create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/.changeset/contact-merge-ui.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+When two records turn out to be the same person, you can now merge them from
+the contact itself: search for the duplicate, and its history moves across
+while anything the surviving record was missing gets filled in from it. Only
+the owner can do this, because it removes a record and cannot be undone.

package/dist/template/.changeset/contact-privacy-rights.md

@@ -0,0 +1,18 @@
+---
+"freeholder": minor
+---
+
+Add an end-to-end consent and privacy-rights workflow to the Contact spine.
+Consent is now immutable, purpose/channel-specific evidence with an effective
+preference service and a translated customer preference centre. Owners can
+record, verify, start, fulfil, deny and audit access, portable export,
+correction and erasure requests from a translated privacy desk.
+
+Exports and receipts are checksum-backed JSON files delivered only through an
+authenticated, no-store route and pruned after 30 days. Step-up-protected
+erasure anonymizes the Contact, timeline, forms, analytics, audit and merge
+history, revokes customer credentials, preserves marketing suppression, and
+retains only explicitly documented legal scopes. A reflected registry gate now
+requires every module that references a Contact to implement export and
+erasure alongside merge handling. The same services power admin, portal, HTTP
+API, OpenAPI and MCP callers.

package/dist/template/.changeset/contacts-admin.md

@@ -0,0 +1,15 @@
+---
+"freeholder": minor
+---
+
+Contacts are browsable now. Search by name or email, filter by stage, and page
+through them — and because filters live in the web address, a filtered view is
+something you can bookmark or send to your bookkeeper.
+
+Open anyone to see their details and their history: every quote, booking,
+invoice and email will appear on that timeline as those parts arrive. You can
+add and edit contacts by hand, and if you try to use an email address that
+already belongs to someone, Freeholder tells you rather than quietly creating
+a second record for the same person.
+
+Forms no longer throw away what you typed when something is wrong with it.

package/dist/template/.changeset/contacts-create-human-only.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+`contacts.create` is deliberate entry by a human, and now the platform enforces it: API keys and MCP callers are refused and pointed at `contacts.resolve`, the door automated paths were always supposed to use. The unique email index catches an email-keyed fork, but nothing stopped a key from freely duplicating email-less contacts. The API examples and tests now use `contacts.resolve` as the canonical key-holder mutation.

package/dist/template/.changeset/content-security-policy.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Enforce a per-request nonce-based Content Security Policy across document
+responses, with bounded editor preview and S3 upload exceptions, separately
+consented exact creative origins, and privacy-redacted violation reporting in
+the admin Health view.

package/dist/template/.changeset/contract-templates.md

@@ -0,0 +1,22 @@
+---
+"freeholder": minor
+---
+
+Write an agreement once and send it as often as you like. Templates take
+placeholders — put `{{customer_name}}`, `{{business_name}}` or `{{today}}`
+anywhere in the text and Freeholder fills them in for whoever you are sending
+it to. Anything it cannot fill stays visible in the draft, so you spot it
+before your customer does rather than sending "Dear ,".
+
+Saving a template always makes a new version. Whatever you have already sent
+keeps saying exactly what it said, which is the whole point of a signed
+document, and retiring a template stops you sending it without erasing the ones
+you already have.
+
+Agreements you both sign are now possible. Mark a template as mutual and, once
+the customer has signed, you countersign it yourself — in that order, because a
+document only you have signed is an offer rather than an agreement.
+
+Every agreement can be exported: the words, who signed, when, from where, and
+the fingerprints that let anyone check the text has not been altered since. It
+is plain text on purpose — it will still open in thirty years.

package/dist/template/.changeset/contribute-channel.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+You can send a bug, a feature idea or a question to the Freeholder project from your own site — or have your assistant do it. Nothing leaves the instance until you submit. Security reports still go through the private path.

package/dist/template/.changeset/contribute-status-replies.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+When Freeholder replies to a report you sent, your own site is updated. You can turn hub ingest on with one button. The project's own site accepts reports unless you turn that off.

package/dist/template/.changeset/conversations.md

@@ -0,0 +1,20 @@
+---
+"freeholder": minor
+---
+
+One conversation with each person, whatever it arrived on. A contact form
+submission, the email reply to it, and a text about the same job now sit in one
+thread on that person's record — not three separate places to check.
+
+Every message shows which door it came through, so a mixed thread stays
+readable. Replying picks the channel of whatever they last used, because
+somebody who emailed you and then texted expects the answer by text.
+
+A text from a number you have never seen becomes a real contact with a real
+history, rather than an orphan message with a phone number attached.
+
+For anything sent, you see what actually happened to it rather than what was
+hoped: queued, sent, delivered, read — or the carrier's own reason it failed,
+word for word, which is what you need when you ring them about it. What each
+message cost is recorded too, because texting is the one thing here where money
+can leave by accident.

