create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/.changeset/access-from-grants.md

@@ -0,0 +1,14 @@
+---
+"freeholder": minor
+---
+
+What someone may use is now a grant, not a flag on the page. A membership,
+a class pass, a one-time unlock, a loyalty tier or a decision you make by
+hand all grant the same kind of access, and the site asks that question at
+the moment of looking rather than trusting a leftover checkbox.
+
+A membership starts a site-wide grant for the period already paid for.
+Pausing it takes the access away; cancelling at period end leaves it until
+the period runs out. Member-only products hide from strangers and show to
+whoever holds a grant. You can also grant and revoke access by hand from
+Access in admin.

package/dist/template/.changeset/accounting-exports.md

@@ -0,0 +1,32 @@
+---
+"freeholder": minor
+---
+
+You can now hand your bookkeeper a file their software will actually take.
+Under Reports → Accounting exports, define an export, pick whether it is for
+QuickBooks, for Xero, or a plain spreadsheet, and choose whether it goes out
+every week, month or quarter — or only when you press the button. Whoever you
+name gets an email with the figures and a link; the file itself is never
+attached, because it lists every customer and what they paid, and an inbox is
+not a safe place for that.
+
+The list shows the one thing that matters about a scheduled file: whether the
+mail provider accepted every recipient's copy. A later bounce changes that
+answer back to failed. A failed delivery says so in red, keeps the file so you
+can send it by hand, and waits for an explicit retry instead of mailing a bad
+address every hour. An export that should have gone out and did not is flagged
+at the top of the page rather than quietly not happening.
+
+Every recipient gets a separate private link that expires after 30 days. The
+raw token exists only inside the encrypted mail outbox and the email; Freeholder
+stores its HMAC and allows the download only after a delivering provider has
+accepted that recipient's message.
+
+Two things it deliberately will not do. It will not add two currencies
+together — one export covers one currency, and any invoices in another are left
+out of the file and counted separately, so a reconciliation that comes up short
+always tells you why. And it will not keep your books: there is no chart of
+accounts here, so the account code, tax code and product code go in once, from
+your bookkeeper, and get copied onto every row without Freeholder having an
+opinion about them. Refunds are reported beside the total rather than turned
+into credit notes for you.

package/dist/template/.changeset/ad-creatives.md

@@ -0,0 +1,33 @@
+---
+"freeholder": minor
+---
+
+Your ad positions now actually show ads.
+
+Upload the artwork, give it a click-through and a description, and it runs in
+the positions you sold it into — at the size those positions declare, on a
+laptop and on a phone, from one placement. A text-only sponsor line is there
+too, for a newsletter or a blog where a banner would look wrong.
+
+Space nobody has bought falls back to your own promotion, if you asked it to.
+Your own promotions need nobody's approval but yours; anything somebody paid
+for has to be looked at before it appears, and goes back for another look the
+moment its artwork or its destination is edited.
+
+Every ad is labelled as one, on the page, and there is no setting that turns
+that off.
+
+Visitors leave through your own link rather than the advertiser's, so a click
+is counted and the destination cannot quietly be swapped for a different one
+after you approved it. A link that has been tampered with goes nowhere.
+
+And when it is time to bill, a campaign raises an ordinary draft invoice
+against the advertiser's contact — the same invoice, tax and reporting path as
+anything else you sell. You issue it from the invoice, where the tax question
+is asked properly.
+
+One thing to redo if you were an early adopter: an ad position could previously
+carry its own house image and link, set on the position itself in the editor.
+That setting has gone, because it was a second, unlabelled kind of ad that none
+of your reports could see. If you had set one, create it as a house campaign
+instead and it will fill the same space — labelled and counted this time.

package/dist/template/.changeset/ad-inventory.md

@@ -0,0 +1,19 @@
+---
+"freeholder": minor
+---
+
+Sell advertising on your own site, if that is your business. Define the
+positions where ads appear, place them on pages like any other block, and the
+space is reserved at every screen size — so an ad arriving late never shoves
+the article down the page.
+
+An advertiser is a contact like everybody else, so the local bakery buying a
+banner and the local bakery buying prints is one person in your records, not
+two.
+
+Campaigns carry their own dates, rates, budgets and priority, and a paid one
+cannot go live until it has been approved. Your own house promotions skip that,
+because they are yours already.
+
+Line items say what runs where: which positions, which pages, which countries
+and devices, which days and hours, and how often one person should see it.

