create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/deploy/release-notes-2026-09-26.md

@@ -0,0 +1,209 @@
+<!--
+Copyright (C) 2026 Tony Aly
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Release notes — session digest 2026-09-26
+
+Product version remains **0.1.0**, in active development. This is a session
+digest, not a release-candidate announcement and not a claim of deployment.
+`CHANGELOG.md`, generated from `.changeset/`, is the canonical owner-facing
+change list. Plan gate at this snapshot: **297 unique IDs, 270 checked,
+27 open**. Refresh GitHub before treating anything below as shipped.
+
+Two themes ran through this session. The first was closing C6.11 and getting the
+C11.11 harness to run at all. The second was a set of defects reported by a
+third party who built two sites on Freeholder and deployed one to DigitalOcean —
+**23 of their 24 findings were reproduced exactly as described**, and most of
+them were in code this checklist already counted as complete.
+
+## Security — `forms.get` disclosed notification addresses (#412)
+
+`forms.get` is `permission: "public"` and returned the whole form row, so any
+unauthenticated caller could read `notify`: the addresses a site's form
+submissions are e-mailed to. No session, cookie or key needed, and `contact` is
+the obvious slug to guess, so the addresses were harvestable across instances.
+The reporter confirmed it on two sites and did not disclose it publicly.
+
+The intent was already documented and only the query disagreed — the comment
+above `forms.get` said "deliberately thin", and `forms.byId` below it describes
+`notify` as a column "a visitor never sees". `forms.get` now has its own named
+projection in both its output schema and its query, so the column never leaves
+the database and a column added to the table later cannot leak the same way.
+Sending is unaffected; the submit path reads `notify` through its own query.
+
+**An existing test had been asserting this against the wrong service.** "is not
+a way for a visitor to read who gets notified" tested `forms.byId`, which refuses
+anonymous callers outright, so it passed while the service a stranger can
+actually reach was never checked. The new test calls `forms.get` as `ANONYMOUS`,
+asserts `notify` is *absent* rather than empty, and confirms staff can still read
+it. Verified failing against the previous service.
+
+Owners on existing instances should assume the addresses on any site with a
+public form were readable and decide whether that warrants a notification.
+
+## Owner-authored truth — C8.14, C8.15, C8.16, C5.26, C6.18 (#411)
+
+Five capabilities, each built to the full F01–F12 bar, so an industry starter can
+be assembled from Freeholder rather than forked from it:
+
+- **Guided assessments** (C8.14) — owner-authored questions, scored bands and
+  per-answer escalations. `assessment_responses.band_id` is `NOT NULL` with
+  `RESTRICT`, so an unauthored outcome is unrepresentable, and
+  `assessment_bands_no_overlap` (`EXCLUDE USING gist`) makes two bands over one
+  score impossible.
+- **As-of dated published facts** (C8.15) with a correction ledger. A partial
+  unique index over `COALESCE`d subject columns allows exactly one current fact
+  per key and subject, so a business-wide figure is not exempt, and a second
+  index stops the ledger forking.
+- **Consent-gated progress media** (C8.16) — an append-only consent ledger
+  ordered by effect time, so late data entry cannot reinstate a withdrawal, plus
+  an hourly sweep that takes published work offline the moment its permission
+  stops standing. This replaced a real pre-existing defect:
+  `projects.revokeConsent` nulled three columns, destroying the proof that
+  publication had been lawful.
+- **Owner-configured calculators** (C5.26) over a closed vocabulary — seven
+  operations and three operand kinds, no expression parsing and nothing
+  evaluated, so configuring arithmetic is not a way to run code. `compute`
+  **refuses** when a fact is missing or stale rather than falling back to the
+  last number it saw.
+- **Enforced coverage checks** (C6.18) that answer `covered`, `outside` or
+  `unconfirmed`, and never claim coverage from a radius or a named region.
+
+## C6.11 closed — events and classes (#414)
+
+The `events` module was already built: venue, sessions with capacity, ticket
+types, waitlists that promote the oldest fitting seat on cancel, check-in, Event
+JSON-LD wired into the public renderer, ICS and both surfaces. Three things kept
+the item honestly open, and all three are now closed.