package/dist/template/.changeset/core-jobs.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Freeholder now does background work on a schedule: expired sign-in sessions and
+old rate-limit counters are cleaned up on their own, and anything the site
+needed to tell itself about — a form submission reaching your contacts, a page
+being published — is recorded in the same breath as the change, so it still
+happens even if the server restarts at exactly the wrong moment.

package/dist/template/.changeset/core-runs.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+**Schema-breaking.** Runs, steps, approvals and spend move out of the agent layer into their own home, and the tables are renamed to match: `agent_runs` becomes `runs`, `agent_steps` becomes `run_steps`, `agent_approvals` becomes `run_approvals`, `agent_spend` becomes `run_spend`. A release older than this one will not find the tables it expects.
+
+Nothing an owner can see changes. This is groundwork for automations, which need to record a run the same way agents do — so that an automation mixing a written instruction with an automatic action produces one history you can read, rather than two.

package/dist/template/.changeset/core-seo.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Your site now tells search engines and AI assistants what it is. Every page
+carries its full address, a social preview card and structured data describing
+your business; a sitemap and a robots file are generated from what you have
+actually published, and `/llms.txt` gives answer engines a plain summary of the
+business and its pages. Renaming a page no longer breaks the links people
+already shared — the old address redirects to the new one automatically.

package/dist/template/.changeset/create-freeholder-setup.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+"create-freeholder": minor
+---
+
+Creating a Freeholder project now checks the environment, can install
+dependencies and run migrations, and prints the setup URL — or the exact
+recovery if something is still missing.

package/dist/template/.changeset/credential-encryption.md

@@ -0,0 +1,26 @@
+---
+"freeholder": minor
+---
+
+Groundwork for connecting your Google, Microsoft and Apple accounts: a safe
+place to keep the access they grant.
+
+Nothing connects yet — that comes next — but the part that has to be right
+before anything does is now in place. Access tokens are encrypted before they
+touch the database, using a key that lives in your server's configuration
+rather than in the database itself. Somebody who obtained a copy of your
+database would get nothing usable out of it.
+
+Two things follow that are worth knowing now rather than later:
+
+**The key belongs in your backups**, alongside the database. If you lose it,
+your connected accounts have to be reconnected — the data is not recoverable
+without it, which is the point.
+
+**Freeholder tells you before this bites.** The health check reports a missing
+key as a warning while nothing is connected, and as a failure the moment
+something is, with the command to generate one. It is not something you find
+out about when a calendar quietly stops syncing.
+
+You can also change the key without downtime: set the old one alongside the
+new, and everything keeps working while it re-encrypts.

package/dist/template/.changeset/custom-field-options-default.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+Fix editing and deactivating custom fields that are not choice fields: toggling a number, text, date, or yes/no field no longer fails with "Only a choice field can have choices."

package/dist/template/.changeset/customer-booking-screens.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+"@freeholder/mobile-app": minor
+"@freeholder/sdk": minor
+---
+
+Add customer-owned booking links and native booking list/detail screens with rescheduling, cancellation confirmation, and intake/waiver web handoffs (C10.25). Never expose management credentials in owner lists or cache booking links. Align the Expo native dependencies and verify Android/iOS bundles in CI.
+
+Connect native password and email-link sign-in to the real auth services, accept validated user-session bearer credentials, and prevent invalid authorization headers from falling back to browser cookies. Cookie-bearing writes retain CSRF protection.

package/dist/template/.changeset/customer-dependency-security.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Update Next.js to the patched 16.3.8 line and sharp to 0.35.5. Require shell-quote 1.11 or newer within its current major. These resolve the eight dependency advisories reported by the customer-surfaces CI security gate (C1.20), without audit exceptions.

package/dist/template/.changeset/customer-gallery-foundation.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+"@freeholder/sdk": minor
+---
+
+Show customers their active galleries and guest invitations in the portal (C10.29), using a contact-bound query that excludes expired or revoked access. Portal rooms now have translated document titles for accessible navigation. Private gallery images can use gallery-session authorization headers for native clients, without putting credentials in URLs. Explicit invalid credentials cannot fall back to cookies, and image URLs must match the session's gallery.
+
+Fix the contract-evidence gate on Windows when the test runner and workspace use different path casing (C11.15). Each required file must still contain a passing test, and different directories cannot substitute for one another.

