create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/.changeset/catalog-quality-rtl.md

@@ -0,0 +1,12 @@
+---
+"freeholder": minor
+---
+
+Continuously verify every English, French and Spanish catalog message for key
+parity, non-empty copy, valid ICU syntax, executable formatting, and matching
+argument and selector contracts.
+
+Add shared locale fixtures, a synthesized expanded `en-XA` pseudo-locale, and
+script-derived document direction. UI source now has a regression gate against
+physical left/right layout utilities so future RTL catalogs mirror through
+logical CSS without a layout rewrite.

package/dist/template/.changeset/change-password.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+You can change your own password from Settings, and doing so signs out every
+other device while leaving the one you are using. If you are ever locked out
+entirely, a command on your own server generates a new owner password — the way
+back in belongs to you rather than to a support queue.

package/dist/template/.changeset/ci-minio-quay.md

@@ -0,0 +1,6 @@
+---
+"freeholder": patch
+---
+
+CI pulls the recipe-gate MinIO from Quay. Docker Hub no longer serves
+`minio/minio`, so the image, recipes and upgrade job could not start.

package/dist/template/.changeset/client-documents.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Documents can be sent to a client and their history stands up afterwards. A document is revised rather than replaced, so "which version did they sign" and "what did we send them in March" both have answers; a share either follows the current version or is pinned to the one it was sent about.
+
+Sharing uses the same vocabulary as a gallery — a link, a password or a signed-in customer, with a stated expiry and a download policy — so an owner learns one model rather than two.
+
+Every open is on the record, and so is every refusal: an expired link, a revoked one, a wrong password and a spent download limit each leave a row saying which it was. The visitor is told only that it did not open. The owner can export a document with its versions, its shares and its whole access history.
+
+Customers see the documents shared with them in their portal.

package/dist/template/.changeset/client-galleries.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Give each client a private proof gallery with PIN, magic-link or login access,
+scoped guests, expiry, per-file permissions and an access audit — without
+making those files a public portfolio page.

package/dist/template/.changeset/client-gallery-delivery-audit.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+Close a client gallery properly: its files are served through the session
+rather than the public media URL, a rotated PIN ends the sessions the old one
+opened, a download limit counts the gallery instead of resetting whenever the
+client signs in again, a view-only gallery stops offering downloads, and a
+guest invitation now arrives by email with a link the owner can also copy.

package/dist/template/.changeset/client-readiness-security.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Require a deployment secret for first ownership in production, remove private data from public waitlist acknowledgements, authorize referral attribution, and serialize loyalty redemption and event capacity changes. Isolate magic-link and form rate limits so one visitor cannot exhaust a shared site-wide bucket.
+
+Reject invalid event tickets and disable unpaid paid-ticket enrollment. Disable automatic updates and rollback until verified host execution and recoverable backups exist; previous snapshot fingerprints were not backups. Honor the self-host image override and require rollback image pins. See deploy/client-readiness.md for setup and deployment requirements (C1.03, C1.05, C6.08, C6.11, C9.09, C9.12, C10.05, C10.06, C10.10, C11.10).

package/dist/template/.changeset/close-world-class-storefront.md

@@ -0,0 +1,27 @@
+---
+"freeholder": patch
+---
+
+C3.24, C3.25 and C3.26 checked 2026-09-29, closing the world-class storefront
+sweep the owner directive of 2026-09-29 made v1-blocking. C3.24 (native
+storefront parity): the capability mapping published at
+`deploy/c324-storefront-parity-2026-09-29.md` stands published and both
+fix-now gaps the mapping found are closed — G1 by C3.25 slices 1–2 (#448, #449)
+plus the collection/facet/search merchandising blocks (#453), G2 by C3.25 slice
+3 (#451) plus the buy affordance on the product blocks (#453) — rows 2–3
+flipped native with cited tests and the f-criteria matrix's C3.24 row carrying
+dated evidence. C3.25 (the two parity gaps): taxonomy with faceted public
+browse and storefront search, and public self-serve cart, checkout and
+order-confirmation pages, all on the existing commerce spine — checkout
+composes `catalog.checkoutCart`, no parallel money path. C3.26 (world-class
+merchandising): manual and segment-driven collection membership, faceted
+browsing on price, options and attributes, native collection pages with grids,
+pagination and SEO/sitemap integration, and the product-grid, featured-
+collection, store-search and buy-button editor blocks, proven end to end by
+the browse → filter → buy browser journeys (`tests/browser/storefront-checkout.spec.ts`,
+`tests/browser/storefront-merch-blocks.spec.ts`). Each item's §43 annotation
+names its F04/F05/F07/F09/F12 proofs with resolvable paths; the f-criteria
+matrix's C3.25 and C3.26 rows flip from standing N/A to dated evidence, and
+§43.1's control block moves the three IDs out of the open list — C2.25 (slice
+C in flight), C11.10, C11.16 and C11.17 stay open. No gate weakened:
+`pnpm plan:check` reads 302 IDs / 286 checked / 16 open.