package/dist/template/.changeset/ad-measurement.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Ads now count first-party. An impression is recorded when the visible
+creative renders; a viewable impression after half of it has been on
+screen for one continuous second. Daily totals, unique visitors, clicks
+and spend roll up for the advertiser report. Even pacing and frequency
+caps come from those numbers. A per-thousand or per-click campaign can
+be reconciled against what actually delivered, on the same invoice.

package/dist/template/.changeset/ad-third-party.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Third-party ad tags are supported and off by default. An HTML tag or a
+named network creative only runs when the slot allows it and the visitor
+has granted a separate consent cookie. /ads.txt and /app-ads.txt are
+generated from the authorized-seller list the owner edits, so the file
+crawlers fetch cannot drift from what is actually authorized.

package/dist/template/.changeset/admin-ads.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Ads have their own admin screen. Define the positions you sell and which sizes each reserves per screen size, record who is buying, create campaigns with a price and a schedule, and say what runs where.
+
+A campaign carries an approval state you can see and set, because a sponsored placement should never reach a page without somebody having said yes.
+
+The screen states plainly that nothing is being served yet — inventory and sales exist, and creatives, house fill and counting are still to come — so a live campaign showing no impressions reads as the next piece of work rather than a bug.

package/dist/template/.changeset/admin-documents.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Documents have their own admin screens. Create one, add a revision, share it with a link, a password or a signed-in customer, set an expiry and a download limit, and see exactly who opened it — including who was turned away and why.
+
+A share link is shown once, when it is created, with a plain warning that it cannot be shown again: only its fingerprint is stored, which is what stops a copy of the database being a set of working links.

package/dist/template/.changeset/admin-loyalty.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Loyalty has its own admin screen. Set up the programme, say what earns points and how many, define tiers and rewards, see recent redemptions, and correct a balance with a reason that goes on the ledger row.
+
+What points are costing you is the first thing on the page, not the last: outstanding points valued at your own redemption rate, across however many customers hold them.
+
+Two gaps this turned up are fixed with it: there was no way to read back the earn rules you had configured, and editing a programme silently reset its minimum account age.

package/dist/template/.changeset/admin-referrals.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Referrals have their own admin screen. Set up the programme and how commission is calculated, issue codes to the people sending you business, build a payout run and download it as CSV for your bank, and record who still owes you tax paperwork.
+
+What is payable now and what is still held back are shown as two separate numbers, because the holdback is exactly the difference between what somebody has earned and what you owe them today.
+
+Before approving a payout run you can see who is on it and for how much — previously only the total was readable, which made approving a payment run a guess rather than a decision.

package/dist/template/.changeset/admin-shell.md

@@ -0,0 +1,16 @@
+---
+"freeholder": minor
+---
+
+There is an admin now. Sign in at /login and you land on an overview showing
+how many contacts you have and what stage they are at, plus a plain-English
+list of everything that has changed on your site — including anything an AI
+agent did on your behalf, named by the key it used.
+
+Settings are editable after setup, not just during it, so your business
+details, currency, time zone, languages and units are no longer fixed by the
+choices you made in the first two minutes. Every time zone and currency is
+selectable, not a short list.
+
+Signing out really ends the session on the server rather than just forgetting
+it in your browser, and the admin tells search engines not to index it.

package/dist/template/.changeset/adversarial-cms-boundaries.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+"@freeholder/sdk": patch
+---
+
+Keep unpublished page drafts, editorial notes and paywall bodies out of public API responses. Full page snapshots stay inside the server renderer, which checks the viewer's access before rendering gated content; owners and scoped agents use the existing page management services for editing.
+
+Serialize page changes and check the exact reviewed version when publishing. Keep newer typing unsaved until it reaches the server, and offer reload or reviewed merge after a publishing conflict. Rejoining a template now edits the working draft without changing a live page before publication.

package/dist/template/.changeset/adversarial-customer-invariants.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Correct booking availability to honor service and calendar capacity, shared-calendar busy time and buffers, and existing appointments against daily limits (C6.03, C6.19). Preserve membership cancellation when an in-flight automatic payment finishes and refuse automatic charges for ended memberships or unrelated invoices. Validate provider settlement amounts and currencies against canonical invoices (C9.33, C9.38).
+
+Keep contract prices private to the customer and authorized staff, show the customer's actual membership price before signup, and remove provider and internal fields from customer membership lists (C5.15, C8.17, C9.38).