package/dist/template/.changeset/customer-invoice-payments.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Customers can open their invoices from the portal or a private email link and pay through the business's payment provider. Offline payment instructions clearly show that payment still needs to be verified. Invoice links stop working after payment or cancellation, and repeated checkout requests reuse the same payment attempt.

package/dist/template/.changeset/customer-magic-links.md

@@ -0,0 +1,12 @@
+---
+"freeholder": minor
+---
+
+Add passwordless customer sign-in with private 15-minute, one-use magic links
+and atomic linking to the existing Contact spine. Requests resist account
+enumeration, tokens are hashed at rest and invalidated by changed email or
+contact merge, and a scanner-safe GET-to-POST confirmation prevents mail
+clients from spending credentials. Magic links refuse every role carrying
+admin grants, create privacy-bounded sessions, record login history and contact
+timeline evidence, and include scheduled credential cleanup plus English,
+French and Spanish customer entry copy.

package/dist/template/.changeset/customer-mobile-contracts.md

@@ -0,0 +1,6 @@
+---
+"freeholder": patch
+"@freeholder/mobile-app": minor
+---
+
+The customer app now uses customer-authorized screen contracts and shared English, Spanish, and French labels. Its shared write helper refuses offline submissions without queueing or retrying them, and home correctly reads the customer's portal rooms without repeatedly refetching them.

package/dist/template/.changeset/customer-reply-and-account.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+"@freeholder/mobile-app": minor
+"@freeholder/sdk": minor
+---
+
+Add a customer reply into the caller's own thread, a portal/app thread view, newsletters and account screens, and native TOTP/recovery two-factor sign-in (C10.28). `conversations.replyAsContact` never sends on the business reply channel and is rate-limited per contact. Sign-out revokes a held device token. WebAuthn-only accounts still sign in on the website.

package/dist/template/.changeset/customer-self-service.md

@@ -0,0 +1,12 @@
+---
+"freeholder": minor
+"@freeholder/sdk": minor
+---
+
+Add public service booking with current availability, price and policy acceptance, retry protection, deposit invoices, and customer rescheduling. Add an editable blog index and a post creation screen. Customers can open their own quotes, orders, projects, rentals and documents from the portal, accept or decline quotes, and cancel appointments.
+
+Add public membership plans and verified signup. Paid access waits for the first settled invoice; cancelled pending signups cannot activate. Automatic signup checkout asks for explicit saved-method consent, and provider renewals start after the first paid period. Add recovery for pending activation and provider schedules.
+
+Check newsletter providers and verified senders before freezing audiences or attempting batches. Keep sign-in and newsletter subscriptions from promising email when no delivering sender exists. Private client document files cannot bypass their share policies through generic media URLs; existing public downloads remain available.
+
+This is beta functionality. External mail delivery, live recurring payments, and new-customer card-required trial setup still need provider acceptance. The independent security review remains open.

package/dist/template/.changeset/customization-seams.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Updates can replace Freeholder itself without touching your database, plugins,
+configuration or uploads. Editing core files on a live server is detected and
+is not a supported way to customise.

package/dist/template/.changeset/daily-briefing.md

@@ -0,0 +1,27 @@
+---
+"freeholder": minor
+---
+
+There is a daily briefing now, at /admin/briefing: one screen answering what
+needs you, what is on today, and what changed while you were away — in that
+order, because the things that need you should not be below the things that do
+not.
+
+It is built each morning before you arrive rather than when you open it, so the
+page loads as fast as any other and the work behind a section has already
+happened.
+
+Sections come from whatever your site is actually running, not from a fixed
+list, so a briefing gains a section when you switch a module on. If one section
+cannot be produced, you still get the rest — this is the screen that tells you
+when something is wrong, so it has to survive something being wrong.
+
+A quiet day says so instead of padding the page, and empty sections are left
+out entirely.
+
+You can hide any section you do not want to read. Hiding only hides: the work
+behind it carries on, and you can bring it back whenever you like.
+
+This release is the briefing itself. What core puts in it — today's
+appointments, new enquiries, overdue invoices, anything that needs
+reconnecting — follows next.

