create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/.changeset/availability-resolver.md

@@ -0,0 +1,29 @@
+---
+"freeholder": minor
+---
+
+Freeholder can now answer "what can I book?".
+
+The answer is worked out fresh every time it is asked, from your opening hours,
+the days that break them, what is already booked, and the busy time synced from
+your own connected calendar. Nothing is cached, because a cached answer is a
+double-booking waiting to happen.
+
+Buffers are taken seriously. If a service needs fifteen minutes either side, or
+forty-five minutes of travel, a slot that would leave you without that time is
+never offered — not offered and then refused.
+
+Services that need two things at once work properly. A treatment needing a
+therapist *and* a room only shows times when both are free, and will use your
+second room when the first is taken. It picks them together rather than picking
+the person and hoping a room is spare.
+
+If several people can do a job, a customer asking for one of them by name sees
+that person first without the others being hidden. If you would rather spread
+the work, round-robin shows each time once and gives it to whoever has least on.
+
+Classes count places rather than slots: a group of three is not offered a
+session with one seat left.
+
+Your notice period, how far ahead people may book, and a daily cap if you set
+one are all respected.

package/dist/template/.changeset/availability.md

@@ -0,0 +1,23 @@
+---
+"freeholder": minor
+---
+
+Calendars have hours now. Open a calendar and set its week — from and until for
+each day, with a separate on-call band for hours somebody is reachable but not
+bookable. Leave a day empty and it is closed.
+
+Days that break the pattern are separate: a bank holiday, a late start after
+training, an extra Saturday, or a Christmas closure spanning two weeks. A day
+listed there overrides the weekly hours completely, and a closure always wins —
+if you have somehow written both a closure and an opening for the same day, the
+day stays shut, because that is the reading that will not take a booking you
+cannot honour.
+
+Hours are written as local times and stay put when the clocks change. Nine in
+the morning is nine in the morning in March and in July.
+
+Nothing is precomputed. When something asks when a calendar is open, the answer
+is worked out from the pattern and the exceptions at that moment — so a closure
+you add takes effect immediately rather than when a cache happens to expire.
+
+The engine that turns these hours into bookable slots comes next.

package/dist/template/.changeset/booking-audiences.md

@@ -0,0 +1,24 @@
+---
+"freeholder": minor
+---
+
+You can now decide who is allowed to book you, and on what terms.
+
+The example this is built around: customers can book you during shop hours,
+your friends can book you any time, and your dentist appointment blocks both
+without telling anybody it is a dentist appointment.
+
+An audience says how someone proves they belong — anyone at all, a private
+link, a tag on their contact record, or simply being signed in — and then which
+hours apply to them, which services they can book, which calendar the booking
+lands on, and how much notice they need to give. Set it once per group.
+
+Busy time always blocks everybody. That is not a setting and never will be: a
+booking system that can double-book you is worse than none.
+
+A private link is a credential, so it is handed over once rather than sitting
+on the page, and you can rotate it — the old link stops working immediately.
+
+An audience you have not given any services to cannot book anything, on
+purpose. And removing an audience never touches appointments already made:
+those are in someone's diary.

package/dist/template/.changeset/booking-race-message.md

@@ -0,0 +1,15 @@
+---
+"freeholder": patch
+---
+
+Fixed: when two people booked the last slot at the same moment, the one who
+lost sometimes saw a database error instead of "that time was taken while you
+were booking it".
+
+The booking itself was always correct — one person got the slot, never both.
+But Postgres has three different ways of saying "somebody got there first"
+depending on exactly how the two requests overlapped, and only one of them was
+being turned into a sentence. The other two reached the person as raw SQL.
+
+All three now say the same thing, because to whoever lost they mean the same
+thing.

package/dist/template/.changeset/bookings.md

@@ -0,0 +1,28 @@
+---
+"freeholder": minor
+---
+
+Appointments exist. Book one at /admin/appointments — pick a calendar, a time
+and a customer, and it lands in the diary.
+
+The customer is matched by email against the contact you already have. Someone
+who booked with you last year is the same person, not a second record.
+
+Two things about a time being taken. First, Freeholder refuses to double-book,
+and it refuses in the database rather than in the screen — so two people
+clicking at the same moment for the last slot cannot both succeed. Second,
+back-to-back is allowed: an appointment may start exactly when the last one
+ends.
+
+A class or a group session works differently on purpose. Give a calendar a
+capacity and it takes that many people at once, counts the seats, and says how
+many are left when someone tries to book past it. A guest with no email address
+can be added by name — "and my sister" is a real booking.
+
+Appointments move through confirm, start, done, no-show and cancel, and a
+finished one cannot be quietly reopened; you book a new one instead.
+Cancelling asks why, because that reason reaches the customer. Moving an
+appointment keeps a record of where it was.
+
+Everything that happens shows up on the customer's timeline, next to their
+invoices and enquiries.