+
+Nobody had ever looked at it in a browser, so F06's axe pass over the public and
+admin surfaces had never run in either theme. `tests/browser/events.spec.ts`
+asserts what only a browser can: a visitor finds the class from the index, a
+sold-out session reads `0 / 2 seats` rather than going quiet — silence reads as
+availability, which is the reading that wastes somebody's trip — the calendar
+link returns real `text/calendar` with a `VEVENT`, and a draft event is absent
+from the index. It passed on its first CI execution.
+
+It shipped no demo fixture; there is now a demo class in en/fr/es whose verify
+requires the event to be published **and** to have a session, because a class
+with no date is not one anybody could attend.
+
+**Its evidence line cited a migration that does not exist.** It named
+`0059_concerned_sumo.sql`, which the migration squash removed — the tables are in
+`0000_reviewed-baseline.sql`. Since the plan gate requires every backticked path
+in a checked item to resolve, C6.11 could not have been ticked as written however
+finished the software was. An audit of the other open items found no second
+instance: **C6.11 was the only item blocked by a stale citation**, so the
+remaining work is genuine.
+
+## C11.11 could not run on the owner's platform (#415)
+
+`scripts/performance-budgets.mjs` shelled out to `pnpm exec vitest`. On Windows
+there is no bare `pnpm` for `spawnSync` to execute, and naming `pnpm.cmd` is
+refused with `EINVAL` because Node will not spawn a `.cmd` without a shell — so
+the harness exited before measuring anything. C11.11 asks the product owner to
+produce the reference-target acceptance evidence, and a gate that only runs on
+the CI image is not a gate anybody can sign. Vitest now runs under
+`process.execPath`, with no package manager involved on any platform.
+
+First measurements on the owner's machine (`win32 · 12 CPUs · 16GB`), all three
+datasets passing and exiting 0:
+
+| Surface | small | medium | Budget |
+|---|---|---|---|
+| Admin list (any) | 3.8ms | 4.3ms | ≤ 800ms p95 |
+| Admin detail | 1.6ms | 2.3ms | ≤ 1s p95 |
+| Search | 3.2ms | 29.2ms | ≤ 500ms p95 |
+| Report generation | 2.5ms | 5.2ms | ≤ 5s p95 |
+| Public page, server render | 3.9ms | 4.1ms | ≤ 300ms p95 |
+
+Fixture counts verified by the harness at medium: 5,000 contacts, 20,000
+messages, 2,000 orders, 500 products, 10,000 assets. Large seeds 100,000
+contacts and took 59s.
+
+**C11.11 stays open.** The browser Core Web Vitals, editor, job-queue, migration
+and cold-boot families are opt-in and have not run, and these numbers come from a
+development machine, not the reference target. The harness prints a run header
+precisely so a diagnostic run cannot be mistaken for acceptance.
+
+## Third-party findings — 13 of 24 fixed
+
+Merged in #413: link previews and short links were swallowed by the locale
+prefix, because `/og/services` is shaped exactly like `/fr/services` and the edge
+stripped the segment. Every page's preview image 404ed when shared, and `/go/…`
+broke identically — invisible on the site itself, visible only when a shared page
+comes back blank. The reporter's suggested fix would not have worked:
+`NEVER_LOCALIZED` is tested against the *rest* of the path, so it answers "is
+`/admin` localizable" and never "is `og` a language". A test now enumerates
+`app/` and fails if a two-letter route appears unlisted.
+
+Also in #413: image renditions stopped one step below an original landing exactly
+on the ladder, so a 1600px photograph produced 400 and 800 only and full-width
+heroes were browser-upscaled (62 of 185 originals on the reporting site were
+exactly 1600 wide); `DATABASE_POOL_MAX` now bounds connections, because an idle
+instance held 21 against DigitalOcean's 22-connection limit and the second deploy
+could not connect at all; and a plugin that cannot be wired now fails readiness
+and is logged, where previously it counted as a booted module, `/api/health`
+answered ok, and the platform promoted a broken instance over the healthy one it
+was replacing — 36 routes short, with nothing in the logs.
+
+`PGMAX` could not have fixed the pool: postgres.js reads it but leaves it a
+**string**, and spreading a string's length yields a one-connection pool, so
+every attempted workaround made throughput worse while looking like a fix. The
+test asserts the *type*, not the value.
