create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/.changeset/first-party-plugin-surfaces.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Gift registries, print-on-demand, community spaces, voice/video recordings and
+marketplace channels now have admin screens, public join/contribute pages, and
+a retry path when the provider says no. Gift money and imported orders still
+land on ordinary invoices.

package/dist/template/.changeset/fork-lane.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+If you have modified Freeholder's code, updates now arrive as a merge instead
+of an image swap. Upstream is merged in a throwaway worktree, conflicts are
+reported file by file, and a pull request is opened in your own repository —
+your CI is the review. A conflict inside your own plugins, config or
+environment stops the lane rather than overwriting your copy. Drift is
+reported the way it matters: "2 security releases behind — CVSS 8.1", not a
+commit count.

package/dist/template/.changeset/form-builder.md

@@ -0,0 +1,26 @@
+---
+"freeholder": minor
+---
+
+You can now build a form in the admin. Forms → New form asks for a name and a
+web address, and then you add questions: the wording, what kind of answer it
+takes, whether it is required, an example and a hint. Questions can be
+reordered or removed, a dropdown takes its choices as a comma-separated list,
+and everything is saved in one go rather than question by question. Until now
+a form could only be created through the API, which meant the module was
+finished and the screen for it was not.
+
+Each question is stored under a short key, worked out from its wording — "What
+is your name?" becomes `name`. You can change that key while you are writing
+the question. Once somebody has answered it, you cannot: answers are stored
+under the key, so renaming it would leave every past answer stranded under a
+name nothing looks for any more. The field is locked at that point and says
+why. The web address is fixed for the same reason, once the form exists, since
+pages point at it.
+
+Editing a form no longer fails to open. The screen was asking for a form by
+its id through the lookup that takes a web address, so it returned nothing and
+errored; forms now have a lookup of their own for the admin to use. Validation
+problems on this screen also read as sentences now — "The field ... is a
+dropdown with no options" — instead of carrying the internal name of the
+service that rejected them.

package/dist/template/.changeset/forms-get-public-projection.md

@@ -0,0 +1,13 @@
+---
+"freeholder": patch
+---
+
+Security: `forms.get` is public and returned the whole form row, so any
+unauthenticated caller could read `notify` — the addresses a site's form
+submissions are e-mailed to. An owner who deliberately keeps their address off
+their site had it published through the API, and `contact` is the obvious slug
+to guess, so the addresses were harvestable across instances. The public service
+now has its own named projection in both its output schema and its query, so
+`notify` never leaves the database and a column added to the table later cannot
+leak the same way. Notification sending is unaffected; it reads the column
+through its own query. Reported by a third party building on Freeholder.

package/dist/template/.changeset/forms-module.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Your site can now take enquiries. Build a form in the admin, drop it onto any
+page, and what people send you arrives as a contact with the message on their
+timeline — the same person whether they write to you once or five times.
+Obvious spam is caught by two traps that ask your visitors to do nothing at
+all, and is held in a review queue rather than deleted, so a real enquiry
+wrongly flagged is one click from being rescued.

package/dist/template/.changeset/freeholder-app-init.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+"freeholder-app": minor
+---
+
+You can now point the customer app at your site with `npx freeholder-app init`
+and get icons, splash, store listing copy and placeholder screenshots from your
+branding — plus a readable diff of what changed in the app config. It does not
+ask for App Store or Play credentials; those come later, when you actually
+build the binary.

package/dist/template/.changeset/front-site-assistant.md

@@ -0,0 +1,29 @@
+---
+"freeholder": minor
+---
+
+An optional assistant that answers website chats for you.
+
+Turn it on in Admin → Assistant and it replies to visitors on your site in your
+business's name, in the same conversation you would have answered yourself — so
+everything it says lands in your inbox, on that person's history, and you can
+take over at any point.
+
+It is off until you switch it on, and it is off in a way that costs nothing:
+with no assistant, your chat works exactly as it did before.
+
+You stay in charge of three things:
+
+- **Who answers.** Pick your model provider and model. Your API key is never
+  stored in Freeholder — you tell it the name of the environment variable your
+  host keeps the key in, and the screen tells you whether it found it.
+- **What it may do.** The assistant can only talk unless you allow more. Today
+  it can hand a conversation to a person, and record a quote request against
+  the visitor's own contact record. Both are off until you allow them, and it
+  cannot reach anything that is not on that list.
+- **What it may spend.** Set a limit per day, week or month, plus a cap on
+  answers per conversation and per hour. Every limit is checked *before* an
+  answer, not added up afterwards, so it stops rather than overshoots.
+
+The Assistant screen also shows the last fifty attempts, refusals included, with
+what each one cost — so if it goes quiet you can see why rather than guess.