package/dist/template/.changeset/adversarial-customer-privacy.md

@@ -0,0 +1,13 @@
+---
+"freeholder": patch
+"@freeholder/sdk": patch
+"@freeholder/mobile-app": patch
+---
+
+C8.03/C8.04/C8.07/C8.11/C8.13/C8.17/C11.10: block private gallery originals and stale ZIPs from bypassing access, watermark, guest and download rules. Byte authorization stays behind controlled gallery routes; old ZIPs require rebuilding. Customer list queries no longer disclose unsent quotes, draft invoices/documents, staff notes or unpublished case-study copy. Password resets are atomically single-use and invalid tokens cannot exhaust another link's allowance (B03). These adversarial repairs do not complete the independent security review.
+
+Gallery byte-authorizer services are internal; gallery session responses expose `viewUrl`, permitted `downloadUrl` and `archiveUrl` for controlled delivery. These routes accept the session token in `Authorization: Bearer <sessionToken>` or the browser cookie, without printing it in a URL. Migration 0023 marks existing client-gallery assets private. Object storage must also be private: these application checks cannot revoke previously delivered copies or signed URLs, or repair a publicly readable bucket.
+
+Client-gallery privacy applies to every use of the same asset, including public media and published project views. Migration 0023 also makes previously shared gallery assets private. Removing a file from its gallery does not automatically make it public again; use a separate public asset for public presentation with the required consent.
+
+C10.27/C10.30: mobile gallery image reads declare the controlled HTTP route separately from generated SDK services, preserving the encrypted cache lease and denial eviction.

package/dist/template/.changeset/adversarial-platform-safety.md

@@ -0,0 +1,15 @@
+---
+"freeholder": patch
+"@freeholder/sdk": minor
+"create-freeholder": patch
+---
+
+Preserve date-bearing MCP tool inputs using the same schema projection as HTTP and the SDK, and return protocol errors for malformed requests instead of crashing a batch.
+
+Validate encryption-key length and safe public origins during source-install preflight. Misconfigured origins cannot print embedded credentials in setup reports.
+
+Serialize campaign batches and start/edit operations, and stage each recipient's message with a stable idempotency key. Campaign copies now contain a private opt-out link and one-click unsubscribe headers through the supported bulk providers. Withdrawal records marketing-email consent on the contact spine; mail already queued checks that consent again before contacting a provider. Delivery refusals update campaign outcomes through the durable event outbox.
+
+Preserve previously sent opt-out links when contact merges deduplicate campaign recipients, including links inherited through repeated merges.
+
+Require an explicit POST to confirm newsletter subscriptions or withdraw through a browser link, so email scanners cannot change consent by fetching a URL. Repeated provider unsubscribe requests remain safe. Lock newsletter consent transitions so an overlapping old confirmation cannot undo an unsubscribe. Actual external delivery and provider signing acceptance remain open.

package/dist/template/.changeset/agent-approval-inbox.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+The approval inbox. Parked managed writes are decided in one place at `/admin/work/approvals`: approving executes exactly what the agent proposed, exactly once, in the same transaction as the decision and under the approver's own permissions; rejecting requires a note the record keeps; unanswered approvals lapse on schedule and release their tasks. Decisions demand a fresh second factor, only a person can make them, and a decided row is never rewritten.

package/dist/template/.changeset/agent-autonomy-writes.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Managed agent writes now honour the autonomy ladder. Suggest produces a proposal and never escalates, approve parks a previewed change, autonomous executes ordinary writes, and irreversible actions always wait for a person. Classification is declared on each service definition and fails closed: a mutation that never declared one queues for approval whatever the agent's autonomy. The gate refuses paused agents and paused connections, refuses proposals outside the agent's own scopes, and stores approved input verbatim while redacting every read of it. Previews cover block diffs, messages, money and destructive work.

package/dist/template/.changeset/agent-budgets.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Agent work now costs what it costs, and the cap holds. Every managed model turn is priced in whole cents — from published model prices, or the price you set on the connection — and checked against your budget *before* the turn is made, across the agent's period budget, the task's own ceiling and the run. A turn is asked for only as many output tokens as the budget can pay for, a run that cannot afford its next step stops and says so, and an agent with no budget or an unpriced model is stopped before it claims work rather than after it spends. What was actually spent lands in the ledger, `/admin/work/spend` shows it per agent and in total against the cap, and crossing 80% or the cap notifies you once per period.

