc\n{ "alias": "placed_on", "label": "Placed on", "type": "date",\n  "format": "date",             // optional \u2014 "date" | "datetime" | "date_range" | "datetime_range"\n  "timezone": "Asia/Ho_Chi_Minh",  // optional \u2014 IANA name\n  "derive_from": "created_at",  // optional \u2014 "created_at" | "updated_at"; makes the field read-only\n  "default": "2026-01-01" }     // optional; refused together with derive_from\n```\n\n### `boolean`\n\n```jsonc\n{ "alias": "paid", "label": "Paid", "type": "boolean", "default": false }\n```\n\n### `select`\n\n```jsonc\n{ "alias": "tier", "label": "Tier", "type": "select",\n  "options": [                                     // at least one\n    { "alias": "standard", "label": "Standard", "color": "slate" },\n    { "alias": "gold",     "label": "Gold",     "color": "amber" }\n  ],\n  "multi": false,               // optional\n  "default": ["standard"] }     // optional \u2014 option ALIASES; one unless multi\n```\n\n`color` is one of: `red`, `orange`, `amber`, `yellow`, `lime`, `green`,\n`emerald`, `teal`, `cyan`, `sky`, `blue`, `indigo`, `violet`, `purple`,\n`fuchsia`, `pink`, `rose`, `slate`, `gray`, `zinc`, `neutral`, `stone`.\n\n### `select_member`\n\nA person picker over the workspace\'s members. No default: a model cannot name\nmembers of a workspace that does not exist yet.\n\n```jsonc\n{ "alias": "owner", "label": "Owner", "type": "select_member", "multi": false }\n```\n\n### `select_record_link`\n\n```jsonc\n{ "alias": "customer", "label": "Customer", "type": "select_record_link",\n  "target_entity": "customer",        // an entity alias this model declares\n  "cardinality": "one",               // optional \u2014 "one" | "many" (default "many")\n  "sync_both_ways": true,             // optional \u2014 keep a paired field on the target\n  "paired_field_alias": "orders",     // the partner field ON THE TARGET entity\n  "display_field_aliases": ["name"] } // optional \u2014 what the link shows / the picker\'s columns\n```\n\nA two-way link is declared on BOTH sides, each naming the other as its\n`paired_field_alias`; the pair must be symmetric or the model is refused.\n\n**A single-valued link needs no partner.** `"cardinality": "one"` on its own is a\nlink that holds one row \u2014 one customer on an invoice, one project on a device \u2014\nand nothing is created on the target. The mirror invariant belongs to a PAIRED\nlink: pair a link when the target\'s own record should list what points at it, and\nleave it unpaired when it should not. Either way the record plan draws the\nrelation as a section on the side it points at, so an unpaired link costs the\ntarget nothing.\n\n### `files`\n\n```jsonc\n{ "alias": "attachments", "label": "Attachments", "type": "files" }\n```\n\n### `formula`\n\n```jsonc\n{ "alias": "total", "label": "Total", "type": "formula",\n  "formula": {\n    "expression": "{amount} * 1.1",  // fields on THIS entity, by alias, in braces\n    "output_type": "number",         // optional \u2014 what it YIELDS: "number" | "text" | "date" | "datetime" | "boolean"\n    "format": "currency",            // optional \u2014 how that result is DRAWN: "number" | "currency" | "percentage" | "link"\n    "currency": "VND"                // optional\n  } }\n```\n\n`output_type` is what the expression answers WITH; `format` is how it is printed.\nThe platform infers the result at write time and ignores what you declare, so\nthis is a statement the offline checks read \u2014 which is what lets a role or a\nscreen clause accept a computed value: a caption over a derived name\n(`output_type: "text"`), a period over a settled date (`"date"`). A formula\ndeclaring neither says nothing about its result, and every rule that needs one\nrefuses it by name. `lotics scaffold export` writes the result a live workspace\ncomputed, so exporting a workspace fills these in.\n\n### `rollup`\n\nAggregates the records reached through a link on this entity.\n\n```jsonc\n{ "alias": "total_ordered", "label": "Total ordered", "type": "rollup",\n  "source_field_alias": "orders",    // a select_record_link field on THIS entity\n  "aggregate_option": {\n    "operation": "sum",              // count | sum | avg | median | min | max | range |\n                                     // empty | filled | percent_empty | percent_filled |\n                                     // unique | percent_unique |\n                                     // earliest | latest | date_range |\n                                     // checked | unchecked | percent_checked |\n                                     // percent_unchecked\n    "field_key": "amount"            // a field ALIAS on the linked entity ("count" may omit it)\n  },\n  "filter": { /* optional \u2014 see Views; every field_key is an alias on the LINKED entity */ } }\n```\n\nThe operation must be one the aggregated field\'s type allows \u2014 `sum` over a\nnumber, `earliest` over a date, `filled` over anything.\n\n### `lookup`\n\nDisplays a field from the linked records.\n\n```jsonc\n{ "alias": "customer_tier", "label": "Customer tier", "type": "lookup",\n  "source_field_alias": "customer",  // a select_record_link field on THIS entity\n  "lookup_field_alias": "tier",      // a field alias on the linked entity\n  "order_by": { "field_key": "placed_on", "direction": "desc" } }  // optional \u2014 pick the single extreme row\n```\n\n### `autonumber`\n\n```jsonc\n{ "alias": "seq", "label": "No.", "type": "autonumber",\n  "prefix": "SO-",     // optional \u2014 ignored when template is set\n  "padding": 4,        // optional \u2014 1..20, zero-pads the integer\n  "template": "SO-{YEAR}-{N:4}" }  // optional \u2014 {N}, {N:W}, {YEAR}, {YEAR:2}, {MONTH}, {DAY}\n```\n\n## Views\n\nSaved views live under the entity they belong to. Every field reference is a\nfield ALIAS on that entity.\n\n```jsonc\n{\n  "alias": "gold",\n  "label": "Gold customers",\n  "description": "\u2026",                       // optional\n  "columns": [                              // optional \u2014 omit to show every field\n    { "field_alias": "name", "visibility": "visible", "width": 240 },\n    { "field_alias": "tier", "visibility": "hidden" }\n  ],\n  "filters": {                              // optional\n    "node_type": "group",\n    "logic": "and",                         // "and" | "or"\n    "children": [\n      { "node_type": "condition", "type": "select", "field_key": "tier",\n        "operator": "has_any_of", "value": ["gold"] }\n    ]\n  },\n  "sort": [ { "field_key": "name", "order": "asc" } ],  // optional; order is "asc" | "desc" | null\n  "summary": { "amount": "sum" },           // optional \u2014 field alias \u2192 footer operation\n  "frozen_columns": 1                       // optional\n}\n```\n\nA condition\'s `type` is the field\'s type and its `operator` is one that type\nadmits \u2014 `has_any_of` / `has_none_of` / `has_all_of` / `is_empty` /\n`is_not_empty` for a select, `equals` / `greater_than` / `less_than` for a\nnumber, `on` / `before` / `after` / `between` for a date, `contains` /\n`is_any_of` for text. A select condition\'s `value` names option ALIASES.\n\n`columns`, when present, is exhaustive and must not be empty: a view renders\nexactly the entries it holds. Omit the key to show every field.\n\n## Roles\n\nA role becomes a workspace group. Members are added afterwards, in the app.\n\n```jsonc\n{ "alias": "sales", "label": "Sales" }\n```\n\n## Templates\n\nOnly inline `html` and `email` templates \u2014 the rest are file-backed and a model\nhas no bytes. An `html` template renders to a PDF when a workflow generates\nfrom it; `{{name}}` is filled from the workflow\'s data.\n\n```jsonc\n{ "alias": "order_ack", "label": "Order acknowledgement", "type": "email",\n  "content": "<p>Hello {{customer}}\u2026</p>" }\n```\n\nA paper that has to look like a counterparty produced it \u2014 an official letter,\nan acceptance minute, a supplier\'s bill \u2014 is the same `html` template with a\nshell around the body: a letterhead, a reference line, a seal and a signature\nblock, and paper grain over everything. One shell, many bodies; the data is the\nonly thing that changes, so a workflow can re-issue it over any record.\n\n```jsonc\n{ "alias": "cong_van", "label": "C\xF4ng v\u0103n", "type": "html",\n  "content": "\u2026the page below, as one JSON string\u2026" }\n```\n\n```html\n<style>\n    .sheet{position:relative;width:718px;padding:44px 58px 30px;background:#fbfaf6;color:#111;font:14.2px/1.5 \'Liberation Serif\',serif}\n    .grain{position:absolute;inset:0;opacity:.34;mix-blend-mode:multiply;background:url("data:image/svg+xml;utf8,<svg xmlns=\'http://www.w3.org/2000/svg\' width=\'140\' height=\'140\'><filter id=\'f\'><feTurbulence baseFrequency=\'.9\' numOctaves=\'2\'/><feColorMatrix values=\'0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .35 0\'/></filter><rect width=\'140\' height=\'140\' filter=\'url(%23f)\'/></svg>")}\n    .top{display:flex;text-align:center;font-size:13.4px} .top>div{flex:1} .u{display:inline-block;border-bottom:1px solid #111;font-weight:700}\n    .ref{display:flex;text-align:center;font-size:13.4px;margin-top:6px} .ref>div{flex:1} .ref .r{font-style:italic}\n    h1{text-align:center;font-size:15.6px;margin:26px 0 18px} p{text-align:justify;text-indent:26px;margin:0 0 9px}\n    .sig{display:flex;margin-top:20px} .sig .l{flex:1} .sig .r{width:290px;text-align:center;position:relative}\n    .sig .nm{font-weight:700;margin-top:96px} .seal{position:absolute;left:4px;top:8px;width:166px;height:166px;opacity:.66;mix-blend-mode:multiply;transform:rotate(-17deg)}\n  </style>\n  <div class=\'sheet\'><div class=\'grain\'></div>\n    <div class=\'top\'><div><b>{{issuer_parent}}</b><br><span class=\'u\'>{{issuer}}</span></div>\n      <div><b>C\u1ED8NG H\xD2A X\xC3 H\u1ED8I CH\u1EE6 NGH\u0128A VI\u1EC6T NAM</b><br><span class=\'u\'>\u0110\u1ED9c l\u1EADp - T\u1EF1 do - H\u1EA1nh ph\xFAc</span></div></div>\n    <div class=\'ref\'><div>S\u1ED1: {{number}}</div><div class=\'r\'>{{place}}, ng\xE0y {{day}} th\xE1ng {{month}} n\u0103m {{year}}</div></div>\n    <h1>{{title}}</h1>\n    <p>K\xEDnh g\u1EEDi: {{recipient}}.</p>\n    {{{body}}}\n    <div class=\'sig\'><div class=\'l\'><b>N\u01A1i nh\u1EADn:</b><br>- Nh\u01B0 tr\xEAn;<br>- L\u01B0u VT.</div>\n      <div class=\'r\'><img class=\'seal\' src=\'{{seal_url}}\'><b>{{signer_title}}</b><div class=\'nm\'>{{signer}}</div></div></div>\n  </div>\n```\n\n`lotics preview <file.html>` renders any such page to a PNG the way a demo\'s\nprops are made, sized to its content, so a paper can be looked at before it is\nput in a template.\n\n## Rows\n\nFirst records, keyed by entity alias. Up to 200 rows per entity and 2000 across\nthe model, attaching at most 2000 documents between them \u2014 a real data set\nbelongs in an import, not a model.\n\n```jsonc\n"rows": {\n  "customer": [\n    { "ref": "acme", "fields": { "name": "Acme Trading", "tier": "gold" } }\n  ]\n}\n```\n\n`ref` is a local handle (lowercase letters, digits, underscores) that other rows\'\nlink fields address. It is never persisted.\n\nA `files` cell attaches documents: paths relative to this file (no `..`, never\nabsolute), which `check` proves exist and `apply` uploads into the workspace\nbefore any row is written \u2014 a paperwork business seeds its papers with its\nrows. The server accepts only `fil_` ids of files this workspace owns, which is\nwhat the upload leaves behind. After a run that wrote rows, the WORKSPACE holds\nwhich record each row became, under the row\'s own `<entity>:<ref>`:\n`delete_records` over them is how a seeded set is reset, and applying again\nre-dates it.\n\n`fields` is keyed by field alias, and every value is read against the field\'s\nDECLARED type:\n\n| Field type | Value |\n|---|---|\n| `text` / `number` / `boolean` | the value itself |\n| `date` | `"2026-03-14"`, or a relative expression (below) |\n| `select` | the option ALIAS \u2014 `"gold"`, or `["gold","vip"]` for a multi-select |\n| `select_record_link` | `"<entity-alias>:<ref>"` naming another row in this file \u2014 `"customer:acme"`, or an array for several |\n| `select_member` | `"self"` only \u2014 the person applying the model |\n| `files` | paths beside this file \u2014 `["scans/pccc_letter.png"]` \u2014 uploaded by `apply`/`setup` before the rows are posted; or `fil_` ids of files already in this workspace |\n| `formula`, `rollup`, `lookup`, `autonumber` | not allowed \u2014 the platform writes these |\n\n**Documents can be attached on their own, afterwards.** Rows land only into empty\ntables, so a model whose binaries were added after the first apply has no second\napply to carry them: `lotics scaffold apply model.json --documents` writes ONLY\nthe `files` cells, onto the records the first run created, found by each row\'s\nown `ref` in the binding the workspace holds \u2014 so a row added to or removed from\nthe file since changes nothing about the rest. Running it twice attaches nothing\nthe second time: the same path keeps the same file, and a cell is a set.\n\n### Relative dates\n\nA date cell holds a literal `YYYY-MM-DD`, or an expression relative to the day\nthe model is applied, so a screen that opens on "this month" is not empty a month\nlater:\n\n- `@today` \u2014 the day of the run, in the workspace\'s timezone\n- `@month-start` \u2014 the 1st of that month\n- either with a whole-day offset: `@today-14`, `@month-start+9`\n\n`@month-start` exists because `@today-N` cannot promise a month: applied on the\n2nd, `@today-3` lands in the previous one.\n\n## Field roles\n\n`field_roles` names the reporting role a field plays on its entity \u2014 keyed by\nentity alias, then field alias \u2014 so every screen over the entity agrees on\nwhich column names the row and which select is the stage. A shape\'s slot binds\nto it (\xA7 Apps and screens). Like `rows` and `apps`, it is this file\'s: `check`\nproves it and the workspace never sees it. Each role sits on the types that can\nanswer it:\n\n| Role | On | Meaning |\n|---|---|---|\n| `identity` | `text`, `select_record_link`, `formula` | what a PERSON calls the row \u2014 the register\'s first column; a link where the row is "the product, at this branch"; a formula where the name is computed, and then it may not be `format`ted as a figure. NEVER an autonumber: a minted code is a `reference`. One per entity |\n| `reference` | `text`, `autonumber`, `formula` | the key the SYSTEM files the row under \u2014 an order number, a container code \u2014 drawn as the supporting line under the name rather than as a column of its own, and leading where the entity has no `identity` at all. One per entity |\n| `mark` | `files`, or a `lookup`/`rollup` that resolves to one | the row\'s picture \u2014 its own, or the linked record\'s. NEVER A COLUMN: a register draws words, so a mark is projected only where a surface leads with one \u2014 the subject rung of a picture-led grid, and a record\'s itinerary. A child entity\'s mark reaches a record\'s run and nothing else. One per entity |\n| `lifecycle` | single `select` | the ordered stages a row walks; option order is the order. Which of them END the flow is `outcomes`, which parts of the flow they group into is `phases`, and `history` keeps the day each one was reached. One per entity |\n| `category` | single `select`, or a `lookup` that resolves to one | what the row IS \u2014 a kind, a service, a book. One badge in the field\'s own colour, with no ladder behind it and no flow to advance. Often a fact about the thing the row books rather than about the row, and then it is the lookup that reads it. Repeats: a row can be of two kinds of thing |\n| `measure` | `number`, `formula`, `rollup` | a level read against a limit \u2014 see `against` and `alert`. Money where the model says so, and then it prints as money |\n| `expected_set` | `select` | its OPTIONS are the required set (documents, checks, services); an option no row has is a gap to show, not nothing. A multi-select draws as a ring and a fraction wherever it is drawn \u2014 absence is the information, and a list of what IS there says nothing about what is missing |\n| `amount` | `number`, `formula`, `rollup` | THE money of a ledger row; `signed_by` says which way it moved, `against` names the reference it is quoted off. One per entity |\n| `when` | `date`, or a `formula`/`rollup`/`lookup` that yields one | the ledger or timeline date \u2014 stated, or derived: the day money MOVED is a formula over the two columns that could hold it. `due` makes it a DEADLINE; without it the date is the plain day it is. `until` names the stage of this entity\'s own `lifecycle` at which the countdown is spent, and says `due` by saying so. One per entity |\n| `slot` | single `select`, or a `datetime` `date` | where in the DAY a row sits \u2014 the run it is read in under its day\'s heading on an itinerary. A select\'s option order IS the run\'s order; a time is ordered by the clock. A plain `date` is refused: that is the day itself. One per entity |\n| `party` | `select_record_link`, `select_member` | WHO THE ROW IS FOR \u2014 the counterparty it was transacted with, or the workspace MEMBER whose work it is (a shift, an assignment, a timesheet period). A member is drawn as the person and opens nothing: they have no record in the app. One per entity \u2014 and left off where the `identity` IS the link to them: the row is then NAMED by that record, and a strip under the title would state them twice |\n| `parent` | `select_record_link` | the record this row belongs to \u2014 a line\'s order, a paper\'s case. The parent\'s record shows these rows; the row shows the parent as a fact. One per entity, and it links to an entity this model declares |\n| `contact` | `text` | a way to reach a party \u2014 an address, a number, the town it is in. The record draws them as ONE row of links under the name, so the role sits on every field that is one of them. Repeats |\n| `currency` | single `select` whose option LABELS are ISO 4217 codes | the money THIS ROW\'s figures are in. Every amount and every money measure on the entity is then printed per row rather than in one code for the whole column, and the select is not drawn as a fact of its own. One per entity |\n| `verdict` | `boolean`, `formula` | a settled pass/fail \u2014 ticked, or computed. TRUE is the PASSING side wherever it is drawn, a register\'s risk flag included, so a field whose true means trouble is the same fact asked the other way round. One per entity |\n| `obligation` | `date` | a day something is OWED by \u2014 a cut-off, a permit expiry, a payment due. It counts down by definition. `satisfied_by` names what CLOSES it (or `until`, the stage the record stops owing it at), `label` what is owed. Repeats: a row owes several things, and a shape that fans them draws one row each |\n| `origin` | `text`, single `select`, or a one-row `select_record_link` | where the row STARTS. Declared with a `destination` \u2014 a route has two ends, and one alone is refused \u2014 and then every surface over the entity draws the two as ONE reading, `Warehouse 4 \u2192 Site B`: on the register\'s supporting line after the key, and as one column on the child registers and party histories that list these rows. The two fields are then not facts of their own, and a `columns` clause naming either end is refused. One per entity, holding ONE place |\n| `destination` | `text`, single `select`, or a one-row `select_record_link` | where the row ENDS \u2014 the other half of the `origin`\'s route, and read only with it. One per entity, holding ONE place |\n\n**`due` is what makes a `when` a deadline.** A date a row is merely filed by \u2014 the\nday a lead arrived, the day a movement happened \u2014 is neither early nor late,\nhowever long ago it was. Without the clause every desk drew every `when` as a\ncountdown and a two-month-old lead read "40 days overdue" on a record nobody was\nlate on. So a bare `when` is a plain date, and `{ "role": "when", "due": true }`\nis the one that counts down. An `obligation` needs no clause: a day something is\nowed by is a deadline already.\n\n**`until` stops a countdown where the work is DONE.** A deadline counts down so\nsomebody acts on it, and a row that has arrived needs nothing: without the clause\na delivered order is tinted for a date it met, and every settled row past its day\njoins the urgent ones in the reader\'s glance. It names one option of the entity\'s\n`lifecycle`; at that stage, at every stage past it and at every `outcome`, the\ndate is drawn as the plain day it is. On a `when` it also says the date is `due`.