package/dist/template/.changeset/gallery-approval-rounds.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Agree a gallery in rounds. The client sends their choices, the owner approves
+or sends them back with a note, and sending back opens the next round while
+keeping the last one whole — what was chosen, what was said about it, and when.
+The client sees where the conversation stands without asking.

package/dist/template/.changeset/gallery-archive-delivery.md

@@ -0,0 +1,13 @@
+---
+"freeholder": minor
+---
+
+Hand a finished gallery over as one download. The client asks, a job packages
+the files the gallery's download policy actually permits — marked renditions
+for a watermarked gallery, web-sized where that is the policy — and the
+archive is served through their session. Two photographs sharing a filename
+stay two files, and a gallery too large for the format is refused rather than
+packaged wrong.
+
+Notifications carry the moments that matter: the gallery is ready, the client
+sent their choices, the round was approved.

package/dist/template/.changeset/gallery-download-policy.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Client galleries now honour their download policy. "Web-sized files" delivers a
+web rendition instead of the master, "original files" delivers the master, and
+a watermarked gallery shows and hands over the marked rendition — or nothing at
+all, rather than quietly falling back to the unmarked original.

package/dist/template/.changeset/gallery-partner-share.md

@@ -0,0 +1,8 @@
+---
+"freeholder": minor
+---
+
+Let a client share their proofing gallery with a partner, but only when the
+owner has allowed it. The invite is a scoped guest — view, not download —
+issued from the gallery they already opened, resolved as a Contact, and
+revocable by the client who sent it. Partners cannot invite anyone else.

package/dist/template/.changeset/gallery-proofing.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Let clients proof a gallery. Every photograph can be marked a favourite, a
+select or a reject, with a note for the photographer, from the same session
+that opened the gallery — so a magic-link guest can proof from a phone without
+an account. Guests see their own marks rather than the client's, and the owner
+sees everyone's together.

package/dist/template/.changeset/gallery-sales.md

@@ -0,0 +1,11 @@
+---
+"freeholder": minor
+---
+
+Sell prints and downloads from a client gallery. The photographer puts products
+on the gallery's price sheet, the client orders a specific photograph, and it
+goes through the ordinary cart and order — no second checkout to maintain.
+
+Two photographs ordered as the same print stay two lines rather than merging
+into one line of quantity two, and which gallery and which frame each line came
+from survives all the way onto the order.

package/dist/template/.changeset/gate-hardening.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+The machine gates now cover what they claimed to. A new colour gate bans Tailwind's raw palette and arbitrary colour values outside the token system across app, src and plugins — the one non-negotiable that had no lint rule. The money gate's division rule finally matches the codebase's own `*Minor` naming and now reaches server actions in `app/**/*.ts` and `plugins/**`. The merge-completeness test additionally scans for columns merely *named* like contact references, so a `contact_id` without a declared foreign key can no longer slip past, with deliberate exclusions documented in place. The licence gate records its Markdown exemption as a decision instead of skipping prose silently.

package/dist/template/.changeset/generate-alt-text-without-open-transactions.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+Generating an image description no longer ties up a database connection while
+Freeholder reads the preview or waits for the configured AI provider. Other
+work can continue normally during a slow model response. Freeholder rechecks
+the image bytes and authored description before saving the reviewable proposal,
+so an edit made while generation is running always wins.

package/dist/template/.changeset/graceful-job-shutdown.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+Own production termination through Next's manual signal contract, stop startup
+retries, and give pg-boss a bounded window to drain active job leases before
+the process exits. Document the supervisor grace period and keep the signal
+ownership contract in the fast repository gates.

package/dist/template/.changeset/help-centre.md

@@ -0,0 +1,16 @@
+---
+"freeholder": minor
+---
+
+Answer the same question once. The help centre is a knowledge base built from
+the pages you already know how to write — same editor, same languages, same SEO
+— so an article is a page you filed under a category rather than something you
+learn a second tool to publish.
+
+Readers search by typing a fragment of the problem, and the search looks inside
+the article, not only at its title. Each article asks whether it helped, with
+two buttons and no comment box, and the admin lists the articles people said did
+not help first — which is the one worth an afternoon.
+
+Deleting a category never deletes the writing in it: those articles stay
+published at the same address, simply uncategorised.