package/dist/template/.changeset/agent-catalogue.md

@@ -0,0 +1,22 @@
+---
+"freeholder": minor
+---
+
+You can follow catalogues of ready-made playbooks now, and install from them.
+
+A catalogue is just a web address you decided to trust. There is no central
+store to be approved by, and Freeholder follows none until you add one.
+
+Before you install anything you see what it would be allowed to do, the
+instructions it would follow in full, who wrote it, and whether it works with
+the version you are running. Approving is approving those exact contents — if
+the catalogue changes the entry after you have read it, installing is refused
+and you are asked to look again.
+
+What arrives is instructions and nothing else. A definition that tries to bring
+along an API key, a connected account or a named worker is rejected outright
+rather than quietly cleaned up. What you install arrives switched off and
+pointed at nobody, for you to hand to a worker of your own.
+
+Freeholder remembers where everything came from — the catalogue, version and
+exact contents — even if you stop following that catalogue later.

package/dist/template/.changeset/agent-f04.md

@@ -0,0 +1,6 @@
+---
+"freeholder": patch
+---
+
+Owners can connect an agent runtime, hire and edit a worker, and export a
+playbook from /admin/work. Each action calls the existing agent services.

package/dist/template/.changeset/agent-injection-hardening.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Material an agent reads can no longer pretend to be an instruction from you. The frame around untrusted input is now an unguessable marker rather than a fixed tag — a customer writing the closing tag into a form can no longer break out of the quote — the platform's instruction sits on both sides of the quoted text, and tool results are quoted the same way, because business data is full of words customers wrote. A new gate keeps the exfiltration surface honest: any tool an agent is offered that accepts a URL has to be listed with the reason it is safe, and it immediately caught playbook controls being advertised to API keys that could not use them.

package/dist/template/.changeset/agent-pause-kill-switch.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Pause now means stop. Pausing one worker — or hitting the kill switch for all of them — ends the runs they are holding instead of leaving them to finish the rest of a ten-minute lease: each run is cancelled, its lease cleared, and its task handed back to the queue so nothing is lost. A managed run in flight notices within one turn. Both controls live on the work board as ordinary buttons that work without JavaScript, because the moment you need them is the worst moment to discover a page did not load.

package/dist/template/.changeset/agent-playbooks.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Playbooks: work you want done more than once, written once. A playbook is a brief, the details it needs, what starts it, and a ceiling on what the resulting work may do. Editing the wording writes a new version, so a task can always be read against the instructions it was actually given rather than the ones the playbook carries today. Playbooks can run by hand with the details filled in, or start themselves when something happens — and when an event starts one, the payload arrives as quoted data in the task rather than as words inside your brief. They are plain data: export one as a document with no credentials or bindings in it, and an imported one arrives switched off until you turn it on.

package/dist/template/.changeset/agent-run-live.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+A live run view shows redacted steps as they arrive. The owner can stop an active run (the lease is revoked immediately), cancel work and have any running attempt end with it, or retry parked work so it can be claimed again.

package/dist/template/.changeset/agent-work-board.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+The admin now has a work board for agent tasks: queued, running, waiting on you, needs attention, and done. You can filter, assign, set priority and due dates, park work that needs a person, and send it back to the queue. Nested work stays on the same root instruction.

package/dist/template/.changeset/agents-inbound.md

@@ -0,0 +1,31 @@
+---
+"freeholder": minor
+---
+
+Your agents can now actually do the work. An agent you already run — your own
+Claude, an assistant, a script — connects with the key you gave it, asks for
+the next task, reports what it did as it goes, and says how it turned out.
+
+You do not have to host anything new for this. The agent runs wherever it
+already runs; your site is what holds the queue, decides who gets what, and
+keeps the record.
+
+Work is handed out one task at a time, highest priority first, and never to two
+agents at once. A task waits for anything it depends on. Each agent takes only
+as much at a time as you allow, and stops entirely once it has spent the budget
+you set — an agent with no budget cannot spend anything at all, which is the
+default.
+
+If an agent disappears mid-task — its machine sleeps, its process dies — your
+site notices within about ten minutes, takes the work back, and offers it to
+somebody else. A task that fails three times stops being retried and moves to
+"needs attention", so work never quietly stops without you finding out.
+
+When a task involves something a customer wrote, the agent is told plainly to
+treat it as material to act on rather than instructions to follow, and to
+propose rather than act.
+
+One thing worth knowing: what an agent *can* do is set by the access you gave
+its key, and that is enforced on every single action. The independence level
+you choose shapes how it behaves within that. So give an agent the access you
+would be comfortable with it having unsupervised.