package/dist/template/.changeset/boot-in-request-graph.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Fixed modules not actually being wired up on a running instance: features that
+react to something happening elsewhere in the platform — like your site being
+created when you finish setup — silently did nothing.

package/dist/template/.changeset/bot-detection.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Traffic figures now tell people apart from crawlers properly — using a
+maintained list of known bots plus the shape of each request, which catches
+scrapers that copy a real browser's name. Crawler visits are still recorded, so
+you can switch between "people" and "people and programs" on the traffic screen
+and see how much was set aside either way.

package/dist/template/.changeset/briefing-delivery.md

@@ -0,0 +1,21 @@
+---
+"freeholder": minor
+---
+
+Any playbook can now report into your briefing. Write the prompt, pick the
+schedule, tick "report into my briefing", and what the work found turns up as
+its own section each morning — in the agent's own words, not a summary of a
+summary. If a run failed, the section says so, because a playbook you asked to
+report on is one whose silence you would read as "nothing to report".
+
+Each playbook gets its own section, so you can hide one without hiding the
+others, and hiding never stops the work.
+
+Your briefing also leaves the admin now. When it is ready, it goes out through
+the notifications you have already set up — inbox, email, text or push,
+whichever you chose — so a briefing from Monday still reaches you if you do not
+sign in until Thursday. Quiet hours and digests apply as they do everywhere
+else.
+
+It only sends when there is something in it, and only once a day however many
+times the day is rebuilt.

package/dist/template/.changeset/briefing-sections.md

@@ -0,0 +1,22 @@
+---
+"freeholder": minor
+---
+
+Your daily briefing now has things in it.
+
+It tells you what is on today, pulled from the calendars you have shared with
+the business — and where a calendar does not share detail, it says "busy"
+rather than quietly showing a title you asked it not to store.
+
+It tells you about new enquiries since yesterday morning, so a Monday briefing
+covers the weekend, and about invoices that are past due, showing what is still
+owed rather than what was originally billed.
+
+Most importantly, it tells you when the platform itself is unhappy: an AI agent
+waiting for you to approve something, work that failed, a webhook that switched
+itself off after too many failures, a connected account that needs
+reconnecting. All of those are quiet by design — nothing retries forever and
+nothing wakes you at 3am — which is exactly why they are collected here, once a
+day, where you will actually see them.
+
+Sections you have nothing in are left out entirely. A quiet day says so.

package/dist/template/.changeset/browser-journeys.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+Repair first-boot setup before mandatory owner two-factor enrollment, fix the
+security-page recovery-count render, and enforce the complete owner workflow
+with production-Chromium journeys through setup, auth, CMS, forms, contacts,
+translations, API keys, MCP and password recovery.

package/dist/template/.changeset/builder-code-lane.md

@@ -0,0 +1,25 @@
+---
+"freeholder": minor
+---
+
+The builder can write code now, and it still never runs any on your site.
+
+Ask it for something that needs real code — a new block type, an integration —
+and it proposes a plugin: a set of files, checked, and handed to you as a pull
+request against your own repository, or as a patch if you have not connected
+one. Your CI builds it. Your merge deploys it. Nothing is compiled or executed
+on the machine serving your visitors.
+
+Before a proposal can leave, it has to get past a set of checks, and it is told
+all of them at once rather than one at a time. Everything must live inside its
+own plugin folder — it cannot touch Freeholder's core, another plugin, or your
+deploy setup. No credentials in files. No migrations that drop or delete data.
+A licence header on every file. Small enough that a person can actually read it
+before merging.
+
+If a proposal fails a check, it is kept along with the reason, so you can see
+what it tried to do.
+
+Building code stays a separate permission from everything else. A key you give
+an assistant to read your calendar cannot change your site, and no key at all
+can write code — that stays with you, signed in.