package/dist/template/.changeset/cms-a11y-hints.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+The page editor now lists accessibility hints as you edit, and publishing refuses a page that does not have exactly one H1.

package/dist/template/.changeset/cms-author-history.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Page and section history now records every editorial act — create, save,
+publish, unpublish, restore, schedule and approval — against a named author.
+The editor lists the people who have touched a page and can filter the trail
+by author.

package/dist/template/.changeset/cms-blocks.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Your site is now built from blocks stored in the database: pages, and the
+header and footer around them, are content you edit rather than code you
+deploy. Changes are live on the next page load, every save keeps the previous
+version, and FAQ blocks publish their own search-engine markup.

package/dist/template/.changeset/cms-cache-budgets.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Draft saves no longer evict the public page cache. Publish and chrome edits do. Pages now have block and image budgets so a huge tree cannot ship.

package/dist/template/.changeset/cms-chrome-sections.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+The site chrome is now four synced sections — announcement, header,
+navigation and footer. Menus stay as rows. Narrow screens get a real
+menu control instead of a cramped row, and an empty announcement bar
+stays off the page.

package/dist/template/.changeset/cms-collab-presence-comments.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+The page editor now shows who else is working on a draft, asks you to reload
+or keep your edits when two people save at once, and keeps comments, mentions
+and review requests on the draft instead of the live page.

package/dist/template/.changeset/cms-content-lifecycle.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Pages now keep scheduled publish and unpublish times, an approval state,
+named revisions you can restore as a draft, and expiring preview links you
+can share without giving someone admin access. Saving a published page still
+never changes the live site until you publish, and a conflicting edit asks
+you to reload instead of overwriting.

package/dist/template/.changeset/cms-design-tokens.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+You can set brand colours, content width, corner radius, motion and a logo from Design. Light and dark both have to stay readable — a pairing that fails WCAG AA will not save. Reset restores the Bench defaults.

package/dist/template/.changeset/cms-editor.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+You can now edit your site from the admin: add, reorder and remove blocks on
+any page, edit the header and footer the same way, and restore an earlier
+version from the history kept on every save. Changes are live on the next page
+load.

package/dist/template/.changeset/cms-email-editor.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Email templates use a restricted block palette, render to table-based HTML with locked variable slots, and can be previewed as an inbox and test-sent to yourself.

package/dist/template/.changeset/cms-entity-layouts.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Product, service, location and event pages can follow a template or detach into their own layout. Rejoin throws the override away and follows the template again. Editing a following page detaches it so a later template change cannot overwrite the work.

package/dist/template/.changeset/cms-experiment-reporting.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Experiment blocks now record impressions and conversions on the first-party analytics ledger, joined to contacts and revenue. The Experiments screen will not name a winner below 30 unique visitors.

package/dist/template/.changeset/cms-experiments.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Pages and chrome can hold an experiment with weighted variants. The server picks one variant per visitor and renders only that HTML — no client-side swap. The same visitor always sees the same variant. Crawlers get the control.

package/dist/template/.changeset/cms-locale-workflow.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+The translations screen now lists chrome locale variants and flags pages whose translated SEO is incomplete. You can seed a machine draft; it stays off the public site until you mark it reviewed.

package/dist/template/.changeset/cms-plugin-proof.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+A first-party proof plugin can add a notice block, a table, a sitemap source and a seed block without changing the page editor.

package/dist/template/.changeset/cms-rich-editor-foundations.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Body copy is now typed rich text — bold, italic, code, links and lists —
+instead of a plain paragraph. Saving HTML in that field is refused. The
+editor can insert blocks from a slash menu, undo and redo, duplicate or
+copy them, and you can drop in a video or a carefully scoped HTML block.