\n\n"One per entity" is one COLUMN, never one value on screen. A second counterparty\nor a second parent stays a ROLELESS `select_record_link`: which field fills a\nslot is the screen\'s answer (\xA7 Apps and screens), and the extra link is a fact on\nthe row with its own section on the record, headed by that link\'s own label. A\nrole naming two fields would move the ambiguity into every shape that reads it.\n\nA COMPUTED field is admitted where its RESULT is what the role needs, and\nrefused where it is not: `identity` and `reference` need `text`, `when` a `date`,\n`mark` `files`. A formula\'s result is its `output_type`; a rollup\'s and a\nlookup\'s is read through the walk. So a formula yielding a number is refused in a\nname\'s place, a lookup landing on anything but `files` is refused as a `mark`, and\na formula declaring NO result is refused by all four \u2014 naming `output_type` as\nthe remedy, because a value drawn as a type nobody stated is the wrong cell with\nnothing saying so. The result also decides the DEVICE every screen draws the value\nwith: a rollup taking the `latest` of a set of dates is drawn as a date, a lookup\nof a select as the words it holds.\n\nA bare role name is the common form. A role that is read against a SECOND field\ntakes the object form:\n\n- **`measure`** names its limit: `against` \u2014 a constant, or a field on the same\n  entity the row states as a number (a `number`, or a formula or rollup whose\n  result is one) \u2014 and `alert`, which side of it needs attention, `over` a\n  capacity or `under` a minimum. The two come together.\n- **`measure`** names what its number COUNTS, where the unit changes how the row\n  is DRAWN rather than how the figure reads: `counts: "days"` spans a stop across\n  that many days of a run, so a three-night stay fills three of its days instead\n  of only the one it starts on, and `counts: "hours"` is how long a stop takes\n  INSIDE its day, stated beside it. Stated, never inferred \u2014 nothing about a `3`\n  says whether it is nights, pallets or hours, and a quantity drawn across a week\n  is a run nobody can read.\n- **`lifecycle`** names the stages that END the flow: `outcomes`, option aliases\n  of that select. A row in one has ARRIVED \u2014 delivered, cancelled, written off \u2014\n  so a desk draws them apart from the ladder instead of chaining them after each\n  other. Not every option may be an outcome, and terminal-ness belongs here, never\n  written into a stage\'s label.\n- **`lifecycle`** groups its stages into the parts of the flow they belong to:\n  `phases`, each a `label` and the `stages` under it. Nine rungs down one column\n  is a list nobody reads as a flow; the same rungs under three headings are three\n  pieces of work, and which belong together is the business\'s answer. Every stage\n  but an `outcome` falls in exactly one \u2014 a stage in two is drawn twice, a stage\n  in none vanishes off the ladder \u2014 and the outcomes may be placed in a phase or\n  left out, and are then read as a last part of their own.\n- **`lifecycle`** keeps every stage the row reached: `history: true`, or\n  `history: "<alias>"` to name the table. A ladder with no history reports where\n  a row IS and nothing about how it got there, which is the whole of what a\n  reader asks a pipeline. It is declared BESIDE `phases`, and refused without\n  them: the rungs a ladder draws are the live select\'s options, which nothing\n  reading a file or an app\'s spec can see, so `phases` is the one statement of\n  what the dates have to cover \u2014 and without it a rung the history cannot reach\n  draws undated on every record with nothing anywhere saying so. The flag is the\n  ONE statement: the model DERIVES a\n  child table from it \u2014 the link back to this record, the stage, the moment it\n  was reached and who moved it \u2014 and `check`, `apply`, `diff` and the app\n  generator all see that table exactly as they see a written one. Nothing else\n  declares it, and a file that also writes it by hand is refused. The generated\n  create stamps the rung the flow opens at and the generated editor stamps every\n  move after it; a stage changed anywhere ELSE is a rung with no date\n  (`docs/platform_gaps.md`). **A first apply backfills nothing** \u2014 `apply` writes\n  rows only into empty tables, and rows that existed before the flag walked their\n  stages before that table existed. The honest backfill is ONE opening row per\n  existing parent, at its FIRST stage, dated when that parent was created (true\n  by construction); the stage it stands on NOW is not dated unless that is also\n  the first. It is a create per parent \u2014 `lotics run create_records` \u2014 and\n  `scaffold apply` prints it as the work it did not do.\n- **`amount`** names the REFERENCE it is read against: `against`, a field on the\n  same entity the row states as a number. A price against the list it is quoted\n  off, a rate against the going one \u2014 and the catalogue item\'s record draws the\n  pair on one axis with the gap said in words. Never a constant (a price typed\n  into the model ages with nothing to update it) and never an `alert`: a limit is\n  a ceiling a row can pass, and beating a reference is the point.\n- **`amount`** names the select that SIGNS it: `signed_by`, a select on the same\n  entity, and `outflow`, the options of that select under which the amount is\n  money going out. Without it every shape over the ledger adds both directions\n  together: a month whose net was small reads as the total of everything that\n  moved, and the trend plots one rising line. The two come together, and\n  `outflow` is some of that select\'s options, never all.\n- **`expected_set`** names what CONDITIONS the set: `required_by`, a field on the\n  same entity, and `options`, which of that field\'s values require which entries.\n  A row whose value is not named requires nothing. Without it the denominator is\n  every option, so a set whose entries are mutually exclusive by kind reads\n  `1 of 4` on every complete row \u2014 a denominator no row can reach is worse than\n  no role. The field is a single `select`, keyed by its option aliases \u2014 or a\n  YES/NO the row answers itself (a `boolean`, or a formula resolving to one),\n  keyed by `"true"` and `"false"`: a check that FAILED owes its consequence \u2014 the\n  photograph, the owner, the day it is due \u2014 and there is no select of the record\n  that says so. `from: "parent"` reads that field off the record these rows hang\n  under instead, through this entity\'s own `parent` link: which documents an order\n  owes is the ORDER\'s type, and the papers carry no column that says it. Which of\n  the two a set takes is the set\'s own shape and not a choice \u2014 a multi-select\n  holds the whole set on one row and is narrowed by that row (`from` omitted), a\n  single select is one entry per row and takes `from: "parent"` \u2014 and the other\n  way round is refused rather than left conditioning nothing.\n- **`obligation`** names what ENDS it: `satisfied_by`, a `date` or a `files` field\n  on the same entity \u2014 the day it was done, or the paper that proves it \u2014 or,\n  where the business stamps nothing, `until`, the stage of this entity\'s\n  `lifecycle` at which the record stops owing it: a deposit is owed until the\n  order is paid, and nobody records the act of paying twice. One or the other,\n  never neither \u2014 without one every obligation the business ever met stays on the\n  desk. Optionally `label`, what is OWED as the reader says it ("G\u1EEDi SI"), which\n  is not what the column holding the date is called ("SI cut-off").\n\n```jsonc\n"field_roles": {\n  "product": { "name": "identity", "photo": "mark" },\n  "stock":   { "on_hand": { "role": "measure", "against": "minimum", "alert": "under" },\n               "uptime":  { "role": "measure", "against": 80, "alert": "under" } },\n  "order":   { "stage": { "role": "lifecycle", "outcomes": ["delivered", "cancelled"],\n                          // Two pieces of work, and every step dated.\n                          "phases": [{ "label": "Taking it on", "stages": ["placed", "confirmed"] },\n                                     { "label": "Getting it out", "stages": ["picked", "shipped"] }],\n                          "history": true },\n               // A DEADLINE COUNTS DOWN \u2014 `payment.paid_on` below is a plain day.\n               "ship_by": { "role": "when", "due": true },\n               // The day the papers are owed by, and the day they went.\n               "papers_due": { "role": "obligation", "label": "File the papers", "satisfied_by": "papers_sent" },\n               // Nothing stamps a deposit paid \u2014 the order\'s own stage ends it.\n               "deposit_due": { "role": "obligation", "label": "Take the deposit", "until": "delivered" } },\n  // WHICH PAPERS THIS ONE OWES IS THE ORDER\'S OWN TYPE, and no document says it.\n  "document": { "order": "parent",\n                "kind": { "role": "expected_set",\n                          "required_by": { "from": "parent", "field": "kind",\n                                           "options": { "export": ["invoice", "customs"] } } } },\n  // `kind` is the direction select \u2014 options `received` and `paid_out`, no role of its own.\n  // Every figure on a quotation is in the currency that row names.\n  "quote":   { "unit": "currency", "total": "amount" },\n  // What the price is quoted off, so the item\'s page reads one against the other.\n  "service": { "price": { "role": "amount", "against": "list_price" },\n               "kind": "category" },\n  // The day the money moved is neither early nor late, so it stays a bare `when`.\n  "payment": { "paid_on": "when",\n               "value": { "role": "amount", "signed_by": "kind", "outflow": ["paid_out"] },\n               // A receipt owes a receipt voucher; a payment owes an invoice and a payment voucher.\n               "papers": { "role": "expected_set",\n                           "required_by": { "field": "kind",\n                                            "options": { "received": ["receipt_voucher"],\n                                                         "paid_out": ["invoice", "payment_voucher"] } } } },\n  // A CHECK THAT FAILED OWES ITS CONSEQUENCE \u2014 keyed by the row\'s own answer,\n  // and the answer that owes nothing is omitted rather than named with an empty list.\n  "check":   { "passed": "verdict",\n               "evidence": { "role": "expected_set",\n                             "required_by": { "field": "passed",\n                                              "options": { "false": ["photo", "owner", "due"] } } } }\n}\n```\n\nIn a file that starts from a preset (\xA7 Starting from a preset), `field_roles`\nmay name the preset\'s fields as well as this business\'s own; a role the preset\ndeclares itself is kept unless this file names the same field, and `null`\nclears it.\n\n## Write rules\n\n`write_rules` is what only a CREATE meets \u2014 keyed by entity alias, like\n`field_roles`, and this file\'s in the same way: `check` proves it and the\nworkspace never sees it. An update names one field that moved; a create takes a\ndraft whole, so it has to know which row a name already belongs to, where a\nvalue comes from when nobody types it, and what a figure or a picker may hold.\nThe generator writes one `create_<entity>` workflow and one `New<Entity>Dialog`\nper entity an app can operate, from these clauses and the fields\' own\n`required`.\n\n```jsonc\n"write_rules": {\n  // A customer is RECOGNISED by their address. Where an entity names a customer\n  // as its `party`, the create takes the email instead of a picker, reuses the\n  // row it matches and mints one only where nothing does \u2014 so the book never\n  // grows a second Acme because somebody typed the name differently.\n  "customer": { "natural_key": ["email"] },\n  "order_line": {\n    "fields": {\n      // A line of nothing is not a line. Refused on create and on update, at\n      // the control the figure was typed into.\n      "quantity": { "min": 1, "max": 9999 },\n      // The price is fixed at the moment of ordering \u2014 COPIED off the product,\n      // not looked up for ever after, so the price list moving next week does\n      // not silently reprice an order already placed.\n      "unit_price": { "default_from": "product.price" },\n      // And nothing is sold off an empty shelf. The picker reads only the rows\n      // that answer this, and the write refuses the same rows again \u2014 a caller\n      // who never opened the picker is bound by it too.\n      "product": {\n        "options_where": {\n          "node_type": "group", "logic": "and",\n          "children": [{ "node_type": "condition", "type": "number",\n                         "field_key": "in_stock", "operator": "greater_than", "value": 0 }]\n        }\n      }\n    }\n  }\n}\n```\n\n| Clause | On | Meaning |\n|---|---|---|\n| `natural_key` | the entity | the field aliases a row is recognised by. A `text` key declares `unique: true` on the field itself \u2014 two rows sharing it would make find-or-create pick whichever the read answered first \u2014 and a key is `text` or `number`, because a person types it back |\n| `default_from` | a field | `"<link alias>.<field alias>"` \u2014 the value is copied from the linked row when the row is created, never asked. The link is a one-row link on this entity and `required`, because there has to be a row to read, and the two field types must match |\n| `min` / `max` | a `number` | the figure is refused outside them, on create and on update |\n| `options_where` | a `select_record_link` | an `and` group of plain conditions over the TARGET\'s own fields, each `field_key` a field alias. It narrows the picker\'s read and is refused again where the write lands, so the link is `required` |\n\nA field\'s own `required` is not here: the contract carries it, every write path\nrefuses the row by field name from it, and the generated panel stands its commit\ndown until the same set is filled. `unique` is the text field\'s own clause\n(\xA7 `text`) \u2014 the create says so at the control before the column does.\n\nWhat a create asks is what a person STATES. A `default_from` field is not drawn,\na `lifecycle` opens at its first rung, and the stamp an obligation\'s\n`satisfied_by` names is not asked (the row is only now taking that on) \u2014 one\nfact, one place. A field the workspace writes (a formula, a rollup, a lookup, an\nautonumber, a date with `derive_from`) is never an input of a create or an\nupdate, a write in a generated body, or an entry in `lotics.writes`, and its\nrecord fact has no editor. Of the files columns it asks for exactly ONE, the\n`mark`: that pile IS the row, so a register leading with the picture would\notherwise open a faceless row, while every other pile is papers gathered onto a\nrow that exists and a panel asking for all of them is a filing cabinet with a\nSave button. The screen narrows that set where it states a `create` (\xA7 Apps and\nscreens). `scaffold check` prints every clause under its entity in **Who writes\nwhat**.\n\n**The `parent` is prefilled only in the door that mounts the act.** A row opened\nfrom the record it hangs under takes that record from the door it was pressed\nin, so the link is neither asked for nor drawn. The same entity\'s act on its own\nregister has no such row, so there the parent is an ordinary picker the draft\ncannot be committed without \u2014 a payment opened from a money app belongs to a\ncase either way.\n\n## Apps and screens\n\n`apps` is the plan: each app the reader will build, as ONE REGISTER \u2014 a SHAPE\nover an ENTITY \u2014 under `screen`. Nothing here is built by the scaffold: the plan\nis what `lotics scaffold check` prints back, register by register with the field\nin every slot, so it is read and corrected before a screen exists.\n\n**THE PRINTOUT EXPLAINS ITSELF.** Everything the shape and the roles answered by\nthemselves is marked `(default)` \u2014 the door, the tab strip, the band\'s figures,\nwhat the rows lead with, how much room they take, which end the register is read\nfrom, the set a member lens opens on, how many rows a capped history stands at \u2014\nso a clause nobody wrote is never read back as one somebody did. And\n`lotics scaffold check --why` prints the RULE behind every binding and every\nsection, indented under the line it explains: which field filled a slot and what\nit was chosen from, why the record opens where it does, why a child\'s rows are a\njournal rather than a register, why a history is capped and a relation counted.\nEvery sentence is the derivation\'s own, so what the printout explains is what\ngets built.\n\n**THREE THINGS DECIDE EVERY SCREEN AND EVERY RECORD**: the SHAPE, whose slots are\nthe table below; the ROLES the entities declare (\xA7 Field roles), which fill those\nslots and decide what each child\'s rows become; and the CLAUSES, which are where\nthe plan overrides what the two would answer. This index says which is which, so\na clause is reached for only where the first two have no answer.\n\n**What a child\'s rows become.** One section per LINK into the record, and what\nthe CHILD declares decides its kind \u2014 the first line it answers wins.\n\n| Printed as | The child declares | The reader gets |\n|---|---|---|\n| `documents:` | an `expected_set` select, one entry per row | the desk of what is owed, each row\'s files attached to it |\n| `timeline:` | an `obligation` closed by a DATE, on rows with no `lifecycle` of their own | the ordered stops, the promised day against the day it happened |\n| `thread:` | a `markdown` body, a `party` and a `when` | the correspondence, its answer, and whose move it is |\n| `journal:` | a `markdown` body and a day, on rows a record OWNS (`parent`) with no `lifecycle` | the log \u2014 each entry read in full under its day, its selects beside it, and a composer that writes the next one |\n| `itinerary:` | a `when` and a `lifecycle`, on rows a JOB\'s record OWNS | the day heads the run, one line per stop, the sum under it |\n| `lines:` | anything else the record owns (`parent`) | the register of the rows it is made of |\n| `history:` | anything else NAMED BY it \u2014 the link is their `party` or their `identity` | the same rows read as that record\'s own history \u2014 on a PROFILE, every one of them stands open at its latest 5, headed by how many there are in all, with the rest a press away |\n| `via <link>:` | a link carrying neither role | the register, headed by that link\'s own label |\n| `related:` | rows of an entity this app lists NOWHERE | one counted line, and a press that opens their register |\n\nA child carrying the BODY and the party who wrote it, and no day, is a plain\nregister, and `scaffold check` names the declaration it is one short of rather\nthan letting it fall through silently. A `party` beside a `when` and no body is\nnot a near miss \u2014 that is every ledger line there is.\n\n**A LOG\'S DAY is the child\'s `when`, unless that `when` counts down** (`due`,\n`until`): a deadline is the day an answer is OWED, so a log stacked on it would\nput the entries nobody has chased at the top. Then \u2014 and where the child declares\nno `when` at all \u2014 the day is the first `date` no role claims. A child carrying a\n`lifecycle` is never a log, on the same rule a run of stops reads: it is a thing\nbeing WORKED, and the prose on it is a note about the job.\n\n**A child\'s columns read, and are given up, in one order**: identity \xB7 when \xB7\nlifecycle \xB7 category \xB7 amount \xB7 measure \xB7 expected_set \xB7 party \xB7 contact \xB7\nverdict. The DAY outranks the counterparty because a list of rows belonging to\none record is scanned by when \u2014 the counterparty repeats on every row, and on a\nlog there is none. Ranked the other way, a narrow register shed the date and kept\na column that said the same thing on every line.\n\n**A section names its link where two of them would read alike.** One child can\nreach a record through several links and land under the same heading twice, which\nis the same sentence with nothing saying which rows either holds \u2014 so each of\nthose says the link it is read through (`timeline: Stops via Billed to`), and a\nchild reaching the record once is named by the rows it lists.\n\n**The clauses, by name.** On the APP: `scope`. On the `screen`: `record`, `tabs`,\n`slots` (`roles` on a `custom` one), `columns`, `writes` (`false`, or\n`"children"` for the rows a record owns and not the record), `period`, `filters`,\n`summary` (`above`, `totals`, `ageing`, `trend`), `facts`, `presentation`\n(`lead`, `density`, `layout`, `until`), `acts` (`row`, `record`, `selection`,\n`export`, `import`), `section_acts`, `sections`. Every one is optional, every one\nis printed back by `scaffold check`, and a screen that states none gets what its\nshape and its roles answer by themselves.