package/dist/template/.changeset/business-presets.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+"@freeholder/templates": minor
+---
+
+Creator, service-business and shop now install as real starter sites: Bench
+colours, pages you can edit, a first product or session, and a letter with
+the right slots — not just a list of intended shapes.

package/dist/template/.changeset/business-settings-and-csrf.md

@@ -0,0 +1,17 @@
+---
+"freeholder": minor
+---
+
+Your business details now live in the platform: name, tagline, what kind of
+business you are, country, language, currency, timezone, units and which day
+your week starts on. Everything public reads from that one record, so changing
+your business name changes it everywhere at once rather than in six places.
+
+First-run setup knows what it still needs and locks itself once finished, so
+nobody can walk through the wizard again on a live site. Modules can be turned
+on and off, except the core, which cannot be switched off — doing so would lock
+you out of your own site.
+
+Requests that change anything now have to prove they came from your own pages,
+so another website cannot make your browser act on your behalf while you are
+signed in.

package/dist/template/.changeset/c11-08-restore-drill.md

@@ -0,0 +1,20 @@
+---
+"freeholder": patch
+---
+
+C11.08's open clause — restore on another Tier-1 target — is closed by a live
+drill, not another simulated pair: a real export from the running `freeholder-
+ref` droplet (6,918,459-byte archive, SHA-256 `e7852732…a46279123`, plus a
+374-table logical ownership export), a second droplet `freeholder-restore`
+provisioned from the digitalocean-droplet recipe, a restore through the
+recipe's own `pg_restore` operation into an empty database, and verification
+before any cutover. The target re-export matched the source on 366 of 374
+tables with every owned total exact (the 8 differing tables are the live
+target app's own operational churn); `pnpm doctor` against the restored
+instance finished 16 ok / 14 warn / 0 fail; and the seeded public page served
+200 through the target's Caddy. The media leg is recorded honestly: the
+dataset seeds 10,000 media rows with zero object bytes, so the manifest
+round-tripped identically while `media:transfer`'s local-disk guardrail fired
+as designed — a source-data finding, not a restore failure. Full record in
+`deploy/c11-08-restore-summary.md` and the dated drill log in `deploy/`;
+MASTER.md §43 C11.08 now carries the dated F04/F05/F07/F09/F12 evidence.

package/dist/template/.changeset/c11-12-f04-axe.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+More admin list screens now go through the same accessibility check as
+Overview: Search, Retention, Payments, Text messaging, Pipeline, Products,
+Redirects, Pages, Community, and Voice and video. This is not every admin
+screen, and it does not ship an Arabic catalog.

package/dist/template/.changeset/c11-14-retention.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Keep notes and other user-owned records only as long as you choose. Set a
+retention policy per kind, apply it from Admin → Retention, and privacy
+holds still win. This is not undelete for every row, and it does not put a
+clock on every table (C11.14).

package/dist/template/.changeset/c11-14-search.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Search across the records you already own. Type one query in admin Search and
+it looks through contacts, conversations, notes, tasks, invoices, pages, media,
+products, quotes, projects and galleries you have access to — the same
+Postgres rows, not a second index to keep in sync.
+
+Staff only see kinds their role can already open. This is not undelete for
+every row, and it does not add a retention clock to every table (C11.14).

package/dist/template/.changeset/c11-journeys.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Cross-module C11.01–C11.08 journey proofs: visitor-to-paid, catalog fulfillment,
+booking/loyalty, capture/gallery/social, subscriptions, agents, mail/calendar,
+and demo/update rollback. Adapter doubles stand in for live charges and OAuth.

package/dist/template/.changeset/c11-ops.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+WordPress and generic-site import now writes real CMS pages on commit and
+publishes them on cutover. A performance-budget harness can fail CI when the
+small-dataset server clocks exceed the §15.1 caps. Failure drills cover
+database, storage, mail, payment, SMS, OAuth and interrupted-update recovery.

package/dist/template/.changeset/c11-quality.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+Quality remainder: colour tokens now cover CSS and package palettes, health
+reports the real version rather than 0.0.0, release notes exist as CHANGELOG.md,
+and accessibility checks reach more admin and portal screens in French, Spanish
+and RTL.