+
+Open in the batch-2 PR: the web manifest named the platform rather than the
+business on customers' home screens; there was no not-found route, so a mistyped
+address rendered an empty body inside the site's own layout; `llms.txt` described
+a Canadian business as "based in CA"; text controls were 14px, so iOS Safari
+zoomed the page on every first tap into a field; `onDanger` was contrast-checked
+but absent from the patch schema, so a site was refused over a role it had never
+been allowed to send; a nav block can now opt out of collapsing behind a phone
+menu, which had hidden every footer link on mobile; and `cms.ensureDefaults`
+names the stale section instead of answering 500.
+
+**Control borders now meet WCAG 1.4.11.** The `rule` token measures **1.17:1**
+against every ground it borders — worse than the 1.3–1.8:1 estimated, and true of
+the default palette, not only custom ones. Raising `rule` was not the fix: it
+draws 828 hairlines and 60 of them are controls, so the fields would have been
+corrected by darkening every divider in the interface. A separate `ruleStrong`
+role (3.32:1 light, 3.41:1 dark) is checked on all four grounds in both schemes,
+and 322 control borders across 86 files use it. Dividers keep the lighter token,
+which is correct: 1.4.11 governs the edge of something you can operate.
+
+### Still open from those reports
+
+Media URLs re-signed every 900 seconds, so a photograph can never be cached and a
+tab left open for fifteen minutes gets 403s on lazy-loaded images; local media
+served with `private, max-age=300` and no `ETag`, `Last-Modified`, `Content-Length`
+or `Range`; media that cannot be tagged, captioned, searched or listed publicly;
+list rows that cannot hold an image picker, so a gallery is edited by pasting
+UUIDs; plugin blocks that cannot declare the heading level they render, so a page
+whose title lives in a hero fails the publish check; plugins not discovered from
+`plugins/` although §25 describes folder auto-discovery; the `--fh-measure` cap on
+header, footer and columns; and a form error that wipes every field and
+identifies none.
+
+Six deployment items also remain: the App Platform recipe still specifies a dev
+database that cannot be migrated; no CA-certificate support, so the job runtime
+cannot reach a DigitalOcean managed database over TLS; the nightly backup cron has
+**never run once**, because `. /opt/freeholder/.env && …` sets shell variables
+without exporting them to a child process and the failure goes to root's mail on a
+box with no mail server; no bucket CORS step, so the first admin upload fails;
+`www` unserved, because the Caddyfile has a single site block; and SMTP on 587,
+which DigitalOcean blocks on droplets.
+
+## Notes for whoever picks this up
+
+Three tests were caught asserting the wrong thing this session: the `notify`
+disclosure was tested against the service that refuses anonymous callers; a
+journey test asserted Next's bare `404` heading, holding the missing not-found
+route in place; and the C6.11 citation kept a finished item open. On this
+codebase a passing test is not by itself evidence that the right subject was
+tested.
+
+CI also enforced two rules worth knowing before editing: route handlers never
+reach the database directly (§15.5 — the first `app/manifest.ts` did, and lint
+refused it), and the generated SDK is compared against a fresh run, so changing
+any service's input or output schema means regenerating it.

package/dist/template/deploy/release-notes-2026-09-27.md

@@ -0,0 +1,47 @@
+<!--
+Copyright (C) 2026 Tony Aly
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Release notes — session digest 2026-09-27
+
+Product version remains **0.1.0**, in active development. This is a session
+digest, not a release-candidate announcement and not a claim of deployment.
+`CHANGELOG.md`, generated from `.changeset/`, is the canonical owner-facing
+change list. Plan gate at this snapshot: **297 unique IDs, 274 checked,
+23 open**. Refresh GitHub before treating anything below as shipped.
+
+## Hardened public playground — C1.38
+
+The disposable demo instance is now hardened to its full contract, closing
+the plan item:
+
+- **Privileged operations are refused by the service layer, not the UI.**
+  The playground's mutation allow-list is enforced in `authorizeInput`, the
+  single choke point every surface (admin UI, REST API, MCP) routes through,
+  so staff invitations, role changes, mail test sends, uploads, SMS, payments,
+  settings and host updates all fail with a `permission` error no matter which
+  door they come in. Tests call these services directly as the playground
+  visitor.