package/dist/template/.changeset/agents-model.md

@@ -0,0 +1,27 @@
+---
+"freeholder": minor
+---
+
+Your site can now employ agents. Connect one — your own Claude, an assistant
+you already run, or later a hosted model — and create workers on top of it:
+named, with a role, a written brief, their own limited access, a budget and a
+level of independence you choose.
+
+Work is organised as tasks. You can create them, assign them, and watch an
+agent break a big one ("clear the inbox") into small ones ("reply to Rae"),
+with everything that came out of one instruction grouped together.
+
+Three things are true by construction rather than by good behaviour. Each
+worker gets its own credential, so everything it does appears in your activity
+log under its name and you can revoke one worker without touching the others.
+You choose how independent each worker is — suggest only, ask before changing
+anything, or work alone — and a task can only ever be *more* cautious than its
+worker, never less. And anything that came from a customer — an email, a form
+submission — is marked as such, is given to the agent as quoted material rather
+than as instructions, and can never be worked on independently, however the
+worker is configured.
+
+There is one button that pauses every agent at once.
+
+This release is the foundation: agents can be connected, hired and given work,
+and you can see all of it. Agents actually carrying out the work comes next.

package/dist/template/.changeset/alt-text-suggestions.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Add generated image alt-text suggestions with an optional OpenAI vision
+adapter, a separate review ledger, explicit edit/accept/dismiss actions,
+stale-write protection, human-only provider calls, doctor diagnostics, and a
+localized review interface. Authored alt text is never changed by generation.

package/dist/template/.changeset/analytics-governance.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Add instance-wide analytics consent modes, bounded configurable retention with
+daily pruning, reversible bot-classification corrections, consented Core Web
+Vitals, privacy-bounded campaign attribution, and k-anonymous aggregate export.

package/dist/template/.changeset/analytics-proxy-origin.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+Analytics consent reconciliation now recognizes the instance's configured
+public origin when Freeholder runs behind a loopback reverse proxy. Cross-site
+origins remain refused, while the browser no longer receives a false 403 on an
+ordinary page load through nginx or Caddy.

package/dist/template/.changeset/analytics.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+You can now see your own traffic: how many people visited, what they read,
+where they came from, and which of them became enquiries. It is counted by your
+own server rather than by a script in your visitors' browsers, so ad blockers
+do not change the numbers and nothing about your audience is sent anywhere. And
+when somebody fills in a form, the pages they read *before* deciding to get in
+touch are attached to their contact record.

package/dist/template/.changeset/apache-license.md

@@ -0,0 +1,15 @@
+---
+"freeholder": major
+"create-freeholder": major
+"@freeholder/sdk": major
+"@freeholder/templates": major
+---
+
+License Freeholder-authored code, documentation, deploy tooling, SDKs, and
+templates under Apache License 2.0. Package manifests and distributable license
+files now use `Apache-2.0`, source headers are consistent across the monorepo,
+and the licensing gate verifies all three surfaces.
+
+Previously released AGPL-3.0-only core and MIT package versions keep their
+original terms; Apache-2.0 applies from this change forward. Bundled third-party
+assets continue to retain their own license notices.

package/dist/template/.changeset/api-keys.md

@@ -0,0 +1,19 @@
+---
+"freeholder": minor
+---
+
+You can now give a script, an app or an AI agent its own key, instead of
+sharing your password. Settings → API keys mints one, and you choose what it
+can reach area by area: no access, read only, or read and change. Most keys
+should be small — a reporting script needs to read your contacts and nothing
+else — and the picker makes that the easy choice rather than the diligent one.
+
+A key is shown exactly once, when you create it. Only a fingerprint of it is
+kept, so nobody who gets into your database gets a working key, and nobody
+including us can show it to you again. If you lose one, revoke it and make
+another. Each key records when it was last used, which is the only question
+that matters about an old one: is anything still using it?
+
+Keys cannot create or revoke keys. A key that could would be a way to turn a
+small key into a big one, which would make choosing its access pointless.
+Issuing credentials stays something a person does while signed in.