package/dist/template/.changeset/c1111-reference-acceptance.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C11.11 §15.1 reference-target acceptance evidence: the run passed all thirteen performance budgets on the provisioned 1 vCPU / 1 GB droplet against the verified medium dataset (5,000 contacts / 20,000 messages / 2,000 orders / 500 products / 10,000 assets). Complete evidence — every command, raw sample and computed percentile — is archived at `deploy/perf-reference-run-2026-09-27.log`, with the summary in `deploy/performance-measurements.md`. No gate was weakened and no budget was raised; the checklist box itself stays open per the C11.16 spec-reconciliation gate's ordering rule, with the flip left to that workstream.

package/dist/template/.changeset/c1111-reference-target-closure.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C11.11: checked. The 2026-09-27 reference-target acceptance run passed all thirteen §15.1 performance budgets on the provisioned `freeholder-ref` droplet with complete archived evidence (`deploy/perf-reference-run-2026-09-27.log`, summary in `deploy/performance-measurements.md`); the box stayed open only because the C11.16 spec-reconciliation gate ordered it so. This change is that gate's flip: the reconciliation table (`deploy/spec-reconciliation.md`) was re-run against the current tree — C3.13's and C11.08's closures recorded, the mobile-app rows re-cast as v2-deferred per §43.18, C3.24 recorded as the remaining product item — and the reconciliation test re-aimed to require C11.11 checked instead of unchecked, the same way C11.08's check arrived with its re-aiming. No gate was weakened: the test still requires C11.10, C11.16 (gated on C3.24) and C11.17 open, and the owner signature remains blank. C11.16's own annotation and the §43.1 header cells are updated to match.

package/dist/template/.changeset/c224-inline-canvas.md

@@ -0,0 +1,13 @@
+---
+"freeholder": minor
+---
+
+The page is now the canvas. In the page editor, click the text on the
+rendered preview and type: headings, paragraphs, FAQ questions and
+answers, video captions and button labels all edit where they render,
+keeping their formatting as you type, and every keystroke still flows
+through the same debounced autosave as the form panel. Click an image
+and a Replace button on the picture opens the asset picker right there,
+swapping the image on the canvas the moment you choose — no separate
+preview step for ordinary edits. The form panel stays beside the canvas
+for the advanced things: links, alignment, alt text, SEO.

package/dist/template/.changeset/c224-merchandising-blocks.md

@@ -0,0 +1,19 @@
+---
+"freeholder": minor
+---
+
+Storefront commerce blocks for the page editor. The palette now offers a
+Product grid (pick a collection — manual or rule-driven — and the
+collection page's own shelf renders on the page: sort links, optional
+filter facets, crawlable pagination, add-to-cart on every card), a
+Featured collection (the collection's hero plus its curated front), a
+Product search block (term search scoped to the page, facets and sort
+included) and a Buy button (one product's variant picker or direct add,
+exactly as the shelf renders it). The product card block joins the same
+buy flow, and the product detail block's buy panel is confirmed on it.
+Collection and product blocks pick their subject from the admin's
+anchored picker — the same choice list drives the form select and the
+on-canvas Replace button — and product grids emit the collection pages'
+ItemList structured data. Chrome ships in English, French, Spanish and
+Arabic, and a composed page is browsable, filterable and shoppable the
+moment it publishes.

package/dist/template/.changeset/c225-canvas-caret-swap.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Typing on the canvas right after a save no longer loses letters. When an edit saved, the canvas loaded the new version out of sight and swapped it in the moment it was ready — even if you had already clicked into the next paragraph and were typing, so the rest of what you typed went into a copy of the page you could no longer see. The canvas now waits for you to finish (press Enter, click elsewhere, or leave the canvas) before it swaps, and a click on the canvas during that moment — on a replace-image button, say — still does what you pressed.

package/dist/template/.changeset/c225-canvas-drag-drop.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Blocks move on the canvas itself, the way the page will actually ship them. In the page editor every block shows a drag handle on hover and keyboard focus: dragging lifts a translucent, live-sized copy of the block that follows the pointer, a line between blocks (or a highlighted nest zone inside a container) shows exactly where it will land, and Escape — or dropping outside a valid spot — changes nothing. Arrow keys on a focused handle reorder the same way, and every move is announced to screen readers. The canvas, the form panel and the saved draft stay in the same order without waiting for a frame reload, and a published page gets a single "Publish changes" action that updates the live site without unpublishing it first.