package/dist/template/.changeset/cms-section-instances.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+You can save a group of blocks as a reusable Section, drop that Section onto other pages so they stay in sync, and detach a copy when a page needs to diverge. A Section still in use cannot be deleted.

package/dist/template/.changeset/cms-surface-blocks.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Pages can now include testimonials, galleries, maps, social embeds, share
+buttons and a help-article list; product cards, a booking request, quote
+and tip forms, and a site chat that all land on the same contact record;
+plus a paywall that never puts gated copy in the HTML and an ad slot that
+keeps its size so the page does not jump.

package/dist/template/.changeset/cms-templates.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Pages can start from a page, post, product, service or email template. Each business preset ships its own defaults. You can preview and edit a template, create a page from it, and reset it back to the seeded tree.

package/dist/template/.changeset/collections-taxonomy.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Product collections — the taxonomy layer the C3.24 parity mapping proved missing (C3.25 slice 1). `collections` + `collection_products` tables (migration `0020_collections.sql`): manual collections curated and ordered by the owner, or segment collections whose membership the hourly job re-derives from one saved segment's paid orders through the core segments engine. Trash/restore/purge per the C11.14 family (a removed collection never touches its products), slug uniqueness with permanent redirects on rename, `catalog.listProducts` gains a `collectionId` filter, and published collections render at `/c/<slug>` with pagination, full hreflang, sitemap entries and CollectionPage + ItemList JSON-LD. Admin: `/admin/collections` list/editor and collection assignment on the product page. Locales en/fr/es/ar.

package/dist/template/.changeset/commerce-advanced-money.md

@@ -0,0 +1,16 @@
+---
+"freeholder": minor
+---
+
+Add linked deposit/balance invoices, exact payment-plan allocation, customer
+credit, tips and pay-what-you-want terms, auditable late-fee invoices, and
+gross/fee/net provider payout reconciliation. Stripe and Square payout events
+join the shared authenticated webhook ledger, while contact merge, privacy,
+admin attention, generated API/MCP services, and database constraints cover
+the new money records without creating a parallel settlement path.
+
+Operators can manage payment and refund recovery from the translated,
+permission-scoped `/admin/payments` workspace. Deposit, installment, voluntary
+payment, credit, late-fee and payout operations all converge through the same
+integer-money invoice, Payment and Refund services; no second settlement ledger
+or admin-only mutation path is introduced.

package/dist/template/.changeset/commerce-carts-orders.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Carts now belong to a contact (or a guest token until one is identified),
+prices and stock refresh on every read, and checkout creates a real order
+plus an issued invoice. Paying the invoice, then the order, consumes held
+stock. `/admin/carts` and `/admin/orders` are the owner workspaces.
+Coupons, shipments and a public storefront checkout still come later.

package/dist/template/.changeset/commerce-catalog-merchandising.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Add product attributes, ordered role-based media (including video, documents and 3D/AR models) and currency-safe price lists. Owners can filter and compare products, swap media per variant, and resolve a deterministic explained price from contract, audience, sale and retail lists without converting currencies.

package/dist/template/.changeset/commerce-edge-contracts.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Add provider-neutral contracts and honest disabled adapters for payments, tax, calendar, SMS, bulk mail, AI, social publishing, shipping carriers and point-of-sale integrations.

package/dist/template/.changeset/commerce-fulfillment.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Paid orders can now leave in split shipments. Stock writes a sale when a
+carton ships, digital lines grant a download token on payment, and a return
+restocks the ledger then refunds the original invoice. `/admin/fulfillment`
+and `/admin/returns` are the owner workspaces. Live carrier labels still
+wait on an adapter.

package/dist/template/.changeset/commerce-inventory-ledger.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Stock is now a ledger, not an edited number. You can start tracking a variant
+at a location, then record receipts, counts, adjustments, damage and transfers.
+On-hand is the sum of those movements; reservations hold units for a cart,
+order or booking until they expire or become a sale. Untracked variants stay
+always available. The owner workspace is `/admin/inventory`.

package/dist/template/.changeset/commerce-invoice-admin.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Add the translated invoice and tax admin workspace. Owners and bookkeepers can now list, create, issue, void and credit invoices, inspect immutable tax evidence and receipts, install dated tax starters, and activate collection only after acknowledging starter limitations. Contact records show invoice history. Admin, HTTP and MCP continue to call the same invoicing services.