\n\n**ONE APP IS ONE REGISTER AND THE RECORDS IT OPENS.** A second register beside\nit is a second job on one page: the reader arrives on whichever the nav listed\nfirst and decides, every time, which of the two they came for. So an app has one\ndestination and everything else about a row is DISCLOSED by opening it \u2014 the\nfacts by tier, the children as lists, the related as counts, one primary act, and\na filter or a group where a strip of destinations would have been. What used to\nbe a second screen is a section of the record, or another app; a model still\nsaying `screens` is refused by name.\n\n**The unit of an app is a JOB, not a person and not a table.** A job has its\nown outcome (something exists or is settled when it is done), its own subject\n(the record it advances), and an end that does not wait on the rest of the\nwork. Two tasks are ONE job when neither finishes without the other and both\nadvance the same record. One app per job, and that is what makes an app a\nwrite-ownership boundary: what the job settles is its app\'s alone to write,\nplus everything it must read to settle it well. A person holding several jobs\nopens several apps \u2014 one app for everything one person does is the dump. A step\nof the job is a section of the record, never a register beside it; a reference\nthe job needs at hand is read inside the record it is about.\n\n**Two people signing is two jobs**, because the outcome belongs to the signer:\nthe desk that prepares against the gate that releases. So is a different\ncadence \u2014 reference data edited monthly and read by the public site, beside a\ndaily desk \u2014 and a different reader, the owner\'s read-only questions. Device,\nplace and step never split a job. A super app holds more than one job; an\nover-split holds less than one, a job cut by device, place or step. The count\nper workspace falls out of the jobs, typically two to six, and is never the\ninput: review the plan app by app, naming who holds it, the job in one\nsentence, what it writes and what it reads.\n\n**A party is not a job.** The people and companies a job\'s rows name \u2014 the\ncustomers, the suppliers, the carriers \u2014 are not a job of their own, however\nmany rows name them: nobody\'s day is "the customer book". They live inside the\napp whose rows name them: a create takes the party by its natural key, the row\'s\nname opens the party\'s own record (a profile \u2014 how to reach them, what is live\nwith them, their history, their journal), and its facts are edited there. A\nparty earns an app of its own only where someone\'s job IS the relationship, with\nan outcome of its own \u2014 an account plan signed, a supplier qualified \u2014 never\n"keeping the book". Two apps for one seller, the deals and the customers, is the\ndump cut in two.\n\n*A two-van appliance repair shop.* The technician\'s job is the call-out: the\noutcome is a visit done, the subject is the call-out record, and quoting it and\nscheduling it are one job, because neither finishes without the other and both\nadvance that record. The owner holds two of his own \u2014 billing the month\n(outcome invoiced, subject the invoice, settled against visits already closed)\nand the price list the booking page quotes from, edited monthly. Three jobs,\nthree apps, and the owner opens two of them.\n\n**Inside a job the caps hold**: six flow stages on a desk, seven facts before a\nrecord\'s fold. Past them, look for the second job hiding inside. And a job\'s app\nis DENSE: every create the job needs lives in it, so its user never leaves it to\ncorrect a figure the screen in front of them is stating \u2014 three workflows is a\nscreen, not a desk.\n\n**A handoff is a stage change.** Where one job ends the record moves stage and\nthe next job\'s desk opens on it; a field two jobs must both write is declared\nshared at the split, naming the stage each may write it in.\n\n**Name an app for the JOB, in the trade\'s own words, never for who it is for.**\nA title on the door says nothing about what the person who opened it came to\ndo, and it is wrong the day the org chart moves.\n\n```jsonc\n"apps": [\n  {\n    "alias": "sales", "name": "Sales",\n    "description": "\u2026", "icon": "briefcase", "theme": { "color": "blue" }, // optional\n    "screen":\n      { "alias": "orders",    "label": "Orders",    "shape": "lifecycle_desk", "entity": "order",\n        "record": "drawer",                  // optional \u2014 "drawer" | "page"; absent, the shape decides\n        "tabs": "stage",                     // optional \u2014 the entity\'s lifecycle, or null; absent, the shape decides. Any other select is a filter\n        "writes": false,                     // optional \u2014 default TRUE; false is a reader, "children" operates only the rows the record owns\n\n        "period": "due_date",                // optional \u2014 any field whose value is a date, derived ones included\n        "filters": ["kind",                  // optional \u2014 a single-select, or a lens the model states itself\n                    { "label": "Qu\xE1 h\u1EA1n l\u01B0u", "predicates": [\n                      { "label": "\u0110\xE3 qu\xE1", "tone": "red",\n                        "where": { "node_type": "group", "logic": "and", "children": [\n                          { "node_type": "condition", "field_key": "owed", "operator": "greater_than", "value": 0 }] } }] }],\n        "summary": { "totals": ["total"], "above": ["total", { "field": "owed", "at": "end" }],\n                     "ageing": { "amount": "owed", "due": "due_date", "buckets": [30, 60, 90] },\n                     "trend": { "field": "total", "direction": "up" } },  // optional \u2014 see below\n        "facts": { "groups": [{ "caption": "Pricing", "fields": ["rate", "surcharge"] }] },  // optional \u2014 the record\'s named bands\n        "presentation": { "lead": "none", "density": "dense" },  // optional \u2014 how it is DRAWN; absent, what the rows are decides\n        "acts": { "row": [{ "label": "Issue the note", "template": "debit_note", "place": "cta", "confirm": true },\n                          { "kind": "agent", "label": "Read the papers", "agent": "reader", "fills": ["ref", "due_date"] },\n                          { "kind": "workflow", "label": "Hand it to dispatch", "workflow": "hand_to_dispatch",\n                            "inputs": { "order_id": "record", "owed_by": "due_date" } }],\n                  "record": [{ "label": "Print the file", "template": "dossier" }],  // optional \u2014 the record\'s own header menu\n                  "selection": [{ "label": "Statement", "template": "statement" }],  // optional \u2014 the work it hands on\n                  "export": true,                                                    // optional \u2014 the rows in view, saved\n                  "import": { "kind": "import", "label": "Upload the sheet",         // optional \u2014 a file turned into rows\n                              "entity": "order", "key": "code", "columns": ["rate"] } },\n        "section_acts": { "line": [{ "label": "Chase the lines", "template": "chaser" }] },  // optional \u2014 a verb on one section\n        "sections": { "line": { "draw": "worksheet", "cost": "buy_rate", "sell": "rate" },  // optional \u2014 priced lines, worked down in place\n                      "payment": { "draw": "ledger", "summary": ["total", "paid", "outstanding", "due_on"] },  // optional \u2014 a book headed by what it is read against\n                      "pinning": { "draw": "publish", \u2026 } },  // optional \u2014 the destinations this record is sent to (see below)\n        "slots": { "identity": "code",       // optional \u2014 slot \u2192 field, where the roles cannot decide alone\n                   "subject": ["customer", "project"],              // \u2026or the TIERS a fold walks down, outermost first\n                   "stage": { "field": "state", "quick": true } },  // \u2026or the field AND the reader\'s own control for it\n        "columns": ["source", "owner"],      // optional \u2014 extra facts after the slots, shed first at narrow width\n        "create": ["code", "customer", "due_date"] }  // optional \u2014 what a NEW row is asked for; absent, every field a person states\n  }\n]\n```\n\nA shape is a proven screen with named SLOTS, each filled by a field carrying a\nrole (\xA7 Field roles). A slot with exactly one candidate on the entity binds by itself;\ntwo candidates need naming in `slots`; a field fills one slot; a required slot\nwith none is refused \u2014 a lifecycle desk over an entity with no `lifecycle`\nselect cannot be built.\n\n**A LIST IS A HIERARCHY, not a set of columns.** A group register\'s `subject`\ntakes one \u2014 `"subject": ["customer", "project", "order"]`, outermost first \u2014 and\nthe register becomes one the reader walks DOWN: it folds by the first tier, a\nnode narrows to the tier inside it, the last tier opens the set behind the\nfigure, and a trail says where they are. Every tier is a field of this entity\ncarrying a role that slot accepts, and none of them fills a second slot. It is\nthe slot\'s own answer that decides: a list on any other is refused, because two\ncolumns in one cell is not a fold. Without it the same business needs a register\nper depth, and the same money is folded twice with nothing saying it is the same\nmoney.\n\n**AND ON A SLOT READ AGAINST A LIMIT A LIST IS SEVERAL MEASURES** \u2014\n`"level": ["received", "invoiced"]`, at most four, each drawn as a named meter\nline inside the ONE column and each read against its OWN `against`/`alert`. A\nrow is regularly scored against more than one target at once, and the second\nreading put in `columns` instead draws a figure bare with the comparison handed\nback to the reader. Every entry states a limit \u2014 a bare measure in the list is\nrefused, naming the clause \u2014 and `quick` is refused beside one, because a typed\nfigure is one cell. The FIRST leads: it is what `summary.above: "counts"` counts\npast-limit rows on and what a live board ranks its exceptions by, both of which\nname one set.\n\n**A QUICK SLOT IS FOR A DECISION THE READER MAKES FROM THE ROW ALONE.** A slot\'s\nvalue in `slots` is normally the field\'s alias; `{"field": \u2026, "quick": true}`\nsays the column is not a reading of that value but the CONTROL for it \u2014 pressed,\nit writes that one field as a diff through the record\'s own update, so the\nregister and the page behind it land the same write. THREE roles are such a\ndecision, and `quick` on any other is refused: a `lifecycle`, which rests as the\nstage\'s own dot and label, takes a rule under it on hover and focus, and opens\nthe field\'s stages with the ones that END the flow last \u2014 ONE control, which IS\nthe reading;\na `verdict`, which is the switch; and a `measure`, which is the figure typed in\nits own cell \u2014 a reading taken per row IS the row, which is what a timesheet\'s\nhours and a count sheet\'s tally are. Everything else is decided against what the\nrecord holds, and the record has to be open. All three carry the record\'s own\nblockers \u2014 a move the ladder holds is a move the cell holds, and it names the\nentries the row still owes \u2014 and an outcome asks before it commits. Add `"order": "sequence"`\nwhere the stages are a WALK rather than a set of destinations: the picker is then\nordered as the walk and the step the row takes next is MARKED in it. It never\nadds a second control \u2014 a column that answered with a reading in some rows and a\nverb in others is two columns about one value. A screen stating `writes: false`\nrefuses `quick`: a reader who may operate nothing has no decision to take.\n\n**THE SLOTS ARE THE ROW\'S ANSWER; `columns` IS ITS CONTEXT.** `"columns":\n["nguon", "phu_trach", "nhu_cau"]` names extra fields of the entity, drawn AFTER\nevery slot and in this order, each by what its column IS \u2014 a chip for a select,\nthe person\'s name for a member, the day for a date, the figure for a number, a\ntick for a boolean, the words for everything else. They are ranked BENEATH every\nslot, so a phone sheds all of them before it sheds any of the shape\'s own\ncolumns. **A COUNT IS NOT A COLUMN**: an entry whose field is a `rollup` that\nCOUNTS rows is read as the thing it counts \u2014 `3 b\xE1o gi\xE1 \u0111ang m\u1EDF`, the number then\nthe column\'s own label \u2014 on the name\'s supporting line at every width, so it\ntakes no seat and a count of nothing draws no run at all. Where the record LISTS\nthose rows, the reading is the press that opens it. At most four, and refused\nwhere one would say what a slot already says,\nover a files field (files are read, so they are a section of the record), over a\ncell holding several (a column of comma lists compares nothing), on a shape whose\nrows are not the entity\'s records in a table, and beside a `presentation.layout`\nthat draws the rows with a device of its own. A fifth fact worth the width is a\nslot the shape is missing \u2014 say so rather than widening this clause.\n\n**THE DRAFT ASKS WHAT FILES THE ROW; THE RECORD ASKS THE REST.** `"create":\n["ma_ho_so", "khach_hang", "han_xu_ly"]` names the fields a NEW row is asked for,\nin that order. Absent, the draft asks for every field a person states \u2014 which is\none panel for a row somebody has the answers to when they open it, and a wall in\nfront of one that is written over days: a job is named, dated and filed the\nmoment it is taken, and everything else about it is learned afterwards. Whatever\nthis clause leaves out is edited in place on the record, where it is read. It is\nthe SCREEN\'s, and a screen is one register over one entity, so it narrows that\nentity\'s own draft: the rows a record adds under itself are the section\'s, and\ntheir composer asks what the section draws. At most twelve, and refused where an\nalias is not a field of the entity, is named twice, or is one no draft ever asks\n\u2014 a computed value, a link holding many rows, a minted number, the `lifecycle`\n(the row opens at the flow\'s first rung), a field a `default_from` copies, the\nstamp an `obligation` is closed by, and every files column but the `mark`. A\nlink the row STANDS ON \u2014 its `parent`, its `party` \u2014 is asked whatever its\ncardinality, because the create writes one row into it and how many the cell\nholds afterwards is the platform\'s business. The\n`mark` itself may be left out, and then the row\'s face is attached on the record\nlike any other pile. Refused too where it omits a field the row cannot be written\nwithout \u2014 one that is `required`, the link it hangs under, or the key a party is\nrecognised by \u2014 because a draft that cannot save is worse than a long one.\n\n| Shape | Answers | Required | Also fills | Record | Tabs |\n|---|---|---|---|---|---|\n| `lifecycle_desk` | what is stuck, what do I move next | `lifecycle`, `identity` | `mark`, `party`, `amount`, `measure` (level, one or several), `when` | page, or drawer where the entity carries `parent` | the lifecycle\'s stages |\n| `party_register` | who is this, our history, is there a risk | `identity` | `mark`, `contact`, `measure` (worth), `verdict` (risk) | page | none |\n| `offering_register` | what do we offer, at what price, can I sell it | `identity` | `mark`, `amount` (price), `measure` (availability) | page | none |\n| `transaction_ledger` | does this period reconcile, what is unexplained | `when`, `amount` | `identity` (reference \u2014 the line\'s own number), `party`, `lifecycle` (classification), `expected_set` (document) | drawer | none |\n| `monitored_asset_set` | what needs attention, is that number normal | `identity`, `measure` (level, one or several) | `mark`, `lifecycle` | drawer | none |\n| `obligation_desk` | what is due next, and has it been done | `identity`, and at least one `obligation` on the entity | `when` (runway) | page | none |\n| `trend_deep_dive` | how did the period go, and why | `when` | `measure`, `amount` | drawer | the series, where the model names a select |\n| `reconciliation_desk` | what does not match, and by how much | `identity` (reference), and two figures \u2014 `ours` and `theirs`, each an `amount` or a `measure` | `category` (reason), `verdict`, `when` | drawer, on the PAIR | the dated runs, where the model names a select |\n| `entry_matrix` | one value per subject per period | `identity` (subject), `across` \u2014 a `when`, or a `category` for a fixed column set | `measure` (value), `lifecycle` (state), `category` (note) | drawer, on the cell\'s row | none |\n| `guided_run` | complete an ordered sequence, a step at a time | `identity` (step) | `slot` (sequence), `capture` \u2014 a `measure`, `verdict` or `expected_set` \u2014 `verdict` (gate), `mark` (media) | page: the run IS the record | none |\n| `live_board` | is everything OK, right now | `lifecycle` (state), `identity` | `verdict` (exception), `when` (since), `measure` (level, one or several), `category` (where) | drawer | none |\n| `group_register` | what does each group come to, and what is behind it | `subject` \u2014 a `category`, `party` or `when` | `amount`, `measure`, `identity` (member) | page: a row is an aggregate, and the door is the SET behind it | none |\n| `media_set` | scan a body of pictures by where they belong | `mark` (picture), `identity` | `category` or `party` (group), `when`, `verdict` (current against superseded) | drawer | none |\n| `day_sheet` | what happened on each day | `when` (the day) | `lifecycle` (state), `measure` (level, one or several), `amount`, `category` (note) | page: a day composes several child logs | none |\n| `resource_schedule` | what is on each resource, in what order, under what ceiling | `lane` \u2014 a `party` or a `parent` \u2014 `identity`, `when` (the start) | `measure` (duration), and `load` and `bulk`, each a `measure` read against a ceiling of the LANE\'s \u2014 a vehicle fills by weight and by room and stops at whichever runs out first; `lifecycle` (stage) | drawer, over the lanes | none |\n| `worksheet` | priced lines the reader edits, totalling to one figure | `identity` | `category` (group), `measure` (quantity), and `cost` and `sell`, each an `amount` or a `measure` | drawer, per line | the versions or the jobs, where the model names a select |\n\n**A record is one of five KINDS, and the shape plus the roles decide which.**\nEvery one of them is ONE READING COLUMN, and the ORDER of that column is the\nwhole of what the kind means.\n\n| Kind | The column, top to bottom |\n|---|---|\n| WORK RECORD \u2014 a `lifecycle_desk` over rows that belong to nothing and that nothing transacts with | the one act that moves it \xB7 what it IS \xB7 the papers it owes \xB7 the rows it is made of \xB7 the book of what it came to |\n| LINE \u2014 the same shape over rows carrying `parent` | its ladder \xB7 the arithmetic behind its amount \xB7 the rows and papers under it \xB7 its particulars, last (the key it is filed by is the line under its title) |\n| PROFILE \u2014 a `party_register`, and any shape over an entity whose rows other entities are NAMED by (their `party` or their `identity`) | where it stands \xB7 its history, OPEN, grouped by year \xB7 the rest of its registers \xB7 its facts (the ways to reach it are under its name, its settlement is the band, and a `when` it owes closes that band as a countdown) |\n| CATALOGUE ITEM \u2014 an `offering_register` | its own words (the picture leads the header at media scale, the price is read against its reference in the band) \xB7 what uses it \xB7 its facts |\n| EVIDENCE \u2014 a `transaction_ledger` | the PROOF \xB7 what the paper is, compactly \xB7 the rest \xB7 the links to the record it settles and the party it was with |\n\nNothing in the file states the kind: a clause that could say it could say the\nwrong one, and the model already says it \u2014 `parent` says whether a row stands\nalone, and a link NAMING this record (`party`, `identity`) says whether other\nrows are ABOUT it. So a desk over accounts\nwalking their own stages opens a PROFILE: the quotes and the invoices naming\neach account are what its record is read for, and a work record would have\ncounted them in one line at the foot. `record`\noverrides the DOOR where the shape\'s own answer is not the one wanted \u2014 and its\nthird value, `"expand"`, is not a door at all: the row REVEALS what it holds in\nplace, where there is nothing behind it worth navigating to. A row read that way\nreads as a LINE whatever the shape would have opened: its ladder, the arithmetic\nbehind its amount, then its particulars, because there is no header above it to\nhave stated the name first. It is REFUSED for two reasons, and they are not the\nsame refusal. On a shape whose record is a page by nature \u2014 a `guided_run`, a\n`group_register`, a `day_sheet`, an `obligation_desk` \u2014 because each of those\nstates the opposite where its door is declared: what its row leads to is read\nwhole, not as four more columns than the register had room for. And on a shape\nthat draws its rows with a device of its OWN \u2014 an `entry_matrix`, a `media_set` \u2014\nbecause a cell of a grid and a tile on a wall have no band under them for the row\nto reveal into. For the same reason a revealed register is drawn as a TABLE: a\n`presentation.layout` of anything else is refused, and the reader is not offered\nthe arrangement either, since it would take away the only door the register has.