package/dist/template/.changeset/honest-error-states.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Admin pages no longer render infrastructure failures as plausible empty states. Optional reads (product variants, invoice/order customers, payment receipts, return detail, capture target lists) now treat a domain refusal as an absence and let a real failure surface, instead of `.catch(() => null)` telling the owner a product has no variants while the database is down. The marketplace seam records a new channel as `pending` rather than claiming `connected` with no provider behind it, presence heartbeats stop throwing unhandled rejections, and the one sanctioned second-transaction exception (`mail.completeOAuth`'s one-time state claim) is now documented where the rule lives.

package/dist/template/.changeset/host-executor-drills.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+The opt-in Docker host updater for the standard app/db/caddy recipe is now fully drill-tested end to end: the shipped `deploy/docker-selfhost/docker-updater/compose.yml` and `Caddyfile` give operators the exact recipe the executor inventories, and the refusal paths — wrong recipe shape, published app port, local media, mutable tags, missing signature identity, interrupted runs — each carry a host test proving the executor refuses instead of reporting success (C10.31).

package/dist/template/.changeset/host-image-identity.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Label published Docker images with their source commit and support an explicitly verified, digest-pinned baseline for the first host update from an older unlabelled image (C10.31). Public playground visitors can open the page editor, maintain edit presence and publish sample pages; real visitor page views are excluded from shared demo analytics. Contact pages omit scoring and conversation panels when the reader lacks access (C1.38, C7.05, C7.08).

package/dist/template/.changeset/host-updater-migration-lane.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Verified host update executors now cover migration-changing releases and the remaining hosting targets. The Docker host updater admits schema-changing candidates only behind an explicit `allow_schema_changes` opt-in: the rehearsal proves the migrations run against a restored backup, cutover holds maintenance for the whole window, and rollback restores the write-free cutover backup before repinning the previous image, because the previous image may not read a migrated schema. A new host updater brings the same discipline to systemd, source-pull and platform deploy-hook targets: digest-pinned immutable artifacts, optional exact-identity cosign verification, a backup hook that must produce a real file, and health-checked rollback that is independently re-verified before a run can call itself rolled back (C10.06).

package/dist/template/.changeset/http-api.md

@@ -0,0 +1,23 @@
+---
+"freeholder": minor
+---
+
+Your site now has an API, and it covers everything. Anything you can do in the
+admin, a script or an AI agent can do with a key: every one of the platform's
+capabilities is reachable at `/api/v1/<name>` — `contacts.create`,
+`locations.list`, `cms.publishPage` — with the same permission checks, the same
+validation and the same activity log as the buttons in your admin.
+
+There is no separate list of what the API supports, which is the point. The API
+is generated from the platform's own capabilities, so a feature that exists is
+a feature the API has. Nothing can be built and then forgotten about here.
+
+Your instance also publishes its own documentation at `/api/openapi.json`,
+generated the same way. It describes exactly what *your* site can do — your
+modules, your plugins, this version — rather than what some generic
+documentation page says a Freeholder can do. Point a developer or an AI agent
+at it and they get current, accurate ground truth, including which key access
+each call needs.
+
+Anything that changes data has to be sent as a POST, so nothing on your site
+can be altered by a link, a page preview or an image tag.

package/dist/template/.changeset/http-edge-auth-routes.md

@@ -0,0 +1,14 @@
+---
+"freeholder": minor
+---
+
+The platform now answers over the web. You can create the owner account on a
+fresh install, sign in, stay signed in as you browse, and sign out — and
+signing out ends your own session and leaves your other devices alone.
+
+Your sign-in is kept in a cookie your browser will not hand to any script and
+will not send to another website, and it renews itself while you are working
+rather than logging you out mid-task. A wrong password, a request you are not
+allowed to make, and a genuine fault are each answered distinctly, so the site
+can tell you to log in when that is the problem and stop pretending everything
+is fine when it is not.

package/dist/template/.changeset/ics-and-calendar-writeback.md

@@ -0,0 +1,19 @@
+---
+"freeholder": minor
+---
+
+Your calendar now goes both ways. Every booking calendar gets a subscribable
+.ics link you can paste into Apple Calendar, Google, Outlook or anything else
+that reads a feed — rotatable in one click if it ever leaks — and every
+confirmed appointment carries an attachment the customer can add to their own
+diary, including a cancellation that removes it again. You can also block your
+availability from any .ics feed somebody else publishes, so a calendar you
+don't own still keeps you from being booked over. None of this needs a
+connected account.
+
+For owners who have connected Google or Microsoft, appointments now appear on
+the real calendar, move when they are rescheduled and disappear when they are
+cancelled — only on calendars you marked bookable, and only with calendar
+writing switched on. Freeholder writes the bookings it made and nothing else.
+An appointment that syncs back as busy time is recognised as its own
+reflection, so it never blocks its own hour twice.