package/dist/template/.changeset/c225-canvas-media-tools.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Pictures can now be uploaded, cropped and focused where they render. The image picker on the editor canvas has an "Upload image" button: the file goes through the same resumable upload the media library uses — a dropped connection picks up where it stopped — and the new picture lands on the block the moment it is ready, with no trip to the library. A "Crop & focus" button on any image opens a crop tool beside it: click the picture to mark its subject, choose a frame shape (original, wide, landscape, square or portrait) and, if you want, drag a crop window with corner handles. Every control also works from the keyboard. A small preview shows exactly what the page will show, Apply saves at once and can be undone in one step, and your original file is never altered — the same photograph can be a wide banner on one page and a square on another. The focal point you set in the media library is now honoured whenever an image is framed tighter than its own shape.

package/dist/template/.changeset/c225-store-sections.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Store sections turn a page into a storefront without leaving the editor. Three new blocks compose live catalog data onto any page: the collection showcase shelves a collection's current membership, the product row shows the products you pick in your order, and the promotional band pairs your copy and call to action with a collection's live shelf and a full-width band behind it. Every shelf draws through the same public components the storefront's own pages ship, so a product added to a collection appears on your landing page the moment the page is requested — no republish, no stale roster. On the canvas the sections behave like everything else you edit: headings and button labels type where they render, a button on the section opens a picker to swap its collection or re-pick its products, and the change saves and shows immediately. The canvas itself got the audit's remaining editor fixes: structural edits reload the frame invisibly instead of flashing it, undo and redo are visible buttons with a history menu that lists every edit, images can be given alt text where they render, and a focus mode gives editing the whole screen with the page at its true height, persistent block outlines and a zoom control.

package/dist/template/.changeset/c313-live-paradise-acceptance.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C3.13: Live Paradise Comms acceptance against production paradisemodern.com closes the item. Full journey through the voice/video service surface on the deployed droplet: real room (PM `POST /v1/rooms` → `rm_` id), LiveKit credentials minted by Freeholder with a headless-Chromium media participant connected to the production SFU (1,888,138 bytes published), provider-confirmed end (`media_ended: true`), recording egress + owner-storage import (51,369 bytes, row sha256 matches the file on disk), and the erasure round-trip (PM DELETE → re-GET 404 → owner copy deleted → privacy receipt completed only after provider confirmation). $0.027634 of the $1.00 grant spent. Evidence: `deploy/c313-live-acceptance-2026-09-28.log` (sanitized transcript) and `deploy/c313-live-acceptance-2026-09-28.md` (summary). No product code changes; four PM/droplet environment gaps surfaced and repaired as ops, each logged.

package/dist/template/.changeset/c324-storefront-parity.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+C3.24's native storefront parity mapping is published at `deploy/c324-storefront-parity-2026-09-29.md`: eleven Shopify-core capability rows mapped onto the native store with a proving test cited for every native claim — products/variants, discounts/coupons, customer accounts/portal, orders with notifications, first-party analytics, SEO/marketing surfaces, shipping and taxes, apps/webhooks and design-token theming are native; cart/checkout is native at the service layer with the public self-serve UI still to build; collections/categories with faceted browse and storefront search do not exist yet. Every gap is dispositioned: the two fix-now gaps (collections/faceted browse/search, public cart/checkout/confirmation) are assigned to C3.25 and C2.24, whose gap lists this mapping feeds; the Shopify importer is positioned as migration-only with its documented import limits. The C3.24 box stays open by its own wording until C3.25/C2.24 close those gaps.

package/dist/template/.changeset/c6-11-events-evidence.md

@@ -0,0 +1,14 @@
+---
+"freeholder": patch
+---
+
+C6.11: Events and classes now carry the evidence the rest of the checklist
+requires. The module was already built — venue, sessions with capacity, ticket
+types, waitlists that promote on cancel, check-in, Event JSON-LD and ICS — but
+nobody had ever looked at it in a browser, so the accessibility pass over its
+public and admin surfaces had never run in either theme, and it shipped no demo
+fixture. Both are now in place: a public index and event page a visitor can
+find, a sold-out session that states zero seats left rather than staying silent
+about it, a calendar link proven to return a calendar, and a demo sourdough
+class in English, French and Spanish that the tracked demo run loads, verifies
+and purges.

package/dist/template/.changeset/caddy-domain-env.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Fixed the DigitalOcean droplet recipe never being able to serve HTTPS: the
+Caddy container was not given the domain name, so it failed to start and the
+site stayed unreachable even with DNS pointed correctly.