\n\n**`scope` \u2014 the one subject every read of the app narrows to.** Stated on the\nAPP rather than on its screen, because it is not a filter: a record opened under\nit stays under it, the pick survives closing the app, and every app declaring the\nsame `entity` shares one pick per viewer \u2014 which is the whole value, and what\nstops a construction workspace asking which project twelve times. `entity` is the\nmodel\'s entity whose one row the app is read inside, and `param` is what the\napp\'s reads take that row by.\n\n```jsonc\n{ "alias": "site_work", "name": "Site work",\n  "scope": { "entity": "project", "param": "project_id" },\n  "screen": { \u2026 } }\n```\n\nThe register\'s own entity has to REACH it \u2014 its own rows, or rows that name one\nthrough a link \u2014 or the switcher is a control that changes nothing. Until a\nsubject is picked the app reads NOTHING and says which one it is waiting for: an\nunscoped read over a scoped app is every row in the workspace drawn as one\nproject\'s work, which looks correct.\n\n**ONE RECORD SURFACE PER ENTITY, AND ITS KIND IS THE ENTITY\'S.** An app is one\nregister, so the record its rows open is the register\'s own and the kind comes\nfrom that register\'s shape. Another app over the same entity opens the same kind\nof record: a payment read from a cash book and one read from a trend are both\nmovements, and both read proof first. A shape with no kind of its own (a trend, a\nmonitored set, a `custom` screen) says only where the record opens.\n\n**A NAMED PARTY HAS A RECORD SURFACE IN THE APP.** One register, but the party\nits rows name \u2014 by `identity` or by `party` \u2014 opens a record of its own, a\nPROFILE, from the cell that names it and from the record\'s header: the ways to\nreach them, what is live with them, every register that names them at its latest\nfive, their journal, their facts. It is the app\'s to write as far as the job\nneeds \u2014 the party\'s facts and its journal \u2014 and the writers matrix says so; the\nregister\'s own record stays the register\'s. A party named through a link\ncarrying no role opens nothing, and neither does a party that is a MEMBER \u2014 a\nperson of this workspace has no row in any book the app carries, so the cell and\nthe header state them and stop.\n\n**Two things a register states about a row beyond which field fills which slot.**\nA `measure` is read AGAINST its limit (`against`/`alert`) where the shape\'s slot\ntakes one \u2014 `level`, on a lifecycle desk, a monitored set, a live board and a day\nsheet, a schedule\'s `load` and `bulk`, and every slot of a\n`custom` screen, which composes the frame\'s own column; `worth`, `availability`\nand a trend\'s headline are plain figures, and a limit there would read as a meter\nin the record over a number the row printed bare. And the name carries a\nSUPPORTING LINE where the entity states a key to file the row under: the `parent`\nit belongs to, its `reference`, an `autonumber`, a text formula \u2014 in that order,\nfirst hit wins, never a field a person types prose into. Every record heads with\nthat same key, so the register and the door it opens name one row one way.\n\n**The act that opens a row belongs to a register that LISTS the entity\'s rows**\n\u2014 a desk, a register, a ledger, a monitored set, or a `custom` screen. A shape\nwhose rows are not records has neither that act nor the door a counted line\nelsewhere leads to: an obligation desk\'s rows are deadlines and a trend\'s are\nperiods, so a create pressed there would open a row the screen cannot show. An\nentity whose only app is one of those has no create at all \u2014 give it an app whose\nregister its rows are read in.\n\n**An `obligation_desk`\'s rows are not its entity\'s rows.** The shape fans the\nentity\'s `obligation` fields out \u2014 one row per thing still owed, which is one\nwhose date is SET and whose `satisfied_by` is empty \u2014 so a l\xF4 with four cut-offs\nis four rows, and the three it has met are not there at all. The row\'s name is\nthe obligation\'s, its supporting line the record\'s `identity`, and the door is\nthat record. A `when` bound to `runway` is what the countdown\'s ring is measured\nfrom. Over an entity declaring no `obligation` the shape is refused: there is\nnothing to count down to.\n\n**What a register carries beyond its columns.** Six clauses, each emitted as\nthe prop the kit draws it with; every one is optional and a screen that states\nnone gets a register of columns and nothing else.\n\n- **`period`** \u2014 a field on the entity whose value is a DATE. The toolbar gains a\n  date-range control (this month to start), and the rows it keeps are what the\n  register AND every figure below are computed over, so a band can never be over a\n  different window than the rows under it. Any such field, not only the `when`\n  role, and however the date got there: one table is read two ways (a cost ledger\n  by the day a line arose, the cash book over the same table by the day it\n  settled), a role is one field\'s, and the day money MOVED is often a formula over\n  the two columns that could hold it \u2014 which then declares `output_type: "date"`.\n  A `trend_deep_dive` brings its own period and takes none here; a `live_board`\n  is PERIODLESS and takes none either, for the opposite reason \u2014 it answers what\n  is true NOW, and a date range over it draws what was true in the window in the\n  live state\'s own colours.\n- **`filters`** \u2014 the chips beside the search. A single-`select` field\'s alias\n  offers that field\'s own live options; it is the lens a register is read through\n  over and above the one band its strip gives, so the strip\'s own field is\n  refused here (one dimension, one control) and so is a multi-select (a row would\n  answer the chip several ways at once). The rows the register and every figure\n  below are computed over are what the chips AND the period kept.\n  A `select_member` field\'s alias is the third form and asks one question \u2014 whose\n  rows these are: two peers, MINE and ALL, read against the person looking rather\n  than a directory of everybody. `{"field": \u2026, "default": "mine"}` opens the\n  register on the reader\'s own; that form on any other type is refused. Alone of\n  the chips it narrows the READ (a `member` param on the register\'s query), so a\n  desk that opens on the reader\'s work opens on all of it rather than on\n  whichever of their rows the first page happened to hold.\n  A DERIVED LENS is the other form \u2014 `{"label": \u2026, "predicates": [{"label": \u2026,\n  "tone": \u2026, "where": \u2026}]}` \u2014 where the sets a reader narrows by are ones the\n  MODEL names and no column holds: rate validity, plan urgency, free-time\n  overrun. Each `where` is an `and` group of plain conditions over the entity\'s\n  own fields, each `field_key` a field alias, and it is read off the row, so the\n  operators are the comparisons a value answers \u2014 `number` and `text` equality,\n  `number` ordering, `boolean` equality, `select` `has_any_of`/`has_none_of`, and\n  `is_empty`/`is_not_empty` on any of them. Nothing DATED: a relative point needs\n  a clock, and a screen states one date control (`period`), so a second beside it\n  would be two windows with nothing saying which a figure was computed over \u2014 a\n  date question is asked as a column the model derives and read here as a number\n  or a yes/no. `tone` is the option palette\'s, because the chip draws these\n  exactly as it draws a select\'s options.\n- **`summary`** \u2014 what the rows in view come to. `above` is a band OVER the\n  register: `"counts"` for how many rows are in view and, for the FIRST\n  `measure` the model gives a limit, how many are past it (accented only when\n  one is) \u2014 one such set, because a band naming three is the dashboard a\n  register is not; a list of number-field aliases for what they add up to, and a\n  `percentage` named there is refused, since a share summed over the rows in\n  view is a figure of no kind (draw it as a column, whose own total reads the\n  mean). A figure written `{"field": \u2026, "at": "end"}` is a STOCK instead: the\n  reading standing at the END of the window rather than the sum of the readings\n  in it, which is the only way opening + in \u2212 out = closing reconciles \u2014 a month\n  of daily closing stocks added together is thirty warehouses. The band labels it\n  as the snapshot it is, and it is refused on a screen that states no `period`,\n  since there is then no window for it to stand at the end of.\n  `ageing` stands in that same\n  band: an `amount` split by how many days past its `due` date each row is,\n  drawn as a `Breakdown` of the edges in `buckets` (30, 60 and 90 days unless the\n  model states its own, ascending). The ladder is the kit\'s \u2014 its boundary, its\n  words and its ramp \u2014 and it opens with what is NOT YET DUE, because a bar of\n  overdue bands alone is full at every input: a book with one late invoice and a\n  book that has gone entirely bad would paint the same solid width. Against the\n  current money the bar\'s own shape is the reading. A row whose date is empty is\n  in no band. `totals` is what the whole\n  view adds up, and it is drawn in that SAME band above the rows: a register\n  states one aggregate, over the rows the reader can see, in one place, and a\n  closing line under them is a second place to look and a second question about\n  which rows it covers. A closing line belongs to the one device that IS a\n  statement \u2014 a record\'s `Ledger`, whose balance is what it is read for, labelled\n  by its amount\'s own word. Where a shape has no band above (a trend, whose own\n  band is the chart) the figure stands under the register instead. A\n  `transaction_ledger` sums its amount column itself and takes `above` alone. An\n  `obligation_desk`\'s rows are DEADLINES and not records, so its band states\n  `"counts"` \u2014 how many are open \u2014 and a figure list, an `ageing` or a `trend`\n  over it is\n  refused: a l\xF4 with three cut-offs is three rows, and its freight added over\n  them is three times the freight.\n  `trend` is `{"field": \u2026, "direction": "up"|"down"}` and states WHICH WAY that\n  figure moved across the window: the rows in view are cut into the window\'s own\n  buckets \u2014 days over a month, weeks over half a year, months beyond \u2014 and the\n  later half of the CLOSED ones is read against the earlier half, drawn beside\n  the figures as one line, so a window the reader is still inside states the\n  movement of the days that have run rather than a fall into the ones that have\n  not. `direction` is which way is GOOD, which nothing about the number\n  says: a book wants its takings rising and a backlog wants its days falling, and\n  the same arrow is a win on one and an alarm on the other. It needs a `period`\n  to be a window of, and it is refused on a shape that draws its own (a\n  `trend_deep_dive` already draws the series) or that reads none at all (a\n  `live_board` answers what is true now). A window whose earlier half took\n  nothing draws no line: there is no base for a percentage, and 0 % would claim a\n  steadiness nobody measured.\n- **`facts`** \u2014 how the RECORD\'s facts are banded. `groups` is a list of\n  `{caption, fields}`: what a set of facts has in common is a sentence about the\n  business and nothing derives it, so a plan that states one gets exactly those\n  bands, in its own order, captioned. EACH BAND IS A SECTION of the record \u2014 its\n  own heading, its own entry in the rail, its own place in the column: under one\n  heading the reader is handed every particular at once, in a caption weight that\n  cannot out-rank the heading above it, with nothing in the rail to reach any of\n  them by. Everything the plan leaves unnamed is the LAST section and carries no\n  heading, since there is no sentence to head "whatever no group claimed" with \u2014\n  ONE section, even where the record\'s own recipe bands what was left in two (an\n  evidence record reads its particulars before the record and the party it was\n  with): both are groups inside it, because the word the kit heads "the rest"\n  with cannot name two entries in the rail.\n  A band of more than eight facts is NOTED: a section that long is two. A field the header, the band, the ladder, a required\n  set, the files or a register below already draws is refused: it is not a fact,\n  so a band naming it would either state it twice or draw nothing. Naming any\n  band IS the answer to which facts fold \u2014 see the TIERS below.\n- **`presentation`** \u2014 how the screen and the record it opens are DRAWN, where\n  what the rows are is not the answer wanted. `lead` is what each row leads\n  with: `"mark"` the subject\'s own mark, always spent because a party\'s initials\n  stand in for a picture nobody uploaded; `"picture"` the photograph, spent only\n  on the rows that carry one and, on the record, at media scale above the name;\n  `"paper"` the row\'s own files, drawn as the cards a pile of documents is read\n  as; `"figure"` the amount, with no gutter at all; `"none"` neither. `density` is\n  how many lines a row\'s subject may take \u2014 `"roomy"` two, `"dense"` one.\n  Both default, and the DEFAULT is what the rows are: a party register leads\n  with the mark, an offering register with the picture, a ledger with its\n  figure, and a desk \u2014 rows that are work still to do, scanned \u2014 stands its rows\n  one line each while a record\'s own rows are read roomy. So state it only to\n  differ, and a plan that states nothing still gets screens that vary. A lead\n  the rows cannot carry is refused: a mark, a picture or a paper where no column\n  is drawn as the rows\' mark, a\n  figure where no column is the amount, and the other subject\'s mark (which of\n  the two a row wears is the shape\'s, so the register and the record it opens\n  cannot call one row two kinds of thing).\n  `layout` is how the rows are ARRANGED \u2014 `"table"`, `"list"`, `"cards"`,\n  `"gallery"`, `"board"`, `"calendar"`, `"timeline"`, `"gantt"` \u2014 and it is\n  AFFORDED by what the rows carry, not by the shape: every register affords a\n  table and a list, a `mark` affords the two picture-led grids, a `lifecycle`\n  affords a board, a `when` affords a calendar and a timeline, and a `when`\n  beside a `measure` that `counts` DAYS affords a gantt, because a bar with no\n  length is a calendar drawn sideways and a bar measured in money or litres is a\n  length of another kind. `until` names the date field a bar ENDS on, where the\n  rows state one, and the days measure is what the bar runs for without it. A\n  layout the bound roles do not afford is refused, naming the ones they do.\n- **`acts`** \u2014 where this screen hands work on: `row` is the \u22EF menu on every row,\n  `record` is the \u22EF on the RECORD\'s own page header \u2014 the same reach as a row\'s,\n  standing where the work is open instead of while a list is scanned, and refused\n  on a record that opens as a drawer, which has no header of its own and whose\n  row already carries the register\'s menu \u2014 and `selection` is the bar over the\n  TICKED rows. `export` is the third reach \u2014\n  the WHOLE VIEW, saved in one press: `true` writes the rows as the register drew\n  them, in the columns it drew, as an `.xlsx`, and\n  `{"template": "\u2026"}` says the layout is the trade\'s and makes the paper with a\n  workflow like any other. It is never a list of columns: which columns the\n  export carries is what the screen already draws, and a second statement of it\n  disagrees the moment a slot moves \u2014 the generator reads them off the drawn\n  slots and writes them into the app, so the sheet\'s headings are the labels the\n  register drew them under.\n  `import` is the reach OPPOSITE it \u2014 a file turned into rows:\n  `{"kind": "import", "label": \u2026, "entity": \u2026, "key": \u2026, "columns": [...]}`. The\n  file is mapped column by column, each row is validated, what would change is\n  previewed, and the commit UPSERTS by `key` \u2014 which is why a sheet sent twice\n  moves no counts. That key is one of the entity\'s own `natural_key` fields\n  (\xA7 Write rules), and an entity declaring none is refused: without a key the\n  second run is a second set of the same rows. `entity` is the register\'s own \u2014\n  an app is one register, and rows filed into another entity are a count nobody\n  on this screen can check. `columns` is what the sheet may fill, in that order;\n  absent, it is every column a person states IN WORDS. A computed one is refused\n  because the workspace writes it, and a link, a member or a files column is\n  refused because a cell of a sheet is words and those hold a row of another\n  table or bytes \u2014 a file reaches another table through the party pattern (a\n  `natural_key` on the target, named rather than picked), which is a create\'s.\n  The generator writes the whole verb, as it does for a paper: an\n  `import_<entity>` workflow that finds the row by `key` and then changes it or\n  opens it, answering which of the two, and the staged run over it \u2014 drop, map,\n  the per-row verdict, the commit. A line whose cell the column cannot hold is\n  refused with the reason and the rest of the sheet still lands. A file MINTS\n  rows of the register, which is the Add many times over, so a screen stating\n  `writes: false` or `"children"` \u2014 which opens no row of its own \u2014 refuses the\n  clause; the `export` beside it stays, because it only reads.\n  Both spreadsheet reaches are read and written IN THE BROWSER, so the generated\n  `src/main.tsx` imports `@lotics/app-runtime/sheets` wherever the plan states\n  one of them and not otherwise; an app that has neither carries no spreadsheet\n  engine at all. An act names ONE of three things, never two:\n  - **`template`** \u2014 an `html` template this model declares (\xA7 Templates). The\n    paper is filled from ONE row in `row`, and from the whole ticked set in\n    `selection`. The generator writes the whole verb \u2014 a `generate_<template>`\n    workflow that reads the row and hands the file back, and a menu item that\n    opens it \u2014 so there is nothing left to bind. An `email` template is sent\n    rather than opened and is refused here; a file-backed template (`excel`,\n    `word`, `pdf-form`) is bytes a model has none of, so those stay the author\'s\n    own `lotics app workflow set`. Two screens over DIFFERENT entities cannot\n    name one template: one paper is filled from one kind of row.\n  - **`{"kind": "agent", \u2026}`** \u2014 a run over ONE row. `agent` is an alias the APP\n    declares (`package.json#lotics.agents`), because an agent is prose and tools\n    rather than anything a workspace model can state \u2014 `lotics app check` refuses\n    one nothing declares, exactly as it refuses a workflow nothing bound. `fills`\n    is the fields the run may write: pressed, the reader watches the run, reviews\n    what it proposes field by field against what the row holds now, and applies\n    the ones they kept as ONE write through the record\'s own update. A run can\n    reach nothing outside `fills`, a computed column there is refused (the\n    workspace writes those), and a screen stating `writes: false` refuses an\n    agent act outright. It belongs in `row`; the selection bar makes ONE paper\n    from many rows, and a run per ticked row is the row\'s own act many times.