package/dist/template/.changeset/ics-feed-500.md

@@ -0,0 +1,7 @@
+---
+"freeholder": patch
+---
+
+Fixed subscribable calendar feeds returning an error instead of your diary. The
+`.ics` links and the `/source` provenance endpoint failed on a cold server even
+with a perfectly valid link; both now work on the first request.

package/dist/template/.changeset/import-replace-rollback.md

@@ -0,0 +1,5 @@
+---
+"freeholder": patch
+---
+
+Rolling back a site import restores pages it replaced instead of deleting the originals.

package/dist/template/.changeset/inbox.md

@@ -0,0 +1,24 @@
+---
+"freeholder": minor
+---
+
+One inbox for everything anybody has said to you. Emails, texts, contact form
+submissions and chat all land in the same list, threaded by person rather than
+scattered across four places to check.
+
+Four things you can do to a conversation, and that is deliberately all: say
+whose it is, put it away until a date, close it, or reply. No folders to
+maintain, no labels to invent — this is a list of what is waiting, not a second
+email client to learn.
+
+Put something away for Tuesday and it comes back on Tuesday, marked unread, as
+though nobody had touched it. That is the whole promise of snoozing, and the
+version that quietly never returns is just closing with extra steps.
+
+Replies go out the way the person got in touch, so whoever texted you gets a
+text back and nobody has to pick. If a channel is not connected yet, it says so
+rather than filing a reply that never left.
+
+Search finds a conversation by a fragment of what was actually said — half a
+word is enough — or by who said it. Tick several and close, hand over or snooze
+them together.

package/dist/template/.changeset/intake-waivers-and-reminders.md

@@ -0,0 +1,26 @@
+---
+"freeholder": minor
+---
+
+Some appointments need something done before they are really on. A service can
+now ask for an intake form and a signed waiver, and Freeholder will take the
+booking, hold the slot, and simply decline to confirm it until both are done —
+because a customer who cannot book until they have signed something is a
+customer who leaves. You can always confirm it anyway; somebody who signed on
+paper in front of you has met the requirement.
+
+Waivers are properly signed, not ticked. The customer reads the actual words,
+types their own name, and Freeholder records who signed, when, from where and
+with what, along with a fingerprint of the exact text — so editing your waiver
+next month changes nothing about what somebody agreed to last month. Signing
+happens once and the link stops working afterwards.
+
+Reminders arrive on their own. Confirming an appointment schedules them — the
+day before and two hours before by default, and you can set your own — and
+every one is recorded: sent, or not sent and exactly why. Moving an appointment
+moves its reminders; cancelling one stops them. Text reminders are held back
+until Freeholder owns the messaging side properly, and say so rather than
+failing quietly.
+
+Customers do all of this from the link in their email. No account, no password,
+and nothing to ask you for.

package/dist/template/.changeset/internal-service-boundary.md

@@ -0,0 +1,9 @@
+---
+"freeholder": patch
+---
+
+Keep scheduler, briefing-contributor, provider-webhook, notification, and
+lifecycle-maintenance services inside the platform. They can still compose
+through the audited service registry, but anonymous callers and API keys now
+see the same 404 as an unknown service, and the operations no longer appear in
+OpenAPI, SDK/LLM projections, API-key scope choices, or MCP discovery.

package/dist/template/.changeset/job-operations.md

@@ -0,0 +1,14 @@
+---
+"freeholder": minor
+---
+
+Add an owner-visible background-work ledger backed directly by retained
+pg-boss runs. Owners can filter queue history, inspect recursively redacted
+payloads and outputs, see retry/lease/lifecycle evidence, and receive overview
+warnings for failed, dead-lettered, or lease-overdue work.
+
+Every ordinary queue now routes exhausted work to a 90-day dead-letter queue
+that preserves its source identity. Step-up-protected, typed-confirmation
+controls cancel eligible work, retry retained failed/cancelled runs, or redrive
+a diagnosed dead letter through audited service transactions. Agents and API
+keys cannot inspect the cross-module payload ledger.