+- **Nothing leaves the box.** Queued mail, SMS and webhook deliveries now fail
+  closed with a playground reason before any provider or endpoint is
+  contacted. This matters because background jobs (reminders, compliance
+  replies, event webhooks) run as `system`, a caller the visitor-facing
+  allow-list was never meant to cover — the container's internal-only
+  networks are the outer bound, and this is the in-app twin.
+- **Bounded by construction.** Visitors share a 300-mutations/minute ceiling,
+  each writable surface (pages, sections, forms, contacts, products, notes,
+  tasks) carries a row cap that refuses creates once full, and upload staging
+  is off entirely.
+- **The hourly reset has a recovery proof.** A service-side test simulates
+  the reset job (fresh disposable database + the ordinary boot phases) and
+  shows the old visitor session no longer validates, visitor pages are gone,
+  the sample site is reinstalled, and a new visitor can edit again. A second
+  test proves separation on a live cluster: the playground flag fails closed
+  against a database holding real accounts, and the synthetic visitor pair is
+  all the playground database ever holds.
+- **A real-browser proof drives the whole journey** — entry, the reset and
+  privacy banner on every surface, a page edited and published in the editor,
+  three privileged API calls refused as the visitor, the reset signing them
+  out and 404-ing their page, then re-entry and editing restored
+  (`pnpm test:playground`).

package/dist/template/deploy/release-notes-2026-09-28.md

@@ -0,0 +1,142 @@
+<!--
+Copyright (C) 2026 Tony Aly
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Release notes — session digest 2026-09-28
+
+Product version remains **0.1.0**, in active development. This is a session
+digest, not a release-candidate announcement and not a claim of deployment.
+`CHANGELOG.md`, generated from `.changeset/`, is the canonical owner-facing
+change list. Plan gate at this snapshot: **298 unique IDs, 280 checked,
+18 open**. Refresh GitHub before treating anything below as shipped.
+
+## C11.11 — performance budgets pass on the reference target
+
+The §15.1 performance budgets are now measured on the actual reference
+hardware, and every one of them passes:
+
+- **Thirteen for thirteen on the $6 droplet.** The acceptance run targeted the
+  provisioned `freeholder-ref` instance (nyc3, `s-1vcpu-1gb`, ubuntu-24-04,
+  app image `ghcr.io/campdenman/freeholder:edge` ≈ main `204f4f7`), measured
+  through the deployed surface over an SSH tunnel, against the verified medium
+  dataset. Public render 203ms p95 (tunnel-adjusted; 274ms on-box), LCP 432ms
+  p75, INP 16ms p75, CLS 0.00064, admin list 732ms p95, admin detail 661ms p95,
+  search 499ms p95, report 544ms p95, editor first paint 488ms p95,
+  keystroke→preview 119.8ms raw p95 at the harness measurement floor, queue
+  1,219ms p95, migration chain 49.1s, cold boot 7.81s p95.
+- **The evidence is archived, not asserted.** `deploy/perf-reference-run-2026-09-27.log`
+  holds the complete run: host configuration, dataset proof, every command,
+  every raw sample, computed percentiles and per-budget verdicts. The summary
+  in `deploy/performance-measurements.md` records the method adaptation
+  (HTTP/browser through the tunnel; queue/migration/boot timed on-droplet) and
+  the honest caveats, including the keystroke row's raw 119.8ms versus its
+  ≤20ms product contribution, and the 1.1ms margin on the search row.
+- **The checklist box stays open, deliberately.** The C11.16
+  spec-reconciliation gate orders C11.11 to remain unchecked until that gate
+  is updated, and no gate was weakened to flip it early. Checking C11.11 now
+  awaits the C11.16 workstream's own reconciliation-table update, with this
+  run's evidence standing as the acceptance record.
+- **Nothing was tuned to pass.** No swap was added, the droplet was not
+  resized, no budget was raised, and no gate was weakened; the one observation
+  of the single CPU starving the queue worker under concurrent measurement
+  load is preserved in the log as a real behavior of the target.