\n  - **`{"kind": "workflow", "workflow": "\u2026", "inputs": {\u2026}}`** \u2014 the work HANDED\n    ON: a lead becomes an opportunity, an order is split into the orders placed\n    on its suppliers, a request is closed. `workflow` is an alias the APP binds\n    (`package.json#lotics.workflows`), because the rule behind it is the\n    business\'s and no model states one \u2014 so the generator writes NO body and\n    `lotics app check` refuses an alias nothing bound, exactly as it refuses an\n    agent nothing declares. `inputs` is what the press hands that body: the\n    workflow\'s own input name \u2192 `"record"` for the row it was pressed on, or a\n    field of this entity for a value off that row. The value is what the\n    workspace HOLDS \u2014 an option\'s key, a linked row\'s id, the figure \u2014 never the\n    rendering. A files column is refused (the body reads the row\'s files off the\n    row it is handed), a column that is not a field of the entity is refused by\n    name, and one input short of the declaration is refused at the press, so the\n    whole act is dropped rather than shipped half-bound. It runs ON the press:\n    there is nothing to review first, which is the agent arm\'s law, and the\n    body\'s own sentence is what the reader is told either way. It stands in\n    `row`, in `record` and on a `section_acts` band \u2014 each reaches ONE row \u2014 and\n    is refused over the ticked set, where one act makes one paper from many. The\n    row it reaches is the RECORD\'s, so a screen stating `writes: false` or\n    `"children"` refuses a hand-off on every one of those surfaces, exactly as it\n    refuses an agent act.\n\n  **`"when"` stands an act down until the work is ready.** `{ "field": "<the\n  entity\'s lifecycle>", "in": ["<stage>", \u2026] }` offers the verb only while the\n  row stands at one of those stages. A verb that cannot work yet is worse than\n  no verb: the reader presses it, the body refuses, and nothing on the screen\n  ever said the work was not ready. Readiness is what a lifecycle states, so the\n  field named is this entity\'s `lifecycle` and nothing else \u2014 a category says\n  what a row is and a verdict answers a question, and neither moves. Refused: a\n  field that is not the lifecycle, a stage it does not declare, and every stage\n  at once, which is the act with no condition.\n\n  **`"place": "cta"` draws an act ON the row** instead of in its \u22EF \u2014 the one verb\n  a reader presses without opening a menu first. At most one per screen and every\n  other act stays in the menu, because the trailing gutter is paid for by every\n  row: a second is refused with *one verb on the row, the rest in its menu*. The\n  ticked set has no row of its own, so `cta` is refused there.\n\n  **`"confirm": true` asks before the act runs**, with the act\'s own label as the\n  commit word \u2014 for a press that cannot be taken back: something goes public,\n  something leaves the building, a figure is filed with somebody else. Everything\n  else runs on the press, because a dialog in front of a reversible act is one\n  readers learn to dismiss, and then dismiss in front of the one that mattered.\n  It reads the same wherever the verb stands \u2014 a row\'s \u22EF, a row\'s own button, a\n  record\'s menu, a section\'s band \u2014 and `scaffold check` prints it as\n  `[asks first]`.\n\n  A hand-off\'s BODY is still the author\'s: `lotics app workflow set <alias>`\n  binds it, and `scaffold check` prints the act as `"<label>" \u2192 <alias>(\u2026) [you\n  write the body]` so it is read as work owed rather than as a verb already\n  wired.\n\n  A `selection` act is a `template` and nothing else: an act over many rows makes\n  ONE paper from them. The generator turns the register\'s checkbox gutter\n  on, emits a `generate_<template>` workflow taking the ticked ids, and the body\n  reads each row and passes them as `rows` \u2014 which is what the template iterates\n  (`{{#each rows}}`). One template is one paper AND one reach: naming the same\n  one from a row\'s \u22EF and from the bar is refused, because those are two bodies.\n  A shape whose rows are DERIVED rather than records \u2014 an `obligation_desk` \u2014\n  has no set to tick and refuses the clause. The paper is handed BACK, never\n  filed: a ticked set can hold rows of three different parents, so there is no\n  record on which "this document belongs here" is true.\n\n**`section_acts` puts a verb WHERE ITS EFFECT LANDS.** "Chase the paperwork"\nbelongs on the papers, not in the register\'s \u22EF two surfaces away. It is keyed by\nthe alias each section is DERIVED from \u2014 a field\'s (its progress, its prose, its\nrequired set, its charge, one of its files) or a CHILD ENTITY\'s (its register,\nits desk, its run, its thread) \u2014 because the sections come off the roles and the\nkey the app addresses one by does not exist until it is built. An alias naming no\nsection is refused, listing the ones that do; the facts band is what every other\nsection left over, so nothing addresses it. Each act is a `template`, an `agent`\nor a `workflow`, exactly as a row\'s is \u2014 the reach is the same one row \u2014 and\n`place: "cta"` is refused: a section is a band with a heading and has no row to\ndraw a verb on. `scaffold check` prints\nwhich section each alias landed on, which is the half an author cannot see in\ntheir own file.\n\n**`sections` says HOW one of those sections is DRAWN**, keyed by the CHILD\nENTITY\'s alias \u2014 every one of its readings is over a child\'s ROWS, so a field\'s\nalias names no section this clause can draw and is refused. It carries four\nreadings, and a clause here OUTRANKS the table above:\nthe derivations there recognise a shape off columns that are also ordinary\ncolumns, so a markdown field holding a refusal reads as somebody\'s message. Where\nthis clause names the reading, it is the reading.\n\n`"draw": "ledger"` heads a book of movements with what the record it is against\nis read against: `summary`, number or DATE fields of THIS record, in the order\nthey read \u2014 what is owed, and by when. Each is drawn as the record\'s own band\ndraws it: a measure with a bound is a meter, a date is a countdown, every other\nfigure is an amount. A date the record works TO is the default; a date a right\nRUNS OUT at \u2014 a free cancellation, a quote\'s validity \u2014 is written\n`{ "field": "refund_until", "sense": "expires" }` and reads closed rather than\nlate once it has passed. A\nsection with nothing in it is otherwise a heading, a verb and a void \u2014 and the\nemptiness is exactly when the reader most needs to be told what the rows would\nbe for, so the statement is drawn at nought rows too. The figures are the\nRECORD\'s rather than the child\'s for the same reason: a sum of the rows under it\nis the one statement a book with no rows cannot make.\n\n`"draw": "worksheet"`: the child\'s rows\nare PRICED LINES the reader works down in place, each part of the job footed and\nthe sheet closing under them. `cost` and `sell` name the child\'s two figures,\nwhich is the one thing the roles cannot decide \u2014 an entity carries one `amount`,\nand a line that is costed and sold carries two. Everything else is read off the\nchild\'s own roles: what a line is FOR is its `identity`, how many it is for is\nthe `measure` the pair left, and the part it falls under is its `category`. The\nMARGIN is on none of them, because it is arithmetic over the pair.\n\n`"draw": "itinerary"` says WHICH FOUR STATEMENTS each stop of a run is read by:\n`line`, in the order they read, from `when`, `kind`, `provider`, `stage`,\n`duration`, `caption` and `reference`. A stop is one press and its supporting\nline holds to one row at every width, so four is the whole of it \u2014 a fifth is a\nfact the stop\'s own drawer answers. Absent, a stop is read by `when`, `kind`,\n`provider`, `stage`, which is how a travel row reads; a roster is read by its\nhours and a courier\'s run by who is at the door, and nothing derives which:\n\n```jsonc\n// A cleaning round: the hour it takes and the flat it is at say more than the kind.\n"sections": { "visit": { "draw": "itinerary", "line": ["when", "duration", "provider", "stage"] } }\n```\n\nEvery run named is one the stops already carry \u2014 `duration` is the child\'s\n`measure` that `counts` hours, `caption` the second `party` a row names, `kind`\nits `category` \u2014 so a word the child declares no role for is refused rather than\ndrawn as a gap in every line, and so is the same word twice.\n\nA sheet is the WRITE side of a price, so it is the one child section whose cells\nare editors: a figure typed into a cell is written as a diff through the child\'s\nown update, which is the same editor the line\'s own drawer saves through. Every\nother child section is read where it is drawn and edited in the row\'s drawer. A\nline is ADDED from the section\'s heading as every child\'s row is, with the record\nit hangs under as the act\'s own context.\n\n`"draw": "publish"`: the child\'s rows are ONE RECORD STANDING ON N\nDESTINATIONS, and the section is drawn as the strip of those destinations rather\nthan as a register of the rows. A register of them is the same record listed once\nper destination with a stage beside it; what a reader wants is every destination\nthey COULD reach, each wearing what has happened there, and the one press that\nsends the ones that are ready.\n\n```jsonc\n"sections": { "pinning": {\n  "draw": "publish",\n  // The child\'s own lifecycle, all four \u2014 each is a different thing the chip\n  // says, and `queued` is the stage its flow OPENS at (a destination is queued\n  // by opening a row).\n  "states": { "queued": "waiting", "published": "up", "failed": "refused", "by_hand": "by_hand" },\n  "text": "wording",        // optional \u2014 a text on the child, what THIS destination goes out with\n  "permalink": "address",   // optional \u2014 a link-formatted text on the child, where it landed\n  "error": "fault",         // optional \u2014 a text on the child holding the platform\'s own refusal\n  "link": "source",         // optional \u2014 a link-formatted text of THIS record, the card it carries.\n                            // A network that takes a card OR a picture takes neither twice, so a plan\n                            // whose records always carry both leaves the desk nothing it can send there\n  "destination": {\n    // The destination\'s own select, and which of its options the platform can\n    // reach as which network\'s feed. An option this map leaves out is by hand.\n    "network": { "field": "surface", "options": { "page": "facebook", "feed": "instagram" } },\n    "connected": "account", // optional \u2014 a text on the destination; empty means not connected\n    // Which of THIS record\'s bodies each destination receives \u2014 the destination\'s\n    // own select, mapping ITS options to text fields here. One alias\n    // (`"bodies": "wording"`) is the model with a single body.\n    "bodies": { "field": "tongue", "options": { "near": "wording_near", "far": "wording_far" } },\n    "offered": { "field": "standing", "in": ["open"] }  // optional \u2014 which rows the strip offers; absent, every row\n  },\n  "publish": "send_pinnings" // the workflow alias the APP binds \u2014 the generator writes no body\n} }\n```\n\nEverything else is read off the roles: the child\'s `parent` (the record), its\n`party` (the destination entity), its `lifecycle` and its `when`; the\ndestination\'s `identity`, `mark`, `contact` (where a post put up by hand is\npasted) and `category` (what the strip folds the chips under); and this record\'s\nown `mark` (the pile the post carries). The destinations are read WHOLE, through\na query of their own, because the strip\'s point is the ones this record has not\ngone to yet \u2014 which the child\'s own read structurally cannot answer with. The\nREGISTER\'s row wears one mark per destination its record has reached, read one\npage of rows at a time; the face and the network each mark wears are read across\nthe `party` link by that read itself, so the model declares no lookup for them.\n\nA network the INSTANCE is not configured for is refused when the send\'s body is\nbound (`tool_capability_unavailable`): a check over a file cannot know which\nproviders this instance holds keys for, so the map is proven against the kit\'s\nnetworks alone and the rest is answered where the body is.\n\nA chip IS the draft, which is why the section mounts no Add: pressing an empty\ndestination opens a row, pressing a queued one takes it back, and both are\nworkflows the generator writes and binds. The create takes the RECORD and the\nDESTINATION and nothing else \u2014 every other column of one of these rows is what\nthe send writes back \u2014 and it reads the desk first, refusing a destination this\nrecord already stands on: a surface guards a second press for the life of a\nmount, and a second tab is a second mount. The withdrawal is the ONE generated\nbody that deletes, and it reads the stage first and refuses anything past the\nqueue. A delete names no column, so `app create` declares the child\'s TABLE in\n`package.json#lotics.deletes` beside the columns in `lotics.writes`, and `lotics\napp check` refuses a body that deletes from a table nothing there names. The SEND\nis the author\'s, like every other hand-off: `lotics app check`\nrefuses an alias nothing bound, and the press hands it the record and the rows it\nis sending.\n\nRefused: an alias naming no register of this record, rows the record does not\nOWN (a line added to a history belongs to the job it is about, not to what is\nreading it), a figure that is not a field of the child or whose role is neither\n`amount` nor `measure`, a sheet naming neither figure, one figure priced as both,\na book headed by anything but a number or date field of the record, and a line on\na section this record draws as a register rather than as a run. A desk is refused\nfor rows that name no destination or carry no lifecycle, a state naming an option\nthat lifecycle has not got, a `queued` stage that is not the one the flow opens\nat, a destination that names no row of itself, a network the kit cannot preview,\nan option of the destination\'s own selects it has not got, and a body, an\noverride, a permalink, a refusal, a card address or a connected account that is\nnot a text field of the entity it is named on. A SECOND desk on one record is\nrefused too: the strip is every destination that record can reach, so two are two\nanswers to one question, and a row of the register wears the marks of one.\n\n**A CHILD NOBODY REGISTERS IS A NOTE, not a refusal.** Where a record lists a\nchild entity no app is a register of, `scaffold check` says `"<entity>" has no\nregister \u2014 its rows are read here and created nowhere` and the plan printout\nmarks that entity `(no app)`. Rows can arrive from an import or a workflow, so\nit is a reading rather than a rule; what it catches is the register somebody\nmeant to plan and did not. A section the record ADDS to is exempt, because its\nheading is where those rows are typed: the rows a record owns on a PAGE, a\nthread on any door \u2014 a reply is written where it is read \u2014 and a sheet, which\nopens its own lines. A record opening in a DRAWER adds none of them, so its\nowned rows are noted like anybody else\'s.\n\n`scaffold check` prints every clause a screen states, on its own line under the\nslots, spelling the screen\'s `writes` clause `operable` \u2014 the app manifest\'s\n`lotics.writes` keeps that word, and the two are different facts: `app create`\nSEEDS the manifest from the fields the screens\' own editors write, and from then\non the app owns the declaration `lotics app check` holds its bodies to.\n\nEach shape is a `@lotics/ui` component of the same name (`LifecycleDesk`,\n`PartyRegister`, \u2026) whose props are these slots, so once the tables exist\n`lotics app create <name> --from <this file>#<app alias>` scaffolds the app with\none screen per entry, each slot reading the field the plan bound.\n\n`"shape": "custom"` is the screen no registry row covers: it declares its own\n`roles` (slot name \u2192 role), and it is emitted on `ShapeFrame` \u2014 the one anatomy\nthe six shapes above are each a configuration of \u2014 so its strip, search,\nordinal, fit budget, empty and waiting states and record door are the same ones\nthey have. It opens the record its `record` says, drawer or page, like any other.\nA bound `lifecycle` slot IS its strip, the stages in the field\'s order as on a\ndesk, so such a screen names no `tabs`. Only a lifecycle earns a strip \u2014 each\ntab a queue of work at one stage \u2014 and a screen naming any other select as\n`tabs` is refused: a kind, a book, a channel is a `filters` entry beside the\nsearch. The three shapes whose strip means something of their own take any\nselect: a reconciliation\'s dated runs, a trend\'s series, a worksheet\'s versions.\n\n**An app IS its `app.json`.** `create --from` writes the bound plan \u2014 every\nscreen with its shape and slots, the record each row opens with its sections in\nthe archetype\'s order, the create panels, the acts \u2014 as one JSON document, plus\na five-line `src/main.tsx` that mounts `@lotics/app-runtime` over it and one\n`src/workflows/<alias>.ts` per write. There is no screen source: the runtime\ndraws the spec, so a kit correction reaches every app with its next install.\nWhere the plan has no word for what a screen or a section IS \u2014 or for what a\npaper act should ASK before it is made \u2014 the spec names one of the app\'s own\ncomponents and `src/components/index.ts` registers it, the one file under `src/`\na regeneration never rewrites. `lotics app eject <screen|<section key>|<act\nlabel>>` writes each of those, starting from what the runtime already drew.\n\n**How a spec reads a row.** Each query projects its columns under the alias the\nworkspace mints from the field\'s LABEL \u2014 never the alias this file keys it\nunder, which is the model\'s own namespace and which the workspace never saw. So\na field this file calls `partner` and labels `\u0110\u1ED1i t\xE1c` is referenced as\n`doi_tac` throughout the spec. Every id in it is live: the `tbl_` a screen is\nover, the `fld_` of each column, and the `opt_` of every option a role names.\n\n**Every query is described, in the model\'s own language.** The line an agent\nchooses between aliases by is written from this file\'s nouns \u2014 the entity\'s\nlabel, the screen\'s, the link\'s \u2014 and the sentence around them is the language\nthe file is mostly written in, decided the same way a generated write\'s refusals\nare. Hand-editing one is erased by the next regeneration; `lotics app check`\nrefuses an alias that carries none.\n\nA screen is that list and the RECORD it opens, and the record comes off the same\nroles \u2014 nothing to declare for it. It opens with a **header**: the entity\'s\n`identity` as the record\'s name \u2014 whether or not the list has a column for it, so\na ledger\'s and a trend\'s records are named too \u2014 the `mark` beside it on a PAGE,\nwhich is what the subject is recognised by (so the pile below is the papers that\nare left, and a `presentation.lead` spending that gutter on something else leaves\nthe picture in the pile), the `when` this screen reads\nunder it, and ONE headline\nfigure (the `amount` the screen reads, else its `measure`). BOTH DOORS state the\nname: which door a screen uses is a layout answer, and what the record is ABOUT\nis not.\n\n**A JOB\'S HEADER ALSO STATES WHO IT IS FOR.** Where the record is the work itself\n\u2014 a desk\'s rows that belong to nothing, opened on a page \u2014 its `party` is a link\nunder the name, beside the ways to reach the subject, or, where that party is a\nworkspace MEMBER, the person themselves with no door behind them, and it is then\nnot a fact\nas well: a page headed by a code alone said nothing about whose work it is, and\nthe one thing a reader arriving from the desk already knows the row by sat in the\ngrid below as a row among forty. A record opening in a DRAWER has no row of links\nto hang it on, so its party stays a fact; so does a LINE\'s, whose register files\nit under the thing it belongs to and whose party is that parent\'s, restated per\nrow.\n\n**A record whose figures are a SENTENCE states them under the header, in a\nband**, and the header then states neither of them: a job reads what it comes to,\nhow far through it is (the `measure` against its limit), what is left of it (a\nformula that is exactly `{amount} - {measure}`) and how long there is (an\n`obligation`, else its `when`, counted down); a party reads its settlement, the\n`amount` and `measure` roles it carries in the order the model declares them; a\ncatalogue item reads its `amount` against the reference that amount names. Two\nfigures are the floor and four the ceiling \u2014 under two, the header keeps its one.