package/dist/template/.changeset/job-runtime-health.md

@@ -0,0 +1,9 @@
+---
+"freeholder": minor
+---
+
+Require durable current-version worker heartbeats for readiness, separate the
+process liveness probe, expose payload-free queue lag and degraded state, and
+make Doctor verify the live worker rather than the in-memory job registry.
+Retry dependency-bound startup without sacrificing process liveness, and keep
+the Node bootstrap outside Next's Edge instrumentation dependency graph.

package/dist/template/.changeset/leftover-f04.md

@@ -0,0 +1,8 @@
+---
+"freeholder": patch
+---
+
+Admin can now update events and newsletters, edit a deal on the pipeline
+board, offer gallery prints from the catalog, publish a product draft,
+grant digital downloads, release stock holds, and map/review import
+conflicts before commit.

package/dist/template/.changeset/light-and-dark.md

@@ -0,0 +1,12 @@
+---
+"freeholder": minor
+---
+
+Light and dark are both standard now, everywhere. Choose one or leave it on
+"match system" and your device decides — and if you leave it on system, it
+keeps following your device when you change that later, rather than freezing
+whatever it was the first time you visited.
+
+Your choice is remembered and applied before the page is drawn, so a dark site
+never flashes white while it loads, and the scrollbars and dropdowns your
+browser draws match the theme too. The switch works with JavaScript turned off.

package/dist/template/.changeset/living-contract.md

@@ -0,0 +1,5 @@
+---
+"freeholder": minor
+---
+
+The live contract now describes errors, auth, webhook envelopes and a version. Agents discover only tools they can call, plus resources and prompts from the same registry. The SDK is a real HTTP client. Webhook deliveries can be inspected (secrets redacted), replayed, and pointed at a new URL.

package/dist/template/.changeset/locale-driven-customer-surfaces.md

@@ -0,0 +1,14 @@
+---
+"freeholder": minor
+---
+
+Make customer locale selection consistent across the public site, portal,
+transactional templates and notifications. Public links now retain the
+selected path prefix, while a signed-in customer's linked Contact preference
+drives portal rendering, magic-link mail, notification catalog copy, localized
+action links and digest wrappers.
+
+Add keyboard-native public and portal language choosers, independently
+editable locale variants for CMS header/footer sections, coherent source
+chrome fallback, localized public-form boilerplate, and an additive migration
+that snapshots recipient locales and upgrades existing header block data.

package/dist/template/.changeset/locale-routing.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Your site can now be published in more than one language. Translated pages live
+at an address like `/fr-CA/services`, they stay the same page — same link, same
+place in your menu — and a visitor who lands on a page you have not translated
+yet reads it in your own language instead of hitting a dead end. A language
+switcher appears in your site's footer as soon as a second language is turned
+on, and search engines are told which languages exist for which pages.

package/dist/template/.changeset/locations-and-nap.md

@@ -0,0 +1,29 @@
+---
+"freeholder": minor
+---
+
+Your address, phone number and opening hours now live in one place, and
+everywhere they appear on your site comes from that one place. Add them under
+Locations in the admin, or during setup, and they show up in your footer, in
+your site's structured data for search engines, and on a page of their own at
+/locations. Change them once and every one of those follows.
+
+That last part matters more than it sounds. Search engines decide whether to
+trust a local business partly by checking whether the address on its website
+matches the address in directories — and "Unit 3, 210 Fifth St" against
+"210 5th Street #3" reads as two different businesses. Freeholder writes your
+address exactly one way, everywhere, so it cannot drift apart over time.
+
+Opening hours understand the difference between "closed on Sunday" and "we
+haven't said anything about Sunday". Only the first is something a search
+result can tell a customer, so state a closure rather than leaving the day
+blank. Addresses are written the way each country writes them: a French
+address puts the postcode before the town, a British one gives the postcode
+its own line.
+
+If you travel to your customers rather than the other way round, you can say
+which areas you cover — either everywhere within a distance of a point, or a
+list of named places — and keep your street address off the site entirely.
+
+If you work online and have no address at all, skip it. Nothing appears on
+your site, and no empty address block turns up in your footer.