+
+## Paradise Comms provider adapter — C3.13 (live acceptance still open)
+
+Paradisemodern's Paradise Comms is now the de-facto first-party voice/video
+provider behind the existing plugin seam, per the 2026-09-27 pivot. The
+Daily adapter remains in-tree as optional code and keeps serving instances
+configured through `DAILY_API_KEY`/`DAILY_DOMAIN` — provider selection reads
+the plugin's stored settings, and only instances with no stored row fall
+back to the Daily environment, so nothing is force-migrated.
+
+- **Provider adapter** (`plugins/voice-video/paradise.ts`,
+  `paradise-provider.ts`): implements the live
+  `2026-09-28.comms-recording-lifecycle` contract — rooms with policy
+  (invite_only by default), participant caps and recording retention; TTL
+  LiveKit credentials with TURN for host and guest; provider-confirmed room
+  end where a 503 `media_termination_pending` stays retryable and fail-closed
+  (the room is never marked ended until PM confirms `media_ended`);
+  recording start/stop; recordings list/get/delete with 409 mid-egress and
+  retryable 503 semantics. PM's prepaid gate is surfaced honestly: a 402
+  carries the balance and top-up URL to the room row and the setup screen,
+  and reads/stops are never budget-gated.
+- **Settings** (`plugins/voice-video/settings.ts`): base URL, auth scheme
+  (site key or legacy portfolio bearer), webhook signing secret, room policy
+  and retention days, all in module settings; secrets are stored as §41
+  ciphertext and never returned by any read path.
+- **Inbound webhooks** (`plugins/voice-video/webhook.ts`,
+  `app/api/plugins/voice-video/webhooks/paradise/route.ts`): PM's
+  HMAC-SHA256 relay is verified with a five-minute timestamp window before
+  any database effect, de-duplicated by envelope id in
+  `voice_video_webhook_deliveries` (migration `0019`), and mapped to the
+  plugin state machine — room-ended closes the local room,
+  `recording.deleted`/`recording.expired` drops local provider references.
+- **Recording lifecycle**: a verified recording is imported into the
+  owner's storage through the existing #394 pipeline, downloading from PM's
+  playback URL with the same pinned, bounded transport as Daily (512 MiB
+  ceiling). Caveat: PM playback URLs are public unsigned Spaces URLs until
+  PM ships signed playback — treat them as short-lived access windows.
+  Transcripts stay absent; PM does not ship them yet.
+- **Erasure**: contact erasure now calls `DELETE /v1/recordings/:id` for the
+  contact's imported PM recordings and acknowledges the privacy receipt only
+  after PM confirms; a 503 keeps the PM row and the receipt pending, and a
+  409 mid-egress defers to the durable job — the same pattern as the Daily
+  path.
+- **Admin UI**: provider picker, encrypted secret fields, verify-connection
+  probe with 402 top-up surfacing, LiveKit credential panels for host and
+  guest (copy into a LiveKit client promptly; PM's `expires_at` governs —
+  the live run minted 60-second TTLs, not the requested 30 minutes), and
+  recording start/stop controls on live rooms.
+- **Coverage**: 33 new tests across `tests/core/paradise-adapter.test.ts`
+  (15 mocked-HTTP client tests), `tests/core/paradise-flow.test.ts` (10
+  database compositions incl. provider switching, erasure round-trip and
+  import retry) and `tests/core/paradise-webhook.test.ts` (signature,
+  replay and mapping). No real network in tests.
+- **Locales**: en/fr/es/ar parity for the new setup and credential strings.
+
+Live acceptance against a real paradisemodern site key (open a room, join
+with a LiveKit client, record, import, erase) was open C3.13 work when this
+section landed; the section below closes it same-day.
+
+## C3.13 — live Paradise Comms acceptance closes the item
+
+The remaining C3.13 clause — live voice/video acceptance against a real
+paradisemodern instance — ran end to end on 2026-09-28 against production
+`https://paradisemodern.com/v1` (contract `2026-09-28.comms-recording-lifecycle`),
+from the Freeholder droplet running the post-#430 image. Every hop went through
+Freeholder's real service surface; PM-side reads used only the site key for
+corroboration. The sanitized transcript is
+`deploy/c313-live-acceptance-2026-09-28.log`; the summary with the five proofs
+(real room; live media participant on the production SFU; provider-confirmed
+end; recording + owner-storage import with checksum-verified bytes; erasure
+round-trip ending in PM 404 + a completed privacy receipt) is
+`deploy/c313-live-acceptance-2026-09-28.md`.