package/dist/template/.changeset/daily-private-rooms.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+<!-- Copyright (C) 2026 Tony Aly -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+C3.13: Add private Daily rooms with expiring host and guest access, verified call shutdown, recording download links and real transcript refresh on the contact conversation. Fence room and recording retries with expiring leases. Missed calls now close the provider room first; stopping a call does not invent a recording. Add English, French and Spanish setup and recovery controls. Live acceptance, owner storage import and provider erasure remain incomplete.

package/dist/template/.changeset/daily-update-check.md

@@ -0,0 +1,6 @@
+---
+"freeholder": minor
+---
+
+This instance checks for updates once a day by downloading a signed file. The
+check sends no instance identifier. Set FREEHOLDER_UPDATE_CHECK=off to stop.

package/dist/template/.changeset/danger-token-integrity.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Danger buttons and the unread badge now take their text colour from a new `onDanger` token instead of a literal white, which failed WCAG AA on the dark scheme's lightened danger fill. The token contrast test enforces the pairing in both schemes. Shadows join the token set too: the pressed button edge, the hero emphasis and the floating chat launcher are `shadow-press` / `shadow-raised` / `shadow-float` tokens defined once in tokens.ts, replacing nine hand-written copies.

package/dist/template/.changeset/demo-same-droplet.md

@@ -0,0 +1,12 @@
+---
+"freeholder": patch
+---
+
+The disposable playground can now share the project's DigitalOcean host without
+sharing the production database or application network. An optional Compose
+overlay keeps only Caddy attached to the playground proxy network across
+deployments, and the checked-in demo Caddy site documents the public route.
+The playground entry now sets its translated document title for browser tabs and
+screen readers.
+An hourly reset now waits for the playground entry page as well as health
+readiness before reporting recovery.

package/dist/template/.changeset/dependency-security-policy.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Patch the current PostCSS and esbuild advisories and enforce a fail-closed
+dependency policy with zero high/critical findings and owned, expiring,
+path-complete exceptions for any lower-severity risk.

package/dist/template/.changeset/deploy-script-stdin.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+C10.10: The DigitalOcean droplet deploy now stages its complete remote script before backup runs, so a command reading stdin cannot silently skip the image swap while reporting success.

package/dist/template/.changeset/design-system-and-setup.md

@@ -0,0 +1,17 @@
+---
+"freeholder": minor
+---
+
+Freeholder now has a face. A fresh install opens a three-step setup that
+creates your owner account, asks who the business is, and gets out of the way —
+and choosing your country fills in your currency, time zone, units and which
+day your week starts on, all still editable.
+
+The look is one consistent system rather than a pile of styles: every colour,
+size and spacing is a named setting, so rebranding a site will be a save rather
+than a rebuild, and the phone app will match the website by construction. Text
+is set in Schibsted Grotesk, served from your own site — no fonts are fetched
+from anyone else, so nothing about your visitors leaks to a third party.
+
+Every colour pairing in the interface is checked against accessibility contrast
+minimums by an automated test, in both light and dark.

package/dist/template/.changeset/deterministic-demo-scenarios.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Add versioned, localized and transactionally purgeable demo scenarios assembled from typed module and plugin manifest contributions, with exact provenance, conformance validation and an owner-facing lifecycle screen.

package/dist/template/.changeset/digitalocean-droplet-recipe.md

@@ -0,0 +1,15 @@
+---
+"freeholder": minor
+---
+
+Freeholder can be deployed to a DigitalOcean droplet you own, with a written
+walkthrough that takes you from an empty account to a site on your own domain
+with a certificate: create a bucket for your files, create the machine, point
+your domain at it, fill in one settings file, and start it.
+
+Your photos and files live in object storage rather than on the machine, so a
+machine that dies is twenty minutes of rebuilding rather than losing your
+archive — and the software now refuses to run in production with files kept on
+the machine's own disk, instead of letting you discover the problem the hard
+way. Database backups run nightly, and the checklist has you rehearse a restore
+before trusting them.

package/dist/template/.changeset/doc-claim-mapping.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Every affirmative claim in MASTER.md §§1–42 now maps to a passing acceptance test, a generated artifact, or a same-change strike: `deploy/doc-claim-mapping.md` is the full inventory (all 42 sections, 118 claim rows) and `tests/core/doc-claim-mapping.test.ts` refuses unmapped claims, unresolved evidence paths, and strike rows whose old wording still parses. Ten over-claims were narrowed in the spec itself, including the §25 "MIT plugin-kit" licence line, the §31 "pgvector" retrieval line, the §4.8 instance-release-notes scope, the §28 hosted docs-site promise, and the §21b backup-script path. Closes C11.15.