\nA band is a PAGE\'s strip, so a screen whose `record` is a drawer keeps every\nfigure where a drawer reads them. Each figure is drawn exactly once: the limit a\nmeter states is not a fact beside it, and the day a countdown counts to is not\nthe provenance line above it. The band draws them, so the band is where they are\nCHANGED \u2014 a date a person states is edited on the countdown and a limit a person\nstates on the meter, while the level between them is read. The `lifecycle` is\nnot badged there, because the progress section is the rung it stands on. Then\nits sections, in the order its KIND reads them: the\n**facts** (every field neither the header, the band nor another section owns, the\nrow\'s own `parent` among them \u2014 led by the ones THIS screen\'s slots bound, then\nthe key it is filed under, then the order the model declares them in \u2014 a\n`markdown` field among them, drawn across the grid\'s whole row rather than\nwrapped to a third of it), the record\'s own **body** (that same markdown, taken\nas a section instead, ONLY where the kind leads with it: a catalogue item IS its\ndescription, and a job is not its notes), the **charge** (where the `amount` is a formula over exactly one\nquantity and one money field, the line states `quantity \xD7 unit price = amount`\nand neither figure is typed twice \u2014 the section is headed by the amount\'s own\nlabel and the closing row says what the figure IS, so the word is said once),\nthe **progress** (the `lifecycle`\'s stages as a ladder the reader ticks a rung of\nto move the record on, grouped into its `phases` where the model states them, and\neach rung carrying the day it was reached where the lifecycle keeps a\n`history`), a\n**required set** (a multi-select `expected_set`, or a child entity whose rows\ncarry one entry of it each \u2014 that child\'s `files` field is what a paper attaches\nto), the record\'s **own rows** (any other child, its role-bound fields as\ncolumns), and its **files** (every `files` field the header does not lead with,\nthe `mark` first where it keeps one \u2014 a section of\nthe column like any other, straight after the facts it is the evidence for,\nexcept on an EVIDENCE record, which OPENS on the paper it exists for; the\nheading carries the Add verb, and stands it down while the pile is empty, where\nthe drop well is already the door; and a `verdict` whose FORMULA reads one of\nthose files fields is the pile\'s OWN state rather than a fact row \u2014 the file it\nis short, drawn as a ghost, and the mark the rail sends a reader to). A child is\nan entity that LINKS here, ONE SECTION PER LINK: the rows it owns (`parent`), the\nrows NAMED by it (their `party` or their `identity` \u2014 so this record\'s history),\nand the rows reaching it through a link carrying neither role, headed by that\nlink\'s own label. A child hanging off two records therefore declares one `parent` and\nleaves the second relationship a plain link, which still gets its section.\n\n**THE ROWS A RECORD OWNS ARE ADDED AND OPENED FROM THEIR SECTION.** A `parent`\nsection\'s heading carries the Add for its rows, handing the record as the\nparent \u2014 filled, never asked. Every row opens its own record \u2014 a line of a book,\na paper on a desk, a stop on a timeline alike: where this app already routes a\npage for those rows (the register\'s own, under one of them) it is navigated to;\notherwise it is a DRAWER mounted on the record it belongs to, stepped \u25C0 \u25B6 over\nthe section\'s rows as they are drawn, with the row\'s framed editors, its ladder\nand its files, saving through `update_<child>` \u2014 the one editor those rows have,\nwhich any control the section draws over a row writes through too. Never the\n`parent` link itself: it is the key the row is FILED under, stated by the record\nthe drawer was opened from, so it is neither a fact of the drawer nor an input\nof that editor. ONE LEVEL, and only from a PAGE: a child\'s own children draw as\nthe kit\'s panel of the row, with no drawer and no Add, and a register whose own\nrecord is a DRAWER is the same for the children it owns \u2014 a drawer mounts no\ndrawer. **A ROW IS ADDED WHERE IT CAN BE OPENED AGAIN**, so those sections lose\ntheir Add with their drawer; a row of the register\'s OWN kind keeps it, because\nthe register\'s list opens it. A correspondence\'s entries are the one owned row\nthat opens nothing anywhere: the composer under them is the section\'s Add\nwhatever door the record has, and the answer mark is one field of the reply\'s\nown editor. The rows a record is merely NAMED by, and those reaching it\nthrough a roleless link, are read only \u2014 a history, never a place to open or\nadd.\n\n**TWO CHILDREN ARE READ AS A RUN RATHER THAN AS A REGISTER**, and the model says\nwhich by the roles it declares on them. A child carrying an `obligation` whose\n`satisfied_by` is a DATE \u2014 and no `lifecycle`, because an entity with stages of\nits own is a JOB being worked and its rows under another record are that record\'s\nlines or its history \u2014 is a **timeline**: its rows are the ordered stops, each\nstating the day it was promised for and the day it happened, with the delta named\nwhere the rung was late \u2014 drawn as a register those are two date columns and the\nreader subtracts them by eye, which is exactly what "three days late at\ndischarge" costs to learn. An obligation closed by a FILE says nothing about\nwhen, so those rows stay the register they were. A child carrying a `markdown`\ntext field beside a `party` and a `when` \u2014 and naming no member of this\nworkspace, which would make it a log \u2014 is a **thread**: the entry is the body,\nthe author and the day lead it, and a `verdict` on the child is the yes/no one\nreply is marked the ANSWER with \u2014 a register of messages is a table whose one\nuseful column is the one it cannot draw. A SECOND `party` on those rows is who\nthe entry was left WITH, and the latest one names the ball in court: while\nnothing answers, the record says whose move it is and counts its own deadline\n(an `obligation`, else its `when`) against them. Both are read only under the\nrecord that OWNS the messages \u2014 under the party who wrote them the same rows are\nthat party\'s history, several questions at once, and the last of them says\nnothing about any. That record also REPLIES: the section\'s Add is a composer \u2014\nthe message is all a reply asks \u2014 and the answer mark is one field of the\nreply\'s own editor.\n\n**A body and a day, under a record that OWNS the rows, is a LOG** \u2014 what was\ndone, when, and the entry in the words somebody wrote. WHO WRITES THE ENTRY\nDECIDES WHICH IT IS: a `select_member` on the child makes it a log whatever else\nit names, because a member of this workspace keeps a log and a party writes a\nmessage. So a `party` on a log entry is who it was WITH, drawn on that entry\'s\nown line beside the `contact` it reached them at and the files that came with\nit \u2014 never its author, and never a move outstanding. The other selects on the\nrow are facts ABOUT the entry. A NAMED row is a log entry, not a message: a\nvisit or an inspection is a thing in its own right, which is what keeps it out\nof the thread. Its Add is a composer too, taking the entry, the day (opening on\ntoday) and the entry\'s own selects; the record it hangs under is not asked.\n\n**A PROFILE LEADS WITH ITS LADDER.** An account walks stages like any other work,\nso a profile carrying a `lifecycle` reads `progress` first \u2014 right under the\nband, the same place a job leads with the act that moves it \u2014 and its histories\nfollow. Under them the ladder was seven bands down a page nobody scrolls that\nfar.\n\n**NOTHING SITS BESIDE THE RECORD.** A page is ONE reading column \u2014 its fields,\nits files, the rows it owns, its notes, all sections of it in the archetype\'s\norder \u2014 over a reserved left gutter holding a floating NAVIGATION RAIL: the way\nback, then one line per section with that section\'s category mark, and nothing\nelse. No files, no counts, no group headings. Too narrow to seat the rail, it is\none pinned bar of the same list across the top. A section HEADING never wears\nthe mark; the rail\'s line for it does.\n\n**A RELATION THE RECORD NEVER ACTS ON CLOSES THE COLUMN.** Every register that\nmerely NAMES the record is one counted line of a single last section: its label,\nhow many rows name this record (a COUNT, never a page of rows measured), and a\npress that opens the register owning them narrowed to this record. An entity\nthis app lists nowhere is a count with no door, and where every count is zero\nthe section is not drawn at all. The one exception is a PROFILE, whose history\nIS its body and stands open in the column.\n\n**Rows the record owns whose `amount` is `signed_by` a direction are a\nBOOK**, drawn as a statement \u2014 each line dated and signed, the balance under\nthem where there is more than one line to add up, labelled by the amount\'s own\nword \u2014 where the same rows on the party they\nwere transacted with stay that party\'s history, which is scanned for the line\nshort of its paperwork rather than struck to a balance. **Rows that carry a\n`when` read as RUNS**: a party\'s history under the year \u2014 and only where the rows\nin hand span more than one, since a subhead over every line of a book names the\nyear and separates nothing \u2014 and a job\'s own rows under the day they fall on,\nwhich, where those rows also carry a `lifecycle`, is an ITINERARY rather than a\ngrouped table: the day heads the run, each row is one line (its `slot`, its name,\nits party, its stage, its `category` and `reference`, its amount), the figures end\non one edge and the run closes with their sum \u2014 unless the record\'s own BAND is a\nsum rollup over exactly these rows, which states it once already. A `category`\npaints the node the run is read down, in the option\'s own colour; a `reference`\ncloses the line with the code somebody quotes on the phone. **A `mark` LEADS the\nline with the stop\'s own picture** \u2014 a venue, a vehicle, a machine \u2014 and it is the one\nplace on a record where a child entity\'s mark is drawn at all, since no register\ncolumn is ever a picture; a line whose subject holds none is marked with its\n`category`\'s glyph instead, so the run keeps one left edge. All three are\nPROJECTED for the run whether or not the register\'s column budget would have\ndrawn them, and a mark is projected NOWHERE ELSE.\nA line\'s mark is most often the SUBJECT\'s rather than the line\'s own \u2014 the\nservice, the product, the asset it is a line of \u2014 which is a `lookup` through\nthat link onto the subject\'s own `files`, given the role on the line.\n**EACH DAY\'S HEAD CARRIES THE SECTION\'S OWN ADD** as well, handing the panel that\nday, so a line made from Tuesday opens with Tuesday answered; the heading keeps\nthe verb too, for the first line and for a day nothing is planned on yet. **THE\nKEY LEAVES THE COLUMNS where the head states the whole of it** \u2014 a day head does,\na year head states four digits of the date and the day is what the column is\nstill there to carry.\n**A run is READ FROM THE END THE READER WANTS**: a job\'s own rows and an itinerary\nascending, a book, a history and a log descending.\n**A REGISTER WHOSE `when` IS A DEADLINE IS READ FROM THE NEAR END** whatever its\nshape does \u2014 `due` (or an `until` that says where the countdown stops) makes the\ndate a promise, so the rows in breach of it lead and a row nobody dated falls\nlast. A plain `when` keeps the shape\'s own end. `scaffold check` prints the\npromise (`order: Theo d\xF5i ti\u1EBFp, overdue first`).\n\n**A DESK OVER AN ENTITY THAT CARRIES A `slot` IS ITSELF A DAY\'S RUN.** Its own\nregister is drawn under one subhead per day, sorted by that day and then by the\npart of it, and the date column goes \u2014 the subhead states it once for the whole\nrun, and a column repeating it down every line is the same value twice. Without\nit an itinerary was one flat list in whatever order the rows arrived.\nA document desk keeps its head either way \u2014 the entries it owes are its\ncontent, filed or not. The name and whatever figure is left to it are the header\'s\nalone \u2014 it states them in full, so a fact for either would be the same sentence\ntwice.\n\n**A FACT IS PRIMARY OR IT IS PROVENANCE.** An `autonumber`, a date the platform\nstamps (`derive_from`) and a date a formula works out that no role names are what\nthe SYSTEM wrote; they fold, with every optional field this record does not\nstate, behind the grid\'s ONE link. Everything a person types or picks is primary\nand is shown, empty or not, because absence is work somebody owes. **A screen\nthat named `facts.groups` has already said which:** a field in a group is\nprimary, and one in none folds \u2014 grouping says what the reader decides with, and\nby saying so says the rest are not. A `tier` on a `facts` entry exists only for\nthe case that derivation gets provably wrong.\n\n**A `contact` field whose kind the\nmodel decides** \u2014 an email, a number, a place, a `link`-formatted text, or a\nMESSAGING APP its label names (WhatsApp, Zalo, Telegram, Viber, WeChat, Line,\nMessenger) \u2014 leaves the facts too, for the row of links under the name on a\nrecord that opens as a page; one whose kind nothing decides stays a labelled\nfact, because a scheme nobody stated is a link that opens nothing. A handle is\ndrawn under its app\'s name \u2014 the app is what identifies the person there, and a\nbare number beside an envelope says the wrong thing \u2014 and it dials only where its\nvalue IS a number.\n`check` prints the record under each screen\'s slots:\n\n```\n  Orders \u2014 lifecycle desk over Orders (12 rows) \xB7 page \xB7 tabs: Stage (New \u2192 Quoted \u2192 Confirmed \u2192 Shipped \u2192 Done)\n    stage Stage \xB7 identity Order no. \xB7 mark Photo \xB7 party Customer \xB7 amount Total \xB7 level (none \u2014 no field declares "measure") \xB7 when Due\n    record: header (Order no. \xB7 Customer) \xB7 band (Total \xB7 Shipped against Lines \xB7 Due counting down) \xB7 progress: Stage (5 stages) \xB7 facts (Ship to \xB7 \u2026 2 filed) \xB7 files: Photos \xB7 documents: Papers (Kind: 4 required) \xB7 itinerary: Order lines by Ship by at Window, kind Handling, ref Waybill (Product \xB7 Quantity \xB7 Line total) \xB7 related: Visits (count via Order)\n```\n\nThe ORDER of that line is the record\'s own, top to bottom, and it is the KIND\'s,\nand every entry of it is a section of the one column. `related:` is the counted\nline that closes it \u2014 a register the record never acts on, named and counted \u2014\nand `\u2026 N filed` is how many facts fold behind the grid\'s one link.\nA child register whose `amount` is `signed_by` a direction is a BOOK of movements\n\u2014 what the record came to rather than what it is made of \u2014 so it closes the\ncolumn rather than standing among the rows the job is made of.\n\n**A section over a child is named by the CHILD\'s own label**, because the reader\nalready knows which record they are on: "\u0110\u01A1n h\xE0ng", not "\u0110\u01A1n h\xE0ng \u2014 Kh\xE1ch h\xE0ng".\nWhere two links from one entity reach this record, that label names two sections\nand each takes its own link\'s label as a qualifier \u2014 `H\u1ED3 s\u01A1 (\u0110\u01A1n h\xE0ng)` and\n`H\u1ED3 s\u01A1 (\u0110\u01A1n g\u1ED1c)`.\n\nIn that line `documents:` is a `RecordExpectedSet`, and `lines:` a `RecordChildren` over the rows\nthis record owns \u2014 `history:` where they NAME it instead, as their `party` or their `identity`, capped at its latest 5\nwhere the record is a profile (`latest 5 of N by <day>`, the whole of them behind the foot); a required set\nwhose entries are a CHILD entity carrying files takes `kind="files"`, and the entity\'s own\nmulti-select takes `kind="items"`, since nothing attaches to an option.\n\n**A section that knows its size says so.** Where a `measure` on the record is a\n`count` rollup over the very link a rows section hangs on, the limit it is read\n`against` is how many rows that section is OWED: the printout adds `\u2014 expects\n<limit>` and the screen draws that many ghost rows until the first one lands,\ninstead of "nothing here" two bands under a count saying three are outstanding.\n\nA figure printed as `Total (USD)` is MONEY in the currency named \u2014 a `formula`\nstates it in `formula.currency`, and a `rollup` or a `lookup` inherits it from the\nfield it reads, so read those brackets: a rate that should be in dollars and is\nprinted bare will be drawn in the workspace\'s own money. Where the entity carries\na `currency` role, the ROW\'s code outranks the field\'s on every line that states\none, and a line stating none falls back to the field\'s.\n\n**A record surface can be OPERATED, and that is the default.** Every screen with\na record gets a workflow that writes its editable facts \u2014 every field a person\nstates \u2014 so the record\'s values are edited in place and its stage is advanced\nfrom the progress section. `"writes": false` makes one screen a reader: use it\nfor a screen over rows another desk owns, never as the default. A desk nobody\ncan act on is a viewer of state somebody must go and set somewhere else. A\nreader keeps the acts that only READ the row \u2014 its papers and its `export` \u2014\nand refuses every one that writes it: the quick column, the agent act, the\nhand-off on any surface, and the file an `import` would mint rows from.\n\n**`"writes": "children"` splits the record from the rows under it.** The record\nis drawn exactly as `false` draws it \u2014 the same refusals, and the register opens\nno row of its own \u2014 while every section listing the rows that record OWNS keeps\nits Add, its drawer and its own editor. Use it where one desk states the plan\nand another logs against it: the hours typed under a period the office set, the\nitems ticked under a job somebody else opened.\n\n**Which facts those are is the FIELD\'s answer.** Text, number, date, yes/no and\nselect are typed or picked. A `"cardinality": "one"` link is RE-POINTED, through\na picker over the target entity named by its `display_field_aliases` \u2014 else the\ntarget\'s `identity` \u2014 narrowed by what the reader types and carrying that\nentity\'s own `read_scope`, so a link the plan gives neither column is read\ninstead of offering an empty list. A files field is ATTACHED TO and DETACHED\nFROM, as the delta rather than the pile, so two readers filing at once each keep\ntheir file. A many-link, an `autonumber` and every computed field are read: the\nfirst is a list a fact cannot state, and the rest are the platform\'s to write.\n\n**A one-link is that fact WHATEVER its sync.** `sync_both_ways` is one relation\nwith a field on each side, and the sides are not the same surface: the record\nthat names ONE row states it as a fact, and the MANY side is the register on the\nother entity\'s record. Declaring both directions does not give this record a\nregister of the single row its own fact already names.\n\n**The write is the record SURFACE\'s.** Its inputs are the fields that surface\noffers to save \u2014 the facts with an editor, the lifecycle its ladder advances, a\nfiles section over exactly one stated field, and what the BAND states rather than\nreads: its countdown\'s date, and the limit under a meter where that limit is a\ncolumn a person types \u2014 never every field a person could in principle type. What\nthe header states, a limit a level folds into a meter among the FACTS, a required\nset with a section of its own and the pile a page\'s mark draws are read there, so\nno input is declared for them. A second screen over the same entity draws no\nsurface of its own and adds nothing.\n\nWhere two operable screens of one plan reach the same entity, `scaffold check`\nnames them and the apps they belong to: two desks writing one record is a\ndecision, and the split is stated on the FIELD in each app\'s\n`package.json#lotics.writes` rather than left to whoever edits second.\n\nThat workflow lands in the app as source, like every other: its body in\n`src/workflows/update_<entity>.ts` and its declaration in\n`package.json#lotics.workflows`. The two together are the binding \u2014 `lotics app\ndeploy` pushes whatever differs from what it last saw live \u2014 so the write is\nversion-controlled and travels with the app rather than being bound by hand\nafterwards.