package/dist/template/.changeset/arabic-rtl-catalog.md

@@ -0,0 +1,23 @@
+---
+"freeholder": minor
+---
+
+Arabic ships as a complete UI catalog. All 6,340 English strings now have a
+Modern Standard Arabic counterpart in `locales/ar.json`, ICU placeholders and
+plural contracts preserved exactly, so the parity gate covers it like French
+and Spanish. It is labeled AI-drafted pending native review in
+`locales/README.md`, honest about provenance the way the fr and es catalogs
+are.
+
+Enabling Arabic in Settings flips the whole admin, storefront and portal to
+right-to-left automatically: the root layout already derives `dir` from the
+locale's script, and the real-browser accessibility suite now proves it —
+`html[lang=ar][dir=rtl]`, axe WCAG A/AA in both asserted themes, the bypass
+link and 12-stop keyboard loop, and the 320px reflow refusal all run against
+the catalog rather than an injected direction attribute. The same pass covers
+populated contact, invoice, product and appointment forms, and ten owner
+screens that were missing from the accessibility scan.
+
+Arabic-speaking customers also get the legally protected SMS control words:
+STOP/START/HELP now recognise Arabic keywords, and the mandatory compliance
+replies answer in Arabic for an Arabic-preferred contact.

package/dist/template/.changeset/assistant-grounding.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+The optional assistant now quotes from what you have actually published.
+Published pages, the catalog, opening hours and owner-written notes
+(facts, Q&As, policies) are indexed in Postgres. A change to any of
+those rebuilds the index. Switch a note off and it leaves the index.
+The assistant is told to quote only from those notes; if a price or
+opening time is not there, it says it does not have it to hand.

package/dist/template/.changeset/assistant-guardrails.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+The optional assistant will no longer invent a price or an availability it
+did not read. Topics you mark as refuse never reach the model; topics you
+mark as escalate offer the contact form and hand the chat to a person.
+Unanswered questions queue in admin so you can turn yesterday's failed
+answer into a note in one click. The transcript was already on the
+contact; the contact's timeline now records that the assistant replied
+or refused.

package/dist/template/.changeset/attested-facts-and-corrections.md

@@ -0,0 +1,11 @@
+---
+"freeholder": patch
+---
+
+C8.15: Published figures now carry where they came from and when they were true, and correcting one never erases what it replaced. `core/attestations` is a single table behind a rate, a metric, an opening status and a byline, because they are the same thing — something the business asserts, that somebody stood behind, at a moment that can be named. Storing them one way is what makes "no unattested claim" a rule the codebase can keep rather than a promise each module re-makes in its own way.
+
+Nothing is ever edited. A correction is a new row that supersedes the old one, and the old one keeps its value, its source and its dates — so the correction ledger the two publishing editions asked for is the storage model rather than a feature beside it, and a rate history exists without anybody building one. Two guarantees sit in the database rather than the service: `attestations_current_idx` allows exactly one current fact per key and subject, so "what is the rate today" can never have two answers that differ by row order, and `attestations_one_correction_idx` allows a fact to be superseded once, so the history cannot fork. The first is written by hand because a business-wide figure has no subject, and NULLs do not collide in a plain unique index — every such fact would otherwise have been exempt from the one rule that matters most.
+
+The service refuses more than it accepts, deliberately. Asking for a fact nobody stated returns null: no fallback, no last known value, no neighbouring subject, because a surface with nothing to say should say nothing. A correction dated earlier than the value it replaces is refused as a typo rather than accepted into a ledger that would then read backwards. A fact past its `validUntil` is returned and marked stale rather than hidden, since "we last knew this on Tuesday" is honest and silence about a number the business published is not. Withdrawing unpublishes everywhere without deleting the row.
+
+Owners work at `/admin/facts`, sorted by as-of rather than by key so the oldest thing still on the public site is the first thing they see. There is no edit button anywhere in it. The ledger page shows what the figure is now above everything it has been, each with its date, its source and why it changed. Staff hold a read grant on the module — the administrator and legacy staff seeds can see the ledger but every write is refused to them — so checking a published figure never requires the keys that change it. A `fact` block renders one on a page with its date and source together — never the number alone — and can show the corrections publicly, because a correction only the owner can see is not a correction.