+
+- **Real media, honestly metered.** Headless Chromium (fake devices) joined the
+  room with Freeholder-minted LiveKit JWTs: connected in 907 ms, audio + video
+  published, 1,888,138 bytes sent. Recording start/stop through
+  `voiceVideo.recordingControl` produced an MP4 whose import into owner storage
+  verified byte-for-byte (sha256 on the row equals the file on disk).
+- **Erasure is provider-confirmed.** Contact erasure deleted the PM recording
+  (re-GET 404, empty listing), removed the owner-storage copy, and the privacy
+  receipt acknowledged completion only after both durable provider jobs
+  confirmed.
+- **Budget.** $0.027634 of the $1.00/100-min grant; ending balance $0.972366.
+- **Ops findings (no product defects).** Four environment gaps surfaced and were
+  repaired with before/after evidence in the log: the acceptance site's PM
+  portfolio was not provisioned for Comms (site moved to the owner's
+  `campdenman` portfolio); the recording object's ACL was private despite the
+  documented public playback-URL contract (repaired); the droplet's split-
+  horizon DNS answered the Spaces hostname with a VPC-private IP that the
+  pinned downloader's SSRF guard rightly refuses (public IP pinned in compose);
+  and droplet `CREDENTIAL_KEY`/owner-storage needed configuration (set,
+  documented). The adapter failed visibly and honestly at each gap, matching
+  the #430 contract tests.
+- **Observed PM behavior worth noting.** Credential mints returned a 60-second
+  TTL (Freeholder requests 30 minutes and surfaces PM's `expires_at`
+  faithfully); the earlier release note's "expire within 30 minutes" reflects
+  the request, not PM's current grant.
+
+`MASTER.md` C3.13 is checked; `deploy/f-criteria-matrix.md` F12 is updated.

package/dist/template/deploy/release-notes-2026-09-29.md

@@ -0,0 +1,138 @@
+<!--
+Copyright (C) 2026 Tony Aly
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Release notes — session digest 2026-09-29
+
+Product version remains **0.1.0**, in active development. This is a session
+digest, not a release-candidate announcement and not a claim of deployment.
+`CHANGELOG.md`, generated from `.changeset/`, is the canonical owner-facing
+change list. Refresh GitHub before treating anything below as shipped.
+
+## C3.24 — native storefront parity mapping published (box stays open)
+
+The 2026-09-27 owner decision ("freeholder should put shopify out of business"
+— the native store is the product, the Shopify importer is a migration bridge)
+gets its proof instrument: the capability mapping at
+`deploy/c324-storefront-parity-2026-09-29.md`.
+
+- **Eleven Shopify-core rows, ground truth over optimism.** Every native claim
+  cites the test file that proves it: products/variants, discounts/coupons,
+  customer accounts/portal, order management with notifications, first-party
+  analytics, SEO/marketing surfaces, shipping/taxes, apps/webhooks and
+  design-token theming are native ✓ — several deeper than the benchmark
+  (price lists and tiered/volume breaks, append-only inventory ledger with
+  procurement, deterministic shipping engine, signed webhook subscriptions).
+- **One partial, honestly labelled.** Cart/checkout is native and deep at the
+  service layer (persistent carts, one-transaction checkout into an issued
+  invoice, idempotent payment) but the public self-serve storefront UI —
+  cart page, checkout, order confirmation — does not exist yet; no route
+  outside admin calls the cart services.
+- **Two gaps, dispositioned.** There is no product collections/categories
+  taxonomy (schema-confirmed: only the invoicing tax-category key exists),
+  no faceted public browse and no storefront search. Both gaps are fix-now,
+  assigned to C3.25 (storefront commerce) and C2.24 (editor blocks); the
+  mapping feeds those items' gap lists. Deferred with reasons: live carrier
+  labels (documented adapter seam), theme marketplace (§36 anti-roadmap),
+  third-party analytics pixels (§36 anti-roadmap).
+- **The importer stays a bridge.** The Shopify connection imports paid
+  order/refund history only, within Shopify's documented limits (60-day
+  history, 500-page stop, orders and refunds as reviewable draft invoices) —
+  it does not import the catalog, which is what the native store owns.