\n\nA `custom` screen declares its slots under `roles` (slot \u2192 role) and they bind\nthe same way:\n\n```jsonc\n{ "alias": "readings", "label": "Readings", "shape": "custom", "entity": "reading",\n  "roles": { "subject": "identity", "reading": "measure" } }\n```\n\n## Applying packages\n\n`apply` copies published packages into the workspace AFTER the model\'s own\ntables exist \u2014 apps over the tables you just described, and any tables of their\nown they still need. Ordered, and run by `lotics setup` and `lotics scaffold\napply` alike.\n\n```jsonc\n"apply": [\n  {\n    "package": "apg_k3nf82ldpq",\n    "bind": {                              // optional \u2014 which of YOUR tables each entity is\n      "company": { "label": "Customers", "fields": { "name": "Company name" } }\n    },\n    "no_sample_data": true                 // optional\n  }\n]\n```\n\n`bind` is keyed by the package\'s entity alias and holds the LABELS this\nworkspace uses: scaffold adopts by label, so binding points the package at the\ntables the model created instead of a second set beside them. Only naming\nmoves \u2014 a bound field must be the TYPE the package declares, or the copy is\nrefused. `lotics library list` is the shelf, and `lotics library show <apg_id>`\nlists the aliases to bind.\n\nEntries run in the order they are written, because a later one may bind onto a\ntable an earlier one created. **A refused entry stops the run and the entries\nbefore it stay** \u2014 they are separate copies, committed as they land, so the\nrefusal names them rather than leaving a caller to re-run the file and copy them\ntwice.\n\n### What a run remembers\n\nThe WORKSPACE remembers what each entity, field, select option, role and\ntemplate alias became here, plus which record each first row landed on and the\nfile each document path was uploaded as. The model file itself holds no live id\n\u2014 it is the portable half, and the same file applies to a demo workspace and to\na customer\'s \u2014 so the join lives where the things it names live, and one model\napplied to two workspaces holds two bindings that know nothing of each other.\n\nIt is the workspace\'s and not the file\'s because a model file is never\ncommitted: memory kept beside it is one author\'s disk, absent for a teammate, on\na second machine or after a delete \u2014 and every one of those goes quietly back to\nbinding by label, which is what grows the second table.\n\nEvery later verb binds through it: `apply`, `diff`, `app create --from`,\n`app regenerate --from` and `workspace build` take the remembered id first and\nfall back to a label only for an alias nothing has bound \u2014 a field you have just\nadded, or a workspace nothing has applied this model to. That is what makes a\nrelabel on EITHER side a rename rather than one thing the workspace lacks and\none the model lacks: `diff` prints one line under the alias\n(`order.state: label: model "Stage" \xB7 workspace "Giai \u0111o\u1EA1n"`), and `apply` binds\nthe thing it has always meant, reports the move and names the command that makes\nthe two agree \u2014 which side is right is yours to decide, not a reason to refuse\nthe run.\n\nA bound target the workspace no longer holds IS a refusal, by name: re-binding\nto whatever carries that label today is how the model comes to point at\nsomebody else\'s table. `lotics run restore_table` puts a deleted table back, and\n`lotics scaffold unbind <kind> <alias>` forgets the binding \u2014 after which the\nnext apply creates a new one and nothing joins it to what was there.\n\n## Presets\n\nA preset is a trade\'s model, published to be READ. An assistant reads it, asks\nat most two questions, picks a variant and writes a `model.json` from it \u2014\nnothing is copied, and a preset is a file rather than anything a workspace\ninstalls.\n\n```jsonc\n"preset": {\n  "name": "Field service",\n  "description": "Jobs, the crew that runs them, and what each one billed.",\n  "questions": ["Do you dispatch crews, or one person per job?"],  // at most 2\n  "variants": {\n    "crews": {\n      "when": "work is dispatched to crews rather than to one person",\n      "entities": [ /* tables this branch ADDS */ ],\n      "fields": { "job": [ /* fields this branch ADDS to `job` */ ] }\n    }\n  }\n}\n```\n\nVariants are **additive only**: a branch adds entities and fields and never\nremoves them, so the base is a model in its own right rather than a draft.\n`lotics scaffold check` proves the base AND every variant merged onto it, so a\npreset ships with every branch already proven \u2014 the branch nobody took is the\none that fails in the workspace of whoever takes it.\n\n`preset` is not scaffolded. `lotics setup` and `lotics scaffold apply` ignore\nit and create the base model\'s tables.\n\n`lotics scaffold export` prints a workspace that already works as one of these\nfiles \u2014 the starting point for a preset or for another business\'s model, never a\nsource of truth: it carries one business\'s words and stops describing that\nworkspace the moment either changes.\n\n## Starting from a preset\n\n`lotics library list` is the shelf of them and `lotics library show <slug>`\nprints one whole: its questions, every table as `alias \xB7 label` with each field\nas `alias:type`, and each variant as `slug \xB7 when` followed by the tables and\nfields that branch adds. When one of them is the trade in front of you, do not\ntranscribe it \u2014 name it:\n\n```jsonc\n{\n  "from": "field_service",\n  "variants": ["crews"],\n  "rename": { "job": { "label": "\u0110\u01A1n h\xE0ng", "fields": { "code": "M\xE3 \u0111\u01A1n" } } },\n  "entities": [ /* a table this business has that the preset does not */ ],\n  "rows": { "job": [ { "ref": "j1", "fields": { "code": "J-1" } } ] },\n  "field_roles": { "job": { "code": "identity" } },\n  "write_rules": { "customer": { "natural_key": ["email"] } },\n  "apps": [ /* the screens this business\'s apps will have */ ]\n}\n```\n\n- **`from`** is the preset\'s SLUG \u2014 its own file name, a lowercase slug. Naming\n  it is what makes `entities` optional; every other rule on this page is\n  unchanged, because the file is resolved into the full form and then checked and\n  applied exactly as one. A slug nothing serves is refused with the ones there\n  are, never resolved against something else.\n- **`variants`** names the branches to merge onto the base, in order. Pick the\n  one whose `when` describes what the person said; a slug the preset does not\n  declare is refused rather than ignored.\n- **`rename`** is keyed by the preset\'s entity alias and holds the labels this\n  business uses \u2014 the same shape `apply[].bind` takes, and the same rule: only\n  naming moves. An alias the preset does not declare, and a label that is\n  already another table\'s, are both refused.\n- **`entities`** are added after the rename, already in this business\'s own\n  words.\n- **`rows`**, **`field_roles`**, **`write_rules`**, **`apps`** and **`apply`**\n  mean exactly what they mean in the full form \u2014 `"rows"` are this business\'s\n  real first records,\n  `"field_roles"` may name the preset\'s fields as well as its own (a role the\n  preset declares itself is kept unless this file names the same field, or\n  clears it with `null`), `"write_rules"` the create-time clauses on either\n  (an entity this file names replaces the preset\'s whole entry for it),\n  `"apps"` the screens it will have (a preset carries none), `"apply"` the\n  packages copied in once its tables exist.\n\nThis is the ONE thing on this page that needs the network: `check` reads the\npreset it names, once. Everything after that read is the same offline check.\n\nWrite the full form when no preset is the trade.\n\n## A complete model\n\n```json\n{\n  "entities": [\n    {\n      "alias": "customer",\n      "label": "Customers",\n      "singular": "Customer",\n      "fields": [\n        { "alias": "name", "label": "Name", "type": "text", "required": true },\n        {\n          "alias": "tier",\n          "label": "Tier",\n          "type": "select",\n          "options": [\n            { "alias": "standard", "label": "Standard", "color": "slate" },\n            { "alias": "gold", "label": "Gold", "color": "amber" }\n          ],\n          "default": ["standard"]\n        },\n        {\n          "alias": "orders",\n          "label": "Orders",\n          "type": "select_record_link",\n          "target_entity": "order",\n          "cardinality": "many",\n          "sync_both_ways": true,\n          "paired_field_alias": "customer",\n          "display_field_aliases": ["code"]\n        },\n        {\n          "alias": "total_ordered",\n          "label": "Total ordered",\n          "type": "rollup",\n          "source_field_alias": "orders",\n          "aggregate_option": { "operation": "sum", "field_key": "amount" }\n        }\n      ],\n      "views": [\n        {\n          "alias": "gold",\n          "label": "Gold customers",\n          "filters": {\n            "node_type": "condition",\n            "type": "select",\n            "field_key": "tier",\n            "operator": "has_any_of",\n            "value": ["gold"]\n          },\n          "sort": [{ "field_key": "name", "order": "asc" }]\n        }\n      ]\n    },\n    {\n      "alias": "order",\n      "label": "Orders",\n      "singular": "Order",\n      "fields": [\n        { "alias": "code", "label": "Order no.", "type": "text", "unique": true },\n        { "alias": "placed_on", "label": "Placed on", "type": "date", "format": "date" },\n        {\n          "alias": "amount",\n          "label": "Amount",\n          "type": "number",\n          "format": "currency",\n          "currency": "VND"\n        },\n        {\n          "alias": "total",\n          "label": "Total with VAT",\n          "type": "formula",\n          "formula": { "expression": "{amount} * 1.1", "format": "currency", "currency": "VND" }\n        },\n        {\n          "alias": "customer",\n          "label": "Customer",\n          "type": "select_record_link",\n          "target_entity": "customer",\n          "cardinality": "one",\n          "sync_both_ways": true,\n          "paired_field_alias": "orders",\n          "display_field_aliases": ["name"]\n        }\n      ]\n    }\n  ],\n  "roles": [{ "alias": "sales", "label": "Sales" }],\n  "field_roles": {\n    "customer": { "name": "identity" },\n    "order": { "code": "identity", "placed_on": "when", "amount": "amount", "customer": "party" }\n  },\n  "apps": [\n    {\n      "alias": "customers",\n      "name": "Customers",\n      "screen": { "alias": "customers", "label": "Customers", "shape": "party_register", "entity": "customer" }\n    },\n    {\n      "alias": "orders",\n      "name": "Orders",\n      "screen": { "alias": "orders", "label": "Orders", "shape": "transaction_ledger", "entity": "order" }\n    }\n  ],\n  "rows": {\n    "customer": [\n      { "ref": "acme", "fields": { "name": "Acme Trading", "tier": "gold" } },\n      { "ref": "bluebird", "fields": { "name": "Bluebird Foods", "tier": "standard" } }\n    ],\n    "order": [\n      {\n        "ref": "so_1001",\n        "fields": {\n          "code": "SO-1001",\n          "placed_on": "@month-start+2",\n          "amount": 4200000,\n          "customer": "customer:acme"\n        }\n      },\n      {\n        "ref": "so_1002",\n        "fields": {\n          "code": "SO-1002",\n          "placed_on": "@today-3",\n          "amount": 1150000,\n          "customer": "customer:bluebird"\n        }\n      }\n    ]\n  }\n}\n```\n\n`lotics scaffold check` on this file reports\n`2 tables, 9 fields, 2 links, 1 view, 1 role, 4 rows, 2 apps`, then\nthe plan:\n\n```\nCustomers\n  Customers \u2014 party register over Customers (2 rows) \xB7 page (default) \xB7 tabs: none (default)\n    identity Name \xB7 mark (none \u2014 no field declares "mark") \xB7 contact (none \u2014 no field declares "contact") \xB7 worth (none \u2014 no field declares "measure") \xB7 risk (none \u2014 no field declares "verdict")\n    presentation: leads with nothing (default), roomy (default) \xB7 above: rows (default)\n    record: header (Name) \xB7 history: Orders (latest 5 (default) of N by Placed on) (Order no. \xB7 Placed on \xB7 Amount (VND)) \xB7 facts (Tier \xB7 Total ordered (VND))\nOrders\n  Orders \u2014 transaction ledger over Orders (2 rows) \xB7 drawer (default) \xB7 tabs: none (default)\n    when Placed on \xB7 amount Amount (VND) \xB7 reference Order no. \xB7 party Customer \xB7 classification (none \u2014 no field declares "lifecycle") \xB7 document (none \u2014 no field declares "expected_set" or "verdict")\n    order: Placed on, newest first (default) \xB7 presentation: leads with the figure (default), roomy (default) \xB7 above: Amount (VND) (default)\n    record: header (Order no. \xB7 Placed on \xB7 Amount (VND)) \xB7 facts (Placed on \xB7 Total with VAT (VND) \xB7 Customer)\n    party: Customers \u2014 opens from Customer (profile: header (Name) \xB7 history: Orders (latest 5 (default) of N by Placed on) (Order no. \xB7 Placed on \xB7 Amount (VND)) \u2014 foot: the whole register, narrowed to this record \xB7 facts (Tier \xB7 Total ordered (VND)))\nWho writes what:\n  Customers (customer, one: Customer): Customers \xB7 written from the rows of Orders: facts\n    Name: required\n  Orders (order, one: Order): Orders\n```\n\nA `party:` line is the record a NAME on a row opens. A party is not a job, so it\ngets no app of its own \u2014 but a clerk reading the orders book presses the\ncustomer and corrects the phone number there, so the app whose rows name a party\ncarries that party\'s own record beside its register\'s. It is printed in the same\ngrammar the `record:` line is, because it is the same kind of surface: a profile,\non a page, its histories capped. Which cells are the door is what `opens from`\nsays \u2014 `the name` where the register\'s subject IS the party.\n\nThe last block is the WRITERS matrix \u2014 one line per record surface the plan\nleaves operable, the word one of its rows is called, and the app whose register\nopens it. Part of the verdict rather than a diagnostic beside it: which desk\nchanges a table is answerable from the plan, and two apps on one line is the\nsplit to state in each of their `package.json#lotics.writes`. A\n`written from the rows of \u2026` clause is the other reach: the party that register\nnames, and what the app can change on it \u2014 counted apart, because several\nregisters naming one account is the model working as designed rather than a\nsplit to declare. A publish desk\'s rows get a clause of their own, because the\npress that withdraws one DELETES it \u2014 the app declares that table in\n`package.json#lotics.deletes`, and `lotics app check` refuses a body that deletes\nfrom a table it does not name. Indented under each entity are the clauses only a\ncreate meets: the cells a row cannot stand without, and what `write_rules` state.\n\nEvery `(none)` is a slot no field fills, and it says WHY: no field declares the\nrole, or several could and the plan named none of them (`(none \u2014 a, b; name\none)`). Read it as the screen a person will see. `above: \u2026 (default)` is the band\nnobody stated \u2014 the shape sums the amount its slot draws, and a plan naming its\nown figures loses the word. Neither\nentity carries a stage, a required set or files, so the rest is facts \u2014 except\nthe sections neither entity declares: the customer\'s `history:` is the orders\nthat name it as their party, and the order\'s `via Orders:` is the customers whose\n`Orders` link names it. **A link is a section, not a fact**, on the side it\npoints AT and on the side that holds it: `Customers.Orders` therefore leaves the\ncustomer\'s facts, because the section below already lists the same relation and\na link fact can only ever show the first of them. Both records state their name\nin the header and nowhere else \u2014 a ledger\'s columns are the date and the figure,\nso `Order no.` is on no column of that list and is still what the drawer behind\na line is called. `Total ordered (VND)` is the rollup inheriting the currency of\nthe column it sums: money is read off the model, never off the field\'s own line.\n';
 
 // src/scaffold_commands.ts
 function printModelReference() {
@@ -65564,6 +66539,34 @@ function fieldName(model, entity, field) {
   if (unit.currencyField !== void 0) return `${field.label} (in ${unit.currencyField.label})`;
   return unit.currency === void 0 ? field.label : `${field.label} (${unit.currency})`;
 }
+function describePublish(model, resolved, section, clause) {
+  const child = section.child;
+  const party = child.fields.find(
+    (field) => field.type === "select_record_link" && roleOf(model.field_roles, child.alias, field.alias)?.role === "party"
+  );
+  const target = party?.type === "select_record_link" ? model.contract.entities.find((one) => one.alias === party.target_entity) : void 0;
+  if (target === void 0) return `publish: ${child.label} (no destination)`;
+  const network = target.fields.find((field) => field.alias === clause.destination.network.field);
+  const options = network?.type === "select" ? network.options : [];
+  const reached = options.filter((option) => clause.destination.network.options[option.alias] !== void 0);
+  const byHand = options.length - reached.length;
+  const through = reached.length === 0 ? "none through the API" : `${reached.map((option) => option.label).join(" \xB7 ")} through the API${byHand === 0 ? "" : `; ${byHand} by hand`}`;
+  const body = (alias) => {
+    const field = resolved.entity.fields.find((one) => one.alias === alias);
+    return field === void 0 ? alias : fieldName(model, resolved.entity, field);
+  };
+  const written = clause.destination.bodies;
+  const bodies = (() => {
+    if (typeof written === "string") return `one body (${body(written)})`;
+    const picks = target.fields.find((field) => field.alias === written.field);
+    const said = (picks?.type === "select" ? picks.options : []).flatMap((option) => {
+      const onto = written.options[option.alias];
+      return onto === void 0 ? [] : [`${option.label} \u2192 ${body(onto)}`];
+    }).join(", ");
+    return `bodies by ${picks === void 0 ? written.field : picks.label} (${said})`;
+  })();
+  return `publish: ${child.label} \u2192 ${target.label} (${through}) \xB7 ${bodies} \xB7 "Publish" \u2192 ${clause.publish} [you write the body]`;
+}
 function describeRecord2(model, resolved, register = resolved.entity.alias) {
   const labels = (owner, fields) => {
     const route = routeOf(owner, model.field_roles);
@@ -65625,7 +66628,9 @@ function describeRecord2(model, resolved, register = resolved.entity.alias) {
           const foot = section.child.alias === register ? " \u2014 foot: the whole register, narrowed to this record" : "";
           return `history: ${rows(section.child, section.link)} (latest ${HISTORY_ROWS} (default) of N${by}) (${held})${foot}`;
         }
-        if (resolved.screen.sections?.[section.child.alias]?.draw === "worksheet") {
+        const drawnAs = resolved.screen.sections?.[section.child.alias];
+        if (drawnAs?.draw === "publish") return describePublish(model, resolved, section, drawnAs);
+        if (drawnAs?.draw === "worksheet") {
           return `sheet: ${rows(section.child, section.link)} (${labels(section.child, section.fields)})`;
         }
         const run = recordItinerary(archetype, recipeSlot, section.child, model.field_roles, resolved.screen.sections);
@@ -65812,7 +66817,7 @@ function describeCarried(model, resolved) {
   const { acts, summary, period } = resolved;
   const name = (field) => fieldName(model, resolved.entity, field);
   const act = (entry) => {
-    const where = entry.place === "cta" ? " [on the row]" : "";
+    const where = `${entry.place === "cta" ? " [on the row]" : ""}${entry.confirm === true ? " [asks first]" : ""}`;
     if (entry.kind === "agent") return `"${entry.label}" \u2192 ${entry.agent} fills ${entry.fills.map(name).join(", ")}${where}`;
     if (entry.kind === "workflow") {
       const taken = entry.inputs.map((input) => `${input.name}: ${input.field === null ? "the record" : name(input.field)}`).join(", ");
@@ -65914,10 +66919,12 @@ function describeCarried(model, resolved) {
     // prices and which of the child's figures is the base and which the answer —
     // and a BOOK says what the record it is against comes to, which is the line
     // its reader sees before the first row exists.
-    // A RUN'S LINE IS NOT AMONG THEM: the section that draws it already prints
-    // what each stop is read by, beside the columns it is read off.
+    // A PUBLISH DESK states everything it is in the record line itself — the
+    // destinations, the bodies and the press — so a second clause here would be
+    // the same sentence a line apart; and a RUN'S LINE is printed by the section
+    // that draws it, beside the columns each stop is read off.