package/dist/template/.changeset/audit-search-and-proof.md

@@ -0,0 +1,34 @@
+---
+"freeholder": patch
+---
+
+Global search now requires the actual read permission for each kind of record.
+An API key limited to contact writes can no longer use search to read contact
+names or email addresses; notes, tasks and conversations use their own grants.
+
+Completion checks now test realistic performance datasets and scan 22 more
+admin lists for accessibility in both themes (C11.10–C11.12, C11.14–C11.15).
+
+Community members and moderators must now sign in. Knowing another member's
+email no longer reveals gated posts or lets someone write or moderate as them.
+Unconfigured print, marketplace, and voice/video providers report failure
+instead of simulated success. Contacts imported together now paginate in a
+stable order without repeating people (C3.13, C11.10–C11.11, C11.15).
+
+SDK generation now refuses to report success when its live-registry step was
+skipped (C3.03, C11.15).
+
+Managed agents can no longer propose or execute private service phases. Capture
+session IDs require media access, upload staging is internal, and phone links
+can bind only their own uploads (C4.03–C4.04, C1.29, C11.09).
+
+Print-provider acceptance no longer marks an order shipped or presents the
+vendor order identifier as a carrier tracking number (C3.13).
+
+Print and voice/video provider claims now exclude simultaneous retries (C3.13).
+
+The upgrade gate now fails when its previous image cannot be pulled instead
+of reporting an unverified upgrade as a successful first-release skip (C11.15).
+
+Marketplace sync now uses expiring leases to exclude competing workers and
+imports each contact, invoice and channel order atomically (C3.13).

package/dist/template/.changeset/autofill-safety.md

@@ -0,0 +1,22 @@
+---
+"freeholder": patch
+---
+
+Fixed a way a real enquiry could be marked as spam.
+
+Every form carries a hidden field that only an automated script should ever
+fill. It was called "website_url" — and that is a name password managers and
+iPhone autofill recognise, so a visitor accepting their own saved contact
+details could have it filled in for them without ever seeing it. Their genuine
+enquiry then landed in the spam queue.
+
+The field is now named for something no browser or password manager reaches
+for, and carries the opt-out markers 1Password, LastPass and Bitwarden read.
+Turning autofill "off" is only ever a request, and iOS ignores it, so it can
+never be the only defence.
+
+Freeholder now also refuses to build if any submit button is greyed out because
+an autofillable field looks empty. Browsers fill those fields without telling
+the page, so a button gated that way stays dead over a form the person can see
+is complete — no error, nothing happening, indistinguishable from a broken
+site. Nothing in Freeholder did this; the check is there so nothing ever does.

package/dist/template/.changeset/automation-guardrails.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Automations now ask permission before they act. One check, before the step that would do something: does this person still consent, is there budget left, does this need your say-so, and is it a reasonable hour where they are.
+
+Anything triggered by something a stranger typed — a form, an inbound message — can only propose, never act, however you configured it. That limit belongs to the whole run, so it cannot be shed by passing through a harmless step first.
+
+Quiet hours hold a message until morning rather than dropping it, and the run picks up exactly where it paused.

package/dist/template/.changeset/automation-runtime.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Automations run. A rule can wait days between steps, branch on what actually happened, repeat a fixed number of times, hold for your approval, and stop — and you can watch every step it took, kill one mid-flight, or see why one stopped.
+
+A waiting automation is a row rather than a running process, so a two-day delay survives a deploy, a restart or a crash. The same event arriving twice runs the automation once. A rule set to run once per person runs once per person, and a cooldown holds somebody back until it has passed.
+
+A run remembers which version of the automation it was following, so editing the rule tomorrow never changes what yesterday's run was doing.

package/dist/template/.changeset/automations-builder.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Automations can be built, checked and published. An automation triggers on an event the platform actually emits — chosen from a real list, not typed — or on a schedule, and its steps are a mix of things modules can do and prompts written into the automation itself.
+
+Nothing runs yet. This is the part that lets an owner draw a rule and be told, before it is ever switched on, exactly what is wrong with it: a loop with no limit, a step nothing reaches, an action that needs a customer in an automation that has none. Every problem at once, not the first one.
+
+Publishing writes a version that never changes afterwards, so a rule that misbehaves later can still be read against the wording it actually had. Restoring an old version fills the draft rather than rewriting the history.