+- **The checklist box stays open, deliberately.** C3.24's wording requires
+  every provable gap closed; closure lands via C3.25/C2.24, and the
+  f-criteria-matrix row updates to dated evidence at that closure. No gate
+  was weakened to flip it early.
+
+## C2.25 — the page is the canvas, slice B: drag-and-drop repositioning (box stays open)
+
+Slice A made the page's text and images editable where they render; slice B
+makes the page's *blocks* movable where they render. Both ride the same
+draft-broadcast/autosave pipeline the form panel has always used.
+
+- **Drag a block by its handle, watch exactly where it will land.** Every
+  block on the canvas shows a grip on hover and keyboard focus. Dragging
+  lifts a translucent, live-sized copy of the block that follows the
+  pointer; a line between blocks marks the insertion point, and a container
+  highlights its nest zone when a drop would put the block inside it.
+  Escape, or dropping outside a valid zone, changes nothing — the canvas
+  only ever shows an order the tree actually holds.
+- **Keyboard and screen readers are first-class, not an afterthought.** The
+  grip is a real button: focus it and the arrow keys reorder, announced by a
+  live region in the frame. Editor-side moves (the form panel's buttons,
+  Alt+Arrow) announce their new position in the editor itself.
+- **Every surface stays in the same order, immediately.** A move — from the
+  canvas, the keyboard, or the form panel — is one tree operation; the draft
+  broadcast re-sorts the rendered canvas in the same commit, and the
+  debounced autosave persists it. No frame reload stands between the gesture
+  and the preview agreeing.
+- **"Publish changes" lands (audit gap 8).** A published page shows a
+  draft/live chip and a single "Publish changes" action that saves and
+  publishes in one step — the live site is never unpublished mid-flow, so the
+  storefront cannot 404 while edits go out. Unpublish stays a separate,
+  deliberately-scary header action.
+- **Proof.** `tests/core/editor-canvas-drag.test.ts` (the shipped frame
+  script: start/move/cancel/drop → tree intents), `tests/core/editor-reorder.test.ts`
+  (canvas ↔ form-panel ↔ autosave sync) and the
+  `tests/browser/editor-drag-drop.spec.ts` journey: drag the home page's
+  heading below its intro on the canvas, watch "Saved", publish once, and
+  read the new order back from the public page — plus the keyboard path.
+- **No keystroke regression.** `PERF_MEASURE_EDITOR=1` on this machine:
+  100.5ms p95 keystroke→preview against the slice-A baseline's 100.6ms on
+  the same box — inside the documented 99–104ms harness floor (90ms typing
+  pacing + 100ms poll tick); the product path remains the same-commit draft
+  overlay. The re-sort pass is signature-gated so typing never pays for an
+  order that did not change.
+- **The checklist box stays open, deliberately.** Store-section composition
+  (product grids, collection layouts) is the next slice, and the UX audit's
+  remaining gaps — in-place structural updates beyond reorder, on-canvas
+  media editing beyond swap, undo/redo chrome, the true public-view preview —
+  are still on the item's list.
+
+## C2.25 — store sections and the audit-gap closure, slice C (box stays open)
+
+Slices A and B made the page editable and movable where it renders; slice C
+makes it *sell*. A page is now a storefront: the new collection showcase,
+product row and promotional band blocks pull live catalog data at render
+time, and the audit's remaining editor gaps that belong to this item close
+alongside them.
+
+- **Compose a storefront without leaving the editor.** The collection
+  showcase shelves a collection's current membership; the product row shows
+  the products you pick, in your order; the promotional band pairs your
+  headline, copy and call to action with a collection's live shelf on a
+  full-width band. Every shelf draws through the same public components the
+  storefront's own pages ship — a product added to a collection appears on
+  your landing page the moment it is requested, no republish, no stale
+  roster.
+- **Store sections are edited where they render.** Headings and button
+  labels type on the canvas; a swap button on the section raises a picker —
+  your collections, your products — and the pick saves immediately and shows
+  at once. Sections drag, drop and reorder like every other block (slice B).