     ...Object.entries(resolved.screen.sections ?? {}).flatMap(([alias, drawn2]) => {
-      if (drawn2.draw === "itinerary") return [];
+      if (drawn2.draw === "publish" || drawn2.draw === "itinerary") return [];
       return [
         drawn2.draw === "ledger" ? `book on ${alias}: headed ${drawn2.summary.map((field) => {
           const carried = resolved.entity.fields.find((one) => one.alias === field);
@@ -66010,6 +67017,15 @@ function describeWriters(model) {
       if (!reached.through.includes(line)) reached.through.push(line);
       appsByEntity.set(party.entity.alias, reached);
     }
+    for (const [alias, clause] of Object.entries(screen.screen.sections ?? {})) {
+      if (clause.draw !== "publish") continue;
+      const child = model.contract.entities.find((one) => one.alias === alias);
+      if (child === void 0) continue;
+      const reached = named3(child);
+      const line = `queued and withdrawn from the desk in ${screen.app.name} \u2014 it DELETES these rows`;
+      if (!reached.through.includes(line)) reached.through.push(line);
+      appsByEntity.set(child.alias, reached);
+    }
   }
   const registered = new Set(resolved.map((screen) => screen.entity.alias));
   for (const screen of resolved) {
@@ -66028,7 +67044,7 @@ function describeWriters(model) {
     lines.push(
       `  ${entry.label} (${alias}${entry.singular === void 0 ? "" : `, one: ${entry.singular}`}): ${writers.length === 0 ? "(no app)" : writers.join(" \xB7 ")}` + (entry.apps.length > 1 ? ` \u2014 ${entry.apps.length} desks write this record; state the split in each app's package.json#lotics.writes` : "")
     );
-    for (const clause of [...describeReadScope(model, alias), ...describeWriteRules(model, alias)]) lines.push(`    ${clause}`);
+    for (const clause of [...describeReadScope(model, alias), ...describeCreateClauses(model, alias, resolved)]) lines.push(`    ${clause}`);
   }
   return lines;
 }
@@ -66065,13 +67081,21 @@ function describeReadScope(model, alias) {
   });
   return [`read by ${said.join(", or ")} \u2014 every other row is hidden, on every door`];
 }
-function describeWriteRules(model, alias) {
-  const rules = model.write_rules[alias];
-  if (rules === void 0) return [];
+function describeCreateClauses(model, alias, resolved) {
   const entity = model.contract.entities.find((one) => one.alias === alias);
   if (entity === void 0) return [];
+  const required2 = entity.fields.flatMap((field) => field.required === true ? [`${field.label}: required`] : []);
+  const drafts = resolved.filter((screen) => screen.entity.alias === alias && screen.create.length > 0);
+  for (const screen of drafts) {
+    const by = drafts.length > 1 ? `${screen.app.name} ` : "";
+    required2.push(`${by}asks: ${screen.create.map((field) => field.label).join(" \xB7 ")}`);
+  }
+  const face = entity.fields.find((field) => field.type === "files" && roleOf(model.field_roles, alias, field.alias)?.role === "mark");
+  if (face !== void 0 && drafts.length === 0) required2.push(`${face.label}: attached at create \u2014 the row's own face, and the only pile a draft asks for`);
+  const rules = model.write_rules[alias];
+  if (rules === void 0) return required2;
   const label = (field) => entity.fields.find((one) => one.alias === field)?.label ?? field;
-  const lines = [];
+  const lines = [...required2];
   if (rules.natural_key !== void 0) {
     lines.push(`recognised by ${rules.natural_key.map(label).join(" + ")} \u2014 a create naming this party reuses the row it finds`);
   }
@@ -66249,21 +67273,29 @@ async function checkModelFile(file2) {
   if (model === null) return { kind: "error", findings: errors, notes };
   return { kind: "ok", model, notes };
 }
+function oneLineEach(findings) {
+  const met = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    const line = `  \u2022 ${finding.path}: ${finding.message}`;
+    met.set(line, (met.get(line) ?? 0) + 1);
+  }
+  return [...met].map(([line, times]) => times === 1 ? line : `${line} (\xD7${times})`);
+}
 function reportModelFindings(file2, findings) {
+  const lines = oneLineEach(findings);
   console.error(
-    `${file2} \u2014 ${count(findings.length, "problem")}:
-` + findings.map((finding) => `  \u2022 ${finding.path}: ${finding.message}`).join("\n") + `
+    `${file2} \u2014 ${count(lines.length, "problem")}:
+` + lines.join("\n") + `
 
   The model's shape, every field type and a worked example:  lotics scaffold docs`
   );
 }
 function reportModelNotes(notes) {
   if (notes.length === 0) return;
-  console.error(
-    `
-${count(notes.length, "note")} \u2014 nothing here refuses the file:
-` + notes.map((note2) => `  \u2022 ${note2.path}: ${note2.message}`).join("\n")
-  );
+  const lines = oneLineEach(notes);
+  console.error(`
+${count(lines.length, "note")} \u2014 nothing here refuses the file:
+` + lines.join("\n"));
 }
 async function scaffoldExport(client, opts = {}) {
   const { contract, findings, pulled_in } = await client.exportWorkspaceModel(opts);
@@ -66299,26 +67331,33 @@ async function scaffoldDiff(client, model) {
       `The workspace's own model did not parse (${live.error.issues[0]?.message ?? "unknown"}) \u2014 that is ours to fix, not yours. \`lotics scaffold export\` prints what came back.`
     );
   }
-  const lines = diffModelAgainstWorkspace(model.contract.entities, live.data, binding);
-  if (lines.length === 0) {
+  const differences = diffModelAgainstWorkspace(model.contract.entities, live.data, binding);
+  if (differences.length === 0) {
     console.log(`No difference \u2014 ${count(model.contract.entities.length, "table")} match this workspace.`);
     return;
   }
-  for (const line of lines) console.log(line);
+  for (const line of describeDiff(differences)) console.log(line);
   console.error(
     `
-${count(lines.length, "difference")}. The workspace is the truth after the first apply: edit the file to match it, or \`lotics scaffold apply\` to add what is missing (it never renames or deletes).`
+${count(differences.length, "difference")}. The workspace is the truth after the first apply: edit the file to match it, or \`lotics scaffold apply\` to add what is missing (it never renames or deletes).`
   );
   process.exitCode = 1;
 }
+function describeDiff(differences) {
+  const of = (side) => differences.filter((one) => one.side === side).length;
+  return [
+    `${of("create")} to create \xB7 ${of("standing")} already in the workspace and not in the model \xB7 ${of("disagreement")} the two disagree about`,
+    ...differences.map((one) => one.line)
+  ];
+}
 function optionLabels(field) {
   return field.type === "select" ? field.options.map((option) => option.label) : null;
 }
 function fieldDifferences(where, mine, theirs, unpairable, renamed) {
   if (mine.type !== theirs.type) {
-    return [`  ${where}: model says ${mine.type}, workspace has ${theirs.type}`];
+    return [{ side: "disagreement", line: `  ${where}: model says ${mine.type}, workspace has ${theirs.type}` }];
   }
-  const pairing = unpairable ? [`  ${where}: model pairs it both ways, the workspace's link is one-way \u2014 ${PAIRING_ADOPTION_REMEDY}`] : [];
+  const pairing = unpairable ? [{ side: "disagreement", line: `  ${where}: model pairs it both ways, the workspace's link is one-way \u2014 ${PAIRING_ADOPTION_REMEDY}` }] : [];
   const ours = optionLabels(mine);
   const yours = optionLabels(theirs);
   if (ours === null || yours === null) return pairing;
@@ -66327,8 +67366,11 @@ function fieldDifferences(where, mine, theirs, unpairable, renamed) {
   const extra = yours.filter((label) => !ours.includes(label) && !moved.has(label));
   return [
     ...pairing,
-    ...missing.length === 0 ? [] : [`  ${where}: workspace lacks ${missing.map((l) => `"${l}"`).join(", ")}`],
-    ...extra.length === 0 ? [] : [`  ${where}: model lacks ${extra.map((l) => `"${l}"`).join(", ")}`]
+    // AN OPTION IS ADDED LIKE A COLUMN IS. `apply` is additive down to the
+    // option, so an option the workspace lacks is something it would write and
+    // one the model lacks is something it would leave standing.
+    ...missing.length === 0 ? [] : [{ side: "create", line: `  ${where}: workspace lacks ${missing.map((l) => `"${l}"`).join(", ")}` }],
+    ...extra.length === 0 ? [] : [{ side: "standing", line: `  ${where}: model lacks ${extra.map((l) => `"${l}"`).join(", ")}` }]
   ];
 }
 function exportIndex(bound, read2, among, label) {
@@ -66388,51 +67430,51 @@ function diffModelAgainstWorkspace(declared, live, binding) {
   const claimed = /* @__PURE__ */ new Set();
   for (const { declared: entity, found, fields: boundFields } of resolved) {
     if (found.how === "gone") {
-      lines.push(`  ${goneMessage("entity", entity.alias, found.id)}`);
+      lines.push({ side: "disagreement", line: `  ${goneMessage("entity", entity.alias, found.id)}` });
       continue;
     }
     if (found.how === "absent") {
-      lines.push(`  ${entity.label}: in the model, not in the workspace`);
+      lines.push({ side: "create", line: `  ${entity.label}: in the model, not in the workspace` });
       continue;
     }
     if (found.how === "ambiguous") {
-      lines.push(`  ${entity.label}: ${count(found.live.length, "table")} here carry this label \u2014 a label binds one`);
+      lines.push({ side: "disagreement", line: `  ${entity.label}: ${count(found.live.length, "table")} here carry this label \u2014 a label binds one` });
       continue;
     }
     const here = found.live;
     claimed.add(here);
     const renamed = renames.get(entity.alias);
-    if (renamed !== void 0) lines.push(driftLine(renamed));
+    if (renamed !== void 0) lines.push({ side: "disagreement", line: driftLine(renamed) });
     const claimedFields = /* @__PURE__ */ new Set();
     for (const field of entity.fields) {
       const at2 = fieldKeyName(entity.alias, field.alias);
       const counterpart = boundFields.get(field.alias) ?? { how: "absent" };
       if (counterpart.how === "gone") {
-        lines.push(`  ${goneMessage("field", at2, counterpart.id)}`);
+        lines.push({ side: "disagreement", line: `  ${goneMessage("field", at2, counterpart.id)}` });
         continue;
       }
       if (counterpart.how === "absent") {
-        lines.push(`  ${entity.label}.${field.label}: in the model, not in the workspace`);
+        lines.push({ side: "create", line: `  ${entity.label}.${field.label}: in the model, not in the workspace` });
         continue;
       }
       if (counterpart.how === "ambiguous") {
-        lines.push(`  ${entity.label}.${field.label}: ${count(counterpart.live.length, "field")} here carry this label \u2014 a label binds one`);
+        lines.push({ side: "disagreement", line: `  ${entity.label}.${field.label}: ${count(counterpart.live.length, "field")} here carry this label \u2014 a label binds one` });
         continue;
       }
       const theirs = counterpart.live;
       claimedFields.add(theirs);
       const movedField = renames.get(at2);
-      if (movedField !== void 0) lines.push(driftLine(movedField));
+      if (movedField !== void 0) lines.push({ side: "disagreement", line: driftLine(movedField) });
       const movedOptions = /* @__PURE__ */ new Map();
       for (const option of field.type === "select" ? field.options : []) {
         const moved = renames.get(optionKeyName(entity.alias, field.alias, option.alias));
         if (moved === void 0) continue;
         if (moved.workspace === null) {
-          lines.push(`  ${goneMessage("option", moved.at, moved.id)}`);
+          lines.push({ side: "disagreement", line: `  ${goneMessage("option", moved.at, moved.id)}` });
           continue;
         }
         movedOptions.set(option.label, moved.workspace);
-        lines.push(driftLine(moved));
+        lines.push({ side: "disagreement", line: driftLine(moved) });
       }
       lines.push(
         ...fieldDifferences(`${entity.label}.${field.label}`, field, theirs, unpairable.has(at2), movedOptions)
@@ -66440,12 +67482,12 @@ function diffModelAgainstWorkspace(declared, live, binding) {
     }
     for (const field of here.fields) {
       if (claimedFields.has(field)) continue;
-      lines.push(`  ${entity.label}.${field.label}: in the workspace, not in the model`);
+      lines.push({ side: "standing", line: `  ${entity.label}.${field.label}: in the workspace, not in the model` });
     }
   }
   for (const entity of live) {
     if (claimed.has(entity)) continue;
-    lines.push(`  ${entity.label}: in the workspace, not in the model`);
+    lines.push({ side: "standing", line: `  ${entity.label}: in the workspace, not in the model` });
   }
   return lines;
 }
@@ -66966,12 +68008,6 @@ function remapFilter(group, entity, binding, at2) {
   return remapContractFilterGroup(group, entity, resolver);
 }
 
-// ../shared/src/schemas/database_types.ts
-function extractRecordLinkIds(value) {
-  if (!value || !Array.isArray(value)) return [];
-  return value.map((item) => typeof item === "string" ? item : item?.id).filter((id) => Boolean(id));
-}
-
 // ../../node_modules/jexpr/lib/constants.js
 var KEYWORDS = ["this"];
 var UNARY_OPERATORS = ["+", "-", "!"];
@@ -70452,27 +71488,37 @@ function applyGeneration(projectDir, plan) {
     fs16.writeFileSync(full, plan.droppedPatch);
   }
 }
-var NOTHING_DROPPED = { gone: [], unwritten: [] };
+var NOTHING_DROPPED = { gone: [], unwritten: [], undeleted: [] };
 function foldWrites(existing, generated, live, bodies) {
-  if (generated === void 0 && existing === void 0) {
-    return { writes: void 0, dropped: NOTHING_DROPPED };
-  }
+  const nothingDeclared = generated.writes === void 0 && existing.writes === void 0 && generated.deletes === void 0 && existing.deletes === void 0;
+  if (nothingDeclared) return { writes: void 0, deletes: void 0, dropped: NOTHING_DROPPED };
   const out = {};
-  for (const [table, entries2] of Object.entries(existing ?? {})) out[table] = [...entries2];
-  for (const [table, entries2] of Object.entries(generated ?? {})) {
+  for (const [table, entries2] of Object.entries(existing.writes ?? {})) out[table] = [...entries2];
+  for (const [table, entries2] of Object.entries(generated.writes ?? {})) {
     const already2 = new Set((out[table] ?? []).map(writtenField));
     out[table] = [...out[table] ?? [], ...entries2.filter((entry) => !already2.has(writtenField(entry)))];
   }
+  const removals = [.../* @__PURE__ */ new Set([...existing.deletes ?? [], ...generated.deletes ?? []])];
+  const declared = existing.deletes !== void 0 || generated.deletes !== void 0;
   const carried = carriedWrites(out, live);
   const scanned = bodies.map((body) => body.source === null ? null : bodyWrites(body.source));
   if (scanned.some((body) => body === null || !body.parsed || body.unknownTools.length > 0)) {
-    return { writes: carried.writes, dropped: { gone: carried.dropped, unwritten: [] } };
+    return {
+      writes: carried.writes,
+      deletes: declared ? removals : void 0,
+      dropped: { gone: carried.dropped, unwritten: [], undeleted: [] }
+    };
   }
-  const written = stillWritten(carried.writes, live, {
+  const written = stillWritten({ writes: carried.writes, deletes: removals }, live, {
     bodies: scanned.flatMap((body) => body?.writes ?? []),
-    generated: generated ?? {}
+    removed: scanned.flatMap((body) => body?.deletes ?? []),
+    generated: { writes: generated.writes ?? {}, deletes: generated.deletes ?? [] }
   });
-  return { writes: written.writes, dropped: { gone: carried.dropped, unwritten: written.dropped } };
+  return {
+    writes: written.writes,
+    deletes: declared ? written.deletes : void 0,
+    dropped: { gone: carried.dropped, unwritten: written.dropped, undeleted: written.undeleted }
+  };
 }
 function rewrittenWorkflowBodies(plan) {
   return new Set(
@@ -70522,8 +71568,9 @@ function renderSummary(summary, dryRun) {
     }),
     // A declaration losing an entry is not something to do quietly, and the two
     // rules that can take one away are not the same fact.
-    ...summary.droppedWrites.gone.length === 0 ? [] : [`  Dropped from writes (the table no longer carries them): ${list2(summary.droppedWrites.gone)}`],
-    ...summary.droppedWrites.unwritten.length === 0 ? [] : [`  Dropped from writes (nothing here writes them any more): ${list2(summary.droppedWrites.unwritten)}`],
+    ...summary.droppedDeclarations.gone.length === 0 ? [] : [`  Dropped from writes (the table no longer carries them): ${list2(summary.droppedDeclarations.gone)}`],
+    ...summary.droppedDeclarations.unwritten.length === 0 ? [] : [`  Dropped from writes (nothing here writes them any more): ${list2(summary.droppedDeclarations.unwritten)}`],
+    ...summary.droppedDeclarations.undeleted.length === 0 ? [] : [`  Dropped from deletes (nothing here takes their rows any more): ${list2(summary.droppedDeclarations.undeleted)}`],
     // WHAT A DEPLOY WILL CHANGE, never what this command changed: a binding is
     // what the live app runs, and it moves at `lotics app deploy`.
     ...nothingToDeploy ? ["  Bindings: the live app already runs what this tree declares."] : [
@@ -70592,8 +71639,8 @@ async function foldRegeneration(client, args = {}) {
     }
   );
   const folded = foldWrites(
-    lotics.writes,
-    plan.writes,
+    { writes: lotics.writes, deletes: lotics.deletes },
+    { writes: plan.writes, deletes: plan.deletes },
     plan.live,
     plannedWorkflowBodies(projectDir, generation, Object.keys(workflows.entries))
   );
@@ -70613,7 +71660,7 @@ async function foldRegeneration(client, args = {}) {
     outcomes: generation.outcomes,
     queries,
     workflows,
-    droppedWrites: folded.dropped,
+    droppedDeclarations: folded.dropped,
     deploy: deployPreview(pending, live, { queries: queries.removed, workflows: workflows.removed }),
     pushed: [],
     refused: [],
@@ -70630,7 +71677,8 @@ async function foldRegeneration(client, args = {}) {
     plan: rememberedPlanReference(projectDir, reference),
     queries: queries.entries,
     workflows: workflows.entries,
-    ...folded.writes === void 0 ? {} : { writes: folded.writes }
+    ...folded.writes === void 0 ? {} : { writes: folded.writes },
+    ...folded.deletes === void 0 ? {} : { deletes: folded.deletes }
   };
   fs16.writeFileSync(path19.join(projectDir, "package.json"), `${JSON.stringify(whole, null, 2)}
 `);
@@ -70767,7 +71815,7 @@ async function workspaceBuild(client, args, actions = REAL_ACTIONS) {
     );
   }
   const differences = diffModelAgainstWorkspace(model.contract.entities, live.data, binding);
-  for (const line of differences) note(line);
+  for (const line of describeDiff(differences)) note(line);
   let scaffold = "unchanged";
   if (differences.length > 0) {
     if (dryRun) scaffold = "not run";