package/dist/template/.changeset/docs-availability.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Public docs now distinguish what ships today from the finished product.
+Package descriptions no longer read as if the SDK, installer or templates
+were complete, and image tags no longer imply a versioned release exists.

package/dist/template/.changeset/doctor.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+A new **Health** screen in the admin — and a `doctor` command — tell you what
+your site can and cannot currently do. Everything on it was actually tried: a
+file really is written to your storage and read back, your mail settings really
+are loaded, and the database really is asked whether it is up to date. Anything
+that is not working says what to change, in a sentence.

package/dist/template/.changeset/done.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+The product spec now matches what is actually built: leftover claims that were
+never implemented are removed, and remaining work (device proof, security
+review, live payments, restore, and the owner sign-off) is listed honestly.
+This is not DONE.

package/dist/template/.changeset/droplet-backup-cron-env.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+The DigitalOcean droplet walkthrough's nightly backup now actually runs. The
+cron line it gave loaded the settings file without exporting it, so the backup
+script saw none of its settings and failed every night without a word. The
+walkthrough now exports them, writes each run to a log you can check, creates
+the versioned backup bucket the script needs, and scopes the storage key to
+both buckets instead of the media bucket alone.

package/dist/template/.changeset/dunning.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+When a membership renewal cannot be billed, the plan now has a dunning
+policy: retry on the days you name, keep access for a grace window, send
+a notice on the channels the person already receives, then pause, cancel
+or move them to a cheaper plan. Paying the open invoice stops the chase
+and restores access. Without a policy the failure is still written on
+the history and nothing else happens.

package/dist/template/.changeset/durable-provider-work.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Move catalogue refresh and social ingest, health, Google Business Profile, and
+publication provider calls out of service-owned database transactions. Human
+and agent calls now atomically enqueue bounded jobs; workers perform network
+work between short service-layer snapshot and apply transactions, with
+idempotency, cancellation safe points, retry policy, audit-redacted provider
+responses, and a source gate that prevents the long transactions returning.

package/dist/template/.changeset/editor-preview-local-draft.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+The editor preview keeps up with typing. The canvas rendered only stored state, so every keystroke's preview waited for the 1.2s autosave debounce plus the save round-trip and a frame reload — measured at ~1.4s against the §15.1 budget of 100ms. The editor now broadcasts its local draft to the preview frame in the same commit as each keystroke, and the frame layers the draft text onto the typeable elements it already renders; autosave still runs on its own debounce and a save still reloads the frame from stored state, so structure and anything a text patch cannot express reconverge as before.

package/dist/template/.changeset/editor-publish-autosave-race.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+C2.25: Publishing a page now waits for an in-progress autosave, keeps the page version current after publishing, and recovers from a failed publish request with a clear message instead of leaving the button stuck.

package/dist/template/.changeset/embeds-with-backlinks.md

@@ -0,0 +1,7 @@
+---
+"freeholder": minor
+---
+
+Copy-paste embed codes for reviews, booking, newsletter signup and galleries.
+Each snippet is an iframe plus a backlink home, and only those embed URLs may
+be framed by other sites.

package/dist/template/.changeset/enforced-service-area-coverage.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+C6.18: service-area coverage is now enforced, not just described. When a business has named the postcodes it delivers to, checkout re-checks the order's destination against that list in the same transaction and refuses — cleanly, before anything is written — a postcode the owner did not name. A postcode one character off a listed code counts as outside: the match is exact, never a prefix, radius or guess, and a business that named a radius, a region, or nothing at all is never asked to honour a boundary the software invented. Each area can also carry the weekly delivery days and hours it receives deliveries, which the coverage check on the page now shows alongside its yes.

package/dist/template/.changeset/events-newsletters-seo.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Public product landing pages, an events module (venue, sessions, seats, tickets, waitlists, ICS, check-in) and a newsletter module (double-opt-in, RFC 8058 unsubscribe, public archive) now fill the same OG / IndexNow / sitemap / feed registry (C2.21).

package/dist/template/.changeset/executable-tier-one-portability.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+Replace declarative-only Tier-1 deployment and migration claims with executable Replit, DigitalOcean, Railway, Render and Docker artifacts; parsed recipe contracts; a six-target runtime/Doctor CI matrix; real 30-pair PostgreSQL restore/export drills; byte-verified S3/Replit media transfer; and a complete migration/cutover runbook.