package/dist/template/.changeset/commerce-money-foundation.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Add the normalized invoice, payment, refund, credit-note, tax calculation, source-attributed tax starter, and currency-safe threshold foundation with fixed-point arithmetic, idempotent state transitions, immutable tax evidence, contact merge/privacy integration, and generated API/MCP services.

package/dist/template/.changeset/commerce-payment-providers.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Add transaction-safe manual/offline, Stripe, and PayPal payment paths over the
+shared invoice ledger, including raw-body authenticated and replay-safe
+webhooks, provider refunds, masked saved methods, disputes, reconciliation,
+doctor status, and operator guidance.

package/dist/template/.changeset/commerce-pos.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+You can take cash or a Stripe Terminal / tap-to-pay payment at a location.
+Every take becomes a normal invoice payment and receipt. `/admin/pos` is the
+owner workspace. Stripe still needs `STRIPE_SECRET_KEY` before a reader will
+collect.

package/dist/template/.changeset/commerce-procurement.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+You can now set safety and reorder levels, decide what happens when stock
+runs out, and buy stock back in. Suppliers and purchase orders live at
+`/admin/procurement`. Placing an order raises incoming; receiving writes a
+receipt on the ledger and can notify people who asked to hear when an item
+is back. Cancelling an open order reverses the remaining incoming quantity.

package/dist/template/.changeset/commerce-product-lifecycle.md

@@ -0,0 +1,16 @@
+---
+"freeholder": minor
+---
+
+Add the shared product lifecycle for physical, digital, service, rental, bundle
+and pass products. A translated admin catalog now creates, edits, previews,
+activates, archives and restores products through the same audited services
+exposed to HTTP and MCP, with tax activation interlocks, visibility projections,
+stale-write refusal, redirect-safe address changes and append-only history.
+
+The catalog provides one durable Product identity for every supported kind so
+options, variants, pricing, inventory, bookings and orders can build on the same
+record. The `/admin/products` workspace includes translated list, filter,
+creation, editing, responsive preview and lifecycle-history flows, with
+permission checks and optimistic concurrency enforced by the shared service
+layer.

package/dist/template/.changeset/commerce-promotions.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Checkout can now take a coupon or a gift card without a second money path.
+Coupons become invoice discounts. Gift cards credit the existing customer
+balance and pay the invoice from there. Abandoned carts get one recovery
+coupon. `/admin/promotions` is the owner workspace.

package/dist/template/.changeset/commerce-provider-parity.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Add production payment adapters for Square, Mollie, Razorpay, Paystack, and
+Flutterwave behind the existing invoice/payment/refund ledger. Each provider
+gets capability discovery, hosted checkout and recheck, refunds, authenticated
+webhook convergence, readiness diagnostics, environment documentation, and a
+mocked contract suite without introducing a second balance or storing raw
+provider payloads.

package/dist/template/.changeset/commerce-relations-breaks.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Add merchandising relations, bundle components with deterministic quotes, and volume versus tiered quantity breaks on the existing price resolver. Bundle availability follows active components until inventory exists. Prices stay integer minor units with an explained winner.

package/dist/template/.changeset/commerce-service-offerings.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Service products now carry real offering configuration: duration, buffers,
+location type, capacity, assignment, travel time, a deposit (fixed or
+percent), a reusable cancellation policy and an optional intake form. You can
+also say how the service may be paid — in full, deposit then balance, a
+payment plan, hourly or a retainer — and the catalog can quote the deposit
+and balance from the same price resolver. Calendars and signed waivers still
+attach when scheduling and contracts exist.

package/dist/template/.changeset/commerce-shipping-rates.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Shipping now quotes a real rate instead of a single field. You define zones
+(most specific match wins), methods (flat, weight, price, item, dimensional,
+free over a threshold, pickup, local delivery), rate bands and boxes.
+`/admin/shipping` is the owner workspace. Live carrier rates still wait on
+an adapter.

package/dist/template/.changeset/commerce-tax-templates.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+C5.04: Canada, EU, UK, US, Australia and New Zealand tax starters can be installed in monitoring mode, and an owner can still define a custom zone elsewhere. Collection stays interlocked until the starter limitation is acknowledged.