package/dist/template/.changeset/calculators-and-coverage.md

@@ -0,0 +1,13 @@
+---
+"freeholder": patch
+---
+
+C5.26: Calculators that compute only from figures somebody published. An affordability estimate, a cost range, a rebate, a catch value — all arithmetic, and all things a visitor will reasonably read as a promise. So the constants are not stored on the calculator: it names them by attestation key, which means a rate used in a sum cannot be a number nobody stood behind, and the correction that fixes the published rate fixes every figure computed from it.
+
+The calculation is a list of named steps with a closed vocabulary of seven operations and three kinds of operand — a literal the owner typed, an answer the visitor gave, or a published fact. It is never an expression string and never evaluated as code: an owner configuring arithmetic must not be a way to run code on the instance, and "we sanitise it first" is how most of the ways that goes wrong begin.
+
+What it refuses is the feature. A constant nobody has published, or one past the date it was good for, stops the calculation and names the figure at fault — no default, no last value it saw, no term quietly dropped from the sum. A payment computed from a stale rate looks exactly like one computed from today's and the reader cannot tell, so the only honest thing a page can do with an out-of-date constant is decline the arithmetic. Division by zero is refused rather than rendered as Infinity. Every result carries the owner's assumptions — the column is NOT NULL, because an optional caveat is one nobody writes — and the as-of date of its oldest input, which is how old the answer really is. Publishing is refused while any constant it needs is unpublished, so a calculator cannot go live destined to fail its first visitor.
+
+C6.18: Service areas that can actually be checked. `radius` and `regions` describe coverage to a reader; neither answers "do you come to L4C 2K1?" without a geocoder or a gazetteer. A third kind, `postal_codes`, is checkable exactly, and `locations.checkCoverage` answers one of three things: covered, outside, or unconfirmed. The third is the point — for a radius, a named region, or a business that has said nothing, the answer is never "covered", because the failure worth designing against is a van sent two towns over on the strength of software answering a question it had no way of answering, in the business's voice.
+
+Both surfaces are plain GET forms, server-rendered, with no client component and no server action. Only the visitor's own numbers travel in the URL and the figure is recomputed on every render, so a crafted link cannot display a result the calculator never produced — and the answer is shareable, which a redirect-and-flash pattern would have thrown away. The builder at `/admin/calculators` never offers a box that takes a formula: every operand is chosen from a list — a number the owner types, an answer the visitor gives, a figure the business published, or an earlier step — which is the safety property made visible rather than merely documented.

package/dist/template/.changeset/calculators-localized-evidence.md

@@ -0,0 +1,11 @@
+---
+"freeholder": patch
+---
+
+C5.26: Calculators now refuse in the visitor's own words, and carry every assumption beside the figure.
+
+A refusal is now data as well as prose: `calculators.compute` answers a declined calculation with a stable `refusalCode` and the key of the input or published figure at fault, alongside the English detail it always carried. The public block renders the refusal from that code through the catalog — en, fr, es and ar each have the full refusal vocabulary, so a stale or missing figure declines in the same words whatever language the page is being read in, and the service's English sentence never leaks onto a non-English page.
+
+A result now arrives with its working, not just its caveats. Beside the figure the block lists every published input the arithmetic rested on — key, value, source and as-of date, in the business's timezone and the request's locale — above the as-of of the oldest of them, which is how old the answer really is. A new locale gate scans every calculator-reachable string in all four catalogs against quote, approval and guarantee vocabulary in each language, so no surface can present a figure as any of the three no matter how the strings are refactored.
+
+The Aurora Coast demo seeds two working calculators through the services on a new Planning page — a wedding-day affordability figure and an off-season print-credit eligibility figure — each resting on published, dated, sourced figures in integer minor units, with the print credit's terms carrying a `valid_until` so the demo shows a calculator declining on schedule rather than answering from expired terms.

package/dist/template/.changeset/calendar-oauth.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+You can now connect a Google or Microsoft calendar, and connecting one never costs you something you already had. Adding a calendar to the mailbox that sends your mail keeps the sending; reconnecting mail later keeps the calendar. Reading is the default — letting software change your events is a separate request — and you can connect as many accounts as you actually have, your own and the business's, on either provider. The consent flow gets its own return address, so a code issued for a calendar can never be redeemed as permission to send mail.