package/dist/template/.changeset/loyalty-points.md

@@ -0,0 +1,17 @@
+---
+"freeholder": minor
+---
+
+Run a loyalty programme where every point can be explained. Points are a
+ledger rather than a number, so "I had 400 stars last week" is a question with
+an answer: the balance is the sum of its rows, and a customer can see every one
+of them — what earned it, when, and which order it came from.
+
+Earning happens by watching the customer's own history, so nothing in your shop
+or your booking calendar has to know the programme exists. A refund takes the
+points back by writing the reversal next to the original rather than by quietly
+editing the past.
+
+Points never expire without notice — the programme refuses to be configured
+that way — and the owner can see, at any moment, what the outstanding points
+would cost if everybody spent them tomorrow.

package/dist/template/.changeset/loyalty-tiers-rewards.md

@@ -0,0 +1,20 @@
+---
+"freeholder": minor
+---
+
+Give loyalty points something to buy, and status levels worth reaching.
+
+Rewards are redeemed into a real coupon your shop already honours at checkout —
+not a discount the loyalty screen invented and nothing else understands. Where
+a reward is something no code can hand over on its own, like a framed print,
+the redemption says it needs issuing by hand rather than pretending it is done
+and leaving the customer to find out at the till.
+
+Status levels are worked out from the same history that explains the balance,
+so nobody is in a tier their own record does not justify, and spending points
+never costs somebody their standing. Promotions and demotions appear on the
+customer's timeline.
+
+Redeeming checks everything before it takes anything: the balance, the stock,
+the per-person limit, the tier, and how old the account is — points farmed and
+cashed out the same hour is a pattern you can now set a floor against.

package/dist/template/.changeset/mail-adapter-completion.md

@@ -0,0 +1,20 @@
+---
+"freeholder": minor
+---
+
+Complete account and broadcast mail delivery. Gmail and Microsoft mailboxes
+connect through least-privilege delegated OAuth; SMTP remains an account-mail
+option; Resend, Postmark and Amazon SES provide the broadcast route with
+authenticated delivery, bounce and complaint feedback.
+
+Admin Settings now shows both routes, sender verification and reconnect
+health, default/pause/test controls, recent delivery evidence, and exact-address
+suppression release in English, French and Spanish. First-run setup and doctor
+report secret-free configured, pending, missing and broken states without
+making a real or billable provider send.
+
+Password resets, portal links, invitations, security notices and form
+notifications share one delivery path. Message bodies and raw webhook payloads
+are never retained; provider effects are idempotent and non-regressive, and
+permanent bounces or complaints suppress the address until a person verifies
+and releases it.

package/dist/template/.changeset/mail-and-reset.md

@@ -0,0 +1,10 @@
+---
+"freeholder": minor
+---
+
+Forgotten passwords can be reset by email now: ask for a link from the sign-in
+screen, choose a new password, and every device is signed out. If your site has
+no email set up yet it says so plainly rather than leaving you waiting for a
+message that is not coming. Freeholder can also send through your own mail
+server, which is what makes the new-enquiry notifications on your forms
+actually arrive.

package/dist/template/.changeset/mail-contacts.md

@@ -0,0 +1,28 @@
+---
+"freeholder": minor
+---
+
+You can connect a Gmail or Microsoft mailbox now, and Freeholder will learn who
+has been in touch.
+
+It reads headers only — who wrote, when, and the subject line. It never asks
+your provider for a message body, so there is no body for it to store, show or
+lose. It is not becoming a mail client: there is no inbox, no folders, no
+compose screen.
+
+What you get is the thing that was missing: the enquiry from three months ago
+sits on the same timeline as the invoice. A correspondent becomes a contact
+through the same door everything else uses, so connecting a mailbox does not
+create a second address book — and if someone writes from a new address, they
+go to your duplicate queue rather than being merged on a guess.
+
+A name from an email header only ever fills a blank. It cannot rename someone
+you have already named, whatever the sender put in their display name.
+
+Subject lines are stored only for a mailbox you have explicitly shared with the
+business. Connect your own mail and Freeholder learns who you correspond with,
+not what about.
+
+Connecting to read is a separate, read-only permission from connecting to send.
+Neither one grants the other, and a mailbox is read by the person who connected
+it — managing connections is not the same as reading someone's mail.

package/dist/template/.changeset/mail-delivery-boundary.md

@@ -0,0 +1,10 @@
+---
+"freeholder": patch
+---
+
+Queue account and campaign email only after encrypting its short-lived message
+body, so a slow mail provider can no longer hold open or roll back the business
+transaction that asked for it. Delivery retries keep stable evidence without
+putting message bodies or credentials in job data, and discard the encrypted
+copy after submission, terminal failure, suppression, or the retention limit.
+Sender-verification checks now use the same post-commit worker boundary.