package/dist/template/.changeset/commerce-variant-matrices.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Add reusable catalog option dimensions and generated variant matrices. Owners assign option types and values on a product, preview additions/retentions/archives, and apply a reconciliation that keeps stable variant identities and SKU fragments. Existing combinations are never silently deleted.

package/dist/template/.changeset/community-rooms.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Community spaces now have rooms, a chronological member feed, and hide/remove
+moderation. Open spaces still accept a public join; gated spaces show a join
+request until you add the person, and only members see the posts.

package/dist/template/.changeset/complete-demo-scenarios.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Admin → Demo scenarios now includes four complete journeys — creator,
+service-business, shop and everything — assembled from the modules you already
+have. Each loads marked contacts, a studio, a sitting, an inbox thread, a page,
+a form, a print, a gallery, a quote, an overdue invoice and a saved revenue
+view, in English, French or Spanish. Load, reload, reset and purge still only
+touch those tracked records.

package/dist/template/.changeset/completion-honesty.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+The first-party plugins that ship with an instance are seams, not finished
+products. Community rooms and posts, voice or video on a conversation,
+Printify-style print fulfillment, and real marketplace order sync are still
+being built. Membership billing can already charge a stored card or follow
+Stripe and PayPal's calendars; proof that a live provider actually settles
+is the final evidence program, not a missing billing mode.

package/dist/template/.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

package/dist/template/.changeset/connection-grants.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+An agent can now be given one connected account rather than all of them. Scopes say what kind of work a worker may do; they never said whose mailbox or whose calendar, so reaching a connected account is now a separate grant you make one agent and one account at a time — and an agent sees only what it was given, never a credential, and never that the other accounts exist. Taking access back does not need a second factor, because removing it should never wait. If a provider withdraws consent, every grant on that account goes with it in the same breath; if a token simply expires, the grants survive and the reconnect notice tells you how many agents are waiting on it.

package/dist/template/.changeset/consent-gated-media.md

@@ -0,0 +1,13 @@
+---
+"freeholder": patch
+---
+
+C8.16: Before/after pairs and progress series now publish only against a recorded consent, and a withdrawal unpublishes from every surface in one action.
+
+The consent ledger from the first half of this item is enforced at the render layer, not just at the publish button. New `consentBlockedProjectIds`/`consentBlockedAssetIds` in the projects module re-derive what may render from the ledger at read time, and every public query path that can surface the media consults them: the portfolio index and collections, the service page's proof-of-work list, and the structured-data query behind a case study's CreativeWork JSON-LD all drop a project the moment its permission stops standing. Public galleries apply the same rule to their items — a withdrawn frame disappears from the session list, refuses direct view and download by item id, is left out of rebuilt ZIP archives, and holds any archive that might predate the withdrawal offline.
+
+Pages and sitemaps read `pages.status`, which the withdrawal maintains — and a new publish-veto registry in `core/privacy` closes the gap a hand-flipped flag would leave: `cms.resolvePage` and `cms.publishedPaths` consult registered vetoes before answering, so a case-study page whose client's consent no longer stands refuses to render and leaves the sitemap even if its status is put back by hand. The veto is registered from the projects module and re-reads the consent ledger on every public answer; the portfolio index and collection pages are deliberately not vetoed, because they re-derive their project lists at render time and a withdrawn project should not take unrelated work offline with it.
+
+A published time series also becomes real publishing machinery rather than loose images: the case-study snapshot now carries `seriesKey` and `capturedAt` into the `projectCaseStudy` block, the block accepts the `series` role, and the public page renders each series as a dated, chronologically ordered strip under a "Progress over time" heading (new `projects.public.progress` key, en/fr/es/ar).
+
+The ownership export's media manifest now carries each asset's capture provenance alongside the byte inventory, and the consent ledger exports as a table with everything else — provenance and permission history both survive export.