package/dist/template/.changeset/calendars.md

@@ -0,0 +1,26 @@
+---
+"freeholder": minor
+---
+
+Calendars exist now, at /admin/calendars — the groundwork the booking engine
+sits on.
+
+A calendar is anything whose time can be spent. The business itself has one.
+Each person who works there has one. So does every room, chair, kiln, van or
+piece of equipment that can only be in one place at a time. They are all the
+same kind of thing, which is what will let a service say "this needs a
+therapist *and* the treatment room" and have both checked at once.
+
+If you work alone, you will have two calendars — yours and the business's — and
+never think about it again. The day you hire someone or buy a second chair,
+nothing has to be rebuilt.
+
+Each calendar carries its own timezone, so a second location in another country
+keeps its own hours. It also carries how far ahead people can book, how much
+notice you need, and an optional cap on how many bookings a day it will take,
+because being overbooked is a scheduling problem and not a personality flaw.
+
+Calendars are archived, never deleted. An archived calendar stops taking new
+work and keeps everything already on it.
+
+Opening hours, exceptions and the availability engine itself come next.

package/dist/template/.changeset/campaign-broadcasts.md

@@ -0,0 +1,34 @@
+---
+"freeholder": minor
+---
+
+You can now send one message to a whole audience. Under Newsletters →
+Campaigns, pick wording you have already written and a group you have already
+defined, give it a name, and send it — now or at a time you choose.
+
+Sending starts the campaign rather than finishing it. Copies go out in batches
+over the following minutes, so a campaign to ten thousand people cannot fall
+over halfway and leave you guessing; you can pause it at any point and carry on
+later, and it picks up exactly where it stopped rather than starting again.
+
+The audience is frozen the moment a campaign starts. Someone who joins the
+group afterwards is not on that send, someone who leaves still is, and months
+later you can still say exactly who it went to.
+
+One bad address no longer stops the rest. If someone has unsubscribed or an
+address has bounced before, that copy is recorded as not sent — with the
+reason — and everybody else still receives theirs. Bounces and spam complaints
+reported afterwards are recorded against the campaign that caused them rather
+than against whichever campaign mailed that person most recently.
+
+Campaigns only go to people who agreed to hear from you. Confirming a
+newsletter subscription now records that agreement against the contact, and
+unsubscribing records that it was withdrawn — so a campaign built on any
+audience still skips anybody who has said no, and says so on the campaign page.
+
+Every number on the campaign page is counted from what was actually recorded
+for each person, not read from your mail provider's dashboard. If your provider
+loses a message, a figure stops rising rather than quietly becoming wrong.
+
+There is a "send test" button so you can read the thing yourself before
+committing to the list.

package/dist/template/.changeset/canonical-two-factor-envelope.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Reject malformed or non-canonical encrypted two-factor secret envelopes before
+decryption, so alternate Base64URL spellings and corrupted lengths fail closed
+while existing canonical AES-GCM records remain compatible.

package/dist/template/.changeset/capture-chunk-integrity.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Recording uploads can no longer lose footage silently. Each chunk upload in the record studio retries on failure and is tracked to completion; stopping a recording waits for every chunk, and a recording with missing parts shows a clear retry control instead of assembling with a hole. The server refuses to assemble a capture whose chunk sequence has gaps or whose count falls short of what the recorder produced.

package/dist/template/.changeset/cart-capability-authorization.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C5.20/C5.23/C8.08/C11.10: Require the matching cart token, verified contact ownership or authorized catalog scope for cart reads and edits. Saved carts and private wishlists no longer accept anonymous contact IDs. View-only cart reads redact write tokens, and admin displays use cart IDs. Guest cart and gallery-purchase integrations must pass cartToken; getCart retains its token input. Preserve checked checkout composition and exact API scopes, and refuse editing closed carts.
+
+The expanded regression suite runs across 24 isolated CI test shards, preserving the 25-minute timeout and sevenfold degraded-runner allowance.

package/dist/template/.changeset/cart-contact-authority.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Naming a contact on cart and checkout services now requires real authority. Previously an anonymous caller who knew a contact's UUID could merge lines into that contact's open cart, read the cart back, and create orders and invoices against them through the public API. Staff with catalog access, system composition and catalog-scoped agent keys keep working; anonymous callers are refused, and the future storefront identify/checkout flows verify the shopper before elevating.

package/dist/template/.changeset/catalog-checkout-milestones.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+Checkout can now collect a configured first payment against the full order price
+and wait for the seller to release each later payment. The agreement shown at
+checkout is saved with the order, and orders with money received cannot be
+cancelled as unpaid.