+- **The canvas reload became invisible (audit gap 5).** A save stages the
+  next version of the frame off-screen and swaps it in only when it has
+  rendered; the old scroll position carries over. Structural edits stop
+  flashing the canvas.
+- **Undo and redo are visible (audit gap 6).** Buttons with disabled states
+  sit beside a history menu that names every edit — "Added the Collection
+  showcase block" — and jumps straight to one. Typing into a field coalesces
+  into a single step.
+- **Editing got its own surface (audit gap 10).** Focus mode gives the
+  canvas the whole screen at the page's true height, with persistent block
+  outlines, a zoom control and the desktop/mobile widths.
+- **Images gained alt text where they render** (the slice of audit gap 7 a
+  text patch can carry). The remainder of that gap — upload and crop/focal
+  in the canvas picker — is media-workstream; crop/focal exist nowhere in
+  the platform yet, so the C2.25 box stays open on that clause with a dated
+  annotation.
+- **Proof.** `tests/core/store-sections.test.ts` (palette, live-render,
+  layout choice, composition round-trip, locale parity),
+  `tests/core/editor-store-sections.test.ts` (undo chrome, history jumps,
+  staging reload, focus mode, canvas picks, alt editing) and the
+  `tests/browser/editor-store-sections.spec.ts` flagship journey: compose a
+  hero + featured-products row + collection band on an empty page, pick
+  products and bind the collection on the canvas, publish, read live shelves
+  and prices back from the public page, add a product to the collection and
+  watch the published page follow without a republish, then swap the band's
+  collection on the canvas and push it live with one "Publish changes".

package/dist/template/deploy/release-notes-2026-09-30.md

@@ -0,0 +1,50 @@
+<!--
+Copyright (C) 2026 Tony Aly
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Release notes — session digest 2026-09-30
+
+Product version remains **0.1.0**, in active development. This is a session
+digest, not a release-candidate announcement and not a claim of deployment.
+`CHANGELOG.md`, generated from `.changeset/`, is the canonical owner-facing
+change list. Refresh GitHub before treating anything below as shipped.
+
+## C2.25 — upload, crop and focal point on the canvas (box closed)
+
+The last open clause of the world-class visual editor: the audit's gap 7
+asked for a picker anchored to the image that can upload, pick, edit alt
+text and set crop/focal point without leaving the canvas. Pick and alt text
+landed in slices A and C; this closes the rest.
+
+- **Upload from the canvas picker.** "Upload image" sits at the top of the
+  image's anchored picker. The file travels the media library's own
+  resumable pipeline — the browser half now lives in one client
+  (`app/(admin)/admin/media/upload-client.ts`) shared by the library's
+  upload form and the canvas, so there is no second upload path — and the
+  Asset it becomes is applied to the block at once and joins the form
+  panel's choices. A refusal (type, size, scan) is shown in the picker and
+  leaves the block untouched.
+- **Crop and focal point are media concepts now.** The asset's focal point
+  (already editable in the media library, but honoured by no renderer) is
+  returned by `media.resolveImage`. The image block gains a frame shape
+  (`aspect`), a per-placement focal override and an optional crop
+  rectangle. A crop is a window onto the ordinary `<picture>` — same
+  srcset, same renditions, nothing re-encoded — drawn by one pure function
+  (`src/core/media/framing.ts`) that the public renderer, the canvas and the
+  crop tool's live preview share.
+- **The crop & focus tool.** Anchored to the picture on the canvas: click to
+  mark the subject, choose a shape, toggle a crop window with four corner
+  handles and a draggable body. Every control is a real button; arrows nudge
+  1%, Shift 10%. Apply is one undoable, structural edit that saves at once;
+  picking a different picture drops the old crop.
+- **No migration.** Focal columns already existed on `assets`; overrides and
+  crops are block props on the CMS tree, so revisions, draft/publish, export
+  and restore carry them unchanged.
+- **Proof.** `tests/core/media-framing.test.ts`,
+  `tests/core/editor-media-tools.test.ts`, the resolve assertion in
+  `tests/core/media.test.ts`, and the
+  `tests/browser/editor-media-tools.spec.ts` journey: upload on the canvas →
+  the reservation completes into a ready Asset → mark the subject, square
+  frame, crop → saved → publish → the public page draws the same square
+  window of the uploaded file.