package/dist/template/.changeset/consent-is-evidence.md

@@ -0,0 +1,13 @@
+---
+"freeholder": patch
+---
+
+C8.16: Permission to publish a client's work is now a ledger rather than three columns, and taking it back no longer destroys the proof it was ever given. `projects.revokeConsent` used to set `client_consent_given_at`, `client_consent_method` and `client_consent_note` back to NULL — so a clinic that had published lawfully for six months could no longer show that it had, at the exact moment that record starts mattering. §4.18 is explicit that a withdrawal unpublishes *without deleting*.
+
+Consent moves to `media_consents` in `core/privacy`, in the shape `consent_records` has used all along: immutable proof of one decision, with the current state derived from the history. A withdrawal is a new row. The existing grants are carried across by the migration rather than dropped, because they are the same evidence. Consent is scoped to the work it covers rather than to the person, because somebody who agreed to one before-and-after has not agreed to every photograph of them the business will ever hold — and a model that cannot express that difference will eventually be used as though they had.
+
+Grants can now lapse. Consent given for a period was previously unrepresentable, which meant consent that had quietly run out read exactly like consent that still held. `liveConsent` answers false for a withdrawal, false for a lapsed grant, and false when nobody ever decided, and the publishing path does not distinguish them: all three mean do not publish. Decisions are ordered by when they took effect rather than when they were typed, so a consent form entered late cannot silently reinstate a permission somebody had already taken back.
+
+Project media gains a `series` role with a `series_key` and a `captured_at`, because orthodontic progress and a recovery timeline are ordered over time and a before/after pair cannot express that. `captured_at` is when the picture was taken, not when it was uploaded — the distinction the whole of §4.18 turns on.
+
+Both new tables record their actor as text (`user:<id>`, `agent:<name>`, `system`) following `audit_log`, not as a foreign key to users: an actor is not always a person, and a uuid column would assert something untrue of every row an agent or a scheduled job writes. `media_consents` joins the contact spine — repointed on merge, exported on request, and on erasure its decisions are kept while the free-text note is cleared, since the rows are evidence under a legal hold and the note is where somebody's own words could end up.

package/dist/template/.changeset/contact-data-depth.md

@@ -0,0 +1,16 @@
+---
+"freeholder": minor
+---
+
+Complete the Contact spine's owner-managed data depth. Organizations now have
+searchable records, unique normalized domains, member counts, safe deletion,
+and their own typed custom fields. Contacts gain canonical tags, organization
+membership, validated language, time-zone and country preferences, and explicit
+lifecycle history.
+
+Owners can define, order and retire typed contact or organization fields without
+discarding stored values. Relationships connect two existing Contact records as
+household members, partners, employers, guardians or referrals; directional
+meaning remains explicit, both timelines are audited, and contact merges safely
+coalesce duplicate edges. The same services and permissions power the translated
+English, French and Spanish admin, HTTP API, OpenAPI document, and MCP tools.

package/dist/template/.changeset/contact-duplicate-review.md

@@ -0,0 +1,17 @@
+---
+"freeholder": minor
+---
+
+Add a human-reviewed duplicate workflow to the Contact spine. An indexed scan
+surfaces canonical candidate pairs with transparent name, phone, organization,
+and country scoring; it never merges automatically, and dismissals remain
+closed across later scans. The translated admin review desk makes the surviving
+record explicit before an owner approves a merge.
+
+Every manual or queue-approved merge now records its exact contact snapshots
+and affected references. Owners can undo while the survivor and moved records
+remain conflict-free; relationships, timeline events, form submissions, and
+analytics attribution return to their original contacts in one transaction.
+Security credentials are invalidated rather than restored, and such merges are
+clearly recorded as non-undoable. The same permissioned services power admin,
+HTTP API, OpenAPI, and MCP callers.

package/dist/template/.changeset/contact-import.md

@@ -0,0 +1,26 @@
+---
+"freeholder": minor
+---
+
+Bring your contact list in from a spreadsheet, and take it back out again if it
+goes wrong.
+
+Upload a CSV and Freeholder reads it properly — a company name with a comma in
+it, an address that runs onto two lines, a file Excel saved: all of them survive
+intact rather than shifting every column along by one. It guesses what each
+column means and shows you the first value from each, so you can correct the
+guesses before anything happens.
+
+Then it tells you exactly what the file would do: how many new people, how many
+existing records it would fill in, how many are already right, and which lines
+it cannot use and why — with the line number, so you can open the file and fix
+them. Nothing is written until you say so.
+
+People already in your contacts are recognised by their email address and
+updated rather than duplicated, so importing the same list twice does not give
+you two of everybody.
+
+And it can be undone. Anything the import changed goes back to what it was, and
+anyone it brought in is removed — except the people who have since ordered,
+booked or been quoted, who are kept, because undoing an import should not undo
+your work.