package/dist/template/.changeset/expo-customer-app.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+There is now a real customer app. It asks for your business's web address,
+picks up your name, colours and logo, and shows your shop — no rebuild needed
+when you change your branding. Signing in adds the customer's own records. It
+keeps their session in the phone's keychain, tells them when what they are
+looking at was last loaded, and never invents a screen your site does not
+already have.

package/dist/template/.changeset/external-calendar-sync.md

@@ -0,0 +1,20 @@
+---
+"freeholder": minor
+---
+
+Freeholder now reads the calendars you connected, so it knows when you are
+already busy. By default it learns exactly that and nothing else: the times
+that are taken, and whether they block. Titles, guests, locations and notes
+are not stored at all unless you turn detail on for that account, and turning
+it back off erases what was kept.
+
+Each calendar on a connected account can be a source of busy time, one
+Freeholder may book into, or ignored entirely. Ignored means ignored: it is
+not fetched, and anything already read from it is deleted. Rediscovering it
+later does not quietly switch it back on.
+
+Syncing runs every fifteen minutes and is cheap when nothing has changed,
+because it asks each provider only for what moved since last time. If a
+connection stops working, Freeholder tells you it needs reconnecting — in the
+provider's own words — instead of retrying quietly into a lockout, and one bad
+connection never stops the others from syncing.

package/dist/template/.changeset/f-matrix-2026-09-16.md

@@ -0,0 +1,17 @@
+---
+"freeholder": minor
+---
+
+Every completion claim now faces all twelve F-criteria at once.
+`deploy/f-criteria-matrix.md` audits F01–F12 across 286 rows — every live
+§43 checklist item (computed from `scripts/plan-gate.mjs`, never retyped),
+the seven mobile items deferred to v2, all seven workspace packages and all
+six first-party plugins — with a repository citation or a specific
+`N/A — reason` in every cell. `scripts/f-matrix.mjs` and
+`tests/core/f-matrix.test.ts` keep the matrix honest the way plan-gate keeps
+the checklist honest: a row that drifts from the plan, an empty cell, a
+citation that does not resolve, a cited test file outside the suite, or a
+lazy "N/A — not applicable" fails `pnpm gates`. The C0.11 audit behind it
+re-read the audit-repaired evidence assertion-by-assertion and narrowed 45
+stamped coverage claims to what the cited files actually prove; the
+annotation rewrites are queued on C11.15. No product behaviour changes.

package/dist/template/.changeset/f-matrix.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+Admin callers now exist for module on/off, plugin update/rollback/catalogue,
+webhook inspect/replay, SEO redirects, help-centre filing, payment plans,
+late fees, deposit/balance invoices, provider payouts, segment preview,
+automation run kill, update rollback, and messaging keyword/quiet-hour
+rules. Every former `PROOF_DEBT` item names its F04/F05/F07/F09/F12 proof.

package/dist/template/.changeset/f04-journey-screens.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Reviews now have an admin screen: list what came in, publish or hide or reject it, reply in public, and ask a customer once. Hiding still counts toward the rating; rejecting is for spam.
+
+You can start connecting a Google or Microsoft calendar from the calendar itself — including when a calendar says it needs reconnecting — and start connecting Gmail or Microsoft to read mail into the inbox.
+
+An accepted quote can be turned into the job and the invoices from the quote page. It asks first, because converting twice is refused.
+
+Guides and notifications are in the admin navigation, next to the screens that were already there.

package/dist/template/.changeset/faceted-browse-storefront-search.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Faceted storefront browse and product search — the shopper-facing half of the C3.24 parity mapping's G1 gap (C3.25 slice 2). One public service, `catalog.browseProducts`, powers both surfaces: filter/sort/pagination over live rows (active + public, the global search registry's participation rules) for a collection or a search term. Facet dimensions derive from the catalog's existing primitives with no new tables: option types/values, filterable attribute definitions (value counts; observed ranges for number/measure), an anonymous-mirror price (sale beats retail; audience-gated lists don't apply; half-open ladder bands), and per-product availability mirroring `catalog.availability`. Counts are conjunctive — a selected dimension reads the scope without its own filter. The collection page at `/c/<slug>` gains the filter panel and sort links; `/search` becomes the public product search. Filter state lives in query params per the SEO doctrine: facet links are crawlable anchors and GET forms (no client script), filtered views are noindexed with canonical on the clean address, and robots.txt covers the bracket grammar. Locales en/fr/es/ar.